diff --git a/.codecov.yml b/.codecov.yml
new file mode 100644
index 000000000..704499c3d
--- /dev/null
+++ b/.codecov.yml
@@ -0,0 +1,18 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2021-05-20T15:00:42Z by kres adb52e5-dirty.
+
+codecov:
+  require_ci_to_pass: false
+
+coverage:
+  status:
+    project:
+      default:
+        target: 50%
+        threshold: 0.5%
+        base: auto
+        if_ci_failed: success
+    patch: off
+
+comment: false
diff --git a/.conform.yaml b/.conform.yaml
new file mode 100644
index 000000000..eca30dab1
--- /dev/null
+++ b/.conform.yaml
@@ -0,0 +1,88 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2024-02-23T20:48:03Z by kres 38f172c.
+
+policies:
+  - type: commit
+    spec:
+      dco: true
+      gpg:
+        required: true
+        identity:
+          gitHubOrganization: siderolabs
+      spellcheck:
+        locale: US
+      maximumOfOneCommit: true
+      header:
+        length: 89
+        imperative: true
+        case: lower
+        invalidLastCharacters: .
+      body:
+        required: true
+      conventional:
+        types:
+          - chore
+          - docs
+          - perf
+          - refactor
+          - style
+          - test
+          - release
+        scopes:
+          - .*
+  - type: license
+    spec:
+      root: .
+      skipPaths:
+        - .git
+        - testdata/
+        - client/
+        - frontend/node_modules/
+        - internal/pkg/kubernetes/resource/
+      includeSuffixes:
+        - .go
+        - .ts
+        - .js
+      excludeSuffixes:
+        - .pb.go
+        - .pb.gw.go
+        - .pb.ts
+        - babel.config.js
+      header: |
+        // Copyright (c) 2024 Sidero Labs, Inc.
+        //
+        // Use of this software is governed by the Business Source License
+        // included in the LICENSE file.
+  - type: license
+    spec:
+      root: client
+      skipPaths:
+        - .git/
+        - testdata/
+      includeSuffixes:
+        - .go
+      excludeSuffixes:
+        - .pb.go
+        - .pb.gw.go
+      header: |
+        // This Source Code Form is subject to the terms of the Mozilla Public
+        // License, v. 2.0. If a copy of the MPL was not distributed with this
+        // file, You can obtain one at http://mozilla.org/MPL/2.0/
+  - type: license
+    spec:
+      root: frontend/
+      skipPaths:
+        - node_modules/
+      includeSuffixes:
+        - .vue
+      excludeSuffixes:
+        - .pb.go
+        - .pb.gw.go
+      header: |
+        <!--
+        Copyright (c) 2024 Sidero Labs, Inc.
+
+        Use of this software is governed by the Business Source License
+        included in the LICENSE file.
+        -->
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 000000000..20d3edba1
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,29 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2024-02-26T21:35:48Z by kres latest.
+
+*
+!frontend/src
+!frontend/tests
+!frontend/public
+!client/api
+!client/pkg
+!cmd
+!internal
+!docs
+!frontend/*.json
+!frontend/*.js
+!frontend/.eslintrc.yaml
+!internal/frontend/frontend.go
+!client/go.mod
+!client/go.sum
+!go.mod
+!go.sum
+!client/.golangci.yml
+!.golangci.yml
+!CHANGELOG.md
+!CONTRIBUTING.md
+!DEVELOPMENT.md
+!README.md
+!.markdownlint.json
+!.license-header.go.txt
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yaml b/.github/ISSUE_TEMPLATE/bug_report.yaml
new file mode 100644
index 000000000..64acd5792
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yaml
@@ -0,0 +1,56 @@
+name: 🐞 Bug
+description: File a bug/issue
+title: "[bug] <title>"
+labels: [bug, needs triage]
+body:
+- type: checkboxes
+  attributes:
+    label: Is there an existing issue for this?
+    description: Please search to see if an issue already exists for the bug you encountered.
+    options:
+    - label: I have searched the existing issues
+      required: true
+- type: textarea
+  attributes:
+    label: Current Behavior
+    description: A concise description of what you're experiencing.
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Expected Behavior
+    description: A concise description of what you expected to happen.
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Steps To Reproduce
+    description: Steps to reproduce the behavior.
+    placeholder: |
+      1. In this environment...
+      2. With this config...
+      3. Run '...'
+      4. See error...
+  validations:
+    required: true
+- type: dropdown
+  id: browsers
+  attributes:
+      label: What browsers are you seeing the problem on?
+      multiple: true
+      options:
+        - Firefox
+        - Chrome
+        - Safari
+        - Microsoft Edge
+  validations:
+    required: false
+- type: textarea
+  attributes:
+    label: Anything else?
+    description: |
+      Links? References? Anything that will give us more context about the issue you are encountering!
+
+      Tip: You can attach images or log files by clicking this area to highlight it and then dragging files in.
+  validations:
+    required: false
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yaml b/.github/ISSUE_TEMPLATE/feature_request.yaml
new file mode 100644
index 000000000..d7e4adeaa
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yaml
@@ -0,0 +1,33 @@
+name: 🔧 Feature request
+description: Suggest an idea for this project
+title: "[feature] <title>"
+labels: [feature]
+body:
+- type: textarea
+  attributes:
+    label: Problem Description
+    description: Is your feature request related to a problem? Please describe.
+    placeholder: A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+  validations:
+    required: true
+- type: textarea
+  attributes:
+    label: Solution
+    description: Describe the solution you'd like
+    placeholder: A clear and concise description of what you want to happen.
+  validations:
+    required: false
+- type: textarea
+  attributes:
+    label: Alternative Solutions
+    description: Describe alternatives you've considered
+    placeholder: A clear and concise description of any alternative solutions or features you've considered.
+  validations:
+    required: false
+- type: textarea
+  attributes:
+    label: Notes
+    description: Additional context
+    placeholder: Add any other context or screenshots about the feature request here.
+  validations:
+    required: false
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 000000000..9f305fb49
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,439 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2024-02-28T11:30:58Z by kres latest.
+
+name: default
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+"on":
+  push:
+    branches:
+      - main
+      - release-*
+    tags:
+      - v*
+  pull_request:
+    branches:
+      - main
+      - release-*
+jobs:
+  default:
+    permissions:
+      actions: read
+      contents: write
+      issues: read
+      packages: write
+      pull-requests: read
+    runs-on:
+      - self-hosted
+      - generic
+    if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/'))
+    outputs:
+      labels: ${{ steps.retrieve-pr-labels.outputs.result }}
+    services:
+      buildkitd:
+        image: moby/buildkit:v0.12.5
+        options: --privileged
+        ports:
+          - 1234:1234
+        volumes:
+          - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
+          - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: Unshallow
+        run: |
+          git fetch --prune --unshallow
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: remote
+          endpoint: tcp://localhost:1234
+        timeout-minutes: 1
+      - name: js
+        run: |
+          make js
+      - name: unit-tests-frontend
+        run: |
+          make unit-tests-frontend
+      - name: frontend
+        run: |
+          make frontend
+      - name: base
+        run: |
+          make base
+      - name: unit-tests-client
+        run: |
+          make unit-tests-client
+      - name: unit-tests-client-race
+        run: |
+          make unit-tests-client-race
+      - name: unit-tests
+        run: |
+          make unit-tests
+      - name: unit-tests-race
+        run: |
+          make unit-tests-race
+      - name: omni
+        run: |
+          make omni
+      - name: lint
+        run: |
+          make lint
+      - name: Login to registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+      - name: image-omni
+        run: |
+          make image-omni
+      - name: push-omni
+        if: github.event_name != 'pull_request'
+        env:
+          PUSH: "true"
+        run: |
+          make image-omni
+      - name: push-omni-latest
+        if: github.event_name != 'pull_request'
+        env:
+          PUSH: "true"
+        run: |
+          make image-omni TAG=latest
+      - name: omni-integration-test
+        run: |
+          make omni-integration-test
+      - name: omnictl
+        run: |
+          make omnictl
+      - name: run-integration-test
+        env:
+          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
+          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
+          INTEGRATION_RUN_E2E_TEST: "true"
+          INTEGRATION_TEST_ARGS: --test.run CleanState/|Auth/|DefaultCluster/
+          WITH_DEBUG: "true"
+        run: |
+          sudo -E make run-integration-test
+      - name: Retrieve PR labels
+        id: retrieve-pr-labels
+        uses: actions/github-script@v7
+        with:
+          retries: "3"
+          script: |
+            if (context.eventName != "pull_request") { return "[]" }
+
+            const resp = await github.rest.issues.get({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+            })
+
+            return resp.data.labels.map(label => label.name)
+      - name: Generate executable list
+        run: |
+          find _out -type f -executable > _out/executable-artifacts
+      - name: save-artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: artifacts
+          path: |-
+            _out
+            !_out/etcd
+            !_out/secondary-storage/**
+          retention-days: "5"
+      - name: save-talos-logs-artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: talos-logs
+          path: ~/.talos/clusters/**/*.log
+          retention-days: "5"
+      - name: Generate Checksums
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          sha256sum _out/omnictl-* _out/omni-* > _out/sha256sum.txt
+          sha512sum _out/omnictl-* _out/omni-* > _out/sha512sum.txt
+      - name: release-notes
+        if: startsWith(github.ref, 'refs/tags/')
+        run: |
+          make release-notes
+      - name: Release
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: crazy-max/ghaction-github-release@v2
+        with:
+          body_path: _out/RELEASE_NOTES.md
+          draft: "true"
+          files: |-
+            _out/omnictl-*
+            _out/omni-*
+            _out/sha*.txt
+  e2e-backups:
+    runs-on:
+      - self-hosted
+      - omni
+    if: contains(fromJSON(needs.default.outputs.labels), 'integration/e2e') || contains(fromJSON(needs.default.outputs.labels), 'integration/e2e-backups')
+    needs:
+      - default
+    services:
+      buildkitd:
+        image: moby/buildkit:v0.12.5
+        options: --privileged
+        ports:
+          - 1234:1234
+        volumes:
+          - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
+          - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: Unshallow
+        run: |
+          git fetch --prune --unshallow
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: remote
+          endpoint: tcp://localhost:1234
+        timeout-minutes: 1
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: artifacts
+          path: _out
+      - name: Fix artifact permissions
+        run: |
+          xargs -a _out/executable-artifacts -I {} chmod +x {}
+      - name: run-integration-test
+        env:
+          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
+          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: --test.run CleanState/|EtcdBackupAndRestore
+          WITH_DEBUG: "true"
+        run: |
+          sudo -E make run-integration-test
+      - name: save-talos-logs-artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: talos-logs-e2e-backups
+          path: ~/.talos/clusters/**/*.log
+          retention-days: "5"
+        continue-on-error: true
+  e2e-scaling:
+    runs-on:
+      - self-hosted
+      - omni
+    if: contains(fromJSON(needs.default.outputs.labels), 'integration/e2e') || contains(fromJSON(needs.default.outputs.labels), 'integration/e2e-scaling')
+    needs:
+      - default
+    services:
+      buildkitd:
+        image: moby/buildkit:v0.12.5
+        options: --privileged
+        ports:
+          - 1234:1234
+        volumes:
+          - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
+          - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: Unshallow
+        run: |
+          git fetch --prune --unshallow
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: remote
+          endpoint: tcp://localhost:1234
+        timeout-minutes: 1
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: artifacts
+          path: _out
+      - name: Fix artifact permissions
+        run: |
+          xargs -a _out/executable-artifacts -I {} chmod +x {}
+      - name: run-integration-test
+        env:
+          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
+          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: --test.run CleanState/|ScaleUpAndDown/|ScaleUpAndDownMachineClassBasedMachineSets/|RollingUpdateParallelism/|ForcedMachineRemoval/|ReplaceControlPlanes/|ConfigPatching/
+          WITH_DEBUG: "true"
+        run: |
+          sudo -E make run-integration-test
+      - name: save-talos-logs-artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: talos-logs-e2e-scaling
+          path: ~/.talos/clusters/**/*.log
+          retention-days: "5"
+        continue-on-error: true
+  e2e-short:
+    runs-on:
+      - self-hosted
+      - omni
+    if: contains(fromJSON(needs.default.outputs.labels), 'integration/e2e') || contains(fromJSON(needs.default.outputs.labels), 'integration/e2e-short')
+    needs:
+      - default
+    services:
+      buildkitd:
+        image: moby/buildkit:v0.12.5
+        options: --privileged
+        ports:
+          - 1234:1234
+        volumes:
+          - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
+          - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: Unshallow
+        run: |
+          git fetch --prune --unshallow
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: remote
+          endpoint: tcp://localhost:1234
+        timeout-minutes: 1
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: artifacts
+          path: _out
+      - name: Fix artifact permissions
+        run: |
+          xargs -a _out/executable-artifacts -I {} chmod +x {}
+      - name: run-integration-test
+        env:
+          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
+          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: --test.run CleanState/|TalosImageGeneration/|ImmediateClusterDestruction/|DefaultCluster/|EncryptedCluster/|SinglenodeCluster/|Auth/
+          WITH_DEBUG: "true"
+        run: |
+          sudo -E make run-integration-test
+      - name: save-talos-logs-artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: talos-logs-e2e-short
+          path: ~/.talos/clusters/**/*.log
+          retention-days: "5"
+        continue-on-error: true
+  e2e-templates:
+    runs-on:
+      - self-hosted
+      - omni
+    if: contains(fromJSON(needs.default.outputs.labels), 'integration/e2e') || contains(fromJSON(needs.default.outputs.labels), 'integration/e2e-templates')
+    needs:
+      - default
+    services:
+      buildkitd:
+        image: moby/buildkit:v0.12.5
+        options: --privileged
+        ports:
+          - 1234:1234
+        volumes:
+          - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
+          - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: Unshallow
+        run: |
+          git fetch --prune --unshallow
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: remote
+          endpoint: tcp://localhost:1234
+        timeout-minutes: 1
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: artifacts
+          path: _out
+      - name: Fix artifact permissions
+        run: |
+          xargs -a _out/executable-artifacts -I {} chmod +x {}
+      - name: run-integration-test
+        env:
+          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
+          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: --test.run CleanState/|ClusterTemplate/
+          WITH_DEBUG: "true"
+        run: |
+          sudo -E make run-integration-test
+      - name: save-talos-logs-artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: talos-logs-e2e-templates
+          path: ~/.talos/clusters/**/*.log
+          retention-days: "5"
+        continue-on-error: true
+  e2e-upgrades:
+    runs-on:
+      - self-hosted
+      - omni
+    if: contains(fromJSON(needs.default.outputs.labels), 'integration/e2e') || contains(fromJSON(needs.default.outputs.labels), 'integration/e2e-upgrades')
+    needs:
+      - default
+    services:
+      buildkitd:
+        image: moby/buildkit:v0.12.5
+        options: --privileged
+        ports:
+          - 1234:1234
+        volumes:
+          - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
+          - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: Unshallow
+        run: |
+          git fetch --prune --unshallow
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: remote
+          endpoint: tcp://localhost:1234
+        timeout-minutes: 1
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: artifacts
+          path: _out
+      - name: Fix artifact permissions
+        run: |
+          xargs -a _out/executable-artifacts -I {} chmod +x {}
+      - name: run-integration-test
+        env:
+          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
+          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: --test.run CleanState/|TalosUpgrades/|KubernetesUpgrades/|MaintenanceDowngrade/
+          WITH_DEBUG: "true"
+        run: |
+          sudo -E make run-integration-test
+      - name: save-talos-logs-artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: talos-logs-e2e-upgrades
+          path: ~/.talos/clusters/**/*.log
+          retention-days: "5"
+        continue-on-error: true
diff --git a/.github/workflows/e2e-backups-cron.yaml b/.github/workflows/e2e-backups-cron.yaml
new file mode 100644
index 000000000..bebae109b
--- /dev/null
+++ b/.github/workflows/e2e-backups-cron.yaml
@@ -0,0 +1,53 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2024-02-28T11:30:58Z by kres latest.
+
+name: e2e-backups-cron
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+"on":
+  schedule:
+    - cron: 30 1 * * *
+jobs:
+  default:
+    runs-on:
+      - self-hosted
+      - omni
+    services:
+      buildkitd:
+        image: moby/buildkit:v0.12.5
+        options: --privileged
+        ports:
+          - 1234:1234
+        volumes:
+          - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
+          - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: Unshallow
+        run: |
+          git fetch --prune --unshallow
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: remote
+          endpoint: tcp://localhost:1234
+        timeout-minutes: 1
+      - name: run-integration-test
+        env:
+          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
+          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: --test.run CleanState/|EtcdBackupAndRestore
+          WITH_DEBUG: "true"
+        run: |
+          sudo -E make run-integration-test
+      - name: save-talos-logs-artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: talos-logs
+          path: ~/.talos/clusters/**/*.log
+          retention-days: "5"
diff --git a/.github/workflows/e2e-scaling-cron.yaml b/.github/workflows/e2e-scaling-cron.yaml
new file mode 100644
index 000000000..13c61eb1e
--- /dev/null
+++ b/.github/workflows/e2e-scaling-cron.yaml
@@ -0,0 +1,53 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2024-02-28T11:30:58Z by kres latest.
+
+name: e2e-scaling-cron
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+"on":
+  schedule:
+    - cron: 30 1 * * *
+jobs:
+  default:
+    runs-on:
+      - self-hosted
+      - omni
+    services:
+      buildkitd:
+        image: moby/buildkit:v0.12.5
+        options: --privileged
+        ports:
+          - 1234:1234
+        volumes:
+          - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
+          - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: Unshallow
+        run: |
+          git fetch --prune --unshallow
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: remote
+          endpoint: tcp://localhost:1234
+        timeout-minutes: 1
+      - name: run-integration-test
+        env:
+          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
+          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: --test.run CleanState/|ScaleUpAndDown/|ScaleUpAndDownMachineClassBasedMachineSets/|RollingUpdateParallelism/|ForcedMachineRemoval/|ReplaceControlPlanes/|ConfigPatching/
+          WITH_DEBUG: "true"
+        run: |
+          sudo -E make run-integration-test
+      - name: save-talos-logs-artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: talos-logs
+          path: ~/.talos/clusters/**/*.log
+          retention-days: "5"
diff --git a/.github/workflows/e2e-short-cron.yaml b/.github/workflows/e2e-short-cron.yaml
new file mode 100644
index 000000000..fc42ab94a
--- /dev/null
+++ b/.github/workflows/e2e-short-cron.yaml
@@ -0,0 +1,53 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2024-02-28T11:30:58Z by kres latest.
+
+name: e2e-short-cron
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+"on":
+  schedule:
+    - cron: 30 1 * * *
+jobs:
+  default:
+    runs-on:
+      - self-hosted
+      - omni
+    services:
+      buildkitd:
+        image: moby/buildkit:v0.12.5
+        options: --privileged
+        ports:
+          - 1234:1234
+        volumes:
+          - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
+          - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: Unshallow
+        run: |
+          git fetch --prune --unshallow
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: remote
+          endpoint: tcp://localhost:1234
+        timeout-minutes: 1
+      - name: run-integration-test
+        env:
+          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
+          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: --test.run CleanState/|TalosImageGeneration/|ImmediateClusterDestruction/|DefaultCluster/|EncryptedCluster/|SinglenodeCluster/|Auth/
+          WITH_DEBUG: "true"
+        run: |
+          sudo -E make run-integration-test
+      - name: save-talos-logs-artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: talos-logs
+          path: ~/.talos/clusters/**/*.log
+          retention-days: "5"
diff --git a/.github/workflows/e2e-templates-cron.yaml b/.github/workflows/e2e-templates-cron.yaml
new file mode 100644
index 000000000..e9565e9d3
--- /dev/null
+++ b/.github/workflows/e2e-templates-cron.yaml
@@ -0,0 +1,53 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2024-02-28T11:30:58Z by kres latest.
+
+name: e2e-templates-cron
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+"on":
+  schedule:
+    - cron: 30 1 * * *
+jobs:
+  default:
+    runs-on:
+      - self-hosted
+      - omni
+    services:
+      buildkitd:
+        image: moby/buildkit:v0.12.5
+        options: --privileged
+        ports:
+          - 1234:1234
+        volumes:
+          - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
+          - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: Unshallow
+        run: |
+          git fetch --prune --unshallow
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: remote
+          endpoint: tcp://localhost:1234
+        timeout-minutes: 1
+      - name: run-integration-test
+        env:
+          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
+          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: --test.run CleanState/|ClusterTemplate/
+          WITH_DEBUG: "true"
+        run: |
+          sudo -E make run-integration-test
+      - name: save-talos-logs-artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: talos-logs
+          path: ~/.talos/clusters/**/*.log
+          retention-days: "5"
diff --git a/.github/workflows/e2e-upgrades-cron.yaml b/.github/workflows/e2e-upgrades-cron.yaml
new file mode 100644
index 000000000..dca883343
--- /dev/null
+++ b/.github/workflows/e2e-upgrades-cron.yaml
@@ -0,0 +1,53 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2024-02-28T11:30:58Z by kres latest.
+
+name: e2e-upgrades-cron
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+"on":
+  schedule:
+    - cron: 30 1 * * *
+jobs:
+  default:
+    runs-on:
+      - self-hosted
+      - omni
+    services:
+      buildkitd:
+        image: moby/buildkit:v0.12.5
+        options: --privileged
+        ports:
+          - 1234:1234
+        volumes:
+          - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
+          - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: Unshallow
+        run: |
+          git fetch --prune --unshallow
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: remote
+          endpoint: tcp://localhost:1234
+        timeout-minutes: 1
+      - name: run-integration-test
+        env:
+          AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
+          AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: --test.run CleanState/|TalosUpgrades/|KubernetesUpgrades/|MaintenanceDowngrade/
+          WITH_DEBUG: "true"
+        run: |
+          sudo -E make run-integration-test
+      - name: save-talos-logs-artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: talos-logs
+          path: ~/.talos/clusters/**/*.log
+          retention-days: "5"
diff --git a/.github/workflows/slack-notify.yaml b/.github/workflows/slack-notify.yaml
new file mode 100644
index 000000000..9b45a9d8d
--- /dev/null
+++ b/.github/workflows/slack-notify.yaml
@@ -0,0 +1,97 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2023-11-23T16:03:37Z by kres latest.
+
+name: slack-notify
+"on":
+  workflow_run:
+    workflows:
+      - default
+      - e2e-short-cron
+      - e2e-scaling-cron
+      - e2e-upgrades-cron
+      - e2e-templates-cron
+      - e2e-backups-cron
+    types:
+      - completed
+jobs:
+  slack-notify:
+    runs-on:
+      - self-hosted
+      - generic
+    if: github.event.workflow_run.conclusion != 'skipped'
+    steps:
+      - name: Get PR number
+        id: get-pr-number
+        if: github.event.workflow_run.event == 'pull_request'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          echo pull_request_number=$(gh pr view -R ${{ github.repository }} ${{ github.event.workflow_run.head_repository.owner.login }}:${{ github.event.workflow_run.head_branch }} --json number --jq .number) >> $GITHUB_OUTPUT
+      - name: Slack Notify
+        uses: slackapi/slack-github-action@v1
+        with:
+          channel-id: proj-talos-maintainers
+          payload: |
+            {
+                "attachments": [
+                    {
+                        "color": "${{ github.event.workflow_run.conclusion == 'success' && '#2EB886' || github.event.workflow_run.conclusion == 'failure' && '#A30002' || '#FFCC00' }}",
+                        "fallback": "test",
+                        "blocks": [
+                            {
+                                "type": "section",
+                                "fields": [
+                                    {
+                                        "type": "mrkdwn",
+                                        "text": "${{ github.event.workflow_run.event == 'pull_request' && format('*Pull Request:* {0} (`{1}`)\n<{2}/pull/{3}|{4}>', github.repository, github.ref_name, github.event.repository.html_url, steps.get-pr-number.outputs.pull_request_number, github.event.workflow_run.display_title) || format('*Build:* {0} (`{1}`)\n<{2}/commit/{3}|{4}>', github.repository, github.ref_name, github.event.repository.html_url, github.sha, github.event.workflow_run.display_title) }}"
+                                    },
+                                    {
+                                        "type": "mrkdwn",
+                                        "text": "*Status:*\n`${{ github.event.workflow_run.conclusion }}`"
+                                    }
+                                ]
+                            },
+                            {
+                                "type": "section",
+                                "fields": [
+                                    {
+                                        "type": "mrkdwn",
+                                        "text": "*Author:*\n`${{ github.actor }}`"
+                                    },
+                                    {
+                                        "type": "mrkdwn",
+                                        "text": "*Event:*\n`${{ github.event.workflow_run.event }}`"
+                                    }
+                                ]
+                            },
+                            {
+                                "type": "divider"
+                            },
+                            {
+                                "type": "actions",
+                                "elements": [
+                                    {
+                                        "type": "button",
+                                        "text": {
+                                            "type": "plain_text",
+                                            "text": "Logs"
+                                        },
+                                        "url": "${{ github.event.workflow_run.html_url }}"
+                                    },
+                                    {
+                                        "type": "button",
+                                        "text": {
+                                            "type": "plain_text",
+                                            "text": "Commit"
+                                        },
+                                        "url": "${{ github.event.repository.html_url }}/commit/${{ github.sha }}"
+                                    }
+                                ]
+                            }
+                        ]
+                    }
+                ]
+            }
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 000000000..1ba1aaad6
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,10 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2022-11-30T18:14:53Z by kres c41f376.
+
+_out
+hack/generate-certs.yml
+hack/generate-certs/ca-root
+hack/generate-certs/certs
+hack/compose/docker-compose.override.yml
+frontend/node_modules
diff --git a/.golangci.yml b/.golangci.yml
new file mode 100644
index 000000000..18755b7c1
--- /dev/null
+++ b/.golangci.yml
@@ -0,0 +1,178 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2024-02-09T09:47:03Z by kres decf506.
+
+# options for analysis running
+run:
+  timeout: 10m
+  issues-exit-code: 1
+  tests: true
+  build-tags: []
+  skip-dirs: []
+  skip-dirs-use-default: true
+  skip-files: []
+  modules-download-mode: readonly
+
+# output configuration options
+output:
+  format: colored-line-number
+  print-issued-lines: true
+  print-linter-name: true
+  uniq-by-line: true
+  path-prefix: ""
+
+# all available settings of specific linters
+linters-settings:
+  dogsled:
+    max-blank-identifiers: 2
+  dupl:
+    threshold: 150
+  errcheck:
+    check-type-assertions: true
+    check-blank: true
+  exhaustive:
+    default-signifies-exhaustive: false
+  funlen:
+    lines: 60
+    statements: 40
+  gci:
+    local-prefixes: github.com/siderolabs/omni/
+  gocognit:
+    min-complexity: 30
+  ireturn:
+    allow:
+      - anon
+      - error
+      - empty
+      - stdlib
+      - github.com\/talos-systems\/kres\/internal\/dag.Node
+  nestif:
+    min-complexity: 5
+  goconst:
+    min-len: 3
+    min-occurrences: 3
+  gocritic:
+    disabled-checks: []
+  gocyclo:
+    min-complexity: 20
+  godot:
+    check-all: false
+  godox:
+    keywords: # default keywords are TODO, BUG, and FIXME, these can be overwritten by this setting
+      - NOTE
+      - OPTIMIZE # marks code that should be optimized before merging
+      - HACK # marks hack-arounds that should be removed before merging
+  gofmt:
+    simplify: true
+  goimports:
+    local-prefixes: github.com/siderolabs/omni/
+  golint:
+    min-confidence: 0.8
+  gomnd:
+    settings: {}
+  gomodguard: {}
+  govet:
+    check-shadowing: true
+    enable-all: true
+  lll:
+    line-length: 200
+    tab-width: 4
+  misspell:
+    locale: US
+    ignore-words: []
+  nakedret:
+    max-func-lines: 30
+  prealloc:
+    simple: true
+    range-loops: true # Report preallocation suggestions on range loops, true by default
+    for-loops: false # Report preallocation suggestions on for loops, false by default
+  nolintlint:
+    allow-unused: false
+    allow-leading-space: false
+    allow-no-explanation: []
+    require-explanation: false
+    require-specific: true
+  rowserrcheck: {}
+  testpackage: {}
+  unparam:
+    check-exported: false
+  unused:
+    check-exported: false
+  whitespace:
+    multi-if: false   # Enforces newlines (or comments) after every multi-line if statement
+    multi-func: false # Enforces newlines (or comments) after every multi-line function signature
+  wsl:
+    strict-append: true
+    allow-assign-and-call: true
+    allow-multiline-assign: true
+    allow-cuddle-declarations: false
+    allow-trailing-comment: false
+    force-case-trailing-whitespace: 0
+    force-err-cuddling: false
+    allow-separated-leading-comment: false
+  gofumpt:
+    extra-rules: false
+  cyclop:
+      # the maximal code complexity to report
+      max-complexity: 20
+  #  depguard:
+  #    Main:
+  #      deny:
+  #        - github.com/OpenPeeDeeP/depguard # this is just an example
+
+linters:
+  enable-all: true
+  disable-all: false
+  fast: false
+  disable:
+    - exhaustruct
+    - exhaustivestruct
+    - forbidigo
+    - funlen
+    - gas
+    - gochecknoglobals
+    - gochecknoinits
+    - godox
+    - goerr113
+    - gomnd
+    - gomoddirectives
+    - ireturn
+    - nestif
+    - nonamedreturns
+    - nosnakecase
+    - paralleltest
+    - tagliatelle
+    - thelper
+    - typecheck
+    - varnamelen
+    - wrapcheck
+    - depguard # Disabled because starting with golangci-lint 1.53.0 it doesn't allow denylist alone anymore
+    - tagalign
+    - inamedparam
+    - testifylint # complains about our assert recorder and has a number of false positives for assert.Greater(t, thing, 1)
+    - protogetter # complains about us using Value field on typed spec, instead of GetValue which has a different signature
+    - perfsprint # complains about us using fmt.Sprintf in non-performance critical code, updating just kres took too long
+    # abandoned linters for which golangci shows the warning that the repo is archived by the owner
+    - interfacer
+    - maligned
+    - golint
+    - scopelint
+    - varcheck
+    - deadcode
+    - structcheck
+    - ifshort
+    # disabled as it seems to be broken - goes into imported libraries and reports issues there
+    - musttag
+
+issues:
+  exclude: []
+  exclude-rules: []
+  exclude-use-default: false
+  exclude-case-sensitive: false
+  max-issues-per-linter: 10
+  max-same-issues: 3
+  new: false
+
+severity:
+  default-severity: error
+  case-sensitive: false
diff --git a/.kres.yaml b/.kres.yaml
new file mode 100644
index 000000000..c65957751
--- /dev/null
+++ b/.kres.yaml
@@ -0,0 +1,511 @@
+---
+kind: auto.CommandConfig
+name: omnictl
+spec:
+  disableImage: true
+---
+kind: auto.CommandConfig
+name: omni-integration-test
+spec:
+  disableImage: true
+---
+kind: auto.CustomSteps
+spec:
+  steps:
+    - name: dev-server
+      toplevel: true
+    - name: docker-compose-up
+      toplevel: true
+    - name: docker-compose-down
+      toplevel: true
+    - name: mkcert-install
+      toplevel: true
+    - name: mkcert-generate
+      toplevel: true
+    - name: mkcert-uninstall
+      toplevel: true
+    - name: run-integration-test
+      toplevel: true
+---
+kind: custom.Step
+name: dev-server
+spec:
+  makefile:
+    enabled: true
+    phony: true
+    script:
+      - hack/dev-server.sh
+---
+kind: custom.Step
+name: docker-compose-up
+spec:
+  makefile:
+    enabled: true
+    phony: true
+    script:
+      - >-
+        ARTIFACTS="$(ARTIFACTS)"
+        SHA="$(SHA)"
+        TAG="$(TAG)"
+        USERNAME="$(USERNAME)"
+        REGISTRY="$(REGISTRY)"
+        JS_TOOLCHAIN="$(JS_TOOLCHAIN)"
+        PROTOBUF_TS_VERSION="$(PROTOBUF_TS_VERSION)"
+        PROTOBUF_GRPC_GATEWAY_TS_VERSION="$(PROTOBUF_GRPC_GATEWAY_TS_VERSION)"
+        NODE_BUILD_ARGS="$(NODE_BUILD_ARGS)"
+        TOOLCHAIN="$(TOOLCHAIN)"
+        CGO_ENABLED="$(CGO_ENABLED)"
+        GO_BUILDFLAGS="$(GO_BUILDFLAGS)"
+        GOLANGCILINT_VERSION="$(GOLANGCILINT_VERSION)"
+        GOFUMPT_VERSION="$(GOFUMPT_VERSION)"
+        GOIMPORTS_VERSION="$(GOIMPORTS_VERSION)"
+        PROTOBUF_GO_VERSION="$(PROTOBUF_GO_VERSION)"
+        GRPC_GO_VERSION="$(GRPC_GO_VERSION)"
+        GRPC_GATEWAY_VERSION="$(GRPC_GATEWAY_VERSION)"
+        VTPROTOBUF_VERSION="$(VTPROTOBUF_VERSION)"
+        DEEPCOPY_VERSION="$(DEEPCOPY_VERSION)"
+        TESTPKGS="$(TESTPKGS)"
+        COMPOSE_DOCKER_CLI_BUILD=1
+        DOCKER_BUILDKIT=1
+        GO_LDFLAGS="$(GO_LDFLAGS)"
+        docker compose --file ./hack/compose/docker-compose.yml --file ./hack/compose/docker-compose.override.yml up --build
+---
+kind: custom.Step
+name: mkcert-generate
+spec:
+  makefile:
+    enabled: true
+    phony: true
+    script:
+      - >-
+        go run ./hack/generate-certs -config ./hack/generate-certs.yml generate
+---
+kind: custom.Step
+name: mkcert-install
+spec:
+  makefile:
+    enabled: true
+    phony: true
+    script:
+      - >-
+        go run ./hack/generate-certs install
+---
+kind: custom.Step
+name: mkcert-uninstall
+spec:
+  makefile:
+    enabled: true
+    phony: true
+    script:
+      - >-
+        go run ./hack/generate-certs uninstall
+---
+kind: custom.Step
+name: docker-compose-down
+spec:
+  makefile:
+    enabled: true
+    phony: true
+    variables:
+      - name: REMOVE_VOLUMES
+        defaultValue: false
+    script:
+      - >-
+        ARTIFACTS="$(ARTIFACTS)"
+        SHA="$(SHA)"
+        TAG="$(TAG)"
+        USERNAME="$(USERNAME)"
+        REGISTRY="$(REGISTRY)"
+        JS_TOOLCHAIN="$(JS_TOOLCHAIN)"
+        PROTOBUF_TS_VERSION="$(PROTOBUF_TS_VERSION)"
+        PROTOBUF_GRPC_GATEWAY_TS_VERSION="$(PROTOBUF_GRPC_GATEWAY_TS_VERSION)"
+        NODE_BUILD_ARGS="$(NODE_BUILD_ARGS)"
+        TOOLCHAIN="$(TOOLCHAIN)"
+        CGO_ENABLED="$(CGO_ENABLED)"
+        GO_BUILDFLAGS="$(GO_BUILDFLAGS)"
+        GOLANGCILINT_VERSION="$(GOLANGCILINT_VERSION)"
+        GOFUMPT_VERSION="$(GOFUMPT_VERSION)"
+        GOIMPORTS_VERSION="$(GOIMPORTS_VERSION)"
+        PROTOBUF_GO_VERSION="$(PROTOBUF_GO_VERSION)"
+        GRPC_GO_VERSION="$(GRPC_GO_VERSION)"
+        GRPC_GATEWAY_VERSION="$(GRPC_GATEWAY_VERSION)"
+        VTPROTOBUF_VERSION="$(VTPROTOBUF_VERSION)"
+        DEEPCOPY_VERSION="$(DEEPCOPY_VERSION)"
+        TESTPKGS="$(TESTPKGS)"
+        COMPOSE_DOCKER_CLI_BUILD=1
+        DOCKER_BUILDKIT=1
+        GO_LDFLAGS="$(GO_LDFLAGS)"
+        docker compose --file ./hack/compose/docker-compose.yml --file ./hack/compose/docker-compose.override.yml down --rmi local --remove-orphans --volumes=$(REMOVE_VOLUMES)
+---
+kind: custom.Step
+name: run-integration-test
+spec:
+  sudoInCI: true
+  makefile:
+    enabled: true
+    depends:
+      - omni-integration-test-linux-amd64
+      - omnictl-linux-amd64
+      - omni-linux-amd64
+    script:
+      - >-
+        @hack/test/integration.sh
+  ghaction:
+    enabled: true
+    artifacts:
+      enabled: true
+      extraPaths:
+        - "!_out/etcd"
+        - "!_out/secondary-storage/**"
+      additional:
+        - name: talos-logs
+          always: true
+          continueOnError: true
+          paths:
+            - ~/.talos/clusters/**/*.log
+    environment:
+      WITH_DEBUG: "true"
+      INTEGRATION_RUN_E2E_TEST: "true"
+      INTEGRATION_TEST_ARGS: "--test.run CleanState/|Auth/|DefaultCluster/"
+      AUTH0_TEST_PASSWORD: ${{ secrets.AUTH0_TEST_PASSWORD }}
+      AUTH0_TEST_USERNAME: ${{ secrets.AUTH0_TEST_USERNAME }}
+    jobs:
+      - name: e2e-short
+        crons:
+          - '30 1 * * *'
+        runnerLabels:
+          - omni
+        triggerLabels:
+          - integration/e2e
+          - integration/e2e-short
+        environmentOverride:
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: "--test.run CleanState/|TalosImageGeneration/|ImmediateClusterDestruction/|DefaultCluster/|EncryptedCluster/|SinglenodeCluster/|Auth/"
+      - name: e2e-scaling
+        crons:
+          - '30 1 * * *'
+        runnerLabels:
+          - omni
+        triggerLabels:
+          - integration/e2e
+          - integration/e2e-scaling
+        environmentOverride:
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: "--test.run CleanState/|ScaleUpAndDown/|ScaleUpAndDownMachineClassBasedMachineSets/|RollingUpdateParallelism/|ForcedMachineRemoval/|ReplaceControlPlanes/|ConfigPatching/"
+      - name: e2e-upgrades
+        crons:
+          - '30 1 * * *'
+        runnerLabels:
+          - omni
+        triggerLabels:
+          - integration/e2e
+          - integration/e2e-upgrades
+        environmentOverride:
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: "--test.run CleanState/|TalosUpgrades/|KubernetesUpgrades/|MaintenanceDowngrade/"
+      - name: e2e-templates
+        crons:
+          - '30 1 * * *'
+        runnerLabels:
+          - omni
+        triggerLabels:
+          - integration/e2e
+          - integration/e2e-templates
+        environmentOverride:
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: "--test.run CleanState/|ClusterTemplate/"
+      - name: e2e-backups
+        crons:
+          - '30 1 * * *'
+        runnerLabels:
+          - omni
+        triggerLabels:
+          - integration/e2e
+          - integration/e2e-backups
+        environmentOverride:
+          INTEGRATION_RUN_E2E_TEST: "false"
+          INTEGRATION_TEST_ARGS: "--test.run CleanState/|EtcdBackupAndRestore"
+---
+kind: common.Build
+spec:
+  ignoredPaths:
+    - "hack/generate-certs.yml"
+    - "hack/generate-certs/ca-root"
+    - "hack/generate-certs/certs"
+    - "hack/compose/docker-compose.override.yml"
+---
+kind: golang.Build
+name: omni
+spec:
+  outputs:
+    linux-amd64:
+      GOOS: linux
+      GOARCH: amd64
+    linux-arm64:
+      GOOS: linux
+      GOARCH: arm64
+    darwin-amd64:
+      GOOS: darwin
+      GOARCH: amd64
+    darwin-arm64:
+      GOOS: darwin
+      GOARCH: arm64
+---
+kind: golang.Build
+name: omnictl
+spec:
+  outputs:
+    linux-amd64:
+      GOOS: linux
+      GOARCH: amd64
+    linux-arm64:
+      GOOS: linux
+      GOARCH: arm64
+    darwin-amd64:
+      GOOS: darwin
+      GOARCH: amd64
+    darwin-arm64:
+      GOOS: darwin
+      GOARCH: arm64
+    windows-amd64.exe:
+      GOOS: windows
+      GOARCH: amd64
+---
+kind: golang.Build
+name: omni-integration-test
+spec:
+  outputs:
+    linux-amd64:
+      GOOS: linux
+      GOARCH: amd64
+---
+kind: golang.Generate
+spec:
+  versionPackagePath: internal/version
+  licenseText: |
+    Copyright (c) 2024 Sidero Labs, Inc.
+    
+    Use of this software is governed by the Business Source License
+    included in the LICENSE file.
+---
+kind: golang.Generate
+spec:
+  baseSpecPath: /client/api
+  goGenerateSpecs:
+    - source: ./internal
+      copy:
+        - frontend/
+  vtProtobufEnabled: true
+  specs:
+    - source: client/api/common/omni.proto
+      subdirectory: common
+    - source: client/api/omni/resources/resources.proto
+      subdirectory: omni/resources
+      genGateway: true
+    - source: client/api/omni/management/management.proto
+      subdirectory: omni/management
+      genGateway: true
+    - source: client/api/omni/oidc/oidc.proto
+      subdirectory: omni/oidc
+      genGateway: true
+    - source: client/api/omni/specs/auth.proto
+      subdirectory: omni/specs
+      genGateway: true
+    - source: client/api/omni/specs/virtual.proto
+      subdirectory: omni/specs
+      genGateway: true
+    - source: client/api/omni/specs/ephemeral.proto
+      subdirectory: omni/specs
+      genGateway: true
+    - source: client/api/omni/specs/oidc.proto # not used in the frontend
+      subdirectory: omni/specs
+      genGateway: true
+    - source: client/api/omni/specs/omni.proto
+      subdirectory: omni/specs
+      genGateway: true
+    - source: client/api/omni/specs/siderolink.proto
+      subdirectory: omni/specs
+      genGateway: true
+    - source: client/api/omni/specs/system.proto
+      subdirectory: omni/specs
+      genGateway: true
+    - source: https://raw.githubusercontent.com/googleapis/googleapis/master/google/rpc/status.proto
+      subdirectory: google/rpc/
+      genGateway: true
+    - source: https://raw.githubusercontent.com/siderolabs/talos/03a20da9da5916c63015d355f4b56823778e994f/api/common/common.proto
+      subdirectory: common/
+      genGateway: true
+    - source: https://raw.githubusercontent.com/siderolabs/talos/03a20da9da5916c63015d355f4b56823778e994f/api/machine/machine.proto
+      subdirectory: talos/machine/
+      genGateway: true
+    - source: https://raw.githubusercontent.com/cosi-project/specification/c644a4b0fd408ec41bd29193bcdbd1a5b7feead2/proto/v1alpha1/resource.proto
+      subdirectory: v1alpha1
+      genGateway: true
+---
+kind: js.Build
+spec:
+  licenseText: |
+    Copyright (c) 2024 Sidero Labs, Inc.
+    
+    Use of this software is governed by the Business Source License
+    included in the LICENSE file.
+---
+kind: js.Protobuf
+spec:
+  baseSpecPath: /client/api
+  files:
+     - source: https://www.talos.dev/v1.6/schemas/config.schema.json
+       destination: frontend/src/schemas/config.schema.json
+  destinationRoot: src/api
+  specs:
+    - source: client/api/common/omni.proto
+      subdirectory: common
+      genGateway: true
+    - source: client/api/omni/resources/resources.proto
+      subdirectory: omni/resources
+      genGateway: true
+    - source: client/api/omni/management/management.proto
+      subdirectory: omni/management
+      genGateway: true
+    - source: client/api/omni/oidc/oidc.proto
+      subdirectory: omni/oidc
+      genGateway: true
+    - source: https://raw.githubusercontent.com/siderolabs/go-api-signature/a034e9ff315ba4a56115acc7ad0fb99d0dc77800/api/auth/auth.proto
+      subdirectory: omni/auth
+      genGateway: true
+    - source: client/api/omni/specs/omni.proto
+      subdirectory: omni/specs
+      genGateway: true
+    - source: client/api/omni/specs/siderolink.proto
+      subdirectory: omni/specs
+      genGateway: true
+    - source: client/api/omni/specs/system.proto
+      subdirectory: omni/specs
+      genGateway: true
+    - source: client/api/omni/specs/auth.proto
+      subdirectory: omni/specs
+      genGateway: true
+    - source: client/api/omni/specs/virtual.proto
+      subdirectory: omni/specs
+      genGateway: true
+    - source: client/api/omni/specs/ephemeral.proto
+      subdirectory: omni/specs
+      genGateway: true
+    - source: https://raw.githubusercontent.com/googleapis/googleapis/master/google/rpc/status.proto
+      subdirectory: google/rpc/
+      genGateway: true
+    - source: https://raw.githubusercontent.com/siderolabs/talos/03a20da9da5916c63015d355f4b56823778e994f/api/machine/machine.proto
+      subdirectory: talos/machine
+      genGateway: true
+    - source: https://raw.githubusercontent.com/protocolbuffers/protobuf/master/src/google/protobuf/any.proto
+      subdirectory: google/protobuf/
+      genGateway: true
+    - source: https://raw.githubusercontent.com/protocolbuffers/protobuf/master/src/google/protobuf/duration.proto
+      subdirectory: google/protobuf/
+      genGateway: true
+    - source: https://raw.githubusercontent.com/protocolbuffers/protobuf/master/src/google/protobuf/empty.proto
+      subdirectory: google/protobuf/
+      genGateway: true
+    - source: https://raw.githubusercontent.com/protocolbuffers/protobuf/master/src/google/protobuf/timestamp.proto
+      subdirectory: google/protobuf/
+      genGateway: true
+    - source: https://raw.githubusercontent.com/googleapis/googleapis/master/google/rpc/code.proto
+      subdirectory: google/rpc/
+      genGateway: true
+    - source: https://raw.githubusercontent.com/siderolabs/talos/03a20da9da5916c63015d355f4b56823778e994f/api/common/common.proto
+      subdirectory: common/
+      genGateway: true
+    - source: https://raw.githubusercontent.com/cosi-project/specification/5c734257bfa6a3acb01417809797dbfbe0e73c71/proto/v1alpha1/resource.proto
+      subdirectory: v1alpha1
+      genGateway: true
+---
+kind: common.Release
+name: release
+spec:
+  artifacts:
+    - omnictl-*
+    - omni-*
+---
+kind: common.Image
+name: image-omni
+spec:
+  copyFrom:
+    - stage: omnictl-all
+      destination: /omnictl/
+---
+kind: service.CodeCov
+spec:
+  enabled: false
+---
+kind: common.Repository
+spec:
+  licenses:
+    - id: BSL-1.1
+      params:
+        Licensor: Sidero Labs, Inc.
+        LicensedWork: Omni
+        Copyright: (c) 2024 Sidero Labs, Inc.
+        ChangeDate: "2028-02-22"
+        ChangeLicense: Mozilla Public License, version 2.0
+        EnterpriseLink: https://www.siderolabs.com/contact/
+      header: |
+        // Copyright (c) 2024 Sidero Labs, Inc.
+        //
+        // Use of this software is governed by the Business Source License
+        // included in the LICENSE file.
+
+    - id: MPL-2.0
+      root: client
+      header: |
+        // This Source Code Form is subject to the terms of the Mozilla Public
+        // License, v. 2.0. If a copy of the MPL was not distributed with this
+        // file, You can obtain one at http://mozilla.org/MPL/2.0/.
+  licenseChecks:
+    - root: "."
+      header: |
+        // Copyright (c) 2024 Sidero Labs, Inc.
+        //
+        // Use of this software is governed by the Business Source License
+        // included in the LICENSE file.
+      includeSuffixes:
+        - .go
+        - .ts
+        - .js
+      excludeSuffixes:
+        - .pb.go
+        - .pb.gw.go
+        - .pb.ts
+        - babel.config.js
+      skipPaths:
+        - .git
+        - testdata/
+        - client/
+        - frontend/node_modules/
+        - internal/pkg/kubernetes/resource/ # contains a file copied from kubectl
+
+    - root: client
+      header: |
+        // This Source Code Form is subject to the terms of the Mozilla Public
+        // License, v. 2.0. If a copy of the MPL was not distributed with this
+        // file, You can obtain one at http://mozilla.org/MPL/2.0/
+
+    - root: frontend/
+      header: |
+        <!--
+        Copyright (c) 2024 Sidero Labs, Inc.
+        
+        Use of this software is governed by the Business Source License
+        included in the LICENSE file.
+        -->
+      includeSuffixes:
+        - .vue
+      skipPaths:
+        - node_modules/
+
+  enableConform: true
+  enforceContexts:
+    - e2e-short
+    - e2e-scaling
+    - e2e-templates
+    - e2e-upgrades
+    - e2e-backups
diff --git a/.license-header.go.txt b/.license-header.go.txt
new file mode 100644
index 000000000..574b91d23
--- /dev/null
+++ b/.license-header.go.txt
@@ -0,0 +1,4 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
diff --git a/.markdownlint.json b/.markdownlint.json
new file mode 100644
index 000000000..042c15577
--- /dev/null
+++ b/.markdownlint.json
@@ -0,0 +1,9 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2020-08-29T13:20:33Z by kres latest.
+
+{
+    "MD013": false,
+    "MD033": false,
+    "default": true
+  }
diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 000000000..26c033edb
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,4 @@
+{
+    "css.lint.unknownAtRules": "ignore",
+    "vue3snippets.enable-compile-vue-file-on-did-save-code": false
+}
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 000000000..a3fa663b6
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,1655 @@
+## [Omni 0.20.0](https://github.com/siderolabs/omni/releases/tag/v0.20.0) (2023-10-17)
+
+Welcome to the v0.20.0 release of Omni!
+
+
+
+Please try out the release binaries and report any issues at
+https://github.com/siderolabs/omni/issues.
+
+### Kubeconfig Changes
+
+Omni now generates Kubernetes configs without accessing Talos API.
+
+
+### 
+
+Omni can now define SAML user roles depending on the SAML labels it gets from the SAML assertion.
+Role is assigned only once on user creation.
+
+
+### Contributors
+
+* Andrey Smirnov
+* Artem Chernyshev
+* Utku Ozdemir
+
+### Changes
+<details><summary>19 commits</summary>
+<p>
+
+* [`992614d4`](https://github.com/siderolabs/omni/commit/992614d408f185692ddde2021682fdef68ebd5ba) chore: stop kubernetes status watchers for the offline cluster
+* [`79868c27`](https://github.com/siderolabs/omni/commit/79868c279355bec3b36c194f97381d55e3b4a007) chore: optimize controller operations for disconnected machines
+* [`8c2c39d3`](https://github.com/siderolabs/omni/commit/8c2c39d386cb8074db3c196b69b07fc80d30fdbe) fix: do not run loadbalancer for the unreachable clusters
+* [`caf3d955`](https://github.com/siderolabs/omni/commit/caf3d955fe8e79e1a52ff463c3c6e0fa5e8420d8) test: set unique names for config patches
+* [`f31373bd`](https://github.com/siderolabs/omni/commit/f31373bd317dcb1be407d3616669746f2ba79fee) feat: implement kubeconfig generation on Omni side
+* [`681ffa3b`](https://github.com/siderolabs/omni/commit/681ffa3b1d8446f77618399353f8563d139d9f44) feat: allow defining SAML label mapping rules to Omni roles
+* [`9d3f3b9e`](https://github.com/siderolabs/omni/commit/9d3f3b9e3ad0a56f666b50e2930610c0fa91f8eb) fix: rewrite the link counter handling
+* [`9becbc78`](https://github.com/siderolabs/omni/commit/9becbc78f8ffc7065e2c8dcaa0386fa00a147c17) refactor: use COSI runtime with new controller runtime DB
+* [`22235517`](https://github.com/siderolabs/omni/commit/22235517c04351136fc1a34977f394e4298cb25e) fix: gracefully handle links removal in the siderolink manager
+* [`26ae4163`](https://github.com/siderolabs/omni/commit/26ae416378acfee1ae66561017cd809da6960f3c) refactor: lower the level of log storage logs
+* [`01743ecd`](https://github.com/siderolabs/omni/commit/01743ecdde23583e9bc177e250122e6237996975) fix: rework the talos client and configuration generation
+* [`f837129a`](https://github.com/siderolabs/omni/commit/f837129ae469d319b78e575f0e72e16f97f8e2fe) chore: bump Talos machinery to the latest main
+* [`4a79387e`](https://github.com/siderolabs/omni/commit/4a79387e95f07e2f33df682904af00eb38bf1f5b) fix: update to Go 1.21.3
+* [`3df360b8`](https://github.com/siderolabs/omni/commit/3df360b81196e939eb571e6ee262eb5bee715bd7) chore: log received interruption signals in Omni
+* [`0a72c596`](https://github.com/siderolabs/omni/commit/0a72c5962a446f4ca1ea9399ff87aa750587bd07) chore: update state-etcd to v0.2.4
+* [`4f2978d2`](https://github.com/siderolabs/omni/commit/4f2978d2cf051a2a83eca885193792a335d94fcc) test: override grpc call log level in authorization tests
+* [`e21e39a8`](https://github.com/siderolabs/omni/commit/e21e39a83e80ef3226e73f85d0f36fcfd7e0b7b9) test: avoid excessive public key registration in integration tests
+* [`78c5fbdf`](https://github.com/siderolabs/omni/commit/78c5fbdf290ffe8feb2d42a7a510089f327eaf60) ci: remove gh actions workflow
+* [`e9f07068`](https://github.com/siderolabs/omni/commit/e9f07068ac0c08a7500677ec22d94afbb437e151) test: fix the assertion on cluster destroyed
+</p>
+</details>
+
+### Dependency Changes
+
+* **github.com/cosi-project/runtime**            v0.3.11 -> v0.3.13
+* **github.com/cosi-project/state-etcd**         v0.2.3 -> v0.2.4
+* **github.com/hashicorp/golang-lru/v2**         v2.0.7 **_new_**
+* **github.com/siderolabs/talos/pkg/machinery**  c14a5d4f79a3 -> 7bb205ebe2ef
+* **golang.org/x/crypto**                        v0.13.0 -> v0.14.0
+* **golang.org/x/net**                           v0.15.0 -> v0.17.0
+* **google.golang.org/grpc**                     v1.58.2 -> v1.58.3
+
+Previous release can be found at [v0.19.0](https://github.com/siderolabs/omni/releases/tag/v0.19.0)
+
+## [Omni 0.16.0](https://github.com/siderolabs/omni/releases/tag/v0.16.0) (2023-08-18)
+
+Welcome to the v0.16.0 release of Omni!
+
+
+
+Please try out the release binaries and report any issues at
+https://github.com/siderolabs/omni/issues.
+
+### Better Etcd Disaster Recovery
+
+Omni now allows replacing control plane machines even if etcd is unhealthy.
+And stil properly handles safety checks, not allowing to break etcd quorum,
+allowing removing only unhealthy machines.
+
+It also allows canceling machine destroy sequence if the machine destroyed
+is not being torn down by the machine set controller.
+
+
+### Machine Locking
+
+Cluster templates now also support machine locking:
+
+```yaml
+kind: Machine
+name: 430d882a-51a8-48b3-ab00-d4b5b0b5b0b0
+locked: true
+```
+
+
+### Limit Workload Access
+
+Workload proxy now takes into account the access to the cluster when allowing users to open the service endpoints.
+
+
+### Contributors
+
+* Utku Ozdemir
+* Artem Chernyshev
+* Dmitriy Matrenichev
+
+### Changes
+<details><summary>18 commits</summary>
+<p>
+
+* [`3d1c19a1`](https://github.com/siderolabs/omni/commit/3d1c19a11110e8b3e8a04543797b0cf32cd79a88) feat: allow replacing control plane machines if it doesn't break etcd
+* [`12561b5b`](https://github.com/siderolabs/omni/commit/12561b5b82d4f150dac334e8b891b7f3dc7aeb54) fix: don't allow changing disk for the nodes that have Talos installed
+* [`8e17f742`](https://github.com/siderolabs/omni/commit/8e17f742c17f0e47b79b1e2da03725a7205721f8) feat: allow canceling deletion of a machine set node
+* [`1d8722aa`](https://github.com/siderolabs/omni/commit/1d8722aa353258c4e157e122ec9f11ddd8d1476b) chore: use 1.5.0 Talos in tests and enable disk encryption feature
+* [`3318a443`](https://github.com/siderolabs/omni/commit/3318a443c4bd8c36914b1d0a768c59ff6651680b) feat: show `invalid-state` label if the machine is reachable but apid is not
+* [`05f69c0d`](https://github.com/siderolabs/omni/commit/05f69c0d2a40837a466b4b2f607f7df5601207fa) feat: enable workload proxying by default
+* [`dded4d81`](https://github.com/siderolabs/omni/commit/dded4d814633f42b2677ca392636f6103d042b55) fix: check for roles and ACLs on exposed service access
+* [`d718f134`](https://github.com/siderolabs/omni/commit/d718f13432e92666b875b9134cf38c12dbbf01e5) chore: run auth tests in main integration test pipeline
+* [`79516583`](https://github.com/siderolabs/omni/commit/79516583e7995b3832f0759dbdc855e230f42abe) chore: remove `toInputWeak` and add mutex.Empty
+* [`6b2e09b7`](https://github.com/siderolabs/omni/commit/6b2e09b7e2229c25bd77863a7aa9aed367b20845) chore: bump Go to 1.21
+* [`a5f4a9a4`](https://github.com/siderolabs/omni/commit/a5f4a9a493a7e359ec552f61dabb898ad7dd66e6) chore: cleanup `ConfigPatch` resources along with their owners
+* [`a48efd7a`](https://github.com/siderolabs/omni/commit/a48efd7a9793c47a23b1b57fa23f90e7c72c7825) feat: add support for machine locking in cluster templates
+* [`964eb23d`](https://github.com/siderolabs/omni/commit/964eb23dc862cabb9b3029515ff1a947ee6978f2) feat: block `os:admin` access to Talos API from workload clusters
+* [`65bb6403`](https://github.com/siderolabs/omni/commit/65bb6403a529bf24aedf1175230fb98b4f63ab0d) refactor: simplify cleanup of exposed services
+* [`ede70550`](https://github.com/siderolabs/omni/commit/ede70550561562b930196701f989a1821da5ebba) fix: destroy exposedservices when cluster is destroyed
+* [`ddfd7657`](https://github.com/siderolabs/omni/commit/ddfd7657a3d871ab6da4b42adfb2b940e3781b36) fix: fix workload svc proxy feature visibility on frontend
+* [`ead58143`](https://github.com/siderolabs/omni/commit/ead581434227dad691e0e8ac9a7f0926afb7d2b9) chore: update vault in docker-compose
+* [`653824ca`](https://github.com/siderolabs/omni/commit/653824ca093ca053c129bd15780ae2e27e91ced0) chore: set default Talos version to v1.4.7
+</p>
+</details>
+
+### Dependency Changes
+
+* **github.com/emicklei/dot**                    v1.5.0 -> v1.6.0
+* **github.com/siderolabs/talos/pkg/machinery**  80238a05a6f8 -> v1.5.0-beta.1
+* **go.uber.org/zap**                            v1.24.0 -> v1.25.0
+* **golang.org/x/net**                           v0.12.0 -> v0.14.0
+* **golang.org/x/text**                          v0.11.0 -> v0.12.0
+* **golang.org/x/tools**                         v0.11.0 -> v0.12.0
+
+Previous release can be found at [v0.15.0](https://github.com/siderolabs/omni/releases/tag/v0.15.0)
+
+## [Omni 0.11.0-alpha.0](https://github.com/siderolabs/omni/releases/tag/v0.11.0-alpha.0) (2023-06-08)
+
+Welcome to the v0.11.0-alpha.0 release of Omni!  
+*This is a pre-release of Omni*
+
+
+
+Please try out the release binaries and report any issues at
+https://github.com/siderolabs/omni/issues.
+
+### Support Full ACL Syntax
+
+ACL now supports configuring additive perimissions to the base role, which includes:
+
+- accessing the clusters - read-only, write access, separate Talos API access
+- read-only access to machines
+- write access to machines
+
+
+### SAML support
+
+Omni now supports SAML authentication.
+SAML authentication is enabled by the following cmd line flags:
+
+```
+--auth-saml-enabled
+--auth-saml-url <idp-url>
+--auth-saml-metadata <idp-metadata>
+--auth-saml-label-rules '{"Role": "role"}'
+```
+
+Omni metadata endpoint is `/saml/metadata`.
+
+The users are automatically created on the first SAML login.
+The first created user has Admin permissions, other have no permissions.
+Permissions can be managed by ACLs or `Admin` can change user roles.
+
+
+### Replace User Scopes with Roles
+
+User management is now simplified. Instead of having scopes like `cluster:read`, `cluster:write`, etc,
+the user is assigned one of 4 roles: `None`, `Reader`, `Operator`, `Admin`.
+
+- `None` - gives no permissions.
+- `Reader` - gives readonly permissions.
+- `Operator` - allows managing clusters, machines, getting talosconfig, but doesn't allow editing users.
+- `Amdin` - all permissions.
+
+Fine grained access can still be managed by ACLs.
+
+
+### Contributors
+
+* Utku Ozdemir
+* Artem Chernyshev
+* Andrey Smirnov
+
+### Changes
+<details><summary>10 commits</summary>
+<p>
+
+* [`c7c93a1e`](https://github.com/siderolabs/omni/commit/c7c93a1e87f9d58ed8626aeed03bddb5b1d27a0d) fix: let the empty endpoints be recorded if there are no endpoints
+* [`c28907e4`](https://github.com/siderolabs/omni/commit/c28907e4cafe2ed478ace42e5dfeeb0beaf52b95) feat: copy SAML attributes to `Identity` as labels
+* [`a2f17a21`](https://github.com/siderolabs/omni/commit/a2f17a21f7321cc9dac4ea740afa8a14fa9d3e77) feat: implement full ACL syntax
+* [`c0fa5d46`](https://github.com/siderolabs/omni/commit/c0fa5d46f705e73d904b78a5ce4e98dc0b787d0e) feat: add support for SAML authentication
+* [`ad783798`](https://github.com/siderolabs/omni/commit/ad783798a081b4ff4ce667748db05688f91e0006) fix: replace `exponential-backoff` library with own implementation
+* [`c8d7183a`](https://github.com/siderolabs/omni/commit/c8d7183a37e20c8fbc8c28b0d3cff684ae367199) feat: replace scopes with simplified roles
+* [`08a048a9`](https://github.com/siderolabs/omni/commit/08a048a925fde227329b9b6696a03307ebc92256) feat: update default Talos to 1.4.5, Kubernetes to 1.27.2
+* [`5278321b`](https://github.com/siderolabs/omni/commit/5278321bb38a1af39b4157c0a49157cc5d16fe73) fix: respect service account key env on omnictl download
+* [`caac445d`](https://github.com/siderolabs/omni/commit/caac445d65289afb4276de0788c877640c74b4de) fix: don't show `OngoingTasks` until the UI is authorized
+* [`dfca66df`](https://github.com/siderolabs/omni/commit/dfca66dfa297f5c35b5c7ea44e81dab20e74d8c2) fix: include node name in the cluster node search
+</p>
+</details>
+
+### Changes from siderolabs/go-api-signature
+<details><summary>1 commit</summary>
+<p>
+
+* [`a034e9f`](https://github.com/siderolabs/go-api-signature/commit/a034e9ff315ba4a56115acc7ad0fb99d0dc77800) feat: replace scopes with roles
+</p>
+</details>
+
+### Dependency Changes
+
+* **github.com/crewjam/saml**                    v0.4.13 **_new_**
+* **github.com/siderolabs/go-api-signature**     v0.2.4 -> a034e9ff315b
+* **github.com/siderolabs/talos/pkg/machinery**  v1.4.4 -> v1.4.5
+
+Previous release can be found at [v0.10.0](https://github.com/siderolabs/omni/releases/tag/v0.10.0)
+
+## [Omni 0.1.0-beta.2](https://github.com/siderolabs/omni/releases/tag/v0.1.0-beta.2) (2022-12-20)
+
+Welcome to the v0.1.0-beta.2 release of Omni!  
+*This is a pre-release of Omni*
+
+
+
+Please try out the release binaries and report any issues at
+https://github.com/siderolabs/omni/issues.
+
+### Contributors
+
+* Andrey Smirnov
+* Artem Chernyshev
+
+### Changes
+<details><summary>5 commits</summary>
+<p>
+
+* [`59df55f`](https://github.com/siderolabs/omni/commit/59df55f7b82c1e26564c77772eaa9755a2947b9e) fix: bring K8s info back to life on the node overview page
+* [`2f54f91`](https://github.com/siderolabs/omni/commit/2f54f9136ecce5009dbca552c1ab01cfeb602679) chore: run etcd elections ("lock") to prevent concurrent Omni runs
+* [`8beb051`](https://github.com/siderolabs/omni/commit/8beb05147a2746630c96fae2f62465dd3c95dd64) chore: update COSI to v0.3.0-alpha.2
+* [`f14e358`](https://github.com/siderolabs/omni/commit/f14e3582ed8f63ba188d7b7e0b33fed0f27c5b8a) fix: better errors in `talosctl` via Omni
+* [`f12a216`](https://github.com/siderolabs/omni/commit/f12a21673593ace90c51bdf087e2c7d084bb9c5f) fix: properly reset flush timeout in the Talos logs viewer
+</p>
+</details>
+
+### Dependency Changes
+
+* **github.com/cosi-project/runtime**  v0.3.0-alpha.1 -> v0.3.0-alpha.2
+
+Previous release can be found at [v0.1.0-beta.1](https://github.com/siderolabs/omni/releases/tag/v0.1.0-beta.1)
+
+## [Omni 0.1.0-beta.1](https://github.com/siderolabs/omni/releases/tag/v0.1.0-beta.1) (2022-12-16)
+
+Welcome to the v0.1.0-beta.1 release of Omni!  
+*This is a pre-release of Omni*
+
+
+
+Please try out the release binaries and report any issues at
+https://github.com/siderolabs/omni/issues.
+
+### Contributors
+
+* Andrey Smirnov
+* Andrey Smirnov
+* Utku Ozdemir
+* Alexey Palazhchenko
+* Artem Chernyshev
+* Dmitriy Matrenichev
+* Andrew Rynhard
+* Artem Chernyshev
+* Noel Georgi
+* Serge Logvinov
+
+### Changes
+<details><summary>20 commits</summary>
+<p>
+
+* [`9a7a9a0`](https://github.com/siderolabs/omni/commit/9a7a9a02f4853ecb9d99031c9e606eab1cb4f7ea) feat: add RedactedClusterMachineConfig resource
+* [`c83cfe2`](https://github.com/siderolabs/omni/commit/c83cfe2f84c88bcff62a2c664b805bccbc996e56) feat: rework the cluster list view and cluster overview pages
+* [`f65ce14`](https://github.com/siderolabs/omni/commit/f65ce14cea1d9169e39bf5845c6f8aff70a299f1) fix: ignore keys if the auth is disabled
+* [`e9c3831`](https://github.com/siderolabs/omni/commit/e9c383161583c33ae32f229dbcbb8e546db507c2) fix: create config patch if it does not exist
+* [`437d271`](https://github.com/siderolabs/omni/commit/437d2718c6d4bdcef2aac4d5b2c98cf2ce17e4e8) fix: support Kubernetes proxy OIDC flow when auth is disabled
+* [`a47c211`](https://github.com/siderolabs/omni/commit/a47c211222881d474bb5774ff4969d4144652096) fix: read cluster reference from MachineStatus spec
+* [`8091f16`](https://github.com/siderolabs/omni/commit/8091f16161c7779b2406062e37bdbd7f4ea7e68e) fix: set owner on MachineStatus migration
+* [`e986e20`](https://github.com/siderolabs/omni/commit/e986e20d6f8899c3ff99e316c9111de56dd8b42c) fix: wrong yaml module version (should be v3)
+* [`dbb3d48`](https://github.com/siderolabs/omni/commit/dbb3d48d0ff3305a9c0184b469d0100ada76db6a) fix: rollback etcd auto compaction retention
+* [`047b89f`](https://github.com/siderolabs/omni/commit/047b89fd81eeffb60680a289cf1c5ba335afed40) refactor: move machine status labels into spec
+* [`f990aea`](https://github.com/siderolabs/omni/commit/f990aea20db95502aa0013889168897d34161a98) feat: do not allow setting config patch fields which are owned by Omni
+* [`7d9258f`](https://github.com/siderolabs/omni/commit/7d9258ff3b48582111487e114b7fffe098d38464) fix: fix incorrect yaml multiline string decoding in ClusterMachineSpec
+* [`0b5b095`](https://github.com/siderolabs/omni/commit/0b5b0959c80beccc5eb5d062cf5158f8577edc0d) fix: prevent etcd audit from removing valid members
+* [`82fe21b`](https://github.com/siderolabs/omni/commit/82fe21be7169a29f70b8c3425716082696dc770e) fix: label generated patches with `system-patch` label
+* [`4c2ce26`](https://github.com/siderolabs/omni/commit/4c2ce26a28b57911b0489de6d7ba99ab8ebdbb77) fix: enhance watch to accept a single `Ref` value
+* [`ef78843`](https://github.com/siderolabs/omni/commit/ef788432b6a3f3c2a40875fef65650e177a1adcd) feat: implement `Machine` level config patch editor
+* [`8144d44`](https://github.com/siderolabs/omni/commit/8144d44f9f0974a94cdab257c5803367581d4db3) fix: encode image download URL when signing & slugify file names
+* [`75ea9e6`](https://github.com/siderolabs/omni/commit/75ea9e6b60134981f3776f3b250678113f19dc63) refactor: rewrite generic ClusterMachineStatusController
+* [`5dba725`](https://github.com/siderolabs/omni/commit/5dba725ed040cb0cde35ec9295c6e99db4cb9d6a) feat: add ability to download admin talosconfig in debug mode
+* [`5baa939`](https://github.com/siderolabs/omni/commit/5baa939b8db3d3069960ff896ac77349ba63f172) refactor: `kubernetes.Runtime` to cache clients and configs
+</p>
+</details>
+
+### Changes from siderolabs/crypto
+<details><summary>28 commits</summary>
+<p>
+
+* [`c03ff58`](https://github.com/siderolabs/crypto/commit/c03ff58af5051acb9b56e08377200324a3ea1d5e) feat: add a way to represent redacted x509 private keys
+* [`c3225ee`](https://github.com/siderolabs/crypto/commit/c3225eee603a8d1218c67e1bfe33ddde7953ed74) feat: allow CSR template subject field to be overridden
+* [`8570669`](https://github.com/siderolabs/crypto/commit/85706698dac8cddd0e9f41006bed059347d2ea26) chore: rename to siderolabs/crypto
+* [`e9df1b8`](https://github.com/siderolabs/crypto/commit/e9df1b8ca74c6efdc7f72191e5d2613830162fd5) feat: add support for generating keys from RSA-SHA256 CAs
+* [`510b0d2`](https://github.com/siderolabs/crypto/commit/510b0d2753a89170d0c0f60e052a66484997a5b2) chore: add json tags
+* [`6fa2d93`](https://github.com/siderolabs/crypto/commit/6fa2d93d0382299d5471e0de8e831c923398aaa8) fix: deepcopy nil fields as `nil`
+* [`9a63cba`](https://github.com/siderolabs/crypto/commit/9a63cba8dabd278f3080fa8c160613efc48c43f8) fix: add back support for generating ECDSA keys with P-256 and SHA512
+* [`893bc66`](https://github.com/siderolabs/crypto/commit/893bc66e4716a4cb7d1d5e66b5660ffc01f22823) fix: use SHA256 for ECDSA-P256
+* [`deec8d4`](https://github.com/siderolabs/crypto/commit/deec8d47700e10e3ea813bdce01377bd93c83367) chore: implement DeepCopy methods for PEMEncoded* types
+* [`d3cb772`](https://github.com/siderolabs/crypto/commit/d3cb77220384b3a3119a6f3ddb1340bbc811f1d1) feat: make possible to change KeyUsage
+* [`6bc5bb5`](https://github.com/siderolabs/crypto/commit/6bc5bb50c52767296a1b1cab6580e3fcf1358f34) chore: remove unused argument
+* [`cd18ef6`](https://github.com/siderolabs/crypto/commit/cd18ef62eb9f65d8b6730a2eb73e47e629949e1b) feat: add support for several organizations
+* [`97c888b`](https://github.com/siderolabs/crypto/commit/97c888b3924dd5ac70b8d30dd66b4370b5ab1edc) chore: add options to CSR
+* [`7776057`](https://github.com/siderolabs/crypto/commit/7776057f5086157873f62f6a21ec23fa9fd86e05) chore: fix typos
+* [`80df078`](https://github.com/siderolabs/crypto/commit/80df078327030af7e822668405bb4853c512bd7c) chore: remove named result parameters
+* [`15bdd28`](https://github.com/siderolabs/crypto/commit/15bdd282b74ac406ab243853c1b50338a1bc29d0) chore: minor updates
+* [`4f80b97`](https://github.com/siderolabs/crypto/commit/4f80b976b640d773fb025d981bf85bcc8190815b) fix: verify CSR signature before issuing a certificate
+* [`39584f1`](https://github.com/siderolabs/crypto/commit/39584f1b6e54e9966db1f16369092b2215707134) feat: support for key/certificate types RSA, Ed25519, ECDSA
+* [`cf75519`](https://github.com/siderolabs/crypto/commit/cf75519cab82bd1b128ae9b45107c6bb422bd96a) fix: function NewKeyPair should create certificate with proper subject
+* [`751c95a`](https://github.com/siderolabs/crypto/commit/751c95aa9434832a74deb6884cff7c5fd785db0b) feat: add 'PEMEncodedKey' which allows to transport keys in YAML
+* [`562c3b6`](https://github.com/siderolabs/crypto/commit/562c3b66f89866746c0ba47927c55f41afed0f7f) feat: add support for public RSA key in RSAKey
+* [`bda0e9c`](https://github.com/siderolabs/crypto/commit/bda0e9c24e80c658333822e2002e0bc671ac53a3) feat: enable more conversions between encoded and raw versions
+* [`e0dd56a`](https://github.com/siderolabs/crypto/commit/e0dd56ac47456f85c0b247999afa93fb87ebc78b) feat: add NotBefore option for x509 cert creation
+* [`12a4897`](https://github.com/siderolabs/crypto/commit/12a489768a6bb2c13e16e54617139c980f99a658) feat: add support for SPKI fingerprint generation and matching
+* [`d0c3eef`](https://github.com/siderolabs/crypto/commit/d0c3eef149ec9b713e7eca8c35a6214bd0a64bc4) fix: implement NewKeyPair
+* [`196679e`](https://github.com/siderolabs/crypto/commit/196679e9ec77cb709db54879ddeddd4eaafaea01) feat: move `pkg/grpc/tls` from `github.com/talos-systems/talos` as `./tls`
+* [`1ff6242`](https://github.com/siderolabs/crypto/commit/1ff6242c91bb298ceeb4acd65685cba952fe4178) chore: initial version as imported from talos-systems/talos
+* [`835063e`](https://github.com/siderolabs/crypto/commit/835063e055b28a525038b826a6d80cbe76402414) chore: initial commit
+</p>
+</details>
+
+### Changes from siderolabs/gen
+<details><summary>1 commit</summary>
+<p>
+
+* [`8e89b1e`](https://github.com/siderolabs/gen/commit/8e89b1ede9f35ff4c18a41ee44a69259181c892b) feat: add GetOrCreate and GetOrCall methods
+</p>
+</details>
+
+### Dependency Changes
+
+* **github.com/cosi-project/runtime**            v0.2.0 -> v0.3.0-alpha.1
+* **github.com/grpc-ecosystem/grpc-gateway/v2**  v2.13.0 -> v2.14.0
+* **github.com/siderolabs/crypto**               c03ff58af505 **_new_**
+* **github.com/siderolabs/gen**                  v0.4.1 -> v0.4.2
+* **github.com/siderolabs/talos/pkg/machinery**  v1.3.0-beta.0 -> 873bd3807c0f
+* **go.uber.org/zap**                            v1.23.0 -> v1.24.0
+* **golang.org/x/net**                           v0.2.0 -> v0.4.0
+* **golang.org/x/text**                          v0.4.0 -> v0.5.0
+
+Previous release can be found at [v0.1.0-beta.0](https://github.com/siderolabs/omni/releases/tag/v0.1.0-beta.0)
+
+## [Omni 0.1.0-beta.0](https://github.com/siderolabs/omni/releases/tag/v0.1.0-beta.0) (2022-12-02)
+
+Welcome to the v0.1.0-beta.0 release of Omni!  
+*This is a pre-release of Omni*
+
+
+
+Please try out the release binaries and report any issues at
+https://github.com/siderolabs/omni/issues.
+
+### Contributors
+
+* Artem Chernyshev
+* Andrey Smirnov
+* Artem Chernyshev
+* Dmitriy Matrenichev
+* Utku Ozdemir
+* Philipp Sauter
+* evgeniybryzh
+* Noel Georgi
+* Andrew Rynhard
+* Tim Jones
+* Andrew Rynhard
+* Gerard de Leeuw
+* Steve Francis
+* Volodymyr Mazurets
+
+### Changes
+<details><summary>405 commits</summary>
+<p>
+
+* [`e096c88`](https://github.com/siderolabs/omni/commit/e096c887604399028a559e33da13653c1f54965d) chore: add resource operation metrics
+* [`741e820`](https://github.com/siderolabs/omni/commit/741e8202c5aecfe171082c38e2c55e0184e9c80c) feat: implement config patch creation UI
+* [`5def267`](https://github.com/siderolabs/omni/commit/5def26706fa21df7748801cbdab5c6e81543174f) fix: attempt to clean up docker container better
+* [`876ff5e`](https://github.com/siderolabs/omni/commit/876ff5ee44d4193c52e4daeec776ad50b69664f9) feat: update COSI and state-etcd to 0.2.0
+* [`3df410d`](https://github.com/siderolabs/omni/commit/3df410d964fc66b2d4ad8c7db0459108d16adde0) test: refactor and update config patch integration tests
+* [`5eea9e5`](https://github.com/siderolabs/omni/commit/5eea9e50b47a6df324f2fd5564aa9010b56e16e0) feat: add TLS support to siderolink API
+* [`36394ea`](https://github.com/siderolabs/omni/commit/36394ea242f9af4d9c17f90ec143b0356fa9e671) refactor: simplify the resource leak fix
+* [`e5b962b`](https://github.com/siderolabs/omni/commit/e5b962b66f158fd31b74dc6b97f524c168b4fad1) chore: update dev environment
+* [`39bf206`](https://github.com/siderolabs/omni/commit/39bf206eec29262b1c15ed557f7f24e029c61206) fix: save user picture and fullname in the local storage
+* [`f1611c1`](https://github.com/siderolabs/omni/commit/f1611c10d26b937b5bae69a1b9eda67d2bc5e137) feat: add machine level config patch support
+* [`f2e6cf5`](https://github.com/siderolabs/omni/commit/f2e6cf5cddb47aaa290e7db1a037f2155fcd60d2) fix: remove several resource/goroutine leaks
+* [`fc37af3`](https://github.com/siderolabs/omni/commit/fc37af36d87e01c3e9f349f206711f154740e0b4) feat: allow destroying config patches in the UI
+* [`3154d59`](https://github.com/siderolabs/omni/commit/3154d591e7c65713c6940d953df45d8242ae9359) fix: respect SIDEROLINK_DEV_JOIN_TOKEN only in debug mode
+* [`38f5380`](https://github.com/siderolabs/omni/commit/38f53802ab3dda70fedc0a81de9d6dd43e6204f1) feat: avoid deleting all resources on omnictl delete
+* [`28666bc`](https://github.com/siderolabs/omni/commit/28666bcb4acaf6e4f053e99d8d45d5dae320c89c) chore: add support for local development using compose
+* [`cad73ce`](https://github.com/siderolabs/omni/commit/cad73cefc6b187a26e3833089e89ca1cb6fbf843) chore: increase TestEtcdAudit timeout and fix incorrect `Assert()` calls.
+* [`7199b75`](https://github.com/siderolabs/omni/commit/7199b75c2108568d8bee82c42fcc00edb4a22e1c) chore: during `config merge` create config if there was none
+* [`dab54d1`](https://github.com/siderolabs/omni/commit/dab54d14fcd8c0fadc6bb2a49d79e90379234403) chore: increase `TestTalosBackendRoles` reliability
+* [`997cd78`](https://github.com/siderolabs/omni/commit/997cd7823bd126302ed4772658c0791768d67638) feat: add reconfiguring phase to machinesetstatus
+* [`81fb2b9`](https://github.com/siderolabs/omni/commit/81fb2b94e61f7e7aaf41075fe17a2bbfea005d9f) fix: fix button order and vue config
+* [`252fb29`](https://github.com/siderolabs/omni/commit/252fb29d64dac660da08459d9c5acc44e457b034) refactor: simplify backend.Server.Run method
+* [`f335c2f`](https://github.com/siderolabs/omni/commit/f335c2f5311a81ca23699c473b68bf6918430aab) refactor: split watch to `Watch` and `WatchFunc`, add unit tests
+* [`35a7919`](https://github.com/siderolabs/omni/commit/35a79193b965d42fba0a649bef0efe82abbd2fd5) feat: track machine config apply status
+* [`1c54710`](https://github.com/siderolabs/omni/commit/1c54710c6f5ebe2740af27cebfb9c5532b22cc26) fix: use rolling update strategy on control planes
+* [`17ccdc2`](https://github.com/siderolabs/omni/commit/17ccdc2f78693b5d1276b843c027e8057faa2ff7) refactor: various logging fixes
+* [`3c9ca9c`](https://github.com/siderolabs/omni/commit/3c9ca9cd83298c5281c7ced50720b341c10a02f0) fix: update node overview Kubernetes node watch to make it compatible
+* [`e8c2063`](https://github.com/siderolabs/omni/commit/e8c20631501308952bbc596e994a71b7677034b3) fix: enable edit config patches button on the cluster overview page
+* [`6e80521`](https://github.com/siderolabs/omni/commit/6e8052169dd672e6fce5668982b704331eac4645) fix: reset the item list after the watch gets reconnected
+* [`620d197`](https://github.com/siderolabs/omni/commit/620d1977a70bbc2cca8b331db825fc7bdb8fcda3) chore: remove AddContext method from runtime.Runtime interface
+* [`8972ade`](https://github.com/siderolabs/omni/commit/8972ade40dea2bf3bf41bcb865a817d90b37657d) chore: update default version of Talos to v1.2.7
+* [`6a2dde8`](https://github.com/siderolabs/omni/commit/6a2dde863d306986027904167f262d4307a7420d) fix: update the config patch rollout strategy
+* [`fb3f6a3`](https://github.com/siderolabs/omni/commit/fb3f6a340c37d1958e36400edf7ca53e2cde48a7) fix: skip updating config status if applying config caused a reboot
+* [`8776146`](https://github.com/siderolabs/omni/commit/877614606d0c7d0259c4e65e4911f331550dd7d7) fix: apply finalizer to the `Machine` only when CMS is created
+* [`134bb20`](https://github.com/siderolabs/omni/commit/134bb2053ce6250b9b4c647f3b2dbb8255cea2ce) test: fix config patch test with reboot
+* [`d3b6b5a`](https://github.com/siderolabs/omni/commit/d3b6b5a75f9ea5304595851d6160e98ec4c9b8aa) feat: implement config patch viewer and editor
+* [`149efe1`](https://github.com/siderolabs/omni/commit/149efe189a24c07e648289ee81d0b95ed1c972b7) chore: bump runtime and state-etcd modules
+* [`c345b83`](https://github.com/siderolabs/omni/commit/c345b8348412aef59cbd43c35bf06ce3eac5ad3f) chore: output omnictl auth log to stderr
+* [`39b2ba2`](https://github.com/siderolabs/omni/commit/39b2ba2a86972324161c6cff056abf10eb2fce5c) refactor: introduce ClusterEndpoint resource
+* [`6998ff0`](https://github.com/siderolabs/omni/commit/6998ff0803063b22e113da0c72356ee254f13143) fix: treat created and updated events same
+* [`289fe88`](https://github.com/siderolabs/omni/commit/289fe88aba94d6cfe4d7be7472b609232e45cbf6) feat: add omnictl apply
+* [`2f1be3b`](https://github.com/siderolabs/omni/commit/2f1be3b4643e2a66a62da6a7f8f1f1da39ed6e17) chore: fix `TestGenerateJoinToken` test
+* [`3829176`](https://github.com/siderolabs/omni/commit/382917630030415b1a218f14f2a1d6d3595834a0) fix: don't close config patch editor window if config validation fails
+* [`c96f504`](https://github.com/siderolabs/omni/commit/c96f5041be7befb517998fc7bbccd135cb76908d) feat: add suspended mode
+* [`b967bcf`](https://github.com/siderolabs/omni/commit/b967bcfd26b2fccfa6bbb08b8a15eb3796e2e872) feat: add last config apply error to clustermachineconfigstatus
+* [`0395d9d`](https://github.com/siderolabs/omni/commit/0395d9dd7b985802be8f4cd2b8005b409faca3de) test: increase key generation timeout on storage signing test
+* [`577eba4`](https://github.com/siderolabs/omni/commit/577eba4231142fe983f9a0f9b5a81280c377686e) fix: set SideroLink MTU to 1280
+* [`0f32172`](https://github.com/siderolabs/omni/commit/0f32172922ed2f7b8b4b7433fb1f9ce104f3c5a8) fix: minor things in frontend
+* [`9abcc7b`](https://github.com/siderolabs/omni/commit/9abcc7b444c49f6223e0ae4948bff13eedbb05b5) test: add config patching integration tests
+* [`99531fb`](https://github.com/siderolabs/omni/commit/99531fbeee982e2ab87d9f0162a0080308b852ab) refactor: drop unneeded controller inputs
+* [`5172354`](https://github.com/siderolabs/omni/commit/51723541621d91964e88e8a5add834159214dc5b) chore: add omnictl to the generated image
+* [`738cf64`](https://github.com/siderolabs/omni/commit/738cf649f53ec29e88112a027ec72f3d6f0cfff8) fix: set cluster machine version in machine config status correctly
+* [`1d0d220`](https://github.com/siderolabs/omni/commit/1d0d220f47f1cc9ca8b20bfef47004a875b7573c) fix: lower ttl of the issued keys on the FE side by 10 minutes
+* [`2889524`](https://github.com/siderolabs/omni/commit/2889524f222e42d49061867b2b2f5b59a16af4ba) feat: dynamic title
+* [`3d17bd7`](https://github.com/siderolabs/omni/commit/3d17bd7cfd4775292090ccb3fd3c2b575b26d449) chore: fix release CI run
+* [`f2c752f`](https://github.com/siderolabs/omni/commit/f2c752fed627006912018ae3e5f2ff0f2bed60b8) fix: properly proxy watch requests through dev-server
+* [`9a74897`](https://github.com/siderolabs/omni/commit/9a74897d0ce60a51086f5af98c4c4eb71f2b0009) release(v0.1.0-alpha.1): prepare release
+* [`8b284f3`](https://github.com/siderolabs/omni/commit/8b284f3aa26cf8a34452f33807dcc04045e7a098) feat: implement Kubernetes API OIDC proxy and OIDC server
+* [`adad8d0`](https://github.com/siderolabs/omni/commit/adad8d0fe2f3356e97de613104196233a3b98ff5) refactor: rework LoadBalancerConfig/LoadBalancerStatus resources
+* [`08e2cb4`](https://github.com/siderolabs/omni/commit/08e2cb4fd40ec918bf458edd6a5d8e6c86fe5c97) feat: support editing config patches on cluster and machine set levels
+* [`e2197c8`](https://github.com/siderolabs/omni/commit/e2197c83e994afb435671f5af5cdefa843bbddb5) test: e2e testing improvements
+* [`ec9051f`](https://github.com/siderolabs/omni/commit/ec9051f6dfdf1f5acaf3fa6766dc1195b6f6dcdd) fix: config patching
+* [`e2a1d6c`](https://github.com/siderolabs/omni/commit/e2a1d6c78809eaa4168ca5ede433824797a6aa4e) fix: send logs in JSON format by default
+* [`954dd70`](https://github.com/siderolabs/omni/commit/954dd70b935b7c373ba5830fd7ad6e965f6b0da8) chore: replace talos-systems depedencies with siderolabs
+* [`acf94db`](https://github.com/siderolabs/omni/commit/acf94db8ac80fb6f15cc87ff276b7edca0cb8661) chore: add payload logger
+* [`838c716`](https://github.com/siderolabs/omni/commit/838c7168c64f2296a9e01d3ef6ab4feb9f16aeb9) fix: allow time skew on validating the public keys
+* [`dd481d6`](https://github.com/siderolabs/omni/commit/dd481d6cb3620790f6e7a9c8e305defb507cbe5f) fix: refactor runGRPCProxy in router tests to catch listener errors
+* [`e68d010`](https://github.com/siderolabs/omni/commit/e68d010685d4f0a5d25fee671744119cecf6c27b) chore: small fixes
+* [`ad86875`](https://github.com/siderolabs/omni/commit/ad86875ec146e05d7d7f461bf7c8094a8c143df5) feat: minor adjustments on the cluster create page
+* [`e61f194`](https://github.com/siderolabs/omni/commit/e61f1943e965287c79fbaef05760bb0b0deee988) chore: implement debug handlers with controller dependency graphs
+* [`cbbf901`](https://github.com/siderolabs/omni/commit/cbbf901e601d31c777ad2ada0f0036c57020ba96) refactor: use generic TransformController more
+* [`33f9f2c`](https://github.com/siderolabs/omni/commit/33f9f2ce3ec0999198f311ae4bae9b58e57153c9) chore: remove reflect from runtime package
+* [`6586963`](https://github.com/siderolabs/omni/commit/65869636aa33013b5feafb06e727b9d2a4cf1c19) feat: add scopes to users, rework authz & add integration tests
+* [`bb355f5`](https://github.com/siderolabs/omni/commit/bb355f5c659d8c66b825de409d9446767005a2bb) fix: reload the page to init the UI Authenticator on signature fails
+* [`c90cd48`](https://github.com/siderolabs/omni/commit/c90cd48eefa7f29328a456aa5ca474eece17c6fe) chore: log auth context
+* [`d278780`](https://github.com/siderolabs/omni/commit/d2787801a4904fe895996e5319f301a1d7ca76df) fix: update Clusters page UI
+* [`5e77607`](https://github.com/siderolabs/omni/commit/5e776072285e535e93c0458774dcad810b9b857a) tests: abort on first failure
+* [`4c55980`](https://github.com/siderolabs/omni/commit/4c5598083ff6d8763c8763d8e46a3d7b659784ff) chore: get full method name from the service
+* [`2194f43`](https://github.com/siderolabs/omni/commit/2194f4391607e6e73bce1917d2744e78fdd2cebc) feat: redesign cluster list view
+* [`40b3f23`](https://github.com/siderolabs/omni/commit/40b3f23071096987e8a7c6f30a2622c317c190cb) chore: enable gRPC request duration histogram
+* [`0235bb9`](https://github.com/siderolabs/omni/commit/0235bb91a71510cf4d349eedd3625b119c7e4e11) refactor: make sure Talos/Kubernetes versions are defined once
+* [`dd6154a`](https://github.com/siderolabs/omni/commit/dd6154a45d5dcd14870e0aa3f97aa1d4e53bdcfb) chore: add public key pruning
+* [`68908ba`](https://github.com/siderolabs/omni/commit/68908ba330ecd1e285681e24db4b9037eb2e8202) fix: bring back UpgradeInfo API
+* [`f1bc692`](https://github.com/siderolabs/omni/commit/f1bc692c9125f7683fe5f234b03eb3521ba7e773) refactor: drop dependency on Talos Go module
+* [`0e3ef43`](https://github.com/siderolabs/omni/commit/0e3ef43cfed68e53879e6c22b46e7d0568ddc05f) feat: implement talosctl access via Omni
+* [`2b0014f`](https://github.com/siderolabs/omni/commit/2b0014fea15da359217f89ef723965dcc9faa739) fix: provide a way to switch the user on the authenticate page
+* [`e295d7e`](https://github.com/siderolabs/omni/commit/e295d7e2854ac0226e7efda32864f6a687a88470) chore: refactor all controller tests to use assertResource function
+* [`8251dfb`](https://github.com/siderolabs/omni/commit/8251dfb9e44341e9df9471f387cc76c91359cf84) refactor: extract PGP client key handling
+* [`02da9ee`](https://github.com/siderolabs/omni/commit/02da9ee66f15462e6f4d7da18515651a5fde11aa) refactor: use extracted go-api-signature library
+* [`4bc3db4`](https://github.com/siderolabs/omni/commit/4bc3db4dcbc14e0e51c7a3b5257686b671cc2823) fix: drop not working upgrade k8s functional
+* [`17ca75e`](https://github.com/siderolabs/omni/commit/17ca75ef864b7a59f9c6f829de19cc9630a670c0) feat: add 404 page
+* [`8dcde2a`](https://github.com/siderolabs/omni/commit/8dcde2af3ca49d9be16cc705c0b403826f2eee5d) feat: implement logout flow in the frontend
+* [`ba766b9`](https://github.com/siderolabs/omni/commit/ba766b9922302b9d1f279b74caf94e6ca727f86f) fix: make `omnictl` correctly re-auth on invalid key
+* [`fd16f87`](https://github.com/siderolabs/omni/commit/fd16f8743d3843e8ec6735a7c2e96532694b876e) fix: don't set timeout on watch gRPC requests
+* [`8dc3cc6`](https://github.com/siderolabs/omni/commit/8dc3cc682e5419c3824c6e740a32085c386b8817) fix: don't use `omni` in external names
+* [`2513661`](https://github.com/siderolabs/omni/commit/2513661578574255ca3f736d3dfa1f307f5d43b6) fix: reset `Error` field of the `MachineSetStatus`
+* [`b611e99`](https://github.com/siderolabs/omni/commit/b611e99e14a7e2ebc64c55ed5c95a47e17d6ac32) fix: properly handle `Forbidden` errors on the authentication page
+* [`8525502`](https://github.com/siderolabs/omni/commit/8525502265b10dc3cc056d301785f6f60e4f7e22) fix: stop runners properly and clean up StatusMachineSnapshot
+* [`ab0190d`](https://github.com/siderolabs/omni/commit/ab0190d9a41b830daf60173b998acdbcbbdd3754) feat: implement scopes and enforce authorization
+* [`9198d96`](https://github.com/siderolabs/omni/commit/9198d96ea9d57bb5949c59350aec42b2ce13ebac) feat: sign gRPC requests on the frontend to enable Authentication flow
+* [`bdd8f21`](https://github.com/siderolabs/omni/commit/bdd8f216a9eca7ec657fa0dc554e663743f058d1) chore: remove reset button and fix padding
+* [`362db57`](https://github.com/siderolabs/omni/commit/362db570349b4a2659f746ce18a436d684481ecb) fix: gRPC verifier should verify against original JSON payload
+* [`30186b8`](https://github.com/siderolabs/omni/commit/30186b8cfe2eea6eaade8bacf31114886d3da3ea) fix: omnictl ignoring omniconfig argument
+* [`e8ab0ba`](https://github.com/siderolabs/omni/commit/e8ab0ba45648b8f521500b46fe032797da6a111f) fix: do not attempt to execute failed integration test again
+* [`9fda25e`](https://github.com/siderolabs/omni/commit/9fda25ef45f0060cc6c3ec812f5fa1c7b1015801) chore: add more info on errors to different controllers
+* [`ccda526`](https://github.com/siderolabs/omni/commit/ccda5260c4645b5929724574a9f856eeaa4c232f) chore: bump grpc version
+* [`b1ac125`](https://github.com/siderolabs/omni/commit/b1ac1255da5ca4b5d9c409e27c51e4298275e73c) chore: emit log when we got machine status event.
+* [`005d257`](https://github.com/siderolabs/omni/commit/005d257c25c745b61e5a25c39167d511710562c7) chore: set admin role specifically for Reboot request.
+* [`27f0e30`](https://github.com/siderolabs/omni/commit/27f0e309cec76a454e5bb24c2df1e62d9e4718e0) chore: update deps
+* [`77f0219`](https://github.com/siderolabs/omni/commit/77f02198c1e7fb215548f3a0e2be30a0e19aaf6d) test: more unit-tests for auth components
+* [`0bf6ddf`](https://github.com/siderolabs/omni/commit/0bf6ddfa46e0ea6ad255ede00a600c390344e221) fix: pass through HTTP request if auth is disabled
+* [`4f3a67b`](https://github.com/siderolabs/omni/commit/4f3a67b08e03a1bad65c2acb8d65f0281fdd2f9e) fix: unit-tests for auth package and fixes
+* [`e3390cb`](https://github.com/siderolabs/omni/commit/e3390cbbac1d0e78b72512c6ebb64a8f53dcde17) chore: rename arges-theila to omni
+* [`14d2614`](https://github.com/siderolabs/omni/commit/14d2614538ec696d468a0850bd4ee7bc6884c3b1) chore: allow slashes in secretPath
+* [`e423edc`](https://github.com/siderolabs/omni/commit/e423edc072714e7f693249b60079f5f700cc0a65) fix: add unit-tests for auth message and fix issues
+* [`b5cfa1a`](https://github.com/siderolabs/omni/commit/b5cfa1a84e93b6bbf5533c599917f293fc5cdf66) feat: add vault client
+* [`b47791c`](https://github.com/siderolabs/omni/commit/b47791ce303cbb9a8aab279685d17f92a480c7f4) feat: sign grpc requests on cli with pgp key & verify it on server
+* [`d6ef4d9`](https://github.com/siderolabs/omni/commit/d6ef4d9c36758cb0091e2c528b848952f312941a) feat: split account ID and name
+* [`e412e1a`](https://github.com/siderolabs/omni/commit/e412e1a69edad0d19d7e46fa3aa076dcb8e6d4b6) chore: workaround the bind problem
+* [`e23cc59`](https://github.com/siderolabs/omni/commit/e23cc59bb8cb8f9df81738d4c58aed08d80fa9c4) chore: bump minimum Talos version to v1.2.4
+* [`0638a29`](https://github.com/siderolabs/omni/commit/0638a29d78c092641573aa2b8d2e594a7ff6aab4) feat: stop using websockets
+* [`8f3c19d`](https://github.com/siderolabs/omni/commit/8f3c19d0f0ecfbe5beabc7dc508dcafa720e83e2) feat: update install media to be identifiable
+* [`70d1e35`](https://github.com/siderolabs/omni/commit/70d1e354466618bb07c13445a16ca639be12009e) feat: implement resource encryption
+* [`7653638`](https://github.com/siderolabs/omni/commit/76536386499889994b65f66a8a40f18b5535c5ba) fix: fix NPE in integration tests
+* [`e39849f`](https://github.com/siderolabs/omni/commit/e39849f4047f028251123781bd8be350ebbfd65d) chore: update Makefile and Dockerfile with kres
+* [`4709473`](https://github.com/siderolabs/omni/commit/4709473ec20fbf92a3240fb3376a322f1321103a) fix: return an error if external etcd client fails to be built
+* [`5366661`](https://github.com/siderolabs/omni/commit/536666140556ba9b997a2b5d4441ea4b5f42d1c5) refactor: use generic transform controller
+* [`a2a5f16`](https://github.com/siderolabs/omni/commit/a2a5f167f21df6375767d018981651d60bb2f768) feat: limit access to Talos API via Omni to `os:reader`
+* [`e254201`](https://github.com/siderolabs/omni/commit/e2542013938991faa8f1c521fc524b8fcf31ea34) feat: merge internal/external states into one
+* [`3258ca4`](https://github.com/siderolabs/omni/commit/3258ca487c818a34924f138640f44a2e51d307fb) feat: add `ControlPlaneStatus` controller
+* [`1c0f286`](https://github.com/siderolabs/omni/commit/1c0f286a28f5134333130708d031dbfa11051a42) refactor: use `MachineStatus` Talos resource
+* [`0a6b19f`](https://github.com/siderolabs/omni/commit/0a6b19fb916ea301a8f5f6ccd9bbdaa7cb4c39e0) chore: drop support for Talos resource API
+* [`ee5f6d5`](https://github.com/siderolabs/omni/commit/ee5f6d58a2b22a87930d3c8bb9963f71c92f3908) feat: add auth resource types & implement CLI auth
+* [`36736e1`](https://github.com/siderolabs/omni/commit/36736e14e5c837d38568a473834d14073b88a153) fix: use correct protobuf URL for cosi resource spec
+* [`b98c56d`](https://github.com/siderolabs/omni/commit/b98c56dafe33beef7792bd861ac4e637fe13c494) feat: bump minimum version for Talos to v1.2.3
+* [`b93bc9c`](https://github.com/siderolabs/omni/commit/b93bc9cd913b017c66502d96d99c52e4d971e231) chore: move containers and optional package to the separate module
+* [`e1af4d8`](https://github.com/siderolabs/omni/commit/e1af4d8a0bee31721d8946ef452afe04da6b494d) chore: update COSI to v0.2.0-alpha.1
+* [`788dd37`](https://github.com/siderolabs/omni/commit/788dd37c0be32745547ee8268aa0f004041dc96f) feat: implement and enable by default etcd backend
+* [`1b83038`](https://github.com/siderolabs/omni/commit/1b83038b77cab87ffc2d4d73a91582785ed446ef) release(v0.1.0-alpha.0): prepare release
+* [`8a9c4f1`](https://github.com/siderolabs/omni/commit/8a9c4f17ed6ee0d8e4a51b466d60a8278cd50f9c) feat: implement CLI configuration file (omniconfig)
+* [`b0c92d5`](https://github.com/siderolabs/omni/commit/b0c92d56da00529c106f042399c1163375046785) feat: implement etcd audit controller
+* [`0e993a0`](https://github.com/siderolabs/omni/commit/0e993a0977c711fb8767e3de2ad828fd5b9e688f) feat: properly support scaling down the cluster
+* [`264cdc9`](https://github.com/siderolabs/omni/commit/264cdc9e015fd87724c7a07128d1136153732540) refactor: prepare for etcd backend integration
+* [`b519d17`](https://github.com/siderolabs/omni/commit/b519d17971bb1c919286813b4c2465c2f5803a03) feat: show version in the UI
+* [`a2fb539`](https://github.com/siderolabs/omni/commit/a2fb5397f9efb22a1354c5675180ca49537bee55) feat: keep track of loadbalancer health in the controller
+* [`4789c62`](https://github.com/siderolabs/omni/commit/4789c62af0d1694d8d0a492cd6fb7d436e213fe5) feat: implement a new controller that can gather cluster machine data
+* [`bd3712e`](https://github.com/siderolabs/omni/commit/bd3712e13491ede4610ab1452ae85bde6d92b2db) fix: populate machine label field in the patches created by the UI
+* [`ba70b4a`](https://github.com/siderolabs/omni/commit/ba70b4a48623939d31775935bd0338c0d60ab65b) fix: rename to Omni, fix workers scale up, hide join token
+* [`47b45c1`](https://github.com/siderolabs/omni/commit/47b45c129160821576d808d9a46a9ec5d14c6469) fix: correct filenames for Digital Ocean images
+* [`9d217cf`](https://github.com/siderolabs/omni/commit/9d217cf16d432c5194110ae16a566b44b02a567e) feat: introduce new resources, deprecate `ClusterMachineTemplate`
+* [`aee153b`](https://github.com/siderolabs/omni/commit/aee153bedb2f7856913a54b282603b07bf20059b) fix: address style issue in the Pods paginator
+* [`752dd44`](https://github.com/siderolabs/omni/commit/752dd44ac42c95c644cad5640f6b2c5536a29676) chore: update Talos machinery to 1.2.0 and use client config struct
+* [`88d7079`](https://github.com/siderolabs/omni/commit/88d7079a6656605a1a8dfed56d392414583a283e) fix: regenerate sources from proto files that were rolled back.
+* [`84062c5`](https://github.com/siderolabs/omni/commit/84062c53417197417ff636a667289342089f390c) chore: update Talos to the latest master
+* [`5a139e4`](https://github.com/siderolabs/omni/commit/5a139e473abcdf7fd25ad7c61dad8cbdc964a453) fix: properly route theila internal requests in the gRPC proxy
+* [`4be4fb6`](https://github.com/siderolabs/omni/commit/4be4fb6a4e0bca29b32e1b732c227c9e7a0b1f43) feat: add support for 'talosconfig' generation
+* [`9235b8b`](https://github.com/siderolabs/omni/commit/9235b8b522d4bc0712012425b68ff89e455886b9) fix: properly layer gRPC proxies
+* [`9a516cc`](https://github.com/siderolabs/omni/commit/9a516ccb5c892ed8fe41f7cf69aaa5bb1d3fa471) fix: wait for selector of 'View All' to render in e2e tests.
+* [`3cf3aa7`](https://github.com/siderolabs/omni/commit/3cf3aa730e7833c0c1abe42a6afb87a85f14b58c) fix: some unhandled errors in the e2e tests.
+* [`c32c7d5`](https://github.com/siderolabs/omni/commit/c32c7d55c92007aa1aa10feab3c7a7de2b2afc42) fix: ignore updating cluster machines statuses without machine statuses
+* [`4cfa307`](https://github.com/siderolabs/omni/commit/4cfa307b85b410b44e482b259d14670b55e4a237) chore: run rekres, fix lint errors and bump Go to 1.19
+* [`eb2d449`](https://github.com/siderolabs/omni/commit/eb2d4499f1a3da7bc1552a6b099c28bed6fd0e4d) fix: skip the machines in `tearingDown` phase in the controller
+* [`9ebc769`](https://github.com/siderolabs/omni/commit/9ebc769b89a2bab37fd081e555f84e3e4c99187e) fix: allow all services to be proxied by gRPC router
+* [`ea2b01d`](https://github.com/siderolabs/omni/commit/ea2b01d0a0e054b259d710317fe368882534cf4c) fix: properly handle non empty resource id in the K8s resource watch
+* [`3bb7da3`](https://github.com/siderolabs/omni/commit/3bb7da3a0fa6b746f6a7b9aa668e055bdf825e6a) feat: show a Cluster column in the Machine section
+* [`8beb70b`](https://github.com/siderolabs/omni/commit/8beb70b7f045a218f9cb753e1402a07542b0bf1c) fix: ignore tearing down clusters in the `Cluster` migrations
+* [`319d4e7`](https://github.com/siderolabs/omni/commit/319d4e7947cb78135f5a14c02afe5814c56a312c) fix: properly handle `null` memory modules list
+* [`6c2120b`](https://github.com/siderolabs/omni/commit/6c2120b5ae2bd947f473d002dfe165646032e811) chore: introduce migrations manager for COSI DB state
+* [`ec52139`](https://github.com/siderolabs/omni/commit/ec521397946cc15929472feb7c45435fb48df848) fix: filter out invalid memory modules info coming from Talos nodes
+* [`8e87031`](https://github.com/siderolabs/omni/commit/8e870313a3a31d052eecf81acb522433ff98ae79) fix: bump loadbalancer timeout settings
+* [`bc0ed26`](https://github.com/siderolabs/omni/commit/bc0ed2672064a6bf148cd9799b35a2790f5aa7f6) feat: introduce websocket, HTTP requests monitoring
+* [`857401f`](https://github.com/siderolabs/omni/commit/857401f54e3922a9ab85d7dc703a5afb70c6ee45) feat: add HTTP logging (static, gateway), and websocket logging
+* [`eb612a3`](https://github.com/siderolabs/omni/commit/eb612a38e9c71913ebecc9f345e17844d60800b8) fix: do hard stop of events sink gRPC server after 5 seconds
+* [`3162513`](https://github.com/siderolabs/omni/commit/31625135e2b971d6b9f92eb4096c010113030a80) fix: populate nodes filter dropdown properly and rewrite filter function
+* [`5713a51`](https://github.com/siderolabs/omni/commit/5713a516391a5190fac9b7044a9f71952ce15479) fix: make `TSelectList` search filter the items in the dropdown
+* [`f2519ff`](https://github.com/siderolabs/omni/commit/f2519ff51b88766a907f1d7717ef74031157fd56) feat: don't allow using nodes with not enough mem for the cluster
+* [`9e474d6`](https://github.com/siderolabs/omni/commit/9e474d69c76a898fc5b6fcd9fdc8e87f25b7dc53) feat: show disconnected warning in the machines list
+* [`fa52b48`](https://github.com/siderolabs/omni/commit/fa52b48f54362c7305681ca79a7d98237531f2b4) feat: redesign Installation Media selection menu
+* [`01e301a`](https://github.com/siderolabs/omni/commit/01e301a875699cf6fcc887cb31cd7939338f58e9) fix: query node list using `talosctl get members` instead of K8s nodes
+* [`e694df5`](https://github.com/siderolabs/omni/commit/e694df59c50fbee356a48c94ade95e924ea46bb2) fix: display all available Talos versions on cluster create page
+* [`7a87525`](https://github.com/siderolabs/omni/commit/7a87525ed1b928a8f8e3e6a39feb4c19009ec264) fix: use `v-model` instead of callbacks in the inputs
+* [`d681f5f`](https://github.com/siderolabs/omni/commit/d681f5f58788612f144fa1f8d90ec6c996badb0e) feat: support scaling up the clusters
+* [`e992b95`](https://github.com/siderolabs/omni/commit/e992b9574d7b8f76497f46e25764618ec274af1a) feat: show notification on image download progress
+* [`8ea6d9f`](https://github.com/siderolabs/omni/commit/8ea6d9f1724b271919e538ed55ff6582858470f9) fix: probably fix 'context canceled' on image download
+* [`692612b`](https://github.com/siderolabs/omni/commit/692612b7e628588fa7608cff683c5af406f24ca7) fix: improve the Talos image generation process
+* [`a69c140`](https://github.com/siderolabs/omni/commit/a69c140e26f4298fcaafb1f96c389269992fc069) feat: introduce Prometheus metrics
+* [`e90ca78`](https://github.com/siderolabs/omni/commit/e90ca7875c501391f860f5df9f2a4e4f8e2f2d7a) fix: make grpc api listen only on siderolink interface
+* [`99fc28c`](https://github.com/siderolabs/omni/commit/99fc28c36c62a8d8c654c05f9b9c64ff37cedba8) fix: display correct cluster/machine status on ui
+* [`eaf7655`](https://github.com/siderolabs/omni/commit/eaf7655395401cd88e6bd47f4f8aa958abee30f1) fix: add a pause before integration tests
+* [`19ff1c9`](https://github.com/siderolabs/omni/commit/19ff1c909bedf63fe6cf2f5cc0e44f34046ca568) chore: rename download button
+* [`e1c4e1b`](https://github.com/siderolabs/omni/commit/e1c4e1b171eab08585a3315ca5838c88a4d2eb24) feat: add download options for all talos images
+* [`24e7863`](https://github.com/siderolabs/omni/commit/24e786369bfc0bb4966712296395db91751e657b) fix: delete cached clients from gRPC proxy when the cluster is destroyed
+* [`58c89ef`](https://github.com/siderolabs/omni/commit/58c89ef3fe621ef6909c5d38a0d47cc861667f45) feat: implement `argesctl delete` command
+* [`3c99b49`](https://github.com/siderolabs/omni/commit/3c99b49a9b680b091d92455a0d3bc325f8f68ca6) test: add a test which removes allocated machine
+* [`75dd28f`](https://github.com/siderolabs/omni/commit/75dd28f56d7ce9a92b96822a867fbfe2655cd0fa) chore: fill in resource definitions for table headers
+* [`028f168`](https://github.com/siderolabs/omni/commit/028f16886c41b7aa7eafb65308cc4adf4d624037) feat: End-to-end tests with playwright
+* [`6be6b36`](https://github.com/siderolabs/omni/commit/6be6b3605583ce8e8068746624ca86ed6adc37af) chore: bump goimports from 0.1.10 to 0.1.11 and node from 18.5.0 to 18.6.0
+* [`af4da08`](https://github.com/siderolabs/omni/commit/af4da086d4b709f504eda7909a36a8f0cf84e480) test: implement kernel log streaming test
+* [`1eacfee`](https://github.com/siderolabs/omni/commit/1eacfee2c1084040ae2201eba957409218a92c66) feat: implement argesctl machine-logs output in 'zap-like' and 'dmesg' form.
+* [`96ab7ab`](https://github.com/siderolabs/omni/commit/96ab7ab8317898dd45d129d5cecd2aaf1d379fba) chore: ignore memory modules with zero size
+* [`fd0575f`](https://github.com/siderolabs/omni/commit/fd0575ff4050702c9d07e34c7d9d5596b4ad7311) chore: retrieve k8s versions from github registry
+* [`8651527`](https://github.com/siderolabs/omni/commit/86515275a77741bacc790d2006f3671a5cfb27c6) feat: redo errgroup to return error on first nil error
+* [`944222d`](https://github.com/siderolabs/omni/commit/944222d06607079b5d982afe4b19fc1dda7f1ec2) fix: show ClusterMachineStatus.Stage in 'Clusters' view
+* [`f3f6b6e`](https://github.com/siderolabs/omni/commit/f3f6b6eecd3ffc13b69845dff50d2e8ab31bc0d2) chore: refactor run method and no longer ignore log receiver listener errors
+* [`b316377`](https://github.com/siderolabs/omni/commit/b316377b277f87a184b969b3bbf20ebe6047a0a8) chore: rename 'Dmesg' to 'Console'
+* [`19ee857`](https://github.com/siderolabs/omni/commit/19ee8578a6f1c1bf742699d1b5720dc4c2674c82) test: add a way to recover deleted machines
+* [`e5b5bdc`](https://github.com/siderolabs/omni/commit/e5b5bdc39fa6f3812b15771366f942ddcbe7f328) fix: update SideroLink library for EEXIST fixes
+* [`363de69`](https://github.com/siderolabs/omni/commit/363de69a50b5c1e9d07fa42152cca935844d118b) fix: spec collector equality
+* [`841f3b2`](https://github.com/siderolabs/omni/commit/841f3b22aacc6d2875062ef324d900c5f2091f9d) feat: add ability to supply machine config patches on the machines
+* [`907ca93`](https://github.com/siderolabs/omni/commit/907ca93247267d80125866c2b60225ceca3ada27) test: fix link destroy test
+* [`4c9f99d`](https://github.com/siderolabs/omni/commit/4c9f99d32874cdaff1eb651bf6d74ef39167c273) fix: remove machine status if the machine is in tearing down phase
+* [`d9747e5`](https://github.com/siderolabs/omni/commit/d9747e552e52156a9baeae962a9478231e26c566) fix: make cluster machine status test more reliable
+* [`3bfff3b`](https://github.com/siderolabs/omni/commit/3bfff3bb0eea9d18956dee21aff7f3de900c6b82) fix: do not set up full theila runtime during clients tests
+* [`4bf33bc`](https://github.com/siderolabs/omni/commit/4bf33bc9d37404a733c5039784c80e92800fb3dc) fix: immediately fail the request if the cluster is down
+* [`124a5c2`](https://github.com/siderolabs/omni/commit/124a5c2947978e6bc86d1b19c9eacbcf7f870b53) fix: ensure the created date on resources is set
+* [`14161bf`](https://github.com/siderolabs/omni/commit/14161bf3dad4484868359d186d99d9198b6eed95) feat: add scale up integration test and minor log fixes
+* [`7af06fd`](https://github.com/siderolabs/omni/commit/7af06fd75959eb9e807680ac8a6ba4f0a7f59255) feat: make integration tests a subtests of one global test
+* [`f7c1464`](https://github.com/siderolabs/omni/commit/f7c1464a1002f63daab29b36d19ea16de0cd5794) feat: implement log receiver for logs from Talos
+* [`5b800ea`](https://github.com/siderolabs/omni/commit/5b800ea970215fb4e100ed7b3b73d7e218fd6d86) fix: accumulate bytes received/send in the link resource
+* [`b3b1e9b`](https://github.com/siderolabs/omni/commit/b3b1e9bbfbf62632dc0d8c2239a72793883101ce) feat: machine removal
+* [`fb01bc4`](https://github.com/siderolabs/omni/commit/fb01bc4b26c5b37f15bac923450e1f58fb7a3d89) fix: use Talos 1.2.0
+* [`3a50efe`](https://github.com/siderolabs/omni/commit/3a50efe363c4724f369a02f672848ad7c284847c) feat: filter machines that can be added to cluster
+* [`ba62db5`](https://github.com/siderolabs/omni/commit/ba62db521b47049e92557bf8cfc5f737e496bf57) fix: properly parse `siderolink-api-advertised-url` if there's no port
+* [`96f835a`](https://github.com/siderolabs/omni/commit/96f835a91136f62d9dbdf5c1d1c46c729d57e51e) fix: properly display node selectors in FireFox
+* [`12c20a4`](https://github.com/siderolabs/omni/commit/12c20a42c9dfdea5f88e0e7942fbdb42ea543b95) fix: populate disks when machines are connected during cluster create
+* [`0dc97f8`](https://github.com/siderolabs/omni/commit/0dc97f8696a7c571d5318daf794700342e06f639) fix: adjust overview page to look closer to the mockups
+* [`2b77af8`](https://github.com/siderolabs/omni/commit/2b77af8d39e555970487c3265dfbd63412e90d2f) feat: add the chart showing the count of clusters
+* [`a1dff65`](https://github.com/siderolabs/omni/commit/a1dff6589d64207e6e7331d0407e7857f9c4079d) feat: implement ISO download with embedded kernel args
+* [`37c03d8`](https://github.com/siderolabs/omni/commit/37c03d8cb04b02e79f42e70eeea1e4368445604d) test: pull kubeconfig and interact with Kubernetes API
+* [`75bfb08`](https://github.com/siderolabs/omni/commit/75bfb08f0738fc9f67259caf12902db67860370f) fix: ignore the error on splitting host/port
+* [`3be5a32`](https://github.com/siderolabs/omni/commit/3be5a3254168cddec8f1629789c2ae50d9eaa08e) feat: make the whole cluster list item clickable, add dropdown menu item
+* [`2c9dc99`](https://github.com/siderolabs/omni/commit/2c9dc99000266b3d4c139f27dea4f6283709251e) fix: adjust the look of the Overview page a bit
+* [`aa4a926`](https://github.com/siderolabs/omni/commit/aa4a926cbb85bf63312493b937440a174aed5070) feat: add the button for downloading cluster Kubeconfig on overview page
+* [`4532de6`](https://github.com/siderolabs/omni/commit/4532de6f3d514a534c38a63731c43075698f5c01) feat: support basic auth in `argesctl` command
+* [`b66bb3c`](https://github.com/siderolabs/omni/commit/b66bb3cbcc85d7be4348ecd9a6d5d62f72a90e11) feat: add summary information Overview page
+* [`3bdbce4`](https://github.com/siderolabs/omni/commit/3bdbce41a3ed89a42556d837bc0c5cfe417e22e6) test: more cluster creation tests, two clusters, cleanup
+* [`3b00bd5`](https://github.com/siderolabs/omni/commit/3b00bd5bf417c5c9cb42471d27811c1849a40c78) fix: improve cluster deletion and node reset flow
+* [`2d83d16`](https://github.com/siderolabs/omni/commit/2d83d1694ec73da818004f91ede76a0bca30fe79) test: create a cluster and verify cluster machine statuses
+* [`f471cfd`](https://github.com/siderolabs/omni/commit/f471cfdcf7c9e70f37436e173c3a58c1965e8bb2) fix: copy all labels from the `ClusterMachine` to `ClusterMachineStatus`
+* [`ec32f86`](https://github.com/siderolabs/omni/commit/ec32f8632db104efd6fedc5421179175274d6339) test: add integration tests up to the cluster creation
+* [`a8d3ee5`](https://github.com/siderolabs/omni/commit/a8d3ee5b14a57ad1d9d88512a95032bbda61e734) feat: add kubeconfig command to argesctl and fix kubeconfig
+* [`10b9a3b`](https://github.com/siderolabs/omni/commit/10b9a3ba676a636e488805ed04a0c908c3d2cf53) test: implement API integration test
+* [`3e6b891`](https://github.com/siderolabs/omni/commit/3e6b8913f916dc5e8ac3ef49e14648defa6e1bf6) feat: aggregate cluster machine statuses in cluster status controller
+* [`f6cbc58`](https://github.com/siderolabs/omni/commit/f6cbc58a91124833f0cbae4ecd0c0416acbe8bfa) chore: ignore empty processor info
+* [`c5fc71b`](https://github.com/siderolabs/omni/commit/c5fc71b86a5492d548ae9098c5c74de240ebd800) fix: clean up Kubernetes client and configs when a cluster is destroyed
+* [`e8478fe`](https://github.com/siderolabs/omni/commit/e8478fe5280d5e8a32bb423ec96edacadabc7e43) fix: properly use tracker to cleanup `ClusterMachineConfig` resources
+* [`044fcad`](https://github.com/siderolabs/omni/commit/044fcadb66de61742ab871d10f3fcf0f453f6e27) fix: make `MachineStatusController` connect to configured nodes
+* [`2867099`](https://github.com/siderolabs/omni/commit/2867099a52d651c3b0f9d3abbae266f2792cafe7) feat: add api endpoint to fetch kubeconfig
+* [`5f32667`](https://github.com/siderolabs/omni/commit/5f3266747012b590dd7a7d0ebc23ee0e80abb2ab) test: support registry mirrors for development purposes
+* [`5114695`](https://github.com/siderolabs/omni/commit/5114695cfeb0b6c792002ff5f0f31c1944c269ab) refactor: consistent flag naming
+* [`9ffb19e`](https://github.com/siderolabs/omni/commit/9ffb19e77968c6e411903a2c59fd9a18063b46d4) chore: use latest node
+* [`5512321`](https://github.com/siderolabs/omni/commit/5512321f05b6b657a28abc25470664f6eb6e3d0a) refactor: set better defaults for cli args
+* [`ff88242`](https://github.com/siderolabs/omni/commit/ff882427f56e42039b79900380b61b86d3290269) chore: mark 'siderolink-wireguard-endpoint' flags as required
+* [`4a9d9ad`](https://github.com/siderolabs/omni/commit/4a9d9adef1e521d3c0293b6dc414f572bd8a93d4) feat: add the ClusterMachineStatus resource
+* [`e4e8b62`](https://github.com/siderolabs/omni/commit/e4e8b6264cb48edd014f97129f52aefaa129fd63) refactor: unify all Arges API under a single HTTP server
+* [`5af9049`](https://github.com/siderolabs/omni/commit/5af9049bdc2e09bf410e1b0646e4e08a4366f33b) chore: rename sidebar item
+* [`a4fc47f`](https://github.com/siderolabs/omni/commit/a4fc47f97d79259532b91a8d391e84b59554ed8e) chore: fix build warning
+* [`547b83c`](https://github.com/siderolabs/omni/commit/547b83c4a2a543d5b6ce4dca6cf6f5de87c33dcb) chore: bump siderolink version
+* [`11c31f3`](https://github.com/siderolabs/omni/commit/11c31f39d834e3352b086c1aec665065fd74e944) refactor: drop one of the layered gRPC servers
+* [`0adbbb7`](https://github.com/siderolabs/omni/commit/0adbbb7edfeacedd98a7e84c2f45ac458750a281) feat: introduce a way to copy kernel arguments from the UI
+* [`ce5422a`](https://github.com/siderolabs/omni/commit/ce5422a27771a94cc25be70ec756711d140b2758) fix: import new COSI library to fix YAML marshaling
+* [`d6cec09`](https://github.com/siderolabs/omni/commit/d6cec099cb6f4c3118e4263b9517176858bb9cfb) feat: implement Arges API client, and minimal `argesctl`
+* [`65c8d68`](https://github.com/siderolabs/omni/commit/65c8d683187d82dc730752294c1bc03657f5df78) feat: implement cluster creation view
+* [`8365b00`](https://github.com/siderolabs/omni/commit/8365b00df90ac55f99e0f82e1fa6d4367ebd6a3f) feat: re-enable old Theila UI
+* [`63e703c`](https://github.com/siderolabs/omni/commit/63e703c4e1dfb4bf645fbc9cd28ba2a722e04dc2) fix: update Talos to the latest master
+* [`d33e27b`](https://github.com/siderolabs/omni/commit/d33e27b49113729c5538fce688832152ff96a7ea) feat: implement clusters list view
+* [`cb9e23c`](https://github.com/siderolabs/omni/commit/cb9e23ca6f420ac7b71acf6b19e9012265f3c69b) feat: protect Theila state from external API access
+* [`952c235`](https://github.com/siderolabs/omni/commit/952c2359b32fdd077d85e312707f8b9c9e01ea0c) fix: properly allocated ports in the loadbalancer
+* [`a58c479`](https://github.com/siderolabs/omni/commit/a58c479e9e31f70e806a1f3482b9b984c5c0ca68) chore: report siderolink events kernel arg
+* [`8a56fe3`](https://github.com/siderolabs/omni/commit/8a56fe34ce1966fe28f9e432c696fdd779dfb638) refactor: move Theila resources to public `pkg/`
+* [`1251699`](https://github.com/siderolabs/omni/commit/12516996eda859db6677403ad1f72a3994ea180b) fix: reset the `MachineEventsSnapshot` after the node is reset
+* [`9a2e6af`](https://github.com/siderolabs/omni/commit/9a2e6af3113b795f57c4e3a86c1348b120fa3bbd) feat: implement bootstrap controller
+* [`7107e27`](https://github.com/siderolabs/omni/commit/7107e27ee6b9ba644fc803e4463cbfcf26cf97de) feat: implement apply and reset config controller
+* [`1579eb0`](https://github.com/siderolabs/omni/commit/1579eb09eb58f2cb679205e9e204369f3a362e07) feat: implement machine events handler and `ClusterStatus`
+* [`7214f4a`](https://github.com/siderolabs/omni/commit/7214f4a514a921d6b9df7515116613996416f383) feat: implement cluster load balancer controller
+* [`9c4fafa`](https://github.com/siderolabs/omni/commit/9c4fafaf6b8dc9b7ff08fe28704ca6a2e7efc097) feat: add a controller that manages load balancers for talos clusters
+* [`7e3d80c`](https://github.com/siderolabs/omni/commit/7e3d80ce956d621ed79e4db094808831e18db85b) feat: add a resources that specify configurations for load balancers
+* [`dc0d356`](https://github.com/siderolabs/omni/commit/dc0d356a181b4c37670d2ed4e8d7af370dccef60) feat: support Theila runtime watch with label selectors
+* [`6a568a7`](https://github.com/siderolabs/omni/commit/6a568a72922e34e91f5448d3c1caa2f0b3a02e96) feat: implement `ClusterMachineConfig` resource and it's controller
+* [`3db0f1c`](https://github.com/siderolabs/omni/commit/3db0f1c9d4e2d6f962b6f3216a4f9c7e2575dd21) feat: implement `TalosConfig` controller
+* [`b7ae8e1`](https://github.com/siderolabs/omni/commit/b7ae8e113dc68acd87c4cfe5e3c8349d32bc392d) feat: introduce `Cluster` controller that adds finalizers on Clusters
+* [`8d7ea02`](https://github.com/siderolabs/omni/commit/8d7ea0293e8f57388fd483dc82e79e6b4c76a53f) chore: use label selectors in `TalosConfig`, set labels on the resources
+* [`cff9cb1`](https://github.com/siderolabs/omni/commit/cff9cb19ba8718fdad509b5e91cb8221c6c1ff00) fix: separate advertised endpoint from the actual wireguard endpoint
+* [`5be6cc3`](https://github.com/siderolabs/omni/commit/5be6cc391adf8bcb58b8d47f09dad5aa75d1ad98) feat: implement cluster creation UI
+* [`a1633eb`](https://github.com/siderolabs/omni/commit/a1633eb18772b9e99d687dfddd12fc09fd1ea5c4) chore: add typed wrappers around State, Reader and Writer
+* [`5515f3d`](https://github.com/siderolabs/omni/commit/5515f3d004f54455a1eb1f4977bbb9d663fd1bca) feat: add `ClusterSecrets` resource and controller and tests
+* [`7226f6c`](https://github.com/siderolabs/omni/commit/7226f6cdc60eeb4d6040d1aa0711fed378c50b33) feat: add `Cluster`, `ClusterMachine` and `TalosConfig` resources
+* [`ec44930`](https://github.com/siderolabs/omni/commit/ec44930672ca8954c6ba68975c1799a087ec0c43) feat: enable vtprotobuf optimized marshaling
+* [`15be219`](https://github.com/siderolabs/omni/commit/15be2198872fb637f7ba2e1ff550e4466179f2b1) feat: generate TS constants from go `//tsgen:` comments
+* [`caa4c4d`](https://github.com/siderolabs/omni/commit/caa4c4d285dcd1176a70d87f28ee303cd0483ca8) fix: resource equality for proto specs
+* [`beeca88`](https://github.com/siderolabs/omni/commit/beeca886213332f313f7f3a477d7e7c508e6d058) refactor: clarify code that creates or gets links for nodes
+* [`340c63a`](https://github.com/siderolabs/omni/commit/340c63ad4ba918d4b11ab1f57fdbd3b5e5d8b3dc) feat: implement `Machines` page
+* [`f7bc0c6`](https://github.com/siderolabs/omni/commit/f7bc0c69c69fe515cfa729bc062c730756a53019) feat: accept nodes if they provide the correct join token
+* [`bdf789a`](https://github.com/siderolabs/omni/commit/bdf789a35da5491a4fcbd2af35a1c6efd22ab1fc) feat: immediately reconnect SideroLink peers after Arges restart
+* [`6b74fa8`](https://github.com/siderolabs/omni/commit/6b74fa82ca5757d6f3809853c1ac3e7754efb06d) feat: implement MachineStatusController
+* [`f5db0e0`](https://github.com/siderolabs/omni/commit/f5db0e05a87d5c11b4a1029b14020b19ca67035d) feat: add more info to the siderolink connection spec
+* [`d3e4a71`](https://github.com/siderolabs/omni/commit/d3e4a71af8fd79328e4edda6d9642b83902b2003) refactor: simplify the usage of gRPC resource CRUD API
+* [`2430115`](https://github.com/siderolabs/omni/commit/2430115af1aaac4226b7d5821e1fe706a1088501) feat: implement MachineController and small fixes
+* [`e31d22d`](https://github.com/siderolabs/omni/commit/e31d22d7639753df53c130461ae1f96b9126f3a5) feat: support running Theila without contexts
+* [`a6b3646`](https://github.com/siderolabs/omni/commit/a6b364626bd808687d5ad95307766344b16dd042) refactor: small fixes
+* [`33d2b59`](https://github.com/siderolabs/omni/commit/33d2b59c202f03785580209c885aa297c023fa60) refactor: clean up a bit SideroLink code, fix shutdown
+* [`98ec883`](https://github.com/siderolabs/omni/commit/98ec8830308755c7073a5d4510483e97d8e1d02d) chore: rename main executable to avoid clashing with Theila project
+* [`828721d`](https://github.com/siderolabs/omni/commit/828721d9aa5d912cce628256f75579309d1ad67d) feat: enable COSI persistence for resources
+* [`f1f7883`](https://github.com/siderolabs/omni/commit/f1f788344254e18bcab00a25b56a86289bfb1638) feat: set up siderolink endpoints in Theila
+* [`6439335`](https://github.com/siderolabs/omni/commit/64393353ca7cf430f82bfe73a004da319da28261) refactor: migrate to `typed.Resource` in Theila internal state
+* [`6195274`](https://github.com/siderolabs/omni/commit/61952742a47ea89e89228f057d0d3de351766150) refactor: restructure folders in the project
+* [`1abf72b`](https://github.com/siderolabs/omni/commit/1abf72b4b2e382fe0cf9302b42242152c255a3ee) chore: update Talos libs to the latest version
+* [`16dffd9`](https://github.com/siderolabs/omni/commit/16dffd9058570477b3a648896a89e6445e5b0162) fix: display delta time for pod's age
+* [`8b80726`](https://github.com/siderolabs/omni/commit/8b807262b23cfa830f3ff444d49f11b3a1654703) feat: update favicon to sidero logo
+* [`2da7378`](https://github.com/siderolabs/omni/commit/2da737841c2ae0bf1f1f916dc6f45b1e3996d6e4) feat: show the extended hardware info
+* [`d3c6004`](https://github.com/siderolabs/omni/commit/d3c6004f9767bf0cff9191dc130308c848ede077) chore: allow getting resources without version and group
+* [`eb19087`](https://github.com/siderolabs/omni/commit/eb190875b30275195e52f1a95ed0bb3aae08424f) fix: remove t-header error notification
+* [`5a28202`](https://github.com/siderolabs/omni/commit/5a28202c939ef9683d14fb3d873e0bacb35577db) feat: restyle t-alert component
+* [`9f2b482`](https://github.com/siderolabs/omni/commit/9f2b48228bbfa39d33b07ae43e9fdb34192c3eed) fix: get rid of racy code in the kubeconfig request code
+* [`c40824e`](https://github.com/siderolabs/omni/commit/c40824ecc5d10cb5289e133b8b1f51213aa12f7f) feat: add text Highlight feature
+* [`9018c81`](https://github.com/siderolabs/omni/commit/9018c81bd0d7c58bb5c632c06f3c3904f6674e03) feat: use `~/.talos/config` as a primary source for clusters
+* [`e10547b`](https://github.com/siderolabs/omni/commit/e10547b5761ad96ab8b5766fe5c3f06fcdf86477) refactor: remove old components and not used code parts
+* [`f704684`](https://github.com/siderolabs/omni/commit/f7046846ea8e83a0e39647c4fcc49addf4c56061) fix: properly calculate servers capacity
+* [`755a077`](https://github.com/siderolabs/omni/commit/755a0779014b0a4177e0fc5180db20720be5a814) fix: use proper units for memory and CPU charts on the node monitor page
+* [`d0a083d`](https://github.com/siderolabs/omni/commit/d0a083d1c15c319e236dd258fabcc9a231f797a1) release(v0.2.0-alpha.0): prepare release
+* [`53878ee`](https://github.com/siderolabs/omni/commit/53878eea09c18f2bc0dd55ca11a6743587748319) fix: properly update servers menu item when the context is changed
+* [`b4cb9c7`](https://github.com/siderolabs/omni/commit/b4cb9c7989ec5299785b86acb3fa0ee648efd259) feat: restyle TMonitor page
+* [`f0377e2`](https://github.com/siderolabs/omni/commit/f0377e2ad5da702af71f2706141f4d7c638c7a15) fix: invert chart value for cpu, storage and memory on the overview page
+* [`6ea6ecf`](https://github.com/siderolabs/omni/commit/6ea6ecf12c4d8b5253b4dfc2e64f5b5d787d022a) fix: update capi-utils to fix talosconfig requests for CAPI clusters
+* [`e3796d3`](https://github.com/siderolabs/omni/commit/e3796d3876d33248fd0998901273a14d29a487a3) chore: update capi-utils
+* [`39186eb`](https://github.com/siderolabs/omni/commit/39186ebe50da531f35d21ac2488f8a58c1ef8e78) feat: implement overview page, cluster dropdown, ongoing tasks
+* [`59f2b27`](https://github.com/siderolabs/omni/commit/59f2b27be4d7f5a591fdeae533d649494356250d) docs: update README.md
+* [`2b7831f`](https://github.com/siderolabs/omni/commit/2b7831f2d22106ac8a82f890d73c2705841b0739) feat: add Kubernetes and Servers pages
+* [`4451a5b`](https://github.com/siderolabs/omni/commit/4451a5bc9f5c6b058c6bcf1252b7c83a001cafbe) fix: properly set TaskStatus namespace in the initial call
+* [`4545464`](https://github.com/siderolabs/omni/commit/454546425f2fd7e4418aa8a03465f3a062de804e) fix: add new fields to the TaskStatus spec, update Talos
+* [`891cf3b`](https://github.com/siderolabs/omni/commit/891cf3b79c8430deeed8a168955afd6e97083baa) docs: describe client context types, usage
+* [`309b515`](https://github.com/siderolabs/omni/commit/309b51545ead2ee144244591df2e5ead2849fb11) feat: update k8s upgrades tasks structure for the new UI representation
+* [`5aa8ca2`](https://github.com/siderolabs/omni/commit/5aa8ca24bd3159879c46c8e8a134702b174e3362) feat: add NodesPage
+* [`db434e0`](https://github.com/siderolabs/omni/commit/db434e07b9f23562bd746a0f78e3868b079006e2) feat: add TPagination component
+* [`0b51727`](https://github.com/siderolabs/omni/commit/0b51727efed31f13f52fa20b360071e7e2a6d9eb) feat: add Pods, Dashboard, Upgrade views, etc
+* [`c549b8b`](https://github.com/siderolabs/omni/commit/c549b8b9ee8a563f14b2e791f91a7b3cb0430aa7) feat: add Overview and Upgrade Kubernetes pages
+* [`cec2e85`](https://github.com/siderolabs/omni/commit/cec2e854f4f3999109220902bccaee6c25d1f502) chore: define constants for all used resource types
+* [`962bdaf`](https://github.com/siderolabs/omni/commit/962bdaf6406ab8e5febea0ad8d32da9c86fa39e7) feat: add TSideBar
+* [`fa28ccb`](https://github.com/siderolabs/omni/commit/fa28ccb67f52c1dd9096b23388427d78be526275) feat: add TheHeader component
+* [`f3418a5`](https://github.com/siderolabs/omni/commit/f3418a59e38e551bd0be7cc7ae66ef4645719aa7) feat: button;icons;config
+* [`db30f50`](https://github.com/siderolabs/omni/commit/db30f503730bdbd8ed359d4070dea0214df67fcd) fix: add `frontend/node_modules` to gitignore
+* [`a675b86`](https://github.com/siderolabs/omni/commit/a675b86f7d55cecd4ae1277cbf057a6bc264940c) fix: properly pass label selector to the metadata in ClusterListItem
+* [`7911d6a`](https://github.com/siderolabs/omni/commit/7911d6a31abdb51e86586a025b705ddfeb1dd19e) chore: add ability to start local development server for the frontend
+* [`076fee1`](https://github.com/siderolabs/omni/commit/076fee10c6583dc49e6530b02cab1f757da0e853) feat: use CAPI utils for CAPI requests
+* [`5ed5ba2`](https://github.com/siderolabs/omni/commit/5ed5ba2a122585a97cf65c3ff081126752cd26fa) fix: more websocket client bugfixes
+* [`6fe22ad`](https://github.com/siderolabs/omni/commit/6fe22ad370026380ba75b38e261870addc341e6f) fix: reset reconnect timeouts after the client is reconnected
+* [`c4b144a`](https://github.com/siderolabs/omni/commit/c4b144af272a46dbdc8d1bb35784e09ba1b79987) fix: talosconfig/kubeconfig when using the default context
+* [`b439a37`](https://github.com/siderolabs/omni/commit/b439a371c13a8d46d986a1dae3d6f4b7cba4a298) fix: properly handle Same-Origin header in websockets
+* [`ffffed1`](https://github.com/siderolabs/omni/commit/ffffed100cec18209bae723b9919eb8613950649) fix: read node name from nodename resource instead of hostname
+* [`2d6f984`](https://github.com/siderolabs/omni/commit/2d6f9844440a6d18b3093dea6228ac6a237dc86b) fix: use secure websockets if the page itself is using https
+* [`799f2d2`](https://github.com/siderolabs/omni/commit/799f2d2d00762d5270dd4a3f4b4b312b32dbb7dd) feat: rework the node overview page
+* [`0d0eaf4`](https://github.com/siderolabs/omni/commit/0d0eaf4b2721dfa1b04bce24e4a1e476579e3a74) fix: make charts height resize depending on the screen height
+* [`7de0101`](https://github.com/siderolabs/omni/commit/7de0101bf0e613653caadd5733db0e29a6bb5bfb) fix: use polyfill to fix streaming APIs on Firefox
+* [`0cff2b0`](https://github.com/siderolabs/omni/commit/0cff2b02b5d8b2c2c644067cf6bd3ed573cb784d) feat: small UI adjustments
+* [`d70bd41`](https://github.com/siderolabs/omni/commit/d70bd41992e13fb3dacc1740532083a8f6ce9afa) feat: implement accept Sidero server functional
+* [`f3a6e16`](https://github.com/siderolabs/omni/commit/f3a6e16a79e1bca9ea6c87eb0d3e0f2a6c65ff2e) feat: add top processes list to the Overview page
+* [`3cf97e4`](https://github.com/siderolabs/omni/commit/3cf97e4b9e07f8383da8a6fb7a993b70c8f82503) refactor: use the same object for gRPC metadata context and messages
+* [`243206f`](https://github.com/siderolabs/omni/commit/243206f95aa6ba944bd4361db6274e7072bae1fc) release(v0.1.0-alpha.2): prepare release
+* [`e5b6f29`](https://github.com/siderolabs/omni/commit/e5b6f29fd298904e06284a67681cc0ce5135145f) feat: implement node Reset
+* [`bcb7d23`](https://github.com/siderolabs/omni/commit/bcb7d237c31f42a35f5c3b53e7615ddae1ce0a8b) fix: node IP not being truncated
+* [`e576d33`](https://github.com/siderolabs/omni/commit/e576d33ba40f629eed14668f2d9bf77d7fef62c2) feat: add upgrade UI for CAPI clusters
+* [`10cdce7`](https://github.com/siderolabs/omni/commit/10cdce7fcc219af969a85a41d18fb904936faa0a) fix: server labels key/value order and chevron orientation
+* [`4007177`](https://github.com/siderolabs/omni/commit/40071775d6de1eea697f67e55441c384c86e75d9) feat: implement Kubernetes upgrade UI components
+* [`f4917ee`](https://github.com/siderolabs/omni/commit/f4917eecfb3173acf7518883c738118c8537d657) fix: accumulate chart updates into a single update
+* [`414d76c`](https://github.com/siderolabs/omni/commit/414d76c1c926695e5d66787b34decae92e151b45) feat: implement upgrade controller
+* [`36742ea`](https://github.com/siderolabs/omni/commit/36742ea5ab1e8a983b73f73443c1cf122a90d054) feat: introduce create, delete and update gRPC APIs
+* [`2b3d314`](https://github.com/siderolabs/omni/commit/2b3d314a460b385d8c13bdd025fadb37b5508bdc) feat: install internal COSI runtime alongside with K8s and Talos
+* [`ae7f784`](https://github.com/siderolabs/omni/commit/ae7f784d08621d18075b1763f026a7513d9d9dcb) refactor: move all generated TypeScript files under `frontend/src/api`
+* [`61bad64`](https://github.com/siderolabs/omni/commit/61bad64540c28fb0520a39a6c64d64c3e9353361) release(v0.1.0-alpha.1): prepare release
+* [`8e5e722`](https://github.com/siderolabs/omni/commit/8e5e7229470713d2fbd5ad0df027bd825f5481e3) feat: implement node reboot controls
+* [`9765a88`](https://github.com/siderolabs/omni/commit/9765a88069f05c49f5a7d854675ee37e1c7a8273) feat: dmesg logs page
+* [`ecbbd67`](https://github.com/siderolabs/omni/commit/ecbbd67936b1fb570d706fe3b93b81f6089b5124) feat: use updated timestamp to display event time on the graph
+* [`7c56773`](https://github.com/siderolabs/omni/commit/7c56773448a496fe1ceeec3c47978975ce336b3a) refactor: use Metadata to pass context in all gRPC calls
+* [`abb4733`](https://github.com/siderolabs/omni/commit/abb47330222217d7d8b5c36ff28902415bc755d8) feat: implement service logs viewer
+* [`8e8e032`](https://github.com/siderolabs/omni/commit/8e8e032b20d082bfd71a26c2af2bbc821d9c2a7b) feat: add ability to pick sort order on the servers page
+* [`1a1c728`](https://github.com/siderolabs/omni/commit/1a1c728ac929bb02db7f1bd0b991a747e63fe81a) fix: resolve the issue with idFn value generating undefined ids
+* [`2e83fe2`](https://github.com/siderolabs/omni/commit/2e83fe23a7feb51b73bc7b53997636b641ae42b9) feat: allow filtering servers by picking from predefined categories
+* [`48f776e`](https://github.com/siderolabs/omni/commit/48f776e10f6c79772481393d7397557419520046) fix: navigate home when changing the context
+* [`a1ce0ca`](https://github.com/siderolabs/omni/commit/a1ce0ca8c8fabb2267c3dc6f6b1509f131e18ba8) fix: resolve services search issues
+* [`5b768f8`](https://github.com/siderolabs/omni/commit/5b768f85277ee31131994ae0b253700a5d26978d) feat: make stacked lists searchable
+* [`ec1bc5b`](https://github.com/siderolabs/omni/commit/ec1bc5b48943e473c756ebc7a8c943a34cdeaeac) feat: implement stats component and add stats to the servers page
+* [`1a85999`](https://github.com/siderolabs/omni/commit/1a8599981f93fc5ce68e23b1b4cd7aabbb43c90c) feat: align Sidero servers list outlook with the wireframes
+* [`524264c`](https://github.com/siderolabs/omni/commit/524264c515a9efdce9f06a3c2ebd59c2979f9b2a) fix: display error message and use proper layout for the spinner
+* [`5263d16`](https://github.com/siderolabs/omni/commit/5263d16cfb936aad9ba461e0cc7b150ff9b806d5) feat: introduce node stats page
+* [`8feb35e`](https://github.com/siderolabs/omni/commit/8feb35e95a6d588e1d9c605231308976be452a2e) feat: make root sidebar sections collapsible
+* [`36ad656`](https://github.com/siderolabs/omni/commit/36ad656a3bbdc1e2915a87c0d09c31738ae3f3c4) feat: detect cluster capabilities
+* [`a25d90d`](https://github.com/siderolabs/omni/commit/a25d90d58a85b3b73432858f134fa09cd1338d5c) feat: support switching context in the UI
+* [`67903e2`](https://github.com/siderolabs/omni/commit/67903e23f49623ae9a9a6b297282c62aa8579aa8) refactor: separate Watch from StackedList
+* [`76b9e1d`](https://github.com/siderolabs/omni/commit/76b9e1dc88cccf74cebb28470eae5e9249809d40) release(v0.1.0-alpha.0): prepare release
+* [`7bde4c8`](https://github.com/siderolabs/omni/commit/7bde4c8c6e16c197578cbb4e037a05d50194958f) fix: cobra command was initialized but not actually used
+* [`04624c9`](https://github.com/siderolabs/omni/commit/04624c95cec587ae0b0d8888d95d484ef8d98cfa) feat: support getting Talos and Kubernetes client configs for a cluster
+* [`219b9c8`](https://github.com/siderolabs/omni/commit/219b9c8663fe03af65796b0b6299cff5e66b3efc) feat: implement notifications component
+* [`f8b19a0`](https://github.com/siderolabs/omni/commit/f8b19a0585e6e19c0e7da4e4afad5bbd264e0029) feat: decouple watch list from the view
+* [`2f8c96e`](https://github.com/siderolabs/omni/commit/2f8c96e44012e7bd0db9869eeb90ab48ff41e162) feat: implement appearance settings modal window
+* [`de745d6`](https://github.com/siderolabs/omni/commit/de745d6b7170a9c509cc835a8b675a1c788e80f4) feat: implement Talos runtime backend
+* [`af69a0d`](https://github.com/siderolabs/omni/commit/af69a0d58906a86974bc7dbec2c09ca9f78b152f) feat: support getting Kubernetes resource through gRPC gateway
+* [`2c50010`](https://github.com/siderolabs/omni/commit/2c50010b0d9f7b168354fedd698600d94123c354) feat: implement breadcrumbs component, add support for table header
+* [`3fc1e80`](https://github.com/siderolabs/omni/commit/3fc1e808875f6f502cd2657c4548dd886fbf465d) feat: implement nodes view
+* [`961e93a`](https://github.com/siderolabs/omni/commit/961e93a4af430eaa9efcd1e2922af8072fe4cf85) feat: implement clusters view
+* [`e8248ff`](https://github.com/siderolabs/omni/commit/e8248ffab89633cae8834631e39cf4dce5e4147a) feat: use plain zap instead of SugaredLogger everywhere
+* [`81ba93d`](https://github.com/siderolabs/omni/commit/81ba93dffdc37efdde06557a1c63511a7d61b2f2) chore: generate websocket protocol messages using protobuf
+* [`37a878d`](https://github.com/siderolabs/omni/commit/37a878dd396b650df8afaf6730f9afe52d35569c) feat: make JS websocket reconnect on connection loss
+* [`23b3281`](https://github.com/siderolabs/omni/commit/23b3281f8880800a9084e1c8a74617fcf966c846) feat: use dynamic watcher to allow listing any kinds of resources
+* [`16475f5`](https://github.com/siderolabs/omni/commit/16475f51cc9651736213b36c57381b24dcabdc62) feat: implement real time update server on top of web sockets
+* [`76b39ae`](https://github.com/siderolabs/omni/commit/76b39ae563d9f09ecac3451389e3d260abdad48d) feat: create hello world Vue app using Kres
+* [`baab493`](https://github.com/siderolabs/omni/commit/baab493f155cbd78c2e8af6ce45268c40ef6aeed) Initial commit
+</p>
+</details>
+
+### Changes since v0.1.0-alpha.1
+<details><summary>55 commits</summary>
+<p>
+
+* [`e096c88`](https://github.com/siderolabs/omni/commit/e096c887604399028a559e33da13653c1f54965d) chore: add resource operation metrics
+* [`741e820`](https://github.com/siderolabs/omni/commit/741e8202c5aecfe171082c38e2c55e0184e9c80c) feat: implement config patch creation UI
+* [`5def267`](https://github.com/siderolabs/omni/commit/5def26706fa21df7748801cbdab5c6e81543174f) fix: attempt to clean up docker container better
+* [`876ff5e`](https://github.com/siderolabs/omni/commit/876ff5ee44d4193c52e4daeec776ad50b69664f9) feat: update COSI and state-etcd to 0.2.0
+* [`3df410d`](https://github.com/siderolabs/omni/commit/3df410d964fc66b2d4ad8c7db0459108d16adde0) test: refactor and update config patch integration tests
+* [`5eea9e5`](https://github.com/siderolabs/omni/commit/5eea9e50b47a6df324f2fd5564aa9010b56e16e0) feat: add TLS support to siderolink API
+* [`36394ea`](https://github.com/siderolabs/omni/commit/36394ea242f9af4d9c17f90ec143b0356fa9e671) refactor: simplify the resource leak fix
+* [`e5b962b`](https://github.com/siderolabs/omni/commit/e5b962b66f158fd31b74dc6b97f524c168b4fad1) chore: update dev environment
+* [`39bf206`](https://github.com/siderolabs/omni/commit/39bf206eec29262b1c15ed557f7f24e029c61206) fix: save user picture and fullname in the local storage
+* [`f1611c1`](https://github.com/siderolabs/omni/commit/f1611c10d26b937b5bae69a1b9eda67d2bc5e137) feat: add machine level config patch support
+* [`f2e6cf5`](https://github.com/siderolabs/omni/commit/f2e6cf5cddb47aaa290e7db1a037f2155fcd60d2) fix: remove several resource/goroutine leaks
+* [`fc37af3`](https://github.com/siderolabs/omni/commit/fc37af36d87e01c3e9f349f206711f154740e0b4) feat: allow destroying config patches in the UI
+* [`3154d59`](https://github.com/siderolabs/omni/commit/3154d591e7c65713c6940d953df45d8242ae9359) fix: respect SIDEROLINK_DEV_JOIN_TOKEN only in debug mode
+* [`38f5380`](https://github.com/siderolabs/omni/commit/38f53802ab3dda70fedc0a81de9d6dd43e6204f1) feat: avoid deleting all resources on omnictl delete
+* [`28666bc`](https://github.com/siderolabs/omni/commit/28666bcb4acaf6e4f053e99d8d45d5dae320c89c) chore: add support for local development using compose
+* [`cad73ce`](https://github.com/siderolabs/omni/commit/cad73cefc6b187a26e3833089e89ca1cb6fbf843) chore: increase TestEtcdAudit timeout and fix incorrect `Assert()` calls.
+* [`7199b75`](https://github.com/siderolabs/omni/commit/7199b75c2108568d8bee82c42fcc00edb4a22e1c) chore: during `config merge` create config if there was none
+* [`dab54d1`](https://github.com/siderolabs/omni/commit/dab54d14fcd8c0fadc6bb2a49d79e90379234403) chore: increase `TestTalosBackendRoles` reliability
+* [`997cd78`](https://github.com/siderolabs/omni/commit/997cd7823bd126302ed4772658c0791768d67638) feat: add reconfiguring phase to machinesetstatus
+* [`81fb2b9`](https://github.com/siderolabs/omni/commit/81fb2b94e61f7e7aaf41075fe17a2bbfea005d9f) fix: fix button order and vue config
+* [`252fb29`](https://github.com/siderolabs/omni/commit/252fb29d64dac660da08459d9c5acc44e457b034) refactor: simplify backend.Server.Run method
+* [`f335c2f`](https://github.com/siderolabs/omni/commit/f335c2f5311a81ca23699c473b68bf6918430aab) refactor: split watch to `Watch` and `WatchFunc`, add unit tests
+* [`35a7919`](https://github.com/siderolabs/omni/commit/35a79193b965d42fba0a649bef0efe82abbd2fd5) feat: track machine config apply status
+* [`1c54710`](https://github.com/siderolabs/omni/commit/1c54710c6f5ebe2740af27cebfb9c5532b22cc26) fix: use rolling update strategy on control planes
+* [`17ccdc2`](https://github.com/siderolabs/omni/commit/17ccdc2f78693b5d1276b843c027e8057faa2ff7) refactor: various logging fixes
+* [`3c9ca9c`](https://github.com/siderolabs/omni/commit/3c9ca9cd83298c5281c7ced50720b341c10a02f0) fix: update node overview Kubernetes node watch to make it compatible
+* [`e8c2063`](https://github.com/siderolabs/omni/commit/e8c20631501308952bbc596e994a71b7677034b3) fix: enable edit config patches button on the cluster overview page
+* [`6e80521`](https://github.com/siderolabs/omni/commit/6e8052169dd672e6fce5668982b704331eac4645) fix: reset the item list after the watch gets reconnected
+* [`620d197`](https://github.com/siderolabs/omni/commit/620d1977a70bbc2cca8b331db825fc7bdb8fcda3) chore: remove AddContext method from runtime.Runtime interface
+* [`8972ade`](https://github.com/siderolabs/omni/commit/8972ade40dea2bf3bf41bcb865a817d90b37657d) chore: update default version of Talos to v1.2.7
+* [`6a2dde8`](https://github.com/siderolabs/omni/commit/6a2dde863d306986027904167f262d4307a7420d) fix: update the config patch rollout strategy
+* [`fb3f6a3`](https://github.com/siderolabs/omni/commit/fb3f6a340c37d1958e36400edf7ca53e2cde48a7) fix: skip updating config status if applying config caused a reboot
+* [`8776146`](https://github.com/siderolabs/omni/commit/877614606d0c7d0259c4e65e4911f331550dd7d7) fix: apply finalizer to the `Machine` only when CMS is created
+* [`134bb20`](https://github.com/siderolabs/omni/commit/134bb2053ce6250b9b4c647f3b2dbb8255cea2ce) test: fix config patch test with reboot
+* [`d3b6b5a`](https://github.com/siderolabs/omni/commit/d3b6b5a75f9ea5304595851d6160e98ec4c9b8aa) feat: implement config patch viewer and editor
+* [`149efe1`](https://github.com/siderolabs/omni/commit/149efe189a24c07e648289ee81d0b95ed1c972b7) chore: bump runtime and state-etcd modules
+* [`c345b83`](https://github.com/siderolabs/omni/commit/c345b8348412aef59cbd43c35bf06ce3eac5ad3f) chore: output omnictl auth log to stderr
+* [`39b2ba2`](https://github.com/siderolabs/omni/commit/39b2ba2a86972324161c6cff056abf10eb2fce5c) refactor: introduce ClusterEndpoint resource
+* [`6998ff0`](https://github.com/siderolabs/omni/commit/6998ff0803063b22e113da0c72356ee254f13143) fix: treat created and updated events same
+* [`289fe88`](https://github.com/siderolabs/omni/commit/289fe88aba94d6cfe4d7be7472b609232e45cbf6) feat: add omnictl apply
+* [`2f1be3b`](https://github.com/siderolabs/omni/commit/2f1be3b4643e2a66a62da6a7f8f1f1da39ed6e17) chore: fix `TestGenerateJoinToken` test
+* [`3829176`](https://github.com/siderolabs/omni/commit/382917630030415b1a218f14f2a1d6d3595834a0) fix: don't close config patch editor window if config validation fails
+* [`c96f504`](https://github.com/siderolabs/omni/commit/c96f5041be7befb517998fc7bbccd135cb76908d) feat: add suspended mode
+* [`b967bcf`](https://github.com/siderolabs/omni/commit/b967bcfd26b2fccfa6bbb08b8a15eb3796e2e872) feat: add last config apply error to clustermachineconfigstatus
+* [`0395d9d`](https://github.com/siderolabs/omni/commit/0395d9dd7b985802be8f4cd2b8005b409faca3de) test: increase key generation timeout on storage signing test
+* [`577eba4`](https://github.com/siderolabs/omni/commit/577eba4231142fe983f9a0f9b5a81280c377686e) fix: set SideroLink MTU to 1280
+* [`0f32172`](https://github.com/siderolabs/omni/commit/0f32172922ed2f7b8b4b7433fb1f9ce104f3c5a8) fix: minor things in frontend
+* [`9abcc7b`](https://github.com/siderolabs/omni/commit/9abcc7b444c49f6223e0ae4948bff13eedbb05b5) test: add config patching integration tests
+* [`99531fb`](https://github.com/siderolabs/omni/commit/99531fbeee982e2ab87d9f0162a0080308b852ab) refactor: drop unneeded controller inputs
+* [`5172354`](https://github.com/siderolabs/omni/commit/51723541621d91964e88e8a5add834159214dc5b) chore: add omnictl to the generated image
+* [`738cf64`](https://github.com/siderolabs/omni/commit/738cf649f53ec29e88112a027ec72f3d6f0cfff8) fix: set cluster machine version in machine config status correctly
+* [`1d0d220`](https://github.com/siderolabs/omni/commit/1d0d220f47f1cc9ca8b20bfef47004a875b7573c) fix: lower ttl of the issued keys on the FE side by 10 minutes
+* [`2889524`](https://github.com/siderolabs/omni/commit/2889524f222e42d49061867b2b2f5b59a16af4ba) feat: dynamic title
+* [`3d17bd7`](https://github.com/siderolabs/omni/commit/3d17bd7cfd4775292090ccb3fd3c2b575b26d449) chore: fix release CI run
+* [`f2c752f`](https://github.com/siderolabs/omni/commit/f2c752fed627006912018ae3e5f2ff0f2bed60b8) fix: properly proxy watch requests through dev-server
+</p>
+</details>
+
+### Dependency Changes
+
+This release has no dependency changes
+
+## [Omni 0.1.0-alpha.1](https://github.com/siderolabs/omni/releases/tag/v0.1.0-alpha.1) (2022-11-10)
+
+Welcome to the v0.1.0-alpha.1 release of Omni!  
+*This is a pre-release of Omni*
+
+
+
+Please try out the release binaries and report any issues at
+https://github.com/siderolabs/omni/issues.
+
+### Contributors
+
+* Artem Chernyshev
+* Andrey Smirnov
+* Artem Chernyshev
+* Dmitriy Matrenichev
+* Philipp Sauter
+* Utku Ozdemir
+* evgeniybryzh
+* Noel Georgi
+* Andrew Rynhard
+* Tim Jones
+* Andrew Rynhard
+* Gerard de Leeuw
+* Steve Francis
+* Volodymyr Mazurets
+
+### Changes
+<details><summary>349 commits</summary>
+<p>
+
+* [`8b284f3`](https://github.com/siderolabs/omni/commit/8b284f3aa26cf8a34452f33807dcc04045e7a098) feat: implement Kubernetes API OIDC proxy and OIDC server
+* [`adad8d0`](https://github.com/siderolabs/omni/commit/adad8d0fe2f3356e97de613104196233a3b98ff5) refactor: rework LoadBalancerConfig/LoadBalancerStatus resources
+* [`08e2cb4`](https://github.com/siderolabs/omni/commit/08e2cb4fd40ec918bf458edd6a5d8e6c86fe5c97) feat: support editing config patches on cluster and machine set levels
+* [`e2197c8`](https://github.com/siderolabs/omni/commit/e2197c83e994afb435671f5af5cdefa843bbddb5) test: e2e testing improvements
+* [`ec9051f`](https://github.com/siderolabs/omni/commit/ec9051f6dfdf1f5acaf3fa6766dc1195b6f6dcdd) fix: config patching
+* [`e2a1d6c`](https://github.com/siderolabs/omni/commit/e2a1d6c78809eaa4168ca5ede433824797a6aa4e) fix: send logs in JSON format by default
+* [`954dd70`](https://github.com/siderolabs/omni/commit/954dd70b935b7c373ba5830fd7ad6e965f6b0da8) chore: replace talos-systems depedencies with siderolabs
+* [`acf94db`](https://github.com/siderolabs/omni/commit/acf94db8ac80fb6f15cc87ff276b7edca0cb8661) chore: add payload logger
+* [`838c716`](https://github.com/siderolabs/omni/commit/838c7168c64f2296a9e01d3ef6ab4feb9f16aeb9) fix: allow time skew on validating the public keys
+* [`dd481d6`](https://github.com/siderolabs/omni/commit/dd481d6cb3620790f6e7a9c8e305defb507cbe5f) fix: refactor runGRPCProxy in router tests to catch listener errors
+* [`e68d010`](https://github.com/siderolabs/omni/commit/e68d010685d4f0a5d25fee671744119cecf6c27b) chore: small fixes
+* [`ad86875`](https://github.com/siderolabs/omni/commit/ad86875ec146e05d7d7f461bf7c8094a8c143df5) feat: minor adjustments on the cluster create page
+* [`e61f194`](https://github.com/siderolabs/omni/commit/e61f1943e965287c79fbaef05760bb0b0deee988) chore: implement debug handlers with controller dependency graphs
+* [`cbbf901`](https://github.com/siderolabs/omni/commit/cbbf901e601d31c777ad2ada0f0036c57020ba96) refactor: use generic TransformController more
+* [`33f9f2c`](https://github.com/siderolabs/omni/commit/33f9f2ce3ec0999198f311ae4bae9b58e57153c9) chore: remove reflect from runtime package
+* [`6586963`](https://github.com/siderolabs/omni/commit/65869636aa33013b5feafb06e727b9d2a4cf1c19) feat: add scopes to users, rework authz & add integration tests
+* [`bb355f5`](https://github.com/siderolabs/omni/commit/bb355f5c659d8c66b825de409d9446767005a2bb) fix: reload the page to init the UI Authenticator on signature fails
+* [`c90cd48`](https://github.com/siderolabs/omni/commit/c90cd48eefa7f29328a456aa5ca474eece17c6fe) chore: log auth context
+* [`d278780`](https://github.com/siderolabs/omni/commit/d2787801a4904fe895996e5319f301a1d7ca76df) fix: update Clusters page UI
+* [`5e77607`](https://github.com/siderolabs/omni/commit/5e776072285e535e93c0458774dcad810b9b857a) tests: abort on first failure
+* [`4c55980`](https://github.com/siderolabs/omni/commit/4c5598083ff6d8763c8763d8e46a3d7b659784ff) chore: get full method name from the service
+* [`2194f43`](https://github.com/siderolabs/omni/commit/2194f4391607e6e73bce1917d2744e78fdd2cebc) feat: redesign cluster list view
+* [`40b3f23`](https://github.com/siderolabs/omni/commit/40b3f23071096987e8a7c6f30a2622c317c190cb) chore: enable gRPC request duration histogram
+* [`0235bb9`](https://github.com/siderolabs/omni/commit/0235bb91a71510cf4d349eedd3625b119c7e4e11) refactor: make sure Talos/Kubernetes versions are defined once
+* [`dd6154a`](https://github.com/siderolabs/omni/commit/dd6154a45d5dcd14870e0aa3f97aa1d4e53bdcfb) chore: add public key pruning
+* [`68908ba`](https://github.com/siderolabs/omni/commit/68908ba330ecd1e285681e24db4b9037eb2e8202) fix: bring back UpgradeInfo API
+* [`f1bc692`](https://github.com/siderolabs/omni/commit/f1bc692c9125f7683fe5f234b03eb3521ba7e773) refactor: drop dependency on Talos Go module
+* [`0e3ef43`](https://github.com/siderolabs/omni/commit/0e3ef43cfed68e53879e6c22b46e7d0568ddc05f) feat: implement talosctl access via Omni
+* [`2b0014f`](https://github.com/siderolabs/omni/commit/2b0014fea15da359217f89ef723965dcc9faa739) fix: provide a way to switch the user on the authenticate page
+* [`e295d7e`](https://github.com/siderolabs/omni/commit/e295d7e2854ac0226e7efda32864f6a687a88470) chore: refactor all controller tests to use assertResource function
+* [`8251dfb`](https://github.com/siderolabs/omni/commit/8251dfb9e44341e9df9471f387cc76c91359cf84) refactor: extract PGP client key handling
+* [`02da9ee`](https://github.com/siderolabs/omni/commit/02da9ee66f15462e6f4d7da18515651a5fde11aa) refactor: use extracted go-api-signature library
+* [`4bc3db4`](https://github.com/siderolabs/omni/commit/4bc3db4dcbc14e0e51c7a3b5257686b671cc2823) fix: drop not working upgrade k8s functional
+* [`17ca75e`](https://github.com/siderolabs/omni/commit/17ca75ef864b7a59f9c6f829de19cc9630a670c0) feat: add 404 page
+* [`8dcde2a`](https://github.com/siderolabs/omni/commit/8dcde2af3ca49d9be16cc705c0b403826f2eee5d) feat: implement logout flow in the frontend
+* [`ba766b9`](https://github.com/siderolabs/omni/commit/ba766b9922302b9d1f279b74caf94e6ca727f86f) fix: make `omnictl` correctly re-auth on invalid key
+* [`fd16f87`](https://github.com/siderolabs/omni/commit/fd16f8743d3843e8ec6735a7c2e96532694b876e) fix: don't set timeout on watch gRPC requests
+* [`8dc3cc6`](https://github.com/siderolabs/omni/commit/8dc3cc682e5419c3824c6e740a32085c386b8817) fix: don't use `omni` in external names
+* [`2513661`](https://github.com/siderolabs/omni/commit/2513661578574255ca3f736d3dfa1f307f5d43b6) fix: reset `Error` field of the `MachineSetStatus`
+* [`b611e99`](https://github.com/siderolabs/omni/commit/b611e99e14a7e2ebc64c55ed5c95a47e17d6ac32) fix: properly handle `Forbidden` errors on the authentication page
+* [`8525502`](https://github.com/siderolabs/omni/commit/8525502265b10dc3cc056d301785f6f60e4f7e22) fix: stop runners properly and clean up StatusMachineSnapshot
+* [`ab0190d`](https://github.com/siderolabs/omni/commit/ab0190d9a41b830daf60173b998acdbcbbdd3754) feat: implement scopes and enforce authorization
+* [`9198d96`](https://github.com/siderolabs/omni/commit/9198d96ea9d57bb5949c59350aec42b2ce13ebac) feat: sign gRPC requests on the frontend to enable Authentication flow
+* [`bdd8f21`](https://github.com/siderolabs/omni/commit/bdd8f216a9eca7ec657fa0dc554e663743f058d1) chore: remove reset button and fix padding
+* [`362db57`](https://github.com/siderolabs/omni/commit/362db570349b4a2659f746ce18a436d684481ecb) fix: gRPC verifier should verify against original JSON payload
+* [`30186b8`](https://github.com/siderolabs/omni/commit/30186b8cfe2eea6eaade8bacf31114886d3da3ea) fix: omnictl ignoring omniconfig argument
+* [`e8ab0ba`](https://github.com/siderolabs/omni/commit/e8ab0ba45648b8f521500b46fe032797da6a111f) fix: do not attempt to execute failed integration test again
+* [`9fda25e`](https://github.com/siderolabs/omni/commit/9fda25ef45f0060cc6c3ec812f5fa1c7b1015801) chore: add more info on errors to different controllers
+* [`ccda526`](https://github.com/siderolabs/omni/commit/ccda5260c4645b5929724574a9f856eeaa4c232f) chore: bump grpc version
+* [`b1ac125`](https://github.com/siderolabs/omni/commit/b1ac1255da5ca4b5d9c409e27c51e4298275e73c) chore: emit log when we got machine status event.
+* [`005d257`](https://github.com/siderolabs/omni/commit/005d257c25c745b61e5a25c39167d511710562c7) chore: set admin role specifically for Reboot request.
+* [`27f0e30`](https://github.com/siderolabs/omni/commit/27f0e309cec76a454e5bb24c2df1e62d9e4718e0) chore: update deps
+* [`77f0219`](https://github.com/siderolabs/omni/commit/77f02198c1e7fb215548f3a0e2be30a0e19aaf6d) test: more unit-tests for auth components
+* [`0bf6ddf`](https://github.com/siderolabs/omni/commit/0bf6ddfa46e0ea6ad255ede00a600c390344e221) fix: pass through HTTP request if auth is disabled
+* [`4f3a67b`](https://github.com/siderolabs/omni/commit/4f3a67b08e03a1bad65c2acb8d65f0281fdd2f9e) fix: unit-tests for auth package and fixes
+* [`e3390cb`](https://github.com/siderolabs/omni/commit/e3390cbbac1d0e78b72512c6ebb64a8f53dcde17) chore: rename arges-theila to omni
+* [`14d2614`](https://github.com/siderolabs/omni/commit/14d2614538ec696d468a0850bd4ee7bc6884c3b1) chore: allow slashes in secretPath
+* [`e423edc`](https://github.com/siderolabs/omni/commit/e423edc072714e7f693249b60079f5f700cc0a65) fix: add unit-tests for auth message and fix issues
+* [`b5cfa1a`](https://github.com/siderolabs/omni/commit/b5cfa1a84e93b6bbf5533c599917f293fc5cdf66) feat: add vault client
+* [`b47791c`](https://github.com/siderolabs/omni/commit/b47791ce303cbb9a8aab279685d17f92a480c7f4) feat: sign grpc requests on cli with pgp key & verify it on server
+* [`d6ef4d9`](https://github.com/siderolabs/omni/commit/d6ef4d9c36758cb0091e2c528b848952f312941a) feat: split account ID and name
+* [`e412e1a`](https://github.com/siderolabs/omni/commit/e412e1a69edad0d19d7e46fa3aa076dcb8e6d4b6) chore: workaround the bind problem
+* [`e23cc59`](https://github.com/siderolabs/omni/commit/e23cc59bb8cb8f9df81738d4c58aed08d80fa9c4) chore: bump minimum Talos version to v1.2.4
+* [`0638a29`](https://github.com/siderolabs/omni/commit/0638a29d78c092641573aa2b8d2e594a7ff6aab4) feat: stop using websockets
+* [`8f3c19d`](https://github.com/siderolabs/omni/commit/8f3c19d0f0ecfbe5beabc7dc508dcafa720e83e2) feat: update install media to be identifiable
+* [`70d1e35`](https://github.com/siderolabs/omni/commit/70d1e354466618bb07c13445a16ca639be12009e) feat: implement resource encryption
+* [`7653638`](https://github.com/siderolabs/omni/commit/76536386499889994b65f66a8a40f18b5535c5ba) fix: fix NPE in integration tests
+* [`e39849f`](https://github.com/siderolabs/omni/commit/e39849f4047f028251123781bd8be350ebbfd65d) chore: update Makefile and Dockerfile with kres
+* [`4709473`](https://github.com/siderolabs/omni/commit/4709473ec20fbf92a3240fb3376a322f1321103a) fix: return an error if external etcd client fails to be built
+* [`5366661`](https://github.com/siderolabs/omni/commit/536666140556ba9b997a2b5d4441ea4b5f42d1c5) refactor: use generic transform controller
+* [`a2a5f16`](https://github.com/siderolabs/omni/commit/a2a5f167f21df6375767d018981651d60bb2f768) feat: limit access to Talos API via Omni to `os:reader`
+* [`e254201`](https://github.com/siderolabs/omni/commit/e2542013938991faa8f1c521fc524b8fcf31ea34) feat: merge internal/external states into one
+* [`3258ca4`](https://github.com/siderolabs/omni/commit/3258ca487c818a34924f138640f44a2e51d307fb) feat: add `ControlPlaneStatus` controller
+* [`1c0f286`](https://github.com/siderolabs/omni/commit/1c0f286a28f5134333130708d031dbfa11051a42) refactor: use `MachineStatus` Talos resource
+* [`0a6b19f`](https://github.com/siderolabs/omni/commit/0a6b19fb916ea301a8f5f6ccd9bbdaa7cb4c39e0) chore: drop support for Talos resource API
+* [`ee5f6d5`](https://github.com/siderolabs/omni/commit/ee5f6d58a2b22a87930d3c8bb9963f71c92f3908) feat: add auth resource types & implement CLI auth
+* [`36736e1`](https://github.com/siderolabs/omni/commit/36736e14e5c837d38568a473834d14073b88a153) fix: use correct protobuf URL for cosi resource spec
+* [`b98c56d`](https://github.com/siderolabs/omni/commit/b98c56dafe33beef7792bd861ac4e637fe13c494) feat: bump minimum version for Talos to v1.2.3
+* [`b93bc9c`](https://github.com/siderolabs/omni/commit/b93bc9cd913b017c66502d96d99c52e4d971e231) chore: move containers and optional package to the separate module
+* [`e1af4d8`](https://github.com/siderolabs/omni/commit/e1af4d8a0bee31721d8946ef452afe04da6b494d) chore: update COSI to v0.2.0-alpha.1
+* [`788dd37`](https://github.com/siderolabs/omni/commit/788dd37c0be32745547ee8268aa0f004041dc96f) feat: implement and enable by default etcd backend
+* [`1b83038`](https://github.com/siderolabs/omni/commit/1b83038b77cab87ffc2d4d73a91582785ed446ef) release(v0.1.0-alpha.0): prepare release
+* [`8a9c4f1`](https://github.com/siderolabs/omni/commit/8a9c4f17ed6ee0d8e4a51b466d60a8278cd50f9c) feat: implement CLI configuration file (omniconfig)
+* [`b0c92d5`](https://github.com/siderolabs/omni/commit/b0c92d56da00529c106f042399c1163375046785) feat: implement etcd audit controller
+* [`0e993a0`](https://github.com/siderolabs/omni/commit/0e993a0977c711fb8767e3de2ad828fd5b9e688f) feat: properly support scaling down the cluster
+* [`264cdc9`](https://github.com/siderolabs/omni/commit/264cdc9e015fd87724c7a07128d1136153732540) refactor: prepare for etcd backend integration
+* [`b519d17`](https://github.com/siderolabs/omni/commit/b519d17971bb1c919286813b4c2465c2f5803a03) feat: show version in the UI
+* [`a2fb539`](https://github.com/siderolabs/omni/commit/a2fb5397f9efb22a1354c5675180ca49537bee55) feat: keep track of loadbalancer health in the controller
+* [`4789c62`](https://github.com/siderolabs/omni/commit/4789c62af0d1694d8d0a492cd6fb7d436e213fe5) feat: implement a new controller that can gather cluster machine data
+* [`bd3712e`](https://github.com/siderolabs/omni/commit/bd3712e13491ede4610ab1452ae85bde6d92b2db) fix: populate machine label field in the patches created by the UI
+* [`ba70b4a`](https://github.com/siderolabs/omni/commit/ba70b4a48623939d31775935bd0338c0d60ab65b) fix: rename to Omni, fix workers scale up, hide join token
+* [`47b45c1`](https://github.com/siderolabs/omni/commit/47b45c129160821576d808d9a46a9ec5d14c6469) fix: correct filenames for Digital Ocean images
+* [`9d217cf`](https://github.com/siderolabs/omni/commit/9d217cf16d432c5194110ae16a566b44b02a567e) feat: introduce new resources, deprecate `ClusterMachineTemplate`
+* [`aee153b`](https://github.com/siderolabs/omni/commit/aee153bedb2f7856913a54b282603b07bf20059b) fix: address style issue in the Pods paginator
+* [`752dd44`](https://github.com/siderolabs/omni/commit/752dd44ac42c95c644cad5640f6b2c5536a29676) chore: update Talos machinery to 1.2.0 and use client config struct
+* [`88d7079`](https://github.com/siderolabs/omni/commit/88d7079a6656605a1a8dfed56d392414583a283e) fix: regenerate sources from proto files that were rolled back.
+* [`84062c5`](https://github.com/siderolabs/omni/commit/84062c53417197417ff636a667289342089f390c) chore: update Talos to the latest master
+* [`5a139e4`](https://github.com/siderolabs/omni/commit/5a139e473abcdf7fd25ad7c61dad8cbdc964a453) fix: properly route theila internal requests in the gRPC proxy
+* [`4be4fb6`](https://github.com/siderolabs/omni/commit/4be4fb6a4e0bca29b32e1b732c227c9e7a0b1f43) feat: add support for 'talosconfig' generation
+* [`9235b8b`](https://github.com/siderolabs/omni/commit/9235b8b522d4bc0712012425b68ff89e455886b9) fix: properly layer gRPC proxies
+* [`9a516cc`](https://github.com/siderolabs/omni/commit/9a516ccb5c892ed8fe41f7cf69aaa5bb1d3fa471) fix: wait for selector of 'View All' to render in e2e tests.
+* [`3cf3aa7`](https://github.com/siderolabs/omni/commit/3cf3aa730e7833c0c1abe42a6afb87a85f14b58c) fix: some unhandled errors in the e2e tests.
+* [`c32c7d5`](https://github.com/siderolabs/omni/commit/c32c7d55c92007aa1aa10feab3c7a7de2b2afc42) fix: ignore updating cluster machines statuses without machine statuses
+* [`4cfa307`](https://github.com/siderolabs/omni/commit/4cfa307b85b410b44e482b259d14670b55e4a237) chore: run rekres, fix lint errors and bump Go to 1.19
+* [`eb2d449`](https://github.com/siderolabs/omni/commit/eb2d4499f1a3da7bc1552a6b099c28bed6fd0e4d) fix: skip the machines in `tearingDown` phase in the controller
+* [`9ebc769`](https://github.com/siderolabs/omni/commit/9ebc769b89a2bab37fd081e555f84e3e4c99187e) fix: allow all services to be proxied by gRPC router
+* [`ea2b01d`](https://github.com/siderolabs/omni/commit/ea2b01d0a0e054b259d710317fe368882534cf4c) fix: properly handle non empty resource id in the K8s resource watch
+* [`3bb7da3`](https://github.com/siderolabs/omni/commit/3bb7da3a0fa6b746f6a7b9aa668e055bdf825e6a) feat: show a Cluster column in the Machine section
+* [`8beb70b`](https://github.com/siderolabs/omni/commit/8beb70b7f045a218f9cb753e1402a07542b0bf1c) fix: ignore tearing down clusters in the `Cluster` migrations
+* [`319d4e7`](https://github.com/siderolabs/omni/commit/319d4e7947cb78135f5a14c02afe5814c56a312c) fix: properly handle `null` memory modules list
+* [`6c2120b`](https://github.com/siderolabs/omni/commit/6c2120b5ae2bd947f473d002dfe165646032e811) chore: introduce migrations manager for COSI DB state
+* [`ec52139`](https://github.com/siderolabs/omni/commit/ec521397946cc15929472feb7c45435fb48df848) fix: filter out invalid memory modules info coming from Talos nodes
+* [`8e87031`](https://github.com/siderolabs/omni/commit/8e870313a3a31d052eecf81acb522433ff98ae79) fix: bump loadbalancer timeout settings
+* [`bc0ed26`](https://github.com/siderolabs/omni/commit/bc0ed2672064a6bf148cd9799b35a2790f5aa7f6) feat: introduce websocket, HTTP requests monitoring
+* [`857401f`](https://github.com/siderolabs/omni/commit/857401f54e3922a9ab85d7dc703a5afb70c6ee45) feat: add HTTP logging (static, gateway), and websocket logging
+* [`eb612a3`](https://github.com/siderolabs/omni/commit/eb612a38e9c71913ebecc9f345e17844d60800b8) fix: do hard stop of events sink gRPC server after 5 seconds
+* [`3162513`](https://github.com/siderolabs/omni/commit/31625135e2b971d6b9f92eb4096c010113030a80) fix: populate nodes filter dropdown properly and rewrite filter function
+* [`5713a51`](https://github.com/siderolabs/omni/commit/5713a516391a5190fac9b7044a9f71952ce15479) fix: make `TSelectList` search filter the items in the dropdown
+* [`f2519ff`](https://github.com/siderolabs/omni/commit/f2519ff51b88766a907f1d7717ef74031157fd56) feat: don't allow using nodes with not enough mem for the cluster
+* [`9e474d6`](https://github.com/siderolabs/omni/commit/9e474d69c76a898fc5b6fcd9fdc8e87f25b7dc53) feat: show disconnected warning in the machines list
+* [`fa52b48`](https://github.com/siderolabs/omni/commit/fa52b48f54362c7305681ca79a7d98237531f2b4) feat: redesign Installation Media selection menu
+* [`01e301a`](https://github.com/siderolabs/omni/commit/01e301a875699cf6fcc887cb31cd7939338f58e9) fix: query node list using `talosctl get members` instead of K8s nodes
+* [`e694df5`](https://github.com/siderolabs/omni/commit/e694df59c50fbee356a48c94ade95e924ea46bb2) fix: display all available Talos versions on cluster create page
+* [`7a87525`](https://github.com/siderolabs/omni/commit/7a87525ed1b928a8f8e3e6a39feb4c19009ec264) fix: use `v-model` instead of callbacks in the inputs
+* [`d681f5f`](https://github.com/siderolabs/omni/commit/d681f5f58788612f144fa1f8d90ec6c996badb0e) feat: support scaling up the clusters
+* [`e992b95`](https://github.com/siderolabs/omni/commit/e992b9574d7b8f76497f46e25764618ec274af1a) feat: show notification on image download progress
+* [`8ea6d9f`](https://github.com/siderolabs/omni/commit/8ea6d9f1724b271919e538ed55ff6582858470f9) fix: probably fix 'context canceled' on image download
+* [`692612b`](https://github.com/siderolabs/omni/commit/692612b7e628588fa7608cff683c5af406f24ca7) fix: improve the Talos image generation process
+* [`a69c140`](https://github.com/siderolabs/omni/commit/a69c140e26f4298fcaafb1f96c389269992fc069) feat: introduce Prometheus metrics
+* [`e90ca78`](https://github.com/siderolabs/omni/commit/e90ca7875c501391f860f5df9f2a4e4f8e2f2d7a) fix: make grpc api listen only on siderolink interface
+* [`99fc28c`](https://github.com/siderolabs/omni/commit/99fc28c36c62a8d8c654c05f9b9c64ff37cedba8) fix: display correct cluster/machine status on ui
+* [`eaf7655`](https://github.com/siderolabs/omni/commit/eaf7655395401cd88e6bd47f4f8aa958abee30f1) fix: add a pause before integration tests
+* [`19ff1c9`](https://github.com/siderolabs/omni/commit/19ff1c909bedf63fe6cf2f5cc0e44f34046ca568) chore: rename download button
+* [`e1c4e1b`](https://github.com/siderolabs/omni/commit/e1c4e1b171eab08585a3315ca5838c88a4d2eb24) feat: add download options for all talos images
+* [`24e7863`](https://github.com/siderolabs/omni/commit/24e786369bfc0bb4966712296395db91751e657b) fix: delete cached clients from gRPC proxy when the cluster is destroyed
+* [`58c89ef`](https://github.com/siderolabs/omni/commit/58c89ef3fe621ef6909c5d38a0d47cc861667f45) feat: implement `argesctl delete` command
+* [`3c99b49`](https://github.com/siderolabs/omni/commit/3c99b49a9b680b091d92455a0d3bc325f8f68ca6) test: add a test which removes allocated machine
+* [`75dd28f`](https://github.com/siderolabs/omni/commit/75dd28f56d7ce9a92b96822a867fbfe2655cd0fa) chore: fill in resource definitions for table headers
+* [`028f168`](https://github.com/siderolabs/omni/commit/028f16886c41b7aa7eafb65308cc4adf4d624037) feat: End-to-end tests with playwright
+* [`6be6b36`](https://github.com/siderolabs/omni/commit/6be6b3605583ce8e8068746624ca86ed6adc37af) chore: bump goimports from 0.1.10 to 0.1.11 and node from 18.5.0 to 18.6.0
+* [`af4da08`](https://github.com/siderolabs/omni/commit/af4da086d4b709f504eda7909a36a8f0cf84e480) test: implement kernel log streaming test
+* [`1eacfee`](https://github.com/siderolabs/omni/commit/1eacfee2c1084040ae2201eba957409218a92c66) feat: implement argesctl machine-logs output in 'zap-like' and 'dmesg' form.
+* [`96ab7ab`](https://github.com/siderolabs/omni/commit/96ab7ab8317898dd45d129d5cecd2aaf1d379fba) chore: ignore memory modules with zero size
+* [`fd0575f`](https://github.com/siderolabs/omni/commit/fd0575ff4050702c9d07e34c7d9d5596b4ad7311) chore: retrieve k8s versions from github registry
+* [`8651527`](https://github.com/siderolabs/omni/commit/86515275a77741bacc790d2006f3671a5cfb27c6) feat: redo errgroup to return error on first nil error
+* [`944222d`](https://github.com/siderolabs/omni/commit/944222d06607079b5d982afe4b19fc1dda7f1ec2) fix: show ClusterMachineStatus.Stage in 'Clusters' view
+* [`f3f6b6e`](https://github.com/siderolabs/omni/commit/f3f6b6eecd3ffc13b69845dff50d2e8ab31bc0d2) chore: refactor run method and no longer ignore log receiver listener errors
+* [`b316377`](https://github.com/siderolabs/omni/commit/b316377b277f87a184b969b3bbf20ebe6047a0a8) chore: rename 'Dmesg' to 'Console'
+* [`19ee857`](https://github.com/siderolabs/omni/commit/19ee8578a6f1c1bf742699d1b5720dc4c2674c82) test: add a way to recover deleted machines
+* [`e5b5bdc`](https://github.com/siderolabs/omni/commit/e5b5bdc39fa6f3812b15771366f942ddcbe7f328) fix: update SideroLink library for EEXIST fixes
+* [`363de69`](https://github.com/siderolabs/omni/commit/363de69a50b5c1e9d07fa42152cca935844d118b) fix: spec collector equality
+* [`841f3b2`](https://github.com/siderolabs/omni/commit/841f3b22aacc6d2875062ef324d900c5f2091f9d) feat: add ability to supply machine config patches on the machines
+* [`907ca93`](https://github.com/siderolabs/omni/commit/907ca93247267d80125866c2b60225ceca3ada27) test: fix link destroy test
+* [`4c9f99d`](https://github.com/siderolabs/omni/commit/4c9f99d32874cdaff1eb651bf6d74ef39167c273) fix: remove machine status if the machine is in tearing down phase
+* [`d9747e5`](https://github.com/siderolabs/omni/commit/d9747e552e52156a9baeae962a9478231e26c566) fix: make cluster machine status test more reliable
+* [`3bfff3b`](https://github.com/siderolabs/omni/commit/3bfff3bb0eea9d18956dee21aff7f3de900c6b82) fix: do not set up full theila runtime during clients tests
+* [`4bf33bc`](https://github.com/siderolabs/omni/commit/4bf33bc9d37404a733c5039784c80e92800fb3dc) fix: immediately fail the request if the cluster is down
+* [`124a5c2`](https://github.com/siderolabs/omni/commit/124a5c2947978e6bc86d1b19c9eacbcf7f870b53) fix: ensure the created date on resources is set
+* [`14161bf`](https://github.com/siderolabs/omni/commit/14161bf3dad4484868359d186d99d9198b6eed95) feat: add scale up integration test and minor log fixes
+* [`7af06fd`](https://github.com/siderolabs/omni/commit/7af06fd75959eb9e807680ac8a6ba4f0a7f59255) feat: make integration tests a subtests of one global test
+* [`f7c1464`](https://github.com/siderolabs/omni/commit/f7c1464a1002f63daab29b36d19ea16de0cd5794) feat: implement log receiver for logs from Talos
+* [`5b800ea`](https://github.com/siderolabs/omni/commit/5b800ea970215fb4e100ed7b3b73d7e218fd6d86) fix: accumulate bytes received/send in the link resource
+* [`b3b1e9b`](https://github.com/siderolabs/omni/commit/b3b1e9bbfbf62632dc0d8c2239a72793883101ce) feat: machine removal
+* [`fb01bc4`](https://github.com/siderolabs/omni/commit/fb01bc4b26c5b37f15bac923450e1f58fb7a3d89) fix: use Talos 1.2.0
+* [`3a50efe`](https://github.com/siderolabs/omni/commit/3a50efe363c4724f369a02f672848ad7c284847c) feat: filter machines that can be added to cluster
+* [`ba62db5`](https://github.com/siderolabs/omni/commit/ba62db521b47049e92557bf8cfc5f737e496bf57) fix: properly parse `siderolink-api-advertised-url` if there's no port
+* [`96f835a`](https://github.com/siderolabs/omni/commit/96f835a91136f62d9dbdf5c1d1c46c729d57e51e) fix: properly display node selectors in FireFox
+* [`12c20a4`](https://github.com/siderolabs/omni/commit/12c20a42c9dfdea5f88e0e7942fbdb42ea543b95) fix: populate disks when machines are connected during cluster create
+* [`0dc97f8`](https://github.com/siderolabs/omni/commit/0dc97f8696a7c571d5318daf794700342e06f639) fix: adjust overview page to look closer to the mockups
+* [`2b77af8`](https://github.com/siderolabs/omni/commit/2b77af8d39e555970487c3265dfbd63412e90d2f) feat: add the chart showing the count of clusters
+* [`a1dff65`](https://github.com/siderolabs/omni/commit/a1dff6589d64207e6e7331d0407e7857f9c4079d) feat: implement ISO download with embedded kernel args
+* [`37c03d8`](https://github.com/siderolabs/omni/commit/37c03d8cb04b02e79f42e70eeea1e4368445604d) test: pull kubeconfig and interact with Kubernetes API
+* [`75bfb08`](https://github.com/siderolabs/omni/commit/75bfb08f0738fc9f67259caf12902db67860370f) fix: ignore the error on splitting host/port
+* [`3be5a32`](https://github.com/siderolabs/omni/commit/3be5a3254168cddec8f1629789c2ae50d9eaa08e) feat: make the whole cluster list item clickable, add dropdown menu item
+* [`2c9dc99`](https://github.com/siderolabs/omni/commit/2c9dc99000266b3d4c139f27dea4f6283709251e) fix: adjust the look of the Overview page a bit
+* [`aa4a926`](https://github.com/siderolabs/omni/commit/aa4a926cbb85bf63312493b937440a174aed5070) feat: add the button for downloading cluster Kubeconfig on overview page
+* [`4532de6`](https://github.com/siderolabs/omni/commit/4532de6f3d514a534c38a63731c43075698f5c01) feat: support basic auth in `argesctl` command
+* [`b66bb3c`](https://github.com/siderolabs/omni/commit/b66bb3cbcc85d7be4348ecd9a6d5d62f72a90e11) feat: add summary information Overview page
+* [`3bdbce4`](https://github.com/siderolabs/omni/commit/3bdbce41a3ed89a42556d837bc0c5cfe417e22e6) test: more cluster creation tests, two clusters, cleanup
+* [`3b00bd5`](https://github.com/siderolabs/omni/commit/3b00bd5bf417c5c9cb42471d27811c1849a40c78) fix: improve cluster deletion and node reset flow
+* [`2d83d16`](https://github.com/siderolabs/omni/commit/2d83d1694ec73da818004f91ede76a0bca30fe79) test: create a cluster and verify cluster machine statuses
+* [`f471cfd`](https://github.com/siderolabs/omni/commit/f471cfdcf7c9e70f37436e173c3a58c1965e8bb2) fix: copy all labels from the `ClusterMachine` to `ClusterMachineStatus`
+* [`ec32f86`](https://github.com/siderolabs/omni/commit/ec32f8632db104efd6fedc5421179175274d6339) test: add integration tests up to the cluster creation
+* [`a8d3ee5`](https://github.com/siderolabs/omni/commit/a8d3ee5b14a57ad1d9d88512a95032bbda61e734) feat: add kubeconfig command to argesctl and fix kubeconfig
+* [`10b9a3b`](https://github.com/siderolabs/omni/commit/10b9a3ba676a636e488805ed04a0c908c3d2cf53) test: implement API integration test
+* [`3e6b891`](https://github.com/siderolabs/omni/commit/3e6b8913f916dc5e8ac3ef49e14648defa6e1bf6) feat: aggregate cluster machine statuses in cluster status controller
+* [`f6cbc58`](https://github.com/siderolabs/omni/commit/f6cbc58a91124833f0cbae4ecd0c0416acbe8bfa) chore: ignore empty processor info
+* [`c5fc71b`](https://github.com/siderolabs/omni/commit/c5fc71b86a5492d548ae9098c5c74de240ebd800) fix: clean up Kubernetes client and configs when a cluster is destroyed
+* [`e8478fe`](https://github.com/siderolabs/omni/commit/e8478fe5280d5e8a32bb423ec96edacadabc7e43) fix: properly use tracker to cleanup `ClusterMachineConfig` resources
+* [`044fcad`](https://github.com/siderolabs/omni/commit/044fcadb66de61742ab871d10f3fcf0f453f6e27) fix: make `MachineStatusController` connect to configured nodes
+* [`2867099`](https://github.com/siderolabs/omni/commit/2867099a52d651c3b0f9d3abbae266f2792cafe7) feat: add api endpoint to fetch kubeconfig
+* [`5f32667`](https://github.com/siderolabs/omni/commit/5f3266747012b590dd7a7d0ebc23ee0e80abb2ab) test: support registry mirrors for development purposes
+* [`5114695`](https://github.com/siderolabs/omni/commit/5114695cfeb0b6c792002ff5f0f31c1944c269ab) refactor: consistent flag naming
+* [`9ffb19e`](https://github.com/siderolabs/omni/commit/9ffb19e77968c6e411903a2c59fd9a18063b46d4) chore: use latest node
+* [`5512321`](https://github.com/siderolabs/omni/commit/5512321f05b6b657a28abc25470664f6eb6e3d0a) refactor: set better defaults for cli args
+* [`ff88242`](https://github.com/siderolabs/omni/commit/ff882427f56e42039b79900380b61b86d3290269) chore: mark 'siderolink-wireguard-endpoint' flags as required
+* [`4a9d9ad`](https://github.com/siderolabs/omni/commit/4a9d9adef1e521d3c0293b6dc414f572bd8a93d4) feat: add the ClusterMachineStatus resource
+* [`e4e8b62`](https://github.com/siderolabs/omni/commit/e4e8b6264cb48edd014f97129f52aefaa129fd63) refactor: unify all Arges API under a single HTTP server
+* [`5af9049`](https://github.com/siderolabs/omni/commit/5af9049bdc2e09bf410e1b0646e4e08a4366f33b) chore: rename sidebar item
+* [`a4fc47f`](https://github.com/siderolabs/omni/commit/a4fc47f97d79259532b91a8d391e84b59554ed8e) chore: fix build warning
+* [`547b83c`](https://github.com/siderolabs/omni/commit/547b83c4a2a543d5b6ce4dca6cf6f5de87c33dcb) chore: bump siderolink version
+* [`11c31f3`](https://github.com/siderolabs/omni/commit/11c31f39d834e3352b086c1aec665065fd74e944) refactor: drop one of the layered gRPC servers
+* [`0adbbb7`](https://github.com/siderolabs/omni/commit/0adbbb7edfeacedd98a7e84c2f45ac458750a281) feat: introduce a way to copy kernel arguments from the UI
+* [`ce5422a`](https://github.com/siderolabs/omni/commit/ce5422a27771a94cc25be70ec756711d140b2758) fix: import new COSI library to fix YAML marshaling
+* [`d6cec09`](https://github.com/siderolabs/omni/commit/d6cec099cb6f4c3118e4263b9517176858bb9cfb) feat: implement Arges API client, and minimal `argesctl`
+* [`65c8d68`](https://github.com/siderolabs/omni/commit/65c8d683187d82dc730752294c1bc03657f5df78) feat: implement cluster creation view
+* [`8365b00`](https://github.com/siderolabs/omni/commit/8365b00df90ac55f99e0f82e1fa6d4367ebd6a3f) feat: re-enable old Theila UI
+* [`63e703c`](https://github.com/siderolabs/omni/commit/63e703c4e1dfb4bf645fbc9cd28ba2a722e04dc2) fix: update Talos to the latest master
+* [`d33e27b`](https://github.com/siderolabs/omni/commit/d33e27b49113729c5538fce688832152ff96a7ea) feat: implement clusters list view
+* [`cb9e23c`](https://github.com/siderolabs/omni/commit/cb9e23ca6f420ac7b71acf6b19e9012265f3c69b) feat: protect Theila state from external API access
+* [`952c235`](https://github.com/siderolabs/omni/commit/952c2359b32fdd077d85e312707f8b9c9e01ea0c) fix: properly allocated ports in the loadbalancer
+* [`a58c479`](https://github.com/siderolabs/omni/commit/a58c479e9e31f70e806a1f3482b9b984c5c0ca68) chore: report siderolink events kernel arg
+* [`8a56fe3`](https://github.com/siderolabs/omni/commit/8a56fe34ce1966fe28f9e432c696fdd779dfb638) refactor: move Theila resources to public `pkg/`
+* [`1251699`](https://github.com/siderolabs/omni/commit/12516996eda859db6677403ad1f72a3994ea180b) fix: reset the `MachineEventsSnapshot` after the node is reset
+* [`9a2e6af`](https://github.com/siderolabs/omni/commit/9a2e6af3113b795f57c4e3a86c1348b120fa3bbd) feat: implement bootstrap controller
+* [`7107e27`](https://github.com/siderolabs/omni/commit/7107e27ee6b9ba644fc803e4463cbfcf26cf97de) feat: implement apply and reset config controller
+* [`1579eb0`](https://github.com/siderolabs/omni/commit/1579eb09eb58f2cb679205e9e204369f3a362e07) feat: implement machine events handler and `ClusterStatus`
+* [`7214f4a`](https://github.com/siderolabs/omni/commit/7214f4a514a921d6b9df7515116613996416f383) feat: implement cluster load balancer controller
+* [`9c4fafa`](https://github.com/siderolabs/omni/commit/9c4fafaf6b8dc9b7ff08fe28704ca6a2e7efc097) feat: add a controller that manages load balancers for talos clusters
+* [`7e3d80c`](https://github.com/siderolabs/omni/commit/7e3d80ce956d621ed79e4db094808831e18db85b) feat: add a resources that specify configurations for load balancers
+* [`dc0d356`](https://github.com/siderolabs/omni/commit/dc0d356a181b4c37670d2ed4e8d7af370dccef60) feat: support Theila runtime watch with label selectors
+* [`6a568a7`](https://github.com/siderolabs/omni/commit/6a568a72922e34e91f5448d3c1caa2f0b3a02e96) feat: implement `ClusterMachineConfig` resource and it's controller
+* [`3db0f1c`](https://github.com/siderolabs/omni/commit/3db0f1c9d4e2d6f962b6f3216a4f9c7e2575dd21) feat: implement `TalosConfig` controller
+* [`b7ae8e1`](https://github.com/siderolabs/omni/commit/b7ae8e113dc68acd87c4cfe5e3c8349d32bc392d) feat: introduce `Cluster` controller that adds finalizers on Clusters
+* [`8d7ea02`](https://github.com/siderolabs/omni/commit/8d7ea0293e8f57388fd483dc82e79e6b4c76a53f) chore: use label selectors in `TalosConfig`, set labels on the resources
+* [`cff9cb1`](https://github.com/siderolabs/omni/commit/cff9cb19ba8718fdad509b5e91cb8221c6c1ff00) fix: separate advertised endpoint from the actual wireguard endpoint
+* [`5be6cc3`](https://github.com/siderolabs/omni/commit/5be6cc391adf8bcb58b8d47f09dad5aa75d1ad98) feat: implement cluster creation UI
+* [`a1633eb`](https://github.com/siderolabs/omni/commit/a1633eb18772b9e99d687dfddd12fc09fd1ea5c4) chore: add typed wrappers around State, Reader and Writer
+* [`5515f3d`](https://github.com/siderolabs/omni/commit/5515f3d004f54455a1eb1f4977bbb9d663fd1bca) feat: add `ClusterSecrets` resource and controller and tests
+* [`7226f6c`](https://github.com/siderolabs/omni/commit/7226f6cdc60eeb4d6040d1aa0711fed378c50b33) feat: add `Cluster`, `ClusterMachine` and `TalosConfig` resources
+* [`ec44930`](https://github.com/siderolabs/omni/commit/ec44930672ca8954c6ba68975c1799a087ec0c43) feat: enable vtprotobuf optimized marshaling
+* [`15be219`](https://github.com/siderolabs/omni/commit/15be2198872fb637f7ba2e1ff550e4466179f2b1) feat: generate TS constants from go `//tsgen:` comments
+* [`caa4c4d`](https://github.com/siderolabs/omni/commit/caa4c4d285dcd1176a70d87f28ee303cd0483ca8) fix: resource equality for proto specs
+* [`beeca88`](https://github.com/siderolabs/omni/commit/beeca886213332f313f7f3a477d7e7c508e6d058) refactor: clarify code that creates or gets links for nodes
+* [`340c63a`](https://github.com/siderolabs/omni/commit/340c63ad4ba918d4b11ab1f57fdbd3b5e5d8b3dc) feat: implement `Machines` page
+* [`f7bc0c6`](https://github.com/siderolabs/omni/commit/f7bc0c69c69fe515cfa729bc062c730756a53019) feat: accept nodes if they provide the correct join token
+* [`bdf789a`](https://github.com/siderolabs/omni/commit/bdf789a35da5491a4fcbd2af35a1c6efd22ab1fc) feat: immediately reconnect SideroLink peers after Arges restart
+* [`6b74fa8`](https://github.com/siderolabs/omni/commit/6b74fa82ca5757d6f3809853c1ac3e7754efb06d) feat: implement MachineStatusController
+* [`f5db0e0`](https://github.com/siderolabs/omni/commit/f5db0e05a87d5c11b4a1029b14020b19ca67035d) feat: add more info to the siderolink connection spec
+* [`d3e4a71`](https://github.com/siderolabs/omni/commit/d3e4a71af8fd79328e4edda6d9642b83902b2003) refactor: simplify the usage of gRPC resource CRUD API
+* [`2430115`](https://github.com/siderolabs/omni/commit/2430115af1aaac4226b7d5821e1fe706a1088501) feat: implement MachineController and small fixes
+* [`e31d22d`](https://github.com/siderolabs/omni/commit/e31d22d7639753df53c130461ae1f96b9126f3a5) feat: support running Theila without contexts
+* [`a6b3646`](https://github.com/siderolabs/omni/commit/a6b364626bd808687d5ad95307766344b16dd042) refactor: small fixes
+* [`33d2b59`](https://github.com/siderolabs/omni/commit/33d2b59c202f03785580209c885aa297c023fa60) refactor: clean up a bit SideroLink code, fix shutdown
+* [`98ec883`](https://github.com/siderolabs/omni/commit/98ec8830308755c7073a5d4510483e97d8e1d02d) chore: rename main executable to avoid clashing with Theila project
+* [`828721d`](https://github.com/siderolabs/omni/commit/828721d9aa5d912cce628256f75579309d1ad67d) feat: enable COSI persistence for resources
+* [`f1f7883`](https://github.com/siderolabs/omni/commit/f1f788344254e18bcab00a25b56a86289bfb1638) feat: set up siderolink endpoints in Theila
+* [`6439335`](https://github.com/siderolabs/omni/commit/64393353ca7cf430f82bfe73a004da319da28261) refactor: migrate to `typed.Resource` in Theila internal state
+* [`6195274`](https://github.com/siderolabs/omni/commit/61952742a47ea89e89228f057d0d3de351766150) refactor: restructure folders in the project
+* [`1abf72b`](https://github.com/siderolabs/omni/commit/1abf72b4b2e382fe0cf9302b42242152c255a3ee) chore: update Talos libs to the latest version
+* [`16dffd9`](https://github.com/siderolabs/omni/commit/16dffd9058570477b3a648896a89e6445e5b0162) fix: display delta time for pod's age
+* [`8b80726`](https://github.com/siderolabs/omni/commit/8b807262b23cfa830f3ff444d49f11b3a1654703) feat: update favicon to sidero logo
+* [`2da7378`](https://github.com/siderolabs/omni/commit/2da737841c2ae0bf1f1f916dc6f45b1e3996d6e4) feat: show the extended hardware info
+* [`d3c6004`](https://github.com/siderolabs/omni/commit/d3c6004f9767bf0cff9191dc130308c848ede077) chore: allow getting resources without version and group
+* [`eb19087`](https://github.com/siderolabs/omni/commit/eb190875b30275195e52f1a95ed0bb3aae08424f) fix: remove t-header error notification
+* [`5a28202`](https://github.com/siderolabs/omni/commit/5a28202c939ef9683d14fb3d873e0bacb35577db) feat: restyle t-alert component
+* [`9f2b482`](https://github.com/siderolabs/omni/commit/9f2b48228bbfa39d33b07ae43e9fdb34192c3eed) fix: get rid of racy code in the kubeconfig request code
+* [`c40824e`](https://github.com/siderolabs/omni/commit/c40824ecc5d10cb5289e133b8b1f51213aa12f7f) feat: add text Highlight feature
+* [`9018c81`](https://github.com/siderolabs/omni/commit/9018c81bd0d7c58bb5c632c06f3c3904f6674e03) feat: use `~/.talos/config` as a primary source for clusters
+* [`e10547b`](https://github.com/siderolabs/omni/commit/e10547b5761ad96ab8b5766fe5c3f06fcdf86477) refactor: remove old components and not used code parts
+* [`f704684`](https://github.com/siderolabs/omni/commit/f7046846ea8e83a0e39647c4fcc49addf4c56061) fix: properly calculate servers capacity
+* [`755a077`](https://github.com/siderolabs/omni/commit/755a0779014b0a4177e0fc5180db20720be5a814) fix: use proper units for memory and CPU charts on the node monitor page
+* [`d0a083d`](https://github.com/siderolabs/omni/commit/d0a083d1c15c319e236dd258fabcc9a231f797a1) release(v0.2.0-alpha.0): prepare release
+* [`53878ee`](https://github.com/siderolabs/omni/commit/53878eea09c18f2bc0dd55ca11a6743587748319) fix: properly update servers menu item when the context is changed
+* [`b4cb9c7`](https://github.com/siderolabs/omni/commit/b4cb9c7989ec5299785b86acb3fa0ee648efd259) feat: restyle TMonitor page
+* [`f0377e2`](https://github.com/siderolabs/omni/commit/f0377e2ad5da702af71f2706141f4d7c638c7a15) fix: invert chart value for cpu, storage and memory on the overview page
+* [`6ea6ecf`](https://github.com/siderolabs/omni/commit/6ea6ecf12c4d8b5253b4dfc2e64f5b5d787d022a) fix: update capi-utils to fix talosconfig requests for CAPI clusters
+* [`e3796d3`](https://github.com/siderolabs/omni/commit/e3796d3876d33248fd0998901273a14d29a487a3) chore: update capi-utils
+* [`39186eb`](https://github.com/siderolabs/omni/commit/39186ebe50da531f35d21ac2488f8a58c1ef8e78) feat: implement overview page, cluster dropdown, ongoing tasks
+* [`59f2b27`](https://github.com/siderolabs/omni/commit/59f2b27be4d7f5a591fdeae533d649494356250d) docs: update README.md
+* [`2b7831f`](https://github.com/siderolabs/omni/commit/2b7831f2d22106ac8a82f890d73c2705841b0739) feat: add Kubernetes and Servers pages
+* [`4451a5b`](https://github.com/siderolabs/omni/commit/4451a5bc9f5c6b058c6bcf1252b7c83a001cafbe) fix: properly set TaskStatus namespace in the initial call
+* [`4545464`](https://github.com/siderolabs/omni/commit/454546425f2fd7e4418aa8a03465f3a062de804e) fix: add new fields to the TaskStatus spec, update Talos
+* [`891cf3b`](https://github.com/siderolabs/omni/commit/891cf3b79c8430deeed8a168955afd6e97083baa) docs: describe client context types, usage
+* [`309b515`](https://github.com/siderolabs/omni/commit/309b51545ead2ee144244591df2e5ead2849fb11) feat: update k8s upgrades tasks structure for the new UI representation
+* [`5aa8ca2`](https://github.com/siderolabs/omni/commit/5aa8ca24bd3159879c46c8e8a134702b174e3362) feat: add NodesPage
+* [`db434e0`](https://github.com/siderolabs/omni/commit/db434e07b9f23562bd746a0f78e3868b079006e2) feat: add TPagination component
+* [`0b51727`](https://github.com/siderolabs/omni/commit/0b51727efed31f13f52fa20b360071e7e2a6d9eb) feat: add Pods, Dashboard, Upgrade views, etc
+* [`c549b8b`](https://github.com/siderolabs/omni/commit/c549b8b9ee8a563f14b2e791f91a7b3cb0430aa7) feat: add Overview and Upgrade Kubernetes pages
+* [`cec2e85`](https://github.com/siderolabs/omni/commit/cec2e854f4f3999109220902bccaee6c25d1f502) chore: define constants for all used resource types
+* [`962bdaf`](https://github.com/siderolabs/omni/commit/962bdaf6406ab8e5febea0ad8d32da9c86fa39e7) feat: add TSideBar
+* [`fa28ccb`](https://github.com/siderolabs/omni/commit/fa28ccb67f52c1dd9096b23388427d78be526275) feat: add TheHeader component
+* [`f3418a5`](https://github.com/siderolabs/omni/commit/f3418a59e38e551bd0be7cc7ae66ef4645719aa7) feat: button;icons;config
+* [`db30f50`](https://github.com/siderolabs/omni/commit/db30f503730bdbd8ed359d4070dea0214df67fcd) fix: add `frontend/node_modules` to gitignore
+* [`a675b86`](https://github.com/siderolabs/omni/commit/a675b86f7d55cecd4ae1277cbf057a6bc264940c) fix: properly pass label selector to the metadata in ClusterListItem
+* [`7911d6a`](https://github.com/siderolabs/omni/commit/7911d6a31abdb51e86586a025b705ddfeb1dd19e) chore: add ability to start local development server for the frontend
+* [`076fee1`](https://github.com/siderolabs/omni/commit/076fee10c6583dc49e6530b02cab1f757da0e853) feat: use CAPI utils for CAPI requests
+* [`5ed5ba2`](https://github.com/siderolabs/omni/commit/5ed5ba2a122585a97cf65c3ff081126752cd26fa) fix: more websocket client bugfixes
+* [`6fe22ad`](https://github.com/siderolabs/omni/commit/6fe22ad370026380ba75b38e261870addc341e6f) fix: reset reconnect timeouts after the client is reconnected
+* [`c4b144a`](https://github.com/siderolabs/omni/commit/c4b144af272a46dbdc8d1bb35784e09ba1b79987) fix: talosconfig/kubeconfig when using the default context
+* [`b439a37`](https://github.com/siderolabs/omni/commit/b439a371c13a8d46d986a1dae3d6f4b7cba4a298) fix: properly handle Same-Origin header in websockets
+* [`ffffed1`](https://github.com/siderolabs/omni/commit/ffffed100cec18209bae723b9919eb8613950649) fix: read node name from nodename resource instead of hostname
+* [`2d6f984`](https://github.com/siderolabs/omni/commit/2d6f9844440a6d18b3093dea6228ac6a237dc86b) fix: use secure websockets if the page itself is using https
+* [`799f2d2`](https://github.com/siderolabs/omni/commit/799f2d2d00762d5270dd4a3f4b4b312b32dbb7dd) feat: rework the node overview page
+* [`0d0eaf4`](https://github.com/siderolabs/omni/commit/0d0eaf4b2721dfa1b04bce24e4a1e476579e3a74) fix: make charts height resize depending on the screen height
+* [`7de0101`](https://github.com/siderolabs/omni/commit/7de0101bf0e613653caadd5733db0e29a6bb5bfb) fix: use polyfill to fix streaming APIs on Firefox
+* [`0cff2b0`](https://github.com/siderolabs/omni/commit/0cff2b02b5d8b2c2c644067cf6bd3ed573cb784d) feat: small UI adjustments
+* [`d70bd41`](https://github.com/siderolabs/omni/commit/d70bd41992e13fb3dacc1740532083a8f6ce9afa) feat: implement accept Sidero server functional
+* [`f3a6e16`](https://github.com/siderolabs/omni/commit/f3a6e16a79e1bca9ea6c87eb0d3e0f2a6c65ff2e) feat: add top processes list to the Overview page
+* [`3cf97e4`](https://github.com/siderolabs/omni/commit/3cf97e4b9e07f8383da8a6fb7a993b70c8f82503) refactor: use the same object for gRPC metadata context and messages
+* [`243206f`](https://github.com/siderolabs/omni/commit/243206f95aa6ba944bd4361db6274e7072bae1fc) release(v0.1.0-alpha.2): prepare release
+* [`e5b6f29`](https://github.com/siderolabs/omni/commit/e5b6f29fd298904e06284a67681cc0ce5135145f) feat: implement node Reset
+* [`bcb7d23`](https://github.com/siderolabs/omni/commit/bcb7d237c31f42a35f5c3b53e7615ddae1ce0a8b) fix: node IP not being truncated
+* [`e576d33`](https://github.com/siderolabs/omni/commit/e576d33ba40f629eed14668f2d9bf77d7fef62c2) feat: add upgrade UI for CAPI clusters
+* [`10cdce7`](https://github.com/siderolabs/omni/commit/10cdce7fcc219af969a85a41d18fb904936faa0a) fix: server labels key/value order and chevron orientation
+* [`4007177`](https://github.com/siderolabs/omni/commit/40071775d6de1eea697f67e55441c384c86e75d9) feat: implement Kubernetes upgrade UI components
+* [`f4917ee`](https://github.com/siderolabs/omni/commit/f4917eecfb3173acf7518883c738118c8537d657) fix: accumulate chart updates into a single update
+* [`414d76c`](https://github.com/siderolabs/omni/commit/414d76c1c926695e5d66787b34decae92e151b45) feat: implement upgrade controller
+* [`36742ea`](https://github.com/siderolabs/omni/commit/36742ea5ab1e8a983b73f73443c1cf122a90d054) feat: introduce create, delete and update gRPC APIs
+* [`2b3d314`](https://github.com/siderolabs/omni/commit/2b3d314a460b385d8c13bdd025fadb37b5508bdc) feat: install internal COSI runtime alongside with K8s and Talos
+* [`ae7f784`](https://github.com/siderolabs/omni/commit/ae7f784d08621d18075b1763f026a7513d9d9dcb) refactor: move all generated TypeScript files under `frontend/src/api`
+* [`61bad64`](https://github.com/siderolabs/omni/commit/61bad64540c28fb0520a39a6c64d64c3e9353361) release(v0.1.0-alpha.1): prepare release
+* [`8e5e722`](https://github.com/siderolabs/omni/commit/8e5e7229470713d2fbd5ad0df027bd825f5481e3) feat: implement node reboot controls
+* [`9765a88`](https://github.com/siderolabs/omni/commit/9765a88069f05c49f5a7d854675ee37e1c7a8273) feat: dmesg logs page
+* [`ecbbd67`](https://github.com/siderolabs/omni/commit/ecbbd67936b1fb570d706fe3b93b81f6089b5124) feat: use updated timestamp to display event time on the graph
+* [`7c56773`](https://github.com/siderolabs/omni/commit/7c56773448a496fe1ceeec3c47978975ce336b3a) refactor: use Metadata to pass context in all gRPC calls
+* [`abb4733`](https://github.com/siderolabs/omni/commit/abb47330222217d7d8b5c36ff28902415bc755d8) feat: implement service logs viewer
+* [`8e8e032`](https://github.com/siderolabs/omni/commit/8e8e032b20d082bfd71a26c2af2bbc821d9c2a7b) feat: add ability to pick sort order on the servers page
+* [`1a1c728`](https://github.com/siderolabs/omni/commit/1a1c728ac929bb02db7f1bd0b991a747e63fe81a) fix: resolve the issue with idFn value generating undefined ids
+* [`2e83fe2`](https://github.com/siderolabs/omni/commit/2e83fe23a7feb51b73bc7b53997636b641ae42b9) feat: allow filtering servers by picking from predefined categories
+* [`48f776e`](https://github.com/siderolabs/omni/commit/48f776e10f6c79772481393d7397557419520046) fix: navigate home when changing the context
+* [`a1ce0ca`](https://github.com/siderolabs/omni/commit/a1ce0ca8c8fabb2267c3dc6f6b1509f131e18ba8) fix: resolve services search issues
+* [`5b768f8`](https://github.com/siderolabs/omni/commit/5b768f85277ee31131994ae0b253700a5d26978d) feat: make stacked lists searchable
+* [`ec1bc5b`](https://github.com/siderolabs/omni/commit/ec1bc5b48943e473c756ebc7a8c943a34cdeaeac) feat: implement stats component and add stats to the servers page
+* [`1a85999`](https://github.com/siderolabs/omni/commit/1a8599981f93fc5ce68e23b1b4cd7aabbb43c90c) feat: align Sidero servers list outlook with the wireframes
+* [`524264c`](https://github.com/siderolabs/omni/commit/524264c515a9efdce9f06a3c2ebd59c2979f9b2a) fix: display error message and use proper layout for the spinner
+* [`5263d16`](https://github.com/siderolabs/omni/commit/5263d16cfb936aad9ba461e0cc7b150ff9b806d5) feat: introduce node stats page
+* [`8feb35e`](https://github.com/siderolabs/omni/commit/8feb35e95a6d588e1d9c605231308976be452a2e) feat: make root sidebar sections collapsible
+* [`36ad656`](https://github.com/siderolabs/omni/commit/36ad656a3bbdc1e2915a87c0d09c31738ae3f3c4) feat: detect cluster capabilities
+* [`a25d90d`](https://github.com/siderolabs/omni/commit/a25d90d58a85b3b73432858f134fa09cd1338d5c) feat: support switching context in the UI
+* [`67903e2`](https://github.com/siderolabs/omni/commit/67903e23f49623ae9a9a6b297282c62aa8579aa8) refactor: separate Watch from StackedList
+* [`76b9e1d`](https://github.com/siderolabs/omni/commit/76b9e1dc88cccf74cebb28470eae5e9249809d40) release(v0.1.0-alpha.0): prepare release
+* [`7bde4c8`](https://github.com/siderolabs/omni/commit/7bde4c8c6e16c197578cbb4e037a05d50194958f) fix: cobra command was initialized but not actually used
+* [`04624c9`](https://github.com/siderolabs/omni/commit/04624c95cec587ae0b0d8888d95d484ef8d98cfa) feat: support getting Talos and Kubernetes client configs for a cluster
+* [`219b9c8`](https://github.com/siderolabs/omni/commit/219b9c8663fe03af65796b0b6299cff5e66b3efc) feat: implement notifications component
+* [`f8b19a0`](https://github.com/siderolabs/omni/commit/f8b19a0585e6e19c0e7da4e4afad5bbd264e0029) feat: decouple watch list from the view
+* [`2f8c96e`](https://github.com/siderolabs/omni/commit/2f8c96e44012e7bd0db9869eeb90ab48ff41e162) feat: implement appearance settings modal window
+* [`de745d6`](https://github.com/siderolabs/omni/commit/de745d6b7170a9c509cc835a8b675a1c788e80f4) feat: implement Talos runtime backend
+* [`af69a0d`](https://github.com/siderolabs/omni/commit/af69a0d58906a86974bc7dbec2c09ca9f78b152f) feat: support getting Kubernetes resource through gRPC gateway
+* [`2c50010`](https://github.com/siderolabs/omni/commit/2c50010b0d9f7b168354fedd698600d94123c354) feat: implement breadcrumbs component, add support for table header
+* [`3fc1e80`](https://github.com/siderolabs/omni/commit/3fc1e808875f6f502cd2657c4548dd886fbf465d) feat: implement nodes view
+* [`961e93a`](https://github.com/siderolabs/omni/commit/961e93a4af430eaa9efcd1e2922af8072fe4cf85) feat: implement clusters view
+* [`e8248ff`](https://github.com/siderolabs/omni/commit/e8248ffab89633cae8834631e39cf4dce5e4147a) feat: use plain zap instead of SugaredLogger everywhere
+* [`81ba93d`](https://github.com/siderolabs/omni/commit/81ba93dffdc37efdde06557a1c63511a7d61b2f2) chore: generate websocket protocol messages using protobuf
+* [`37a878d`](https://github.com/siderolabs/omni/commit/37a878dd396b650df8afaf6730f9afe52d35569c) feat: make JS websocket reconnect on connection loss
+* [`23b3281`](https://github.com/siderolabs/omni/commit/23b3281f8880800a9084e1c8a74617fcf966c846) feat: use dynamic watcher to allow listing any kinds of resources
+* [`16475f5`](https://github.com/siderolabs/omni/commit/16475f51cc9651736213b36c57381b24dcabdc62) feat: implement real time update server on top of web sockets
+* [`76b39ae`](https://github.com/siderolabs/omni/commit/76b39ae563d9f09ecac3451389e3d260abdad48d) feat: create hello world Vue app using Kres
+* [`baab493`](https://github.com/siderolabs/omni/commit/baab493f155cbd78c2e8af6ce45268c40ef6aeed) Initial commit
+</p>
+</details>
+
+### Changes since v0.1.0-alpha.0
+<details><summary>81 commits</summary>
+<p>
+
+* [`8b284f3`](https://github.com/siderolabs/omni/commit/8b284f3aa26cf8a34452f33807dcc04045e7a098) feat: implement Kubernetes API OIDC proxy and OIDC server
+* [`adad8d0`](https://github.com/siderolabs/omni/commit/adad8d0fe2f3356e97de613104196233a3b98ff5) refactor: rework LoadBalancerConfig/LoadBalancerStatus resources
+* [`08e2cb4`](https://github.com/siderolabs/omni/commit/08e2cb4fd40ec918bf458edd6a5d8e6c86fe5c97) feat: support editing config patches on cluster and machine set levels
+* [`e2197c8`](https://github.com/siderolabs/omni/commit/e2197c83e994afb435671f5af5cdefa843bbddb5) test: e2e testing improvements
+* [`ec9051f`](https://github.com/siderolabs/omni/commit/ec9051f6dfdf1f5acaf3fa6766dc1195b6f6dcdd) fix: config patching
+* [`e2a1d6c`](https://github.com/siderolabs/omni/commit/e2a1d6c78809eaa4168ca5ede433824797a6aa4e) fix: send logs in JSON format by default
+* [`954dd70`](https://github.com/siderolabs/omni/commit/954dd70b935b7c373ba5830fd7ad6e965f6b0da8) chore: replace talos-systems depedencies with siderolabs
+* [`acf94db`](https://github.com/siderolabs/omni/commit/acf94db8ac80fb6f15cc87ff276b7edca0cb8661) chore: add payload logger
+* [`838c716`](https://github.com/siderolabs/omni/commit/838c7168c64f2296a9e01d3ef6ab4feb9f16aeb9) fix: allow time skew on validating the public keys
+* [`dd481d6`](https://github.com/siderolabs/omni/commit/dd481d6cb3620790f6e7a9c8e305defb507cbe5f) fix: refactor runGRPCProxy in router tests to catch listener errors
+* [`e68d010`](https://github.com/siderolabs/omni/commit/e68d010685d4f0a5d25fee671744119cecf6c27b) chore: small fixes
+* [`ad86875`](https://github.com/siderolabs/omni/commit/ad86875ec146e05d7d7f461bf7c8094a8c143df5) feat: minor adjustments on the cluster create page
+* [`e61f194`](https://github.com/siderolabs/omni/commit/e61f1943e965287c79fbaef05760bb0b0deee988) chore: implement debug handlers with controller dependency graphs
+* [`cbbf901`](https://github.com/siderolabs/omni/commit/cbbf901e601d31c777ad2ada0f0036c57020ba96) refactor: use generic TransformController more
+* [`33f9f2c`](https://github.com/siderolabs/omni/commit/33f9f2ce3ec0999198f311ae4bae9b58e57153c9) chore: remove reflect from runtime package
+* [`6586963`](https://github.com/siderolabs/omni/commit/65869636aa33013b5feafb06e727b9d2a4cf1c19) feat: add scopes to users, rework authz & add integration tests
+* [`bb355f5`](https://github.com/siderolabs/omni/commit/bb355f5c659d8c66b825de409d9446767005a2bb) fix: reload the page to init the UI Authenticator on signature fails
+* [`c90cd48`](https://github.com/siderolabs/omni/commit/c90cd48eefa7f29328a456aa5ca474eece17c6fe) chore: log auth context
+* [`d278780`](https://github.com/siderolabs/omni/commit/d2787801a4904fe895996e5319f301a1d7ca76df) fix: update Clusters page UI
+* [`5e77607`](https://github.com/siderolabs/omni/commit/5e776072285e535e93c0458774dcad810b9b857a) tests: abort on first failure
+* [`4c55980`](https://github.com/siderolabs/omni/commit/4c5598083ff6d8763c8763d8e46a3d7b659784ff) chore: get full method name from the service
+* [`2194f43`](https://github.com/siderolabs/omni/commit/2194f4391607e6e73bce1917d2744e78fdd2cebc) feat: redesign cluster list view
+* [`40b3f23`](https://github.com/siderolabs/omni/commit/40b3f23071096987e8a7c6f30a2622c317c190cb) chore: enable gRPC request duration histogram
+* [`0235bb9`](https://github.com/siderolabs/omni/commit/0235bb91a71510cf4d349eedd3625b119c7e4e11) refactor: make sure Talos/Kubernetes versions are defined once
+* [`dd6154a`](https://github.com/siderolabs/omni/commit/dd6154a45d5dcd14870e0aa3f97aa1d4e53bdcfb) chore: add public key pruning
+* [`68908ba`](https://github.com/siderolabs/omni/commit/68908ba330ecd1e285681e24db4b9037eb2e8202) fix: bring back UpgradeInfo API
+* [`f1bc692`](https://github.com/siderolabs/omni/commit/f1bc692c9125f7683fe5f234b03eb3521ba7e773) refactor: drop dependency on Talos Go module
+* [`0e3ef43`](https://github.com/siderolabs/omni/commit/0e3ef43cfed68e53879e6c22b46e7d0568ddc05f) feat: implement talosctl access via Omni
+* [`2b0014f`](https://github.com/siderolabs/omni/commit/2b0014fea15da359217f89ef723965dcc9faa739) fix: provide a way to switch the user on the authenticate page
+* [`e295d7e`](https://github.com/siderolabs/omni/commit/e295d7e2854ac0226e7efda32864f6a687a88470) chore: refactor all controller tests to use assertResource function
+* [`8251dfb`](https://github.com/siderolabs/omni/commit/8251dfb9e44341e9df9471f387cc76c91359cf84) refactor: extract PGP client key handling
+* [`02da9ee`](https://github.com/siderolabs/omni/commit/02da9ee66f15462e6f4d7da18515651a5fde11aa) refactor: use extracted go-api-signature library
+* [`4bc3db4`](https://github.com/siderolabs/omni/commit/4bc3db4dcbc14e0e51c7a3b5257686b671cc2823) fix: drop not working upgrade k8s functional
+* [`17ca75e`](https://github.com/siderolabs/omni/commit/17ca75ef864b7a59f9c6f829de19cc9630a670c0) feat: add 404 page
+* [`8dcde2a`](https://github.com/siderolabs/omni/commit/8dcde2af3ca49d9be16cc705c0b403826f2eee5d) feat: implement logout flow in the frontend
+* [`ba766b9`](https://github.com/siderolabs/omni/commit/ba766b9922302b9d1f279b74caf94e6ca727f86f) fix: make `omnictl` correctly re-auth on invalid key
+* [`fd16f87`](https://github.com/siderolabs/omni/commit/fd16f8743d3843e8ec6735a7c2e96532694b876e) fix: don't set timeout on watch gRPC requests
+* [`8dc3cc6`](https://github.com/siderolabs/omni/commit/8dc3cc682e5419c3824c6e740a32085c386b8817) fix: don't use `omni` in external names
+* [`2513661`](https://github.com/siderolabs/omni/commit/2513661578574255ca3f736d3dfa1f307f5d43b6) fix: reset `Error` field of the `MachineSetStatus`
+* [`b611e99`](https://github.com/siderolabs/omni/commit/b611e99e14a7e2ebc64c55ed5c95a47e17d6ac32) fix: properly handle `Forbidden` errors on the authentication page
+* [`8525502`](https://github.com/siderolabs/omni/commit/8525502265b10dc3cc056d301785f6f60e4f7e22) fix: stop runners properly and clean up StatusMachineSnapshot
+* [`ab0190d`](https://github.com/siderolabs/omni/commit/ab0190d9a41b830daf60173b998acdbcbbdd3754) feat: implement scopes and enforce authorization
+* [`9198d96`](https://github.com/siderolabs/omni/commit/9198d96ea9d57bb5949c59350aec42b2ce13ebac) feat: sign gRPC requests on the frontend to enable Authentication flow
+* [`bdd8f21`](https://github.com/siderolabs/omni/commit/bdd8f216a9eca7ec657fa0dc554e663743f058d1) chore: remove reset button and fix padding
+* [`362db57`](https://github.com/siderolabs/omni/commit/362db570349b4a2659f746ce18a436d684481ecb) fix: gRPC verifier should verify against original JSON payload
+* [`30186b8`](https://github.com/siderolabs/omni/commit/30186b8cfe2eea6eaade8bacf31114886d3da3ea) fix: omnictl ignoring omniconfig argument
+* [`e8ab0ba`](https://github.com/siderolabs/omni/commit/e8ab0ba45648b8f521500b46fe032797da6a111f) fix: do not attempt to execute failed integration test again
+* [`9fda25e`](https://github.com/siderolabs/omni/commit/9fda25ef45f0060cc6c3ec812f5fa1c7b1015801) chore: add more info on errors to different controllers
+* [`ccda526`](https://github.com/siderolabs/omni/commit/ccda5260c4645b5929724574a9f856eeaa4c232f) chore: bump grpc version
+* [`b1ac125`](https://github.com/siderolabs/omni/commit/b1ac1255da5ca4b5d9c409e27c51e4298275e73c) chore: emit log when we got machine status event.
+* [`005d257`](https://github.com/siderolabs/omni/commit/005d257c25c745b61e5a25c39167d511710562c7) chore: set admin role specifically for Reboot request.
+* [`27f0e30`](https://github.com/siderolabs/omni/commit/27f0e309cec76a454e5bb24c2df1e62d9e4718e0) chore: update deps
+* [`77f0219`](https://github.com/siderolabs/omni/commit/77f02198c1e7fb215548f3a0e2be30a0e19aaf6d) test: more unit-tests for auth components
+* [`0bf6ddf`](https://github.com/siderolabs/omni/commit/0bf6ddfa46e0ea6ad255ede00a600c390344e221) fix: pass through HTTP request if auth is disabled
+* [`4f3a67b`](https://github.com/siderolabs/omni/commit/4f3a67b08e03a1bad65c2acb8d65f0281fdd2f9e) fix: unit-tests for auth package and fixes
+* [`e3390cb`](https://github.com/siderolabs/omni/commit/e3390cbbac1d0e78b72512c6ebb64a8f53dcde17) chore: rename arges-theila to omni
+* [`14d2614`](https://github.com/siderolabs/omni/commit/14d2614538ec696d468a0850bd4ee7bc6884c3b1) chore: allow slashes in secretPath
+* [`e423edc`](https://github.com/siderolabs/omni/commit/e423edc072714e7f693249b60079f5f700cc0a65) fix: add unit-tests for auth message and fix issues
+* [`b5cfa1a`](https://github.com/siderolabs/omni/commit/b5cfa1a84e93b6bbf5533c599917f293fc5cdf66) feat: add vault client
+* [`b47791c`](https://github.com/siderolabs/omni/commit/b47791ce303cbb9a8aab279685d17f92a480c7f4) feat: sign grpc requests on cli with pgp key & verify it on server
+* [`d6ef4d9`](https://github.com/siderolabs/omni/commit/d6ef4d9c36758cb0091e2c528b848952f312941a) feat: split account ID and name
+* [`e412e1a`](https://github.com/siderolabs/omni/commit/e412e1a69edad0d19d7e46fa3aa076dcb8e6d4b6) chore: workaround the bind problem
+* [`e23cc59`](https://github.com/siderolabs/omni/commit/e23cc59bb8cb8f9df81738d4c58aed08d80fa9c4) chore: bump minimum Talos version to v1.2.4
+* [`0638a29`](https://github.com/siderolabs/omni/commit/0638a29d78c092641573aa2b8d2e594a7ff6aab4) feat: stop using websockets
+* [`8f3c19d`](https://github.com/siderolabs/omni/commit/8f3c19d0f0ecfbe5beabc7dc508dcafa720e83e2) feat: update install media to be identifiable
+* [`70d1e35`](https://github.com/siderolabs/omni/commit/70d1e354466618bb07c13445a16ca639be12009e) feat: implement resource encryption
+* [`7653638`](https://github.com/siderolabs/omni/commit/76536386499889994b65f66a8a40f18b5535c5ba) fix: fix NPE in integration tests
+* [`e39849f`](https://github.com/siderolabs/omni/commit/e39849f4047f028251123781bd8be350ebbfd65d) chore: update Makefile and Dockerfile with kres
+* [`4709473`](https://github.com/siderolabs/omni/commit/4709473ec20fbf92a3240fb3376a322f1321103a) fix: return an error if external etcd client fails to be built
+* [`5366661`](https://github.com/siderolabs/omni/commit/536666140556ba9b997a2b5d4441ea4b5f42d1c5) refactor: use generic transform controller
+* [`a2a5f16`](https://github.com/siderolabs/omni/commit/a2a5f167f21df6375767d018981651d60bb2f768) feat: limit access to Talos API via Omni to `os:reader`
+* [`e254201`](https://github.com/siderolabs/omni/commit/e2542013938991faa8f1c521fc524b8fcf31ea34) feat: merge internal/external states into one
+* [`3258ca4`](https://github.com/siderolabs/omni/commit/3258ca487c818a34924f138640f44a2e51d307fb) feat: add `ControlPlaneStatus` controller
+* [`1c0f286`](https://github.com/siderolabs/omni/commit/1c0f286a28f5134333130708d031dbfa11051a42) refactor: use `MachineStatus` Talos resource
+* [`0a6b19f`](https://github.com/siderolabs/omni/commit/0a6b19fb916ea301a8f5f6ccd9bbdaa7cb4c39e0) chore: drop support for Talos resource API
+* [`ee5f6d5`](https://github.com/siderolabs/omni/commit/ee5f6d58a2b22a87930d3c8bb9963f71c92f3908) feat: add auth resource types & implement CLI auth
+* [`36736e1`](https://github.com/siderolabs/omni/commit/36736e14e5c837d38568a473834d14073b88a153) fix: use correct protobuf URL for cosi resource spec
+* [`b98c56d`](https://github.com/siderolabs/omni/commit/b98c56dafe33beef7792bd861ac4e637fe13c494) feat: bump minimum version for Talos to v1.2.3
+* [`b93bc9c`](https://github.com/siderolabs/omni/commit/b93bc9cd913b017c66502d96d99c52e4d971e231) chore: move containers and optional package to the separate module
+* [`e1af4d8`](https://github.com/siderolabs/omni/commit/e1af4d8a0bee31721d8946ef452afe04da6b494d) chore: update COSI to v0.2.0-alpha.1
+* [`788dd37`](https://github.com/siderolabs/omni/commit/788dd37c0be32745547ee8268aa0f004041dc96f) feat: implement and enable by default etcd backend
+</p>
+</details>
+
+### Dependency Changes
+
+This release has no dependency changes
+
+## [Omni 0.1.0-alpha.0](https://github.com/siderolabs/arges-theila/releases/tag/v0.1.0-alpha.0) (2022-09-19)
+
+Welcome to the v0.1.0-alpha.0 release of Omni!  
+*This is a pre-release of Omni*
+
+
+
+Please try out the release binaries and report any issues at
+https://github.com/siderolabs/arges-theila/issues.
+
+### Contributors
+
+* Artem Chernyshev
+* Artem Chernyshev
+* Andrey Smirnov
+* Philipp Sauter
+* evgeniybryzh
+* Dmitriy Matrenichev
+* Utku Ozdemir
+* Noel Georgi
+* Andrew Rynhard
+* Andrew Rynhard
+* Gerard de Leeuw
+* Steve Francis
+* Tim Jones
+* Volodymyr Mazurets
+
+### Changes
+<details><summary>267 commits</summary>
+<p>
+
+* [`8a9c4f1`](https://github.com/siderolabs/arges-theila/commit/8a9c4f17ed6ee0d8e4a51b466d60a8278cd50f9c) feat: implement CLI configuration file (omniconfig)
+* [`b0c92d5`](https://github.com/siderolabs/arges-theila/commit/b0c92d56da00529c106f042399c1163375046785) feat: implement etcd audit controller
+* [`0e993a0`](https://github.com/siderolabs/arges-theila/commit/0e993a0977c711fb8767e3de2ad828fd5b9e688f) feat: properly support scaling down the cluster
+* [`264cdc9`](https://github.com/siderolabs/arges-theila/commit/264cdc9e015fd87724c7a07128d1136153732540) refactor: prepare for etcd backend integration
+* [`b519d17`](https://github.com/siderolabs/arges-theila/commit/b519d17971bb1c919286813b4c2465c2f5803a03) feat: show version in the UI
+* [`a2fb539`](https://github.com/siderolabs/arges-theila/commit/a2fb5397f9efb22a1354c5675180ca49537bee55) feat: keep track of loadbalancer health in the controller
+* [`4789c62`](https://github.com/siderolabs/arges-theila/commit/4789c62af0d1694d8d0a492cd6fb7d436e213fe5) feat: implement a new controller that can gather cluster machine data
+* [`bd3712e`](https://github.com/siderolabs/arges-theila/commit/bd3712e13491ede4610ab1452ae85bde6d92b2db) fix: populate machine label field in the patches created by the UI
+* [`ba70b4a`](https://github.com/siderolabs/arges-theila/commit/ba70b4a48623939d31775935bd0338c0d60ab65b) fix: rename to Omni, fix workers scale up, hide join token
+* [`47b45c1`](https://github.com/siderolabs/arges-theila/commit/47b45c129160821576d808d9a46a9ec5d14c6469) fix: correct filenames for Digital Ocean images
+* [`9d217cf`](https://github.com/siderolabs/arges-theila/commit/9d217cf16d432c5194110ae16a566b44b02a567e) feat: introduce new resources, deprecate `ClusterMachineTemplate`
+* [`aee153b`](https://github.com/siderolabs/arges-theila/commit/aee153bedb2f7856913a54b282603b07bf20059b) fix: address style issue in the Pods paginator
+* [`752dd44`](https://github.com/siderolabs/arges-theila/commit/752dd44ac42c95c644cad5640f6b2c5536a29676) chore: update Talos machinery to 1.2.0 and use client config struct
+* [`88d7079`](https://github.com/siderolabs/arges-theila/commit/88d7079a6656605a1a8dfed56d392414583a283e) fix: regenerate sources from proto files that were rolled back.
+* [`84062c5`](https://github.com/siderolabs/arges-theila/commit/84062c53417197417ff636a667289342089f390c) chore: update Talos to the latest master
+* [`5a139e4`](https://github.com/siderolabs/arges-theila/commit/5a139e473abcdf7fd25ad7c61dad8cbdc964a453) fix: properly route theila internal requests in the gRPC proxy
+* [`4be4fb6`](https://github.com/siderolabs/arges-theila/commit/4be4fb6a4e0bca29b32e1b732c227c9e7a0b1f43) feat: add support for 'talosconfig' generation
+* [`9235b8b`](https://github.com/siderolabs/arges-theila/commit/9235b8b522d4bc0712012425b68ff89e455886b9) fix: properly layer gRPC proxies
+* [`9a516cc`](https://github.com/siderolabs/arges-theila/commit/9a516ccb5c892ed8fe41f7cf69aaa5bb1d3fa471) fix: wait for selector of 'View All' to render in e2e tests.
+* [`3cf3aa7`](https://github.com/siderolabs/arges-theila/commit/3cf3aa730e7833c0c1abe42a6afb87a85f14b58c) fix: some unhandled errors in the e2e tests.
+* [`c32c7d5`](https://github.com/siderolabs/arges-theila/commit/c32c7d55c92007aa1aa10feab3c7a7de2b2afc42) fix: ignore updating cluster machines statuses without machine statuses
+* [`4cfa307`](https://github.com/siderolabs/arges-theila/commit/4cfa307b85b410b44e482b259d14670b55e4a237) chore: run rekres, fix lint errors and bump Go to 1.19
+* [`eb2d449`](https://github.com/siderolabs/arges-theila/commit/eb2d4499f1a3da7bc1552a6b099c28bed6fd0e4d) fix: skip the machines in `tearingDown` phase in the controller
+* [`9ebc769`](https://github.com/siderolabs/arges-theila/commit/9ebc769b89a2bab37fd081e555f84e3e4c99187e) fix: allow all services to be proxied by gRPC router
+* [`ea2b01d`](https://github.com/siderolabs/arges-theila/commit/ea2b01d0a0e054b259d710317fe368882534cf4c) fix: properly handle non empty resource id in the K8s resource watch
+* [`3bb7da3`](https://github.com/siderolabs/arges-theila/commit/3bb7da3a0fa6b746f6a7b9aa668e055bdf825e6a) feat: show a Cluster column in the Machine section
+* [`8beb70b`](https://github.com/siderolabs/arges-theila/commit/8beb70b7f045a218f9cb753e1402a07542b0bf1c) fix: ignore tearing down clusters in the `Cluster` migrations
+* [`319d4e7`](https://github.com/siderolabs/arges-theila/commit/319d4e7947cb78135f5a14c02afe5814c56a312c) fix: properly handle `null` memory modules list
+* [`6c2120b`](https://github.com/siderolabs/arges-theila/commit/6c2120b5ae2bd947f473d002dfe165646032e811) chore: introduce migrations manager for COSI DB state
+* [`ec52139`](https://github.com/siderolabs/arges-theila/commit/ec521397946cc15929472feb7c45435fb48df848) fix: filter out invalid memory modules info coming from Talos nodes
+* [`8e87031`](https://github.com/siderolabs/arges-theila/commit/8e870313a3a31d052eecf81acb522433ff98ae79) fix: bump loadbalancer timeout settings
+* [`bc0ed26`](https://github.com/siderolabs/arges-theila/commit/bc0ed2672064a6bf148cd9799b35a2790f5aa7f6) feat: introduce websocket, HTTP requests monitoring
+* [`857401f`](https://github.com/siderolabs/arges-theila/commit/857401f54e3922a9ab85d7dc703a5afb70c6ee45) feat: add HTTP logging (static, gateway), and websocket logging
+* [`eb612a3`](https://github.com/siderolabs/arges-theila/commit/eb612a38e9c71913ebecc9f345e17844d60800b8) fix: do hard stop of events sink gRPC server after 5 seconds
+* [`3162513`](https://github.com/siderolabs/arges-theila/commit/31625135e2b971d6b9f92eb4096c010113030a80) fix: populate nodes filter dropdown properly and rewrite filter function
+* [`5713a51`](https://github.com/siderolabs/arges-theila/commit/5713a516391a5190fac9b7044a9f71952ce15479) fix: make `TSelectList` search filter the items in the dropdown
+* [`f2519ff`](https://github.com/siderolabs/arges-theila/commit/f2519ff51b88766a907f1d7717ef74031157fd56) feat: don't allow using nodes with not enough mem for the cluster
+* [`9e474d6`](https://github.com/siderolabs/arges-theila/commit/9e474d69c76a898fc5b6fcd9fdc8e87f25b7dc53) feat: show disconnected warning in the machines list
+* [`fa52b48`](https://github.com/siderolabs/arges-theila/commit/fa52b48f54362c7305681ca79a7d98237531f2b4) feat: redesign Installation Media selection menu
+* [`01e301a`](https://github.com/siderolabs/arges-theila/commit/01e301a875699cf6fcc887cb31cd7939338f58e9) fix: query node list using `talosctl get members` instead of K8s nodes
+* [`e694df5`](https://github.com/siderolabs/arges-theila/commit/e694df59c50fbee356a48c94ade95e924ea46bb2) fix: display all available Talos versions on cluster create page
+* [`7a87525`](https://github.com/siderolabs/arges-theila/commit/7a87525ed1b928a8f8e3e6a39feb4c19009ec264) fix: use `v-model` instead of callbacks in the inputs
+* [`d681f5f`](https://github.com/siderolabs/arges-theila/commit/d681f5f58788612f144fa1f8d90ec6c996badb0e) feat: support scaling up the clusters
+* [`e992b95`](https://github.com/siderolabs/arges-theila/commit/e992b9574d7b8f76497f46e25764618ec274af1a) feat: show notification on image download progress
+* [`8ea6d9f`](https://github.com/siderolabs/arges-theila/commit/8ea6d9f1724b271919e538ed55ff6582858470f9) fix: probably fix 'context canceled' on image download
+* [`692612b`](https://github.com/siderolabs/arges-theila/commit/692612b7e628588fa7608cff683c5af406f24ca7) fix: improve the Talos image generation process
+* [`a69c140`](https://github.com/siderolabs/arges-theila/commit/a69c140e26f4298fcaafb1f96c389269992fc069) feat: introduce Prometheus metrics
+* [`e90ca78`](https://github.com/siderolabs/arges-theila/commit/e90ca7875c501391f860f5df9f2a4e4f8e2f2d7a) fix: make grpc api listen only on siderolink interface
+* [`99fc28c`](https://github.com/siderolabs/arges-theila/commit/99fc28c36c62a8d8c654c05f9b9c64ff37cedba8) fix: display correct cluster/machine status on ui
+* [`eaf7655`](https://github.com/siderolabs/arges-theila/commit/eaf7655395401cd88e6bd47f4f8aa958abee30f1) fix: add a pause before integration tests
+* [`19ff1c9`](https://github.com/siderolabs/arges-theila/commit/19ff1c909bedf63fe6cf2f5cc0e44f34046ca568) chore: rename download button
+* [`e1c4e1b`](https://github.com/siderolabs/arges-theila/commit/e1c4e1b171eab08585a3315ca5838c88a4d2eb24) feat: add download options for all talos images
+* [`24e7863`](https://github.com/siderolabs/arges-theila/commit/24e786369bfc0bb4966712296395db91751e657b) fix: delete cached clients from gRPC proxy when the cluster is destroyed
+* [`58c89ef`](https://github.com/siderolabs/arges-theila/commit/58c89ef3fe621ef6909c5d38a0d47cc861667f45) feat: implement `argesctl delete` command
+* [`3c99b49`](https://github.com/siderolabs/arges-theila/commit/3c99b49a9b680b091d92455a0d3bc325f8f68ca6) test: add a test which removes allocated machine
+* [`75dd28f`](https://github.com/siderolabs/arges-theila/commit/75dd28f56d7ce9a92b96822a867fbfe2655cd0fa) chore: fill in resource definitions for table headers
+* [`028f168`](https://github.com/siderolabs/arges-theila/commit/028f16886c41b7aa7eafb65308cc4adf4d624037) feat: End-to-end tests with playwright
+* [`6be6b36`](https://github.com/siderolabs/arges-theila/commit/6be6b3605583ce8e8068746624ca86ed6adc37af) chore: bump goimports from 0.1.10 to 0.1.11 and node from 18.5.0 to 18.6.0
+* [`af4da08`](https://github.com/siderolabs/arges-theila/commit/af4da086d4b709f504eda7909a36a8f0cf84e480) test: implement kernel log streaming test
+* [`1eacfee`](https://github.com/siderolabs/arges-theila/commit/1eacfee2c1084040ae2201eba957409218a92c66) feat: implement argesctl machine-logs output in 'zap-like' and 'dmesg' form.
+* [`96ab7ab`](https://github.com/siderolabs/arges-theila/commit/96ab7ab8317898dd45d129d5cecd2aaf1d379fba) chore: ignore memory modules with zero size
+* [`fd0575f`](https://github.com/siderolabs/arges-theila/commit/fd0575ff4050702c9d07e34c7d9d5596b4ad7311) chore: retrieve k8s versions from github registry
+* [`8651527`](https://github.com/siderolabs/arges-theila/commit/86515275a77741bacc790d2006f3671a5cfb27c6) feat: redo errgroup to return error on first nil error
+* [`944222d`](https://github.com/siderolabs/arges-theila/commit/944222d06607079b5d982afe4b19fc1dda7f1ec2) fix: show ClusterMachineStatus.Stage in 'Clusters' view
+* [`f3f6b6e`](https://github.com/siderolabs/arges-theila/commit/f3f6b6eecd3ffc13b69845dff50d2e8ab31bc0d2) chore: refactor run method and no longer ignore log receiver listener errors
+* [`b316377`](https://github.com/siderolabs/arges-theila/commit/b316377b277f87a184b969b3bbf20ebe6047a0a8) chore: rename 'Dmesg' to 'Console'
+* [`19ee857`](https://github.com/siderolabs/arges-theila/commit/19ee8578a6f1c1bf742699d1b5720dc4c2674c82) test: add a way to recover deleted machines
+* [`e5b5bdc`](https://github.com/siderolabs/arges-theila/commit/e5b5bdc39fa6f3812b15771366f942ddcbe7f328) fix: update SideroLink library for EEXIST fixes
+* [`363de69`](https://github.com/siderolabs/arges-theila/commit/363de69a50b5c1e9d07fa42152cca935844d118b) fix: spec collector equality
+* [`841f3b2`](https://github.com/siderolabs/arges-theila/commit/841f3b22aacc6d2875062ef324d900c5f2091f9d) feat: add ability to supply machine config patches on the machines
+* [`907ca93`](https://github.com/siderolabs/arges-theila/commit/907ca93247267d80125866c2b60225ceca3ada27) test: fix link destroy test
+* [`4c9f99d`](https://github.com/siderolabs/arges-theila/commit/4c9f99d32874cdaff1eb651bf6d74ef39167c273) fix: remove machine status if the machine is in tearing down phase
+* [`d9747e5`](https://github.com/siderolabs/arges-theila/commit/d9747e552e52156a9baeae962a9478231e26c566) fix: make cluster machine status test more reliable
+* [`3bfff3b`](https://github.com/siderolabs/arges-theila/commit/3bfff3bb0eea9d18956dee21aff7f3de900c6b82) fix: do not set up full theila runtime during clients tests
+* [`4bf33bc`](https://github.com/siderolabs/arges-theila/commit/4bf33bc9d37404a733c5039784c80e92800fb3dc) fix: immediately fail the request if the cluster is down
+* [`124a5c2`](https://github.com/siderolabs/arges-theila/commit/124a5c2947978e6bc86d1b19c9eacbcf7f870b53) fix: ensure the created date on resources is set
+* [`14161bf`](https://github.com/siderolabs/arges-theila/commit/14161bf3dad4484868359d186d99d9198b6eed95) feat: add scale up integration test and minor log fixes
+* [`7af06fd`](https://github.com/siderolabs/arges-theila/commit/7af06fd75959eb9e807680ac8a6ba4f0a7f59255) feat: make integration tests a subtests of one global test
+* [`f7c1464`](https://github.com/siderolabs/arges-theila/commit/f7c1464a1002f63daab29b36d19ea16de0cd5794) feat: implement log receiver for logs from Talos
+* [`5b800ea`](https://github.com/siderolabs/arges-theila/commit/5b800ea970215fb4e100ed7b3b73d7e218fd6d86) fix: accumulate bytes received/send in the link resource
+* [`b3b1e9b`](https://github.com/siderolabs/arges-theila/commit/b3b1e9bbfbf62632dc0d8c2239a72793883101ce) feat: machine removal
+* [`fb01bc4`](https://github.com/siderolabs/arges-theila/commit/fb01bc4b26c5b37f15bac923450e1f58fb7a3d89) fix: use Talos 1.2.0
+* [`3a50efe`](https://github.com/siderolabs/arges-theila/commit/3a50efe363c4724f369a02f672848ad7c284847c) feat: filter machines that can be added to cluster
+* [`ba62db5`](https://github.com/siderolabs/arges-theila/commit/ba62db521b47049e92557bf8cfc5f737e496bf57) fix: properly parse `siderolink-api-advertised-url` if there's no port
+* [`96f835a`](https://github.com/siderolabs/arges-theila/commit/96f835a91136f62d9dbdf5c1d1c46c729d57e51e) fix: properly display node selectors in FireFox
+* [`12c20a4`](https://github.com/siderolabs/arges-theila/commit/12c20a42c9dfdea5f88e0e7942fbdb42ea543b95) fix: populate disks when machines are connected during cluster create
+* [`0dc97f8`](https://github.com/siderolabs/arges-theila/commit/0dc97f8696a7c571d5318daf794700342e06f639) fix: adjust overview page to look closer to the mockups
+* [`2b77af8`](https://github.com/siderolabs/arges-theila/commit/2b77af8d39e555970487c3265dfbd63412e90d2f) feat: add the chart showing the count of clusters
+* [`a1dff65`](https://github.com/siderolabs/arges-theila/commit/a1dff6589d64207e6e7331d0407e7857f9c4079d) feat: implement ISO download with embedded kernel args
+* [`37c03d8`](https://github.com/siderolabs/arges-theila/commit/37c03d8cb04b02e79f42e70eeea1e4368445604d) test: pull kubeconfig and interact with Kubernetes API
+* [`75bfb08`](https://github.com/siderolabs/arges-theila/commit/75bfb08f0738fc9f67259caf12902db67860370f) fix: ignore the error on splitting host/port
+* [`3be5a32`](https://github.com/siderolabs/arges-theila/commit/3be5a3254168cddec8f1629789c2ae50d9eaa08e) feat: make the whole cluster list item clickable, add dropdown menu item
+* [`2c9dc99`](https://github.com/siderolabs/arges-theila/commit/2c9dc99000266b3d4c139f27dea4f6283709251e) fix: adjust the look of the Overview page a bit
+* [`aa4a926`](https://github.com/siderolabs/arges-theila/commit/aa4a926cbb85bf63312493b937440a174aed5070) feat: add the button for downloading cluster Kubeconfig on overview page
+* [`4532de6`](https://github.com/siderolabs/arges-theila/commit/4532de6f3d514a534c38a63731c43075698f5c01) feat: support basic auth in `argesctl` command
+* [`b66bb3c`](https://github.com/siderolabs/arges-theila/commit/b66bb3cbcc85d7be4348ecd9a6d5d62f72a90e11) feat: add summary information Overview page
+* [`3bdbce4`](https://github.com/siderolabs/arges-theila/commit/3bdbce41a3ed89a42556d837bc0c5cfe417e22e6) test: more cluster creation tests, two clusters, cleanup
+* [`3b00bd5`](https://github.com/siderolabs/arges-theila/commit/3b00bd5bf417c5c9cb42471d27811c1849a40c78) fix: improve cluster deletion and node reset flow
+* [`2d83d16`](https://github.com/siderolabs/arges-theila/commit/2d83d1694ec73da818004f91ede76a0bca30fe79) test: create a cluster and verify cluster machine statuses
+* [`f471cfd`](https://github.com/siderolabs/arges-theila/commit/f471cfdcf7c9e70f37436e173c3a58c1965e8bb2) fix: copy all labels from the `ClusterMachine` to `ClusterMachineStatus`
+* [`ec32f86`](https://github.com/siderolabs/arges-theila/commit/ec32f8632db104efd6fedc5421179175274d6339) test: add integration tests up to the cluster creation
+* [`a8d3ee5`](https://github.com/siderolabs/arges-theila/commit/a8d3ee5b14a57ad1d9d88512a95032bbda61e734) feat: add kubeconfig command to argesctl and fix kubeconfig
+* [`10b9a3b`](https://github.com/siderolabs/arges-theila/commit/10b9a3ba676a636e488805ed04a0c908c3d2cf53) test: implement API integration test
+* [`3e6b891`](https://github.com/siderolabs/arges-theila/commit/3e6b8913f916dc5e8ac3ef49e14648defa6e1bf6) feat: aggregate cluster machine statuses in cluster status controller
+* [`f6cbc58`](https://github.com/siderolabs/arges-theila/commit/f6cbc58a91124833f0cbae4ecd0c0416acbe8bfa) chore: ignore empty processor info
+* [`c5fc71b`](https://github.com/siderolabs/arges-theila/commit/c5fc71b86a5492d548ae9098c5c74de240ebd800) fix: clean up Kubernetes client and configs when a cluster is destroyed
+* [`e8478fe`](https://github.com/siderolabs/arges-theila/commit/e8478fe5280d5e8a32bb423ec96edacadabc7e43) fix: properly use tracker to cleanup `ClusterMachineConfig` resources
+* [`044fcad`](https://github.com/siderolabs/arges-theila/commit/044fcadb66de61742ab871d10f3fcf0f453f6e27) fix: make `MachineStatusController` connect to configured nodes
+* [`2867099`](https://github.com/siderolabs/arges-theila/commit/2867099a52d651c3b0f9d3abbae266f2792cafe7) feat: add api endpoint to fetch kubeconfig
+* [`5f32667`](https://github.com/siderolabs/arges-theila/commit/5f3266747012b590dd7a7d0ebc23ee0e80abb2ab) test: support registry mirrors for development purposes
+* [`5114695`](https://github.com/siderolabs/arges-theila/commit/5114695cfeb0b6c792002ff5f0f31c1944c269ab) refactor: consistent flag naming
+* [`9ffb19e`](https://github.com/siderolabs/arges-theila/commit/9ffb19e77968c6e411903a2c59fd9a18063b46d4) chore: use latest node
+* [`5512321`](https://github.com/siderolabs/arges-theila/commit/5512321f05b6b657a28abc25470664f6eb6e3d0a) refactor: set better defaults for cli args
+* [`ff88242`](https://github.com/siderolabs/arges-theila/commit/ff882427f56e42039b79900380b61b86d3290269) chore: mark 'siderolink-wireguard-endpoint' flags as required
+* [`4a9d9ad`](https://github.com/siderolabs/arges-theila/commit/4a9d9adef1e521d3c0293b6dc414f572bd8a93d4) feat: add the ClusterMachineStatus resource
+* [`e4e8b62`](https://github.com/siderolabs/arges-theila/commit/e4e8b6264cb48edd014f97129f52aefaa129fd63) refactor: unify all Arges API under a single HTTP server
+* [`5af9049`](https://github.com/siderolabs/arges-theila/commit/5af9049bdc2e09bf410e1b0646e4e08a4366f33b) chore: rename sidebar item
+* [`a4fc47f`](https://github.com/siderolabs/arges-theila/commit/a4fc47f97d79259532b91a8d391e84b59554ed8e) chore: fix build warning
+* [`547b83c`](https://github.com/siderolabs/arges-theila/commit/547b83c4a2a543d5b6ce4dca6cf6f5de87c33dcb) chore: bump siderolink version
+* [`11c31f3`](https://github.com/siderolabs/arges-theila/commit/11c31f39d834e3352b086c1aec665065fd74e944) refactor: drop one of the layered gRPC servers
+* [`0adbbb7`](https://github.com/siderolabs/arges-theila/commit/0adbbb7edfeacedd98a7e84c2f45ac458750a281) feat: introduce a way to copy kernel arguments from the UI
+* [`ce5422a`](https://github.com/siderolabs/arges-theila/commit/ce5422a27771a94cc25be70ec756711d140b2758) fix: import new COSI library to fix YAML marshaling
+* [`d6cec09`](https://github.com/siderolabs/arges-theila/commit/d6cec099cb6f4c3118e4263b9517176858bb9cfb) feat: implement Arges API client, and minimal `argesctl`
+* [`65c8d68`](https://github.com/siderolabs/arges-theila/commit/65c8d683187d82dc730752294c1bc03657f5df78) feat: implement cluster creation view
+* [`8365b00`](https://github.com/siderolabs/arges-theila/commit/8365b00df90ac55f99e0f82e1fa6d4367ebd6a3f) feat: re-enable old Theila UI
+* [`63e703c`](https://github.com/siderolabs/arges-theila/commit/63e703c4e1dfb4bf645fbc9cd28ba2a722e04dc2) fix: update Talos to the latest master
+* [`d33e27b`](https://github.com/siderolabs/arges-theila/commit/d33e27b49113729c5538fce688832152ff96a7ea) feat: implement clusters list view
+* [`cb9e23c`](https://github.com/siderolabs/arges-theila/commit/cb9e23ca6f420ac7b71acf6b19e9012265f3c69b) feat: protect Theila state from external API access
+* [`952c235`](https://github.com/siderolabs/arges-theila/commit/952c2359b32fdd077d85e312707f8b9c9e01ea0c) fix: properly allocated ports in the loadbalancer
+* [`a58c479`](https://github.com/siderolabs/arges-theila/commit/a58c479e9e31f70e806a1f3482b9b984c5c0ca68) chore: report siderolink events kernel arg
+* [`8a56fe3`](https://github.com/siderolabs/arges-theila/commit/8a56fe34ce1966fe28f9e432c696fdd779dfb638) refactor: move Theila resources to public `pkg/`
+* [`1251699`](https://github.com/siderolabs/arges-theila/commit/12516996eda859db6677403ad1f72a3994ea180b) fix: reset the `MachineEventsSnapshot` after the node is reset
+* [`9a2e6af`](https://github.com/siderolabs/arges-theila/commit/9a2e6af3113b795f57c4e3a86c1348b120fa3bbd) feat: implement bootstrap controller
+* [`7107e27`](https://github.com/siderolabs/arges-theila/commit/7107e27ee6b9ba644fc803e4463cbfcf26cf97de) feat: implement apply and reset config controller
+* [`1579eb0`](https://github.com/siderolabs/arges-theila/commit/1579eb09eb58f2cb679205e9e204369f3a362e07) feat: implement machine events handler and `ClusterStatus`
+* [`7214f4a`](https://github.com/siderolabs/arges-theila/commit/7214f4a514a921d6b9df7515116613996416f383) feat: implement cluster load balancer controller
+* [`9c4fafa`](https://github.com/siderolabs/arges-theila/commit/9c4fafaf6b8dc9b7ff08fe28704ca6a2e7efc097) feat: add a controller that manages load balancers for talos clusters
+* [`7e3d80c`](https://github.com/siderolabs/arges-theila/commit/7e3d80ce956d621ed79e4db094808831e18db85b) feat: add a resources that specify configurations for load balancers
+* [`dc0d356`](https://github.com/siderolabs/arges-theila/commit/dc0d356a181b4c37670d2ed4e8d7af370dccef60) feat: support Theila runtime watch with label selectors
+* [`6a568a7`](https://github.com/siderolabs/arges-theila/commit/6a568a72922e34e91f5448d3c1caa2f0b3a02e96) feat: implement `ClusterMachineConfig` resource and it's controller
+* [`3db0f1c`](https://github.com/siderolabs/arges-theila/commit/3db0f1c9d4e2d6f962b6f3216a4f9c7e2575dd21) feat: implement `TalosConfig` controller
+* [`b7ae8e1`](https://github.com/siderolabs/arges-theila/commit/b7ae8e113dc68acd87c4cfe5e3c8349d32bc392d) feat: introduce `Cluster` controller that adds finalizers on Clusters
+* [`8d7ea02`](https://github.com/siderolabs/arges-theila/commit/8d7ea0293e8f57388fd483dc82e79e6b4c76a53f) chore: use label selectors in `TalosConfig`, set labels on the resources
+* [`cff9cb1`](https://github.com/siderolabs/arges-theila/commit/cff9cb19ba8718fdad509b5e91cb8221c6c1ff00) fix: separate advertised endpoint from the actual wireguard endpoint
+* [`5be6cc3`](https://github.com/siderolabs/arges-theila/commit/5be6cc391adf8bcb58b8d47f09dad5aa75d1ad98) feat: implement cluster creation UI
+* [`a1633eb`](https://github.com/siderolabs/arges-theila/commit/a1633eb18772b9e99d687dfddd12fc09fd1ea5c4) chore: add typed wrappers around State, Reader and Writer
+* [`5515f3d`](https://github.com/siderolabs/arges-theila/commit/5515f3d004f54455a1eb1f4977bbb9d663fd1bca) feat: add `ClusterSecrets` resource and controller and tests
+* [`7226f6c`](https://github.com/siderolabs/arges-theila/commit/7226f6cdc60eeb4d6040d1aa0711fed378c50b33) feat: add `Cluster`, `ClusterMachine` and `TalosConfig` resources
+* [`ec44930`](https://github.com/siderolabs/arges-theila/commit/ec44930672ca8954c6ba68975c1799a087ec0c43) feat: enable vtprotobuf optimized marshaling
+* [`15be219`](https://github.com/siderolabs/arges-theila/commit/15be2198872fb637f7ba2e1ff550e4466179f2b1) feat: generate TS constants from go `//tsgen:` comments
+* [`caa4c4d`](https://github.com/siderolabs/arges-theila/commit/caa4c4d285dcd1176a70d87f28ee303cd0483ca8) fix: resource equality for proto specs
+* [`beeca88`](https://github.com/siderolabs/arges-theila/commit/beeca886213332f313f7f3a477d7e7c508e6d058) refactor: clarify code that creates or gets links for nodes
+* [`340c63a`](https://github.com/siderolabs/arges-theila/commit/340c63ad4ba918d4b11ab1f57fdbd3b5e5d8b3dc) feat: implement `Machines` page
+* [`f7bc0c6`](https://github.com/siderolabs/arges-theila/commit/f7bc0c69c69fe515cfa729bc062c730756a53019) feat: accept nodes if they provide the correct join token
+* [`bdf789a`](https://github.com/siderolabs/arges-theila/commit/bdf789a35da5491a4fcbd2af35a1c6efd22ab1fc) feat: immediately reconnect SideroLink peers after Arges restart
+* [`6b74fa8`](https://github.com/siderolabs/arges-theila/commit/6b74fa82ca5757d6f3809853c1ac3e7754efb06d) feat: implement MachineStatusController
+* [`f5db0e0`](https://github.com/siderolabs/arges-theila/commit/f5db0e05a87d5c11b4a1029b14020b19ca67035d) feat: add more info to the siderolink connection spec
+* [`d3e4a71`](https://github.com/siderolabs/arges-theila/commit/d3e4a71af8fd79328e4edda6d9642b83902b2003) refactor: simplify the usage of gRPC resource CRUD API
+* [`2430115`](https://github.com/siderolabs/arges-theila/commit/2430115af1aaac4226b7d5821e1fe706a1088501) feat: implement MachineController and small fixes
+* [`e31d22d`](https://github.com/siderolabs/arges-theila/commit/e31d22d7639753df53c130461ae1f96b9126f3a5) feat: support running Theila without contexts
+* [`a6b3646`](https://github.com/siderolabs/arges-theila/commit/a6b364626bd808687d5ad95307766344b16dd042) refactor: small fixes
+* [`33d2b59`](https://github.com/siderolabs/arges-theila/commit/33d2b59c202f03785580209c885aa297c023fa60) refactor: clean up a bit SideroLink code, fix shutdown
+* [`98ec883`](https://github.com/siderolabs/arges-theila/commit/98ec8830308755c7073a5d4510483e97d8e1d02d) chore: rename main executable to avoid clashing with Theila project
+* [`828721d`](https://github.com/siderolabs/arges-theila/commit/828721d9aa5d912cce628256f75579309d1ad67d) feat: enable COSI persistence for resources
+* [`f1f7883`](https://github.com/siderolabs/arges-theila/commit/f1f788344254e18bcab00a25b56a86289bfb1638) feat: set up siderolink endpoints in Theila
+* [`6439335`](https://github.com/siderolabs/arges-theila/commit/64393353ca7cf430f82bfe73a004da319da28261) refactor: migrate to `typed.Resource` in Theila internal state
+* [`6195274`](https://github.com/siderolabs/arges-theila/commit/61952742a47ea89e89228f057d0d3de351766150) refactor: restructure folders in the project
+* [`1abf72b`](https://github.com/siderolabs/arges-theila/commit/1abf72b4b2e382fe0cf9302b42242152c255a3ee) chore: update Talos libs to the latest version
+* [`16dffd9`](https://github.com/siderolabs/arges-theila/commit/16dffd9058570477b3a648896a89e6445e5b0162) fix: display delta time for pod's age
+* [`8b80726`](https://github.com/siderolabs/arges-theila/commit/8b807262b23cfa830f3ff444d49f11b3a1654703) feat: update favicon to sidero logo
+* [`2da7378`](https://github.com/siderolabs/arges-theila/commit/2da737841c2ae0bf1f1f916dc6f45b1e3996d6e4) feat: show the extended hardware info
+* [`d3c6004`](https://github.com/siderolabs/arges-theila/commit/d3c6004f9767bf0cff9191dc130308c848ede077) chore: allow getting resources without version and group
+* [`eb19087`](https://github.com/siderolabs/arges-theila/commit/eb190875b30275195e52f1a95ed0bb3aae08424f) fix: remove t-header error notification
+* [`5a28202`](https://github.com/siderolabs/arges-theila/commit/5a28202c939ef9683d14fb3d873e0bacb35577db) feat: restyle t-alert component
+* [`9f2b482`](https://github.com/siderolabs/arges-theila/commit/9f2b48228bbfa39d33b07ae43e9fdb34192c3eed) fix: get rid of racy code in the kubeconfig request code
+* [`c40824e`](https://github.com/siderolabs/arges-theila/commit/c40824ecc5d10cb5289e133b8b1f51213aa12f7f) feat: add text Highlight feature
+* [`9018c81`](https://github.com/siderolabs/arges-theila/commit/9018c81bd0d7c58bb5c632c06f3c3904f6674e03) feat: use `~/.talos/config` as a primary source for clusters
+* [`e10547b`](https://github.com/siderolabs/arges-theila/commit/e10547b5761ad96ab8b5766fe5c3f06fcdf86477) refactor: remove old components and not used code parts
+* [`f704684`](https://github.com/siderolabs/arges-theila/commit/f7046846ea8e83a0e39647c4fcc49addf4c56061) fix: properly calculate servers capacity
+* [`755a077`](https://github.com/siderolabs/arges-theila/commit/755a0779014b0a4177e0fc5180db20720be5a814) fix: use proper units for memory and CPU charts on the node monitor page
+* [`d0a083d`](https://github.com/siderolabs/arges-theila/commit/d0a083d1c15c319e236dd258fabcc9a231f797a1) release(v0.2.0-alpha.0): prepare release
+* [`53878ee`](https://github.com/siderolabs/arges-theila/commit/53878eea09c18f2bc0dd55ca11a6743587748319) fix: properly update servers menu item when the context is changed
+* [`b4cb9c7`](https://github.com/siderolabs/arges-theila/commit/b4cb9c7989ec5299785b86acb3fa0ee648efd259) feat: restyle TMonitor page
+* [`f0377e2`](https://github.com/siderolabs/arges-theila/commit/f0377e2ad5da702af71f2706141f4d7c638c7a15) fix: invert chart value for cpu, storage and memory on the overview page
+* [`6ea6ecf`](https://github.com/siderolabs/arges-theila/commit/6ea6ecf12c4d8b5253b4dfc2e64f5b5d787d022a) fix: update capi-utils to fix talosconfig requests for CAPI clusters
+* [`e3796d3`](https://github.com/siderolabs/arges-theila/commit/e3796d3876d33248fd0998901273a14d29a487a3) chore: update capi-utils
+* [`39186eb`](https://github.com/siderolabs/arges-theila/commit/39186ebe50da531f35d21ac2488f8a58c1ef8e78) feat: implement overview page, cluster dropdown, ongoing tasks
+* [`59f2b27`](https://github.com/siderolabs/arges-theila/commit/59f2b27be4d7f5a591fdeae533d649494356250d) docs: update README.md
+* [`2b7831f`](https://github.com/siderolabs/arges-theila/commit/2b7831f2d22106ac8a82f890d73c2705841b0739) feat: add Kubernetes and Servers pages
+* [`4451a5b`](https://github.com/siderolabs/arges-theila/commit/4451a5bc9f5c6b058c6bcf1252b7c83a001cafbe) fix: properly set TaskStatus namespace in the initial call
+* [`4545464`](https://github.com/siderolabs/arges-theila/commit/454546425f2fd7e4418aa8a03465f3a062de804e) fix: add new fields to the TaskStatus spec, update Talos
+* [`891cf3b`](https://github.com/siderolabs/arges-theila/commit/891cf3b79c8430deeed8a168955afd6e97083baa) docs: describe client context types, usage
+* [`309b515`](https://github.com/siderolabs/arges-theila/commit/309b51545ead2ee144244591df2e5ead2849fb11) feat: update k8s upgrades tasks structure for the new UI representation
+* [`5aa8ca2`](https://github.com/siderolabs/arges-theila/commit/5aa8ca24bd3159879c46c8e8a134702b174e3362) feat: add NodesPage
+* [`db434e0`](https://github.com/siderolabs/arges-theila/commit/db434e07b9f23562bd746a0f78e3868b079006e2) feat: add TPagination component
+* [`0b51727`](https://github.com/siderolabs/arges-theila/commit/0b51727efed31f13f52fa20b360071e7e2a6d9eb) feat: add Pods, Dashboard, Upgrade views, etc
+* [`c549b8b`](https://github.com/siderolabs/arges-theila/commit/c549b8b9ee8a563f14b2e791f91a7b3cb0430aa7) feat: add Overview and Upgrade Kubernetes pages
+* [`cec2e85`](https://github.com/siderolabs/arges-theila/commit/cec2e854f4f3999109220902bccaee6c25d1f502) chore: define constants for all used resource types
+* [`962bdaf`](https://github.com/siderolabs/arges-theila/commit/962bdaf6406ab8e5febea0ad8d32da9c86fa39e7) feat: add TSideBar
+* [`fa28ccb`](https://github.com/siderolabs/arges-theila/commit/fa28ccb67f52c1dd9096b23388427d78be526275) feat: add TheHeader component
+* [`f3418a5`](https://github.com/siderolabs/arges-theila/commit/f3418a59e38e551bd0be7cc7ae66ef4645719aa7) feat: button;icons;config
+* [`db30f50`](https://github.com/siderolabs/arges-theila/commit/db30f503730bdbd8ed359d4070dea0214df67fcd) fix: add `frontend/node_modules` to gitignore
+* [`a675b86`](https://github.com/siderolabs/arges-theila/commit/a675b86f7d55cecd4ae1277cbf057a6bc264940c) fix: properly pass label selector to the metadata in ClusterListItem
+* [`7911d6a`](https://github.com/siderolabs/arges-theila/commit/7911d6a31abdb51e86586a025b705ddfeb1dd19e) chore: add ability to start local development server for the frontend
+* [`076fee1`](https://github.com/siderolabs/arges-theila/commit/076fee10c6583dc49e6530b02cab1f757da0e853) feat: use CAPI utils for CAPI requests
+* [`5ed5ba2`](https://github.com/siderolabs/arges-theila/commit/5ed5ba2a122585a97cf65c3ff081126752cd26fa) fix: more websocket client bugfixes
+* [`6fe22ad`](https://github.com/siderolabs/arges-theila/commit/6fe22ad370026380ba75b38e261870addc341e6f) fix: reset reconnect timeouts after the client is reconnected
+* [`c4b144a`](https://github.com/siderolabs/arges-theila/commit/c4b144af272a46dbdc8d1bb35784e09ba1b79987) fix: talosconfig/kubeconfig when using the default context
+* [`b439a37`](https://github.com/siderolabs/arges-theila/commit/b439a371c13a8d46d986a1dae3d6f4b7cba4a298) fix: properly handle Same-Origin header in websockets
+* [`ffffed1`](https://github.com/siderolabs/arges-theila/commit/ffffed100cec18209bae723b9919eb8613950649) fix: read node name from nodename resource instead of hostname
+* [`2d6f984`](https://github.com/siderolabs/arges-theila/commit/2d6f9844440a6d18b3093dea6228ac6a237dc86b) fix: use secure websockets if the page itself is using https
+* [`799f2d2`](https://github.com/siderolabs/arges-theila/commit/799f2d2d00762d5270dd4a3f4b4b312b32dbb7dd) feat: rework the node overview page
+* [`0d0eaf4`](https://github.com/siderolabs/arges-theila/commit/0d0eaf4b2721dfa1b04bce24e4a1e476579e3a74) fix: make charts height resize depending on the screen height
+* [`7de0101`](https://github.com/siderolabs/arges-theila/commit/7de0101bf0e613653caadd5733db0e29a6bb5bfb) fix: use polyfill to fix streaming APIs on Firefox
+* [`0cff2b0`](https://github.com/siderolabs/arges-theila/commit/0cff2b02b5d8b2c2c644067cf6bd3ed573cb784d) feat: small UI adjustments
+* [`d70bd41`](https://github.com/siderolabs/arges-theila/commit/d70bd41992e13fb3dacc1740532083a8f6ce9afa) feat: implement accept Sidero server functional
+* [`f3a6e16`](https://github.com/siderolabs/arges-theila/commit/f3a6e16a79e1bca9ea6c87eb0d3e0f2a6c65ff2e) feat: add top processes list to the Overview page
+* [`3cf97e4`](https://github.com/siderolabs/arges-theila/commit/3cf97e4b9e07f8383da8a6fb7a993b70c8f82503) refactor: use the same object for gRPC metadata context and messages
+* [`243206f`](https://github.com/siderolabs/arges-theila/commit/243206f95aa6ba944bd4361db6274e7072bae1fc) release(v0.1.0-alpha.2): prepare release
+* [`e5b6f29`](https://github.com/siderolabs/arges-theila/commit/e5b6f29fd298904e06284a67681cc0ce5135145f) feat: implement node Reset
+* [`bcb7d23`](https://github.com/siderolabs/arges-theila/commit/bcb7d237c31f42a35f5c3b53e7615ddae1ce0a8b) fix: node IP not being truncated
+* [`e576d33`](https://github.com/siderolabs/arges-theila/commit/e576d33ba40f629eed14668f2d9bf77d7fef62c2) feat: add upgrade UI for CAPI clusters
+* [`10cdce7`](https://github.com/siderolabs/arges-theila/commit/10cdce7fcc219af969a85a41d18fb904936faa0a) fix: server labels key/value order and chevron orientation
+* [`4007177`](https://github.com/siderolabs/arges-theila/commit/40071775d6de1eea697f67e55441c384c86e75d9) feat: implement Kubernetes upgrade UI components
+* [`f4917ee`](https://github.com/siderolabs/arges-theila/commit/f4917eecfb3173acf7518883c738118c8537d657) fix: accumulate chart updates into a single update
+* [`414d76c`](https://github.com/siderolabs/arges-theila/commit/414d76c1c926695e5d66787b34decae92e151b45) feat: implement upgrade controller
+* [`36742ea`](https://github.com/siderolabs/arges-theila/commit/36742ea5ab1e8a983b73f73443c1cf122a90d054) feat: introduce create, delete and update gRPC APIs
+* [`2b3d314`](https://github.com/siderolabs/arges-theila/commit/2b3d314a460b385d8c13bdd025fadb37b5508bdc) feat: install internal COSI runtime alongside with K8s and Talos
+* [`ae7f784`](https://github.com/siderolabs/arges-theila/commit/ae7f784d08621d18075b1763f026a7513d9d9dcb) refactor: move all generated TypeScript files under `frontend/src/api`
+* [`61bad64`](https://github.com/siderolabs/arges-theila/commit/61bad64540c28fb0520a39a6c64d64c3e9353361) release(v0.1.0-alpha.1): prepare release
+* [`8e5e722`](https://github.com/siderolabs/arges-theila/commit/8e5e7229470713d2fbd5ad0df027bd825f5481e3) feat: implement node reboot controls
+* [`9765a88`](https://github.com/siderolabs/arges-theila/commit/9765a88069f05c49f5a7d854675ee37e1c7a8273) feat: dmesg logs page
+* [`ecbbd67`](https://github.com/siderolabs/arges-theila/commit/ecbbd67936b1fb570d706fe3b93b81f6089b5124) feat: use updated timestamp to display event time on the graph
+* [`7c56773`](https://github.com/siderolabs/arges-theila/commit/7c56773448a496fe1ceeec3c47978975ce336b3a) refactor: use Metadata to pass context in all gRPC calls
+* [`abb4733`](https://github.com/siderolabs/arges-theila/commit/abb47330222217d7d8b5c36ff28902415bc755d8) feat: implement service logs viewer
+* [`8e8e032`](https://github.com/siderolabs/arges-theila/commit/8e8e032b20d082bfd71a26c2af2bbc821d9c2a7b) feat: add ability to pick sort order on the servers page
+* [`1a1c728`](https://github.com/siderolabs/arges-theila/commit/1a1c728ac929bb02db7f1bd0b991a747e63fe81a) fix: resolve the issue with idFn value generating undefined ids
+* [`2e83fe2`](https://github.com/siderolabs/arges-theila/commit/2e83fe23a7feb51b73bc7b53997636b641ae42b9) feat: allow filtering servers by picking from predefined categories
+* [`48f776e`](https://github.com/siderolabs/arges-theila/commit/48f776e10f6c79772481393d7397557419520046) fix: navigate home when changing the context
+* [`a1ce0ca`](https://github.com/siderolabs/arges-theila/commit/a1ce0ca8c8fabb2267c3dc6f6b1509f131e18ba8) fix: resolve services search issues
+* [`5b768f8`](https://github.com/siderolabs/arges-theila/commit/5b768f85277ee31131994ae0b253700a5d26978d) feat: make stacked lists searchable
+* [`ec1bc5b`](https://github.com/siderolabs/arges-theila/commit/ec1bc5b48943e473c756ebc7a8c943a34cdeaeac) feat: implement stats component and add stats to the servers page
+* [`1a85999`](https://github.com/siderolabs/arges-theila/commit/1a8599981f93fc5ce68e23b1b4cd7aabbb43c90c) feat: align Sidero servers list outlook with the wireframes
+* [`524264c`](https://github.com/siderolabs/arges-theila/commit/524264c515a9efdce9f06a3c2ebd59c2979f9b2a) fix: display error message and use proper layout for the spinner
+* [`5263d16`](https://github.com/siderolabs/arges-theila/commit/5263d16cfb936aad9ba461e0cc7b150ff9b806d5) feat: introduce node stats page
+* [`8feb35e`](https://github.com/siderolabs/arges-theila/commit/8feb35e95a6d588e1d9c605231308976be452a2e) feat: make root sidebar sections collapsible
+* [`36ad656`](https://github.com/siderolabs/arges-theila/commit/36ad656a3bbdc1e2915a87c0d09c31738ae3f3c4) feat: detect cluster capabilities
+* [`a25d90d`](https://github.com/siderolabs/arges-theila/commit/a25d90d58a85b3b73432858f134fa09cd1338d5c) feat: support switching context in the UI
+* [`67903e2`](https://github.com/siderolabs/arges-theila/commit/67903e23f49623ae9a9a6b297282c62aa8579aa8) refactor: separate Watch from StackedList
+* [`76b9e1d`](https://github.com/siderolabs/arges-theila/commit/76b9e1dc88cccf74cebb28470eae5e9249809d40) release(v0.1.0-alpha.0): prepare release
+* [`7bde4c8`](https://github.com/siderolabs/arges-theila/commit/7bde4c8c6e16c197578cbb4e037a05d50194958f) fix: cobra command was initialized but not actually used
+* [`04624c9`](https://github.com/siderolabs/arges-theila/commit/04624c95cec587ae0b0d8888d95d484ef8d98cfa) feat: support getting Talos and Kubernetes client configs for a cluster
+* [`219b9c8`](https://github.com/siderolabs/arges-theila/commit/219b9c8663fe03af65796b0b6299cff5e66b3efc) feat: implement notifications component
+* [`f8b19a0`](https://github.com/siderolabs/arges-theila/commit/f8b19a0585e6e19c0e7da4e4afad5bbd264e0029) feat: decouple watch list from the view
+* [`2f8c96e`](https://github.com/siderolabs/arges-theila/commit/2f8c96e44012e7bd0db9869eeb90ab48ff41e162) feat: implement appearance settings modal window
+* [`de745d6`](https://github.com/siderolabs/arges-theila/commit/de745d6b7170a9c509cc835a8b675a1c788e80f4) feat: implement Talos runtime backend
+* [`af69a0d`](https://github.com/siderolabs/arges-theila/commit/af69a0d58906a86974bc7dbec2c09ca9f78b152f) feat: support getting Kubernetes resource through gRPC gateway
+* [`2c50010`](https://github.com/siderolabs/arges-theila/commit/2c50010b0d9f7b168354fedd698600d94123c354) feat: implement breadcrumbs component, add support for table header
+* [`3fc1e80`](https://github.com/siderolabs/arges-theila/commit/3fc1e808875f6f502cd2657c4548dd886fbf465d) feat: implement nodes view
+* [`961e93a`](https://github.com/siderolabs/arges-theila/commit/961e93a4af430eaa9efcd1e2922af8072fe4cf85) feat: implement clusters view
+* [`e8248ff`](https://github.com/siderolabs/arges-theila/commit/e8248ffab89633cae8834631e39cf4dce5e4147a) feat: use plain zap instead of SugaredLogger everywhere
+* [`81ba93d`](https://github.com/siderolabs/arges-theila/commit/81ba93dffdc37efdde06557a1c63511a7d61b2f2) chore: generate websocket protocol messages using protobuf
+* [`37a878d`](https://github.com/siderolabs/arges-theila/commit/37a878dd396b650df8afaf6730f9afe52d35569c) feat: make JS websocket reconnect on connection loss
+* [`23b3281`](https://github.com/siderolabs/arges-theila/commit/23b3281f8880800a9084e1c8a74617fcf966c846) feat: use dynamic watcher to allow listing any kinds of resources
+* [`16475f5`](https://github.com/siderolabs/arges-theila/commit/16475f51cc9651736213b36c57381b24dcabdc62) feat: implement real time update server on top of web sockets
+* [`76b39ae`](https://github.com/siderolabs/arges-theila/commit/76b39ae563d9f09ecac3451389e3d260abdad48d) feat: create hello world Vue app using Kres
+* [`baab493`](https://github.com/siderolabs/arges-theila/commit/baab493f155cbd78c2e8af6ce45268c40ef6aeed) Initial commit
+</p>
+</details>
+
+### Dependency Changes
+
+This release has no dependency changes
+
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 000000000..e55a13648
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,11 @@
+# Contributing
+
+## Developer Certificate of Origin
+
+All commits require a [DCO](https://developercertificate.org/) sign-off.
+This is done by committing with the `--signoff` flag.
+
+## Development
+
+The build process for this project is designed to run entirely in containers.
+To get started, run `make help` and follow the instructions.
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
new file mode 100644
index 000000000..0a7a0af84
--- /dev/null
+++ b/DEVELOPMENT.md
@@ -0,0 +1,232 @@
+# Developing Omni
+
+Decide on the CIDR for the local set of QEMU Talos machines.
+In this document, we are going to use the `172.20.0.0/24` CIDR, but you can use any CIDR you want.
+
+With the CIDR `172.20.0.0/24`, the bridge IP is going to be `172.20.0.1`, so we are going to use the bridge IP
+as the Omni endpoint QEMU VMs can reach.
+
+## Build Omni and omnictl
+
+```shell
+make omni-linux-amd64
+```
+
+```shell
+make omnictl-linux-amd64
+```
+
+## Dev Environment
+
+### mkcert
+
+First, install and run [mkcert](https://github.com/FiloSottile/mkcert) to generate the TLS root certificates,
+and add them to your system's trust store.
+After installing dependencies, you can run the following command (requires `sudo`) to generate the root certificates:
+
+```shell
+make mkcert-install
+```
+
+or
+
+```shell
+go run ./hack/generate-certs install
+```
+
+Then you will need to create `generate-certs.yml` which you customize using `generate-certs.example.yml` as an example.
+The example file also contains a commented-out registry mirror configuration which speeds up local testing.
+After that, you can run the following command to generate the certificates and `hack/compose/docker-compose.override.yml` file:
+
+```shell
+make mkcert-generate
+```
+
+or
+
+```shell
+go run ./hack/generate-certs -config ./hack/generate-certs.yml generate
+```
+
+This should result in the following (git-ignored) files:
+
+- `hack/generate-certs/ca-root/rootCA.pem`
+- `hack/generate-certs/ca-root/rootCA-key.pem`
+- `hack/generate-certs/certs/localhost.pem`
+- `hack/generate-certs/certs/localhost-key.pem`
+- `hack/compose/docker-compose.override.yml`
+
+After that, you can run the following command to start the docker-compose environment:
+
+```shell
+make docker-compose-up WITH_DEBUG=1
+```
+
+When you're done, you can run the following command to stop the docker-compose environment:
+
+```shell
+make docker-compose-down
+```
+
+If you need to clean up `etcd` state, run:
+
+```shell
+docker volume rm compose_etcd
+```
+
+If you want to remove all volumes created by docker compose (e.g. `etcd`, `logs`, `secondary-storage`), run:
+
+```shell
+make docker-compose-down REMOVE_VOLUMES=true
+```
+
+### mkcert uninstall
+
+You can always remove the root certificates from your system's trust store using the following command:
+
+```shell
+make mkcert-uninstall
+```
+
+or
+
+```shell
+go run ./hack/generate-certs uninstall
+```
+
+## Start Talos VMs
+
+```shell
+sudo -E _out/talosctl-linux-amd64 cluster create \
+    --provisioner=qemu --cidr=172.20.0.0/24 --install-image=ghcr.io/siderolabs/installer:v1.3.2 --memory 2048 --memory-workers 2048 --disk 6144 --cpus 2 --controlplanes 1 --workers 5 \
+    --extra-boot-kernel-args 'siderolink.api=grpc://<HOST_IP>:8090?jointoken=w7uVuW3zbVKIYQuzEcyetAHeYMeo5q2L9RvkAVfCfSCD  talos.events.sink=[fdae:41e4:649b:9303::1]:8090 talos.logging.kernel=tcp://[fdae:41e4:649b:9303::1]:8092'
+    --skip-injecting-config --wait=false --with-init-node
+```
+
+> Note: `<HOST_IP>` is the IP address of the host machine, which is used by the Talos VMs to connect to Omni.
+> Omni also prints these args in the startup logs.
+
+## Open Omni UI
+
+By default, Omni serves the frontend and API on `*:443`, so you can open the Omni UI in your browser with e.g. `https://my.host/`.
+
+You should see your Talos VMs registered in the `Machines` tab, and a cluster can be created in the `Clusters` tab.
+
+Node.js development server can be used to get immediate feedback on frontend changes: `https://my.host:8120/`.
+When making frontend changes, `https://my.host/` will only update after stopping docker-compose environment with `^C` and running `make docker-compose-up WITH_DEBUG=1` again.
+At the same time `https://my.host:8120/` will update immediately.
+
+## Use `omnictl`
+
+Download `omniconfig` from the Omni UI.
+
+Fetch some resources with `omnictl`:
+
+```shell
+$ _out/omnictl-linux-amd64 --omniconfig=omniconfig get machines
+NAMESPACE   TYPE      ID                                     VERSION
+default     Machine   17e1d2c1-60f0-452e-87a9-bc949953643b   1
+default     Machine   20141377-15f2-43e2-a0a9-ff68ca21d90e   1
+```
+
+If the browser can't be launched from your machine (e.g., in a headless environment), you can use environment variable `BROWSER=echo` to see the URL instead.
+
+## Running Integration Tests
+
+Make sure the Omni database is clean, and it has some machines connected to it.
+
+Then run the integration tests:
+
+```shell
+$ sudo -E make run-integration-test WITH_DEBUG=true
+=== RUN   TestSideroLinkDiscovery
+    siderolink.go:54: links discovered: 1
+    siderolink.go:54: links discovered: 2
+    siderolink.go:54: links discovered: 3
+    siderolink.go:54: links discovered: 4
+--- PASS: TestSideroLinkDiscovery (0.00s)
+PASS
+```
+
+Another way to run integration tests directly:
+
+```shell
+$ make _out/omni-integration-test-linux-amd64
+$ sudo -E _out/omni-integration-test-linux-amd64 \
+    --endpoint=https://my.host \
+    --expected-machines=6
+```
+
+Tests need a hint on number of available Talos VMs with `--expected-machines` flag: make it equal to the sum of `--controlplanes` and `--workers` in the `talosctl cluster create` above.
+
+Specific tests can be run by appending a flag `--test.run=TestSideroLinkDiscovery` to the command above.
+
+## Local Network Use
+
+When using Omni to provision Talos clusters in your LAN, it makes sense to launch it with default args, this way Omni advertises the first host IP address by default.
+
+## Etcd Backups
+
+You can set up Omni to periodically back up its etcd database to a local directory or s3 storage.
+By default, Omni uses s3 storage.
+
+To enable etcd backups into the local directory, set the following command line flag:
+
+```shell
+--etcd-backup-local-path /path/to/backup/dir
+```
+
+For s3 you should also create `EtcdBackupS3Configs.omni.sidero.dev` resource in the default namespace, since this is
+the place where Omni gets s3 credentials and options from.
+For example, for minio s3 with bucket `mybucket` and operating locally on port `9000` that would be:
+
+```yaml
+metadata:
+  namespace: default
+  type: EtcdBackupS3Configs.omni.sidero.dev
+  id: etcd-backup-s3-conf
+  version: undefined
+  owner:
+  phase: running
+  created: 2023-12-12T17:43:12+00:00
+  updated: 2023-12-12T17:43:12+00:00
+spec:
+  bucket: mybucket
+  region: us-east-1
+  endpoint: http://127.0.0.1:9000
+  accesskeyid: access
+  secretaccesskey: secret123
+  sessiontoken: ""
+```
+
+Keep in mind that `etcd-backup-local-path` and `etcd-backup-s3` are mutually exclusive.
+
+### Manual Etcd Backups
+
+You can create manual etcd backup if s3 or local backup is enabled.
+To do that, create a resource:
+
+```yaml
+metadata:
+  namespace: ephemeral
+  type: EtcdManualBackups.omni.sidero.dev
+  id: <your-cluster-name>
+  version: undefined
+  owner:
+  phase: running
+spec:
+  backupat:
+    seconds: <unix-timestamp>
+    nanos: 0
+```
+
+`unix-timestamp` should be no more than one minute in the future or in the past.
+
+## Controller Dependency Graphs
+
+If Omni is built `WITH_DEBUG=1`, it provides an additional handler under `/debug` prefix:
+
+```shell
+curl https://my.host/debug/controller-graph | dot -Tsvg -o controller.svg
+curl https://my.host/debug/controller-resource-graph | dot -Tsvg -o controller-resource.svg
+```
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 000000000..a2af04e83
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,513 @@
+# syntax = docker/dockerfile-upstream:1.6.0-labs
+
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2024-02-26T21:35:48Z by kres latest.
+
+ARG JS_TOOLCHAIN
+ARG TOOLCHAIN
+
+FROM ghcr.io/siderolabs/ca-certificates:v1.6.0 AS image-ca-certificates
+
+FROM ghcr.io/siderolabs/fhs:v1.6.0 AS image-fhs
+
+# base toolchain image
+FROM ${JS_TOOLCHAIN} AS js-toolchain
+COPY --from=golang:1.22-alpine /usr/local/go /usr/local/go
+RUN apk --update --no-cache add bash curl protoc protobuf-dev
+COPY ./go.mod .
+COPY ./go.sum .
+ENV GOPATH /go
+ENV PATH ${PATH}:/usr/local/go/bin
+
+# runs markdownlint
+FROM docker.io/node:21.6.2-alpine3.19 AS lint-markdown
+WORKDIR /src
+RUN npm i -g markdownlint-cli@0.39.0
+RUN npm i sentences-per-line@0.2.1
+COPY .markdownlint.json .
+COPY ./docs ./docs
+COPY ./CHANGELOG.md ./CHANGELOG.md
+COPY ./CONTRIBUTING.md ./CONTRIBUTING.md
+COPY ./DEVELOPMENT.md ./DEVELOPMENT.md
+COPY ./README.md ./README.md
+RUN markdownlint --ignore "CHANGELOG.md" --ignore "**/node_modules/**" --ignore '**/hack/chglog/**' --rules node_modules/sentences-per-line/index.js .
+
+# collects proto specs
+FROM scratch AS proto-specs
+ADD client/api/common/omni.proto /client/api/common/
+ADD client/api/omni/resources/resources.proto /client/api/omni/resources/
+ADD client/api/omni/management/management.proto /client/api/omni/management/
+ADD client/api/omni/oidc/oidc.proto /client/api/omni/oidc/
+ADD client/api/omni/specs/auth.proto /client/api/omni/specs/
+ADD client/api/omni/specs/virtual.proto /client/api/omni/specs/
+ADD client/api/omni/specs/ephemeral.proto /client/api/omni/specs/
+ADD client/api/omni/specs/oidc.proto /client/api/omni/specs/
+ADD client/api/omni/specs/omni.proto /client/api/omni/specs/
+ADD client/api/omni/specs/siderolink.proto /client/api/omni/specs/
+ADD client/api/omni/specs/system.proto /client/api/omni/specs/
+ADD https://raw.githubusercontent.com/googleapis/googleapis/master/google/rpc/status.proto /client/api/google/rpc/
+ADD https://raw.githubusercontent.com/siderolabs/talos/03a20da9da5916c63015d355f4b56823778e994f/api/common/common.proto /client/api/common/
+ADD https://raw.githubusercontent.com/siderolabs/talos/03a20da9da5916c63015d355f4b56823778e994f/api/machine/machine.proto /client/api/talos/machine/
+ADD https://raw.githubusercontent.com/cosi-project/specification/c644a4b0fd408ec41bd29193bcdbd1a5b7feead2/proto/v1alpha1/resource.proto /client/api/v1alpha1/
+
+# collects proto specs
+FROM scratch AS proto-specs-frontend
+ADD client/api/common/omni.proto /frontend/src/api/common/
+ADD client/api/omni/resources/resources.proto /frontend/src/api/omni/resources/
+ADD client/api/omni/management/management.proto /frontend/src/api/omni/management/
+ADD client/api/omni/oidc/oidc.proto /frontend/src/api/omni/oidc/
+ADD https://raw.githubusercontent.com/siderolabs/go-api-signature/a034e9ff315ba4a56115acc7ad0fb99d0dc77800/api/auth/auth.proto /frontend/src/api/omni/auth/
+ADD client/api/omni/specs/omni.proto /frontend/src/api/omni/specs/
+ADD client/api/omni/specs/siderolink.proto /frontend/src/api/omni/specs/
+ADD client/api/omni/specs/system.proto /frontend/src/api/omni/specs/
+ADD client/api/omni/specs/auth.proto /frontend/src/api/omni/specs/
+ADD client/api/omni/specs/virtual.proto /frontend/src/api/omni/specs/
+ADD client/api/omni/specs/ephemeral.proto /frontend/src/api/omni/specs/
+ADD https://raw.githubusercontent.com/googleapis/googleapis/master/google/rpc/status.proto /frontend/src/api/google/rpc/
+ADD https://raw.githubusercontent.com/siderolabs/talos/03a20da9da5916c63015d355f4b56823778e994f/api/machine/machine.proto /frontend/src/api/talos/machine/
+ADD https://raw.githubusercontent.com/protocolbuffers/protobuf/master/src/google/protobuf/any.proto /frontend/src/api/google/protobuf/
+ADD https://raw.githubusercontent.com/protocolbuffers/protobuf/master/src/google/protobuf/duration.proto /frontend/src/api/google/protobuf/
+ADD https://raw.githubusercontent.com/protocolbuffers/protobuf/master/src/google/protobuf/empty.proto /frontend/src/api/google/protobuf/
+ADD https://raw.githubusercontent.com/protocolbuffers/protobuf/master/src/google/protobuf/timestamp.proto /frontend/src/api/google/protobuf/
+ADD https://raw.githubusercontent.com/googleapis/googleapis/master/google/rpc/code.proto /frontend/src/api/google/rpc/
+ADD https://raw.githubusercontent.com/siderolabs/talos/03a20da9da5916c63015d355f4b56823778e994f/api/common/common.proto /frontend/src/api/common/
+ADD https://raw.githubusercontent.com/cosi-project/specification/5c734257bfa6a3acb01417809797dbfbe0e73c71/proto/v1alpha1/resource.proto /frontend/src/api/v1alpha1/
+
+# base toolchain image
+FROM ${TOOLCHAIN} AS toolchain
+RUN apk --update --no-cache add bash curl build-base protoc protobuf-dev
+
+# build tools
+FROM --platform=${BUILDPLATFORM} toolchain AS tools
+ENV GO111MODULE on
+ARG CGO_ENABLED
+ENV CGO_ENABLED ${CGO_ENABLED}
+ARG GOTOOLCHAIN
+ENV GOTOOLCHAIN ${GOTOOLCHAIN}
+ARG GOEXPERIMENT
+ENV GOEXPERIMENT ${GOEXPERIMENT}
+ENV GOPATH /go
+ARG PROTOBUF_GO_VERSION
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg go install google.golang.org/protobuf/cmd/protoc-gen-go@v${PROTOBUF_GO_VERSION}
+RUN mv /go/bin/protoc-gen-go /bin
+ARG GRPC_GO_VERSION
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v${GRPC_GO_VERSION}
+RUN mv /go/bin/protoc-gen-go-grpc /bin
+ARG GRPC_GATEWAY_VERSION
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway@v${GRPC_GATEWAY_VERSION}
+RUN mv /go/bin/protoc-gen-grpc-gateway /bin
+ARG VTPROTOBUF_VERSION
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg go install github.com/planetscale/vtprotobuf/cmd/protoc-gen-go-vtproto@v${VTPROTOBUF_VERSION}
+RUN mv /go/bin/protoc-gen-go-vtproto /bin
+ARG DEEPCOPY_VERSION
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg go install github.com/siderolabs/deep-copy@${DEEPCOPY_VERSION} \
+	&& mv /go/bin/deep-copy /bin/deep-copy
+ARG GOLANGCILINT_VERSION
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg go install github.com/golangci/golangci-lint/cmd/golangci-lint@${GOLANGCILINT_VERSION} \
+	&& mv /go/bin/golangci-lint /bin/golangci-lint
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg go install golang.org/x/vuln/cmd/govulncheck@latest \
+	&& mv /go/bin/govulncheck /bin/govulncheck
+ARG GOIMPORTS_VERSION
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg go install golang.org/x/tools/cmd/goimports@${GOIMPORTS_VERSION} \
+	&& mv /go/bin/goimports /bin/goimports
+ARG GOFUMPT_VERSION
+RUN go install mvdan.cc/gofumpt@${GOFUMPT_VERSION} \
+	&& mv /go/bin/gofumpt /bin/gofumpt
+
+# tools and sources
+FROM js-toolchain AS js
+WORKDIR /src
+ARG PROTOBUF_GRPC_GATEWAY_TS_VERSION
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg go install github.com/siderolabs/protoc-gen-grpc-gateway-ts@v${PROTOBUF_GRPC_GATEWAY_TS_VERSION}
+RUN mv /go/bin/protoc-gen-grpc-gateway-ts /bin
+COPY frontend/package.json ./
+COPY frontend/package-lock.json ./
+RUN --mount=type=cache,target=/src/node_modules npm version ${VERSION}
+RUN --mount=type=cache,target=/src/node_modules npm ci
+COPY frontend/.eslintrc.yaml ./
+COPY frontend/babel.config.js ./
+COPY frontend/jest.config.js ./
+COPY frontend/tsconfig.json ./
+COPY ./frontend/src ./src
+COPY ./frontend/tests ./tests
+COPY ./frontend/public ./public
+COPY ./frontend/babel.config.js ./babel.config.js
+COPY ./frontend/jest.config.js ./jest.config.js
+COPY ./frontend/postcss.config.js ./postcss.config.js
+COPY ./frontend/tailwind.config.js ./tailwind.config.js
+COPY ./frontend/vue.config.js ./vue.config.js
+
+FROM tools AS embed-generate
+ARG SHA
+ARG TAG
+WORKDIR /src
+RUN mkdir -p internal/version/data && \
+    echo -n ${SHA} > internal/version/data/sha && \
+    echo -n ${TAG} > internal/version/data/tag
+
+# runs protobuf compiler
+FROM tools AS proto-compile
+COPY --from=proto-specs / /
+RUN protoc -I/client/api --go_out=paths=source_relative:/client/api --go-grpc_out=paths=source_relative:/client/api --go-vtproto_out=paths=source_relative:/client/api --go-vtproto_opt=features=marshal+unmarshal+size+equal+clone /client/api/common/omni.proto
+RUN protoc -I/client/api --grpc-gateway_out=paths=source_relative:/client/api --grpc-gateway_opt=generate_unbound_methods=true --go_out=paths=source_relative:/client/api --go-grpc_out=paths=source_relative:/client/api --go-vtproto_out=paths=source_relative:/client/api --go-vtproto_opt=features=marshal+unmarshal+size+equal+clone /client/api/omni/resources/resources.proto /client/api/omni/management/management.proto /client/api/omni/oidc/oidc.proto /client/api/omni/specs/auth.proto /client/api/omni/specs/virtual.proto /client/api/omni/specs/ephemeral.proto /client/api/omni/specs/oidc.proto /client/api/omni/specs/omni.proto /client/api/omni/specs/siderolink.proto /client/api/omni/specs/system.proto
+RUN protoc -I/client/api --grpc-gateway_out=paths=source_relative:/client/api --grpc-gateway_opt=generate_unbound_methods=true --grpc-gateway_opt=standalone=true /client/api/google/rpc/status.proto /client/api/common/common.proto /client/api/talos/machine/machine.proto /client/api/v1alpha1/resource.proto
+RUN rm /client/api/common/omni.proto
+RUN rm /client/api/omni/resources/resources.proto
+RUN rm /client/api/omni/management/management.proto
+RUN rm /client/api/omni/oidc/oidc.proto
+RUN rm /client/api/omni/specs/auth.proto
+RUN rm /client/api/omni/specs/virtual.proto
+RUN rm /client/api/omni/specs/ephemeral.proto
+RUN rm /client/api/omni/specs/oidc.proto
+RUN rm /client/api/omni/specs/omni.proto
+RUN rm /client/api/omni/specs/siderolink.proto
+RUN rm /client/api/omni/specs/system.proto
+RUN goimports -w -local github.com/siderolabs/omni/client,github.com/siderolabs/omni /client/api
+RUN gofumpt -w /client/api
+
+# builds frontend
+FROM js AS frontend
+ARG NODE_BUILD_ARGS
+RUN --mount=type=cache,target=/src/node_modules npm run build ${NODE_BUILD_ARGS}
+RUN mkdir -p /internal/frontend/dist
+RUN cp -rf ./dist/* /internal/frontend/dist
+
+# runs eslint
+FROM js AS lint-eslint
+RUN --mount=type=cache,target=/src/node_modules npm run lint
+
+# runs protobuf compiler
+FROM js AS proto-compile-frontend
+COPY --from=proto-specs-frontend / /
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/common/omni.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/omni/resources/resources.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/omni/management/management.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/omni/oidc/oidc.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/omni/auth/auth.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/omni/specs/omni.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/omni/specs/siderolink.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/omni/specs/system.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/omni/specs/auth.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/omni/specs/virtual.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/omni/specs/ephemeral.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/google/rpc/status.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/talos/machine/machine.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/google/protobuf/any.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/google/protobuf/duration.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/google/protobuf/empty.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/google/protobuf/timestamp.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/google/rpc/code.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/common/common.proto
+RUN protoc -I/frontend/src/api --grpc-gateway-ts_out=source_relative:/frontend/src/api --grpc-gateway-ts_opt=use_proto_names=true /frontend/src/api/v1alpha1/resource.proto
+RUN rm /frontend/src/api/common/omni.proto
+RUN rm /frontend/src/api/omni/resources/resources.proto
+RUN rm /frontend/src/api/omni/management/management.proto
+RUN rm /frontend/src/api/omni/oidc/oidc.proto
+RUN rm /frontend/src/api/omni/specs/omni.proto
+RUN rm /frontend/src/api/omni/specs/siderolink.proto
+RUN rm /frontend/src/api/omni/specs/system.proto
+RUN rm /frontend/src/api/omni/specs/auth.proto
+RUN rm /frontend/src/api/omni/specs/virtual.proto
+RUN rm /frontend/src/api/omni/specs/ephemeral.proto
+
+# runs js unit-tests
+FROM js AS unit-tests-frontend
+RUN --mount=type=cache,target=/src/node_modules CI=true npm run test
+
+FROM embed-generate AS embed-abbrev-generate
+WORKDIR /src
+ARG ABBREV_TAG
+RUN echo -n 'undefined' > internal/version/data/sha && \
+    echo -n ${ABBREV_TAG} > internal/version/data/tag
+
+# tools and sources
+FROM tools AS base
+WORKDIR /src
+COPY client/go.mod client/go.mod
+COPY client/go.sum client/go.sum
+COPY go.mod go.mod
+COPY go.sum go.sum
+RUN cd client
+RUN --mount=type=cache,target=/go/pkg go mod download
+RUN --mount=type=cache,target=/go/pkg go mod verify
+RUN cd .
+RUN --mount=type=cache,target=/go/pkg go mod download
+RUN --mount=type=cache,target=/go/pkg go mod verify
+COPY ./client/api ./client/api
+COPY ./client/pkg ./client/pkg
+COPY ./cmd ./cmd
+COPY ./internal ./internal
+COPY --from=frontend /internal/frontend/dist ./internal/frontend/dist
+RUN --mount=type=cache,target=/go/pkg go list -mod=readonly all >/dev/null
+
+# cleaned up specs and compiled versions
+FROM scratch AS generate-frontend
+ADD https://www.talos.dev/v1.6/schemas/config.schema.json frontend/src/schemas/config.schema.json
+COPY --from=proto-compile-frontend frontend/ frontend/
+
+# run go generate
+FROM base AS go-generate-0
+WORKDIR /src
+COPY .license-header.go.txt hack/.license-header.go.txt
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg go generate ./internal/...
+RUN goimports -w -local github.com/siderolabs/omni/client,github.com/siderolabs/omni ./internal
+
+# runs gofumpt
+FROM base AS lint-gofumpt
+RUN FILES="$(gofumpt -l .)" && test -z "${FILES}" || (echo -e "Source code is not formatted with 'gofumpt -w .':\n${FILES}"; exit 1)
+
+# runs gofumpt
+FROM base AS lint-gofumpt-client
+RUN FILES="$(gofumpt -l client)" && test -z "${FILES}" || (echo -e "Source code is not formatted with 'gofumpt -w client':\n${FILES}"; exit 1)
+
+# runs goimports
+FROM base AS lint-goimports
+RUN FILES="$(goimports -l -local github.com/siderolabs/omni/ .)" && test -z "${FILES}" || (echo -e "Source code is not formatted with 'goimports -w -local github.com/siderolabs/omni/ .':\n${FILES}"; exit 1)
+
+# runs goimports
+FROM base AS lint-goimports-client
+RUN FILES="$(goimports -l -local github.com/siderolabs/omni/client/ client)" && test -z "${FILES}" || (echo -e "Source code is not formatted with 'goimports -w -local github.com/siderolabs/omni/client/ client':\n${FILES}"; exit 1)
+
+# runs golangci-lint
+FROM base AS lint-golangci-lint
+WORKDIR /src
+COPY .golangci.yml .
+ENV GOGC 50
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/root/.cache/golangci-lint --mount=type=cache,target=/go/pkg golangci-lint run --config .golangci.yml
+
+# runs golangci-lint
+FROM base AS lint-golangci-lint-client
+WORKDIR /src/client
+COPY client/.golangci.yml .
+ENV GOGC 50
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/root/.cache/golangci-lint --mount=type=cache,target=/go/pkg golangci-lint run --config .golangci.yml
+
+# runs govulncheck
+FROM base AS lint-govulncheck
+WORKDIR /src
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg govulncheck ./...
+
+# runs govulncheck
+FROM base AS lint-govulncheck-client
+WORKDIR /src/client
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg govulncheck ./...
+
+# runs unit-tests with race detector
+FROM base AS unit-tests-client-race
+WORKDIR /src/client
+ARG TESTPKGS
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg --mount=type=cache,target=/tmp CGO_ENABLED=1 go test -v -race -count 1 ${TESTPKGS}
+
+# runs unit-tests
+FROM base AS unit-tests-client-run
+WORKDIR /src/client
+ARG TESTPKGS
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg --mount=type=cache,target=/tmp go test -v -covermode=atomic -coverprofile=coverage.txt -coverpkg=${TESTPKGS} -count 1 ${TESTPKGS}
+
+# runs unit-tests with race detector
+FROM base AS unit-tests-race
+WORKDIR /src
+ARG TESTPKGS
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg --mount=type=cache,target=/tmp CGO_ENABLED=1 go test -v -race -count 1 ${TESTPKGS}
+
+# runs unit-tests
+FROM base AS unit-tests-run
+WORKDIR /src
+ARG TESTPKGS
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg --mount=type=cache,target=/tmp go test -v -covermode=atomic -coverprofile=coverage.txt -coverpkg=${TESTPKGS} -count 1 ${TESTPKGS}
+
+# cleaned up specs and compiled versions
+FROM scratch AS generate
+COPY --from=proto-compile /client/api/ /client/api/
+COPY --from=go-generate-0 /src/frontend frontend
+COPY --from=embed-abbrev-generate /src/internal/version internal/version
+
+FROM scratch AS unit-tests-client
+COPY --from=unit-tests-client-run /src/client/coverage.txt /coverage-unit-tests-client.txt
+
+FROM scratch AS unit-tests
+COPY --from=unit-tests-run /src/coverage.txt /coverage-unit-tests.txt
+
+# builds omni-darwin-amd64
+FROM base AS omni-darwin-amd64-build
+COPY --from=generate / /
+COPY --from=embed-generate / /
+WORKDIR /src/cmd/omni
+ARG GO_BUILDFLAGS
+ARG GO_LDFLAGS
+ARG VERSION_PKG="internal/version"
+ARG SHA
+ARG TAG
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg GOARCH=amd64 GOOS=darwin go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=omni -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /omni-darwin-amd64
+
+# builds omni-darwin-arm64
+FROM base AS omni-darwin-arm64-build
+COPY --from=generate / /
+COPY --from=embed-generate / /
+WORKDIR /src/cmd/omni
+ARG GO_BUILDFLAGS
+ARG GO_LDFLAGS
+ARG VERSION_PKG="internal/version"
+ARG SHA
+ARG TAG
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg GOARCH=arm64 GOOS=darwin go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=omni -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /omni-darwin-arm64
+
+# builds omni-integration-test-linux-amd64
+FROM base AS omni-integration-test-linux-amd64-build
+COPY --from=generate / /
+COPY --from=embed-generate / /
+WORKDIR /src/cmd/omni-integration-test
+ARG GO_BUILDFLAGS
+ARG GO_LDFLAGS
+ARG VERSION_PKG="internal/version"
+ARG SHA
+ARG TAG
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg GOARCH=amd64 GOOS=linux go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=omni-integration-test -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /omni-integration-test-linux-amd64
+
+# builds omni-linux-amd64
+FROM base AS omni-linux-amd64-build
+COPY --from=generate / /
+COPY --from=embed-generate / /
+WORKDIR /src/cmd/omni
+ARG GO_BUILDFLAGS
+ARG GO_LDFLAGS
+ARG VERSION_PKG="internal/version"
+ARG SHA
+ARG TAG
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg GOARCH=amd64 GOOS=linux go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=omni -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /omni-linux-amd64
+
+# builds omni-linux-arm64
+FROM base AS omni-linux-arm64-build
+COPY --from=generate / /
+COPY --from=embed-generate / /
+WORKDIR /src/cmd/omni
+ARG GO_BUILDFLAGS
+ARG GO_LDFLAGS
+ARG VERSION_PKG="internal/version"
+ARG SHA
+ARG TAG
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg GOARCH=arm64 GOOS=linux go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=omni -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /omni-linux-arm64
+
+# builds omnictl-darwin-amd64
+FROM base AS omnictl-darwin-amd64-build
+COPY --from=generate / /
+COPY --from=embed-generate / /
+WORKDIR /src/cmd/omnictl
+ARG GO_BUILDFLAGS
+ARG GO_LDFLAGS
+ARG VERSION_PKG="internal/version"
+ARG SHA
+ARG TAG
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg GOARCH=amd64 GOOS=darwin go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=omnictl -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /omnictl-darwin-amd64
+
+# builds omnictl-darwin-arm64
+FROM base AS omnictl-darwin-arm64-build
+COPY --from=generate / /
+COPY --from=embed-generate / /
+WORKDIR /src/cmd/omnictl
+ARG GO_BUILDFLAGS
+ARG GO_LDFLAGS
+ARG VERSION_PKG="internal/version"
+ARG SHA
+ARG TAG
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg GOARCH=arm64 GOOS=darwin go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=omnictl -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /omnictl-darwin-arm64
+
+# builds omnictl-linux-amd64
+FROM base AS omnictl-linux-amd64-build
+COPY --from=generate / /
+COPY --from=embed-generate / /
+WORKDIR /src/cmd/omnictl
+ARG GO_BUILDFLAGS
+ARG GO_LDFLAGS
+ARG VERSION_PKG="internal/version"
+ARG SHA
+ARG TAG
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg GOARCH=amd64 GOOS=linux go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=omnictl -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /omnictl-linux-amd64
+
+# builds omnictl-linux-arm64
+FROM base AS omnictl-linux-arm64-build
+COPY --from=generate / /
+COPY --from=embed-generate / /
+WORKDIR /src/cmd/omnictl
+ARG GO_BUILDFLAGS
+ARG GO_LDFLAGS
+ARG VERSION_PKG="internal/version"
+ARG SHA
+ARG TAG
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg GOARCH=arm64 GOOS=linux go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=omnictl -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /omnictl-linux-arm64
+
+# builds omnictl-windows-amd64.exe
+FROM base AS omnictl-windows-amd64.exe-build
+COPY --from=generate / /
+COPY --from=embed-generate / /
+WORKDIR /src/cmd/omnictl
+ARG GO_BUILDFLAGS
+ARG GO_LDFLAGS
+ARG VERSION_PKG="internal/version"
+ARG SHA
+ARG TAG
+RUN --mount=type=cache,target=/root/.cache/go-build --mount=type=cache,target=/go/pkg GOARCH=amd64 GOOS=windows go build ${GO_BUILDFLAGS} -ldflags "${GO_LDFLAGS} -X ${VERSION_PKG}.Name=omnictl -X ${VERSION_PKG}.SHA=${SHA} -X ${VERSION_PKG}.Tag=${TAG}" -o /omnictl-windows-amd64.exe
+
+FROM scratch AS omni-darwin-amd64
+COPY --from=omni-darwin-amd64-build /omni-darwin-amd64 /omni-darwin-amd64
+
+FROM scratch AS omni-darwin-arm64
+COPY --from=omni-darwin-arm64-build /omni-darwin-arm64 /omni-darwin-arm64
+
+FROM scratch AS omni-integration-test-linux-amd64
+COPY --from=omni-integration-test-linux-amd64-build /omni-integration-test-linux-amd64 /omni-integration-test-linux-amd64
+
+FROM scratch AS omni-linux-amd64
+COPY --from=omni-linux-amd64-build /omni-linux-amd64 /omni-linux-amd64
+
+FROM scratch AS omni-linux-arm64
+COPY --from=omni-linux-arm64-build /omni-linux-arm64 /omni-linux-arm64
+
+FROM scratch AS omnictl-darwin-amd64
+COPY --from=omnictl-darwin-amd64-build /omnictl-darwin-amd64 /omnictl-darwin-amd64
+
+FROM scratch AS omnictl-darwin-arm64
+COPY --from=omnictl-darwin-arm64-build /omnictl-darwin-arm64 /omnictl-darwin-arm64
+
+FROM scratch AS omnictl-linux-amd64
+COPY --from=omnictl-linux-amd64-build /omnictl-linux-amd64 /omnictl-linux-amd64
+
+FROM scratch AS omnictl-linux-arm64
+COPY --from=omnictl-linux-arm64-build /omnictl-linux-arm64 /omnictl-linux-arm64
+
+FROM scratch AS omnictl-windows-amd64.exe
+COPY --from=omnictl-windows-amd64.exe-build /omnictl-windows-amd64.exe /omnictl-windows-amd64.exe
+
+FROM omni-integration-test-linux-${TARGETARCH} AS omni-integration-test
+
+FROM scratch AS omni-integration-test-all
+COPY --from=omni-integration-test-linux-amd64 / /
+
+FROM omni-linux-${TARGETARCH} AS omni
+
+FROM scratch AS omni-all
+COPY --from=omni-darwin-amd64 / /
+COPY --from=omni-darwin-arm64 / /
+COPY --from=omni-linux-amd64 / /
+COPY --from=omni-linux-arm64 / /
+
+FROM omnictl-linux-${TARGETARCH} AS omnictl
+
+FROM scratch AS omnictl-all
+COPY --from=omnictl-darwin-amd64 / /
+COPY --from=omnictl-darwin-arm64 / /
+COPY --from=omnictl-linux-amd64 / /
+COPY --from=omnictl-linux-arm64 / /
+COPY --from=omnictl-windows-amd64.exe / /
+
+FROM scratch AS image-omni
+ARG TARGETARCH
+COPY --from=omni omni-linux-${TARGETARCH} /omni
+COPY --from=omni omni-linux-${TARGETARCH} /omni
+COPY --from=image-fhs / /
+COPY --from=image-ca-certificates / /
+COPY --from=omnictl-all / /omnictl/
+LABEL org.opencontainers.image.source https://github.com/siderolabs/omni
+ENTRYPOINT ["/omni"]
+
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 000000000..1b42f0fd5
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,95 @@
+Business Source License 1.1
+
+Parameters
+
+Licensor:             Sidero Labs, Inc.
+Licensed Work:        Omni
+                      The Licensed Work is (c) 2024 Sidero Labs, Inc.
+Additional Use Grant: None
+
+Change Date:          2028-02-22
+
+Change License:       Mozilla Public License, version 2.0
+
+For information about alternative licensing arrangements for the Software,
+please visit: https://www.siderolabs.com/contact/
+
+Notice
+
+The Business Source License (this document, or the "License") is not an Open
+Source license. However, the Licensed Work will eventually be made available
+under an Open Source License, as stated in this License.
+
+License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+-----------------------------------------------------------------------------
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License’s text to license
+your works, and to refer to it using the trademark "Business Source License",
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License’s text and the "Business
+Source License" name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where "compatible" means that software provided under the Change License can
+   be included in a program with software provided under GPL Version 2.0 or a
+   later version. Licensor may specify additional Change Licenses without
+   limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text "None".
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.
diff --git a/Makefile b/Makefile
new file mode 100644
index 000000000..bc546a6b2
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,365 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2024-02-26T21:35:48Z by kres latest.
+
+# common variables
+
+SHA := $(shell git describe --match=none --always --abbrev=8 --dirty)
+TAG := $(shell git describe --tag --always --dirty)
+ABBREV_TAG := $(shell git describe --tags >/dev/null 2>/dev/null && git describe --tag --always --match v[0-9]\* --abbrev=0 || echo 'undefined')
+BRANCH := $(shell git rev-parse --abbrev-ref HEAD)
+ARTIFACTS := _out
+WITH_DEBUG ?= false
+WITH_RACE ?= false
+REGISTRY ?= ghcr.io
+USERNAME ?= siderolabs
+REGISTRY_AND_USERNAME ?= $(REGISTRY)/$(USERNAME)
+PROTOBUF_GRPC_GATEWAY_TS_VERSION ?= 1.2.1
+TESTPKGS ?= ./...
+NODE_BUILD_ARGS ?=
+PROTOBUF_GO_VERSION ?= 1.32.0
+GRPC_GO_VERSION ?= 1.3.0
+GRPC_GATEWAY_VERSION ?= 2.19.1
+VTPROTOBUF_VERSION ?= 0.6.0
+DEEPCOPY_VERSION ?= v0.5.6
+GOLANGCILINT_VERSION ?= v1.56.2
+GOFUMPT_VERSION ?= v0.6.0
+GO_VERSION ?= 1.22.0
+GOIMPORTS_VERSION ?= v0.18.0
+GO_BUILDFLAGS ?=
+GO_LDFLAGS ?=
+CGO_ENABLED ?= 0
+GOTOOLCHAIN ?= local
+KRES_IMAGE ?= ghcr.io/siderolabs/kres:latest
+CONFORMANCE_IMAGE ?= ghcr.io/siderolabs/conform:latest
+
+# docker build settings
+
+BUILD := docker buildx build
+PLATFORM ?= linux/amd64
+PROGRESS ?= auto
+PUSH ?= false
+CI_ARGS ?=
+COMMON_ARGS = --file=Dockerfile
+COMMON_ARGS += --provenance=false
+COMMON_ARGS += --progress=$(PROGRESS)
+COMMON_ARGS += --platform=$(PLATFORM)
+COMMON_ARGS += --push=$(PUSH)
+COMMON_ARGS += --build-arg=ARTIFACTS="$(ARTIFACTS)"
+COMMON_ARGS += --build-arg=SHA="$(SHA)"
+COMMON_ARGS += --build-arg=TAG="$(TAG)"
+COMMON_ARGS += --build-arg=ABBREV_TAG="$(ABBREV_TAG)"
+COMMON_ARGS += --build-arg=USERNAME="$(USERNAME)"
+COMMON_ARGS += --build-arg=REGISTRY="$(REGISTRY)"
+COMMON_ARGS += --build-arg=JS_TOOLCHAIN="$(JS_TOOLCHAIN)"
+COMMON_ARGS += --build-arg=PROTOBUF_GRPC_GATEWAY_TS_VERSION="$(PROTOBUF_GRPC_GATEWAY_TS_VERSION)"
+COMMON_ARGS += --build-arg=NODE_BUILD_ARGS="$(NODE_BUILD_ARGS)"
+COMMON_ARGS += --build-arg=TOOLCHAIN="$(TOOLCHAIN)"
+COMMON_ARGS += --build-arg=CGO_ENABLED="$(CGO_ENABLED)"
+COMMON_ARGS += --build-arg=GO_BUILDFLAGS="$(GO_BUILDFLAGS)"
+COMMON_ARGS += --build-arg=GO_LDFLAGS="$(GO_LDFLAGS)"
+COMMON_ARGS += --build-arg=GOTOOLCHAIN="$(GOTOOLCHAIN)"
+COMMON_ARGS += --build-arg=GOEXPERIMENT="$(GOEXPERIMENT)"
+COMMON_ARGS += --build-arg=PROTOBUF_GO_VERSION="$(PROTOBUF_GO_VERSION)"
+COMMON_ARGS += --build-arg=GRPC_GO_VERSION="$(GRPC_GO_VERSION)"
+COMMON_ARGS += --build-arg=GRPC_GATEWAY_VERSION="$(GRPC_GATEWAY_VERSION)"
+COMMON_ARGS += --build-arg=VTPROTOBUF_VERSION="$(VTPROTOBUF_VERSION)"
+COMMON_ARGS += --build-arg=DEEPCOPY_VERSION="$(DEEPCOPY_VERSION)"
+COMMON_ARGS += --build-arg=GOLANGCILINT_VERSION="$(GOLANGCILINT_VERSION)"
+COMMON_ARGS += --build-arg=GOIMPORTS_VERSION="$(GOIMPORTS_VERSION)"
+COMMON_ARGS += --build-arg=GOFUMPT_VERSION="$(GOFUMPT_VERSION)"
+COMMON_ARGS += --build-arg=TESTPKGS="$(TESTPKGS)"
+JS_TOOLCHAIN ?= docker.io/node:21.6.2-alpine3.19
+TOOLCHAIN ?= docker.io/golang:1.22-alpine
+
+# extra variables
+
+REMOVE_VOLUMES ?= false
+
+# help menu
+
+export define HELP_MENU_HEADER
+# Getting Started
+
+To build this project, you must have the following installed:
+
+- git
+- make
+- docker (19.03 or higher)
+
+## Creating a Builder Instance
+
+The build process makes use of experimental Docker features (buildx).
+To enable experimental features, add 'experimental: "true"' to '/etc/docker/daemon.json' on
+Linux or enable experimental features in Docker GUI for Windows or Mac.
+
+To create a builder instance, run:
+
+	docker buildx create --name local --use
+
+If running builds that needs to be cached aggresively create a builder instance with the following:
+
+	docker buildx create --name local --use --config=config.toml
+
+config.toml contents:
+
+[worker.oci]
+  gc = true
+  gckeepstorage = 50000
+
+  [[worker.oci.gcpolicy]]
+    keepBytes = 10737418240
+    keepDuration = 604800
+    filters = [ "type==source.local", "type==exec.cachemount", "type==source.git.checkout"]
+  [[worker.oci.gcpolicy]]
+    all = true
+    keepBytes = 53687091200
+
+If you already have a compatible builder instance, you may use that instead.
+
+## Artifacts
+
+All artifacts will be output to ./$(ARTIFACTS). Images will be tagged with the
+registry "$(REGISTRY)", username "$(USERNAME)", and a dynamic tag (e.g. $(IMAGE):$(TAG)).
+The registry and username can be overridden by exporting REGISTRY, and USERNAME
+respectively.
+
+endef
+
+ifneq (, $(filter $(WITH_RACE), t true TRUE y yes 1))
+GO_BUILDFLAGS += -race
+CGO_ENABLED := 1
+GO_LDFLAGS += -linkmode=external -extldflags '-static'
+endif
+
+ifneq (, $(filter $(WITH_DEBUG), t true TRUE y yes 1))
+GO_BUILDFLAGS += -tags sidero.debug
+else
+GO_LDFLAGS += -s
+endif
+
+all: unit-tests-frontend lint-eslint frontend unit-tests-client unit-tests omni image-omni omni-integration-test omnictl dev-server docker-compose-up docker-compose-down mkcert-install mkcert-generate mkcert-uninstall run-integration-test lint
+
+.PHONY: clean
+clean:  ## Cleans up all artifacts.
+	@rm -rf $(ARTIFACTS)
+
+target-%:  ## Builds the specified target defined in the Dockerfile. The build result will only remain in the build cache.
+	@$(BUILD) --target=$* $(COMMON_ARGS) $(TARGET_ARGS) $(CI_ARGS) .
+
+local-%:  ## Builds the specified target defined in the Dockerfile using the local output type. The build result will be output to the specified local destination.
+	@$(MAKE) target-$* TARGET_ARGS="--output=type=local,dest=$(DEST) $(TARGET_ARGS)"
+
+generate-frontend:  ## Generate .proto definitions.
+	@$(MAKE) local-$@ DEST=./
+
+.PHONY: js
+js:  ## Prepare js base toolchain.
+	@$(MAKE) target-$@
+
+.PHONY: unit-tests-frontend
+unit-tests-frontend:  ## Performs unit tests
+	@$(MAKE) target-$@
+
+lint-eslint:  ## Runs eslint linter.
+	@$(MAKE) target-$@
+
+.PHONY: $(ARTIFACTS)/frontend-js
+$(ARTIFACTS)/frontend-js:
+	@$(MAKE) target-frontend
+
+.PHONY: frontend
+frontend: $(ARTIFACTS)/frontend-js  ## Builds js release for frontend.
+
+generate:  ## Generate .proto definitions.
+	@$(MAKE) local-$@ DEST=./
+
+lint-golangci-lint-client:  ## Runs golangci-lint linter.
+	@$(MAKE) target-$@
+
+lint-gofumpt-client:  ## Runs gofumpt linter.
+	@$(MAKE) target-$@
+
+.PHONY: fmt
+fmt:  ## Formats the source code
+	@docker run --rm -it -v $(PWD):/src -w /src golang:$(GO_VERSION) \
+		bash -c "export GOTOOLCHAIN=local; \
+		export GO111MODULE=on; export GOPROXY=https://proxy.golang.org; \
+		go install mvdan.cc/gofumpt@$(GOFUMPT_VERSION) && \
+		gofumpt -w ."
+
+lint-govulncheck-client:  ## Runs govulncheck linter.
+	@$(MAKE) target-$@
+
+lint-goimports-client:  ## Runs goimports linter.
+	@$(MAKE) target-$@
+
+lint-golangci-lint:  ## Runs golangci-lint linter.
+	@$(MAKE) target-$@
+
+lint-gofumpt:  ## Runs gofumpt linter.
+	@$(MAKE) target-$@
+
+lint-govulncheck:  ## Runs govulncheck linter.
+	@$(MAKE) target-$@
+
+lint-goimports:  ## Runs goimports linter.
+	@$(MAKE) target-$@
+
+.PHONY: base
+base: frontend  ## Prepare base toolchain
+	@$(MAKE) target-$@
+
+.PHONY: unit-tests-client
+unit-tests-client:  ## Performs unit tests
+	@$(MAKE) local-$@ DEST=$(ARTIFACTS)
+
+.PHONY: unit-tests-client-race
+unit-tests-client-race:  ## Performs unit tests with race detection enabled.
+	@$(MAKE) target-$@
+
+.PHONY: unit-tests
+unit-tests:  ## Performs unit tests
+	@$(MAKE) local-$@ DEST=$(ARTIFACTS)
+
+.PHONY: unit-tests-race
+unit-tests-race:  ## Performs unit tests with race detection enabled.
+	@$(MAKE) target-$@
+
+.PHONY: $(ARTIFACTS)/omni-darwin-amd64
+$(ARTIFACTS)/omni-darwin-amd64:
+	@$(MAKE) local-omni-darwin-amd64 DEST=$(ARTIFACTS)
+
+.PHONY: omni-darwin-amd64
+omni-darwin-amd64: $(ARTIFACTS)/omni-darwin-amd64  ## Builds executable for omni-darwin-amd64.
+
+.PHONY: $(ARTIFACTS)/omni-darwin-arm64
+$(ARTIFACTS)/omni-darwin-arm64:
+	@$(MAKE) local-omni-darwin-arm64 DEST=$(ARTIFACTS)
+
+.PHONY: omni-darwin-arm64
+omni-darwin-arm64: $(ARTIFACTS)/omni-darwin-arm64  ## Builds executable for omni-darwin-arm64.
+
+.PHONY: $(ARTIFACTS)/omni-linux-amd64
+$(ARTIFACTS)/omni-linux-amd64:
+	@$(MAKE) local-omni-linux-amd64 DEST=$(ARTIFACTS)
+
+.PHONY: omni-linux-amd64
+omni-linux-amd64: $(ARTIFACTS)/omni-linux-amd64  ## Builds executable for omni-linux-amd64.
+
+.PHONY: $(ARTIFACTS)/omni-linux-arm64
+$(ARTIFACTS)/omni-linux-arm64:
+	@$(MAKE) local-omni-linux-arm64 DEST=$(ARTIFACTS)
+
+.PHONY: omni-linux-arm64
+omni-linux-arm64: $(ARTIFACTS)/omni-linux-arm64  ## Builds executable for omni-linux-arm64.
+
+.PHONY: omni
+omni: omni-darwin-amd64 omni-darwin-arm64 omni-linux-amd64 omni-linux-arm64  ## Builds executables for omni.
+
+.PHONY: lint-markdown
+lint-markdown:  ## Runs markdownlint.
+	@$(MAKE) target-$@
+
+.PHONY: lint
+lint: lint-golangci-lint-client lint-gofumpt-client lint-govulncheck-client lint-goimports-client lint-golangci-lint lint-gofumpt lint-govulncheck lint-goimports lint-markdown  ## Run all linters for the project.
+
+.PHONY: image-omni
+image-omni:  ## Builds image for omni.
+	@$(MAKE) target-$@ TARGET_ARGS="--tag=$(REGISTRY)/$(USERNAME)/omni:$(TAG)"
+
+.PHONY: $(ARTIFACTS)/omni-integration-test-linux-amd64
+$(ARTIFACTS)/omni-integration-test-linux-amd64:
+	@$(MAKE) local-omni-integration-test-linux-amd64 DEST=$(ARTIFACTS)
+
+.PHONY: omni-integration-test-linux-amd64
+omni-integration-test-linux-amd64: $(ARTIFACTS)/omni-integration-test-linux-amd64  ## Builds executable for omni-integration-test-linux-amd64.
+
+.PHONY: omni-integration-test
+omni-integration-test: omni-integration-test-linux-amd64  ## Builds executables for omni-integration-test.
+
+.PHONY: $(ARTIFACTS)/omnictl-darwin-amd64
+$(ARTIFACTS)/omnictl-darwin-amd64:
+	@$(MAKE) local-omnictl-darwin-amd64 DEST=$(ARTIFACTS)
+
+.PHONY: omnictl-darwin-amd64
+omnictl-darwin-amd64: $(ARTIFACTS)/omnictl-darwin-amd64  ## Builds executable for omnictl-darwin-amd64.
+
+.PHONY: $(ARTIFACTS)/omnictl-darwin-arm64
+$(ARTIFACTS)/omnictl-darwin-arm64:
+	@$(MAKE) local-omnictl-darwin-arm64 DEST=$(ARTIFACTS)
+
+.PHONY: omnictl-darwin-arm64
+omnictl-darwin-arm64: $(ARTIFACTS)/omnictl-darwin-arm64  ## Builds executable for omnictl-darwin-arm64.
+
+.PHONY: $(ARTIFACTS)/omnictl-linux-amd64
+$(ARTIFACTS)/omnictl-linux-amd64:
+	@$(MAKE) local-omnictl-linux-amd64 DEST=$(ARTIFACTS)
+
+.PHONY: omnictl-linux-amd64
+omnictl-linux-amd64: $(ARTIFACTS)/omnictl-linux-amd64  ## Builds executable for omnictl-linux-amd64.
+
+.PHONY: $(ARTIFACTS)/omnictl-linux-arm64
+$(ARTIFACTS)/omnictl-linux-arm64:
+	@$(MAKE) local-omnictl-linux-arm64 DEST=$(ARTIFACTS)
+
+.PHONY: omnictl-linux-arm64
+omnictl-linux-arm64: $(ARTIFACTS)/omnictl-linux-arm64  ## Builds executable for omnictl-linux-arm64.
+
+.PHONY: $(ARTIFACTS)/omnictl-windows-amd64.exe
+$(ARTIFACTS)/omnictl-windows-amd64.exe:
+	@$(MAKE) local-omnictl-windows-amd64.exe DEST=$(ARTIFACTS)
+
+.PHONY: omnictl-windows-amd64.exe
+omnictl-windows-amd64.exe: $(ARTIFACTS)/omnictl-windows-amd64.exe  ## Builds executable for omnictl-windows-amd64.exe.
+
+.PHONY: omnictl
+omnictl: omnictl-darwin-amd64 omnictl-darwin-arm64 omnictl-linux-amd64 omnictl-linux-arm64 omnictl-windows-amd64.exe  ## Builds executables for omnictl.
+
+.PHONY: dev-server
+dev-server:
+	hack/dev-server.sh
+
+.PHONY: docker-compose-up
+docker-compose-up:
+	ARTIFACTS="$(ARTIFACTS)" SHA="$(SHA)" TAG="$(TAG)" USERNAME="$(USERNAME)" REGISTRY="$(REGISTRY)" JS_TOOLCHAIN="$(JS_TOOLCHAIN)" PROTOBUF_TS_VERSION="$(PROTOBUF_TS_VERSION)" PROTOBUF_GRPC_GATEWAY_TS_VERSION="$(PROTOBUF_GRPC_GATEWAY_TS_VERSION)" NODE_BUILD_ARGS="$(NODE_BUILD_ARGS)" TOOLCHAIN="$(TOOLCHAIN)" CGO_ENABLED="$(CGO_ENABLED)" GO_BUILDFLAGS="$(GO_BUILDFLAGS)" GOLANGCILINT_VERSION="$(GOLANGCILINT_VERSION)" GOFUMPT_VERSION="$(GOFUMPT_VERSION)" GOIMPORTS_VERSION="$(GOIMPORTS_VERSION)" PROTOBUF_GO_VERSION="$(PROTOBUF_GO_VERSION)" GRPC_GO_VERSION="$(GRPC_GO_VERSION)" GRPC_GATEWAY_VERSION="$(GRPC_GATEWAY_VERSION)" VTPROTOBUF_VERSION="$(VTPROTOBUF_VERSION)" DEEPCOPY_VERSION="$(DEEPCOPY_VERSION)" TESTPKGS="$(TESTPKGS)" COMPOSE_DOCKER_CLI_BUILD=1 DOCKER_BUILDKIT=1 GO_LDFLAGS="$(GO_LDFLAGS)" docker compose --file ./hack/compose/docker-compose.yml --file ./hack/compose/docker-compose.override.yml up --build
+
+.PHONY: docker-compose-down
+docker-compose-down:
+	ARTIFACTS="$(ARTIFACTS)" SHA="$(SHA)" TAG="$(TAG)" USERNAME="$(USERNAME)" REGISTRY="$(REGISTRY)" JS_TOOLCHAIN="$(JS_TOOLCHAIN)" PROTOBUF_TS_VERSION="$(PROTOBUF_TS_VERSION)" PROTOBUF_GRPC_GATEWAY_TS_VERSION="$(PROTOBUF_GRPC_GATEWAY_TS_VERSION)" NODE_BUILD_ARGS="$(NODE_BUILD_ARGS)" TOOLCHAIN="$(TOOLCHAIN)" CGO_ENABLED="$(CGO_ENABLED)" GO_BUILDFLAGS="$(GO_BUILDFLAGS)" GOLANGCILINT_VERSION="$(GOLANGCILINT_VERSION)" GOFUMPT_VERSION="$(GOFUMPT_VERSION)" GOIMPORTS_VERSION="$(GOIMPORTS_VERSION)" PROTOBUF_GO_VERSION="$(PROTOBUF_GO_VERSION)" GRPC_GO_VERSION="$(GRPC_GO_VERSION)" GRPC_GATEWAY_VERSION="$(GRPC_GATEWAY_VERSION)" VTPROTOBUF_VERSION="$(VTPROTOBUF_VERSION)" DEEPCOPY_VERSION="$(DEEPCOPY_VERSION)" TESTPKGS="$(TESTPKGS)" COMPOSE_DOCKER_CLI_BUILD=1 DOCKER_BUILDKIT=1 GO_LDFLAGS="$(GO_LDFLAGS)" docker compose --file ./hack/compose/docker-compose.yml --file ./hack/compose/docker-compose.override.yml down --rmi local --remove-orphans --volumes=$(REMOVE_VOLUMES)
+
+.PHONY: mkcert-install
+mkcert-install:
+	go run ./hack/generate-certs install
+
+.PHONY: mkcert-generate
+mkcert-generate:
+	go run ./hack/generate-certs -config ./hack/generate-certs.yml generate
+
+.PHONY: mkcert-uninstall
+mkcert-uninstall:
+	go run ./hack/generate-certs uninstall
+
+run-integration-test: omni-integration-test-linux-amd64 omnictl-linux-amd64 omni-linux-amd64
+	@hack/test/integration.sh
+
+.PHONY: rekres
+rekres:
+	@docker pull $(KRES_IMAGE)
+	@docker run --rm --net=host --user $(shell id -u):$(shell id -g) -v $(PWD):/src -w /src -e GITHUB_TOKEN $(KRES_IMAGE)
+
+.PHONY: help
+help:  ## This help menu.
+	@echo "$$HELP_MENU_HEADER"
+	@grep -E '^[a-zA-Z%_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
+
+.PHONY: release-notes
+release-notes:
+	mkdir -p $(ARTIFACTS)
+	@ARTIFACTS=$(ARTIFACTS) ./hack/release.sh $@ $(ARTIFACTS)/RELEASE_NOTES.md $(TAG)
+
+.PHONY: conformance
+conformance:
+	@docker pull $(CONFORMANCE_IMAGE)
+	@docker run --rm -it -v $(PWD):/src -w /src $(CONFORMANCE_IMAGE) enforce
+
diff --git a/README.md b/README.md
new file mode 100644
index 000000000..aaa3eff6a
--- /dev/null
+++ b/README.md
@@ -0,0 +1,70 @@
+<!-- markdownlint-disable first-line-heading sentences-per-line -->
+
+<p align="center">
+  <h1 align="center">Omni</h1>
+  <p align="center">SaaS-simple deployment of Kubernetes - on your own hardware.</p>
+  <p align="center">
+    <a href="https://github.com/siderolabs/omni/releases/latest">
+      <img alt="Release" src="https://img.shields.io/github/release/siderolabs/omni.svg?logo=github&logoColor=white&style=flat-square">
+    </a>
+    <a href="https://github.com/siderolabs/omni/releases/latest">
+      <img alt="Pre-release" src="https://img.shields.io/github/release-pre/siderolabs/omni.svg?label=pre-release&logo=GitHub&logoColor=white&style=flat-square">
+    </a>
+  </p>
+</p>
+
+---
+
+Kubernetes is wonderful, but requires scarce time and expertise to set up and manage.
+Other solutions demand you have already set up Linux correctly, have all your servers in the same network, and meet their other criteria.
+And hybrid clusters that span cloud and data center?
+Good luck with that!
+
+Omni allows you to start with bare metal, virtual machines or a cloud provider, and create clusters spanning all of your locations, with a few clicks.
+
+You provide the machines – edge compute, bare metal, VMs, or in your cloud account. Boot from an Omni image. Click to allocate to a cluster. That’s it!
+
+- Vanilla Kubernetes, on your machines, under your control.
+- Elegant UI for management and operations
+- Security taken care of – ties into your Enterprise ID provider
+- Highly Available Kubernetes API endpoint built in
+- Firewall friendly. Manage Edge nodes securely
+- From single-node clusters to the largest scale
+- Support for GPUs and most CSIs.
+
+## Development
+
+For instructions on developing Omni, see [DEVELOPMENT.md](DEVELOPMENT.md).
+
+## Community
+
+- Support: Questions, bugs, feature requests [GitHub Issues](https://github.com/siderolabs/omni/issues)
+- Slack: Join our [slack channel](https://slack.dev.talos-systems.io)
+- Twitter: [@SideroLabs](https://twitter.com/SideroLabs)
+- Email: [info@SideroLabs.com](mailto:info@SideroLabs.com)
+
+If you're interested in this project and would like to help in engineering efforts or have general usage questions, we are happy to have you!
+We hold a weekly meeting that all audiences are welcome to attend.
+
+### Office Hours
+
+- When: Mondays at 16:30 UTC.
+- Where: [Google Meet](https://meet.google.com/day-pxhv-zky).
+
+You can subscribe to this meeting by joining the community forum above.
+
+> Note: You can convert the meeting hours to your [local time](https://everytimezone.com/s/599e61d6).
+
+## Contributing
+
+Contributions are welcomed and appreciated!
+See [Contributing](CONTRIBUTING.md) for our guidelines.
+
+## Licenses
+
+The Omni code is released under a combination of two licenses:
+
+- The main Omni Server code is licensed under [Business Source License 1.1 (BSL-1.1)](LICENSE).
+- The [Omni client library](client) is licensed under [Mozilla Public License 2.0 (MPL-2.0)](client/LICENSE).
+
+When contributing to an Omni feature, you can find the relevant license in the comments at the top of each file.
diff --git a/client/.golangci.yml b/client/.golangci.yml
new file mode 100644
index 000000000..894c4c4dd
--- /dev/null
+++ b/client/.golangci.yml
@@ -0,0 +1,178 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2024-02-09T09:47:03Z by kres decf506.
+
+# options for analysis running
+run:
+  timeout: 10m
+  issues-exit-code: 1
+  tests: true
+  build-tags: []
+  skip-dirs: []
+  skip-dirs-use-default: true
+  skip-files: []
+  modules-download-mode: readonly
+
+# output configuration options
+output:
+  format: colored-line-number
+  print-issued-lines: true
+  print-linter-name: true
+  uniq-by-line: true
+  path-prefix: ""
+
+# all available settings of specific linters
+linters-settings:
+  dogsled:
+    max-blank-identifiers: 2
+  dupl:
+    threshold: 150
+  errcheck:
+    check-type-assertions: true
+    check-blank: true
+  exhaustive:
+    default-signifies-exhaustive: false
+  funlen:
+    lines: 60
+    statements: 40
+  gci:
+    local-prefixes: github.com/siderolabs/omni/client/
+  gocognit:
+    min-complexity: 30
+  ireturn:
+    allow:
+      - anon
+      - error
+      - empty
+      - stdlib
+      - github.com\/talos-systems\/kres\/internal\/dag.Node
+  nestif:
+    min-complexity: 5
+  goconst:
+    min-len: 3
+    min-occurrences: 3
+  gocritic:
+    disabled-checks: []
+  gocyclo:
+    min-complexity: 20
+  godot:
+    check-all: false
+  godox:
+    keywords: # default keywords are TODO, BUG, and FIXME, these can be overwritten by this setting
+      - NOTE
+      - OPTIMIZE # marks code that should be optimized before merging
+      - HACK # marks hack-arounds that should be removed before merging
+  gofmt:
+    simplify: true
+  goimports:
+    local-prefixes: github.com/siderolabs/omni/client/
+  golint:
+    min-confidence: 0.8
+  gomnd:
+    settings: {}
+  gomodguard: {}
+  govet:
+    check-shadowing: true
+    enable-all: true
+  lll:
+    line-length: 200
+    tab-width: 4
+  misspell:
+    locale: US
+    ignore-words: []
+  nakedret:
+    max-func-lines: 30
+  prealloc:
+    simple: true
+    range-loops: true # Report preallocation suggestions on range loops, true by default
+    for-loops: false # Report preallocation suggestions on for loops, false by default
+  nolintlint:
+    allow-unused: false
+    allow-leading-space: false
+    allow-no-explanation: []
+    require-explanation: false
+    require-specific: true
+  rowserrcheck: {}
+  testpackage: {}
+  unparam:
+    check-exported: false
+  unused:
+    check-exported: false
+  whitespace:
+    multi-if: false   # Enforces newlines (or comments) after every multi-line if statement
+    multi-func: false # Enforces newlines (or comments) after every multi-line function signature
+  wsl:
+    strict-append: true
+    allow-assign-and-call: true
+    allow-multiline-assign: true
+    allow-cuddle-declarations: false
+    allow-trailing-comment: false
+    force-case-trailing-whitespace: 0
+    force-err-cuddling: false
+    allow-separated-leading-comment: false
+  gofumpt:
+    extra-rules: false
+  cyclop:
+      # the maximal code complexity to report
+      max-complexity: 20
+  #  depguard:
+  #    Main:
+  #      deny:
+  #        - github.com/OpenPeeDeeP/depguard # this is just an example
+
+linters:
+  enable-all: true
+  disable-all: false
+  fast: false
+  disable:
+    - exhaustruct
+    - exhaustivestruct
+    - forbidigo
+    - funlen
+    - gas
+    - gochecknoglobals
+    - gochecknoinits
+    - godox
+    - goerr113
+    - gomnd
+    - gomoddirectives
+    - ireturn
+    - nestif
+    - nonamedreturns
+    - nosnakecase
+    - paralleltest
+    - tagliatelle
+    - thelper
+    - typecheck
+    - varnamelen
+    - wrapcheck
+    - depguard # Disabled because starting with golangci-lint 1.53.0 it doesn't allow denylist alone anymore
+    - tagalign
+    - inamedparam
+    - testifylint # complains about our assert recorder and has a number of false positives for assert.Greater(t, thing, 1)
+    - protogetter # complains about us using Value field on typed spec, instead of GetValue which has a different signature
+    - perfsprint # complains about us using fmt.Sprintf in non-performance critical code, updating just kres took too long
+    # abandoned linters for which golangci shows the warning that the repo is archived by the owner
+    - interfacer
+    - maligned
+    - golint
+    - scopelint
+    - varcheck
+    - deadcode
+    - structcheck
+    - ifshort
+    # disabled as it seems to be broken - goes into imported libraries and reports issues there
+    - musttag
+
+issues:
+  exclude: []
+  exclude-rules: []
+  exclude-use-default: false
+  exclude-case-sensitive: false
+  max-issues-per-linter: 10
+  max-same-issues: 3
+  new: false
+
+severity:
+  default-severity: error
+  case-sensitive: false
diff --git a/client/.license-header.go.txt b/client/.license-header.go.txt
new file mode 100644
index 000000000..66e081996
--- /dev/null
+++ b/client/.license-header.go.txt
@@ -0,0 +1,3 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
diff --git a/client/CONTRIBUTING.md b/client/CONTRIBUTING.md
new file mode 100644
index 000000000..cbfa41b6f
--- /dev/null
+++ b/client/CONTRIBUTING.md
@@ -0,0 +1,6 @@
+# Contributing
+
+## Developer Certificate of Origin
+
+All commits require a [DCO](https://developercertificate.org/) sign-off.
+This is done by committing with the `--signoff` flag.
\ No newline at end of file
diff --git a/client/LICENSE b/client/LICENSE
new file mode 100644
index 000000000..a612ad981
--- /dev/null
+++ b/client/LICENSE
@@ -0,0 +1,373 @@
+Mozilla Public License Version 2.0
+==================================
+
+1. Definitions
+--------------
+
+1.1. "Contributor"
+    means each individual or legal entity that creates, contributes to
+    the creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+    means the combination of the Contributions of others (if any) used
+    by a Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+    means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+    means Source Code Form to which the initial Contributor has attached
+    the notice in Exhibit A, the Executable Form of such Source Code
+    Form, and Modifications of such Source Code Form, in each case
+    including portions thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+    means
+
+    (a) that the initial Contributor has attached the notice described
+        in Exhibit B to the Covered Software; or
+
+    (b) that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the
+        terms of a Secondary License.
+
+1.6. "Executable Form"
+    means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+    means a work that combines Covered Software with other material, in
+    a separate file or files, that is not Covered Software.
+
+1.8. "License"
+    means this document.
+
+1.9. "Licensable"
+    means having the right to grant, to the maximum extent possible,
+    whether at the time of the initial grant or subsequently, any and
+    all of the rights conveyed by this License.
+
+1.10. "Modifications"
+    means any of the following:
+
+    (a) any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered
+        Software; or
+
+    (b) any new file in Source Code Form that contains any Covered
+        Software.
+
+1.11. "Patent Claims" of a Contributor
+    means any patent claim(s), including without limitation, method,
+    process, and apparatus claims, in any patent Licensable by such
+    Contributor that would be infringed, but for the grant of the
+    License, by the making, using, selling, offering for sale, having
+    made, import, or transfer of either its Contributions or its
+    Contributor Version.
+
+1.12. "Secondary License"
+    means either the GNU General Public License, Version 2.0, the GNU
+    Lesser General Public License, Version 2.1, the GNU Affero General
+    Public License, Version 3.0, or any later versions of those
+    licenses.
+
+1.13. "Source Code Form"
+    means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+    means an individual or a legal entity exercising rights under this
+    License. For legal entities, "You" includes any entity that
+    controls, is controlled by, or is under common control with You. For
+    purposes of this definition, "control" means (a) the power, direct
+    or indirect, to cause the direction or management of such entity,
+    whether by contract or otherwise, or (b) ownership of more than
+    fifty percent (50%) of the outstanding shares or beneficial
+    ownership of such entity.
+
+2. License Grants and Conditions
+--------------------------------
+
+2.1. Grants
+
+Each Contributor hereby grants You a world-wide, royalty-free,
+non-exclusive license:
+
+(a) under intellectual property rights (other than patent or trademark)
+    Licensable by such Contributor to use, reproduce, make available,
+    modify, display, perform, distribute, and otherwise exploit its
+    Contributions, either on an unmodified basis, with Modifications, or
+    as part of a Larger Work; and
+
+(b) under Patent Claims of such Contributor to make, use, sell, offer
+    for sale, have made, import, and otherwise transfer either its
+    Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+The licenses granted in Section 2.1 with respect to any Contribution
+become effective for each Contribution on the date the Contributor first
+distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
+
+(a) for any code that a Contributor has removed from Covered Software;
+    or
+
+(b) for infringements caused by: (i) Your and any other third party's
+    modifications of Covered Software, or (ii) the combination of its
+    Contributions with other software (except as part of its Contributor
+    Version); or
+
+(c) under Patent Claims infringed by Covered Software in the absence of
+    its Contributions.
+
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+No Contributor makes additional grants as a result of Your choice to
+distribute the Covered Software under a subsequent version of this
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+Each Contributor represents that the Contributor believes its
+Contributions are its original creation(s) or it has sufficient rights
+to grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+This License is not intended to limit any rights You have under
+applicable copyright doctrines of fair use, fair dealing, or other
+equivalents.
+
+2.7. Conditions
+
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
+
+3. Responsibilities
+-------------------
+
+3.1. Distribution of Source Form
+
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under
+the terms of this License. You must inform recipients that the Source
+Code Form of the Covered Software is governed by the terms of this
+License, and how they can obtain a copy of this License. You may not
+attempt to alter or restrict the recipients' rights in the Source Code
+Form.
+
+3.2. Distribution of Executable Form
+
+If You distribute Covered Software in Executable Form then:
+
+(a) such Covered Software must also be made available in Source Code
+    Form, as described in Section 3.1, and You must inform recipients of
+    the Executable Form how they can obtain a copy of such Source Code
+    Form by reasonable means in a timely manner, at a charge no more
+    than the cost of distribution to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this
+    License, or sublicense it under different terms, provided that the
+    license for the Executable Form does not attempt to limit or alter
+    the recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for
+the Covered Software. If the Larger Work is a combination of Covered
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
+License permits You to additionally distribute such Covered Software
+under the terms of such Secondary License(s), so that the recipient of
+the Larger Work may, at their option, further distribute the Covered
+Software under the terms of either this License or such Secondary
+License(s).
+
+3.4. Notices
+
+You may not remove or alter the substance of any license notices
+(including copyright notices, patent notices, disclaimers of warranty,
+or limitations of liability) contained within the Source Code Form of
+the Covered Software, except that You may alter any license notices to
+the extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+You may choose to offer, and to charge a fee for, warranty, support,
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+---------------------------------------------------
+
+If it is impossible for You to comply with any of the terms of this
+License with respect to some or all of the Covered Software due to
+statute, judicial order, or regulation then You must: (a) comply with
+the terms of this License to the maximum extent possible; and (b)
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+--------------
+
+5.1. The rights granted under this License will terminate automatically
+if You fail to comply with any of its terms. However, if You become
+compliant, then the rights granted under this License from a particular
+Contributor are reinstated (a) provisionally, unless and until such
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
+non-compliance by some reasonable means prior to 60 days after You have
+come back into compliance. Moreover, Your grants from a particular
+Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
+
+************************************************************************
+*                                                                      *
+*  6. Disclaimer of Warranty                                           *
+*  -------------------------                                           *
+*                                                                      *
+*  Covered Software is provided under this License on an "as is"       *
+*  basis, without warranty of any kind, either expressed, implied, or  *
+*  statutory, including, without limitation, warranties that the       *
+*  Covered Software is free of defects, merchantable, fit for a        *
+*  particular purpose or non-infringing. The entire risk as to the     *
+*  quality and performance of the Covered Software is with You.        *
+*  Should any Covered Software prove defective in any respect, You     *
+*  (not any Contributor) assume the cost of any necessary servicing,   *
+*  repair, or correction. This disclaimer of warranty constitutes an   *
+*  essential part of this License. No use of any Covered Software is   *
+*  authorized under this License except under this disclaimer.         *
+*                                                                      *
+************************************************************************
+
+************************************************************************
+*                                                                      *
+*  7. Limitation of Liability                                          *
+*  --------------------------                                          *
+*                                                                      *
+*  Under no circumstances and under no legal theory, whether tort      *
+*  (including negligence), contract, or otherwise, shall any           *
+*  Contributor, or anyone who distributes Covered Software as          *
+*  permitted above, be liable to You for any direct, indirect,         *
+*  special, incidental, or consequential damages of any character      *
+*  including, without limitation, damages for lost profits, loss of    *
+*  goodwill, work stoppage, computer failure or malfunction, or any    *
+*  and all other commercial damages or losses, even if such party      *
+*  shall have been informed of the possibility of such damages. This   *
+*  limitation of liability shall not apply to liability for death or   *
+*  personal injury resulting from such party's negligence to the       *
+*  extent applicable law prohibits such limitation. Some               *
+*  jurisdictions do not allow the exclusion or limitation of           *
+*  incidental or consequential damages, so this exclusion and          *
+*  limitation may not apply to You.                                    *
+*                                                                      *
+************************************************************************
+
+8. Litigation
+-------------
+
+Any litigation relating to this License may be brought only in the
+courts of a jurisdiction where the defendant maintains its principal
+place of business and such litigation shall be governed by laws of that
+jurisdiction, without reference to its conflict-of-law provisions.
+Nothing in this Section shall prevent a party's ability to bring
+cross-claims or counter-claims.
+
+9. Miscellaneous
+----------------
+
+This License represents the complete agreement concerning the subject
+matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable. Any law or regulation which provides
+that the language of a contract shall be construed against the drafter
+shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+---------------------------
+
+10.1. New Versions
+
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
+
+10.2. Effect of New Versions
+
+You may distribute the Covered Software under the terms of the version
+of the License under which You originally received the Covered Software,
+or under the terms of any subsequent version published by the license
+steward.
+
+10.3. Modified Versions
+
+If you create software not governed by this License, and you want to
+create a new license for such software, you may create and use a
+modified version of this License if you rename the license and remove
+any references to the name of the license steward (except to note that
+such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses
+
+If You choose to distribute Source Code Form that is Incompatible With
+Secondary Licenses under the terms of this version of the License, the
+notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+-------------------------------------------
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+---------------------------------------------------------
+
+  This Source Code Form is "Incompatible With Secondary Licenses", as
+  defined by the Mozilla Public License, v. 2.0.
diff --git a/client/README.md b/client/README.md
new file mode 100644
index 000000000..cca71f6f8
--- /dev/null
+++ b/client/README.md
@@ -0,0 +1,41 @@
+<!-- markdownlint-disable MD041 -->
+
+<p align="center">
+  <h1 align="center">Omni API</h1>
+  <p align="center">Omni client code and gRPC API libraries.</p>
+</p>
+
+---
+
+[**Omni**](https://www.siderolabs.com/platform/saas-for-kubernetes/) SaaS deployment of Kubernetes.
+Omni is supported by the people at [Sidero Labs](https://www.SideroLabs.com/).
+This respository contains client code and gRPC API definitions used to access Omni SaaS.
+
+## Documentation
+
+For instructions on using Omni, see the [Documentation](https://omni.siderolabs.com/docs/).
+
+## Community
+
+- Slack: Join our [slack channel](https://slack.dev.talos-systems.io)
+- Support: Questions, bugs, feature requests [GitHub Discussions](https://github.com/talos-systems/talos/discussions)
+- Forum: [community](https://groups.google.com/a/SideroLabs.com/forum/#!forum/community)
+- Twitter: [@SideroLabs](https://twitter.com/SideroLabs)
+- Email: [info@SideroLabs.com](mailto:info@SideroLabs.com)
+
+## Contributing
+
+Contributions are welcomed and appreciated!
+See [Contributing](CONTRIBUTING.md) for our guidelines.
+
+## License
+
+<a href="https://github.com/siderolabs/omni/client/blob/main/LICENSE">
+  <img alt="GitHub" src="https://img.shields.io/github/license/siderolabs/omni/client?style=flat-square">
+</a>
+
+Some software we distribute is under the General Public License family
+of licenses or other licenses that require we provide you with the
+source code.
+If you would like a copy of the source code for this
+software, please contact us via email: info at SideroLabs.com.
diff --git a/client/api/common/common.proto b/client/api/common/common.proto
new file mode 100644
index 000000000..97bb7fbb7
--- /dev/null
+++ b/client/api/common/common.proto
@@ -0,0 +1,116 @@
+syntax = "proto3";
+
+package common;
+
+option go_package = "github.com/siderolabs/talos/pkg/machinery/api/common";
+
+import "google/protobuf/any.proto";
+import "google/protobuf/descriptor.proto";
+import "google/rpc/status.proto";
+
+// An alternative to using options could be extracting versions from comments.
+// Unfortunately, they are not available: https://github.com/golang/protobuf/issues/1134
+// Also, while option numbers can be the same,
+// names should be different: https://github.com/protocolbuffers/protobuf/issues/4861
+
+extend google.protobuf.MessageOptions {
+  // Indicates the Talos version when this deprecated message will be removed from API.
+  string remove_deprecated_message = 93117;
+}
+
+extend google.protobuf.FieldOptions {
+  // Indicates the Talos version when this deprecated filed will be removed from API.
+  string remove_deprecated_field = 93117;
+}
+
+extend google.protobuf.EnumOptions {
+  // Indicates the Talos version when this deprecated enum will be removed from API.
+  string remove_deprecated_enum = 93117;
+}
+
+extend google.protobuf.EnumValueOptions {
+  // Indicates the Talos version when this deprecated enum value will be removed from API.
+  string remove_deprecated_enum_value = 93117;
+}
+
+extend google.protobuf.MethodOptions {
+  // Indicates the Talos version when this deprecated method will be removed from API.
+  string remove_deprecated_method = 93117;
+}
+
+extend google.protobuf.ServiceOptions {
+  // Indicates the Talos version when this deprecated service will be removed from API.
+  string remove_deprecated_service = 93117;
+}
+
+enum Code {
+  FATAL = 0;
+  LOCKED = 1;
+  CANCELED = 2;
+}
+
+message Error {
+  Code code = 1;
+  string message = 2;
+  repeated google.protobuf.Any details = 3;
+}
+
+// Common metadata message nested in all reply message types
+message Metadata {
+  // hostname of the server response comes from (injected by proxy)
+  string hostname = 1;
+  // error is set if request failed to the upstream (rest of response is
+  // undefined)
+  string error = 2;
+  // error as gRPC Status
+  google.rpc.Status status = 3;
+}
+
+message Data {
+  Metadata metadata = 1;
+  bytes bytes = 2;
+}
+
+message DataResponse {
+  repeated Data messages = 1;
+}
+
+message Empty {
+  Metadata metadata = 1;
+}
+
+message EmptyResponse {
+  repeated Empty messages = 1;
+}
+
+enum ContainerDriver {
+  CONTAINERD = 0;
+  CRI = 1;
+}
+
+message URL {
+  string full_path = 1;
+}
+
+message PEMEncodedCertificateAndKey {
+  bytes crt = 1;
+  bytes key = 2;
+}
+
+message PEMEncodedKey {
+  bytes key = 1;
+}
+
+message NetIP {
+  bytes ip = 1;
+}
+
+message NetIPPort {
+  bytes ip = 1;
+  int32 port = 2;
+}
+
+message NetIPPrefix {
+  bytes ip = 1;
+  int32 prefix_length = 2;
+}
diff --git a/client/api/common/omni.pb.go b/client/api/common/omni.pb.go
new file mode 100644
index 000000000..1c770c9c1
--- /dev/null
+++ b/client/api/common/omni.pb.go
@@ -0,0 +1,206 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.32.0
+// 	protoc        v4.24.4
+// source: common/omni.proto
+
+package common
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Data source.
+type Runtime int32
+
+const (
+	// Kubernetes control plane.
+	Runtime_Kubernetes Runtime = 0
+	// Talos apid.
+	Runtime_Talos Runtime = 1
+	// Omni internal runtime.
+	Runtime_Omni Runtime = 2
+)
+
+// Enum value maps for Runtime.
+var (
+	Runtime_name = map[int32]string{
+		0: "Kubernetes",
+		1: "Talos",
+		2: "Omni",
+	}
+	Runtime_value = map[string]int32{
+		"Kubernetes": 0,
+		"Talos":      1,
+		"Omni":       2,
+	}
+)
+
+func (x Runtime) Enum() *Runtime {
+	p := new(Runtime)
+	*p = x
+	return p
+}
+
+func (x Runtime) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Runtime) Descriptor() protoreflect.EnumDescriptor {
+	return file_common_omni_proto_enumTypes[0].Descriptor()
+}
+
+func (Runtime) Type() protoreflect.EnumType {
+	return &file_common_omni_proto_enumTypes[0]
+}
+
+func (x Runtime) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Runtime.Descriptor instead.
+func (Runtime) EnumDescriptor() ([]byte, []int) {
+	return file_common_omni_proto_rawDescGZIP(), []int{0}
+}
+
+// Context represents Kubernetes or Talos config source.
+type Context struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Name fetches the config from the top level Kubeconfig or Talosconfig.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+}
+
+func (x *Context) Reset() {
+	*x = Context{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_common_omni_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Context) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Context) ProtoMessage() {}
+
+func (x *Context) ProtoReflect() protoreflect.Message {
+	mi := &file_common_omni_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Context.ProtoReflect.Descriptor instead.
+func (*Context) Descriptor() ([]byte, []int) {
+	return file_common_omni_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Context) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+var File_common_omni_proto protoreflect.FileDescriptor
+
+var file_common_omni_proto_rawDesc = []byte{
+	0x0a, 0x11, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x06, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x22, 0x29, 0x0a, 0x07, 0x43,
+	0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03,
+	0x4a, 0x04, 0x08, 0x03, 0x10, 0x04, 0x2a, 0x2e, 0x0a, 0x07, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x12, 0x0e, 0x0a, 0x0a, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x10,
+	0x00, 0x12, 0x09, 0x0a, 0x05, 0x54, 0x61, 0x6c, 0x6f, 0x73, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04,
+	0x4f, 0x6d, 0x6e, 0x69, 0x10, 0x02, 0x42, 0x2e, 0x5a, 0x2c, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x64, 0x65, 0x72, 0x6f, 0x6c, 0x61, 0x62, 0x73, 0x2f,
+	0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f,
+	0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_common_omni_proto_rawDescOnce sync.Once
+	file_common_omni_proto_rawDescData = file_common_omni_proto_rawDesc
+)
+
+func file_common_omni_proto_rawDescGZIP() []byte {
+	file_common_omni_proto_rawDescOnce.Do(func() {
+		file_common_omni_proto_rawDescData = protoimpl.X.CompressGZIP(file_common_omni_proto_rawDescData)
+	})
+	return file_common_omni_proto_rawDescData
+}
+
+var file_common_omni_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_common_omni_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_common_omni_proto_goTypes = []interface{}{
+	(Runtime)(0),    // 0: common.Runtime
+	(*Context)(nil), // 1: common.Context
+}
+var file_common_omni_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_common_omni_proto_init() }
+func file_common_omni_proto_init() {
+	if File_common_omni_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_common_omni_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Context); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_common_omni_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_common_omni_proto_goTypes,
+		DependencyIndexes: file_common_omni_proto_depIdxs,
+		EnumInfos:         file_common_omni_proto_enumTypes,
+		MessageInfos:      file_common_omni_proto_msgTypes,
+	}.Build()
+	File_common_omni_proto = out.File
+	file_common_omni_proto_rawDesc = nil
+	file_common_omni_proto_goTypes = nil
+	file_common_omni_proto_depIdxs = nil
+}
diff --git a/client/api/common/omni.proto b/client/api/common/omni.proto
new file mode 100644
index 000000000..f70a74e8d
--- /dev/null
+++ b/client/api/common/omni.proto
@@ -0,0 +1,22 @@
+syntax = "proto3";
+
+package common;
+
+option go_package = "github.com/siderolabs/omni/client/api/common";
+
+// Data source.
+enum Runtime {
+  // Kubernetes control plane.
+  Kubernetes = 0;
+  // Talos apid.
+  Talos = 1;
+  // Omni internal runtime.
+  Omni = 2;
+}
+// Context represents Kubernetes or Talos config source.
+message Context {
+  reserved 2, 3;
+
+  // Name fetches the config from the top level Kubeconfig or Talosconfig.
+  string name = 1;
+}
diff --git a/client/api/common/omni_vtproto.pb.go b/client/api/common/omni_vtproto.pb.go
new file mode 100644
index 000000000..7ee6648fb
--- /dev/null
+++ b/client/api/common/omni_vtproto.pb.go
@@ -0,0 +1,195 @@
+// Code generated by protoc-gen-go-vtproto. DO NOT EDIT.
+// protoc-gen-go-vtproto version: v0.6.0
+// source: common/omni.proto
+
+package common
+
+import (
+	fmt "fmt"
+	io "io"
+
+	protohelpers "github.com/planetscale/vtprotobuf/protohelpers"
+	proto "google.golang.org/protobuf/proto"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+func (m *Context) CloneVT() *Context {
+	if m == nil {
+		return (*Context)(nil)
+	}
+	r := new(Context)
+	r.Name = m.Name
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *Context) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (this *Context) EqualVT(that *Context) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Name != that.Name {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *Context) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*Context)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (m *Context) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Context) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *Context) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Context) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *Context) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Context: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Context: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/client/api/google/rpc/status.proto b/client/api/google/rpc/status.proto
new file mode 100644
index 000000000..923e16938
--- /dev/null
+++ b/client/api/google/rpc/status.proto
@@ -0,0 +1,49 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.rpc;
+
+import "google/protobuf/any.proto";
+
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/genproto/googleapis/rpc/status;status";
+option java_multiple_files = true;
+option java_outer_classname = "StatusProto";
+option java_package = "com.google.rpc";
+option objc_class_prefix = "RPC";
+
+// The `Status` type defines a logical error model that is suitable for
+// different programming environments, including REST APIs and RPC APIs. It is
+// used by [gRPC](https://github.com/grpc). Each `Status` message contains
+// three pieces of data: error code, error message, and error details.
+//
+// You can find out more about this error model and how to work with it in the
+// [API Design Guide](https://cloud.google.com/apis/design/errors).
+message Status {
+  // The status code, which should be an enum value of
+  // [google.rpc.Code][google.rpc.Code].
+  int32 code = 1;
+
+  // A developer-facing error message, which should be in English. Any
+  // user-facing error message should be localized and sent in the
+  // [google.rpc.Status.details][google.rpc.Status.details] field, or localized
+  // by the client.
+  string message = 2;
+
+  // A list of messages that carry the error details.  There is a common set of
+  // message types for APIs to use.
+  repeated google.protobuf.Any details = 3;
+}
diff --git a/client/api/omni/management/management.pb.go b/client/api/omni/management/management.pb.go
new file mode 100644
index 000000000..ea708bfff
--- /dev/null
+++ b/client/api/omni/management/management.pb.go
@@ -0,0 +1,1825 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.32.0
+// 	protoc        v4.24.4
+// source: omni/management/management.proto
+
+package management
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	common "github.com/siderolabs/talos/pkg/machinery/api/common"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type KubernetesSyncManifestResponse_ResponseType int32
+
+const (
+	KubernetesSyncManifestResponse_UNKNOWN  KubernetesSyncManifestResponse_ResponseType = 0
+	KubernetesSyncManifestResponse_MANIFEST KubernetesSyncManifestResponse_ResponseType = 1
+	KubernetesSyncManifestResponse_ROLLOUT  KubernetesSyncManifestResponse_ResponseType = 2
+)
+
+// Enum value maps for KubernetesSyncManifestResponse_ResponseType.
+var (
+	KubernetesSyncManifestResponse_ResponseType_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "MANIFEST",
+		2: "ROLLOUT",
+	}
+	KubernetesSyncManifestResponse_ResponseType_value = map[string]int32{
+		"UNKNOWN":  0,
+		"MANIFEST": 1,
+		"ROLLOUT":  2,
+	}
+)
+
+func (x KubernetesSyncManifestResponse_ResponseType) Enum() *KubernetesSyncManifestResponse_ResponseType {
+	p := new(KubernetesSyncManifestResponse_ResponseType)
+	*p = x
+	return p
+}
+
+func (x KubernetesSyncManifestResponse_ResponseType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (KubernetesSyncManifestResponse_ResponseType) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_management_management_proto_enumTypes[0].Descriptor()
+}
+
+func (KubernetesSyncManifestResponse_ResponseType) Type() protoreflect.EnumType {
+	return &file_omni_management_management_proto_enumTypes[0]
+}
+
+func (x KubernetesSyncManifestResponse_ResponseType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use KubernetesSyncManifestResponse_ResponseType.Descriptor instead.
+func (KubernetesSyncManifestResponse_ResponseType) EnumDescriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{16, 0}
+}
+
+type KubeconfigResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Kubeconfig is the kubeconfig for the cluster.
+	Kubeconfig []byte `protobuf:"bytes,1,opt,name=kubeconfig,proto3" json:"kubeconfig,omitempty"`
+}
+
+func (x *KubeconfigResponse) Reset() {
+	*x = KubeconfigResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubeconfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubeconfigResponse) ProtoMessage() {}
+
+func (x *KubeconfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubeconfigResponse.ProtoReflect.Descriptor instead.
+func (*KubeconfigResponse) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *KubeconfigResponse) GetKubeconfig() []byte {
+	if x != nil {
+		return x.Kubeconfig
+	}
+	return nil
+}
+
+type TalosconfigResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// talosconfig is the talos client configuration to access the cluster via the proxy.
+	Talosconfig []byte `protobuf:"bytes,1,opt,name=talosconfig,proto3" json:"talosconfig,omitempty"`
+}
+
+func (x *TalosconfigResponse) Reset() {
+	*x = TalosconfigResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TalosconfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TalosconfigResponse) ProtoMessage() {}
+
+func (x *TalosconfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TalosconfigResponse.ProtoReflect.Descriptor instead.
+func (*TalosconfigResponse) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *TalosconfigResponse) GetTalosconfig() []byte {
+	if x != nil {
+		return x.Talosconfig
+	}
+	return nil
+}
+
+type OmniconfigResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// omniconfig is the omnictl client configuration to access the omni instance.
+	Omniconfig []byte `protobuf:"bytes,1,opt,name=omniconfig,proto3" json:"omniconfig,omitempty"`
+}
+
+func (x *OmniconfigResponse) Reset() {
+	*x = OmniconfigResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *OmniconfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OmniconfigResponse) ProtoMessage() {}
+
+func (x *OmniconfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OmniconfigResponse.ProtoReflect.Descriptor instead.
+func (*OmniconfigResponse) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *OmniconfigResponse) GetOmniconfig() []byte {
+	if x != nil {
+		return x.Omniconfig
+	}
+	return nil
+}
+
+type MachineLogsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// MachineId is the ID of the machine.
+	MachineId string `protobuf:"bytes,1,opt,name=machine_id,json=machineId,proto3" json:"machine_id,omitempty"`
+	// Follow is whether to follow the logs.
+	Follow bool `protobuf:"varint,2,opt,name=follow,proto3" json:"follow,omitempty"`
+	// TailLines is the number of lines to tail.
+	TailLines int32 `protobuf:"varint,3,opt,name=tail_lines,json=tailLines,proto3" json:"tail_lines,omitempty"`
+}
+
+func (x *MachineLogsRequest) Reset() {
+	*x = MachineLogsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineLogsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineLogsRequest) ProtoMessage() {}
+
+func (x *MachineLogsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineLogsRequest.ProtoReflect.Descriptor instead.
+func (*MachineLogsRequest) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *MachineLogsRequest) GetMachineId() string {
+	if x != nil {
+		return x.MachineId
+	}
+	return ""
+}
+
+func (x *MachineLogsRequest) GetFollow() bool {
+	if x != nil {
+		return x.Follow
+	}
+	return false
+}
+
+func (x *MachineLogsRequest) GetTailLines() int32 {
+	if x != nil {
+		return x.TailLines
+	}
+	return 0
+}
+
+type ValidateConfigRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Config represents raw configuration string to validate.
+	Config string `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+}
+
+func (x *ValidateConfigRequest) Reset() {
+	*x = ValidateConfigRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ValidateConfigRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ValidateConfigRequest) ProtoMessage() {}
+
+func (x *ValidateConfigRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ValidateConfigRequest.ProtoReflect.Descriptor instead.
+func (*ValidateConfigRequest) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ValidateConfigRequest) GetConfig() string {
+	if x != nil {
+		return x.Config
+	}
+	return ""
+}
+
+type TalosconfigRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Admin indicates whether to generate an admin talosconfig or a regular one.
+	Admin bool `protobuf:"varint,1,opt,name=admin,proto3" json:"admin,omitempty"`
+}
+
+func (x *TalosconfigRequest) Reset() {
+	*x = TalosconfigRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TalosconfigRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TalosconfigRequest) ProtoMessage() {}
+
+func (x *TalosconfigRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TalosconfigRequest.ProtoReflect.Descriptor instead.
+func (*TalosconfigRequest) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *TalosconfigRequest) GetAdmin() bool {
+	if x != nil {
+		return x.Admin
+	}
+	return false
+}
+
+type CreateServiceAccountRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ArmoredPgpPublicKey string `protobuf:"bytes,1,opt,name=armored_pgp_public_key,json=armoredPgpPublicKey,proto3" json:"armored_pgp_public_key,omitempty"`
+	// UseUserRole indicates whether to use the role of the creating user.
+	// When true, role will be ignored and the service account will be created with the role of the creating user.
+	UseUserRole bool   `protobuf:"varint,3,opt,name=use_user_role,json=useUserRole,proto3" json:"use_user_role,omitempty"`
+	Role        string `protobuf:"bytes,4,opt,name=role,proto3" json:"role,omitempty"`
+}
+
+func (x *CreateServiceAccountRequest) Reset() {
+	*x = CreateServiceAccountRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateServiceAccountRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateServiceAccountRequest) ProtoMessage() {}
+
+func (x *CreateServiceAccountRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateServiceAccountRequest.ProtoReflect.Descriptor instead.
+func (*CreateServiceAccountRequest) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *CreateServiceAccountRequest) GetArmoredPgpPublicKey() string {
+	if x != nil {
+		return x.ArmoredPgpPublicKey
+	}
+	return ""
+}
+
+func (x *CreateServiceAccountRequest) GetUseUserRole() bool {
+	if x != nil {
+		return x.UseUserRole
+	}
+	return false
+}
+
+func (x *CreateServiceAccountRequest) GetRole() string {
+	if x != nil {
+		return x.Role
+	}
+	return ""
+}
+
+type CreateServiceAccountResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	PublicKeyId string `protobuf:"bytes,1,opt,name=public_key_id,json=publicKeyId,proto3" json:"public_key_id,omitempty"`
+}
+
+func (x *CreateServiceAccountResponse) Reset() {
+	*x = CreateServiceAccountResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateServiceAccountResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateServiceAccountResponse) ProtoMessage() {}
+
+func (x *CreateServiceAccountResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateServiceAccountResponse.ProtoReflect.Descriptor instead.
+func (*CreateServiceAccountResponse) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *CreateServiceAccountResponse) GetPublicKeyId() string {
+	if x != nil {
+		return x.PublicKeyId
+	}
+	return ""
+}
+
+type RenewServiceAccountRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name                string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	ArmoredPgpPublicKey string `protobuf:"bytes,2,opt,name=armored_pgp_public_key,json=armoredPgpPublicKey,proto3" json:"armored_pgp_public_key,omitempty"`
+}
+
+func (x *RenewServiceAccountRequest) Reset() {
+	*x = RenewServiceAccountRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RenewServiceAccountRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RenewServiceAccountRequest) ProtoMessage() {}
+
+func (x *RenewServiceAccountRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RenewServiceAccountRequest.ProtoReflect.Descriptor instead.
+func (*RenewServiceAccountRequest) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *RenewServiceAccountRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *RenewServiceAccountRequest) GetArmoredPgpPublicKey() string {
+	if x != nil {
+		return x.ArmoredPgpPublicKey
+	}
+	return ""
+}
+
+type RenewServiceAccountResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	PublicKeyId string `protobuf:"bytes,1,opt,name=public_key_id,json=publicKeyId,proto3" json:"public_key_id,omitempty"`
+}
+
+func (x *RenewServiceAccountResponse) Reset() {
+	*x = RenewServiceAccountResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RenewServiceAccountResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RenewServiceAccountResponse) ProtoMessage() {}
+
+func (x *RenewServiceAccountResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RenewServiceAccountResponse.ProtoReflect.Descriptor instead.
+func (*RenewServiceAccountResponse) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *RenewServiceAccountResponse) GetPublicKeyId() string {
+	if x != nil {
+		return x.PublicKeyId
+	}
+	return ""
+}
+
+type DestroyServiceAccountRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+}
+
+func (x *DestroyServiceAccountRequest) Reset() {
+	*x = DestroyServiceAccountRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DestroyServiceAccountRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DestroyServiceAccountRequest) ProtoMessage() {}
+
+func (x *DestroyServiceAccountRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DestroyServiceAccountRequest.ProtoReflect.Descriptor instead.
+func (*DestroyServiceAccountRequest) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *DestroyServiceAccountRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+type ListServiceAccountsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ServiceAccounts []*ListServiceAccountsResponse_ServiceAccount `protobuf:"bytes,1,rep,name=service_accounts,json=serviceAccounts,proto3" json:"service_accounts,omitempty"`
+}
+
+func (x *ListServiceAccountsResponse) Reset() {
+	*x = ListServiceAccountsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListServiceAccountsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListServiceAccountsResponse) ProtoMessage() {}
+
+func (x *ListServiceAccountsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListServiceAccountsResponse.ProtoReflect.Descriptor instead.
+func (*ListServiceAccountsResponse) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *ListServiceAccountsResponse) GetServiceAccounts() []*ListServiceAccountsResponse_ServiceAccount {
+	if x != nil {
+		return x.ServiceAccounts
+	}
+	return nil
+}
+
+type KubeconfigRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ServiceAccount       bool                 `protobuf:"varint,1,opt,name=service_account,json=serviceAccount,proto3" json:"service_account,omitempty"`
+	ServiceAccountTtl    *durationpb.Duration `protobuf:"bytes,2,opt,name=service_account_ttl,json=serviceAccountTtl,proto3" json:"service_account_ttl,omitempty"`
+	ServiceAccountUser   string               `protobuf:"bytes,3,opt,name=service_account_user,json=serviceAccountUser,proto3" json:"service_account_user,omitempty"`
+	ServiceAccountGroups []string             `protobuf:"bytes,4,rep,name=service_account_groups,json=serviceAccountGroups,proto3" json:"service_account_groups,omitempty"`
+}
+
+func (x *KubeconfigRequest) Reset() {
+	*x = KubeconfigRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubeconfigRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubeconfigRequest) ProtoMessage() {}
+
+func (x *KubeconfigRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubeconfigRequest.ProtoReflect.Descriptor instead.
+func (*KubeconfigRequest) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *KubeconfigRequest) GetServiceAccount() bool {
+	if x != nil {
+		return x.ServiceAccount
+	}
+	return false
+}
+
+func (x *KubeconfigRequest) GetServiceAccountTtl() *durationpb.Duration {
+	if x != nil {
+		return x.ServiceAccountTtl
+	}
+	return nil
+}
+
+func (x *KubeconfigRequest) GetServiceAccountUser() string {
+	if x != nil {
+		return x.ServiceAccountUser
+	}
+	return ""
+}
+
+func (x *KubeconfigRequest) GetServiceAccountGroups() []string {
+	if x != nil {
+		return x.ServiceAccountGroups
+	}
+	return nil
+}
+
+type KubernetesUpgradePreChecksRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NewVersion string `protobuf:"bytes,1,opt,name=new_version,json=newVersion,proto3" json:"new_version,omitempty"`
+}
+
+func (x *KubernetesUpgradePreChecksRequest) Reset() {
+	*x = KubernetesUpgradePreChecksRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubernetesUpgradePreChecksRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubernetesUpgradePreChecksRequest) ProtoMessage() {}
+
+func (x *KubernetesUpgradePreChecksRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubernetesUpgradePreChecksRequest.ProtoReflect.Descriptor instead.
+func (*KubernetesUpgradePreChecksRequest) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *KubernetesUpgradePreChecksRequest) GetNewVersion() string {
+	if x != nil {
+		return x.NewVersion
+	}
+	return ""
+}
+
+type KubernetesUpgradePreChecksResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Ok     bool   `protobuf:"varint,1,opt,name=ok,proto3" json:"ok,omitempty"`
+	Reason string `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`
+}
+
+func (x *KubernetesUpgradePreChecksResponse) Reset() {
+	*x = KubernetesUpgradePreChecksResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubernetesUpgradePreChecksResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubernetesUpgradePreChecksResponse) ProtoMessage() {}
+
+func (x *KubernetesUpgradePreChecksResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubernetesUpgradePreChecksResponse.ProtoReflect.Descriptor instead.
+func (*KubernetesUpgradePreChecksResponse) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *KubernetesUpgradePreChecksResponse) GetOk() bool {
+	if x != nil {
+		return x.Ok
+	}
+	return false
+}
+
+func (x *KubernetesUpgradePreChecksResponse) GetReason() string {
+	if x != nil {
+		return x.Reason
+	}
+	return ""
+}
+
+type KubernetesSyncManifestRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	DryRun bool `protobuf:"varint,1,opt,name=dry_run,json=dryRun,proto3" json:"dry_run,omitempty"`
+}
+
+func (x *KubernetesSyncManifestRequest) Reset() {
+	*x = KubernetesSyncManifestRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubernetesSyncManifestRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubernetesSyncManifestRequest) ProtoMessage() {}
+
+func (x *KubernetesSyncManifestRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubernetesSyncManifestRequest.ProtoReflect.Descriptor instead.
+func (*KubernetesSyncManifestRequest) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *KubernetesSyncManifestRequest) GetDryRun() bool {
+	if x != nil {
+		return x.DryRun
+	}
+	return false
+}
+
+type KubernetesSyncManifestResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ResponseType KubernetesSyncManifestResponse_ResponseType `protobuf:"varint,1,opt,name=response_type,json=responseType,proto3,enum=management.KubernetesSyncManifestResponse_ResponseType" json:"response_type,omitempty"`
+	Path         string                                      `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"`
+	Object       []byte                                      `protobuf:"bytes,3,opt,name=object,proto3" json:"object,omitempty"`
+	Diff         string                                      `protobuf:"bytes,4,opt,name=diff,proto3" json:"diff,omitempty"`
+	Skipped      bool                                        `protobuf:"varint,5,opt,name=skipped,proto3" json:"skipped,omitempty"`
+}
+
+func (x *KubernetesSyncManifestResponse) Reset() {
+	*x = KubernetesSyncManifestResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[16]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubernetesSyncManifestResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubernetesSyncManifestResponse) ProtoMessage() {}
+
+func (x *KubernetesSyncManifestResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[16]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubernetesSyncManifestResponse.ProtoReflect.Descriptor instead.
+func (*KubernetesSyncManifestResponse) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *KubernetesSyncManifestResponse) GetResponseType() KubernetesSyncManifestResponse_ResponseType {
+	if x != nil {
+		return x.ResponseType
+	}
+	return KubernetesSyncManifestResponse_UNKNOWN
+}
+
+func (x *KubernetesSyncManifestResponse) GetPath() string {
+	if x != nil {
+		return x.Path
+	}
+	return ""
+}
+
+func (x *KubernetesSyncManifestResponse) GetObject() []byte {
+	if x != nil {
+		return x.Object
+	}
+	return nil
+}
+
+func (x *KubernetesSyncManifestResponse) GetDiff() string {
+	if x != nil {
+		return x.Diff
+	}
+	return ""
+}
+
+func (x *KubernetesSyncManifestResponse) GetSkipped() bool {
+	if x != nil {
+		return x.Skipped
+	}
+	return false
+}
+
+type CreateSchematicRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Extensions      []string          `protobuf:"bytes,1,rep,name=extensions,proto3" json:"extensions,omitempty"`
+	ExtraKernelArgs []string          `protobuf:"bytes,2,rep,name=extra_kernel_args,json=extraKernelArgs,proto3" json:"extra_kernel_args,omitempty"`
+	MetaValues      map[uint32]string `protobuf:"bytes,3,rep,name=meta_values,json=metaValues,proto3" json:"meta_values,omitempty" protobuf_key:"varint,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *CreateSchematicRequest) Reset() {
+	*x = CreateSchematicRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateSchematicRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateSchematicRequest) ProtoMessage() {}
+
+func (x *CreateSchematicRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateSchematicRequest.ProtoReflect.Descriptor instead.
+func (*CreateSchematicRequest) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *CreateSchematicRequest) GetExtensions() []string {
+	if x != nil {
+		return x.Extensions
+	}
+	return nil
+}
+
+func (x *CreateSchematicRequest) GetExtraKernelArgs() []string {
+	if x != nil {
+		return x.ExtraKernelArgs
+	}
+	return nil
+}
+
+func (x *CreateSchematicRequest) GetMetaValues() map[uint32]string {
+	if x != nil {
+		return x.MetaValues
+	}
+	return nil
+}
+
+type CreateSchematicResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	SchematicId string `protobuf:"bytes,1,opt,name=schematic_id,json=schematicId,proto3" json:"schematic_id,omitempty"`
+	PxeUrl      string `protobuf:"bytes,2,opt,name=pxe_url,json=pxeUrl,proto3" json:"pxe_url,omitempty"`
+}
+
+func (x *CreateSchematicResponse) Reset() {
+	*x = CreateSchematicResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateSchematicResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateSchematicResponse) ProtoMessage() {}
+
+func (x *CreateSchematicResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateSchematicResponse.ProtoReflect.Descriptor instead.
+func (*CreateSchematicResponse) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *CreateSchematicResponse) GetSchematicId() string {
+	if x != nil {
+		return x.SchematicId
+	}
+	return ""
+}
+
+func (x *CreateSchematicResponse) GetPxeUrl() string {
+	if x != nil {
+		return x.PxeUrl
+	}
+	return ""
+}
+
+type ListServiceAccountsResponse_ServiceAccount struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name          string                                                     `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	PgpPublicKeys []*ListServiceAccountsResponse_ServiceAccount_PgpPublicKey `protobuf:"bytes,2,rep,name=pgp_public_keys,json=pgpPublicKeys,proto3" json:"pgp_public_keys,omitempty"`
+	Role          string                                                     `protobuf:"bytes,4,opt,name=role,proto3" json:"role,omitempty"`
+}
+
+func (x *ListServiceAccountsResponse_ServiceAccount) Reset() {
+	*x = ListServiceAccountsResponse_ServiceAccount{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListServiceAccountsResponse_ServiceAccount) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListServiceAccountsResponse_ServiceAccount) ProtoMessage() {}
+
+func (x *ListServiceAccountsResponse_ServiceAccount) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListServiceAccountsResponse_ServiceAccount.ProtoReflect.Descriptor instead.
+func (*ListServiceAccountsResponse_ServiceAccount) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{11, 0}
+}
+
+func (x *ListServiceAccountsResponse_ServiceAccount) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *ListServiceAccountsResponse_ServiceAccount) GetPgpPublicKeys() []*ListServiceAccountsResponse_ServiceAccount_PgpPublicKey {
+	if x != nil {
+		return x.PgpPublicKeys
+	}
+	return nil
+}
+
+func (x *ListServiceAccountsResponse_ServiceAccount) GetRole() string {
+	if x != nil {
+		return x.Role
+	}
+	return ""
+}
+
+type ListServiceAccountsResponse_ServiceAccount_PgpPublicKey struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id         string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Armored    string                 `protobuf:"bytes,2,opt,name=armored,proto3" json:"armored,omitempty"`
+	Expiration *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expiration,proto3" json:"expiration,omitempty"`
+}
+
+func (x *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) Reset() {
+	*x = ListServiceAccountsResponse_ServiceAccount_PgpPublicKey{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_management_management_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) ProtoMessage() {}
+
+func (x *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_management_management_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListServiceAccountsResponse_ServiceAccount_PgpPublicKey.ProtoReflect.Descriptor instead.
+func (*ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) Descriptor() ([]byte, []int) {
+	return file_omni_management_management_proto_rawDescGZIP(), []int{11, 0, 0}
+}
+
+func (x *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) GetArmored() string {
+	if x != nil {
+		return x.Armored
+	}
+	return ""
+}
+
+func (x *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) GetExpiration() *timestamppb.Timestamp {
+	if x != nil {
+		return x.Expiration
+	}
+	return nil
+}
+
+var File_omni_management_management_proto protoreflect.FileDescriptor
+
+var file_omni_management_management_proto_rawDesc = []byte{
+	0x0a, 0x20, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x12, 0x0a, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x1a, 0x1b,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f,
+	0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d,
+	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x13, 0x63, 0x6f,
+	0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x22, 0x34, 0x0a, 0x12, 0x4b, 0x75, 0x62, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x6b, 0x75, 0x62, 0x65, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a, 0x6b, 0x75, 0x62,
+	0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x37, 0x0a, 0x13, 0x54, 0x61, 0x6c, 0x6f, 0x73,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x20,
+	0x0a, 0x0b, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x0b, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x22, 0x34, 0x0a, 0x12, 0x4f, 0x6d, 0x6e, 0x69, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x6f, 0x6d, 0x6e, 0x69, 0x63, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0a, 0x6f, 0x6d, 0x6e, 0x69,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x6a, 0x0a, 0x12, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x4c, 0x6f, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a,
+	0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x66,
+	0x6f, 0x6c, 0x6c, 0x6f, 0x77, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x66, 0x6f, 0x6c,
+	0x6c, 0x6f, 0x77, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x5f, 0x6c, 0x69, 0x6e, 0x65,
+	0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x09, 0x74, 0x61, 0x69, 0x6c, 0x4c, 0x69, 0x6e,
+	0x65, 0x73, 0x22, 0x2f, 0x0a, 0x15, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x63, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x22, 0x2a, 0x0a, 0x12, 0x54, 0x61, 0x6c, 0x6f, 0x73, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x61, 0x64, 0x6d,
+	0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x61, 0x64, 0x6d, 0x69, 0x6e, 0x22,
+	0x90, 0x01, 0x0a, 0x1b, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x33, 0x0a, 0x16, 0x61, 0x72, 0x6d, 0x6f, 0x72, 0x65, 0x64, 0x5f, 0x70, 0x67, 0x70, 0x5f, 0x70,
+	0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x13, 0x61, 0x72, 0x6d, 0x6f, 0x72, 0x65, 0x64, 0x50, 0x67, 0x70, 0x50, 0x75, 0x62, 0x6c, 0x69,
+	0x63, 0x4b, 0x65, 0x79, 0x12, 0x22, 0x0a, 0x0d, 0x75, 0x73, 0x65, 0x5f, 0x75, 0x73, 0x65, 0x72,
+	0x5f, 0x72, 0x6f, 0x6c, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x75, 0x73, 0x65,
+	0x55, 0x73, 0x65, 0x72, 0x52, 0x6f, 0x6c, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x72, 0x6f, 0x6c, 0x65,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x4a, 0x04, 0x08, 0x02,
+	0x10, 0x03, 0x22, 0x42, 0x0a, 0x1c, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x22, 0x0a, 0x0d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79,
+	0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x70, 0x75, 0x62, 0x6c, 0x69,
+	0x63, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x22, 0x65, 0x0a, 0x1a, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x33, 0x0a, 0x16, 0x61, 0x72, 0x6d, 0x6f,
+	0x72, 0x65, 0x64, 0x5f, 0x70, 0x67, 0x70, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b,
+	0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x61, 0x72, 0x6d, 0x6f, 0x72, 0x65,
+	0x64, 0x50, 0x67, 0x70, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x22, 0x41, 0x0a,
+	0x1b, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63,
+	0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x22, 0x0a, 0x0d,
+	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0b, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x49, 0x64,
+	0x22, 0x32, 0x0a, 0x1c, 0x44, 0x65, 0x73, 0x74, 0x72, 0x6f, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x22, 0xa4, 0x03, 0x0a, 0x1b, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x61, 0x0a, 0x10, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f,
+	0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4c, 0x69, 0x73, 0x74,
+	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41,
+	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x0f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41,
+	0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x1a, 0xa1, 0x02, 0x0a, 0x0e, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x6b,
+	0x0a, 0x0f, 0x70, 0x67, 0x70, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x43, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x2e,
+	0x50, 0x67, 0x70, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x52, 0x0d, 0x70, 0x67,
+	0x70, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x72,
+	0x6f, 0x6c, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x1a,
+	0x74, 0x0a, 0x0c, 0x50, 0x67, 0x70, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x18, 0x0a, 0x07, 0x61, 0x72, 0x6d, 0x6f, 0x72, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x61, 0x72, 0x6d, 0x6f, 0x72, 0x65, 0x64, 0x12, 0x3a, 0x0a, 0x0a, 0x65, 0x78, 0x70,
+	0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4a, 0x04, 0x08, 0x03, 0x10, 0x04, 0x22, 0xef, 0x01, 0x0a, 0x11,
+	0x4b, 0x75, 0x62, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x27, 0x0a, 0x0f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x61, 0x63, 0x63,
+	0x6f, 0x75, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x73, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x49, 0x0a, 0x13, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x74, 0x74,
+	0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x11, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x54, 0x74, 0x6c, 0x12, 0x30, 0x0a, 0x14, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x5f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x12, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f,
+	0x75, 0x6e, 0x74, 0x55, 0x73, 0x65, 0x72, 0x12, 0x34, 0x0a, 0x16, 0x73, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x5f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x14, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x22, 0x44, 0x0a,
+	0x21, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x55, 0x70, 0x67, 0x72, 0x61,
+	0x64, 0x65, 0x50, 0x72, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x6e, 0x65, 0x77, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x65, 0x77, 0x56, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x22, 0x4c, 0x0a, 0x22, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65,
+	0x73, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x50, 0x72, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b,
+	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x6f, 0x6b, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x02, 0x6f, 0x6b, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x61,
+	0x73, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f,
+	0x6e, 0x22, 0x38, 0x0a, 0x1d, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x53,
+	0x79, 0x6e, 0x63, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x17, 0x0a, 0x07, 0x64, 0x72, 0x79, 0x5f, 0x72, 0x75, 0x6e, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x06, 0x64, 0x72, 0x79, 0x52, 0x75, 0x6e, 0x22, 0x90, 0x02, 0x0a, 0x1e,
+	0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61,
+	0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5c,
+	0x0a, 0x0d, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x37, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x53, 0x79, 0x6e,
+	0x63, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x54, 0x79, 0x70, 0x65, 0x52, 0x0c,
+	0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04,
+	0x70, 0x61, 0x74, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68,
+	0x12, 0x16, 0x0a, 0x06, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x06, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x69, 0x66, 0x66,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x64, 0x69, 0x66, 0x66, 0x12, 0x18, 0x0a, 0x07,
+	0x73, 0x6b, 0x69, 0x70, 0x70, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x73,
+	0x6b, 0x69, 0x70, 0x70, 0x65, 0x64, 0x22, 0x36, 0x0a, 0x0c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57,
+	0x4e, 0x10, 0x00, 0x12, 0x0c, 0x0a, 0x08, 0x4d, 0x41, 0x4e, 0x49, 0x46, 0x45, 0x53, 0x54, 0x10,
+	0x01, 0x12, 0x0b, 0x0a, 0x07, 0x52, 0x4f, 0x4c, 0x4c, 0x4f, 0x55, 0x54, 0x10, 0x02, 0x22, 0xf8,
+	0x01, 0x0a, 0x16, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x74,
+	0x69, 0x63, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1e, 0x0a, 0x0a, 0x65, 0x78, 0x74,
+	0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x65,
+	0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x2a, 0x0a, 0x11, 0x65, 0x78, 0x74,
+	0x72, 0x61, 0x5f, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x5f, 0x61, 0x72, 0x67, 0x73, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x0f, 0x65, 0x78, 0x74, 0x72, 0x61, 0x4b, 0x65, 0x72, 0x6e, 0x65,
+	0x6c, 0x41, 0x72, 0x67, 0x73, 0x12, 0x53, 0x0a, 0x0b, 0x6d, 0x65, 0x74, 0x61, 0x5f, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x32, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x63,
+	0x68, 0x65, 0x6d, 0x61, 0x74, 0x69, 0x63, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x4d,
+	0x65, 0x74, 0x61, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0a,
+	0x6d, 0x65, 0x74, 0x61, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x1a, 0x3d, 0x0a, 0x0f, 0x4d, 0x65,
+	0x74, 0x61, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x55, 0x0a, 0x17, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x74, 0x69, 0x63, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x74, 0x69,
+	0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x63, 0x68, 0x65,
+	0x6d, 0x61, 0x74, 0x69, 0x63, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x70, 0x78, 0x65, 0x5f, 0x75,
+	0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x70, 0x78, 0x65, 0x55, 0x72, 0x6c,
+	0x32, 0xd5, 0x08, 0x0a, 0x11, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x4b, 0x0a, 0x0a, 0x4b, 0x75, 0x62, 0x65, 0x63, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x4b, 0x75, 0x62, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x4b, 0x75, 0x62, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x4e, 0x0a, 0x0b, 0x54, 0x61, 0x6c, 0x6f, 0x73, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x54, 0x61, 0x6c, 0x6f, 0x73, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x54, 0x61, 0x6c, 0x6f, 0x73, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x44, 0x0a, 0x0a, 0x4f, 0x6d, 0x6e, 0x69, 0x63, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x12, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4f, 0x6d, 0x6e, 0x69, 0x63, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x3d, 0x0a, 0x0b, 0x4d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x4c, 0x6f, 0x67, 0x73, 0x12, 0x1e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4c, 0x6f, 0x67,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x0c, 0x2e, 0x63, 0x6f, 0x6d, 0x6d, 0x6f,
+	0x6e, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x30, 0x01, 0x12, 0x4b, 0x0a, 0x0e, 0x56, 0x61, 0x6c, 0x69,
+	0x64, 0x61, 0x74, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x21, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x65,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x69, 0x0a, 0x14, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x27, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x66, 0x0a, 0x13, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x26, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x27, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x52, 0x65, 0x6e,
+	0x65, 0x77, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x56, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74,
+	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x12,
+	0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x27, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x59, 0x0a, 0x15, 0x44, 0x65, 0x73, 0x74, 0x72, 0x6f, 0x79, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x28, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x44, 0x65, 0x73, 0x74, 0x72, 0x6f, 0x79, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x7b, 0x0a, 0x1a, 0x4b,
+	0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65,
+	0x50, 0x72, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73, 0x12, 0x2d, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65,
+	0x73, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x50, 0x72, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2e, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73,
+	0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x50, 0x72, 0x65, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x73,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x72, 0x0a, 0x17, 0x4b, 0x75, 0x62, 0x65,
+	0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65,
+	0x73, 0x74, 0x73, 0x12, 0x29, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x53, 0x79, 0x6e, 0x63, 0x4d,
+	0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2a,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x4b, 0x75, 0x62, 0x65,
+	0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65,
+	0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x30, 0x01, 0x12, 0x5a, 0x0a, 0x0f,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x74, 0x69, 0x63, 0x12,
+	0x22, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x74, 0x69, 0x63, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x74, 0x69, 0x63,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x37, 0x5a, 0x35, 0x67, 0x69, 0x74, 0x68,
+	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x64, 0x65, 0x72, 0x6f, 0x6c, 0x61, 0x62,
+	0x73, 0x2f, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2f, 0x61, 0x70,
+	0x69, 0x2f, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_omni_management_management_proto_rawDescOnce sync.Once
+	file_omni_management_management_proto_rawDescData = file_omni_management_management_proto_rawDesc
+)
+
+func file_omni_management_management_proto_rawDescGZIP() []byte {
+	file_omni_management_management_proto_rawDescOnce.Do(func() {
+		file_omni_management_management_proto_rawDescData = protoimpl.X.CompressGZIP(file_omni_management_management_proto_rawDescData)
+	})
+	return file_omni_management_management_proto_rawDescData
+}
+
+var file_omni_management_management_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_omni_management_management_proto_msgTypes = make([]protoimpl.MessageInfo, 22)
+var file_omni_management_management_proto_goTypes = []interface{}{
+	(KubernetesSyncManifestResponse_ResponseType)(0),                // 0: management.KubernetesSyncManifestResponse.ResponseType
+	(*KubeconfigResponse)(nil),                                      // 1: management.KubeconfigResponse
+	(*TalosconfigResponse)(nil),                                     // 2: management.TalosconfigResponse
+	(*OmniconfigResponse)(nil),                                      // 3: management.OmniconfigResponse
+	(*MachineLogsRequest)(nil),                                      // 4: management.MachineLogsRequest
+	(*ValidateConfigRequest)(nil),                                   // 5: management.ValidateConfigRequest
+	(*TalosconfigRequest)(nil),                                      // 6: management.TalosconfigRequest
+	(*CreateServiceAccountRequest)(nil),                             // 7: management.CreateServiceAccountRequest
+	(*CreateServiceAccountResponse)(nil),                            // 8: management.CreateServiceAccountResponse
+	(*RenewServiceAccountRequest)(nil),                              // 9: management.RenewServiceAccountRequest
+	(*RenewServiceAccountResponse)(nil),                             // 10: management.RenewServiceAccountResponse
+	(*DestroyServiceAccountRequest)(nil),                            // 11: management.DestroyServiceAccountRequest
+	(*ListServiceAccountsResponse)(nil),                             // 12: management.ListServiceAccountsResponse
+	(*KubeconfigRequest)(nil),                                       // 13: management.KubeconfigRequest
+	(*KubernetesUpgradePreChecksRequest)(nil),                       // 14: management.KubernetesUpgradePreChecksRequest
+	(*KubernetesUpgradePreChecksResponse)(nil),                      // 15: management.KubernetesUpgradePreChecksResponse
+	(*KubernetesSyncManifestRequest)(nil),                           // 16: management.KubernetesSyncManifestRequest
+	(*KubernetesSyncManifestResponse)(nil),                          // 17: management.KubernetesSyncManifestResponse
+	(*CreateSchematicRequest)(nil),                                  // 18: management.CreateSchematicRequest
+	(*CreateSchematicResponse)(nil),                                 // 19: management.CreateSchematicResponse
+	(*ListServiceAccountsResponse_ServiceAccount)(nil),              // 20: management.ListServiceAccountsResponse.ServiceAccount
+	(*ListServiceAccountsResponse_ServiceAccount_PgpPublicKey)(nil), // 21: management.ListServiceAccountsResponse.ServiceAccount.PgpPublicKey
+	nil,                           // 22: management.CreateSchematicRequest.MetaValuesEntry
+	(*durationpb.Duration)(nil),   // 23: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil), // 24: google.protobuf.Timestamp
+	(*emptypb.Empty)(nil),         // 25: google.protobuf.Empty
+	(*common.Data)(nil),           // 26: common.Data
+}
+var file_omni_management_management_proto_depIdxs = []int32{
+	20, // 0: management.ListServiceAccountsResponse.service_accounts:type_name -> management.ListServiceAccountsResponse.ServiceAccount
+	23, // 1: management.KubeconfigRequest.service_account_ttl:type_name -> google.protobuf.Duration
+	0,  // 2: management.KubernetesSyncManifestResponse.response_type:type_name -> management.KubernetesSyncManifestResponse.ResponseType
+	22, // 3: management.CreateSchematicRequest.meta_values:type_name -> management.CreateSchematicRequest.MetaValuesEntry
+	21, // 4: management.ListServiceAccountsResponse.ServiceAccount.pgp_public_keys:type_name -> management.ListServiceAccountsResponse.ServiceAccount.PgpPublicKey
+	24, // 5: management.ListServiceAccountsResponse.ServiceAccount.PgpPublicKey.expiration:type_name -> google.protobuf.Timestamp
+	13, // 6: management.ManagementService.Kubeconfig:input_type -> management.KubeconfigRequest
+	6,  // 7: management.ManagementService.Talosconfig:input_type -> management.TalosconfigRequest
+	25, // 8: management.ManagementService.Omniconfig:input_type -> google.protobuf.Empty
+	4,  // 9: management.ManagementService.MachineLogs:input_type -> management.MachineLogsRequest
+	5,  // 10: management.ManagementService.ValidateConfig:input_type -> management.ValidateConfigRequest
+	7,  // 11: management.ManagementService.CreateServiceAccount:input_type -> management.CreateServiceAccountRequest
+	9,  // 12: management.ManagementService.RenewServiceAccount:input_type -> management.RenewServiceAccountRequest
+	25, // 13: management.ManagementService.ListServiceAccounts:input_type -> google.protobuf.Empty
+	11, // 14: management.ManagementService.DestroyServiceAccount:input_type -> management.DestroyServiceAccountRequest
+	14, // 15: management.ManagementService.KubernetesUpgradePreChecks:input_type -> management.KubernetesUpgradePreChecksRequest
+	16, // 16: management.ManagementService.KubernetesSyncManifests:input_type -> management.KubernetesSyncManifestRequest
+	18, // 17: management.ManagementService.CreateSchematic:input_type -> management.CreateSchematicRequest
+	1,  // 18: management.ManagementService.Kubeconfig:output_type -> management.KubeconfigResponse
+	2,  // 19: management.ManagementService.Talosconfig:output_type -> management.TalosconfigResponse
+	3,  // 20: management.ManagementService.Omniconfig:output_type -> management.OmniconfigResponse
+	26, // 21: management.ManagementService.MachineLogs:output_type -> common.Data
+	25, // 22: management.ManagementService.ValidateConfig:output_type -> google.protobuf.Empty
+	8,  // 23: management.ManagementService.CreateServiceAccount:output_type -> management.CreateServiceAccountResponse
+	10, // 24: management.ManagementService.RenewServiceAccount:output_type -> management.RenewServiceAccountResponse
+	12, // 25: management.ManagementService.ListServiceAccounts:output_type -> management.ListServiceAccountsResponse
+	25, // 26: management.ManagementService.DestroyServiceAccount:output_type -> google.protobuf.Empty
+	15, // 27: management.ManagementService.KubernetesUpgradePreChecks:output_type -> management.KubernetesUpgradePreChecksResponse
+	17, // 28: management.ManagementService.KubernetesSyncManifests:output_type -> management.KubernetesSyncManifestResponse
+	19, // 29: management.ManagementService.CreateSchematic:output_type -> management.CreateSchematicResponse
+	18, // [18:30] is the sub-list for method output_type
+	6,  // [6:18] is the sub-list for method input_type
+	6,  // [6:6] is the sub-list for extension type_name
+	6,  // [6:6] is the sub-list for extension extendee
+	0,  // [0:6] is the sub-list for field type_name
+}
+
+func init() { file_omni_management_management_proto_init() }
+func file_omni_management_management_proto_init() {
+	if File_omni_management_management_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_omni_management_management_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubeconfigResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TalosconfigResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*OmniconfigResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineLogsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ValidateConfigRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TalosconfigRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateServiceAccountRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateServiceAccountResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RenewServiceAccountRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RenewServiceAccountResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DestroyServiceAccountRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListServiceAccountsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubeconfigRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubernetesUpgradePreChecksRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubernetesUpgradePreChecksResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubernetesSyncManifestRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubernetesSyncManifestResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateSchematicRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateSchematicResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListServiceAccountsResponse_ServiceAccount); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_management_management_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListServiceAccountsResponse_ServiceAccount_PgpPublicKey); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_omni_management_management_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   22,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_omni_management_management_proto_goTypes,
+		DependencyIndexes: file_omni_management_management_proto_depIdxs,
+		EnumInfos:         file_omni_management_management_proto_enumTypes,
+		MessageInfos:      file_omni_management_management_proto_msgTypes,
+	}.Build()
+	File_omni_management_management_proto = out.File
+	file_omni_management_management_proto_rawDesc = nil
+	file_omni_management_management_proto_goTypes = nil
+	file_omni_management_management_proto_depIdxs = nil
+}
diff --git a/client/api/omni/management/management.pb.gw.go b/client/api/omni/management/management.pb.gw.go
new file mode 100644
index 000000000..fc24e3616
--- /dev/null
+++ b/client/api/omni/management/management.pb.gw.go
@@ -0,0 +1,965 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: omni/management/management.proto
+
+/*
+Package management is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package management
+
+import (
+	"context"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/emptypb"
+)
+
+// Suppress "imported and not used" errors
+var _ codes.Code
+var _ io.Reader
+var _ status.Status
+var _ = runtime.String
+var _ = utilities.NewDoubleArray
+var _ = metadata.Join
+
+func request_ManagementService_Kubeconfig_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq KubeconfigRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Kubeconfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_Kubeconfig_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq KubeconfigRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Kubeconfig(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_Talosconfig_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq TalosconfigRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Talosconfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_Talosconfig_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq TalosconfigRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Talosconfig(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_Omniconfig_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq emptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Omniconfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_Omniconfig_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq emptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Omniconfig(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_MachineLogs_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (ManagementService_MachineLogsClient, runtime.ServerMetadata, error) {
+	var protoReq MachineLogsRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	stream, err := client.MachineLogs(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+
+}
+
+func request_ManagementService_ValidateConfig_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq ValidateConfigRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.ValidateConfig(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_ValidateConfig_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq ValidateConfigRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.ValidateConfig(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_CreateServiceAccount_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq CreateServiceAccountRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.CreateServiceAccount(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_CreateServiceAccount_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq CreateServiceAccountRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.CreateServiceAccount(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_RenewServiceAccount_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq RenewServiceAccountRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.RenewServiceAccount(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_RenewServiceAccount_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq RenewServiceAccountRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.RenewServiceAccount(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_ListServiceAccounts_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq emptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.ListServiceAccounts(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_ListServiceAccounts_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq emptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.ListServiceAccounts(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_DestroyServiceAccount_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq DestroyServiceAccountRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.DestroyServiceAccount(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_DestroyServiceAccount_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq DestroyServiceAccountRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.DestroyServiceAccount(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_KubernetesUpgradePreChecks_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq KubernetesUpgradePreChecksRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.KubernetesUpgradePreChecks(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_KubernetesUpgradePreChecks_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq KubernetesUpgradePreChecksRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.KubernetesUpgradePreChecks(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ManagementService_KubernetesSyncManifests_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (ManagementService_KubernetesSyncManifestsClient, runtime.ServerMetadata, error) {
+	var protoReq KubernetesSyncManifestRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	stream, err := client.KubernetesSyncManifests(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+
+}
+
+func request_ManagementService_CreateSchematic_0(ctx context.Context, marshaler runtime.Marshaler, client ManagementServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq CreateSchematicRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.CreateSchematic(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ManagementService_CreateSchematic_0(ctx context.Context, marshaler runtime.Marshaler, server ManagementServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq CreateSchematicRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.CreateSchematic(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+// RegisterManagementServiceHandlerServer registers the http handlers for service ManagementService to "mux".
+// UnaryRPC     :call ManagementServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterManagementServiceHandlerFromEndpoint instead.
+func RegisterManagementServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server ManagementServiceServer) error {
+
+	mux.Handle("POST", pattern_ManagementService_Kubeconfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/management.ManagementService/Kubeconfig", runtime.WithHTTPPathPattern("/management.ManagementService/Kubeconfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_Kubeconfig_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_Kubeconfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_Talosconfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/management.ManagementService/Talosconfig", runtime.WithHTTPPathPattern("/management.ManagementService/Talosconfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_Talosconfig_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_Talosconfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_Omniconfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/management.ManagementService/Omniconfig", runtime.WithHTTPPathPattern("/management.ManagementService/Omniconfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_Omniconfig_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_Omniconfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_MachineLogs_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	mux.Handle("POST", pattern_ManagementService_ValidateConfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/management.ManagementService/ValidateConfig", runtime.WithHTTPPathPattern("/management.ManagementService/ValidateConfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_ValidateConfig_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_ValidateConfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_CreateServiceAccount_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/management.ManagementService/CreateServiceAccount", runtime.WithHTTPPathPattern("/management.ManagementService/CreateServiceAccount"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_CreateServiceAccount_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_CreateServiceAccount_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_RenewServiceAccount_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/management.ManagementService/RenewServiceAccount", runtime.WithHTTPPathPattern("/management.ManagementService/RenewServiceAccount"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_RenewServiceAccount_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_RenewServiceAccount_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_ListServiceAccounts_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/management.ManagementService/ListServiceAccounts", runtime.WithHTTPPathPattern("/management.ManagementService/ListServiceAccounts"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_ListServiceAccounts_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_ListServiceAccounts_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_DestroyServiceAccount_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/management.ManagementService/DestroyServiceAccount", runtime.WithHTTPPathPattern("/management.ManagementService/DestroyServiceAccount"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_DestroyServiceAccount_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_DestroyServiceAccount_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_KubernetesUpgradePreChecks_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/management.ManagementService/KubernetesUpgradePreChecks", runtime.WithHTTPPathPattern("/management.ManagementService/KubernetesUpgradePreChecks"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_KubernetesUpgradePreChecks_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_KubernetesUpgradePreChecks_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_KubernetesSyncManifests_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	mux.Handle("POST", pattern_ManagementService_CreateSchematic_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/management.ManagementService/CreateSchematic", runtime.WithHTTPPathPattern("/management.ManagementService/CreateSchematic"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ManagementService_CreateSchematic_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_CreateSchematic_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	return nil
+}
+
+// RegisterManagementServiceHandlerFromEndpoint is same as RegisterManagementServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterManagementServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.DialContext(ctx, endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+
+	return RegisterManagementServiceHandler(ctx, mux, conn)
+}
+
+// RegisterManagementServiceHandler registers the http handlers for service ManagementService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterManagementServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterManagementServiceHandlerClient(ctx, mux, NewManagementServiceClient(conn))
+}
+
+// RegisterManagementServiceHandlerClient registers the http handlers for service ManagementService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "ManagementServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "ManagementServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "ManagementServiceClient" to call the correct interceptors.
+func RegisterManagementServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client ManagementServiceClient) error {
+
+	mux.Handle("POST", pattern_ManagementService_Kubeconfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/management.ManagementService/Kubeconfig", runtime.WithHTTPPathPattern("/management.ManagementService/Kubeconfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_Kubeconfig_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_Kubeconfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_Talosconfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/management.ManagementService/Talosconfig", runtime.WithHTTPPathPattern("/management.ManagementService/Talosconfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_Talosconfig_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_Talosconfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_Omniconfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/management.ManagementService/Omniconfig", runtime.WithHTTPPathPattern("/management.ManagementService/Omniconfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_Omniconfig_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_Omniconfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_MachineLogs_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/management.ManagementService/MachineLogs", runtime.WithHTTPPathPattern("/management.ManagementService/MachineLogs"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_MachineLogs_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_MachineLogs_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_ValidateConfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/management.ManagementService/ValidateConfig", runtime.WithHTTPPathPattern("/management.ManagementService/ValidateConfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_ValidateConfig_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_ValidateConfig_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_CreateServiceAccount_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/management.ManagementService/CreateServiceAccount", runtime.WithHTTPPathPattern("/management.ManagementService/CreateServiceAccount"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_CreateServiceAccount_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_CreateServiceAccount_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_RenewServiceAccount_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/management.ManagementService/RenewServiceAccount", runtime.WithHTTPPathPattern("/management.ManagementService/RenewServiceAccount"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_RenewServiceAccount_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_RenewServiceAccount_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_ListServiceAccounts_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/management.ManagementService/ListServiceAccounts", runtime.WithHTTPPathPattern("/management.ManagementService/ListServiceAccounts"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_ListServiceAccounts_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_ListServiceAccounts_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_DestroyServiceAccount_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/management.ManagementService/DestroyServiceAccount", runtime.WithHTTPPathPattern("/management.ManagementService/DestroyServiceAccount"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_DestroyServiceAccount_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_DestroyServiceAccount_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_KubernetesUpgradePreChecks_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/management.ManagementService/KubernetesUpgradePreChecks", runtime.WithHTTPPathPattern("/management.ManagementService/KubernetesUpgradePreChecks"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_KubernetesUpgradePreChecks_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_KubernetesUpgradePreChecks_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_KubernetesSyncManifests_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/management.ManagementService/KubernetesSyncManifests", runtime.WithHTTPPathPattern("/management.ManagementService/KubernetesSyncManifests"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_KubernetesSyncManifests_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_KubernetesSyncManifests_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ManagementService_CreateSchematic_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/management.ManagementService/CreateSchematic", runtime.WithHTTPPathPattern("/management.ManagementService/CreateSchematic"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ManagementService_CreateSchematic_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ManagementService_CreateSchematic_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	return nil
+}
+
+var (
+	pattern_ManagementService_Kubeconfig_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"management.ManagementService", "Kubeconfig"}, ""))
+
+	pattern_ManagementService_Talosconfig_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"management.ManagementService", "Talosconfig"}, ""))
+
+	pattern_ManagementService_Omniconfig_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"management.ManagementService", "Omniconfig"}, ""))
+
+	pattern_ManagementService_MachineLogs_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"management.ManagementService", "MachineLogs"}, ""))
+
+	pattern_ManagementService_ValidateConfig_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"management.ManagementService", "ValidateConfig"}, ""))
+
+	pattern_ManagementService_CreateServiceAccount_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"management.ManagementService", "CreateServiceAccount"}, ""))
+
+	pattern_ManagementService_RenewServiceAccount_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"management.ManagementService", "RenewServiceAccount"}, ""))
+
+	pattern_ManagementService_ListServiceAccounts_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"management.ManagementService", "ListServiceAccounts"}, ""))
+
+	pattern_ManagementService_DestroyServiceAccount_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"management.ManagementService", "DestroyServiceAccount"}, ""))
+
+	pattern_ManagementService_KubernetesUpgradePreChecks_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"management.ManagementService", "KubernetesUpgradePreChecks"}, ""))
+
+	pattern_ManagementService_KubernetesSyncManifests_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"management.ManagementService", "KubernetesSyncManifests"}, ""))
+
+	pattern_ManagementService_CreateSchematic_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"management.ManagementService", "CreateSchematic"}, ""))
+)
+
+var (
+	forward_ManagementService_Kubeconfig_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_Talosconfig_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_Omniconfig_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_MachineLogs_0 = runtime.ForwardResponseStream
+
+	forward_ManagementService_ValidateConfig_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_CreateServiceAccount_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_RenewServiceAccount_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_ListServiceAccounts_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_DestroyServiceAccount_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_KubernetesUpgradePreChecks_0 = runtime.ForwardResponseMessage
+
+	forward_ManagementService_KubernetesSyncManifests_0 = runtime.ForwardResponseStream
+
+	forward_ManagementService_CreateSchematic_0 = runtime.ForwardResponseMessage
+)
diff --git a/client/api/omni/management/management.proto b/client/api/omni/management/management.proto
new file mode 100644
index 000000000..4e951d4f9
--- /dev/null
+++ b/client/api/omni/management/management.proto
@@ -0,0 +1,146 @@
+syntax = "proto3";
+package management;
+
+option go_package = "github.com/siderolabs/omni/client/api/omni/management";
+
+import "google/protobuf/empty.proto";
+import "google/protobuf/timestamp.proto";
+import "google/protobuf/duration.proto";
+import "common/common.proto";
+
+message KubeconfigResponse {
+  // Kubeconfig is the kubeconfig for the cluster.
+  bytes kubeconfig = 1;
+}
+
+message TalosconfigResponse {
+  // talosconfig is the talos client configuration to access the cluster via the proxy.
+  bytes talosconfig = 1;
+}
+
+message OmniconfigResponse{
+  // omniconfig is the omnictl client configuration to access the omni instance.
+  bytes omniconfig = 1;
+}
+
+message MachineLogsRequest {
+  // MachineId is the ID of the machine.
+  string machine_id = 1;
+  // Follow is whether to follow the logs.
+  bool follow = 2;
+  // TailLines is the number of lines to tail.
+  int32 tail_lines = 3;
+}
+
+message ValidateConfigRequest {
+  // Config represents raw configuration string to validate.
+  string config = 1;
+}
+
+message TalosconfigRequest {
+  // Admin indicates whether to generate an admin talosconfig or a regular one.
+  bool admin = 1;
+}
+
+message CreateServiceAccountRequest {
+  string armored_pgp_public_key = 1;
+  reserved 2;
+  // UseUserRole indicates whether to use the role of the creating user.
+  // When true, role will be ignored and the service account will be created with the role of the creating user.
+  bool use_user_role = 3;
+  string role = 4;
+}
+
+message CreateServiceAccountResponse {
+  string public_key_id = 1;
+}
+
+message RenewServiceAccountRequest {
+  string name = 1;
+  string armored_pgp_public_key = 2;
+}
+
+message RenewServiceAccountResponse {
+  string public_key_id = 1;
+}
+
+message DestroyServiceAccountRequest {
+  string name = 1;
+}
+
+message ListServiceAccountsResponse {
+  message ServiceAccount {
+    message PgpPublicKey {
+      string id = 1;
+      string armored = 2;
+      google.protobuf.Timestamp expiration = 3;
+    }
+
+    string name = 1;
+    repeated PgpPublicKey pgp_public_keys = 2;
+    reserved 3;
+    string role = 4;
+  }
+
+  repeated ServiceAccount service_accounts = 1;
+}
+
+message KubeconfigRequest {
+  bool service_account = 1;
+  google.protobuf.Duration service_account_ttl = 2;
+  string service_account_user = 3;
+  repeated string service_account_groups = 4;
+}
+
+message KubernetesUpgradePreChecksRequest {
+  string new_version = 1;
+}
+
+message KubernetesUpgradePreChecksResponse {
+  bool ok = 1;
+  string reason = 2;
+}
+
+message KubernetesSyncManifestRequest {
+  bool dry_run = 1;
+}
+
+message KubernetesSyncManifestResponse {
+  enum ResponseType {
+    UNKNOWN = 0;
+    MANIFEST = 1;
+    ROLLOUT = 2;
+  };
+
+  ResponseType response_type = 1;
+  string path = 2;
+  bytes object = 3;
+  string diff = 4;
+  bool skipped = 5;
+}
+
+message CreateSchematicRequest {
+  repeated string extensions = 1;
+  repeated string extra_kernel_args = 2;
+  map<uint32, string> meta_values = 3;
+}
+
+message CreateSchematicResponse {
+  string schematic_id = 1;
+  string pxe_url = 2;
+}
+
+service ManagementService {
+  rpc Kubeconfig(KubeconfigRequest) returns (KubeconfigResponse);
+  rpc Talosconfig(TalosconfigRequest) returns (TalosconfigResponse);
+  rpc Omniconfig(google.protobuf.Empty) returns (OmniconfigResponse);
+  rpc MachineLogs(MachineLogsRequest) returns (stream common.Data);
+  rpc ValidateConfig(ValidateConfigRequest) returns (google.protobuf.Empty);
+  rpc CreateServiceAccount(CreateServiceAccountRequest) returns (CreateServiceAccountResponse);
+  rpc RenewServiceAccount(RenewServiceAccountRequest) returns (RenewServiceAccountResponse);
+  rpc ListServiceAccounts(google.protobuf.Empty) returns (ListServiceAccountsResponse);
+  rpc DestroyServiceAccount(DestroyServiceAccountRequest) returns (google.protobuf.Empty);
+  rpc KubernetesUpgradePreChecks(KubernetesUpgradePreChecksRequest) returns (KubernetesUpgradePreChecksResponse);
+  rpc KubernetesSyncManifests(KubernetesSyncManifestRequest) returns (stream KubernetesSyncManifestResponse);
+  rpc CreateSchematic(CreateSchematicRequest) returns (CreateSchematicResponse);
+}
diff --git a/client/api/omni/management/management_grpc.pb.go b/client/api/omni/management/management_grpc.pb.go
new file mode 100644
index 000000000..83685e32b
--- /dev/null
+++ b/client/api/omni/management/management_grpc.pb.go
@@ -0,0 +1,574 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             v4.24.4
+// source: omni/management/management.proto
+
+package management
+
+import (
+	context "context"
+
+	common "github.com/siderolabs/talos/pkg/machinery/api/common"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	ManagementService_Kubeconfig_FullMethodName                 = "/management.ManagementService/Kubeconfig"
+	ManagementService_Talosconfig_FullMethodName                = "/management.ManagementService/Talosconfig"
+	ManagementService_Omniconfig_FullMethodName                 = "/management.ManagementService/Omniconfig"
+	ManagementService_MachineLogs_FullMethodName                = "/management.ManagementService/MachineLogs"
+	ManagementService_ValidateConfig_FullMethodName             = "/management.ManagementService/ValidateConfig"
+	ManagementService_CreateServiceAccount_FullMethodName       = "/management.ManagementService/CreateServiceAccount"
+	ManagementService_RenewServiceAccount_FullMethodName        = "/management.ManagementService/RenewServiceAccount"
+	ManagementService_ListServiceAccounts_FullMethodName        = "/management.ManagementService/ListServiceAccounts"
+	ManagementService_DestroyServiceAccount_FullMethodName      = "/management.ManagementService/DestroyServiceAccount"
+	ManagementService_KubernetesUpgradePreChecks_FullMethodName = "/management.ManagementService/KubernetesUpgradePreChecks"
+	ManagementService_KubernetesSyncManifests_FullMethodName    = "/management.ManagementService/KubernetesSyncManifests"
+	ManagementService_CreateSchematic_FullMethodName            = "/management.ManagementService/CreateSchematic"
+)
+
+// ManagementServiceClient is the client API for ManagementService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type ManagementServiceClient interface {
+	Kubeconfig(ctx context.Context, in *KubeconfigRequest, opts ...grpc.CallOption) (*KubeconfigResponse, error)
+	Talosconfig(ctx context.Context, in *TalosconfigRequest, opts ...grpc.CallOption) (*TalosconfigResponse, error)
+	Omniconfig(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*OmniconfigResponse, error)
+	MachineLogs(ctx context.Context, in *MachineLogsRequest, opts ...grpc.CallOption) (ManagementService_MachineLogsClient, error)
+	ValidateConfig(ctx context.Context, in *ValidateConfigRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	CreateServiceAccount(ctx context.Context, in *CreateServiceAccountRequest, opts ...grpc.CallOption) (*CreateServiceAccountResponse, error)
+	RenewServiceAccount(ctx context.Context, in *RenewServiceAccountRequest, opts ...grpc.CallOption) (*RenewServiceAccountResponse, error)
+	ListServiceAccounts(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListServiceAccountsResponse, error)
+	DestroyServiceAccount(ctx context.Context, in *DestroyServiceAccountRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	KubernetesUpgradePreChecks(ctx context.Context, in *KubernetesUpgradePreChecksRequest, opts ...grpc.CallOption) (*KubernetesUpgradePreChecksResponse, error)
+	KubernetesSyncManifests(ctx context.Context, in *KubernetesSyncManifestRequest, opts ...grpc.CallOption) (ManagementService_KubernetesSyncManifestsClient, error)
+	CreateSchematic(ctx context.Context, in *CreateSchematicRequest, opts ...grpc.CallOption) (*CreateSchematicResponse, error)
+}
+
+type managementServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewManagementServiceClient(cc grpc.ClientConnInterface) ManagementServiceClient {
+	return &managementServiceClient{cc}
+}
+
+func (c *managementServiceClient) Kubeconfig(ctx context.Context, in *KubeconfigRequest, opts ...grpc.CallOption) (*KubeconfigResponse, error) {
+	out := new(KubeconfigResponse)
+	err := c.cc.Invoke(ctx, ManagementService_Kubeconfig_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *managementServiceClient) Talosconfig(ctx context.Context, in *TalosconfigRequest, opts ...grpc.CallOption) (*TalosconfigResponse, error) {
+	out := new(TalosconfigResponse)
+	err := c.cc.Invoke(ctx, ManagementService_Talosconfig_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *managementServiceClient) Omniconfig(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*OmniconfigResponse, error) {
+	out := new(OmniconfigResponse)
+	err := c.cc.Invoke(ctx, ManagementService_Omniconfig_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *managementServiceClient) MachineLogs(ctx context.Context, in *MachineLogsRequest, opts ...grpc.CallOption) (ManagementService_MachineLogsClient, error) {
+	stream, err := c.cc.NewStream(ctx, &ManagementService_ServiceDesc.Streams[0], ManagementService_MachineLogs_FullMethodName, opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &managementServiceMachineLogsClient{stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type ManagementService_MachineLogsClient interface {
+	Recv() (*common.Data, error)
+	grpc.ClientStream
+}
+
+type managementServiceMachineLogsClient struct {
+	grpc.ClientStream
+}
+
+func (x *managementServiceMachineLogsClient) Recv() (*common.Data, error) {
+	m := new(common.Data)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func (c *managementServiceClient) ValidateConfig(ctx context.Context, in *ValidateConfigRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, ManagementService_ValidateConfig_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *managementServiceClient) CreateServiceAccount(ctx context.Context, in *CreateServiceAccountRequest, opts ...grpc.CallOption) (*CreateServiceAccountResponse, error) {
+	out := new(CreateServiceAccountResponse)
+	err := c.cc.Invoke(ctx, ManagementService_CreateServiceAccount_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *managementServiceClient) RenewServiceAccount(ctx context.Context, in *RenewServiceAccountRequest, opts ...grpc.CallOption) (*RenewServiceAccountResponse, error) {
+	out := new(RenewServiceAccountResponse)
+	err := c.cc.Invoke(ctx, ManagementService_RenewServiceAccount_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *managementServiceClient) ListServiceAccounts(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*ListServiceAccountsResponse, error) {
+	out := new(ListServiceAccountsResponse)
+	err := c.cc.Invoke(ctx, ManagementService_ListServiceAccounts_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *managementServiceClient) DestroyServiceAccount(ctx context.Context, in *DestroyServiceAccountRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, ManagementService_DestroyServiceAccount_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *managementServiceClient) KubernetesUpgradePreChecks(ctx context.Context, in *KubernetesUpgradePreChecksRequest, opts ...grpc.CallOption) (*KubernetesUpgradePreChecksResponse, error) {
+	out := new(KubernetesUpgradePreChecksResponse)
+	err := c.cc.Invoke(ctx, ManagementService_KubernetesUpgradePreChecks_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *managementServiceClient) KubernetesSyncManifests(ctx context.Context, in *KubernetesSyncManifestRequest, opts ...grpc.CallOption) (ManagementService_KubernetesSyncManifestsClient, error) {
+	stream, err := c.cc.NewStream(ctx, &ManagementService_ServiceDesc.Streams[1], ManagementService_KubernetesSyncManifests_FullMethodName, opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &managementServiceKubernetesSyncManifestsClient{stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type ManagementService_KubernetesSyncManifestsClient interface {
+	Recv() (*KubernetesSyncManifestResponse, error)
+	grpc.ClientStream
+}
+
+type managementServiceKubernetesSyncManifestsClient struct {
+	grpc.ClientStream
+}
+
+func (x *managementServiceKubernetesSyncManifestsClient) Recv() (*KubernetesSyncManifestResponse, error) {
+	m := new(KubernetesSyncManifestResponse)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func (c *managementServiceClient) CreateSchematic(ctx context.Context, in *CreateSchematicRequest, opts ...grpc.CallOption) (*CreateSchematicResponse, error) {
+	out := new(CreateSchematicResponse)
+	err := c.cc.Invoke(ctx, ManagementService_CreateSchematic_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ManagementServiceServer is the server API for ManagementService service.
+// All implementations must embed UnimplementedManagementServiceServer
+// for forward compatibility
+type ManagementServiceServer interface {
+	Kubeconfig(context.Context, *KubeconfigRequest) (*KubeconfigResponse, error)
+	Talosconfig(context.Context, *TalosconfigRequest) (*TalosconfigResponse, error)
+	Omniconfig(context.Context, *emptypb.Empty) (*OmniconfigResponse, error)
+	MachineLogs(*MachineLogsRequest, ManagementService_MachineLogsServer) error
+	ValidateConfig(context.Context, *ValidateConfigRequest) (*emptypb.Empty, error)
+	CreateServiceAccount(context.Context, *CreateServiceAccountRequest) (*CreateServiceAccountResponse, error)
+	RenewServiceAccount(context.Context, *RenewServiceAccountRequest) (*RenewServiceAccountResponse, error)
+	ListServiceAccounts(context.Context, *emptypb.Empty) (*ListServiceAccountsResponse, error)
+	DestroyServiceAccount(context.Context, *DestroyServiceAccountRequest) (*emptypb.Empty, error)
+	KubernetesUpgradePreChecks(context.Context, *KubernetesUpgradePreChecksRequest) (*KubernetesUpgradePreChecksResponse, error)
+	KubernetesSyncManifests(*KubernetesSyncManifestRequest, ManagementService_KubernetesSyncManifestsServer) error
+	CreateSchematic(context.Context, *CreateSchematicRequest) (*CreateSchematicResponse, error)
+	mustEmbedUnimplementedManagementServiceServer()
+}
+
+// UnimplementedManagementServiceServer must be embedded to have forward compatible implementations.
+type UnimplementedManagementServiceServer struct {
+}
+
+func (UnimplementedManagementServiceServer) Kubeconfig(context.Context, *KubeconfigRequest) (*KubeconfigResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Kubeconfig not implemented")
+}
+func (UnimplementedManagementServiceServer) Talosconfig(context.Context, *TalosconfigRequest) (*TalosconfigResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Talosconfig not implemented")
+}
+func (UnimplementedManagementServiceServer) Omniconfig(context.Context, *emptypb.Empty) (*OmniconfigResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Omniconfig not implemented")
+}
+func (UnimplementedManagementServiceServer) MachineLogs(*MachineLogsRequest, ManagementService_MachineLogsServer) error {
+	return status.Errorf(codes.Unimplemented, "method MachineLogs not implemented")
+}
+func (UnimplementedManagementServiceServer) ValidateConfig(context.Context, *ValidateConfigRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ValidateConfig not implemented")
+}
+func (UnimplementedManagementServiceServer) CreateServiceAccount(context.Context, *CreateServiceAccountRequest) (*CreateServiceAccountResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateServiceAccount not implemented")
+}
+func (UnimplementedManagementServiceServer) RenewServiceAccount(context.Context, *RenewServiceAccountRequest) (*RenewServiceAccountResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RenewServiceAccount not implemented")
+}
+func (UnimplementedManagementServiceServer) ListServiceAccounts(context.Context, *emptypb.Empty) (*ListServiceAccountsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListServiceAccounts not implemented")
+}
+func (UnimplementedManagementServiceServer) DestroyServiceAccount(context.Context, *DestroyServiceAccountRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DestroyServiceAccount not implemented")
+}
+func (UnimplementedManagementServiceServer) KubernetesUpgradePreChecks(context.Context, *KubernetesUpgradePreChecksRequest) (*KubernetesUpgradePreChecksResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method KubernetesUpgradePreChecks not implemented")
+}
+func (UnimplementedManagementServiceServer) KubernetesSyncManifests(*KubernetesSyncManifestRequest, ManagementService_KubernetesSyncManifestsServer) error {
+	return status.Errorf(codes.Unimplemented, "method KubernetesSyncManifests not implemented")
+}
+func (UnimplementedManagementServiceServer) CreateSchematic(context.Context, *CreateSchematicRequest) (*CreateSchematicResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateSchematic not implemented")
+}
+func (UnimplementedManagementServiceServer) mustEmbedUnimplementedManagementServiceServer() {}
+
+// UnsafeManagementServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ManagementServiceServer will
+// result in compilation errors.
+type UnsafeManagementServiceServer interface {
+	mustEmbedUnimplementedManagementServiceServer()
+}
+
+func RegisterManagementServiceServer(s grpc.ServiceRegistrar, srv ManagementServiceServer) {
+	s.RegisterService(&ManagementService_ServiceDesc, srv)
+}
+
+func _ManagementService_Kubeconfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(KubeconfigRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagementServiceServer).Kubeconfig(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ManagementService_Kubeconfig_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagementServiceServer).Kubeconfig(ctx, req.(*KubeconfigRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ManagementService_Talosconfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TalosconfigRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagementServiceServer).Talosconfig(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ManagementService_Talosconfig_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagementServiceServer).Talosconfig(ctx, req.(*TalosconfigRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ManagementService_Omniconfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagementServiceServer).Omniconfig(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ManagementService_Omniconfig_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagementServiceServer).Omniconfig(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ManagementService_MachineLogs_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(MachineLogsRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(ManagementServiceServer).MachineLogs(m, &managementServiceMachineLogsServer{stream})
+}
+
+type ManagementService_MachineLogsServer interface {
+	Send(*common.Data) error
+	grpc.ServerStream
+}
+
+type managementServiceMachineLogsServer struct {
+	grpc.ServerStream
+}
+
+func (x *managementServiceMachineLogsServer) Send(m *common.Data) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+func _ManagementService_ValidateConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ValidateConfigRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagementServiceServer).ValidateConfig(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ManagementService_ValidateConfig_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagementServiceServer).ValidateConfig(ctx, req.(*ValidateConfigRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ManagementService_CreateServiceAccount_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateServiceAccountRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagementServiceServer).CreateServiceAccount(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ManagementService_CreateServiceAccount_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagementServiceServer).CreateServiceAccount(ctx, req.(*CreateServiceAccountRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ManagementService_RenewServiceAccount_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RenewServiceAccountRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagementServiceServer).RenewServiceAccount(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ManagementService_RenewServiceAccount_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagementServiceServer).RenewServiceAccount(ctx, req.(*RenewServiceAccountRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ManagementService_ListServiceAccounts_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(emptypb.Empty)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagementServiceServer).ListServiceAccounts(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ManagementService_ListServiceAccounts_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagementServiceServer).ListServiceAccounts(ctx, req.(*emptypb.Empty))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ManagementService_DestroyServiceAccount_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DestroyServiceAccountRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagementServiceServer).DestroyServiceAccount(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ManagementService_DestroyServiceAccount_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagementServiceServer).DestroyServiceAccount(ctx, req.(*DestroyServiceAccountRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ManagementService_KubernetesUpgradePreChecks_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(KubernetesUpgradePreChecksRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagementServiceServer).KubernetesUpgradePreChecks(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ManagementService_KubernetesUpgradePreChecks_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagementServiceServer).KubernetesUpgradePreChecks(ctx, req.(*KubernetesUpgradePreChecksRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ManagementService_KubernetesSyncManifests_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(KubernetesSyncManifestRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(ManagementServiceServer).KubernetesSyncManifests(m, &managementServiceKubernetesSyncManifestsServer{stream})
+}
+
+type ManagementService_KubernetesSyncManifestsServer interface {
+	Send(*KubernetesSyncManifestResponse) error
+	grpc.ServerStream
+}
+
+type managementServiceKubernetesSyncManifestsServer struct {
+	grpc.ServerStream
+}
+
+func (x *managementServiceKubernetesSyncManifestsServer) Send(m *KubernetesSyncManifestResponse) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+func _ManagementService_CreateSchematic_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateSchematicRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagementServiceServer).CreateSchematic(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ManagementService_CreateSchematic_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagementServiceServer).CreateSchematic(ctx, req.(*CreateSchematicRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ManagementService_ServiceDesc is the grpc.ServiceDesc for ManagementService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ManagementService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "management.ManagementService",
+	HandlerType: (*ManagementServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Kubeconfig",
+			Handler:    _ManagementService_Kubeconfig_Handler,
+		},
+		{
+			MethodName: "Talosconfig",
+			Handler:    _ManagementService_Talosconfig_Handler,
+		},
+		{
+			MethodName: "Omniconfig",
+			Handler:    _ManagementService_Omniconfig_Handler,
+		},
+		{
+			MethodName: "ValidateConfig",
+			Handler:    _ManagementService_ValidateConfig_Handler,
+		},
+		{
+			MethodName: "CreateServiceAccount",
+			Handler:    _ManagementService_CreateServiceAccount_Handler,
+		},
+		{
+			MethodName: "RenewServiceAccount",
+			Handler:    _ManagementService_RenewServiceAccount_Handler,
+		},
+		{
+			MethodName: "ListServiceAccounts",
+			Handler:    _ManagementService_ListServiceAccounts_Handler,
+		},
+		{
+			MethodName: "DestroyServiceAccount",
+			Handler:    _ManagementService_DestroyServiceAccount_Handler,
+		},
+		{
+			MethodName: "KubernetesUpgradePreChecks",
+			Handler:    _ManagementService_KubernetesUpgradePreChecks_Handler,
+		},
+		{
+			MethodName: "CreateSchematic",
+			Handler:    _ManagementService_CreateSchematic_Handler,
+		},
+	},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "MachineLogs",
+			Handler:       _ManagementService_MachineLogs_Handler,
+			ServerStreams: true,
+		},
+		{
+			StreamName:    "KubernetesSyncManifests",
+			Handler:       _ManagementService_KubernetesSyncManifests_Handler,
+			ServerStreams: true,
+		},
+	},
+	Metadata: "omni/management/management.proto",
+}
diff --git a/client/api/omni/management/management_vtproto.pb.go b/client/api/omni/management/management_vtproto.pb.go
new file mode 100644
index 000000000..0f0797fe6
--- /dev/null
+++ b/client/api/omni/management/management_vtproto.pb.go
@@ -0,0 +1,4745 @@
+// Code generated by protoc-gen-go-vtproto. DO NOT EDIT.
+// protoc-gen-go-vtproto version: v0.6.0
+// source: omni/management/management.proto
+
+package management
+
+import (
+	fmt "fmt"
+	io "io"
+
+	protohelpers "github.com/planetscale/vtprotobuf/protohelpers"
+	durationpb1 "github.com/planetscale/vtprotobuf/types/known/durationpb"
+	timestamppb1 "github.com/planetscale/vtprotobuf/types/known/timestamppb"
+	proto "google.golang.org/protobuf/proto"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+func (m *KubeconfigResponse) CloneVT() *KubeconfigResponse {
+	if m == nil {
+		return (*KubeconfigResponse)(nil)
+	}
+	r := new(KubeconfigResponse)
+	if rhs := m.Kubeconfig; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.Kubeconfig = tmpBytes
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubeconfigResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *TalosconfigResponse) CloneVT() *TalosconfigResponse {
+	if m == nil {
+		return (*TalosconfigResponse)(nil)
+	}
+	r := new(TalosconfigResponse)
+	if rhs := m.Talosconfig; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.Talosconfig = tmpBytes
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *TalosconfigResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *OmniconfigResponse) CloneVT() *OmniconfigResponse {
+	if m == nil {
+		return (*OmniconfigResponse)(nil)
+	}
+	r := new(OmniconfigResponse)
+	if rhs := m.Omniconfig; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.Omniconfig = tmpBytes
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *OmniconfigResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineLogsRequest) CloneVT() *MachineLogsRequest {
+	if m == nil {
+		return (*MachineLogsRequest)(nil)
+	}
+	r := new(MachineLogsRequest)
+	r.MachineId = m.MachineId
+	r.Follow = m.Follow
+	r.TailLines = m.TailLines
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineLogsRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ValidateConfigRequest) CloneVT() *ValidateConfigRequest {
+	if m == nil {
+		return (*ValidateConfigRequest)(nil)
+	}
+	r := new(ValidateConfigRequest)
+	r.Config = m.Config
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ValidateConfigRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *TalosconfigRequest) CloneVT() *TalosconfigRequest {
+	if m == nil {
+		return (*TalosconfigRequest)(nil)
+	}
+	r := new(TalosconfigRequest)
+	r.Admin = m.Admin
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *TalosconfigRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *CreateServiceAccountRequest) CloneVT() *CreateServiceAccountRequest {
+	if m == nil {
+		return (*CreateServiceAccountRequest)(nil)
+	}
+	r := new(CreateServiceAccountRequest)
+	r.ArmoredPgpPublicKey = m.ArmoredPgpPublicKey
+	r.UseUserRole = m.UseUserRole
+	r.Role = m.Role
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *CreateServiceAccountRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *CreateServiceAccountResponse) CloneVT() *CreateServiceAccountResponse {
+	if m == nil {
+		return (*CreateServiceAccountResponse)(nil)
+	}
+	r := new(CreateServiceAccountResponse)
+	r.PublicKeyId = m.PublicKeyId
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *CreateServiceAccountResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *RenewServiceAccountRequest) CloneVT() *RenewServiceAccountRequest {
+	if m == nil {
+		return (*RenewServiceAccountRequest)(nil)
+	}
+	r := new(RenewServiceAccountRequest)
+	r.Name = m.Name
+	r.ArmoredPgpPublicKey = m.ArmoredPgpPublicKey
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *RenewServiceAccountRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *RenewServiceAccountResponse) CloneVT() *RenewServiceAccountResponse {
+	if m == nil {
+		return (*RenewServiceAccountResponse)(nil)
+	}
+	r := new(RenewServiceAccountResponse)
+	r.PublicKeyId = m.PublicKeyId
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *RenewServiceAccountResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *DestroyServiceAccountRequest) CloneVT() *DestroyServiceAccountRequest {
+	if m == nil {
+		return (*DestroyServiceAccountRequest)(nil)
+	}
+	r := new(DestroyServiceAccountRequest)
+	r.Name = m.Name
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *DestroyServiceAccountRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) CloneVT() *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey {
+	if m == nil {
+		return (*ListServiceAccountsResponse_ServiceAccount_PgpPublicKey)(nil)
+	}
+	r := new(ListServiceAccountsResponse_ServiceAccount_PgpPublicKey)
+	r.Id = m.Id
+	r.Armored = m.Armored
+	r.Expiration = (*timestamppb.Timestamp)((*timestamppb1.Timestamp)(m.Expiration).CloneVT())
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ListServiceAccountsResponse_ServiceAccount) CloneVT() *ListServiceAccountsResponse_ServiceAccount {
+	if m == nil {
+		return (*ListServiceAccountsResponse_ServiceAccount)(nil)
+	}
+	r := new(ListServiceAccountsResponse_ServiceAccount)
+	r.Name = m.Name
+	r.Role = m.Role
+	if rhs := m.PgpPublicKeys; rhs != nil {
+		tmpContainer := make([]*ListServiceAccountsResponse_ServiceAccount_PgpPublicKey, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.PgpPublicKeys = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ListServiceAccountsResponse_ServiceAccount) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ListServiceAccountsResponse) CloneVT() *ListServiceAccountsResponse {
+	if m == nil {
+		return (*ListServiceAccountsResponse)(nil)
+	}
+	r := new(ListServiceAccountsResponse)
+	if rhs := m.ServiceAccounts; rhs != nil {
+		tmpContainer := make([]*ListServiceAccountsResponse_ServiceAccount, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.ServiceAccounts = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ListServiceAccountsResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubeconfigRequest) CloneVT() *KubeconfigRequest {
+	if m == nil {
+		return (*KubeconfigRequest)(nil)
+	}
+	r := new(KubeconfigRequest)
+	r.ServiceAccount = m.ServiceAccount
+	r.ServiceAccountTtl = (*durationpb.Duration)((*durationpb1.Duration)(m.ServiceAccountTtl).CloneVT())
+	r.ServiceAccountUser = m.ServiceAccountUser
+	if rhs := m.ServiceAccountGroups; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.ServiceAccountGroups = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubeconfigRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubernetesUpgradePreChecksRequest) CloneVT() *KubernetesUpgradePreChecksRequest {
+	if m == nil {
+		return (*KubernetesUpgradePreChecksRequest)(nil)
+	}
+	r := new(KubernetesUpgradePreChecksRequest)
+	r.NewVersion = m.NewVersion
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubernetesUpgradePreChecksRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubernetesUpgradePreChecksResponse) CloneVT() *KubernetesUpgradePreChecksResponse {
+	if m == nil {
+		return (*KubernetesUpgradePreChecksResponse)(nil)
+	}
+	r := new(KubernetesUpgradePreChecksResponse)
+	r.Ok = m.Ok
+	r.Reason = m.Reason
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubernetesUpgradePreChecksResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubernetesSyncManifestRequest) CloneVT() *KubernetesSyncManifestRequest {
+	if m == nil {
+		return (*KubernetesSyncManifestRequest)(nil)
+	}
+	r := new(KubernetesSyncManifestRequest)
+	r.DryRun = m.DryRun
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubernetesSyncManifestRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubernetesSyncManifestResponse) CloneVT() *KubernetesSyncManifestResponse {
+	if m == nil {
+		return (*KubernetesSyncManifestResponse)(nil)
+	}
+	r := new(KubernetesSyncManifestResponse)
+	r.ResponseType = m.ResponseType
+	r.Path = m.Path
+	r.Diff = m.Diff
+	r.Skipped = m.Skipped
+	if rhs := m.Object; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.Object = tmpBytes
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubernetesSyncManifestResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *CreateSchematicRequest) CloneVT() *CreateSchematicRequest {
+	if m == nil {
+		return (*CreateSchematicRequest)(nil)
+	}
+	r := new(CreateSchematicRequest)
+	if rhs := m.Extensions; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.Extensions = tmpContainer
+	}
+	if rhs := m.ExtraKernelArgs; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.ExtraKernelArgs = tmpContainer
+	}
+	if rhs := m.MetaValues; rhs != nil {
+		tmpContainer := make(map[uint32]string, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v
+		}
+		r.MetaValues = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *CreateSchematicRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *CreateSchematicResponse) CloneVT() *CreateSchematicResponse {
+	if m == nil {
+		return (*CreateSchematicResponse)(nil)
+	}
+	r := new(CreateSchematicResponse)
+	r.SchematicId = m.SchematicId
+	r.PxeUrl = m.PxeUrl
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *CreateSchematicResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (this *KubeconfigResponse) EqualVT(that *KubeconfigResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if string(this.Kubeconfig) != string(that.Kubeconfig) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubeconfigResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubeconfigResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *TalosconfigResponse) EqualVT(that *TalosconfigResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if string(this.Talosconfig) != string(that.Talosconfig) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *TalosconfigResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*TalosconfigResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *OmniconfigResponse) EqualVT(that *OmniconfigResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if string(this.Omniconfig) != string(that.Omniconfig) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *OmniconfigResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*OmniconfigResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineLogsRequest) EqualVT(that *MachineLogsRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.MachineId != that.MachineId {
+		return false
+	}
+	if this.Follow != that.Follow {
+		return false
+	}
+	if this.TailLines != that.TailLines {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineLogsRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineLogsRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ValidateConfigRequest) EqualVT(that *ValidateConfigRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Config != that.Config {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ValidateConfigRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ValidateConfigRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *TalosconfigRequest) EqualVT(that *TalosconfigRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Admin != that.Admin {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *TalosconfigRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*TalosconfigRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CreateServiceAccountRequest) EqualVT(that *CreateServiceAccountRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.ArmoredPgpPublicKey != that.ArmoredPgpPublicKey {
+		return false
+	}
+	if this.UseUserRole != that.UseUserRole {
+		return false
+	}
+	if this.Role != that.Role {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CreateServiceAccountRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*CreateServiceAccountRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CreateServiceAccountResponse) EqualVT(that *CreateServiceAccountResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.PublicKeyId != that.PublicKeyId {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CreateServiceAccountResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*CreateServiceAccountResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *RenewServiceAccountRequest) EqualVT(that *RenewServiceAccountRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Name != that.Name {
+		return false
+	}
+	if this.ArmoredPgpPublicKey != that.ArmoredPgpPublicKey {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *RenewServiceAccountRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*RenewServiceAccountRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *RenewServiceAccountResponse) EqualVT(that *RenewServiceAccountResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.PublicKeyId != that.PublicKeyId {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *RenewServiceAccountResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*RenewServiceAccountResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *DestroyServiceAccountRequest) EqualVT(that *DestroyServiceAccountRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Name != that.Name {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *DestroyServiceAccountRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*DestroyServiceAccountRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) EqualVT(that *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Id != that.Id {
+		return false
+	}
+	if this.Armored != that.Armored {
+		return false
+	}
+	if !(*timestamppb1.Timestamp)(this.Expiration).EqualVT((*timestamppb1.Timestamp)(that.Expiration)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ListServiceAccountsResponse_ServiceAccount_PgpPublicKey)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ListServiceAccountsResponse_ServiceAccount) EqualVT(that *ListServiceAccountsResponse_ServiceAccount) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Name != that.Name {
+		return false
+	}
+	if len(this.PgpPublicKeys) != len(that.PgpPublicKeys) {
+		return false
+	}
+	for i, vx := range this.PgpPublicKeys {
+		vy := that.PgpPublicKeys[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &ListServiceAccountsResponse_ServiceAccount_PgpPublicKey{}
+			}
+			if q == nil {
+				q = &ListServiceAccountsResponse_ServiceAccount_PgpPublicKey{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if this.Role != that.Role {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ListServiceAccountsResponse_ServiceAccount) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ListServiceAccountsResponse_ServiceAccount)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ListServiceAccountsResponse) EqualVT(that *ListServiceAccountsResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.ServiceAccounts) != len(that.ServiceAccounts) {
+		return false
+	}
+	for i, vx := range this.ServiceAccounts {
+		vy := that.ServiceAccounts[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &ListServiceAccountsResponse_ServiceAccount{}
+			}
+			if q == nil {
+				q = &ListServiceAccountsResponse_ServiceAccount{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ListServiceAccountsResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ListServiceAccountsResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubeconfigRequest) EqualVT(that *KubeconfigRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.ServiceAccount != that.ServiceAccount {
+		return false
+	}
+	if !(*durationpb1.Duration)(this.ServiceAccountTtl).EqualVT((*durationpb1.Duration)(that.ServiceAccountTtl)) {
+		return false
+	}
+	if this.ServiceAccountUser != that.ServiceAccountUser {
+		return false
+	}
+	if len(this.ServiceAccountGroups) != len(that.ServiceAccountGroups) {
+		return false
+	}
+	for i, vx := range this.ServiceAccountGroups {
+		vy := that.ServiceAccountGroups[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubeconfigRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubeconfigRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubernetesUpgradePreChecksRequest) EqualVT(that *KubernetesUpgradePreChecksRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.NewVersion != that.NewVersion {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubernetesUpgradePreChecksRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubernetesUpgradePreChecksRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubernetesUpgradePreChecksResponse) EqualVT(that *KubernetesUpgradePreChecksResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Ok != that.Ok {
+		return false
+	}
+	if this.Reason != that.Reason {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubernetesUpgradePreChecksResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubernetesUpgradePreChecksResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubernetesSyncManifestRequest) EqualVT(that *KubernetesSyncManifestRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.DryRun != that.DryRun {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubernetesSyncManifestRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubernetesSyncManifestRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubernetesSyncManifestResponse) EqualVT(that *KubernetesSyncManifestResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.ResponseType != that.ResponseType {
+		return false
+	}
+	if this.Path != that.Path {
+		return false
+	}
+	if string(this.Object) != string(that.Object) {
+		return false
+	}
+	if this.Diff != that.Diff {
+		return false
+	}
+	if this.Skipped != that.Skipped {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubernetesSyncManifestResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubernetesSyncManifestResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CreateSchematicRequest) EqualVT(that *CreateSchematicRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Extensions) != len(that.Extensions) {
+		return false
+	}
+	for i, vx := range this.Extensions {
+		vy := that.Extensions[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if len(this.ExtraKernelArgs) != len(that.ExtraKernelArgs) {
+		return false
+	}
+	for i, vx := range this.ExtraKernelArgs {
+		vy := that.ExtraKernelArgs[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if len(this.MetaValues) != len(that.MetaValues) {
+		return false
+	}
+	for i, vx := range this.MetaValues {
+		vy, ok := that.MetaValues[i]
+		if !ok {
+			return false
+		}
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CreateSchematicRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*CreateSchematicRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CreateSchematicResponse) EqualVT(that *CreateSchematicResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.SchematicId != that.SchematicId {
+		return false
+	}
+	if this.PxeUrl != that.PxeUrl {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CreateSchematicResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*CreateSchematicResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (m *KubeconfigResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubeconfigResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubeconfigResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Kubeconfig) > 0 {
+		i -= len(m.Kubeconfig)
+		copy(dAtA[i:], m.Kubeconfig)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Kubeconfig)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *TalosconfigResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TalosconfigResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *TalosconfigResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Talosconfig) > 0 {
+		i -= len(m.Talosconfig)
+		copy(dAtA[i:], m.Talosconfig)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Talosconfig)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *OmniconfigResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *OmniconfigResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *OmniconfigResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Omniconfig) > 0 {
+		i -= len(m.Omniconfig)
+		copy(dAtA[i:], m.Omniconfig)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Omniconfig)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineLogsRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineLogsRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineLogsRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.TailLines != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.TailLines))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Follow {
+		i--
+		if m.Follow {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.MachineId) > 0 {
+		i -= len(m.MachineId)
+		copy(dAtA[i:], m.MachineId)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.MachineId)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ValidateConfigRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ValidateConfigRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ValidateConfigRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Config) > 0 {
+		i -= len(m.Config)
+		copy(dAtA[i:], m.Config)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Config)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *TalosconfigRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TalosconfigRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *TalosconfigRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Admin {
+		i--
+		if m.Admin {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CreateServiceAccountRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CreateServiceAccountRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CreateServiceAccountRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Role) > 0 {
+		i -= len(m.Role)
+		copy(dAtA[i:], m.Role)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Role)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.UseUserRole {
+		i--
+		if m.UseUserRole {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.ArmoredPgpPublicKey) > 0 {
+		i -= len(m.ArmoredPgpPublicKey)
+		copy(dAtA[i:], m.ArmoredPgpPublicKey)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ArmoredPgpPublicKey)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CreateServiceAccountResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CreateServiceAccountResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CreateServiceAccountResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.PublicKeyId) > 0 {
+		i -= len(m.PublicKeyId)
+		copy(dAtA[i:], m.PublicKeyId)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.PublicKeyId)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RenewServiceAccountRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RenewServiceAccountRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *RenewServiceAccountRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.ArmoredPgpPublicKey) > 0 {
+		i -= len(m.ArmoredPgpPublicKey)
+		copy(dAtA[i:], m.ArmoredPgpPublicKey)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ArmoredPgpPublicKey)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RenewServiceAccountResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RenewServiceAccountResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *RenewServiceAccountResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.PublicKeyId) > 0 {
+		i -= len(m.PublicKeyId)
+		copy(dAtA[i:], m.PublicKeyId)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.PublicKeyId)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *DestroyServiceAccountRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DestroyServiceAccountRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *DestroyServiceAccountRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Expiration != nil {
+		size, err := (*timestamppb1.Timestamp)(m.Expiration).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Armored) > 0 {
+		i -= len(m.Armored)
+		copy(dAtA[i:], m.Armored)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Armored)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Id) > 0 {
+		i -= len(m.Id)
+		copy(dAtA[i:], m.Id)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Id)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListServiceAccountsResponse_ServiceAccount) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListServiceAccountsResponse_ServiceAccount) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ListServiceAccountsResponse_ServiceAccount) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Role) > 0 {
+		i -= len(m.Role)
+		copy(dAtA[i:], m.Role)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Role)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.PgpPublicKeys) > 0 {
+		for iNdEx := len(m.PgpPublicKeys) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.PgpPublicKeys[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListServiceAccountsResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListServiceAccountsResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ListServiceAccountsResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.ServiceAccounts) > 0 {
+		for iNdEx := len(m.ServiceAccounts) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.ServiceAccounts[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubeconfigRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubeconfigRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubeconfigRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.ServiceAccountGroups) > 0 {
+		for iNdEx := len(m.ServiceAccountGroups) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.ServiceAccountGroups[iNdEx])
+			copy(dAtA[i:], m.ServiceAccountGroups[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ServiceAccountGroups[iNdEx])))
+			i--
+			dAtA[i] = 0x22
+		}
+	}
+	if len(m.ServiceAccountUser) > 0 {
+		i -= len(m.ServiceAccountUser)
+		copy(dAtA[i:], m.ServiceAccountUser)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ServiceAccountUser)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.ServiceAccountTtl != nil {
+		size, err := (*durationpb1.Duration)(m.ServiceAccountTtl).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.ServiceAccount {
+		i--
+		if m.ServiceAccount {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubernetesUpgradePreChecksRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesUpgradePreChecksRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubernetesUpgradePreChecksRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.NewVersion) > 0 {
+		i -= len(m.NewVersion)
+		copy(dAtA[i:], m.NewVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.NewVersion)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubernetesUpgradePreChecksResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesUpgradePreChecksResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubernetesUpgradePreChecksResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Reason) > 0 {
+		i -= len(m.Reason)
+		copy(dAtA[i:], m.Reason)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Reason)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Ok {
+		i--
+		if m.Ok {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubernetesSyncManifestRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesSyncManifestRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubernetesSyncManifestRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.DryRun {
+		i--
+		if m.DryRun {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubernetesSyncManifestResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesSyncManifestResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubernetesSyncManifestResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Skipped {
+		i--
+		if m.Skipped {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x28
+	}
+	if len(m.Diff) > 0 {
+		i -= len(m.Diff)
+		copy(dAtA[i:], m.Diff)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Diff)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.Object) > 0 {
+		i -= len(m.Object)
+		copy(dAtA[i:], m.Object)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Object)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Path) > 0 {
+		i -= len(m.Path)
+		copy(dAtA[i:], m.Path)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Path)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.ResponseType != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.ResponseType))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CreateSchematicRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CreateSchematicRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CreateSchematicRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.MetaValues) > 0 {
+		for k := range m.MetaValues {
+			v := m.MetaValues[k]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(k))
+			i--
+			dAtA[i] = 0x8
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.ExtraKernelArgs) > 0 {
+		for iNdEx := len(m.ExtraKernelArgs) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.ExtraKernelArgs[iNdEx])
+			copy(dAtA[i:], m.ExtraKernelArgs[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ExtraKernelArgs[iNdEx])))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Extensions) > 0 {
+		for iNdEx := len(m.Extensions) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Extensions[iNdEx])
+			copy(dAtA[i:], m.Extensions[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Extensions[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CreateSchematicResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CreateSchematicResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CreateSchematicResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.PxeUrl) > 0 {
+		i -= len(m.PxeUrl)
+		copy(dAtA[i:], m.PxeUrl)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.PxeUrl)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.SchematicId) > 0 {
+		i -= len(m.SchematicId)
+		copy(dAtA[i:], m.SchematicId)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.SchematicId)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubeconfigResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Kubeconfig)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *TalosconfigResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Talosconfig)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *OmniconfigResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Omniconfig)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineLogsRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.MachineId)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Follow {
+		n += 2
+	}
+	if m.TailLines != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.TailLines))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ValidateConfigRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Config)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *TalosconfigRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Admin {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CreateServiceAccountRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ArmoredPgpPublicKey)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.UseUserRole {
+		n += 2
+	}
+	l = len(m.Role)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CreateServiceAccountResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.PublicKeyId)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *RenewServiceAccountRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ArmoredPgpPublicKey)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *RenewServiceAccountResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.PublicKeyId)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *DestroyServiceAccountRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Id)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Armored)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Expiration != nil {
+		l = (*timestamppb1.Timestamp)(m.Expiration).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ListServiceAccountsResponse_ServiceAccount) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.PgpPublicKeys) > 0 {
+		for _, e := range m.PgpPublicKeys {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	l = len(m.Role)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ListServiceAccountsResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.ServiceAccounts) > 0 {
+		for _, e := range m.ServiceAccounts {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubeconfigRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.ServiceAccount {
+		n += 2
+	}
+	if m.ServiceAccountTtl != nil {
+		l = (*durationpb1.Duration)(m.ServiceAccountTtl).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ServiceAccountUser)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.ServiceAccountGroups) > 0 {
+		for _, s := range m.ServiceAccountGroups {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubernetesUpgradePreChecksRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.NewVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubernetesUpgradePreChecksResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Ok {
+		n += 2
+	}
+	l = len(m.Reason)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubernetesSyncManifestRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.DryRun {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubernetesSyncManifestResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.ResponseType != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.ResponseType))
+	}
+	l = len(m.Path)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Object)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Diff)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Skipped {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CreateSchematicRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Extensions) > 0 {
+		for _, s := range m.Extensions {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	if len(m.ExtraKernelArgs) > 0 {
+		for _, s := range m.ExtraKernelArgs {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	if len(m.MetaValues) > 0 {
+		for k, v := range m.MetaValues {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + protohelpers.SizeOfVarint(uint64(k)) + 1 + len(v) + protohelpers.SizeOfVarint(uint64(len(v)))
+			n += mapEntrySize + 1 + protohelpers.SizeOfVarint(uint64(mapEntrySize))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CreateSchematicResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.SchematicId)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.PxeUrl)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubeconfigResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubeconfigResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubeconfigResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kubeconfig", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Kubeconfig = append(m.Kubeconfig[:0], dAtA[iNdEx:postIndex]...)
+			if m.Kubeconfig == nil {
+				m.Kubeconfig = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TalosconfigResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TalosconfigResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TalosconfigResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Talosconfig", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Talosconfig = append(m.Talosconfig[:0], dAtA[iNdEx:postIndex]...)
+			if m.Talosconfig == nil {
+				m.Talosconfig = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *OmniconfigResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: OmniconfigResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: OmniconfigResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Omniconfig", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Omniconfig = append(m.Omniconfig[:0], dAtA[iNdEx:postIndex]...)
+			if m.Omniconfig == nil {
+				m.Omniconfig = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineLogsRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineLogsRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineLogsRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MachineId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.MachineId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Follow", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Follow = bool(v != 0)
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TailLines", wireType)
+			}
+			m.TailLines = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.TailLines |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ValidateConfigRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ValidateConfigRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ValidateConfigRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Config", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Config = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TalosconfigRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TalosconfigRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TalosconfigRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Admin", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Admin = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CreateServiceAccountRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CreateServiceAccountRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CreateServiceAccountRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ArmoredPgpPublicKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ArmoredPgpPublicKey = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UseUserRole", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.UseUserRole = bool(v != 0)
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Role", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Role = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CreateServiceAccountResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CreateServiceAccountResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CreateServiceAccountResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PublicKeyId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PublicKeyId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RenewServiceAccountRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RenewServiceAccountRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RenewServiceAccountRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ArmoredPgpPublicKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ArmoredPgpPublicKey = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RenewServiceAccountResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RenewServiceAccountResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RenewServiceAccountResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PublicKeyId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PublicKeyId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DestroyServiceAccountRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DestroyServiceAccountRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DestroyServiceAccountRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListServiceAccountsResponse_ServiceAccount_PgpPublicKey) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListServiceAccountsResponse_ServiceAccount_PgpPublicKey: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListServiceAccountsResponse_ServiceAccount_PgpPublicKey: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Id", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Id = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Armored", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Armored = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Expiration", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Expiration == nil {
+				m.Expiration = &timestamppb.Timestamp{}
+			}
+			if err := (*timestamppb1.Timestamp)(m.Expiration).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListServiceAccountsResponse_ServiceAccount) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListServiceAccountsResponse_ServiceAccount: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListServiceAccountsResponse_ServiceAccount: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PgpPublicKeys", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PgpPublicKeys = append(m.PgpPublicKeys, &ListServiceAccountsResponse_ServiceAccount_PgpPublicKey{})
+			if err := m.PgpPublicKeys[len(m.PgpPublicKeys)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Role", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Role = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListServiceAccountsResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListServiceAccountsResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListServiceAccountsResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceAccounts", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServiceAccounts = append(m.ServiceAccounts, &ListServiceAccountsResponse_ServiceAccount{})
+			if err := m.ServiceAccounts[len(m.ServiceAccounts)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubeconfigRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubeconfigRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubeconfigRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceAccount", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.ServiceAccount = bool(v != 0)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceAccountTtl", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ServiceAccountTtl == nil {
+				m.ServiceAccountTtl = &durationpb.Duration{}
+			}
+			if err := (*durationpb1.Duration)(m.ServiceAccountTtl).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceAccountUser", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServiceAccountUser = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServiceAccountGroups", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServiceAccountGroups = append(m.ServiceAccountGroups, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesUpgradePreChecksRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesUpgradePreChecksRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesUpgradePreChecksRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NewVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NewVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesUpgradePreChecksResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesUpgradePreChecksResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesUpgradePreChecksResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ok", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Ok = bool(v != 0)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesSyncManifestRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesSyncManifestRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesSyncManifestRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DryRun", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.DryRun = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesSyncManifestResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesSyncManifestResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesSyncManifestResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ResponseType", wireType)
+			}
+			m.ResponseType = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ResponseType |= KubernetesSyncManifestResponse_ResponseType(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Path", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Path = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Object", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Object = append(m.Object[:0], dAtA[iNdEx:postIndex]...)
+			if m.Object == nil {
+				m.Object = []byte{}
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Diff", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Diff = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Skipped", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Skipped = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CreateSchematicRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CreateSchematicRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CreateSchematicRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Extensions", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Extensions = append(m.Extensions, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ExtraKernelArgs", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ExtraKernelArgs = append(m.ExtraKernelArgs, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MetaValues", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.MetaValues == nil {
+				m.MetaValues = make(map[uint32]string)
+			}
+			var mapkey uint32
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapkey |= uint32(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.MetaValues[mapkey] = mapvalue
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CreateSchematicResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CreateSchematicResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CreateSchematicResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchematicId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SchematicId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PxeUrl", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PxeUrl = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/client/api/omni/oidc/oidc.pb.go b/client/api/omni/oidc/oidc.pb.go
new file mode 100644
index 000000000..4567c3163
--- /dev/null
+++ b/client/api/omni/oidc/oidc.pb.go
@@ -0,0 +1,223 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.32.0
+// 	protoc        v4.24.4
+// source: omni/oidc/oidc.proto
+
+package oidc
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	_ "google.golang.org/protobuf/types/known/emptypb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type AuthenticateRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Auth Request ID.
+	AuthRequestId string `protobuf:"bytes,1,opt,name=auth_request_id,json=authRequestId,proto3" json:"auth_request_id,omitempty"`
+}
+
+func (x *AuthenticateRequest) Reset() {
+	*x = AuthenticateRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_oidc_oidc_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthenticateRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthenticateRequest) ProtoMessage() {}
+
+func (x *AuthenticateRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_oidc_oidc_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthenticateRequest.ProtoReflect.Descriptor instead.
+func (*AuthenticateRequest) Descriptor() ([]byte, []int) {
+	return file_omni_oidc_oidc_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *AuthenticateRequest) GetAuthRequestId() string {
+	if x != nil {
+		return x.AuthRequestId
+	}
+	return ""
+}
+
+type AuthenticateResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// URL to redirect the user to.
+	RedirectUrl string `protobuf:"bytes,1,opt,name=redirect_url,json=redirectUrl,proto3" json:"redirect_url,omitempty"`
+}
+
+func (x *AuthenticateResponse) Reset() {
+	*x = AuthenticateResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_oidc_oidc_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthenticateResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthenticateResponse) ProtoMessage() {}
+
+func (x *AuthenticateResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_oidc_oidc_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthenticateResponse.ProtoReflect.Descriptor instead.
+func (*AuthenticateResponse) Descriptor() ([]byte, []int) {
+	return file_omni_oidc_oidc_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *AuthenticateResponse) GetRedirectUrl() string {
+	if x != nil {
+		return x.RedirectUrl
+	}
+	return ""
+}
+
+var File_omni_oidc_oidc_proto protoreflect.FileDescriptor
+
+var file_omni_oidc_oidc_proto_rawDesc = []byte{
+	0x0a, 0x14, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x6f, 0x69, 0x64, 0x63, 0x2f, 0x6f, 0x69, 0x64, 0x63,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x04, 0x6f, 0x69, 0x64, 0x63, 0x1a, 0x1b, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d,
+	0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x3d, 0x0a, 0x13, 0x41, 0x75, 0x74,
+	0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x26, 0x0a, 0x0f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x61, 0x75, 0x74, 0x68, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x49, 0x64, 0x22, 0x39, 0x0a, 0x14, 0x41, 0x75, 0x74, 0x68,
+	0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x21, 0x0a, 0x0c, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x72, 0x6c,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x72, 0x65, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74,
+	0x55, 0x72, 0x6c, 0x32, 0x54, 0x0a, 0x0b, 0x4f, 0x49, 0x44, 0x43, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x12, 0x45, 0x0a, 0x0c, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61,
+	0x74, 0x65, 0x12, 0x19, 0x2e, 0x6f, 0x69, 0x64, 0x63, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e,
+	0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e,
+	0x6f, 0x69, 0x64, 0x63, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74,
+	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x31, 0x5a, 0x2f, 0x67, 0x69, 0x74,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x64, 0x65, 0x72, 0x6f, 0x6c, 0x61,
+	0x62, 0x73, 0x2f, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2f, 0x61,
+	0x70, 0x69, 0x2f, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x6f, 0x69, 0x64, 0x63, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_omni_oidc_oidc_proto_rawDescOnce sync.Once
+	file_omni_oidc_oidc_proto_rawDescData = file_omni_oidc_oidc_proto_rawDesc
+)
+
+func file_omni_oidc_oidc_proto_rawDescGZIP() []byte {
+	file_omni_oidc_oidc_proto_rawDescOnce.Do(func() {
+		file_omni_oidc_oidc_proto_rawDescData = protoimpl.X.CompressGZIP(file_omni_oidc_oidc_proto_rawDescData)
+	})
+	return file_omni_oidc_oidc_proto_rawDescData
+}
+
+var file_omni_oidc_oidc_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_omni_oidc_oidc_proto_goTypes = []interface{}{
+	(*AuthenticateRequest)(nil),  // 0: oidc.AuthenticateRequest
+	(*AuthenticateResponse)(nil), // 1: oidc.AuthenticateResponse
+}
+var file_omni_oidc_oidc_proto_depIdxs = []int32{
+	0, // 0: oidc.OIDCService.Authenticate:input_type -> oidc.AuthenticateRequest
+	1, // 1: oidc.OIDCService.Authenticate:output_type -> oidc.AuthenticateResponse
+	1, // [1:2] is the sub-list for method output_type
+	0, // [0:1] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_omni_oidc_oidc_proto_init() }
+func file_omni_oidc_oidc_proto_init() {
+	if File_omni_oidc_oidc_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_omni_oidc_oidc_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthenticateRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_oidc_oidc_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthenticateResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_omni_oidc_oidc_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_omni_oidc_oidc_proto_goTypes,
+		DependencyIndexes: file_omni_oidc_oidc_proto_depIdxs,
+		MessageInfos:      file_omni_oidc_oidc_proto_msgTypes,
+	}.Build()
+	File_omni_oidc_oidc_proto = out.File
+	file_omni_oidc_oidc_proto_rawDesc = nil
+	file_omni_oidc_oidc_proto_goTypes = nil
+	file_omni_oidc_oidc_proto_depIdxs = nil
+}
diff --git a/client/api/omni/oidc/oidc.pb.gw.go b/client/api/omni/oidc/oidc.pb.gw.go
new file mode 100644
index 000000000..399145aa9
--- /dev/null
+++ b/client/api/omni/oidc/oidc.pb.gw.go
@@ -0,0 +1,163 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: omni/oidc/oidc.proto
+
+/*
+Package oidc is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package oidc
+
+import (
+	"context"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Suppress "imported and not used" errors
+var _ codes.Code
+var _ io.Reader
+var _ status.Status
+var _ = runtime.String
+var _ = utilities.NewDoubleArray
+var _ = metadata.Join
+
+func request_OIDCService_Authenticate_0(ctx context.Context, marshaler runtime.Marshaler, client OIDCServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq AuthenticateRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Authenticate(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_OIDCService_Authenticate_0(ctx context.Context, marshaler runtime.Marshaler, server OIDCServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq AuthenticateRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Authenticate(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+// RegisterOIDCServiceHandlerServer registers the http handlers for service OIDCService to "mux".
+// UnaryRPC     :call OIDCServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterOIDCServiceHandlerFromEndpoint instead.
+func RegisterOIDCServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server OIDCServiceServer) error {
+
+	mux.Handle("POST", pattern_OIDCService_Authenticate_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/oidc.OIDCService/Authenticate", runtime.WithHTTPPathPattern("/oidc.OIDCService/Authenticate"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_OIDCService_Authenticate_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_OIDCService_Authenticate_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	return nil
+}
+
+// RegisterOIDCServiceHandlerFromEndpoint is same as RegisterOIDCServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterOIDCServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.DialContext(ctx, endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+
+	return RegisterOIDCServiceHandler(ctx, mux, conn)
+}
+
+// RegisterOIDCServiceHandler registers the http handlers for service OIDCService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterOIDCServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterOIDCServiceHandlerClient(ctx, mux, NewOIDCServiceClient(conn))
+}
+
+// RegisterOIDCServiceHandlerClient registers the http handlers for service OIDCService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "OIDCServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "OIDCServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "OIDCServiceClient" to call the correct interceptors.
+func RegisterOIDCServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client OIDCServiceClient) error {
+
+	mux.Handle("POST", pattern_OIDCService_Authenticate_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/oidc.OIDCService/Authenticate", runtime.WithHTTPPathPattern("/oidc.OIDCService/Authenticate"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_OIDCService_Authenticate_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_OIDCService_Authenticate_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	return nil
+}
+
+var (
+	pattern_OIDCService_Authenticate_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"oidc.OIDCService", "Authenticate"}, ""))
+)
+
+var (
+	forward_OIDCService_Authenticate_0 = runtime.ForwardResponseMessage
+)
diff --git a/client/api/omni/oidc/oidc.proto b/client/api/omni/oidc/oidc.proto
new file mode 100644
index 000000000..19565e357
--- /dev/null
+++ b/client/api/omni/oidc/oidc.proto
@@ -0,0 +1,21 @@
+syntax = "proto3";
+package oidc;
+
+option go_package = "github.com/siderolabs/omni/client/api/omni/oidc";
+
+import "google/protobuf/empty.proto";
+
+message AuthenticateRequest {
+  // Auth Request ID.
+  string auth_request_id = 1;
+}
+
+message AuthenticateResponse {
+  // URL to redirect the user to.
+  string redirect_url = 1;
+}
+
+service OIDCService {
+  // Authenticate an OIDC auth request by ID.
+  rpc Authenticate(AuthenticateRequest) returns (AuthenticateResponse);
+}
diff --git a/client/api/omni/oidc/oidc_grpc.pb.go b/client/api/omni/oidc/oidc_grpc.pb.go
new file mode 100644
index 000000000..e1526099d
--- /dev/null
+++ b/client/api/omni/oidc/oidc_grpc.pb.go
@@ -0,0 +1,112 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             v4.24.4
+// source: omni/oidc/oidc.proto
+
+package oidc
+
+import (
+	context "context"
+
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	OIDCService_Authenticate_FullMethodName = "/oidc.OIDCService/Authenticate"
+)
+
+// OIDCServiceClient is the client API for OIDCService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type OIDCServiceClient interface {
+	// Authenticate an OIDC auth request by ID.
+	Authenticate(ctx context.Context, in *AuthenticateRequest, opts ...grpc.CallOption) (*AuthenticateResponse, error)
+}
+
+type oIDCServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewOIDCServiceClient(cc grpc.ClientConnInterface) OIDCServiceClient {
+	return &oIDCServiceClient{cc}
+}
+
+func (c *oIDCServiceClient) Authenticate(ctx context.Context, in *AuthenticateRequest, opts ...grpc.CallOption) (*AuthenticateResponse, error) {
+	out := new(AuthenticateResponse)
+	err := c.cc.Invoke(ctx, OIDCService_Authenticate_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// OIDCServiceServer is the server API for OIDCService service.
+// All implementations must embed UnimplementedOIDCServiceServer
+// for forward compatibility
+type OIDCServiceServer interface {
+	// Authenticate an OIDC auth request by ID.
+	Authenticate(context.Context, *AuthenticateRequest) (*AuthenticateResponse, error)
+	mustEmbedUnimplementedOIDCServiceServer()
+}
+
+// UnimplementedOIDCServiceServer must be embedded to have forward compatible implementations.
+type UnimplementedOIDCServiceServer struct {
+}
+
+func (UnimplementedOIDCServiceServer) Authenticate(context.Context, *AuthenticateRequest) (*AuthenticateResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Authenticate not implemented")
+}
+func (UnimplementedOIDCServiceServer) mustEmbedUnimplementedOIDCServiceServer() {}
+
+// UnsafeOIDCServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to OIDCServiceServer will
+// result in compilation errors.
+type UnsafeOIDCServiceServer interface {
+	mustEmbedUnimplementedOIDCServiceServer()
+}
+
+func RegisterOIDCServiceServer(s grpc.ServiceRegistrar, srv OIDCServiceServer) {
+	s.RegisterService(&OIDCService_ServiceDesc, srv)
+}
+
+func _OIDCService_Authenticate_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AuthenticateRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(OIDCServiceServer).Authenticate(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: OIDCService_Authenticate_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(OIDCServiceServer).Authenticate(ctx, req.(*AuthenticateRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// OIDCService_ServiceDesc is the grpc.ServiceDesc for OIDCService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var OIDCService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "oidc.OIDCService",
+	HandlerType: (*OIDCServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Authenticate",
+			Handler:    _OIDCService_Authenticate_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "omni/oidc/oidc.proto",
+}
diff --git a/client/api/omni/oidc/oidc_vtproto.pb.go b/client/api/omni/oidc/oidc_vtproto.pb.go
new file mode 100644
index 000000000..dc29e5bd4
--- /dev/null
+++ b/client/api/omni/oidc/oidc_vtproto.pb.go
@@ -0,0 +1,368 @@
+// Code generated by protoc-gen-go-vtproto. DO NOT EDIT.
+// protoc-gen-go-vtproto version: v0.6.0
+// source: omni/oidc/oidc.proto
+
+package oidc
+
+import (
+	fmt "fmt"
+	io "io"
+
+	protohelpers "github.com/planetscale/vtprotobuf/protohelpers"
+	proto "google.golang.org/protobuf/proto"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+func (m *AuthenticateRequest) CloneVT() *AuthenticateRequest {
+	if m == nil {
+		return (*AuthenticateRequest)(nil)
+	}
+	r := new(AuthenticateRequest)
+	r.AuthRequestId = m.AuthRequestId
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AuthenticateRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AuthenticateResponse) CloneVT() *AuthenticateResponse {
+	if m == nil {
+		return (*AuthenticateResponse)(nil)
+	}
+	r := new(AuthenticateResponse)
+	r.RedirectUrl = m.RedirectUrl
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AuthenticateResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (this *AuthenticateRequest) EqualVT(that *AuthenticateRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.AuthRequestId != that.AuthRequestId {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AuthenticateRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AuthenticateRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AuthenticateResponse) EqualVT(that *AuthenticateResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.RedirectUrl != that.RedirectUrl {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AuthenticateResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AuthenticateResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (m *AuthenticateRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AuthenticateRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AuthenticateRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.AuthRequestId) > 0 {
+		i -= len(m.AuthRequestId)
+		copy(dAtA[i:], m.AuthRequestId)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.AuthRequestId)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AuthenticateResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AuthenticateResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AuthenticateResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.RedirectUrl) > 0 {
+		i -= len(m.RedirectUrl)
+		copy(dAtA[i:], m.RedirectUrl)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.RedirectUrl)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AuthenticateRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.AuthRequestId)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AuthenticateResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.RedirectUrl)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AuthenticateRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AuthenticateRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AuthenticateRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AuthRequestId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AuthRequestId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AuthenticateResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AuthenticateResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AuthenticateResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RedirectUrl", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RedirectUrl = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/client/api/omni/resources/resources.pb.go b/client/api/omni/resources/resources.pb.go
new file mode 100644
index 000000000..e62bba205
--- /dev/null
+++ b/client/api/omni/resources/resources.pb.go
@@ -0,0 +1,1315 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.32.0
+// 	protoc        v4.24.4
+// source: omni/resources/resources.proto
+
+package resources
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	v1alpha1 "github.com/cosi-project/runtime/api/v1alpha1"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+
+	_ "github.com/siderolabs/omni/client/api/common"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type EventType int32
+
+const (
+	EventType_UNKNOWN      EventType = 0
+	EventType_CREATED      EventType = 1
+	EventType_UPDATED      EventType = 2
+	EventType_DESTROYED    EventType = 3
+	EventType_BOOTSTRAPPED EventType = 4
+)
+
+// Enum value maps for EventType.
+var (
+	EventType_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "CREATED",
+		2: "UPDATED",
+		3: "DESTROYED",
+		4: "BOOTSTRAPPED",
+	}
+	EventType_value = map[string]int32{
+		"UNKNOWN":      0,
+		"CREATED":      1,
+		"UPDATED":      2,
+		"DESTROYED":    3,
+		"BOOTSTRAPPED": 4,
+	}
+)
+
+func (x EventType) Enum() *EventType {
+	p := new(EventType)
+	*p = x
+	return p
+}
+
+func (x EventType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (EventType) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_resources_resources_proto_enumTypes[0].Descriptor()
+}
+
+func (EventType) Type() protoreflect.EnumType {
+	return &file_omni_resources_resources_proto_enumTypes[0]
+}
+
+func (x EventType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use EventType.Descriptor instead.
+func (EventType) EnumDescriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{0}
+}
+
+type Resource struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Metadata *v1alpha1.Metadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	Spec     string             `protobuf:"bytes,2,opt,name=spec,proto3" json:"spec,omitempty"`
+}
+
+func (x *Resource) Reset() {
+	*x = Resource{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_resources_resources_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Resource) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Resource) ProtoMessage() {}
+
+func (x *Resource) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_resources_resources_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Resource.ProtoReflect.Descriptor instead.
+func (*Resource) Descriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Resource) GetMetadata() *v1alpha1.Metadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *Resource) GetSpec() string {
+	if x != nil {
+		return x.Spec
+	}
+	return ""
+}
+
+type GetRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Namespace string `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	Type      string `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
+	Id        string `protobuf:"bytes,3,opt,name=id,proto3" json:"id,omitempty"`
+}
+
+func (x *GetRequest) Reset() {
+	*x = GetRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_resources_resources_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetRequest) ProtoMessage() {}
+
+func (x *GetRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_resources_resources_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetRequest.ProtoReflect.Descriptor instead.
+func (*GetRequest) Descriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *GetRequest) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+func (x *GetRequest) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *GetRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+type GetResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Body should contain JSON encoded spec.
+	Body string `protobuf:"bytes,1,opt,name=body,proto3" json:"body,omitempty"`
+}
+
+func (x *GetResponse) Reset() {
+	*x = GetResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_resources_resources_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetResponse) ProtoMessage() {}
+
+func (x *GetResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_resources_resources_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetResponse.ProtoReflect.Descriptor instead.
+func (*GetResponse) Descriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *GetResponse) GetBody() string {
+	if x != nil {
+		return x.Body
+	}
+	return ""
+}
+
+type ListRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Namespace      string   `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	Type           string   `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
+	Offset         int32    `protobuf:"varint,3,opt,name=offset,proto3" json:"offset,omitempty"`
+	Limit          int32    `protobuf:"varint,4,opt,name=limit,proto3" json:"limit,omitempty"`
+	SortByField    string   `protobuf:"bytes,5,opt,name=sort_by_field,json=sortByField,proto3" json:"sort_by_field,omitempty"`
+	SortDescending bool     `protobuf:"varint,6,opt,name=sort_descending,json=sortDescending,proto3" json:"sort_descending,omitempty"`
+	SearchFor      []string `protobuf:"bytes,7,rep,name=search_for,json=searchFor,proto3" json:"search_for,omitempty"`
+}
+
+func (x *ListRequest) Reset() {
+	*x = ListRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_resources_resources_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListRequest) ProtoMessage() {}
+
+func (x *ListRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_resources_resources_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListRequest.ProtoReflect.Descriptor instead.
+func (*ListRequest) Descriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ListRequest) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+func (x *ListRequest) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *ListRequest) GetOffset() int32 {
+	if x != nil {
+		return x.Offset
+	}
+	return 0
+}
+
+func (x *ListRequest) GetLimit() int32 {
+	if x != nil {
+		return x.Limit
+	}
+	return 0
+}
+
+func (x *ListRequest) GetSortByField() string {
+	if x != nil {
+		return x.SortByField
+	}
+	return ""
+}
+
+func (x *ListRequest) GetSortDescending() bool {
+	if x != nil {
+		return x.SortDescending
+	}
+	return false
+}
+
+func (x *ListRequest) GetSearchFor() []string {
+	if x != nil {
+		return x.SearchFor
+	}
+	return nil
+}
+
+type ListResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Items should contain JSON encoded resources.
+	Items []string `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
+	Total int32    `protobuf:"varint,2,opt,name=total,proto3" json:"total,omitempty"`
+}
+
+func (x *ListResponse) Reset() {
+	*x = ListResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_resources_resources_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListResponse) ProtoMessage() {}
+
+func (x *ListResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_resources_resources_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListResponse.ProtoReflect.Descriptor instead.
+func (*ListResponse) Descriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ListResponse) GetItems() []string {
+	if x != nil {
+		return x.Items
+	}
+	return nil
+}
+
+func (x *ListResponse) GetTotal() int32 {
+	if x != nil {
+		return x.Total
+	}
+	return 0
+}
+
+// Event is emitted when resource changes.
+// It's the same as COSI Event, but encodes resources into JSON.
+type Event struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Resource  string    `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
+	Old       string    `protobuf:"bytes,2,opt,name=old,proto3" json:"old,omitempty"`
+	EventType EventType `protobuf:"varint,3,opt,name=event_type,json=eventType,proto3,enum=omni.resources.EventType" json:"event_type,omitempty"`
+}
+
+func (x *Event) Reset() {
+	*x = Event{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_resources_resources_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Event) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Event) ProtoMessage() {}
+
+func (x *Event) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_resources_resources_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Event.ProtoReflect.Descriptor instead.
+func (*Event) Descriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *Event) GetResource() string {
+	if x != nil {
+		return x.Resource
+	}
+	return ""
+}
+
+func (x *Event) GetOld() string {
+	if x != nil {
+		return x.Old
+	}
+	return ""
+}
+
+func (x *Event) GetEventType() EventType {
+	if x != nil {
+		return x.EventType
+	}
+	return EventType_UNKNOWN
+}
+
+type WatchRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Namespace      string   `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	Type           string   `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
+	Id             string   `protobuf:"bytes,3,opt,name=id,proto3" json:"id,omitempty"`
+	TailEvents     int32    `protobuf:"varint,4,opt,name=tail_events,json=tailEvents,proto3" json:"tail_events,omitempty"`
+	Offset         int32    `protobuf:"varint,5,opt,name=offset,proto3" json:"offset,omitempty"`
+	Limit          int32    `protobuf:"varint,6,opt,name=limit,proto3" json:"limit,omitempty"`
+	SortByField    string   `protobuf:"bytes,7,opt,name=sort_by_field,json=sortByField,proto3" json:"sort_by_field,omitempty"`
+	SortDescending bool     `protobuf:"varint,8,opt,name=sort_descending,json=sortDescending,proto3" json:"sort_descending,omitempty"`
+	SearchFor      []string `protobuf:"bytes,9,rep,name=search_for,json=searchFor,proto3" json:"search_for,omitempty"`
+}
+
+func (x *WatchRequest) Reset() {
+	*x = WatchRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_resources_resources_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WatchRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WatchRequest) ProtoMessage() {}
+
+func (x *WatchRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_resources_resources_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WatchRequest.ProtoReflect.Descriptor instead.
+func (*WatchRequest) Descriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *WatchRequest) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+func (x *WatchRequest) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *WatchRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *WatchRequest) GetTailEvents() int32 {
+	if x != nil {
+		return x.TailEvents
+	}
+	return 0
+}
+
+func (x *WatchRequest) GetOffset() int32 {
+	if x != nil {
+		return x.Offset
+	}
+	return 0
+}
+
+func (x *WatchRequest) GetLimit() int32 {
+	if x != nil {
+		return x.Limit
+	}
+	return 0
+}
+
+func (x *WatchRequest) GetSortByField() string {
+	if x != nil {
+		return x.SortByField
+	}
+	return ""
+}
+
+func (x *WatchRequest) GetSortDescending() bool {
+	if x != nil {
+		return x.SortDescending
+	}
+	return false
+}
+
+func (x *WatchRequest) GetSearchFor() []string {
+	if x != nil {
+		return x.SearchFor
+	}
+	return nil
+}
+
+type WatchResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Event          *Event `protobuf:"bytes,1,opt,name=event,proto3" json:"event,omitempty"`
+	Total          int32  `protobuf:"varint,2,opt,name=total,proto3" json:"total,omitempty"`
+	SortFieldData  string `protobuf:"bytes,3,opt,name=sort_field_data,json=sortFieldData,proto3" json:"sort_field_data,omitempty"`
+	SortDescending bool   `protobuf:"varint,4,opt,name=sort_descending,json=sortDescending,proto3" json:"sort_descending,omitempty"`
+}
+
+func (x *WatchResponse) Reset() {
+	*x = WatchResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_resources_resources_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WatchResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WatchResponse) ProtoMessage() {}
+
+func (x *WatchResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_resources_resources_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WatchResponse.ProtoReflect.Descriptor instead.
+func (*WatchResponse) Descriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *WatchResponse) GetEvent() *Event {
+	if x != nil {
+		return x.Event
+	}
+	return nil
+}
+
+func (x *WatchResponse) GetTotal() int32 {
+	if x != nil {
+		return x.Total
+	}
+	return 0
+}
+
+func (x *WatchResponse) GetSortFieldData() string {
+	if x != nil {
+		return x.SortFieldData
+	}
+	return ""
+}
+
+func (x *WatchResponse) GetSortDescending() bool {
+	if x != nil {
+		return x.SortDescending
+	}
+	return false
+}
+
+type CreateRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Resource *Resource `protobuf:"bytes,1,opt,name=resource,proto3" json:"resource,omitempty"`
+}
+
+func (x *CreateRequest) Reset() {
+	*x = CreateRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_resources_resources_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateRequest) ProtoMessage() {}
+
+func (x *CreateRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_resources_resources_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateRequest.ProtoReflect.Descriptor instead.
+func (*CreateRequest) Descriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *CreateRequest) GetResource() *Resource {
+	if x != nil {
+		return x.Resource
+	}
+	return nil
+}
+
+type CreateResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *CreateResponse) Reset() {
+	*x = CreateResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_resources_resources_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateResponse) ProtoMessage() {}
+
+func (x *CreateResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_resources_resources_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateResponse.ProtoReflect.Descriptor instead.
+func (*CreateResponse) Descriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{9}
+}
+
+type UpdateRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	CurrentVersion string    `protobuf:"bytes,1,opt,name=currentVersion,proto3" json:"currentVersion,omitempty"`
+	Resource       *Resource `protobuf:"bytes,2,opt,name=resource,proto3" json:"resource,omitempty"`
+}
+
+func (x *UpdateRequest) Reset() {
+	*x = UpdateRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_resources_resources_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateRequest) ProtoMessage() {}
+
+func (x *UpdateRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_resources_resources_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateRequest.ProtoReflect.Descriptor instead.
+func (*UpdateRequest) Descriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *UpdateRequest) GetCurrentVersion() string {
+	if x != nil {
+		return x.CurrentVersion
+	}
+	return ""
+}
+
+func (x *UpdateRequest) GetResource() *Resource {
+	if x != nil {
+		return x.Resource
+	}
+	return nil
+}
+
+type UpdateResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *UpdateResponse) Reset() {
+	*x = UpdateResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_resources_resources_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateResponse) ProtoMessage() {}
+
+func (x *UpdateResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_resources_resources_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateResponse.ProtoReflect.Descriptor instead.
+func (*UpdateResponse) Descriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{11}
+}
+
+type DeleteRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Namespace string `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	Type      string `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
+	Id        string `protobuf:"bytes,3,opt,name=id,proto3" json:"id,omitempty"`
+}
+
+func (x *DeleteRequest) Reset() {
+	*x = DeleteRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_resources_resources_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DeleteRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteRequest) ProtoMessage() {}
+
+func (x *DeleteRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_resources_resources_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteRequest.ProtoReflect.Descriptor instead.
+func (*DeleteRequest) Descriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *DeleteRequest) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+func (x *DeleteRequest) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *DeleteRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+type DeleteResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *DeleteResponse) Reset() {
+	*x = DeleteResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_resources_resources_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DeleteResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteResponse) ProtoMessage() {}
+
+func (x *DeleteResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_resources_resources_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteResponse.ProtoReflect.Descriptor instead.
+func (*DeleteResponse) Descriptor() ([]byte, []int) {
+	return file_omni_resources_resources_proto_rawDescGZIP(), []int{13}
+}
+
+var File_omni_resources_resources_proto protoreflect.FileDescriptor
+
+var file_omni_resources_resources_proto_rawDesc = []byte{
+	0x0a, 0x1e, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x12, 0x0e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x1a, 0x11, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2f, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x1a, 0x17, 0x76, 0x31, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2f, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x53, 0x0a, 0x08,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x33, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x73,
+	0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64,
+	0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x12, 0x0a,
+	0x04, 0x73, 0x70, 0x65, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x73, 0x70, 0x65,
+	0x63, 0x22, 0x4e, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x1c, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x12, 0x0a,
+	0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
+	0x64, 0x22, 0x21, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x12, 0x0a, 0x04, 0x62, 0x6f, 0x64, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x62, 0x6f, 0x64, 0x79, 0x22, 0xd9, 0x01, 0x0a, 0x0b, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6f, 0x66, 0x66, 0x73, 0x65, 0x74,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6f, 0x66, 0x66, 0x73, 0x65, 0x74, 0x12, 0x14,
+	0x0a, 0x05, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x6c,
+	0x69, 0x6d, 0x69, 0x74, 0x12, 0x22, 0x0a, 0x0d, 0x73, 0x6f, 0x72, 0x74, 0x5f, 0x62, 0x79, 0x5f,
+	0x66, 0x69, 0x65, 0x6c, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x6f, 0x72,
+	0x74, 0x42, 0x79, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x27, 0x0a, 0x0f, 0x73, 0x6f, 0x72, 0x74,
+	0x5f, 0x64, 0x65, 0x73, 0x63, 0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0e, 0x73, 0x6f, 0x72, 0x74, 0x44, 0x65, 0x73, 0x63, 0x65, 0x6e, 0x64, 0x69, 0x6e,
+	0x67, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x5f, 0x66, 0x6f, 0x72, 0x18,
+	0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x46, 0x6f, 0x72,
+	0x22, 0x3a, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x14, 0x0a, 0x05, 0x69, 0x74, 0x65, 0x6d, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52,
+	0x05, 0x69, 0x74, 0x65, 0x6d, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x22, 0x6f, 0x0a, 0x05,
+	0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x12, 0x10, 0x0a, 0x03, 0x6f, 0x6c, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
+	0x6f, 0x6c, 0x64, 0x12, 0x38, 0x0a, 0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x79, 0x70,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x54, 0x79,
+	0x70, 0x65, 0x52, 0x09, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x22, 0x8b, 0x02,
+	0x0a, 0x0c, 0x57, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1c,
+	0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
+	0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x61, 0x69, 0x6c, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0a, 0x74, 0x61, 0x69, 0x6c, 0x45, 0x76, 0x65, 0x6e, 0x74,
+	0x73, 0x12, 0x16, 0x0a, 0x06, 0x6f, 0x66, 0x66, 0x73, 0x65, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x06, 0x6f, 0x66, 0x66, 0x73, 0x65, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x6c, 0x69, 0x6d,
+	0x69, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12,
+	0x22, 0x0a, 0x0d, 0x73, 0x6f, 0x72, 0x74, 0x5f, 0x62, 0x79, 0x5f, 0x66, 0x69, 0x65, 0x6c, 0x64,
+	0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x6f, 0x72, 0x74, 0x42, 0x79, 0x46, 0x69,
+	0x65, 0x6c, 0x64, 0x12, 0x27, 0x0a, 0x0f, 0x73, 0x6f, 0x72, 0x74, 0x5f, 0x64, 0x65, 0x73, 0x63,
+	0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x73, 0x6f,
+	0x72, 0x74, 0x44, 0x65, 0x73, 0x63, 0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x12, 0x1d, 0x0a, 0x0a,
+	0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x5f, 0x66, 0x6f, 0x72, 0x18, 0x09, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x09, 0x73, 0x65, 0x61, 0x72, 0x63, 0x68, 0x46, 0x6f, 0x72, 0x22, 0xa3, 0x01, 0x0a, 0x0d,
+	0x57, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2b, 0x0a,
+	0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x6f,
+	0x6d, 0x6e, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x45, 0x76,
+	0x65, 0x6e, 0x74, 0x52, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f,
+	0x74, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x05, 0x74, 0x6f, 0x74, 0x61, 0x6c,
+	0x12, 0x26, 0x0a, 0x0f, 0x73, 0x6f, 0x72, 0x74, 0x5f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f, 0x64,
+	0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x73, 0x6f, 0x72, 0x74, 0x46,
+	0x69, 0x65, 0x6c, 0x64, 0x44, 0x61, 0x74, 0x61, 0x12, 0x27, 0x0a, 0x0f, 0x73, 0x6f, 0x72, 0x74,
+	0x5f, 0x64, 0x65, 0x73, 0x63, 0x65, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0e, 0x73, 0x6f, 0x72, 0x74, 0x44, 0x65, 0x73, 0x63, 0x65, 0x6e, 0x64, 0x69, 0x6e,
+	0x67, 0x22, 0x45, 0x0a, 0x0d, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x34, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x08,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x10, 0x0a, 0x0e, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x6d, 0x0a, 0x0d, 0x55, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x26, 0x0a, 0x0e, 0x63,
+	0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x56, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x12, 0x34, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52,
+	0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x22, 0x10, 0x0a, 0x0e, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x51, 0x0a, 0x0d, 0x44,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1c, 0x0a, 0x09,
+	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79,
+	0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x0e,
+	0x0a, 0x02, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x10,
+	0x0a, 0x0e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x2a, 0x53, 0x0a, 0x09, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a,
+	0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x43, 0x52,
+	0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x01, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x50, 0x44, 0x41, 0x54,
+	0x45, 0x44, 0x10, 0x02, 0x12, 0x0d, 0x0a, 0x09, 0x44, 0x45, 0x53, 0x54, 0x52, 0x4f, 0x59, 0x45,
+	0x44, 0x10, 0x03, 0x12, 0x10, 0x0a, 0x0c, 0x42, 0x4f, 0x4f, 0x54, 0x53, 0x54, 0x52, 0x41, 0x50,
+	0x50, 0x45, 0x44, 0x10, 0x04, 0x32, 0x82, 0x04, 0x0a, 0x0f, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x3e, 0x0a, 0x03, 0x47, 0x65, 0x74,
+	0x12, 0x1a, 0x2e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x73, 0x2e, 0x47, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x6f,
+	0x6d, 0x6e, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x47, 0x65,
+	0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x04, 0x4c, 0x69, 0x73,
+	0x74, 0x12, 0x1b, 0x2e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c,
+	0x2e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e,
+	0x4c, 0x69, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x47, 0x0a, 0x06,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x12, 0x1d, 0x2e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x47, 0x0a, 0x06, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12,
+	0x1d, 0x2e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e,
+	0x2e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x47,
+	0x0a, 0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x1d, 0x2e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x49, 0x0a, 0x08, 0x54, 0x65, 0x61, 0x72, 0x64,
+	0x6f, 0x77, 0x6e, 0x12, 0x1d, 0x2e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x73, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x12, 0x46, 0x0a, 0x05, 0x57, 0x61, 0x74, 0x63, 0x68, 0x12, 0x1c, 0x2e, 0x6f, 0x6d,
+	0x6e, 0x69, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x57, 0x61, 0x74,
+	0x63, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x6f, 0x6d, 0x6e, 0x69,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x2e, 0x57, 0x61, 0x74, 0x63, 0x68,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x30, 0x01, 0x42, 0x36, 0x5a, 0x34, 0x67, 0x69,
+	0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x64, 0x65, 0x72, 0x6f, 0x6c,
+	0x61, 0x62, 0x73, 0x2f, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2f,
+	0x61, 0x70, 0x69, 0x2f, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_omni_resources_resources_proto_rawDescOnce sync.Once
+	file_omni_resources_resources_proto_rawDescData = file_omni_resources_resources_proto_rawDesc
+)
+
+func file_omni_resources_resources_proto_rawDescGZIP() []byte {
+	file_omni_resources_resources_proto_rawDescOnce.Do(func() {
+		file_omni_resources_resources_proto_rawDescData = protoimpl.X.CompressGZIP(file_omni_resources_resources_proto_rawDescData)
+	})
+	return file_omni_resources_resources_proto_rawDescData
+}
+
+var file_omni_resources_resources_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_omni_resources_resources_proto_msgTypes = make([]protoimpl.MessageInfo, 14)
+var file_omni_resources_resources_proto_goTypes = []interface{}{
+	(EventType)(0),            // 0: omni.resources.EventType
+	(*Resource)(nil),          // 1: omni.resources.Resource
+	(*GetRequest)(nil),        // 2: omni.resources.GetRequest
+	(*GetResponse)(nil),       // 3: omni.resources.GetResponse
+	(*ListRequest)(nil),       // 4: omni.resources.ListRequest
+	(*ListResponse)(nil),      // 5: omni.resources.ListResponse
+	(*Event)(nil),             // 6: omni.resources.Event
+	(*WatchRequest)(nil),      // 7: omni.resources.WatchRequest
+	(*WatchResponse)(nil),     // 8: omni.resources.WatchResponse
+	(*CreateRequest)(nil),     // 9: omni.resources.CreateRequest
+	(*CreateResponse)(nil),    // 10: omni.resources.CreateResponse
+	(*UpdateRequest)(nil),     // 11: omni.resources.UpdateRequest
+	(*UpdateResponse)(nil),    // 12: omni.resources.UpdateResponse
+	(*DeleteRequest)(nil),     // 13: omni.resources.DeleteRequest
+	(*DeleteResponse)(nil),    // 14: omni.resources.DeleteResponse
+	(*v1alpha1.Metadata)(nil), // 15: cosi.resource.Metadata
+}
+var file_omni_resources_resources_proto_depIdxs = []int32{
+	15, // 0: omni.resources.Resource.metadata:type_name -> cosi.resource.Metadata
+	0,  // 1: omni.resources.Event.event_type:type_name -> omni.resources.EventType
+	6,  // 2: omni.resources.WatchResponse.event:type_name -> omni.resources.Event
+	1,  // 3: omni.resources.CreateRequest.resource:type_name -> omni.resources.Resource
+	1,  // 4: omni.resources.UpdateRequest.resource:type_name -> omni.resources.Resource
+	2,  // 5: omni.resources.ResourceService.Get:input_type -> omni.resources.GetRequest
+	4,  // 6: omni.resources.ResourceService.List:input_type -> omni.resources.ListRequest
+	9,  // 7: omni.resources.ResourceService.Create:input_type -> omni.resources.CreateRequest
+	11, // 8: omni.resources.ResourceService.Update:input_type -> omni.resources.UpdateRequest
+	13, // 9: omni.resources.ResourceService.Delete:input_type -> omni.resources.DeleteRequest
+	13, // 10: omni.resources.ResourceService.Teardown:input_type -> omni.resources.DeleteRequest
+	7,  // 11: omni.resources.ResourceService.Watch:input_type -> omni.resources.WatchRequest
+	3,  // 12: omni.resources.ResourceService.Get:output_type -> omni.resources.GetResponse
+	5,  // 13: omni.resources.ResourceService.List:output_type -> omni.resources.ListResponse
+	10, // 14: omni.resources.ResourceService.Create:output_type -> omni.resources.CreateResponse
+	12, // 15: omni.resources.ResourceService.Update:output_type -> omni.resources.UpdateResponse
+	14, // 16: omni.resources.ResourceService.Delete:output_type -> omni.resources.DeleteResponse
+	14, // 17: omni.resources.ResourceService.Teardown:output_type -> omni.resources.DeleteResponse
+	8,  // 18: omni.resources.ResourceService.Watch:output_type -> omni.resources.WatchResponse
+	12, // [12:19] is the sub-list for method output_type
+	5,  // [5:12] is the sub-list for method input_type
+	5,  // [5:5] is the sub-list for extension type_name
+	5,  // [5:5] is the sub-list for extension extendee
+	0,  // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_omni_resources_resources_proto_init() }
+func file_omni_resources_resources_proto_init() {
+	if File_omni_resources_resources_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_omni_resources_resources_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Resource); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_resources_resources_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_resources_resources_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_resources_resources_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_resources_resources_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_resources_resources_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Event); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_resources_resources_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WatchRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_resources_resources_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WatchResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_resources_resources_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_resources_resources_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_resources_resources_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdateRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_resources_resources_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdateResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_resources_resources_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DeleteRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_resources_resources_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DeleteResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_omni_resources_resources_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   14,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_omni_resources_resources_proto_goTypes,
+		DependencyIndexes: file_omni_resources_resources_proto_depIdxs,
+		EnumInfos:         file_omni_resources_resources_proto_enumTypes,
+		MessageInfos:      file_omni_resources_resources_proto_msgTypes,
+	}.Build()
+	File_omni_resources_resources_proto = out.File
+	file_omni_resources_resources_proto_rawDesc = nil
+	file_omni_resources_resources_proto_goTypes = nil
+	file_omni_resources_resources_proto_depIdxs = nil
+}
diff --git a/client/api/omni/resources/resources.pb.gw.go b/client/api/omni/resources/resources.pb.gw.go
new file mode 100644
index 000000000..cfe027261
--- /dev/null
+++ b/client/api/omni/resources/resources.pb.gw.go
@@ -0,0 +1,602 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: omni/resources/resources.proto
+
+/*
+Package resources is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package resources
+
+import (
+	"context"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+)
+
+// Suppress "imported and not used" errors
+var _ codes.Code
+var _ io.Reader
+var _ status.Status
+var _ = runtime.String
+var _ = utilities.NewDoubleArray
+var _ = metadata.Join
+
+func request_ResourceService_Get_0(ctx context.Context, marshaler runtime.Marshaler, client ResourceServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq GetRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Get(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ResourceService_Get_0(ctx context.Context, marshaler runtime.Marshaler, server ResourceServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq GetRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Get(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ResourceService_List_0(ctx context.Context, marshaler runtime.Marshaler, client ResourceServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq ListRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.List(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ResourceService_List_0(ctx context.Context, marshaler runtime.Marshaler, server ResourceServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq ListRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.List(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ResourceService_Create_0(ctx context.Context, marshaler runtime.Marshaler, client ResourceServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq CreateRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Create(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ResourceService_Create_0(ctx context.Context, marshaler runtime.Marshaler, server ResourceServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq CreateRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Create(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ResourceService_Update_0(ctx context.Context, marshaler runtime.Marshaler, client ResourceServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq UpdateRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Update(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ResourceService_Update_0(ctx context.Context, marshaler runtime.Marshaler, server ResourceServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq UpdateRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Update(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ResourceService_Delete_0(ctx context.Context, marshaler runtime.Marshaler, client ResourceServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq DeleteRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Delete(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ResourceService_Delete_0(ctx context.Context, marshaler runtime.Marshaler, server ResourceServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq DeleteRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Delete(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ResourceService_Teardown_0(ctx context.Context, marshaler runtime.Marshaler, client ResourceServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq DeleteRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Teardown(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_ResourceService_Teardown_0(ctx context.Context, marshaler runtime.Marshaler, server ResourceServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq DeleteRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Teardown(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_ResourceService_Watch_0(ctx context.Context, marshaler runtime.Marshaler, client ResourceServiceClient, req *http.Request, pathParams map[string]string) (ResourceService_WatchClient, runtime.ServerMetadata, error) {
+	var protoReq WatchRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	stream, err := client.Watch(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+
+}
+
+// RegisterResourceServiceHandlerServer registers the http handlers for service ResourceService to "mux".
+// UnaryRPC     :call ResourceServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterResourceServiceHandlerFromEndpoint instead.
+func RegisterResourceServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server ResourceServiceServer) error {
+
+	mux.Handle("POST", pattern_ResourceService_Get_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/omni.resources.ResourceService/Get", runtime.WithHTTPPathPattern("/omni.resources.ResourceService/Get"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ResourceService_Get_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ResourceService_Get_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ResourceService_List_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/omni.resources.ResourceService/List", runtime.WithHTTPPathPattern("/omni.resources.ResourceService/List"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ResourceService_List_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ResourceService_List_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ResourceService_Create_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/omni.resources.ResourceService/Create", runtime.WithHTTPPathPattern("/omni.resources.ResourceService/Create"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ResourceService_Create_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ResourceService_Create_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ResourceService_Update_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/omni.resources.ResourceService/Update", runtime.WithHTTPPathPattern("/omni.resources.ResourceService/Update"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ResourceService_Update_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ResourceService_Update_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ResourceService_Delete_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/omni.resources.ResourceService/Delete", runtime.WithHTTPPathPattern("/omni.resources.ResourceService/Delete"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ResourceService_Delete_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ResourceService_Delete_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ResourceService_Teardown_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/omni.resources.ResourceService/Teardown", runtime.WithHTTPPathPattern("/omni.resources.ResourceService/Teardown"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_ResourceService_Teardown_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ResourceService_Teardown_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ResourceService_Watch_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	return nil
+}
+
+// RegisterResourceServiceHandlerFromEndpoint is same as RegisterResourceServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterResourceServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.DialContext(ctx, endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+
+	return RegisterResourceServiceHandler(ctx, mux, conn)
+}
+
+// RegisterResourceServiceHandler registers the http handlers for service ResourceService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterResourceServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterResourceServiceHandlerClient(ctx, mux, NewResourceServiceClient(conn))
+}
+
+// RegisterResourceServiceHandlerClient registers the http handlers for service ResourceService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "ResourceServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "ResourceServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "ResourceServiceClient" to call the correct interceptors.
+func RegisterResourceServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client ResourceServiceClient) error {
+
+	mux.Handle("POST", pattern_ResourceService_Get_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/omni.resources.ResourceService/Get", runtime.WithHTTPPathPattern("/omni.resources.ResourceService/Get"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ResourceService_Get_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ResourceService_Get_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ResourceService_List_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/omni.resources.ResourceService/List", runtime.WithHTTPPathPattern("/omni.resources.ResourceService/List"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ResourceService_List_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ResourceService_List_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ResourceService_Create_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/omni.resources.ResourceService/Create", runtime.WithHTTPPathPattern("/omni.resources.ResourceService/Create"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ResourceService_Create_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ResourceService_Create_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ResourceService_Update_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/omni.resources.ResourceService/Update", runtime.WithHTTPPathPattern("/omni.resources.ResourceService/Update"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ResourceService_Update_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ResourceService_Update_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ResourceService_Delete_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/omni.resources.ResourceService/Delete", runtime.WithHTTPPathPattern("/omni.resources.ResourceService/Delete"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ResourceService_Delete_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ResourceService_Delete_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ResourceService_Teardown_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/omni.resources.ResourceService/Teardown", runtime.WithHTTPPathPattern("/omni.resources.ResourceService/Teardown"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ResourceService_Teardown_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ResourceService_Teardown_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_ResourceService_Watch_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/omni.resources.ResourceService/Watch", runtime.WithHTTPPathPattern("/omni.resources.ResourceService/Watch"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_ResourceService_Watch_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_ResourceService_Watch_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+
+	})
+
+	return nil
+}
+
+var (
+	pattern_ResourceService_Get_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"omni.resources.ResourceService", "Get"}, ""))
+
+	pattern_ResourceService_List_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"omni.resources.ResourceService", "List"}, ""))
+
+	pattern_ResourceService_Create_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"omni.resources.ResourceService", "Create"}, ""))
+
+	pattern_ResourceService_Update_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"omni.resources.ResourceService", "Update"}, ""))
+
+	pattern_ResourceService_Delete_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"omni.resources.ResourceService", "Delete"}, ""))
+
+	pattern_ResourceService_Teardown_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"omni.resources.ResourceService", "Teardown"}, ""))
+
+	pattern_ResourceService_Watch_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"omni.resources.ResourceService", "Watch"}, ""))
+)
+
+var (
+	forward_ResourceService_Get_0 = runtime.ForwardResponseMessage
+
+	forward_ResourceService_List_0 = runtime.ForwardResponseMessage
+
+	forward_ResourceService_Create_0 = runtime.ForwardResponseMessage
+
+	forward_ResourceService_Update_0 = runtime.ForwardResponseMessage
+
+	forward_ResourceService_Delete_0 = runtime.ForwardResponseMessage
+
+	forward_ResourceService_Teardown_0 = runtime.ForwardResponseMessage
+
+	forward_ResourceService_Watch_0 = runtime.ForwardResponseStream
+)
diff --git a/client/api/omni/resources/resources.proto b/client/api/omni/resources/resources.proto
new file mode 100644
index 000000000..47cebcf08
--- /dev/null
+++ b/client/api/omni/resources/resources.proto
@@ -0,0 +1,108 @@
+syntax = "proto3";
+package omni.resources;
+
+option go_package = "github.com/siderolabs/omni/client/api/omni/resources";
+
+import "common/omni.proto";
+import "v1alpha1/resource.proto";
+
+message Resource {
+  cosi.resource.Metadata metadata = 1;
+  string spec = 2;
+}
+
+message GetRequest {
+  string namespace = 1;
+  string type = 2;
+  string id = 3;
+}
+
+message GetResponse {
+  // Body should contain JSON encoded spec.
+  string body = 1;
+}
+
+message ListRequest {
+  string namespace = 1;
+  string type = 2;
+  int32 offset = 3;
+  int32 limit = 4;
+  string sort_by_field = 5;
+  bool sort_descending = 6;
+  repeated string search_for = 7;
+}
+
+message ListResponse {
+  // Items should contain JSON encoded resources.
+  repeated string items = 1;
+  int32 total = 2;
+}
+
+enum EventType {
+  UNKNOWN = 0;
+  CREATED = 1;
+  UPDATED = 2;
+  DESTROYED = 3;
+  BOOTSTRAPPED = 4;
+}
+
+// Event is emitted when resource changes.
+// It's the same as COSI Event, but encodes resources into JSON.
+message Event {
+    string resource = 1;
+    string old = 2;
+    EventType event_type = 3;
+}
+
+message WatchRequest {
+  string namespace = 1;
+  string type = 2;
+  string id = 3;
+  int32 tail_events = 4;
+  int32 offset = 5;
+  int32 limit = 6;
+  string sort_by_field = 7;
+  bool sort_descending = 8;
+  repeated string search_for = 9;
+}
+
+message WatchResponse {
+  Event event = 1;
+  int32 total = 2;
+  string sort_field_data = 3;
+  bool sort_descending = 4;
+}
+
+message CreateRequest {
+  Resource resource = 1;
+}
+
+message CreateResponse {
+}
+
+message UpdateRequest {
+  string currentVersion = 1;
+  Resource resource = 2;
+}
+
+message UpdateResponse {
+}
+
+message DeleteRequest {
+  string namespace = 1;
+  string type = 2;
+  string id = 3;
+}
+
+message DeleteResponse {
+}
+
+service ResourceService {
+  rpc Get(GetRequest) returns (GetResponse);
+  rpc List(ListRequest) returns (ListResponse);
+  rpc Create(CreateRequest) returns (CreateResponse);
+  rpc Update(UpdateRequest) returns (UpdateResponse);
+  rpc Delete(DeleteRequest) returns (DeleteResponse);
+  rpc Teardown(DeleteRequest) returns (DeleteResponse);
+  rpc Watch(WatchRequest) returns (stream WatchResponse);
+}
diff --git a/client/api/omni/resources/resources_grpc.pb.go b/client/api/omni/resources/resources_grpc.pb.go
new file mode 100644
index 000000000..bd4c5a3f4
--- /dev/null
+++ b/client/api/omni/resources/resources_grpc.pb.go
@@ -0,0 +1,360 @@
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             v4.24.4
+// source: omni/resources/resources.proto
+
+package resources
+
+import (
+	context "context"
+
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	ResourceService_Get_FullMethodName      = "/omni.resources.ResourceService/Get"
+	ResourceService_List_FullMethodName     = "/omni.resources.ResourceService/List"
+	ResourceService_Create_FullMethodName   = "/omni.resources.ResourceService/Create"
+	ResourceService_Update_FullMethodName   = "/omni.resources.ResourceService/Update"
+	ResourceService_Delete_FullMethodName   = "/omni.resources.ResourceService/Delete"
+	ResourceService_Teardown_FullMethodName = "/omni.resources.ResourceService/Teardown"
+	ResourceService_Watch_FullMethodName    = "/omni.resources.ResourceService/Watch"
+)
+
+// ResourceServiceClient is the client API for ResourceService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type ResourceServiceClient interface {
+	Get(ctx context.Context, in *GetRequest, opts ...grpc.CallOption) (*GetResponse, error)
+	List(ctx context.Context, in *ListRequest, opts ...grpc.CallOption) (*ListResponse, error)
+	Create(ctx context.Context, in *CreateRequest, opts ...grpc.CallOption) (*CreateResponse, error)
+	Update(ctx context.Context, in *UpdateRequest, opts ...grpc.CallOption) (*UpdateResponse, error)
+	Delete(ctx context.Context, in *DeleteRequest, opts ...grpc.CallOption) (*DeleteResponse, error)
+	Teardown(ctx context.Context, in *DeleteRequest, opts ...grpc.CallOption) (*DeleteResponse, error)
+	Watch(ctx context.Context, in *WatchRequest, opts ...grpc.CallOption) (ResourceService_WatchClient, error)
+}
+
+type resourceServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewResourceServiceClient(cc grpc.ClientConnInterface) ResourceServiceClient {
+	return &resourceServiceClient{cc}
+}
+
+func (c *resourceServiceClient) Get(ctx context.Context, in *GetRequest, opts ...grpc.CallOption) (*GetResponse, error) {
+	out := new(GetResponse)
+	err := c.cc.Invoke(ctx, ResourceService_Get_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *resourceServiceClient) List(ctx context.Context, in *ListRequest, opts ...grpc.CallOption) (*ListResponse, error) {
+	out := new(ListResponse)
+	err := c.cc.Invoke(ctx, ResourceService_List_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *resourceServiceClient) Create(ctx context.Context, in *CreateRequest, opts ...grpc.CallOption) (*CreateResponse, error) {
+	out := new(CreateResponse)
+	err := c.cc.Invoke(ctx, ResourceService_Create_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *resourceServiceClient) Update(ctx context.Context, in *UpdateRequest, opts ...grpc.CallOption) (*UpdateResponse, error) {
+	out := new(UpdateResponse)
+	err := c.cc.Invoke(ctx, ResourceService_Update_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *resourceServiceClient) Delete(ctx context.Context, in *DeleteRequest, opts ...grpc.CallOption) (*DeleteResponse, error) {
+	out := new(DeleteResponse)
+	err := c.cc.Invoke(ctx, ResourceService_Delete_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *resourceServiceClient) Teardown(ctx context.Context, in *DeleteRequest, opts ...grpc.CallOption) (*DeleteResponse, error) {
+	out := new(DeleteResponse)
+	err := c.cc.Invoke(ctx, ResourceService_Teardown_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *resourceServiceClient) Watch(ctx context.Context, in *WatchRequest, opts ...grpc.CallOption) (ResourceService_WatchClient, error) {
+	stream, err := c.cc.NewStream(ctx, &ResourceService_ServiceDesc.Streams[0], ResourceService_Watch_FullMethodName, opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &resourceServiceWatchClient{stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type ResourceService_WatchClient interface {
+	Recv() (*WatchResponse, error)
+	grpc.ClientStream
+}
+
+type resourceServiceWatchClient struct {
+	grpc.ClientStream
+}
+
+func (x *resourceServiceWatchClient) Recv() (*WatchResponse, error) {
+	m := new(WatchResponse)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+// ResourceServiceServer is the server API for ResourceService service.
+// All implementations must embed UnimplementedResourceServiceServer
+// for forward compatibility
+type ResourceServiceServer interface {
+	Get(context.Context, *GetRequest) (*GetResponse, error)
+	List(context.Context, *ListRequest) (*ListResponse, error)
+	Create(context.Context, *CreateRequest) (*CreateResponse, error)
+	Update(context.Context, *UpdateRequest) (*UpdateResponse, error)
+	Delete(context.Context, *DeleteRequest) (*DeleteResponse, error)
+	Teardown(context.Context, *DeleteRequest) (*DeleteResponse, error)
+	Watch(*WatchRequest, ResourceService_WatchServer) error
+	mustEmbedUnimplementedResourceServiceServer()
+}
+
+// UnimplementedResourceServiceServer must be embedded to have forward compatible implementations.
+type UnimplementedResourceServiceServer struct {
+}
+
+func (UnimplementedResourceServiceServer) Get(context.Context, *GetRequest) (*GetResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Get not implemented")
+}
+func (UnimplementedResourceServiceServer) List(context.Context, *ListRequest) (*ListResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method List not implemented")
+}
+func (UnimplementedResourceServiceServer) Create(context.Context, *CreateRequest) (*CreateResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Create not implemented")
+}
+func (UnimplementedResourceServiceServer) Update(context.Context, *UpdateRequest) (*UpdateResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Update not implemented")
+}
+func (UnimplementedResourceServiceServer) Delete(context.Context, *DeleteRequest) (*DeleteResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Delete not implemented")
+}
+func (UnimplementedResourceServiceServer) Teardown(context.Context, *DeleteRequest) (*DeleteResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Teardown not implemented")
+}
+func (UnimplementedResourceServiceServer) Watch(*WatchRequest, ResourceService_WatchServer) error {
+	return status.Errorf(codes.Unimplemented, "method Watch not implemented")
+}
+func (UnimplementedResourceServiceServer) mustEmbedUnimplementedResourceServiceServer() {}
+
+// UnsafeResourceServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ResourceServiceServer will
+// result in compilation errors.
+type UnsafeResourceServiceServer interface {
+	mustEmbedUnimplementedResourceServiceServer()
+}
+
+func RegisterResourceServiceServer(s grpc.ServiceRegistrar, srv ResourceServiceServer) {
+	s.RegisterService(&ResourceService_ServiceDesc, srv)
+}
+
+func _ResourceService_Get_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ResourceServiceServer).Get(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ResourceService_Get_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ResourceServiceServer).Get(ctx, req.(*GetRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ResourceService_List_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ResourceServiceServer).List(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ResourceService_List_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ResourceServiceServer).List(ctx, req.(*ListRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ResourceService_Create_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ResourceServiceServer).Create(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ResourceService_Create_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ResourceServiceServer).Create(ctx, req.(*CreateRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ResourceService_Update_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ResourceServiceServer).Update(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ResourceService_Update_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ResourceServiceServer).Update(ctx, req.(*UpdateRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ResourceService_Delete_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ResourceServiceServer).Delete(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ResourceService_Delete_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ResourceServiceServer).Delete(ctx, req.(*DeleteRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ResourceService_Teardown_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ResourceServiceServer).Teardown(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ResourceService_Teardown_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ResourceServiceServer).Teardown(ctx, req.(*DeleteRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ResourceService_Watch_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(WatchRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(ResourceServiceServer).Watch(m, &resourceServiceWatchServer{stream})
+}
+
+type ResourceService_WatchServer interface {
+	Send(*WatchResponse) error
+	grpc.ServerStream
+}
+
+type resourceServiceWatchServer struct {
+	grpc.ServerStream
+}
+
+func (x *resourceServiceWatchServer) Send(m *WatchResponse) error {
+	return x.ServerStream.SendMsg(m)
+}
+
+// ResourceService_ServiceDesc is the grpc.ServiceDesc for ResourceService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ResourceService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "omni.resources.ResourceService",
+	HandlerType: (*ResourceServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Get",
+			Handler:    _ResourceService_Get_Handler,
+		},
+		{
+			MethodName: "List",
+			Handler:    _ResourceService_List_Handler,
+		},
+		{
+			MethodName: "Create",
+			Handler:    _ResourceService_Create_Handler,
+		},
+		{
+			MethodName: "Update",
+			Handler:    _ResourceService_Update_Handler,
+		},
+		{
+			MethodName: "Delete",
+			Handler:    _ResourceService_Delete_Handler,
+		},
+		{
+			MethodName: "Teardown",
+			Handler:    _ResourceService_Teardown_Handler,
+		},
+	},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "Watch",
+			Handler:       _ResourceService_Watch_Handler,
+			ServerStreams: true,
+		},
+	},
+	Metadata: "omni/resources/resources.proto",
+}
diff --git a/client/api/omni/resources/resources_vtproto.pb.go b/client/api/omni/resources/resources_vtproto.pb.go
new file mode 100644
index 000000000..d36214fde
--- /dev/null
+++ b/client/api/omni/resources/resources_vtproto.pb.go
@@ -0,0 +1,3474 @@
+// Code generated by protoc-gen-go-vtproto. DO NOT EDIT.
+// protoc-gen-go-vtproto version: v0.6.0
+// source: omni/resources/resources.proto
+
+package resources
+
+import (
+	fmt "fmt"
+	io "io"
+
+	v1alpha1 "github.com/cosi-project/runtime/api/v1alpha1"
+	protohelpers "github.com/planetscale/vtprotobuf/protohelpers"
+	proto "google.golang.org/protobuf/proto"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+func (m *Resource) CloneVT() *Resource {
+	if m == nil {
+		return (*Resource)(nil)
+	}
+	r := new(Resource)
+	r.Spec = m.Spec
+	if rhs := m.Metadata; rhs != nil {
+		if vtpb, ok := interface{}(rhs).(interface{ CloneVT() *v1alpha1.Metadata }); ok {
+			r.Metadata = vtpb.CloneVT()
+		} else {
+			r.Metadata = proto.Clone(rhs).(*v1alpha1.Metadata)
+		}
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *Resource) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *GetRequest) CloneVT() *GetRequest {
+	if m == nil {
+		return (*GetRequest)(nil)
+	}
+	r := new(GetRequest)
+	r.Namespace = m.Namespace
+	r.Type = m.Type
+	r.Id = m.Id
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *GetRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *GetResponse) CloneVT() *GetResponse {
+	if m == nil {
+		return (*GetResponse)(nil)
+	}
+	r := new(GetResponse)
+	r.Body = m.Body
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *GetResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ListRequest) CloneVT() *ListRequest {
+	if m == nil {
+		return (*ListRequest)(nil)
+	}
+	r := new(ListRequest)
+	r.Namespace = m.Namespace
+	r.Type = m.Type
+	r.Offset = m.Offset
+	r.Limit = m.Limit
+	r.SortByField = m.SortByField
+	r.SortDescending = m.SortDescending
+	if rhs := m.SearchFor; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.SearchFor = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ListRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ListResponse) CloneVT() *ListResponse {
+	if m == nil {
+		return (*ListResponse)(nil)
+	}
+	r := new(ListResponse)
+	r.Total = m.Total
+	if rhs := m.Items; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.Items = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ListResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *Event) CloneVT() *Event {
+	if m == nil {
+		return (*Event)(nil)
+	}
+	r := new(Event)
+	r.Resource = m.Resource
+	r.Old = m.Old
+	r.EventType = m.EventType
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *Event) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *WatchRequest) CloneVT() *WatchRequest {
+	if m == nil {
+		return (*WatchRequest)(nil)
+	}
+	r := new(WatchRequest)
+	r.Namespace = m.Namespace
+	r.Type = m.Type
+	r.Id = m.Id
+	r.TailEvents = m.TailEvents
+	r.Offset = m.Offset
+	r.Limit = m.Limit
+	r.SortByField = m.SortByField
+	r.SortDescending = m.SortDescending
+	if rhs := m.SearchFor; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.SearchFor = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *WatchRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *WatchResponse) CloneVT() *WatchResponse {
+	if m == nil {
+		return (*WatchResponse)(nil)
+	}
+	r := new(WatchResponse)
+	r.Event = m.Event.CloneVT()
+	r.Total = m.Total
+	r.SortFieldData = m.SortFieldData
+	r.SortDescending = m.SortDescending
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *WatchResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *CreateRequest) CloneVT() *CreateRequest {
+	if m == nil {
+		return (*CreateRequest)(nil)
+	}
+	r := new(CreateRequest)
+	r.Resource = m.Resource.CloneVT()
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *CreateRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *CreateResponse) CloneVT() *CreateResponse {
+	if m == nil {
+		return (*CreateResponse)(nil)
+	}
+	r := new(CreateResponse)
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *CreateResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *UpdateRequest) CloneVT() *UpdateRequest {
+	if m == nil {
+		return (*UpdateRequest)(nil)
+	}
+	r := new(UpdateRequest)
+	r.CurrentVersion = m.CurrentVersion
+	r.Resource = m.Resource.CloneVT()
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *UpdateRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *UpdateResponse) CloneVT() *UpdateResponse {
+	if m == nil {
+		return (*UpdateResponse)(nil)
+	}
+	r := new(UpdateResponse)
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *UpdateResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *DeleteRequest) CloneVT() *DeleteRequest {
+	if m == nil {
+		return (*DeleteRequest)(nil)
+	}
+	r := new(DeleteRequest)
+	r.Namespace = m.Namespace
+	r.Type = m.Type
+	r.Id = m.Id
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *DeleteRequest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *DeleteResponse) CloneVT() *DeleteResponse {
+	if m == nil {
+		return (*DeleteResponse)(nil)
+	}
+	r := new(DeleteResponse)
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *DeleteResponse) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (this *Resource) EqualVT(that *Resource) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if equal, ok := interface{}(this.Metadata).(interface{ EqualVT(*v1alpha1.Metadata) bool }); ok {
+		if !equal.EqualVT(that.Metadata) {
+			return false
+		}
+	} else if !proto.Equal(this.Metadata, that.Metadata) {
+		return false
+	}
+	if this.Spec != that.Spec {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *Resource) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*Resource)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *GetRequest) EqualVT(that *GetRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Namespace != that.Namespace {
+		return false
+	}
+	if this.Type != that.Type {
+		return false
+	}
+	if this.Id != that.Id {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *GetRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*GetRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *GetResponse) EqualVT(that *GetResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Body != that.Body {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *GetResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*GetResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ListRequest) EqualVT(that *ListRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Namespace != that.Namespace {
+		return false
+	}
+	if this.Type != that.Type {
+		return false
+	}
+	if this.Offset != that.Offset {
+		return false
+	}
+	if this.Limit != that.Limit {
+		return false
+	}
+	if this.SortByField != that.SortByField {
+		return false
+	}
+	if this.SortDescending != that.SortDescending {
+		return false
+	}
+	if len(this.SearchFor) != len(that.SearchFor) {
+		return false
+	}
+	for i, vx := range this.SearchFor {
+		vy := that.SearchFor[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ListRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ListRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ListResponse) EqualVT(that *ListResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Items) != len(that.Items) {
+		return false
+	}
+	for i, vx := range this.Items {
+		vy := that.Items[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if this.Total != that.Total {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ListResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ListResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *Event) EqualVT(that *Event) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Resource != that.Resource {
+		return false
+	}
+	if this.Old != that.Old {
+		return false
+	}
+	if this.EventType != that.EventType {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *Event) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*Event)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *WatchRequest) EqualVT(that *WatchRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Namespace != that.Namespace {
+		return false
+	}
+	if this.Type != that.Type {
+		return false
+	}
+	if this.Id != that.Id {
+		return false
+	}
+	if this.TailEvents != that.TailEvents {
+		return false
+	}
+	if this.Offset != that.Offset {
+		return false
+	}
+	if this.Limit != that.Limit {
+		return false
+	}
+	if this.SortByField != that.SortByField {
+		return false
+	}
+	if this.SortDescending != that.SortDescending {
+		return false
+	}
+	if len(this.SearchFor) != len(that.SearchFor) {
+		return false
+	}
+	for i, vx := range this.SearchFor {
+		vy := that.SearchFor[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *WatchRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*WatchRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *WatchResponse) EqualVT(that *WatchResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !this.Event.EqualVT(that.Event) {
+		return false
+	}
+	if this.Total != that.Total {
+		return false
+	}
+	if this.SortFieldData != that.SortFieldData {
+		return false
+	}
+	if this.SortDescending != that.SortDescending {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *WatchResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*WatchResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CreateRequest) EqualVT(that *CreateRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !this.Resource.EqualVT(that.Resource) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CreateRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*CreateRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CreateResponse) EqualVT(that *CreateResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CreateResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*CreateResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *UpdateRequest) EqualVT(that *UpdateRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.CurrentVersion != that.CurrentVersion {
+		return false
+	}
+	if !this.Resource.EqualVT(that.Resource) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *UpdateRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*UpdateRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *UpdateResponse) EqualVT(that *UpdateResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *UpdateResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*UpdateResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *DeleteRequest) EqualVT(that *DeleteRequest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Namespace != that.Namespace {
+		return false
+	}
+	if this.Type != that.Type {
+		return false
+	}
+	if this.Id != that.Id {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *DeleteRequest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*DeleteRequest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *DeleteResponse) EqualVT(that *DeleteResponse) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *DeleteResponse) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*DeleteResponse)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (m *Resource) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Resource) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *Resource) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Spec) > 0 {
+		i -= len(m.Spec)
+		copy(dAtA[i:], m.Spec)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Spec)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Metadata != nil {
+		if vtmsg, ok := interface{}(m.Metadata).(interface {
+			MarshalToSizedBufferVT([]byte) (int, error)
+		}); ok {
+			size, err := vtmsg.MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		} else {
+			encoded, err := proto.Marshal(m.Metadata)
+			if err != nil {
+				return 0, err
+			}
+			i -= len(encoded)
+			copy(dAtA[i:], encoded)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(encoded)))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *GetRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GetRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *GetRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Id) > 0 {
+		i -= len(m.Id)
+		copy(dAtA[i:], m.Id)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Id)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Type) > 0 {
+		i -= len(m.Type)
+		copy(dAtA[i:], m.Type)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Type)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Namespace) > 0 {
+		i -= len(m.Namespace)
+		copy(dAtA[i:], m.Namespace)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Namespace)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *GetResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *GetResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *GetResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Body) > 0 {
+		i -= len(m.Body)
+		copy(dAtA[i:], m.Body)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Body)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ListRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.SearchFor) > 0 {
+		for iNdEx := len(m.SearchFor) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.SearchFor[iNdEx])
+			copy(dAtA[i:], m.SearchFor[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.SearchFor[iNdEx])))
+			i--
+			dAtA[i] = 0x3a
+		}
+	}
+	if m.SortDescending {
+		i--
+		if m.SortDescending {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x30
+	}
+	if len(m.SortByField) > 0 {
+		i -= len(m.SortByField)
+		copy(dAtA[i:], m.SortByField)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.SortByField)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.Limit != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Limit))
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.Offset != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Offset))
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.Type) > 0 {
+		i -= len(m.Type)
+		copy(dAtA[i:], m.Type)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Type)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Namespace) > 0 {
+		i -= len(m.Namespace)
+		copy(dAtA[i:], m.Namespace)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Namespace)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ListResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ListResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ListResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Total != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Total))
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Items[iNdEx])
+			copy(dAtA[i:], m.Items[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Items[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Event) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Event) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *Event) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.EventType != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.EventType))
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.Old) > 0 {
+		i -= len(m.Old)
+		copy(dAtA[i:], m.Old)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Old)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Resource) > 0 {
+		i -= len(m.Resource)
+		copy(dAtA[i:], m.Resource)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Resource)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *WatchRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WatchRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *WatchRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.SearchFor) > 0 {
+		for iNdEx := len(m.SearchFor) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.SearchFor[iNdEx])
+			copy(dAtA[i:], m.SearchFor[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.SearchFor[iNdEx])))
+			i--
+			dAtA[i] = 0x4a
+		}
+	}
+	if m.SortDescending {
+		i--
+		if m.SortDescending {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x40
+	}
+	if len(m.SortByField) > 0 {
+		i -= len(m.SortByField)
+		copy(dAtA[i:], m.SortByField)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.SortByField)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if m.Limit != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Limit))
+		i--
+		dAtA[i] = 0x30
+	}
+	if m.Offset != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Offset))
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.TailEvents != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.TailEvents))
+		i--
+		dAtA[i] = 0x20
+	}
+	if len(m.Id) > 0 {
+		i -= len(m.Id)
+		copy(dAtA[i:], m.Id)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Id)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Type) > 0 {
+		i -= len(m.Type)
+		copy(dAtA[i:], m.Type)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Type)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Namespace) > 0 {
+		i -= len(m.Namespace)
+		copy(dAtA[i:], m.Namespace)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Namespace)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *WatchResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *WatchResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *WatchResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.SortDescending {
+		i--
+		if m.SortDescending {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if len(m.SortFieldData) > 0 {
+		i -= len(m.SortFieldData)
+		copy(dAtA[i:], m.SortFieldData)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.SortFieldData)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.Total != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Total))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Event != nil {
+		size, err := m.Event.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CreateRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CreateRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CreateRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Resource != nil {
+		size, err := m.Resource.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CreateResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CreateResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CreateResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *UpdateRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UpdateRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *UpdateRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Resource != nil {
+		size, err := m.Resource.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.CurrentVersion) > 0 {
+		i -= len(m.CurrentVersion)
+		copy(dAtA[i:], m.CurrentVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.CurrentVersion)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *UpdateResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UpdateResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *UpdateResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *DeleteRequest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DeleteRequest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *DeleteRequest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Id) > 0 {
+		i -= len(m.Id)
+		copy(dAtA[i:], m.Id)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Id)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Type) > 0 {
+		i -= len(m.Type)
+		copy(dAtA[i:], m.Type)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Type)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Namespace) > 0 {
+		i -= len(m.Namespace)
+		copy(dAtA[i:], m.Namespace)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Namespace)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *DeleteResponse) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DeleteResponse) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *DeleteResponse) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Resource) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Metadata != nil {
+		if size, ok := interface{}(m.Metadata).(interface {
+			SizeVT() int
+		}); ok {
+			l = size.SizeVT()
+		} else {
+			l = proto.Size(m.Metadata)
+		}
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Spec)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *GetRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Namespace)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Type)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Id)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *GetResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Body)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ListRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Namespace)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Type)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Offset != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Offset))
+	}
+	if m.Limit != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Limit))
+	}
+	l = len(m.SortByField)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.SortDescending {
+		n += 2
+	}
+	if len(m.SearchFor) > 0 {
+		for _, s := range m.SearchFor {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ListResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for _, s := range m.Items {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	if m.Total != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Total))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *Event) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Resource)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Old)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.EventType != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.EventType))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *WatchRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Namespace)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Type)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Id)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.TailEvents != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.TailEvents))
+	}
+	if m.Offset != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Offset))
+	}
+	if m.Limit != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Limit))
+	}
+	l = len(m.SortByField)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.SortDescending {
+		n += 2
+	}
+	if len(m.SearchFor) > 0 {
+		for _, s := range m.SearchFor {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *WatchResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Event != nil {
+		l = m.Event.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Total != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Total))
+	}
+	l = len(m.SortFieldData)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.SortDescending {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CreateRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Resource != nil {
+		l = m.Resource.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CreateResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *UpdateRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.CurrentVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Resource != nil {
+		l = m.Resource.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *UpdateResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *DeleteRequest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Namespace)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Type)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Id)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *DeleteResponse) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *Resource) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Resource: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Resource: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Metadata == nil {
+				m.Metadata = &v1alpha1.Metadata{}
+			}
+			if unmarshal, ok := interface{}(m.Metadata).(interface {
+				UnmarshalVT([]byte) error
+			}); ok {
+				if err := unmarshal.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				if err := proto.Unmarshal(dAtA[iNdEx:postIndex], m.Metadata); err != nil {
+					return err
+				}
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Spec = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GetRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GetRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GetRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Namespace = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Id", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Id = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *GetResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: GetResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: GetResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Body", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Body = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Namespace = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Offset", wireType)
+			}
+			m.Offset = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Offset |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+			}
+			m.Limit = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Limit |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SortByField", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SortByField = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SortDescending", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.SortDescending = bool(v != 0)
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SearchFor", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SearchFor = append(m.SearchFor, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ListResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ListResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ListResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Total", wireType)
+			}
+			m.Total = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Total |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Event) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Event: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Event: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Resource", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Resource = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Old", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Old = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EventType", wireType)
+			}
+			m.EventType = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.EventType |= EventType(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WatchRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WatchRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WatchRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Namespace = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Id", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Id = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TailEvents", wireType)
+			}
+			m.TailEvents = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.TailEvents |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Offset", wireType)
+			}
+			m.Offset = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Offset |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Limit", wireType)
+			}
+			m.Limit = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Limit |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SortByField", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SortByField = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SortDescending", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.SortDescending = bool(v != 0)
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SearchFor", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SearchFor = append(m.SearchFor, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *WatchResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: WatchResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: WatchResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Event", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Event == nil {
+				m.Event = &Event{}
+			}
+			if err := m.Event.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Total", wireType)
+			}
+			m.Total = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Total |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SortFieldData", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SortFieldData = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SortDescending", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.SortDescending = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CreateRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CreateRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CreateRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Resource", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Resource == nil {
+				m.Resource = &Resource{}
+			}
+			if err := m.Resource.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CreateResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CreateResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CreateResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UpdateRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UpdateRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UpdateRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CurrentVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CurrentVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Resource", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Resource == nil {
+				m.Resource = &Resource{}
+			}
+			if err := m.Resource.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UpdateResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UpdateResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UpdateResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeleteRequest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeleteRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeleteRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Namespace", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Namespace = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Id", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Id = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DeleteResponse) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DeleteResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DeleteResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/client/api/omni/specs/auth.pb.go b/client/api/omni/specs/auth.pb.go
new file mode 100644
index 000000000..4983c62e4
--- /dev/null
+++ b/client/api/omni/specs/auth.pb.go
@@ -0,0 +1,2017 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.32.0
+// 	protoc        v4.24.4
+// source: omni/specs/auth.proto
+
+package specs
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	_ "github.com/siderolabs/talos/pkg/machinery/api/machine"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// AuthConfigSpec describes the authentication configuration.
+type AuthConfigSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Auth0     *AuthConfigSpec_Auth0    `protobuf:"bytes,1,opt,name=auth0,proto3" json:"auth0,omitempty"`
+	Webauthn  *AuthConfigSpec_Webauthn `protobuf:"bytes,2,opt,name=webauthn,proto3" json:"webauthn,omitempty"`
+	Suspended bool                     `protobuf:"varint,3,opt,name=suspended,proto3" json:"suspended,omitempty"`
+	Saml      *AuthConfigSpec_SAML     `protobuf:"bytes,4,opt,name=saml,proto3" json:"saml,omitempty"`
+}
+
+func (x *AuthConfigSpec) Reset() {
+	*x = AuthConfigSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthConfigSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthConfigSpec) ProtoMessage() {}
+
+func (x *AuthConfigSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthConfigSpec.ProtoReflect.Descriptor instead.
+func (*AuthConfigSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *AuthConfigSpec) GetAuth0() *AuthConfigSpec_Auth0 {
+	if x != nil {
+		return x.Auth0
+	}
+	return nil
+}
+
+func (x *AuthConfigSpec) GetWebauthn() *AuthConfigSpec_Webauthn {
+	if x != nil {
+		return x.Webauthn
+	}
+	return nil
+}
+
+func (x *AuthConfigSpec) GetSuspended() bool {
+	if x != nil {
+		return x.Suspended
+	}
+	return false
+}
+
+func (x *AuthConfigSpec) GetSaml() *AuthConfigSpec_SAML {
+	if x != nil {
+		return x.Saml
+	}
+	return nil
+}
+
+// SAMLAssertionSpec describes SAML assertion.
+type SAMLAssertionSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Data keeps JSON encoded SAML assertion.
+	Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
+	// Email is the identity that was read from the assertion.
+	Email string `protobuf:"bytes,2,opt,name=email,proto3" json:"email,omitempty"`
+	// Used marks SAML assertion as used.
+	Used bool `protobuf:"varint,3,opt,name=used,proto3" json:"used,omitempty"`
+}
+
+func (x *SAMLAssertionSpec) Reset() {
+	*x = SAMLAssertionSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SAMLAssertionSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SAMLAssertionSpec) ProtoMessage() {}
+
+func (x *SAMLAssertionSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SAMLAssertionSpec.ProtoReflect.Descriptor instead.
+func (*SAMLAssertionSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *SAMLAssertionSpec) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+func (x *SAMLAssertionSpec) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *SAMLAssertionSpec) GetUsed() bool {
+	if x != nil {
+		return x.Used
+	}
+	return false
+}
+
+// UserSpec describes a user.
+type UserSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Scopes are deprecated, use roles instead.
+	//
+	// Deprecated: will be removed once all environments are migrated to use roles.
+	// TODO: remove after all environments are migrated to use roles.
+	Scopes []string `protobuf:"bytes,2,rep,name=scopes,proto3" json:"scopes,omitempty"`
+	Role   string   `protobuf:"bytes,3,opt,name=role,proto3" json:"role,omitempty"`
+}
+
+func (x *UserSpec) Reset() {
+	*x = UserSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UserSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UserSpec) ProtoMessage() {}
+
+func (x *UserSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UserSpec.ProtoReflect.Descriptor instead.
+func (*UserSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *UserSpec) GetScopes() []string {
+	if x != nil {
+		return x.Scopes
+	}
+	return nil
+}
+
+func (x *UserSpec) GetRole() string {
+	if x != nil {
+		return x.Role
+	}
+	return ""
+}
+
+// IdentitySpec describes a user identity.
+type IdentitySpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	UserId string `protobuf:"bytes,1,opt,name=user_id,json=userId,proto3" json:"user_id,omitempty"`
+}
+
+func (x *IdentitySpec) Reset() {
+	*x = IdentitySpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *IdentitySpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IdentitySpec) ProtoMessage() {}
+
+func (x *IdentitySpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IdentitySpec.ProtoReflect.Descriptor instead.
+func (*IdentitySpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *IdentitySpec) GetUserId() string {
+	if x != nil {
+		return x.UserId
+	}
+	return ""
+}
+
+type Identity struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Email string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+}
+
+func (x *Identity) Reset() {
+	*x = Identity{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Identity) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Identity) ProtoMessage() {}
+
+func (x *Identity) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Identity.ProtoReflect.Descriptor instead.
+func (*Identity) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *Identity) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+// PublicKeySpec describes a user or service account public key.
+type PublicKeySpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	PublicKey []byte `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
+	// Scopes are deprecated, use roles instead.
+	//
+	// Deprecated: will be removed once all environments are migrated to use roles.
+	// TODO: remove after all environments are migrated to use roles.
+	Scopes     []string               `protobuf:"bytes,2,rep,name=scopes,proto3" json:"scopes,omitempty"`
+	Expiration *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=expiration,proto3" json:"expiration,omitempty"`
+	Confirmed  bool                   `protobuf:"varint,4,opt,name=confirmed,proto3" json:"confirmed,omitempty"`
+	Identity   *Identity              `protobuf:"bytes,5,opt,name=identity,proto3" json:"identity,omitempty"`
+	Role       string                 `protobuf:"bytes,6,opt,name=role,proto3" json:"role,omitempty"`
+}
+
+func (x *PublicKeySpec) Reset() {
+	*x = PublicKeySpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PublicKeySpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PublicKeySpec) ProtoMessage() {}
+
+func (x *PublicKeySpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PublicKeySpec.ProtoReflect.Descriptor instead.
+func (*PublicKeySpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *PublicKeySpec) GetPublicKey() []byte {
+	if x != nil {
+		return x.PublicKey
+	}
+	return nil
+}
+
+func (x *PublicKeySpec) GetScopes() []string {
+	if x != nil {
+		return x.Scopes
+	}
+	return nil
+}
+
+func (x *PublicKeySpec) GetExpiration() *timestamppb.Timestamp {
+	if x != nil {
+		return x.Expiration
+	}
+	return nil
+}
+
+func (x *PublicKeySpec) GetConfirmed() bool {
+	if x != nil {
+		return x.Confirmed
+	}
+	return false
+}
+
+func (x *PublicKeySpec) GetIdentity() *Identity {
+	if x != nil {
+		return x.Identity
+	}
+	return nil
+}
+
+func (x *PublicKeySpec) GetRole() string {
+	if x != nil {
+		return x.Role
+	}
+	return ""
+}
+
+// AccessPolicyUserGroup describes a user group in the ACLs context.
+type AccessPolicyUserGroup struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Users []*AccessPolicyUserGroup_User `protobuf:"bytes,1,rep,name=users,proto3" json:"users,omitempty"`
+}
+
+func (x *AccessPolicyUserGroup) Reset() {
+	*x = AccessPolicyUserGroup{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessPolicyUserGroup) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessPolicyUserGroup) ProtoMessage() {}
+
+func (x *AccessPolicyUserGroup) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessPolicyUserGroup.ProtoReflect.Descriptor instead.
+func (*AccessPolicyUserGroup) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *AccessPolicyUserGroup) GetUsers() []*AccessPolicyUserGroup_User {
+	if x != nil {
+		return x.Users
+	}
+	return nil
+}
+
+// AccessPolicyClusterGroup describes a cluster group in the ACLs context.
+type AccessPolicyClusterGroup struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Clusters []*AccessPolicyClusterGroup_Cluster `protobuf:"bytes,1,rep,name=clusters,proto3" json:"clusters,omitempty"`
+}
+
+func (x *AccessPolicyClusterGroup) Reset() {
+	*x = AccessPolicyClusterGroup{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessPolicyClusterGroup) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessPolicyClusterGroup) ProtoMessage() {}
+
+func (x *AccessPolicyClusterGroup) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessPolicyClusterGroup.ProtoReflect.Descriptor instead.
+func (*AccessPolicyClusterGroup) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *AccessPolicyClusterGroup) GetClusters() []*AccessPolicyClusterGroup_Cluster {
+	if x != nil {
+		return x.Clusters
+	}
+	return nil
+}
+
+// AccessPolicyRule describes a rule in the ACLs context.
+type AccessPolicyRule struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Users      []string                     `protobuf:"bytes,1,rep,name=users,proto3" json:"users,omitempty"`
+	Clusters   []string                     `protobuf:"bytes,2,rep,name=clusters,proto3" json:"clusters,omitempty"`
+	Kubernetes *AccessPolicyRule_Kubernetes `protobuf:"bytes,3,opt,name=kubernetes,proto3" json:"kubernetes,omitempty"`
+	Role       string                       `protobuf:"bytes,4,opt,name=role,proto3" json:"role,omitempty"`
+}
+
+func (x *AccessPolicyRule) Reset() {
+	*x = AccessPolicyRule{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessPolicyRule) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessPolicyRule) ProtoMessage() {}
+
+func (x *AccessPolicyRule) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessPolicyRule.ProtoReflect.Descriptor instead.
+func (*AccessPolicyRule) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *AccessPolicyRule) GetUsers() []string {
+	if x != nil {
+		return x.Users
+	}
+	return nil
+}
+
+func (x *AccessPolicyRule) GetClusters() []string {
+	if x != nil {
+		return x.Clusters
+	}
+	return nil
+}
+
+func (x *AccessPolicyRule) GetKubernetes() *AccessPolicyRule_Kubernetes {
+	if x != nil {
+		return x.Kubernetes
+	}
+	return nil
+}
+
+func (x *AccessPolicyRule) GetRole() string {
+	if x != nil {
+		return x.Role
+	}
+	return ""
+}
+
+type AccessPolicyTest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name     string                     `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	User     *AccessPolicyTest_User     `protobuf:"bytes,2,opt,name=user,proto3" json:"user,omitempty"`
+	Cluster  *AccessPolicyTest_Cluster  `protobuf:"bytes,3,opt,name=cluster,proto3" json:"cluster,omitempty"`
+	Expected *AccessPolicyTest_Expected `protobuf:"bytes,4,opt,name=expected,proto3" json:"expected,omitempty"`
+}
+
+func (x *AccessPolicyTest) Reset() {
+	*x = AccessPolicyTest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessPolicyTest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessPolicyTest) ProtoMessage() {}
+
+func (x *AccessPolicyTest) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessPolicyTest.ProtoReflect.Descriptor instead.
+func (*AccessPolicyTest) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *AccessPolicyTest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *AccessPolicyTest) GetUser() *AccessPolicyTest_User {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+func (x *AccessPolicyTest) GetCluster() *AccessPolicyTest_Cluster {
+	if x != nil {
+		return x.Cluster
+	}
+	return nil
+}
+
+func (x *AccessPolicyTest) GetExpected() *AccessPolicyTest_Expected {
+	if x != nil {
+		return x.Expected
+	}
+	return nil
+}
+
+// AccessPolicySpec describes the access policy configuration.
+type AccessPolicySpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	UserGroups    map[string]*AccessPolicyUserGroup    `protobuf:"bytes,1,rep,name=user_groups,json=userGroups,proto3" json:"user_groups,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	ClusterGroups map[string]*AccessPolicyClusterGroup `protobuf:"bytes,2,rep,name=cluster_groups,json=clusterGroups,proto3" json:"cluster_groups,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Rules         []*AccessPolicyRule                  `protobuf:"bytes,3,rep,name=rules,proto3" json:"rules,omitempty"`
+	Tests         []*AccessPolicyTest                  `protobuf:"bytes,4,rep,name=tests,proto3" json:"tests,omitempty"`
+}
+
+func (x *AccessPolicySpec) Reset() {
+	*x = AccessPolicySpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessPolicySpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessPolicySpec) ProtoMessage() {}
+
+func (x *AccessPolicySpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessPolicySpec.ProtoReflect.Descriptor instead.
+func (*AccessPolicySpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *AccessPolicySpec) GetUserGroups() map[string]*AccessPolicyUserGroup {
+	if x != nil {
+		return x.UserGroups
+	}
+	return nil
+}
+
+func (x *AccessPolicySpec) GetClusterGroups() map[string]*AccessPolicyClusterGroup {
+	if x != nil {
+		return x.ClusterGroups
+	}
+	return nil
+}
+
+func (x *AccessPolicySpec) GetRules() []*AccessPolicyRule {
+	if x != nil {
+		return x.Rules
+	}
+	return nil
+}
+
+func (x *AccessPolicySpec) GetTests() []*AccessPolicyTest {
+	if x != nil {
+		return x.Tests
+	}
+	return nil
+}
+
+// SAMLLabelRuleSpec describes a rule on how to map Identity labels to Omni roles.
+type SAMLLabelRuleSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// MatchLabels is the list of labels to match the user's Identity against this rule.
+	MatchLabels []string `protobuf:"bytes,1,rep,name=match_labels,json=matchLabels,proto3" json:"match_labels,omitempty"`
+	// AssignRoleOnRegistration is the role to be assigned to the user if this rule matches.
+	AssignRoleOnRegistration string `protobuf:"bytes,2,opt,name=assign_role_on_registration,json=assignRoleOnRegistration,proto3" json:"assign_role_on_registration,omitempty"`
+}
+
+func (x *SAMLLabelRuleSpec) Reset() {
+	*x = SAMLLabelRuleSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SAMLLabelRuleSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SAMLLabelRuleSpec) ProtoMessage() {}
+
+func (x *SAMLLabelRuleSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SAMLLabelRuleSpec.ProtoReflect.Descriptor instead.
+func (*SAMLLabelRuleSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *SAMLLabelRuleSpec) GetMatchLabels() []string {
+	if x != nil {
+		return x.MatchLabels
+	}
+	return nil
+}
+
+func (x *SAMLLabelRuleSpec) GetAssignRoleOnRegistration() string {
+	if x != nil {
+		return x.AssignRoleOnRegistration
+	}
+	return ""
+}
+
+type AuthConfigSpec_Auth0 struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Enabled  bool   `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	Domain   string `protobuf:"bytes,2,opt,name=domain,proto3" json:"domain,omitempty"`
+	ClientId string `protobuf:"bytes,3,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+}
+
+func (x *AuthConfigSpec_Auth0) Reset() {
+	*x = AuthConfigSpec_Auth0{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthConfigSpec_Auth0) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthConfigSpec_Auth0) ProtoMessage() {}
+
+func (x *AuthConfigSpec_Auth0) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthConfigSpec_Auth0.ProtoReflect.Descriptor instead.
+func (*AuthConfigSpec_Auth0) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *AuthConfigSpec_Auth0) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+func (x *AuthConfigSpec_Auth0) GetDomain() string {
+	if x != nil {
+		return x.Domain
+	}
+	return ""
+}
+
+func (x *AuthConfigSpec_Auth0) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+type AuthConfigSpec_Webauthn struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Enabled  bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	Required bool `protobuf:"varint,2,opt,name=required,proto3" json:"required,omitempty"`
+}
+
+func (x *AuthConfigSpec_Webauthn) Reset() {
+	*x = AuthConfigSpec_Webauthn{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthConfigSpec_Webauthn) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthConfigSpec_Webauthn) ProtoMessage() {}
+
+func (x *AuthConfigSpec_Webauthn) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthConfigSpec_Webauthn.ProtoReflect.Descriptor instead.
+func (*AuthConfigSpec_Webauthn) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{0, 1}
+}
+
+func (x *AuthConfigSpec_Webauthn) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+func (x *AuthConfigSpec_Webauthn) GetRequired() bool {
+	if x != nil {
+		return x.Required
+	}
+	return false
+}
+
+type AuthConfigSpec_SAML struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Enabled  bool   `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	Url      string `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
+	Metadata string `protobuf:"bytes,3,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// LabelRules defines custom rules on how to extract SAML attributes from the
+	// saml assertion and turn them into labels.
+	LabelRules map[string]string `protobuf:"bytes,4,rep,name=label_rules,json=labelRules,proto3" json:"label_rules,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *AuthConfigSpec_SAML) Reset() {
+	*x = AuthConfigSpec_SAML{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthConfigSpec_SAML) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthConfigSpec_SAML) ProtoMessage() {}
+
+func (x *AuthConfigSpec_SAML) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthConfigSpec_SAML.ProtoReflect.Descriptor instead.
+func (*AuthConfigSpec_SAML) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{0, 2}
+}
+
+func (x *AuthConfigSpec_SAML) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+func (x *AuthConfigSpec_SAML) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+func (x *AuthConfigSpec_SAML) GetMetadata() string {
+	if x != nil {
+		return x.Metadata
+	}
+	return ""
+}
+
+func (x *AuthConfigSpec_SAML) GetLabelRules() map[string]string {
+	if x != nil {
+		return x.LabelRules
+	}
+	return nil
+}
+
+type AccessPolicyUserGroup_User struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name           string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Match          string   `protobuf:"bytes,2,opt,name=match,proto3" json:"match,omitempty"`
+	LabelSelectors []string `protobuf:"bytes,3,rep,name=label_selectors,json=labelSelectors,proto3" json:"label_selectors,omitempty"`
+}
+
+func (x *AccessPolicyUserGroup_User) Reset() {
+	*x = AccessPolicyUserGroup_User{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[16]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessPolicyUserGroup_User) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessPolicyUserGroup_User) ProtoMessage() {}
+
+func (x *AccessPolicyUserGroup_User) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[16]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessPolicyUserGroup_User.ProtoReflect.Descriptor instead.
+func (*AccessPolicyUserGroup_User) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{6, 0}
+}
+
+func (x *AccessPolicyUserGroup_User) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *AccessPolicyUserGroup_User) GetMatch() string {
+	if x != nil {
+		return x.Match
+	}
+	return ""
+}
+
+func (x *AccessPolicyUserGroup_User) GetLabelSelectors() []string {
+	if x != nil {
+		return x.LabelSelectors
+	}
+	return nil
+}
+
+type AccessPolicyClusterGroup_Cluster struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name  string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Match string `protobuf:"bytes,2,opt,name=match,proto3" json:"match,omitempty"`
+}
+
+func (x *AccessPolicyClusterGroup_Cluster) Reset() {
+	*x = AccessPolicyClusterGroup_Cluster{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessPolicyClusterGroup_Cluster) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessPolicyClusterGroup_Cluster) ProtoMessage() {}
+
+func (x *AccessPolicyClusterGroup_Cluster) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessPolicyClusterGroup_Cluster.ProtoReflect.Descriptor instead.
+func (*AccessPolicyClusterGroup_Cluster) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{7, 0}
+}
+
+func (x *AccessPolicyClusterGroup_Cluster) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *AccessPolicyClusterGroup_Cluster) GetMatch() string {
+	if x != nil {
+		return x.Match
+	}
+	return ""
+}
+
+type AccessPolicyRule_Kubernetes struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Impersonate *AccessPolicyRule_Kubernetes_Impersonate `protobuf:"bytes,1,opt,name=impersonate,proto3" json:"impersonate,omitempty"`
+}
+
+func (x *AccessPolicyRule_Kubernetes) Reset() {
+	*x = AccessPolicyRule_Kubernetes{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessPolicyRule_Kubernetes) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessPolicyRule_Kubernetes) ProtoMessage() {}
+
+func (x *AccessPolicyRule_Kubernetes) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessPolicyRule_Kubernetes.ProtoReflect.Descriptor instead.
+func (*AccessPolicyRule_Kubernetes) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{8, 0}
+}
+
+func (x *AccessPolicyRule_Kubernetes) GetImpersonate() *AccessPolicyRule_Kubernetes_Impersonate {
+	if x != nil {
+		return x.Impersonate
+	}
+	return nil
+}
+
+type AccessPolicyRule_Kubernetes_Impersonate struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Groups []string `protobuf:"bytes,1,rep,name=groups,proto3" json:"groups,omitempty"`
+}
+
+func (x *AccessPolicyRule_Kubernetes_Impersonate) Reset() {
+	*x = AccessPolicyRule_Kubernetes_Impersonate{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessPolicyRule_Kubernetes_Impersonate) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessPolicyRule_Kubernetes_Impersonate) ProtoMessage() {}
+
+func (x *AccessPolicyRule_Kubernetes_Impersonate) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessPolicyRule_Kubernetes_Impersonate.ProtoReflect.Descriptor instead.
+func (*AccessPolicyRule_Kubernetes_Impersonate) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{8, 0, 0}
+}
+
+func (x *AccessPolicyRule_Kubernetes_Impersonate) GetGroups() []string {
+	if x != nil {
+		return x.Groups
+	}
+	return nil
+}
+
+type AccessPolicyTest_Expected struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Kubernetes *AccessPolicyTest_Expected_Kubernetes `protobuf:"bytes,1,opt,name=kubernetes,proto3" json:"kubernetes,omitempty"`
+	Role       string                                `protobuf:"bytes,2,opt,name=role,proto3" json:"role,omitempty"`
+}
+
+func (x *AccessPolicyTest_Expected) Reset() {
+	*x = AccessPolicyTest_Expected{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessPolicyTest_Expected) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessPolicyTest_Expected) ProtoMessage() {}
+
+func (x *AccessPolicyTest_Expected) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessPolicyTest_Expected.ProtoReflect.Descriptor instead.
+func (*AccessPolicyTest_Expected) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{9, 0}
+}
+
+func (x *AccessPolicyTest_Expected) GetKubernetes() *AccessPolicyTest_Expected_Kubernetes {
+	if x != nil {
+		return x.Kubernetes
+	}
+	return nil
+}
+
+func (x *AccessPolicyTest_Expected) GetRole() string {
+	if x != nil {
+		return x.Role
+	}
+	return ""
+}
+
+type AccessPolicyTest_User struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name   string            `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Labels map[string]string `protobuf:"bytes,2,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *AccessPolicyTest_User) Reset() {
+	*x = AccessPolicyTest_User{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[21]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessPolicyTest_User) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessPolicyTest_User) ProtoMessage() {}
+
+func (x *AccessPolicyTest_User) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[21]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessPolicyTest_User.ProtoReflect.Descriptor instead.
+func (*AccessPolicyTest_User) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{9, 1}
+}
+
+func (x *AccessPolicyTest_User) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *AccessPolicyTest_User) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+type AccessPolicyTest_Cluster struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+}
+
+func (x *AccessPolicyTest_Cluster) Reset() {
+	*x = AccessPolicyTest_Cluster{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[22]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessPolicyTest_Cluster) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessPolicyTest_Cluster) ProtoMessage() {}
+
+func (x *AccessPolicyTest_Cluster) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[22]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessPolicyTest_Cluster.ProtoReflect.Descriptor instead.
+func (*AccessPolicyTest_Cluster) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{9, 2}
+}
+
+func (x *AccessPolicyTest_Cluster) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+type AccessPolicyTest_Expected_Kubernetes struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Impersonate *AccessPolicyTest_Expected_Kubernetes_Impersonate `protobuf:"bytes,1,opt,name=impersonate,proto3" json:"impersonate,omitempty"`
+}
+
+func (x *AccessPolicyTest_Expected_Kubernetes) Reset() {
+	*x = AccessPolicyTest_Expected_Kubernetes{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[23]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessPolicyTest_Expected_Kubernetes) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessPolicyTest_Expected_Kubernetes) ProtoMessage() {}
+
+func (x *AccessPolicyTest_Expected_Kubernetes) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[23]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessPolicyTest_Expected_Kubernetes.ProtoReflect.Descriptor instead.
+func (*AccessPolicyTest_Expected_Kubernetes) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{9, 0, 0}
+}
+
+func (x *AccessPolicyTest_Expected_Kubernetes) GetImpersonate() *AccessPolicyTest_Expected_Kubernetes_Impersonate {
+	if x != nil {
+		return x.Impersonate
+	}
+	return nil
+}
+
+type AccessPolicyTest_Expected_Kubernetes_Impersonate struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Groups []string `protobuf:"bytes,1,rep,name=groups,proto3" json:"groups,omitempty"`
+}
+
+func (x *AccessPolicyTest_Expected_Kubernetes_Impersonate) Reset() {
+	*x = AccessPolicyTest_Expected_Kubernetes_Impersonate{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_auth_proto_msgTypes[24]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AccessPolicyTest_Expected_Kubernetes_Impersonate) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AccessPolicyTest_Expected_Kubernetes_Impersonate) ProtoMessage() {}
+
+func (x *AccessPolicyTest_Expected_Kubernetes_Impersonate) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_auth_proto_msgTypes[24]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AccessPolicyTest_Expected_Kubernetes_Impersonate.ProtoReflect.Descriptor instead.
+func (*AccessPolicyTest_Expected_Kubernetes_Impersonate) Descriptor() ([]byte, []int) {
+	return file_omni_specs_auth_proto_rawDescGZIP(), []int{9, 0, 0, 0}
+}
+
+func (x *AccessPolicyTest_Expected_Kubernetes_Impersonate) GetGroups() []string {
+	if x != nil {
+		return x.Groups
+	}
+	return nil
+}
+
+var File_omni_specs_auth_proto protoreflect.FileDescriptor
+
+var file_omni_specs_auth_proto_rawDesc = []byte{
+	0x0a, 0x15, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2f, 0x61, 0x75, 0x74,
+	0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x05, 0x73, 0x70, 0x65, 0x63, 0x73, 0x1a, 0x1b,
+	0x74, 0x61, 0x6c, 0x6f, 0x73, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x6d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d,
+	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xc4, 0x04, 0x0a,
+	0x0e, 0x41, 0x75, 0x74, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x70, 0x65, 0x63, 0x12,
+	0x31, 0x0a, 0x05, 0x61, 0x75, 0x74, 0x68, 0x30, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b,
+	0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x30, 0x52, 0x05, 0x61, 0x75, 0x74,
+	0x68, 0x30, 0x12, 0x3a, 0x0a, 0x08, 0x77, 0x65, 0x62, 0x61, 0x75, 0x74, 0x68, 0x6e, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x41, 0x75, 0x74,
+	0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x57, 0x65, 0x62, 0x61,
+	0x75, 0x74, 0x68, 0x6e, 0x52, 0x08, 0x77, 0x65, 0x62, 0x61, 0x75, 0x74, 0x68, 0x6e, 0x12, 0x1c,
+	0x0a, 0x09, 0x73, 0x75, 0x73, 0x70, 0x65, 0x6e, 0x64, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x09, 0x73, 0x75, 0x73, 0x70, 0x65, 0x6e, 0x64, 0x65, 0x64, 0x12, 0x2e, 0x0a, 0x04,
+	0x73, 0x61, 0x6d, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x73, 0x70, 0x65,
+	0x63, 0x73, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x70, 0x65,
+	0x63, 0x2e, 0x53, 0x41, 0x4d, 0x4c, 0x52, 0x04, 0x73, 0x61, 0x6d, 0x6c, 0x1a, 0x56, 0x0a, 0x05,
+	0x41, 0x75, 0x74, 0x68, 0x30, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12,
+	0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e,
+	0x74, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x49, 0x64, 0x1a, 0x40, 0x0a, 0x08, 0x57, 0x65, 0x62, 0x61, 0x75, 0x74, 0x68, 0x6e,
+	0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x72, 0x65,
+	0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x72, 0x65,
+	0x71, 0x75, 0x69, 0x72, 0x65, 0x64, 0x1a, 0xda, 0x01, 0x0a, 0x04, 0x53, 0x41, 0x4d, 0x4c, 0x12,
+	0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x1a, 0x0a, 0x08, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x4b, 0x0a, 0x0b, 0x6c, 0x61, 0x62, 0x65, 0x6c,
+	0x5f, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x73,
+	0x70, 0x65, 0x63, 0x73, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53,
+	0x70, 0x65, 0x63, 0x2e, 0x53, 0x41, 0x4d, 0x4c, 0x2e, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x52, 0x75,
+	0x6c, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0a, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x52,
+	0x75, 0x6c, 0x65, 0x73, 0x1a, 0x3d, 0x0a, 0x0f, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x52, 0x75, 0x6c,
+	0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a,
+	0x02, 0x38, 0x01, 0x22, 0x51, 0x0a, 0x11, 0x53, 0x41, 0x4d, 0x4c, 0x41, 0x73, 0x73, 0x65, 0x72,
+	0x74, 0x69, 0x6f, 0x6e, 0x53, 0x70, 0x65, 0x63, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x12, 0x14, 0x0a, 0x05,
+	0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61,
+	0x69, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x04, 0x75, 0x73, 0x65, 0x64, 0x22, 0x3c, 0x0a, 0x08, 0x55, 0x73, 0x65, 0x72, 0x53, 0x70,
+	0x65, 0x63, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x06, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x72, 0x6f,
+	0x6c, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x4a, 0x04,
+	0x08, 0x01, 0x10, 0x02, 0x22, 0x27, 0x0a, 0x0c, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79,
+	0x53, 0x70, 0x65, 0x63, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x22, 0x20, 0x0a,
+	0x08, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d, 0x61,
+	0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x22,
+	0xe1, 0x01, 0x0a, 0x0d, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53, 0x70, 0x65,
+	0x63, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79,
+	0x12, 0x16, 0x0a, 0x06, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x06, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x12, 0x3a, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54,
+	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x72, 0x6d, 0x65,
+	0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x72, 0x6d,
+	0x65, 0x64, 0x12, 0x2b, 0x0a, 0x08, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x49, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x08, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12,
+	0x12, 0x0a, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x72,
+	0x6f, 0x6c, 0x65, 0x22, 0xab, 0x01, 0x0a, 0x15, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x50, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x55, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x37, 0x0a,
+	0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x73,
+	0x70, 0x65, 0x63, 0x73, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x55, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x52,
+	0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x1a, 0x59, 0x0a, 0x04, 0x55, 0x73, 0x65, 0x72, 0x12, 0x12,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x05, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x12, 0x27, 0x0a, 0x0f, 0x6c, 0x61, 0x62, 0x65,
+	0x6c, 0x5f, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x0e, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72,
+	0x73, 0x22, 0x94, 0x01, 0x0a, 0x18, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69,
+	0x63, 0x79, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x12, 0x43,
+	0x0a, 0x08, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x27, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75,
+	0x70, 0x2e, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x08, 0x63, 0x6c, 0x75, 0x73, 0x74,
+	0x65, 0x72, 0x73, 0x1a, 0x33, 0x0a, 0x07, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x12,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x05, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x22, 0xa4, 0x02, 0x0a, 0x10, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x75, 0x6c, 0x65, 0x12, 0x14, 0x0a,
+	0x05, 0x75, 0x73, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x75, 0x73,
+	0x65, 0x72, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x12,
+	0x42, 0x0a, 0x0a, 0x6b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x41, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x75, 0x6c, 0x65, 0x2e, 0x4b, 0x75, 0x62,
+	0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x52, 0x0a, 0x6b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65,
+	0x74, 0x65, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x1a, 0x85, 0x01, 0x0a, 0x0a, 0x4b, 0x75, 0x62, 0x65,
+	0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x12, 0x50, 0x0a, 0x0b, 0x69, 0x6d, 0x70, 0x65, 0x72, 0x73,
+	0x6f, 0x6e, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x73, 0x70,
+	0x65, 0x63, 0x73, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x52, 0x75, 0x6c, 0x65, 0x2e, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x2e,
+	0x49, 0x6d, 0x70, 0x65, 0x72, 0x73, 0x6f, 0x6e, 0x61, 0x74, 0x65, 0x52, 0x0b, 0x69, 0x6d, 0x70,
+	0x65, 0x72, 0x73, 0x6f, 0x6e, 0x61, 0x74, 0x65, 0x1a, 0x25, 0x0a, 0x0b, 0x49, 0x6d, 0x70, 0x65,
+	0x72, 0x73, 0x6f, 0x6e, 0x61, 0x74, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x22,
+	0x89, 0x05, 0x0a, 0x10, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x54, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x30, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x41,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x54, 0x65, 0x73, 0x74, 0x2e,
+	0x55, 0x73, 0x65, 0x72, 0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12, 0x39, 0x0a, 0x07, 0x63, 0x6c,
+	0x75, 0x73, 0x74, 0x65, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x73, 0x70,
+	0x65, 0x63, 0x73, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x54, 0x65, 0x73, 0x74, 0x2e, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x07, 0x63, 0x6c,
+	0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x3c, 0x0a, 0x08, 0x65, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65,
+	0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e,
+	0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x54, 0x65, 0x73, 0x74,
+	0x2e, 0x45, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x52, 0x08, 0x65, 0x78, 0x70, 0x65, 0x63,
+	0x74, 0x65, 0x64, 0x1a, 0xfc, 0x01, 0x0a, 0x08, 0x45, 0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64,
+	0x12, 0x4b, 0x0a, 0x0a, 0x6b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x54, 0x65, 0x73, 0x74, 0x2e, 0x45, 0x78,
+	0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x2e, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65,
+	0x73, 0x52, 0x0a, 0x6b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x12, 0x12, 0x0a,
+	0x04, 0x72, 0x6f, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x72, 0x6f, 0x6c,
+	0x65, 0x1a, 0x8e, 0x01, 0x0a, 0x0a, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73,
+	0x12, 0x59, 0x0a, 0x0b, 0x69, 0x6d, 0x70, 0x65, 0x72, 0x73, 0x6f, 0x6e, 0x61, 0x74, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x37, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x41, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x54, 0x65, 0x73, 0x74, 0x2e, 0x45,
+	0x78, 0x70, 0x65, 0x63, 0x74, 0x65, 0x64, 0x2e, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74,
+	0x65, 0x73, 0x2e, 0x49, 0x6d, 0x70, 0x65, 0x72, 0x73, 0x6f, 0x6e, 0x61, 0x74, 0x65, 0x52, 0x0b,
+	0x69, 0x6d, 0x70, 0x65, 0x72, 0x73, 0x6f, 0x6e, 0x61, 0x74, 0x65, 0x1a, 0x25, 0x0a, 0x0b, 0x49,
+	0x6d, 0x70, 0x65, 0x72, 0x73, 0x6f, 0x6e, 0x61, 0x74, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x67, 0x72,
+	0x6f, 0x75, 0x70, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x67, 0x72, 0x6f, 0x75,
+	0x70, 0x73, 0x1a, 0x97, 0x01, 0x0a, 0x04, 0x55, 0x73, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x40, 0x0a, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x28, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x50, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x54, 0x65, 0x73, 0x74, 0x2e, 0x55, 0x73, 0x65, 0x72, 0x2e, 0x4c, 0x61,
+	0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c,
+	0x73, 0x1a, 0x39, 0x0a, 0x0b, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x1d, 0x0a, 0x07,
+	0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0xcd, 0x03, 0x0a, 0x10,
+	0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x53, 0x70, 0x65, 0x63,
+	0x12, 0x48, 0x0a, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18,
+	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x41, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x55,
+	0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0a,
+	0x75, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x51, 0x0a, 0x0e, 0x63, 0x6c,
+	0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x43, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0d,
+	0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x2d, 0x0a,
+	0x05, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x73,
+	0x70, 0x65, 0x63, 0x73, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63,
+	0x79, 0x52, 0x75, 0x6c, 0x65, 0x52, 0x05, 0x72, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x2d, 0x0a, 0x05,
+	0x74, 0x65, 0x73, 0x74, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x73, 0x70,
+	0x65, 0x63, 0x73, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x54, 0x65, 0x73, 0x74, 0x52, 0x05, 0x74, 0x65, 0x73, 0x74, 0x73, 0x1a, 0x5b, 0x0a, 0x0f, 0x55,
+	0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10,
+	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
+	0x12, 0x32, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1c, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x50, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x55, 0x73, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x52, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x61, 0x0a, 0x12, 0x43, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10,
+	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
+	0x12, 0x35, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1f, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x50, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x75, 0x0a, 0x11, 0x53,
+	0x41, 0x4d, 0x4c, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x52, 0x75, 0x6c, 0x65, 0x53, 0x70, 0x65, 0x63,
+	0x12, 0x21, 0x0a, 0x0c, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x5f, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0b, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x4c, 0x61, 0x62,
+	0x65, 0x6c, 0x73, 0x12, 0x3d, 0x0a, 0x1b, 0x61, 0x73, 0x73, 0x69, 0x67, 0x6e, 0x5f, 0x72, 0x6f,
+	0x6c, 0x65, 0x5f, 0x6f, 0x6e, 0x5f, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x18, 0x61, 0x73, 0x73, 0x69, 0x67, 0x6e,
+	0x52, 0x6f, 0x6c, 0x65, 0x4f, 0x6e, 0x52, 0x65, 0x67, 0x69, 0x73, 0x74, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x42, 0x32, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x73, 0x69, 0x64, 0x65, 0x72, 0x6f, 0x6c, 0x61, 0x62, 0x73, 0x2f, 0x6f, 0x6d, 0x6e, 0x69,
+	0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x6f, 0x6d, 0x6e, 0x69,
+	0x2f, 0x73, 0x70, 0x65, 0x63, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_omni_specs_auth_proto_rawDescOnce sync.Once
+	file_omni_specs_auth_proto_rawDescData = file_omni_specs_auth_proto_rawDesc
+)
+
+func file_omni_specs_auth_proto_rawDescGZIP() []byte {
+	file_omni_specs_auth_proto_rawDescOnce.Do(func() {
+		file_omni_specs_auth_proto_rawDescData = protoimpl.X.CompressGZIP(file_omni_specs_auth_proto_rawDescData)
+	})
+	return file_omni_specs_auth_proto_rawDescData
+}
+
+var file_omni_specs_auth_proto_msgTypes = make([]protoimpl.MessageInfo, 28)
+var file_omni_specs_auth_proto_goTypes = []interface{}{
+	(*AuthConfigSpec)(nil),                                   // 0: specs.AuthConfigSpec
+	(*SAMLAssertionSpec)(nil),                                // 1: specs.SAMLAssertionSpec
+	(*UserSpec)(nil),                                         // 2: specs.UserSpec
+	(*IdentitySpec)(nil),                                     // 3: specs.IdentitySpec
+	(*Identity)(nil),                                         // 4: specs.Identity
+	(*PublicKeySpec)(nil),                                    // 5: specs.PublicKeySpec
+	(*AccessPolicyUserGroup)(nil),                            // 6: specs.AccessPolicyUserGroup
+	(*AccessPolicyClusterGroup)(nil),                         // 7: specs.AccessPolicyClusterGroup
+	(*AccessPolicyRule)(nil),                                 // 8: specs.AccessPolicyRule
+	(*AccessPolicyTest)(nil),                                 // 9: specs.AccessPolicyTest
+	(*AccessPolicySpec)(nil),                                 // 10: specs.AccessPolicySpec
+	(*SAMLLabelRuleSpec)(nil),                                // 11: specs.SAMLLabelRuleSpec
+	(*AuthConfigSpec_Auth0)(nil),                             // 12: specs.AuthConfigSpec.Auth0
+	(*AuthConfigSpec_Webauthn)(nil),                          // 13: specs.AuthConfigSpec.Webauthn
+	(*AuthConfigSpec_SAML)(nil),                              // 14: specs.AuthConfigSpec.SAML
+	nil,                                                      // 15: specs.AuthConfigSpec.SAML.LabelRulesEntry
+	(*AccessPolicyUserGroup_User)(nil),                       // 16: specs.AccessPolicyUserGroup.User
+	(*AccessPolicyClusterGroup_Cluster)(nil),                 // 17: specs.AccessPolicyClusterGroup.Cluster
+	(*AccessPolicyRule_Kubernetes)(nil),                      // 18: specs.AccessPolicyRule.Kubernetes
+	(*AccessPolicyRule_Kubernetes_Impersonate)(nil),          // 19: specs.AccessPolicyRule.Kubernetes.Impersonate
+	(*AccessPolicyTest_Expected)(nil),                        // 20: specs.AccessPolicyTest.Expected
+	(*AccessPolicyTest_User)(nil),                            // 21: specs.AccessPolicyTest.User
+	(*AccessPolicyTest_Cluster)(nil),                         // 22: specs.AccessPolicyTest.Cluster
+	(*AccessPolicyTest_Expected_Kubernetes)(nil),             // 23: specs.AccessPolicyTest.Expected.Kubernetes
+	(*AccessPolicyTest_Expected_Kubernetes_Impersonate)(nil), // 24: specs.AccessPolicyTest.Expected.Kubernetes.Impersonate
+	nil,                           // 25: specs.AccessPolicyTest.User.LabelsEntry
+	nil,                           // 26: specs.AccessPolicySpec.UserGroupsEntry
+	nil,                           // 27: specs.AccessPolicySpec.ClusterGroupsEntry
+	(*timestamppb.Timestamp)(nil), // 28: google.protobuf.Timestamp
+}
+var file_omni_specs_auth_proto_depIdxs = []int32{
+	12, // 0: specs.AuthConfigSpec.auth0:type_name -> specs.AuthConfigSpec.Auth0
+	13, // 1: specs.AuthConfigSpec.webauthn:type_name -> specs.AuthConfigSpec.Webauthn
+	14, // 2: specs.AuthConfigSpec.saml:type_name -> specs.AuthConfigSpec.SAML
+	28, // 3: specs.PublicKeySpec.expiration:type_name -> google.protobuf.Timestamp
+	4,  // 4: specs.PublicKeySpec.identity:type_name -> specs.Identity
+	16, // 5: specs.AccessPolicyUserGroup.users:type_name -> specs.AccessPolicyUserGroup.User
+	17, // 6: specs.AccessPolicyClusterGroup.clusters:type_name -> specs.AccessPolicyClusterGroup.Cluster
+	18, // 7: specs.AccessPolicyRule.kubernetes:type_name -> specs.AccessPolicyRule.Kubernetes
+	21, // 8: specs.AccessPolicyTest.user:type_name -> specs.AccessPolicyTest.User
+	22, // 9: specs.AccessPolicyTest.cluster:type_name -> specs.AccessPolicyTest.Cluster
+	20, // 10: specs.AccessPolicyTest.expected:type_name -> specs.AccessPolicyTest.Expected
+	26, // 11: specs.AccessPolicySpec.user_groups:type_name -> specs.AccessPolicySpec.UserGroupsEntry
+	27, // 12: specs.AccessPolicySpec.cluster_groups:type_name -> specs.AccessPolicySpec.ClusterGroupsEntry
+	8,  // 13: specs.AccessPolicySpec.rules:type_name -> specs.AccessPolicyRule
+	9,  // 14: specs.AccessPolicySpec.tests:type_name -> specs.AccessPolicyTest
+	15, // 15: specs.AuthConfigSpec.SAML.label_rules:type_name -> specs.AuthConfigSpec.SAML.LabelRulesEntry
+	19, // 16: specs.AccessPolicyRule.Kubernetes.impersonate:type_name -> specs.AccessPolicyRule.Kubernetes.Impersonate
+	23, // 17: specs.AccessPolicyTest.Expected.kubernetes:type_name -> specs.AccessPolicyTest.Expected.Kubernetes
+	25, // 18: specs.AccessPolicyTest.User.labels:type_name -> specs.AccessPolicyTest.User.LabelsEntry
+	24, // 19: specs.AccessPolicyTest.Expected.Kubernetes.impersonate:type_name -> specs.AccessPolicyTest.Expected.Kubernetes.Impersonate
+	6,  // 20: specs.AccessPolicySpec.UserGroupsEntry.value:type_name -> specs.AccessPolicyUserGroup
+	7,  // 21: specs.AccessPolicySpec.ClusterGroupsEntry.value:type_name -> specs.AccessPolicyClusterGroup
+	22, // [22:22] is the sub-list for method output_type
+	22, // [22:22] is the sub-list for method input_type
+	22, // [22:22] is the sub-list for extension type_name
+	22, // [22:22] is the sub-list for extension extendee
+	0,  // [0:22] is the sub-list for field type_name
+}
+
+func init() { file_omni_specs_auth_proto_init() }
+func file_omni_specs_auth_proto_init() {
+	if File_omni_specs_auth_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_omni_specs_auth_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthConfigSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SAMLAssertionSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UserSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*IdentitySpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Identity); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PublicKeySpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessPolicyUserGroup); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessPolicyClusterGroup); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessPolicyRule); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessPolicyTest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessPolicySpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SAMLLabelRuleSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthConfigSpec_Auth0); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthConfigSpec_Webauthn); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthConfigSpec_SAML); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessPolicyUserGroup_User); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessPolicyClusterGroup_Cluster); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessPolicyRule_Kubernetes); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessPolicyRule_Kubernetes_Impersonate); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessPolicyTest_Expected); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessPolicyTest_User); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessPolicyTest_Cluster); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessPolicyTest_Expected_Kubernetes); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_auth_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AccessPolicyTest_Expected_Kubernetes_Impersonate); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_omni_specs_auth_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   28,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_omni_specs_auth_proto_goTypes,
+		DependencyIndexes: file_omni_specs_auth_proto_depIdxs,
+		MessageInfos:      file_omni_specs_auth_proto_msgTypes,
+	}.Build()
+	File_omni_specs_auth_proto = out.File
+	file_omni_specs_auth_proto_rawDesc = nil
+	file_omni_specs_auth_proto_goTypes = nil
+	file_omni_specs_auth_proto_depIdxs = nil
+}
diff --git a/client/api/omni/specs/auth.proto b/client/api/omni/specs/auth.proto
new file mode 100644
index 000000000..1a7626412
--- /dev/null
+++ b/client/api/omni/specs/auth.proto
@@ -0,0 +1,165 @@
+syntax = "proto3";
+package specs;
+
+option go_package = "github.com/siderolabs/omni/client/api/omni/specs";
+
+import "talos/machine/machine.proto";
+import "google/protobuf/timestamp.proto";
+
+// AuthConfigSpec describes the authentication configuration.
+message AuthConfigSpec {
+  message Auth0 {
+    bool enabled = 1;
+    string domain = 2;
+    string client_id = 3;
+  }
+
+  message Webauthn {
+    bool enabled = 1;
+    bool required = 2;
+  }
+
+  message SAML {
+    bool enabled = 1;
+    string url = 2;
+    string metadata = 3;
+    // LabelRules defines custom rules on how to extract SAML attributes from the
+    // saml assertion and turn them into labels.
+    map<string, string> label_rules = 4;
+  }
+
+  Auth0 auth0 = 1;
+  Webauthn webauthn = 2;
+  bool suspended = 3;
+  SAML saml = 4;
+}
+
+// SAMLAssertionSpec describes SAML assertion.
+message SAMLAssertionSpec {
+  // Data keeps JSON encoded SAML assertion.
+  bytes data = 1;
+
+  // Email is the identity that was read from the assertion.
+  string email = 2;
+
+  // Used marks SAML assertion as used.
+  bool used = 3;
+}
+
+// UserSpec describes a user.
+message UserSpec {
+  reserved 1;
+  // Scopes are deprecated, use roles instead.
+  //
+  // Deprecated: will be removed once all environments are migrated to use roles.
+  // TODO: remove after all environments are migrated to use roles.
+  repeated string scopes = 2;
+  string role = 3;
+}
+
+// IdentitySpec describes a user identity.
+message IdentitySpec {
+  string user_id = 1;
+}
+
+message Identity {
+  string email = 1;
+}
+
+// PublicKeySpec describes a user or service account public key.
+message PublicKeySpec {
+  bytes public_key = 1;
+  // Scopes are deprecated, use roles instead.
+  //
+  // Deprecated: will be removed once all environments are migrated to use roles.
+  // TODO: remove after all environments are migrated to use roles.
+  repeated string scopes = 2;
+  google.protobuf.Timestamp expiration = 3;
+  bool confirmed = 4;
+  Identity identity = 5;
+  string role = 6;
+}
+
+// AccessPolicyUserGroup describes a user group in the ACLs context.
+message AccessPolicyUserGroup {
+  message User {
+    string name = 1;
+    string match = 2;
+    repeated string label_selectors = 3;
+  }
+
+  repeated User users = 1;
+}
+
+// AccessPolicyClusterGroup describes a cluster group in the ACLs context.
+message AccessPolicyClusterGroup {
+  message Cluster {
+    string name = 1;
+    string match = 2;
+  }
+
+  repeated Cluster clusters = 1;
+}
+
+// AccessPolicyRule describes a rule in the ACLs context.
+message AccessPolicyRule {
+  message Kubernetes {
+    message Impersonate {
+      repeated string groups = 1;
+    }
+
+    Impersonate impersonate = 1;
+  }
+
+  repeated string users = 1;
+  repeated string clusters = 2;
+  Kubernetes kubernetes = 3;
+  string role = 4;
+}
+
+message AccessPolicyTest {
+  message Expected {
+    message Kubernetes {
+      message Impersonate {
+        repeated string groups = 1;
+      }
+
+      Impersonate impersonate = 1;
+    }
+
+    Kubernetes kubernetes = 1;
+    string role = 2;
+  }
+
+  message User {
+    string name = 1;
+    map<string, string> labels = 2;
+  }
+
+  message Cluster {
+    string name = 1;
+  }
+
+  string name = 1;
+  User user = 2;
+  Cluster cluster = 3;
+  Expected expected = 4;
+}
+
+// AccessPolicySpec describes the access policy configuration.
+message AccessPolicySpec {
+   map<string, AccessPolicyUserGroup> user_groups = 1;
+   map<string, AccessPolicyClusterGroup> cluster_groups = 2;
+   repeated AccessPolicyRule rules = 3;
+   repeated AccessPolicyTest tests = 4;
+}
+
+// SAMLLabelRuleSpec describes a rule on how to map Identity labels to Omni roles.
+//
+message SAMLLabelRuleSpec {
+  // MatchLabels is the list of labels to match the user's Identity against this rule.
+  repeated string match_labels = 1;
+
+  // AssignRoleOnRegistration is the role to be assigned to the user if this rule matches.
+  string assign_role_on_registration = 2;
+}
diff --git a/client/api/omni/specs/auth_vtproto.pb.go b/client/api/omni/specs/auth_vtproto.pb.go
new file mode 100644
index 000000000..760c01077
--- /dev/null
+++ b/client/api/omni/specs/auth_vtproto.pb.go
@@ -0,0 +1,6474 @@
+// Code generated by protoc-gen-go-vtproto. DO NOT EDIT.
+// protoc-gen-go-vtproto version: v0.6.0
+// source: omni/specs/auth.proto
+
+package specs
+
+import (
+	fmt "fmt"
+	io "io"
+
+	protohelpers "github.com/planetscale/vtprotobuf/protohelpers"
+	timestamppb1 "github.com/planetscale/vtprotobuf/types/known/timestamppb"
+	proto "google.golang.org/protobuf/proto"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+func (m *AuthConfigSpec_Auth0) CloneVT() *AuthConfigSpec_Auth0 {
+	if m == nil {
+		return (*AuthConfigSpec_Auth0)(nil)
+	}
+	r := new(AuthConfigSpec_Auth0)
+	r.Enabled = m.Enabled
+	r.Domain = m.Domain
+	r.ClientId = m.ClientId
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AuthConfigSpec_Auth0) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AuthConfigSpec_Webauthn) CloneVT() *AuthConfigSpec_Webauthn {
+	if m == nil {
+		return (*AuthConfigSpec_Webauthn)(nil)
+	}
+	r := new(AuthConfigSpec_Webauthn)
+	r.Enabled = m.Enabled
+	r.Required = m.Required
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AuthConfigSpec_Webauthn) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AuthConfigSpec_SAML) CloneVT() *AuthConfigSpec_SAML {
+	if m == nil {
+		return (*AuthConfigSpec_SAML)(nil)
+	}
+	r := new(AuthConfigSpec_SAML)
+	r.Enabled = m.Enabled
+	r.Url = m.Url
+	r.Metadata = m.Metadata
+	if rhs := m.LabelRules; rhs != nil {
+		tmpContainer := make(map[string]string, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v
+		}
+		r.LabelRules = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AuthConfigSpec_SAML) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AuthConfigSpec) CloneVT() *AuthConfigSpec {
+	if m == nil {
+		return (*AuthConfigSpec)(nil)
+	}
+	r := new(AuthConfigSpec)
+	r.Auth0 = m.Auth0.CloneVT()
+	r.Webauthn = m.Webauthn.CloneVT()
+	r.Suspended = m.Suspended
+	r.Saml = m.Saml.CloneVT()
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AuthConfigSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *SAMLAssertionSpec) CloneVT() *SAMLAssertionSpec {
+	if m == nil {
+		return (*SAMLAssertionSpec)(nil)
+	}
+	r := new(SAMLAssertionSpec)
+	r.Email = m.Email
+	r.Used = m.Used
+	if rhs := m.Data; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.Data = tmpBytes
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *SAMLAssertionSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *UserSpec) CloneVT() *UserSpec {
+	if m == nil {
+		return (*UserSpec)(nil)
+	}
+	r := new(UserSpec)
+	r.Role = m.Role
+	if rhs := m.Scopes; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.Scopes = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *UserSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *IdentitySpec) CloneVT() *IdentitySpec {
+	if m == nil {
+		return (*IdentitySpec)(nil)
+	}
+	r := new(IdentitySpec)
+	r.UserId = m.UserId
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *IdentitySpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *Identity) CloneVT() *Identity {
+	if m == nil {
+		return (*Identity)(nil)
+	}
+	r := new(Identity)
+	r.Email = m.Email
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *Identity) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *PublicKeySpec) CloneVT() *PublicKeySpec {
+	if m == nil {
+		return (*PublicKeySpec)(nil)
+	}
+	r := new(PublicKeySpec)
+	r.Expiration = (*timestamppb.Timestamp)((*timestamppb1.Timestamp)(m.Expiration).CloneVT())
+	r.Confirmed = m.Confirmed
+	r.Identity = m.Identity.CloneVT()
+	r.Role = m.Role
+	if rhs := m.PublicKey; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.PublicKey = tmpBytes
+	}
+	if rhs := m.Scopes; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.Scopes = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *PublicKeySpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AccessPolicyUserGroup_User) CloneVT() *AccessPolicyUserGroup_User {
+	if m == nil {
+		return (*AccessPolicyUserGroup_User)(nil)
+	}
+	r := new(AccessPolicyUserGroup_User)
+	r.Name = m.Name
+	r.Match = m.Match
+	if rhs := m.LabelSelectors; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.LabelSelectors = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AccessPolicyUserGroup_User) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AccessPolicyUserGroup) CloneVT() *AccessPolicyUserGroup {
+	if m == nil {
+		return (*AccessPolicyUserGroup)(nil)
+	}
+	r := new(AccessPolicyUserGroup)
+	if rhs := m.Users; rhs != nil {
+		tmpContainer := make([]*AccessPolicyUserGroup_User, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.Users = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AccessPolicyUserGroup) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AccessPolicyClusterGroup_Cluster) CloneVT() *AccessPolicyClusterGroup_Cluster {
+	if m == nil {
+		return (*AccessPolicyClusterGroup_Cluster)(nil)
+	}
+	r := new(AccessPolicyClusterGroup_Cluster)
+	r.Name = m.Name
+	r.Match = m.Match
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AccessPolicyClusterGroup_Cluster) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AccessPolicyClusterGroup) CloneVT() *AccessPolicyClusterGroup {
+	if m == nil {
+		return (*AccessPolicyClusterGroup)(nil)
+	}
+	r := new(AccessPolicyClusterGroup)
+	if rhs := m.Clusters; rhs != nil {
+		tmpContainer := make([]*AccessPolicyClusterGroup_Cluster, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.Clusters = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AccessPolicyClusterGroup) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AccessPolicyRule_Kubernetes_Impersonate) CloneVT() *AccessPolicyRule_Kubernetes_Impersonate {
+	if m == nil {
+		return (*AccessPolicyRule_Kubernetes_Impersonate)(nil)
+	}
+	r := new(AccessPolicyRule_Kubernetes_Impersonate)
+	if rhs := m.Groups; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.Groups = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AccessPolicyRule_Kubernetes_Impersonate) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AccessPolicyRule_Kubernetes) CloneVT() *AccessPolicyRule_Kubernetes {
+	if m == nil {
+		return (*AccessPolicyRule_Kubernetes)(nil)
+	}
+	r := new(AccessPolicyRule_Kubernetes)
+	r.Impersonate = m.Impersonate.CloneVT()
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AccessPolicyRule_Kubernetes) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AccessPolicyRule) CloneVT() *AccessPolicyRule {
+	if m == nil {
+		return (*AccessPolicyRule)(nil)
+	}
+	r := new(AccessPolicyRule)
+	r.Kubernetes = m.Kubernetes.CloneVT()
+	r.Role = m.Role
+	if rhs := m.Users; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.Users = tmpContainer
+	}
+	if rhs := m.Clusters; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.Clusters = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AccessPolicyRule) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AccessPolicyTest_Expected_Kubernetes_Impersonate) CloneVT() *AccessPolicyTest_Expected_Kubernetes_Impersonate {
+	if m == nil {
+		return (*AccessPolicyTest_Expected_Kubernetes_Impersonate)(nil)
+	}
+	r := new(AccessPolicyTest_Expected_Kubernetes_Impersonate)
+	if rhs := m.Groups; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.Groups = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AccessPolicyTest_Expected_Kubernetes_Impersonate) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AccessPolicyTest_Expected_Kubernetes) CloneVT() *AccessPolicyTest_Expected_Kubernetes {
+	if m == nil {
+		return (*AccessPolicyTest_Expected_Kubernetes)(nil)
+	}
+	r := new(AccessPolicyTest_Expected_Kubernetes)
+	r.Impersonate = m.Impersonate.CloneVT()
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AccessPolicyTest_Expected_Kubernetes) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AccessPolicyTest_Expected) CloneVT() *AccessPolicyTest_Expected {
+	if m == nil {
+		return (*AccessPolicyTest_Expected)(nil)
+	}
+	r := new(AccessPolicyTest_Expected)
+	r.Kubernetes = m.Kubernetes.CloneVT()
+	r.Role = m.Role
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AccessPolicyTest_Expected) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AccessPolicyTest_User) CloneVT() *AccessPolicyTest_User {
+	if m == nil {
+		return (*AccessPolicyTest_User)(nil)
+	}
+	r := new(AccessPolicyTest_User)
+	r.Name = m.Name
+	if rhs := m.Labels; rhs != nil {
+		tmpContainer := make(map[string]string, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v
+		}
+		r.Labels = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AccessPolicyTest_User) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AccessPolicyTest_Cluster) CloneVT() *AccessPolicyTest_Cluster {
+	if m == nil {
+		return (*AccessPolicyTest_Cluster)(nil)
+	}
+	r := new(AccessPolicyTest_Cluster)
+	r.Name = m.Name
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AccessPolicyTest_Cluster) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AccessPolicyTest) CloneVT() *AccessPolicyTest {
+	if m == nil {
+		return (*AccessPolicyTest)(nil)
+	}
+	r := new(AccessPolicyTest)
+	r.Name = m.Name
+	r.User = m.User.CloneVT()
+	r.Cluster = m.Cluster.CloneVT()
+	r.Expected = m.Expected.CloneVT()
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AccessPolicyTest) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *AccessPolicySpec) CloneVT() *AccessPolicySpec {
+	if m == nil {
+		return (*AccessPolicySpec)(nil)
+	}
+	r := new(AccessPolicySpec)
+	if rhs := m.UserGroups; rhs != nil {
+		tmpContainer := make(map[string]*AccessPolicyUserGroup, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.UserGroups = tmpContainer
+	}
+	if rhs := m.ClusterGroups; rhs != nil {
+		tmpContainer := make(map[string]*AccessPolicyClusterGroup, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.ClusterGroups = tmpContainer
+	}
+	if rhs := m.Rules; rhs != nil {
+		tmpContainer := make([]*AccessPolicyRule, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.Rules = tmpContainer
+	}
+	if rhs := m.Tests; rhs != nil {
+		tmpContainer := make([]*AccessPolicyTest, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.Tests = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *AccessPolicySpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *SAMLLabelRuleSpec) CloneVT() *SAMLLabelRuleSpec {
+	if m == nil {
+		return (*SAMLLabelRuleSpec)(nil)
+	}
+	r := new(SAMLLabelRuleSpec)
+	r.AssignRoleOnRegistration = m.AssignRoleOnRegistration
+	if rhs := m.MatchLabels; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.MatchLabels = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *SAMLLabelRuleSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (this *AuthConfigSpec_Auth0) EqualVT(that *AuthConfigSpec_Auth0) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Enabled != that.Enabled {
+		return false
+	}
+	if this.Domain != that.Domain {
+		return false
+	}
+	if this.ClientId != that.ClientId {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AuthConfigSpec_Auth0) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AuthConfigSpec_Auth0)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AuthConfigSpec_Webauthn) EqualVT(that *AuthConfigSpec_Webauthn) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Enabled != that.Enabled {
+		return false
+	}
+	if this.Required != that.Required {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AuthConfigSpec_Webauthn) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AuthConfigSpec_Webauthn)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AuthConfigSpec_SAML) EqualVT(that *AuthConfigSpec_SAML) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Enabled != that.Enabled {
+		return false
+	}
+	if this.Url != that.Url {
+		return false
+	}
+	if this.Metadata != that.Metadata {
+		return false
+	}
+	if len(this.LabelRules) != len(that.LabelRules) {
+		return false
+	}
+	for i, vx := range this.LabelRules {
+		vy, ok := that.LabelRules[i]
+		if !ok {
+			return false
+		}
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AuthConfigSpec_SAML) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AuthConfigSpec_SAML)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AuthConfigSpec) EqualVT(that *AuthConfigSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !this.Auth0.EqualVT(that.Auth0) {
+		return false
+	}
+	if !this.Webauthn.EqualVT(that.Webauthn) {
+		return false
+	}
+	if this.Suspended != that.Suspended {
+		return false
+	}
+	if !this.Saml.EqualVT(that.Saml) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AuthConfigSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AuthConfigSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *SAMLAssertionSpec) EqualVT(that *SAMLAssertionSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if string(this.Data) != string(that.Data) {
+		return false
+	}
+	if this.Email != that.Email {
+		return false
+	}
+	if this.Used != that.Used {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *SAMLAssertionSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*SAMLAssertionSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *UserSpec) EqualVT(that *UserSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Scopes) != len(that.Scopes) {
+		return false
+	}
+	for i, vx := range this.Scopes {
+		vy := that.Scopes[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if this.Role != that.Role {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *UserSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*UserSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *IdentitySpec) EqualVT(that *IdentitySpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.UserId != that.UserId {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *IdentitySpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*IdentitySpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *Identity) EqualVT(that *Identity) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Email != that.Email {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *Identity) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*Identity)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *PublicKeySpec) EqualVT(that *PublicKeySpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if string(this.PublicKey) != string(that.PublicKey) {
+		return false
+	}
+	if len(this.Scopes) != len(that.Scopes) {
+		return false
+	}
+	for i, vx := range this.Scopes {
+		vy := that.Scopes[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if !(*timestamppb1.Timestamp)(this.Expiration).EqualVT((*timestamppb1.Timestamp)(that.Expiration)) {
+		return false
+	}
+	if this.Confirmed != that.Confirmed {
+		return false
+	}
+	if !this.Identity.EqualVT(that.Identity) {
+		return false
+	}
+	if this.Role != that.Role {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *PublicKeySpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*PublicKeySpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AccessPolicyUserGroup_User) EqualVT(that *AccessPolicyUserGroup_User) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Name != that.Name {
+		return false
+	}
+	if this.Match != that.Match {
+		return false
+	}
+	if len(this.LabelSelectors) != len(that.LabelSelectors) {
+		return false
+	}
+	for i, vx := range this.LabelSelectors {
+		vy := that.LabelSelectors[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AccessPolicyUserGroup_User) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AccessPolicyUserGroup_User)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AccessPolicyUserGroup) EqualVT(that *AccessPolicyUserGroup) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Users) != len(that.Users) {
+		return false
+	}
+	for i, vx := range this.Users {
+		vy := that.Users[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &AccessPolicyUserGroup_User{}
+			}
+			if q == nil {
+				q = &AccessPolicyUserGroup_User{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AccessPolicyUserGroup) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AccessPolicyUserGroup)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AccessPolicyClusterGroup_Cluster) EqualVT(that *AccessPolicyClusterGroup_Cluster) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Name != that.Name {
+		return false
+	}
+	if this.Match != that.Match {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AccessPolicyClusterGroup_Cluster) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AccessPolicyClusterGroup_Cluster)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AccessPolicyClusterGroup) EqualVT(that *AccessPolicyClusterGroup) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Clusters) != len(that.Clusters) {
+		return false
+	}
+	for i, vx := range this.Clusters {
+		vy := that.Clusters[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &AccessPolicyClusterGroup_Cluster{}
+			}
+			if q == nil {
+				q = &AccessPolicyClusterGroup_Cluster{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AccessPolicyClusterGroup) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AccessPolicyClusterGroup)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AccessPolicyRule_Kubernetes_Impersonate) EqualVT(that *AccessPolicyRule_Kubernetes_Impersonate) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Groups) != len(that.Groups) {
+		return false
+	}
+	for i, vx := range this.Groups {
+		vy := that.Groups[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AccessPolicyRule_Kubernetes_Impersonate) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AccessPolicyRule_Kubernetes_Impersonate)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AccessPolicyRule_Kubernetes) EqualVT(that *AccessPolicyRule_Kubernetes) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !this.Impersonate.EqualVT(that.Impersonate) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AccessPolicyRule_Kubernetes) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AccessPolicyRule_Kubernetes)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AccessPolicyRule) EqualVT(that *AccessPolicyRule) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Users) != len(that.Users) {
+		return false
+	}
+	for i, vx := range this.Users {
+		vy := that.Users[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if len(this.Clusters) != len(that.Clusters) {
+		return false
+	}
+	for i, vx := range this.Clusters {
+		vy := that.Clusters[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if !this.Kubernetes.EqualVT(that.Kubernetes) {
+		return false
+	}
+	if this.Role != that.Role {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AccessPolicyRule) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AccessPolicyRule)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AccessPolicyTest_Expected_Kubernetes_Impersonate) EqualVT(that *AccessPolicyTest_Expected_Kubernetes_Impersonate) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Groups) != len(that.Groups) {
+		return false
+	}
+	for i, vx := range this.Groups {
+		vy := that.Groups[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AccessPolicyTest_Expected_Kubernetes_Impersonate) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AccessPolicyTest_Expected_Kubernetes_Impersonate)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AccessPolicyTest_Expected_Kubernetes) EqualVT(that *AccessPolicyTest_Expected_Kubernetes) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !this.Impersonate.EqualVT(that.Impersonate) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AccessPolicyTest_Expected_Kubernetes) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AccessPolicyTest_Expected_Kubernetes)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AccessPolicyTest_Expected) EqualVT(that *AccessPolicyTest_Expected) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !this.Kubernetes.EqualVT(that.Kubernetes) {
+		return false
+	}
+	if this.Role != that.Role {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AccessPolicyTest_Expected) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AccessPolicyTest_Expected)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AccessPolicyTest_User) EqualVT(that *AccessPolicyTest_User) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Name != that.Name {
+		return false
+	}
+	if len(this.Labels) != len(that.Labels) {
+		return false
+	}
+	for i, vx := range this.Labels {
+		vy, ok := that.Labels[i]
+		if !ok {
+			return false
+		}
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AccessPolicyTest_User) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AccessPolicyTest_User)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AccessPolicyTest_Cluster) EqualVT(that *AccessPolicyTest_Cluster) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Name != that.Name {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AccessPolicyTest_Cluster) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AccessPolicyTest_Cluster)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AccessPolicyTest) EqualVT(that *AccessPolicyTest) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Name != that.Name {
+		return false
+	}
+	if !this.User.EqualVT(that.User) {
+		return false
+	}
+	if !this.Cluster.EqualVT(that.Cluster) {
+		return false
+	}
+	if !this.Expected.EqualVT(that.Expected) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AccessPolicyTest) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AccessPolicyTest)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *AccessPolicySpec) EqualVT(that *AccessPolicySpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.UserGroups) != len(that.UserGroups) {
+		return false
+	}
+	for i, vx := range this.UserGroups {
+		vy, ok := that.UserGroups[i]
+		if !ok {
+			return false
+		}
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &AccessPolicyUserGroup{}
+			}
+			if q == nil {
+				q = &AccessPolicyUserGroup{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if len(this.ClusterGroups) != len(that.ClusterGroups) {
+		return false
+	}
+	for i, vx := range this.ClusterGroups {
+		vy, ok := that.ClusterGroups[i]
+		if !ok {
+			return false
+		}
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &AccessPolicyClusterGroup{}
+			}
+			if q == nil {
+				q = &AccessPolicyClusterGroup{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if len(this.Rules) != len(that.Rules) {
+		return false
+	}
+	for i, vx := range this.Rules {
+		vy := that.Rules[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &AccessPolicyRule{}
+			}
+			if q == nil {
+				q = &AccessPolicyRule{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if len(this.Tests) != len(that.Tests) {
+		return false
+	}
+	for i, vx := range this.Tests {
+		vy := that.Tests[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &AccessPolicyTest{}
+			}
+			if q == nil {
+				q = &AccessPolicyTest{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *AccessPolicySpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*AccessPolicySpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *SAMLLabelRuleSpec) EqualVT(that *SAMLLabelRuleSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.MatchLabels) != len(that.MatchLabels) {
+		return false
+	}
+	for i, vx := range this.MatchLabels {
+		vy := that.MatchLabels[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if this.AssignRoleOnRegistration != that.AssignRoleOnRegistration {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *SAMLLabelRuleSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*SAMLLabelRuleSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (m *AuthConfigSpec_Auth0) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AuthConfigSpec_Auth0) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AuthConfigSpec_Auth0) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.ClientId) > 0 {
+		i -= len(m.ClientId)
+		copy(dAtA[i:], m.ClientId)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ClientId)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Domain) > 0 {
+		i -= len(m.Domain)
+		copy(dAtA[i:], m.Domain)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Domain)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Enabled {
+		i--
+		if m.Enabled {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AuthConfigSpec_Webauthn) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AuthConfigSpec_Webauthn) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AuthConfigSpec_Webauthn) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Required {
+		i--
+		if m.Required {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Enabled {
+		i--
+		if m.Enabled {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AuthConfigSpec_SAML) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AuthConfigSpec_SAML) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AuthConfigSpec_SAML) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.LabelRules) > 0 {
+		for k := range m.LabelRules {
+			v := m.LabelRules[k]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x22
+		}
+	}
+	if len(m.Metadata) > 0 {
+		i -= len(m.Metadata)
+		copy(dAtA[i:], m.Metadata)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Metadata)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Url) > 0 {
+		i -= len(m.Url)
+		copy(dAtA[i:], m.Url)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Url)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Enabled {
+		i--
+		if m.Enabled {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AuthConfigSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AuthConfigSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AuthConfigSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Saml != nil {
+		size, err := m.Saml.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.Suspended {
+		i--
+		if m.Suspended {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Webauthn != nil {
+		size, err := m.Webauthn.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Auth0 != nil {
+		size, err := m.Auth0.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *SAMLAssertionSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SAMLAssertionSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *SAMLAssertionSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Used {
+		i--
+		if m.Used {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.Email) > 0 {
+		i -= len(m.Email)
+		copy(dAtA[i:], m.Email)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Email)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Data) > 0 {
+		i -= len(m.Data)
+		copy(dAtA[i:], m.Data)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Data)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *UserSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *UserSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *UserSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Role) > 0 {
+		i -= len(m.Role)
+		copy(dAtA[i:], m.Role)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Role)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Scopes) > 0 {
+		for iNdEx := len(m.Scopes) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Scopes[iNdEx])
+			copy(dAtA[i:], m.Scopes[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Scopes[iNdEx])))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *IdentitySpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *IdentitySpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *IdentitySpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.UserId) > 0 {
+		i -= len(m.UserId)
+		copy(dAtA[i:], m.UserId)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.UserId)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Identity) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Identity) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *Identity) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Email) > 0 {
+		i -= len(m.Email)
+		copy(dAtA[i:], m.Email)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Email)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *PublicKeySpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PublicKeySpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *PublicKeySpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Role) > 0 {
+		i -= len(m.Role)
+		copy(dAtA[i:], m.Role)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Role)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if m.Identity != nil {
+		size, err := m.Identity.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.Confirmed {
+		i--
+		if m.Confirmed {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.Expiration != nil {
+		size, err := (*timestamppb1.Timestamp)(m.Expiration).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Scopes) > 0 {
+		for iNdEx := len(m.Scopes) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Scopes[iNdEx])
+			copy(dAtA[i:], m.Scopes[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Scopes[iNdEx])))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.PublicKey) > 0 {
+		i -= len(m.PublicKey)
+		copy(dAtA[i:], m.PublicKey)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.PublicKey)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessPolicyUserGroup_User) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessPolicyUserGroup_User) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AccessPolicyUserGroup_User) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.LabelSelectors) > 0 {
+		for iNdEx := len(m.LabelSelectors) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.LabelSelectors[iNdEx])
+			copy(dAtA[i:], m.LabelSelectors[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.LabelSelectors[iNdEx])))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.Match) > 0 {
+		i -= len(m.Match)
+		copy(dAtA[i:], m.Match)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Match)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessPolicyUserGroup) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessPolicyUserGroup) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AccessPolicyUserGroup) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Users) > 0 {
+		for iNdEx := len(m.Users) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Users[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessPolicyClusterGroup_Cluster) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessPolicyClusterGroup_Cluster) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AccessPolicyClusterGroup_Cluster) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Match) > 0 {
+		i -= len(m.Match)
+		copy(dAtA[i:], m.Match)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Match)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessPolicyClusterGroup) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessPolicyClusterGroup) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AccessPolicyClusterGroup) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Clusters) > 0 {
+		for iNdEx := len(m.Clusters) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Clusters[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessPolicyRule_Kubernetes_Impersonate) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessPolicyRule_Kubernetes_Impersonate) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AccessPolicyRule_Kubernetes_Impersonate) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Groups) > 0 {
+		for iNdEx := len(m.Groups) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Groups[iNdEx])
+			copy(dAtA[i:], m.Groups[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Groups[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessPolicyRule_Kubernetes) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessPolicyRule_Kubernetes) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AccessPolicyRule_Kubernetes) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Impersonate != nil {
+		size, err := m.Impersonate.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessPolicyRule) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessPolicyRule) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AccessPolicyRule) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Role) > 0 {
+		i -= len(m.Role)
+		copy(dAtA[i:], m.Role)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Role)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.Kubernetes != nil {
+		size, err := m.Kubernetes.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Clusters) > 0 {
+		for iNdEx := len(m.Clusters) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Clusters[iNdEx])
+			copy(dAtA[i:], m.Clusters[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Clusters[iNdEx])))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Users) > 0 {
+		for iNdEx := len(m.Users) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Users[iNdEx])
+			copy(dAtA[i:], m.Users[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Users[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessPolicyTest_Expected_Kubernetes_Impersonate) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessPolicyTest_Expected_Kubernetes_Impersonate) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AccessPolicyTest_Expected_Kubernetes_Impersonate) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Groups) > 0 {
+		for iNdEx := len(m.Groups) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Groups[iNdEx])
+			copy(dAtA[i:], m.Groups[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Groups[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessPolicyTest_Expected_Kubernetes) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessPolicyTest_Expected_Kubernetes) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AccessPolicyTest_Expected_Kubernetes) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Impersonate != nil {
+		size, err := m.Impersonate.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessPolicyTest_Expected) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessPolicyTest_Expected) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AccessPolicyTest_Expected) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Role) > 0 {
+		i -= len(m.Role)
+		copy(dAtA[i:], m.Role)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Role)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Kubernetes != nil {
+		size, err := m.Kubernetes.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessPolicyTest_User) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessPolicyTest_User) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AccessPolicyTest_User) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Labels) > 0 {
+		for k := range m.Labels {
+			v := m.Labels[k]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessPolicyTest_Cluster) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessPolicyTest_Cluster) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AccessPolicyTest_Cluster) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessPolicyTest) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessPolicyTest) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AccessPolicyTest) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Expected != nil {
+		size, err := m.Expected.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.Cluster != nil {
+		size, err := m.Cluster.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.User != nil {
+		size, err := m.User.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AccessPolicySpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *AccessPolicySpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *AccessPolicySpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Tests) > 0 {
+		for iNdEx := len(m.Tests) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Tests[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x22
+		}
+	}
+	if len(m.Rules) > 0 {
+		for iNdEx := len(m.Rules) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Rules[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.ClusterGroups) > 0 {
+		for k := range m.ClusterGroups {
+			v := m.ClusterGroups[k]
+			baseI := i
+			size, err := v.MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x12
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.UserGroups) > 0 {
+		for k := range m.UserGroups {
+			v := m.UserGroups[k]
+			baseI := i
+			size, err := v.MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x12
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *SAMLLabelRuleSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SAMLLabelRuleSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *SAMLLabelRuleSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.AssignRoleOnRegistration) > 0 {
+		i -= len(m.AssignRoleOnRegistration)
+		copy(dAtA[i:], m.AssignRoleOnRegistration)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.AssignRoleOnRegistration)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.MatchLabels) > 0 {
+		for iNdEx := len(m.MatchLabels) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.MatchLabels[iNdEx])
+			copy(dAtA[i:], m.MatchLabels[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.MatchLabels[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *AuthConfigSpec_Auth0) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Enabled {
+		n += 2
+	}
+	l = len(m.Domain)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ClientId)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AuthConfigSpec_Webauthn) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Enabled {
+		n += 2
+	}
+	if m.Required {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AuthConfigSpec_SAML) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Enabled {
+		n += 2
+	}
+	l = len(m.Url)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Metadata)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.LabelRules) > 0 {
+		for k, v := range m.LabelRules {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + protohelpers.SizeOfVarint(uint64(len(k))) + 1 + len(v) + protohelpers.SizeOfVarint(uint64(len(v)))
+			n += mapEntrySize + 1 + protohelpers.SizeOfVarint(uint64(mapEntrySize))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AuthConfigSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Auth0 != nil {
+		l = m.Auth0.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Webauthn != nil {
+		l = m.Webauthn.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Suspended {
+		n += 2
+	}
+	if m.Saml != nil {
+		l = m.Saml.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *SAMLAssertionSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Data)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Email)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Used {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *UserSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Scopes) > 0 {
+		for _, s := range m.Scopes {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	l = len(m.Role)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *IdentitySpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.UserId)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *Identity) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Email)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *PublicKeySpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.PublicKey)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.Scopes) > 0 {
+		for _, s := range m.Scopes {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	if m.Expiration != nil {
+		l = (*timestamppb1.Timestamp)(m.Expiration).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Confirmed {
+		n += 2
+	}
+	if m.Identity != nil {
+		l = m.Identity.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Role)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AccessPolicyUserGroup_User) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Match)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.LabelSelectors) > 0 {
+		for _, s := range m.LabelSelectors {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AccessPolicyUserGroup) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Users) > 0 {
+		for _, e := range m.Users {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AccessPolicyClusterGroup_Cluster) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Match)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AccessPolicyClusterGroup) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Clusters) > 0 {
+		for _, e := range m.Clusters {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AccessPolicyRule_Kubernetes_Impersonate) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Groups) > 0 {
+		for _, s := range m.Groups {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AccessPolicyRule_Kubernetes) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Impersonate != nil {
+		l = m.Impersonate.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AccessPolicyRule) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Users) > 0 {
+		for _, s := range m.Users {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	if len(m.Clusters) > 0 {
+		for _, s := range m.Clusters {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	if m.Kubernetes != nil {
+		l = m.Kubernetes.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Role)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AccessPolicyTest_Expected_Kubernetes_Impersonate) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Groups) > 0 {
+		for _, s := range m.Groups {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AccessPolicyTest_Expected_Kubernetes) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Impersonate != nil {
+		l = m.Impersonate.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AccessPolicyTest_Expected) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Kubernetes != nil {
+		l = m.Kubernetes.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Role)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AccessPolicyTest_User) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.Labels) > 0 {
+		for k, v := range m.Labels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + protohelpers.SizeOfVarint(uint64(len(k))) + 1 + len(v) + protohelpers.SizeOfVarint(uint64(len(v)))
+			n += mapEntrySize + 1 + protohelpers.SizeOfVarint(uint64(mapEntrySize))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AccessPolicyTest_Cluster) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AccessPolicyTest) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.User != nil {
+		l = m.User.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Cluster != nil {
+		l = m.Cluster.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Expected != nil {
+		l = m.Expected.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AccessPolicySpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.UserGroups) > 0 {
+		for k, v := range m.UserGroups {
+			_ = k
+			_ = v
+			l = 0
+			if v != nil {
+				l = v.SizeVT()
+			}
+			l += 1 + protohelpers.SizeOfVarint(uint64(l))
+			mapEntrySize := 1 + len(k) + protohelpers.SizeOfVarint(uint64(len(k))) + l
+			n += mapEntrySize + 1 + protohelpers.SizeOfVarint(uint64(mapEntrySize))
+		}
+	}
+	if len(m.ClusterGroups) > 0 {
+		for k, v := range m.ClusterGroups {
+			_ = k
+			_ = v
+			l = 0
+			if v != nil {
+				l = v.SizeVT()
+			}
+			l += 1 + protohelpers.SizeOfVarint(uint64(l))
+			mapEntrySize := 1 + len(k) + protohelpers.SizeOfVarint(uint64(len(k))) + l
+			n += mapEntrySize + 1 + protohelpers.SizeOfVarint(uint64(mapEntrySize))
+		}
+	}
+	if len(m.Rules) > 0 {
+		for _, e := range m.Rules {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	if len(m.Tests) > 0 {
+		for _, e := range m.Tests {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *SAMLLabelRuleSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.MatchLabels) > 0 {
+		for _, s := range m.MatchLabels {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	l = len(m.AssignRoleOnRegistration)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *AuthConfigSpec_Auth0) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AuthConfigSpec_Auth0: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AuthConfigSpec_Auth0: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Enabled", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Enabled = bool(v != 0)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Domain", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Domain = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClientId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ClientId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AuthConfigSpec_Webauthn) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AuthConfigSpec_Webauthn: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AuthConfigSpec_Webauthn: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Enabled", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Enabled = bool(v != 0)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Required", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Required = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AuthConfigSpec_SAML) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AuthConfigSpec_SAML: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AuthConfigSpec_SAML: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Enabled", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Enabled = bool(v != 0)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Url", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Url = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Metadata", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Metadata = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LabelRules", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.LabelRules == nil {
+				m.LabelRules = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.LabelRules[mapkey] = mapvalue
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AuthConfigSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AuthConfigSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AuthConfigSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Auth0", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Auth0 == nil {
+				m.Auth0 = &AuthConfigSpec_Auth0{}
+			}
+			if err := m.Auth0.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Webauthn", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Webauthn == nil {
+				m.Webauthn = &AuthConfigSpec_Webauthn{}
+			}
+			if err := m.Webauthn.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Suspended", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Suspended = bool(v != 0)
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Saml", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Saml == nil {
+				m.Saml = &AuthConfigSpec_SAML{}
+			}
+			if err := m.Saml.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SAMLAssertionSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SAMLAssertionSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SAMLAssertionSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = append(m.Data[:0], dAtA[iNdEx:postIndex]...)
+			if m.Data == nil {
+				m.Data = []byte{}
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Email", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Email = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Used", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Used = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *UserSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: UserSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: UserSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Scopes", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Scopes = append(m.Scopes, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Role", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Role = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *IdentitySpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: IdentitySpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: IdentitySpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UserId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Identity) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Identity: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Identity: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Email", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Email = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PublicKeySpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PublicKeySpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PublicKeySpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PublicKey", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PublicKey = append(m.PublicKey[:0], dAtA[iNdEx:postIndex]...)
+			if m.PublicKey == nil {
+				m.PublicKey = []byte{}
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Scopes", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Scopes = append(m.Scopes, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Expiration", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Expiration == nil {
+				m.Expiration = &timestamppb.Timestamp{}
+			}
+			if err := (*timestamppb1.Timestamp)(m.Expiration).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Confirmed", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Confirmed = bool(v != 0)
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Identity", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Identity == nil {
+				m.Identity = &Identity{}
+			}
+			if err := m.Identity.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Role", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Role = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessPolicyUserGroup_User) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessPolicyUserGroup_User: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessPolicyUserGroup_User: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Match", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Match = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LabelSelectors", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LabelSelectors = append(m.LabelSelectors, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessPolicyUserGroup) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessPolicyUserGroup: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessPolicyUserGroup: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Users", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Users = append(m.Users, &AccessPolicyUserGroup_User{})
+			if err := m.Users[len(m.Users)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessPolicyClusterGroup_Cluster) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessPolicyClusterGroup_Cluster: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessPolicyClusterGroup_Cluster: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Match", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Match = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessPolicyClusterGroup) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessPolicyClusterGroup: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessPolicyClusterGroup: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Clusters", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Clusters = append(m.Clusters, &AccessPolicyClusterGroup_Cluster{})
+			if err := m.Clusters[len(m.Clusters)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessPolicyRule_Kubernetes_Impersonate) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessPolicyRule_Kubernetes_Impersonate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessPolicyRule_Kubernetes_Impersonate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Groups", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Groups = append(m.Groups, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessPolicyRule_Kubernetes) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessPolicyRule_Kubernetes: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessPolicyRule_Kubernetes: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Impersonate", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Impersonate == nil {
+				m.Impersonate = &AccessPolicyRule_Kubernetes_Impersonate{}
+			}
+			if err := m.Impersonate.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessPolicyRule) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessPolicyRule: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessPolicyRule: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Users", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Users = append(m.Users, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Clusters", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Clusters = append(m.Clusters, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kubernetes", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Kubernetes == nil {
+				m.Kubernetes = &AccessPolicyRule_Kubernetes{}
+			}
+			if err := m.Kubernetes.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Role", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Role = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessPolicyTest_Expected_Kubernetes_Impersonate) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessPolicyTest_Expected_Kubernetes_Impersonate: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessPolicyTest_Expected_Kubernetes_Impersonate: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Groups", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Groups = append(m.Groups, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessPolicyTest_Expected_Kubernetes) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessPolicyTest_Expected_Kubernetes: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessPolicyTest_Expected_Kubernetes: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Impersonate", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Impersonate == nil {
+				m.Impersonate = &AccessPolicyTest_Expected_Kubernetes_Impersonate{}
+			}
+			if err := m.Impersonate.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessPolicyTest_Expected) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessPolicyTest_Expected: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessPolicyTest_Expected: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Kubernetes", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Kubernetes == nil {
+				m.Kubernetes = &AccessPolicyTest_Expected_Kubernetes{}
+			}
+			if err := m.Kubernetes.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Role", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Role = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessPolicyTest_User) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessPolicyTest_User: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessPolicyTest_User: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Labels", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Labels == nil {
+				m.Labels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.Labels[mapkey] = mapvalue
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessPolicyTest_Cluster) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessPolicyTest_Cluster: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessPolicyTest_Cluster: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessPolicyTest) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessPolicyTest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessPolicyTest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field User", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.User == nil {
+				m.User = &AccessPolicyTest_User{}
+			}
+			if err := m.User.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Cluster", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Cluster == nil {
+				m.Cluster = &AccessPolicyTest_Cluster{}
+			}
+			if err := m.Cluster.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Expected", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Expected == nil {
+				m.Expected = &AccessPolicyTest_Expected{}
+			}
+			if err := m.Expected.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *AccessPolicySpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: AccessPolicySpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: AccessPolicySpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UserGroups", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.UserGroups == nil {
+				m.UserGroups = make(map[string]*AccessPolicyUserGroup)
+			}
+			var mapkey string
+			var mapvalue *AccessPolicyUserGroup
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var mapmsglen int
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapmsglen |= int(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					if mapmsglen < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postmsgIndex := iNdEx + mapmsglen
+					if postmsgIndex < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postmsgIndex > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = &AccessPolicyUserGroup{}
+					if err := mapvalue.UnmarshalVT(dAtA[iNdEx:postmsgIndex]); err != nil {
+						return err
+					}
+					iNdEx = postmsgIndex
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.UserGroups[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusterGroups", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ClusterGroups == nil {
+				m.ClusterGroups = make(map[string]*AccessPolicyClusterGroup)
+			}
+			var mapkey string
+			var mapvalue *AccessPolicyClusterGroup
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var mapmsglen int
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						mapmsglen |= int(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					if mapmsglen < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postmsgIndex := iNdEx + mapmsglen
+					if postmsgIndex < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postmsgIndex > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = &AccessPolicyClusterGroup{}
+					if err := mapvalue.UnmarshalVT(dAtA[iNdEx:postmsgIndex]); err != nil {
+						return err
+					}
+					iNdEx = postmsgIndex
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.ClusterGroups[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Rules", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Rules = append(m.Rules, &AccessPolicyRule{})
+			if err := m.Rules[len(m.Rules)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Tests", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Tests = append(m.Tests, &AccessPolicyTest{})
+			if err := m.Tests[len(m.Tests)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SAMLLabelRuleSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SAMLLabelRuleSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SAMLLabelRuleSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MatchLabels", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.MatchLabels = append(m.MatchLabels, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AssignRoleOnRegistration", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AssignRoleOnRegistration = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/client/api/omni/specs/control_plane_status.go b/client/api/omni/specs/control_plane_status.go
new file mode 100644
index 000000000..3fe7f8fb6
--- /dev/null
+++ b/client/api/omni/specs/control_plane_status.go
@@ -0,0 +1,40 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package specs contains all resource specs of the service.
+package specs
+
+// GetCondition returns condition from the list of conditions of the status if it's set.
+func (x *ControlPlaneStatusSpec) GetCondition(condition ConditionType) *ControlPlaneStatusSpec_Condition {
+	for _, c := range x.Conditions {
+		if c.Type == condition {
+			return c
+		}
+	}
+
+	return &ControlPlaneStatusSpec_Condition{
+		Status:   ControlPlaneStatusSpec_Condition_Unknown,
+		Severity: ControlPlaneStatusSpec_Condition_Info,
+	}
+}
+
+// SetCondition updates the conditions: adds new condition if it's not set, or updates the existing one.
+func (x *ControlPlaneStatusSpec) SetCondition(condition ConditionType, status ControlPlaneStatusSpec_Condition_Status, severity ControlPlaneStatusSpec_Condition_Severity, reason string) {
+	c := &ControlPlaneStatusSpec_Condition{
+		Type:     condition,
+		Status:   status,
+		Severity: severity,
+		Reason:   reason,
+	}
+
+	for i, cond := range x.Conditions {
+		if cond.Type == condition {
+			x.Conditions[i] = c
+
+			return
+		}
+	}
+
+	x.Conditions = append(x.Conditions, c)
+}
diff --git a/client/api/omni/specs/ephemeral.pb.go b/client/api/omni/specs/ephemeral.pb.go
new file mode 100644
index 000000000..7f0ea691d
--- /dev/null
+++ b/client/api/omni/specs/ephemeral.pb.go
@@ -0,0 +1,183 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.32.0
+// 	protoc        v4.24.4
+// source: omni/specs/ephemeral.proto
+
+package specs
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// MachineStatusLinkSpec describes the combination of MessageStatusSpec and SideroLinkSpec and SiderolinkCounterSpec
+type MachineStatusLinkSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MessageStatus     *MachineStatusSpec     `protobuf:"bytes,1,opt,name=message_status,json=messageStatus,proto3" json:"message_status,omitempty"`
+	SiderolinkCounter *SiderolinkCounterSpec `protobuf:"bytes,2,opt,name=siderolink_counter,json=siderolinkCounter,proto3" json:"siderolink_counter,omitempty"`
+	MachineCreatedAt  int64                  `protobuf:"varint,3,opt,name=machine_created_at,json=machineCreatedAt,proto3" json:"machine_created_at,omitempty"`
+}
+
+func (x *MachineStatusLinkSpec) Reset() {
+	*x = MachineStatusLinkSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_ephemeral_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineStatusLinkSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineStatusLinkSpec) ProtoMessage() {}
+
+func (x *MachineStatusLinkSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_ephemeral_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineStatusLinkSpec.ProtoReflect.Descriptor instead.
+func (*MachineStatusLinkSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_ephemeral_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *MachineStatusLinkSpec) GetMessageStatus() *MachineStatusSpec {
+	if x != nil {
+		return x.MessageStatus
+	}
+	return nil
+}
+
+func (x *MachineStatusLinkSpec) GetSiderolinkCounter() *SiderolinkCounterSpec {
+	if x != nil {
+		return x.SiderolinkCounter
+	}
+	return nil
+}
+
+func (x *MachineStatusLinkSpec) GetMachineCreatedAt() int64 {
+	if x != nil {
+		return x.MachineCreatedAt
+	}
+	return 0
+}
+
+var File_omni_specs_ephemeral_proto protoreflect.FileDescriptor
+
+var file_omni_specs_ephemeral_proto_rawDesc = []byte{
+	0x0a, 0x1a, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2f, 0x65, 0x70, 0x68,
+	0x65, 0x6d, 0x65, 0x72, 0x61, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x05, 0x73, 0x70,
+	0x65, 0x63, 0x73, 0x1a, 0x15, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2f,
+	0x6f, 0x6d, 0x6e, 0x69, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1b, 0x6f, 0x6d, 0x6e, 0x69,
+	0x2f, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2f, 0x73, 0x69, 0x64, 0x65, 0x72, 0x6f, 0x6c, 0x69, 0x6e,
+	0x6b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xd3, 0x01, 0x0a, 0x15, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x4c, 0x69, 0x6e, 0x6b, 0x53, 0x70, 0x65,
+	0x63, 0x12, 0x3f, 0x0a, 0x0e, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x73, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x73, 0x70, 0x65, 0x63,
+	0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53,
+	0x70, 0x65, 0x63, 0x52, 0x0d, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x12, 0x4b, 0x0a, 0x12, 0x73, 0x69, 0x64, 0x65, 0x72, 0x6f, 0x6c, 0x69, 0x6e, 0x6b,
+	0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c,
+	0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x53, 0x69, 0x64, 0x65, 0x72, 0x6f, 0x6c, 0x69, 0x6e,
+	0x6b, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x65, 0x72, 0x53, 0x70, 0x65, 0x63, 0x52, 0x11, 0x73, 0x69,
+	0x64, 0x65, 0x72, 0x6f, 0x6c, 0x69, 0x6e, 0x6b, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x65, 0x72, 0x12,
+	0x2c, 0x0a, 0x12, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x10, 0x6d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x42, 0x32, 0x5a,
+	0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x64, 0x65,
+	0x72, 0x6f, 0x6c, 0x61, 0x62, 0x73, 0x2f, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x63, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x73, 0x70, 0x65, 0x63,
+	0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_omni_specs_ephemeral_proto_rawDescOnce sync.Once
+	file_omni_specs_ephemeral_proto_rawDescData = file_omni_specs_ephemeral_proto_rawDesc
+)
+
+func file_omni_specs_ephemeral_proto_rawDescGZIP() []byte {
+	file_omni_specs_ephemeral_proto_rawDescOnce.Do(func() {
+		file_omni_specs_ephemeral_proto_rawDescData = protoimpl.X.CompressGZIP(file_omni_specs_ephemeral_proto_rawDescData)
+	})
+	return file_omni_specs_ephemeral_proto_rawDescData
+}
+
+var file_omni_specs_ephemeral_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_omni_specs_ephemeral_proto_goTypes = []interface{}{
+	(*MachineStatusLinkSpec)(nil), // 0: specs.MachineStatusLinkSpec
+	(*MachineStatusSpec)(nil),     // 1: specs.MachineStatusSpec
+	(*SiderolinkCounterSpec)(nil), // 2: specs.SiderolinkCounterSpec
+}
+var file_omni_specs_ephemeral_proto_depIdxs = []int32{
+	1, // 0: specs.MachineStatusLinkSpec.message_status:type_name -> specs.MachineStatusSpec
+	2, // 1: specs.MachineStatusLinkSpec.siderolink_counter:type_name -> specs.SiderolinkCounterSpec
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_omni_specs_ephemeral_proto_init() }
+func file_omni_specs_ephemeral_proto_init() {
+	if File_omni_specs_ephemeral_proto != nil {
+		return
+	}
+	file_omni_specs_omni_proto_init()
+	file_omni_specs_siderolink_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_omni_specs_ephemeral_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineStatusLinkSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_omni_specs_ephemeral_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_omni_specs_ephemeral_proto_goTypes,
+		DependencyIndexes: file_omni_specs_ephemeral_proto_depIdxs,
+		MessageInfos:      file_omni_specs_ephemeral_proto_msgTypes,
+	}.Build()
+	File_omni_specs_ephemeral_proto = out.File
+	file_omni_specs_ephemeral_proto_rawDesc = nil
+	file_omni_specs_ephemeral_proto_goTypes = nil
+	file_omni_specs_ephemeral_proto_depIdxs = nil
+}
diff --git a/client/api/omni/specs/ephemeral.proto b/client/api/omni/specs/ephemeral.proto
new file mode 100644
index 000000000..16b932249
--- /dev/null
+++ b/client/api/omni/specs/ephemeral.proto
@@ -0,0 +1,16 @@
+syntax = "proto3";
+package specs;
+
+option go_package = "github.com/siderolabs/omni/client/api/omni/specs";
+
+import "omni/specs/omni.proto";
+import "omni/specs/siderolink.proto";
+
+
+// MachineStatusLinkSpec describes the combination of MessageStatusSpec and SideroLinkSpec and SiderolinkCounterSpec
+message MachineStatusLinkSpec {
+  specs.MachineStatusSpec message_status = 1;
+  specs.SiderolinkCounterSpec siderolink_counter = 2;
+  int64 machine_created_at = 3;
+}
+
diff --git a/client/api/omni/specs/ephemeral_vtproto.pb.go b/client/api/omni/specs/ephemeral_vtproto.pb.go
new file mode 100644
index 000000000..3b4422d76
--- /dev/null
+++ b/client/api/omni/specs/ephemeral_vtproto.pb.go
@@ -0,0 +1,287 @@
+// Code generated by protoc-gen-go-vtproto. DO NOT EDIT.
+// protoc-gen-go-vtproto version: v0.6.0
+// source: omni/specs/ephemeral.proto
+
+package specs
+
+import (
+	fmt "fmt"
+	io "io"
+
+	protohelpers "github.com/planetscale/vtprotobuf/protohelpers"
+	proto "google.golang.org/protobuf/proto"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+func (m *MachineStatusLinkSpec) CloneVT() *MachineStatusLinkSpec {
+	if m == nil {
+		return (*MachineStatusLinkSpec)(nil)
+	}
+	r := new(MachineStatusLinkSpec)
+	r.MessageStatus = m.MessageStatus.CloneVT()
+	r.SiderolinkCounter = m.SiderolinkCounter.CloneVT()
+	r.MachineCreatedAt = m.MachineCreatedAt
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineStatusLinkSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (this *MachineStatusLinkSpec) EqualVT(that *MachineStatusLinkSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !this.MessageStatus.EqualVT(that.MessageStatus) {
+		return false
+	}
+	if !this.SiderolinkCounter.EqualVT(that.SiderolinkCounter) {
+		return false
+	}
+	if this.MachineCreatedAt != that.MachineCreatedAt {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineStatusLinkSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineStatusLinkSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (m *MachineStatusLinkSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineStatusLinkSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineStatusLinkSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.MachineCreatedAt != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.MachineCreatedAt))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.SiderolinkCounter != nil {
+		size, err := m.SiderolinkCounter.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.MessageStatus != nil {
+		size, err := m.MessageStatus.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineStatusLinkSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.MessageStatus != nil {
+		l = m.MessageStatus.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.SiderolinkCounter != nil {
+		l = m.SiderolinkCounter.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.MachineCreatedAt != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.MachineCreatedAt))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineStatusLinkSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineStatusLinkSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineStatusLinkSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MessageStatus", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.MessageStatus == nil {
+				m.MessageStatus = &MachineStatusSpec{}
+			}
+			if err := m.MessageStatus.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SiderolinkCounter", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.SiderolinkCounter == nil {
+				m.SiderolinkCounter = &SiderolinkCounterSpec{}
+			}
+			if err := m.SiderolinkCounter.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MachineCreatedAt", wireType)
+			}
+			m.MachineCreatedAt = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MachineCreatedAt |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/client/api/omni/specs/oidc.pb.go b/client/api/omni/specs/oidc.pb.go
new file mode 100644
index 000000000..7f578cc3b
--- /dev/null
+++ b/client/api/omni/specs/oidc.pb.go
@@ -0,0 +1,166 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.32.0
+// 	protoc        v4.24.4
+// source: omni/specs/oidc.proto
+
+package specs
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// JWTPublicKeySpec keeps the active set of JWT signing keys.
+type JWTPublicKeySpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// PKCS1 encoded RSA public key.
+	PublicKey []byte `protobuf:"bytes,1,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
+	// Expiration time (when it's ready to be cleaned up).
+	Expiration *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=expiration,proto3" json:"expiration,omitempty"`
+}
+
+func (x *JWTPublicKeySpec) Reset() {
+	*x = JWTPublicKeySpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_oidc_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *JWTPublicKeySpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*JWTPublicKeySpec) ProtoMessage() {}
+
+func (x *JWTPublicKeySpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_oidc_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use JWTPublicKeySpec.ProtoReflect.Descriptor instead.
+func (*JWTPublicKeySpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_oidc_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *JWTPublicKeySpec) GetPublicKey() []byte {
+	if x != nil {
+		return x.PublicKey
+	}
+	return nil
+}
+
+func (x *JWTPublicKeySpec) GetExpiration() *timestamppb.Timestamp {
+	if x != nil {
+		return x.Expiration
+	}
+	return nil
+}
+
+var File_omni_specs_oidc_proto protoreflect.FileDescriptor
+
+var file_omni_specs_oidc_proto_rawDesc = []byte{
+	0x0a, 0x15, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2f, 0x6f, 0x69, 0x64,
+	0x63, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x05, 0x73, 0x70, 0x65, 0x63, 0x73, 0x1a, 0x1f,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f,
+	0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
+	0x6d, 0x0a, 0x10, 0x4a, 0x57, 0x54, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x53,
+	0x70, 0x65, 0x63, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b,
+	0x65, 0x79, 0x12, 0x3a, 0x0a, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x52, 0x0a, 0x65, 0x78, 0x70, 0x69, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x42, 0x32,
+	0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x69, 0x64,
+	0x65, 0x72, 0x6f, 0x6c, 0x61, 0x62, 0x73, 0x2f, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x63, 0x6c, 0x69,
+	0x65, 0x6e, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x73, 0x70, 0x65,
+	0x63, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_omni_specs_oidc_proto_rawDescOnce sync.Once
+	file_omni_specs_oidc_proto_rawDescData = file_omni_specs_oidc_proto_rawDesc
+)
+
+func file_omni_specs_oidc_proto_rawDescGZIP() []byte {
+	file_omni_specs_oidc_proto_rawDescOnce.Do(func() {
+		file_omni_specs_oidc_proto_rawDescData = protoimpl.X.CompressGZIP(file_omni_specs_oidc_proto_rawDescData)
+	})
+	return file_omni_specs_oidc_proto_rawDescData
+}
+
+var file_omni_specs_oidc_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_omni_specs_oidc_proto_goTypes = []interface{}{
+	(*JWTPublicKeySpec)(nil),      // 0: specs.JWTPublicKeySpec
+	(*timestamppb.Timestamp)(nil), // 1: google.protobuf.Timestamp
+}
+var file_omni_specs_oidc_proto_depIdxs = []int32{
+	1, // 0: specs.JWTPublicKeySpec.expiration:type_name -> google.protobuf.Timestamp
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_omni_specs_oidc_proto_init() }
+func file_omni_specs_oidc_proto_init() {
+	if File_omni_specs_oidc_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_omni_specs_oidc_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*JWTPublicKeySpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_omni_specs_oidc_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_omni_specs_oidc_proto_goTypes,
+		DependencyIndexes: file_omni_specs_oidc_proto_depIdxs,
+		MessageInfos:      file_omni_specs_oidc_proto_msgTypes,
+	}.Build()
+	File_omni_specs_oidc_proto = out.File
+	file_omni_specs_oidc_proto_rawDesc = nil
+	file_omni_specs_oidc_proto_goTypes = nil
+	file_omni_specs_oidc_proto_depIdxs = nil
+}
diff --git a/client/api/omni/specs/oidc.proto b/client/api/omni/specs/oidc.proto
new file mode 100644
index 000000000..414b45b64
--- /dev/null
+++ b/client/api/omni/specs/oidc.proto
@@ -0,0 +1,14 @@
+syntax = "proto3";
+package specs;
+
+option go_package = "github.com/siderolabs/omni/client/api/omni/specs";
+
+import "google/protobuf/timestamp.proto";
+
+// JWTPublicKeySpec keeps the active set of JWT signing keys.
+message JWTPublicKeySpec {
+  // PKCS1 encoded RSA public key.
+  bytes public_key = 1;
+  // Expiration time (when it's ready to be cleaned up).
+  google.protobuf.Timestamp expiration = 2;
+}
diff --git a/client/api/omni/specs/oidc_vtproto.pb.go b/client/api/omni/specs/oidc_vtproto.pb.go
new file mode 100644
index 000000000..d2e7ea20d
--- /dev/null
+++ b/client/api/omni/specs/oidc_vtproto.pb.go
@@ -0,0 +1,257 @@
+// Code generated by protoc-gen-go-vtproto. DO NOT EDIT.
+// protoc-gen-go-vtproto version: v0.6.0
+// source: omni/specs/oidc.proto
+
+package specs
+
+import (
+	fmt "fmt"
+	io "io"
+
+	protohelpers "github.com/planetscale/vtprotobuf/protohelpers"
+	timestamppb1 "github.com/planetscale/vtprotobuf/types/known/timestamppb"
+	proto "google.golang.org/protobuf/proto"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+func (m *JWTPublicKeySpec) CloneVT() *JWTPublicKeySpec {
+	if m == nil {
+		return (*JWTPublicKeySpec)(nil)
+	}
+	r := new(JWTPublicKeySpec)
+	r.Expiration = (*timestamppb.Timestamp)((*timestamppb1.Timestamp)(m.Expiration).CloneVT())
+	if rhs := m.PublicKey; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.PublicKey = tmpBytes
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *JWTPublicKeySpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (this *JWTPublicKeySpec) EqualVT(that *JWTPublicKeySpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if string(this.PublicKey) != string(that.PublicKey) {
+		return false
+	}
+	if !(*timestamppb1.Timestamp)(this.Expiration).EqualVT((*timestamppb1.Timestamp)(that.Expiration)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *JWTPublicKeySpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*JWTPublicKeySpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (m *JWTPublicKeySpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *JWTPublicKeySpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *JWTPublicKeySpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Expiration != nil {
+		size, err := (*timestamppb1.Timestamp)(m.Expiration).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.PublicKey) > 0 {
+		i -= len(m.PublicKey)
+		copy(dAtA[i:], m.PublicKey)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.PublicKey)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *JWTPublicKeySpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.PublicKey)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Expiration != nil {
+		l = (*timestamppb1.Timestamp)(m.Expiration).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *JWTPublicKeySpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: JWTPublicKeySpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: JWTPublicKeySpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PublicKey", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PublicKey = append(m.PublicKey[:0], dAtA[iNdEx:postIndex]...)
+			if m.PublicKey == nil {
+				m.PublicKey = []byte{}
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Expiration", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Expiration == nil {
+				m.Expiration = &timestamppb.Timestamp{}
+			}
+			if err := (*timestamppb1.Timestamp)(m.Expiration).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/client/api/omni/specs/omni.pb.go b/client/api/omni/specs/omni.pb.go
new file mode 100644
index 000000000..73a63cfa4
--- /dev/null
+++ b/client/api/omni/specs/omni.pb.go
@@ -0,0 +1,8367 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.32.0
+// 	protoc        v4.24.4
+// source: omni/specs/omni.proto
+
+package specs
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	machine "github.com/siderolabs/talos/pkg/machinery/api/machine"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type ConfigApplyStatus int32
+
+const (
+	ConfigApplyStatus_UNKNOWN ConfigApplyStatus = 0
+	ConfigApplyStatus_PENDING ConfigApplyStatus = 1
+	ConfigApplyStatus_APPLIED ConfigApplyStatus = 2
+	ConfigApplyStatus_FAILED  ConfigApplyStatus = 3
+)
+
+// Enum value maps for ConfigApplyStatus.
+var (
+	ConfigApplyStatus_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "PENDING",
+		2: "APPLIED",
+		3: "FAILED",
+	}
+	ConfigApplyStatus_value = map[string]int32{
+		"UNKNOWN": 0,
+		"PENDING": 1,
+		"APPLIED": 2,
+		"FAILED":  3,
+	}
+)
+
+func (x ConfigApplyStatus) Enum() *ConfigApplyStatus {
+	p := new(ConfigApplyStatus)
+	*p = x
+	return p
+}
+
+func (x ConfigApplyStatus) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ConfigApplyStatus) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_specs_omni_proto_enumTypes[0].Descriptor()
+}
+
+func (ConfigApplyStatus) Type() protoreflect.EnumType {
+	return &file_omni_specs_omni_proto_enumTypes[0]
+}
+
+func (x ConfigApplyStatus) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ConfigApplyStatus.Descriptor instead.
+func (ConfigApplyStatus) EnumDescriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{0}
+}
+
+// MachineSetPhaseSpec is machine set phase.
+type MachineSetPhase int32
+
+const (
+	MachineSetPhase_Unknown       MachineSetPhase = 0
+	MachineSetPhase_ScalingUp     MachineSetPhase = 1
+	MachineSetPhase_ScalingDown   MachineSetPhase = 2
+	MachineSetPhase_Running       MachineSetPhase = 3
+	MachineSetPhase_Destroying    MachineSetPhase = 4
+	MachineSetPhase_Failed        MachineSetPhase = 5
+	MachineSetPhase_Reconfiguring MachineSetPhase = 6
+)
+
+// Enum value maps for MachineSetPhase.
+var (
+	MachineSetPhase_name = map[int32]string{
+		0: "Unknown",
+		1: "ScalingUp",
+		2: "ScalingDown",
+		3: "Running",
+		4: "Destroying",
+		5: "Failed",
+		6: "Reconfiguring",
+	}
+	MachineSetPhase_value = map[string]int32{
+		"Unknown":       0,
+		"ScalingUp":     1,
+		"ScalingDown":   2,
+		"Running":       3,
+		"Destroying":    4,
+		"Failed":        5,
+		"Reconfiguring": 6,
+	}
+)
+
+func (x MachineSetPhase) Enum() *MachineSetPhase {
+	p := new(MachineSetPhase)
+	*p = x
+	return p
+}
+
+func (x MachineSetPhase) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MachineSetPhase) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_specs_omni_proto_enumTypes[1].Descriptor()
+}
+
+func (MachineSetPhase) Type() protoreflect.EnumType {
+	return &file_omni_specs_omni_proto_enumTypes[1]
+}
+
+func (x MachineSetPhase) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MachineSetPhase.Descriptor instead.
+func (MachineSetPhase) EnumDescriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{1}
+}
+
+type ConditionType int32
+
+const (
+	ConditionType_UnknownCondition    ConditionType = 0
+	ConditionType_Etcd                ConditionType = 1
+	ConditionType_WireguardConnection ConditionType = 2
+)
+
+// Enum value maps for ConditionType.
+var (
+	ConditionType_name = map[int32]string{
+		0: "UnknownCondition",
+		1: "Etcd",
+		2: "WireguardConnection",
+	}
+	ConditionType_value = map[string]int32{
+		"UnknownCondition":    0,
+		"Etcd":                1,
+		"WireguardConnection": 2,
+	}
+)
+
+func (x ConditionType) Enum() *ConditionType {
+	p := new(ConditionType)
+	*p = x
+	return p
+}
+
+func (x ConditionType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ConditionType) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_specs_omni_proto_enumTypes[2].Descriptor()
+}
+
+func (ConditionType) Type() protoreflect.EnumType {
+	return &file_omni_specs_omni_proto_enumTypes[2]
+}
+
+func (x ConditionType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ConditionType.Descriptor instead.
+func (ConditionType) EnumDescriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{2}
+}
+
+type MachineStatusSpec_Role int32
+
+const (
+	MachineStatusSpec_NONE          MachineStatusSpec_Role = 0
+	MachineStatusSpec_CONTROL_PLANE MachineStatusSpec_Role = 1
+	MachineStatusSpec_WORKER        MachineStatusSpec_Role = 2
+)
+
+// Enum value maps for MachineStatusSpec_Role.
+var (
+	MachineStatusSpec_Role_name = map[int32]string{
+		0: "NONE",
+		1: "CONTROL_PLANE",
+		2: "WORKER",
+	}
+	MachineStatusSpec_Role_value = map[string]int32{
+		"NONE":          0,
+		"CONTROL_PLANE": 1,
+		"WORKER":        2,
+	}
+)
+
+func (x MachineStatusSpec_Role) Enum() *MachineStatusSpec_Role {
+	p := new(MachineStatusSpec_Role)
+	*p = x
+	return p
+}
+
+func (x MachineStatusSpec_Role) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MachineStatusSpec_Role) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_specs_omni_proto_enumTypes[3].Descriptor()
+}
+
+func (MachineStatusSpec_Role) Type() protoreflect.EnumType {
+	return &file_omni_specs_omni_proto_enumTypes[3]
+}
+
+func (x MachineStatusSpec_Role) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MachineStatusSpec_Role.Descriptor instead.
+func (MachineStatusSpec_Role) EnumDescriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{1, 0}
+}
+
+type EtcdBackupStatusSpec_Status int32
+
+const (
+	EtcdBackupStatusSpec_Unknown EtcdBackupStatusSpec_Status = 0
+	EtcdBackupStatusSpec_Ok      EtcdBackupStatusSpec_Status = 1
+	EtcdBackupStatusSpec_Error   EtcdBackupStatusSpec_Status = 2
+	EtcdBackupStatusSpec_Running EtcdBackupStatusSpec_Status = 3
+)
+
+// Enum value maps for EtcdBackupStatusSpec_Status.
+var (
+	EtcdBackupStatusSpec_Status_name = map[int32]string{
+		0: "Unknown",
+		1: "Ok",
+		2: "Error",
+		3: "Running",
+	}
+	EtcdBackupStatusSpec_Status_value = map[string]int32{
+		"Unknown": 0,
+		"Ok":      1,
+		"Error":   2,
+		"Running": 3,
+	}
+)
+
+func (x EtcdBackupStatusSpec_Status) Enum() *EtcdBackupStatusSpec_Status {
+	p := new(EtcdBackupStatusSpec_Status)
+	*p = x
+	return p
+}
+
+func (x EtcdBackupStatusSpec_Status) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (EtcdBackupStatusSpec_Status) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_specs_omni_proto_enumTypes[4].Descriptor()
+}
+
+func (EtcdBackupStatusSpec_Status) Type() protoreflect.EnumType {
+	return &file_omni_specs_omni_proto_enumTypes[4]
+}
+
+func (x EtcdBackupStatusSpec_Status) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use EtcdBackupStatusSpec_Status.Descriptor instead.
+func (EtcdBackupStatusSpec_Status) EnumDescriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{10, 0}
+}
+
+type ClusterMachineStatusSpec_Stage int32
+
+const (
+	ClusterMachineStatusSpec_UNKNOWN        ClusterMachineStatusSpec_Stage = 0
+	ClusterMachineStatusSpec_BOOTING        ClusterMachineStatusSpec_Stage = 1
+	ClusterMachineStatusSpec_INSTALLING     ClusterMachineStatusSpec_Stage = 2
+	ClusterMachineStatusSpec_UPGRADING      ClusterMachineStatusSpec_Stage = 6
+	ClusterMachineStatusSpec_CONFIGURING    ClusterMachineStatusSpec_Stage = 3
+	ClusterMachineStatusSpec_RUNNING        ClusterMachineStatusSpec_Stage = 4
+	ClusterMachineStatusSpec_REBOOTING      ClusterMachineStatusSpec_Stage = 7
+	ClusterMachineStatusSpec_SHUTTING_DOWN  ClusterMachineStatusSpec_Stage = 8
+	ClusterMachineStatusSpec_BEFORE_DESTROY ClusterMachineStatusSpec_Stage = 9
+	ClusterMachineStatusSpec_DESTROYING     ClusterMachineStatusSpec_Stage = 5
+)
+
+// Enum value maps for ClusterMachineStatusSpec_Stage.
+var (
+	ClusterMachineStatusSpec_Stage_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "BOOTING",
+		2: "INSTALLING",
+		6: "UPGRADING",
+		3: "CONFIGURING",
+		4: "RUNNING",
+		7: "REBOOTING",
+		8: "SHUTTING_DOWN",
+		9: "BEFORE_DESTROY",
+		5: "DESTROYING",
+	}
+	ClusterMachineStatusSpec_Stage_value = map[string]int32{
+		"UNKNOWN":        0,
+		"BOOTING":        1,
+		"INSTALLING":     2,
+		"UPGRADING":      6,
+		"CONFIGURING":    3,
+		"RUNNING":        4,
+		"REBOOTING":      7,
+		"SHUTTING_DOWN":  8,
+		"BEFORE_DESTROY": 9,
+		"DESTROYING":     5,
+	}
+)
+
+func (x ClusterMachineStatusSpec_Stage) Enum() *ClusterMachineStatusSpec_Stage {
+	p := new(ClusterMachineStatusSpec_Stage)
+	*p = x
+	return p
+}
+
+func (x ClusterMachineStatusSpec_Stage) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ClusterMachineStatusSpec_Stage) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_specs_omni_proto_enumTypes[5].Descriptor()
+}
+
+func (ClusterMachineStatusSpec_Stage) Type() protoreflect.EnumType {
+	return &file_omni_specs_omni_proto_enumTypes[5]
+}
+
+func (x ClusterMachineStatusSpec_Stage) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ClusterMachineStatusSpec_Stage.Descriptor instead.
+func (ClusterMachineStatusSpec_Stage) EnumDescriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{21, 0}
+}
+
+type ClusterStatusSpec_Phase int32
+
+const (
+	ClusterStatusSpec_UNKNOWN      ClusterStatusSpec_Phase = 0
+	ClusterStatusSpec_SCALING_UP   ClusterStatusSpec_Phase = 1
+	ClusterStatusSpec_SCALING_DOWN ClusterStatusSpec_Phase = 2
+	ClusterStatusSpec_RUNNING      ClusterStatusSpec_Phase = 3
+	ClusterStatusSpec_DESTROYING   ClusterStatusSpec_Phase = 4
+)
+
+// Enum value maps for ClusterStatusSpec_Phase.
+var (
+	ClusterStatusSpec_Phase_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "SCALING_UP",
+		2: "SCALING_DOWN",
+		3: "RUNNING",
+		4: "DESTROYING",
+	}
+	ClusterStatusSpec_Phase_value = map[string]int32{
+		"UNKNOWN":      0,
+		"SCALING_UP":   1,
+		"SCALING_DOWN": 2,
+		"RUNNING":      3,
+		"DESTROYING":   4,
+	}
+)
+
+func (x ClusterStatusSpec_Phase) Enum() *ClusterStatusSpec_Phase {
+	p := new(ClusterStatusSpec_Phase)
+	*p = x
+	return p
+}
+
+func (x ClusterStatusSpec_Phase) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ClusterStatusSpec_Phase) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_specs_omni_proto_enumTypes[6].Descriptor()
+}
+
+func (ClusterStatusSpec_Phase) Type() protoreflect.EnumType {
+	return &file_omni_specs_omni_proto_enumTypes[6]
+}
+
+func (x ClusterStatusSpec_Phase) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ClusterStatusSpec_Phase.Descriptor instead.
+func (ClusterStatusSpec_Phase) EnumDescriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{23, 0}
+}
+
+// UpdateStrategy defines the update strategy of the machine set.
+type MachineSetSpec_UpdateStrategy int32
+
+const (
+	MachineSetSpec_Unset   MachineSetSpec_UpdateStrategy = 0
+	MachineSetSpec_Rolling MachineSetSpec_UpdateStrategy = 1
+)
+
+// Enum value maps for MachineSetSpec_UpdateStrategy.
+var (
+	MachineSetSpec_UpdateStrategy_name = map[int32]string{
+		0: "Unset",
+		1: "Rolling",
+	}
+	MachineSetSpec_UpdateStrategy_value = map[string]int32{
+		"Unset":   0,
+		"Rolling": 1,
+	}
+)
+
+func (x MachineSetSpec_UpdateStrategy) Enum() *MachineSetSpec_UpdateStrategy {
+	p := new(MachineSetSpec_UpdateStrategy)
+	*p = x
+	return p
+}
+
+func (x MachineSetSpec_UpdateStrategy) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MachineSetSpec_UpdateStrategy) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_specs_omni_proto_enumTypes[7].Descriptor()
+}
+
+func (MachineSetSpec_UpdateStrategy) Type() protoreflect.EnumType {
+	return &file_omni_specs_omni_proto_enumTypes[7]
+}
+
+func (x MachineSetSpec_UpdateStrategy) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MachineSetSpec_UpdateStrategy.Descriptor instead.
+func (MachineSetSpec_UpdateStrategy) EnumDescriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{35, 0}
+}
+
+type MachineSetSpec_MachineClass_AllocationType int32
+
+const (
+	// Static uses the count defined in the count field.
+	MachineSetSpec_MachineClass_Static MachineSetSpec_MachineClass_AllocationType = 0
+	// Unlimited allocates all available machines from the machine class.
+	MachineSetSpec_MachineClass_Unlimited MachineSetSpec_MachineClass_AllocationType = 1
+)
+
+// Enum value maps for MachineSetSpec_MachineClass_AllocationType.
+var (
+	MachineSetSpec_MachineClass_AllocationType_name = map[int32]string{
+		0: "Static",
+		1: "Unlimited",
+	}
+	MachineSetSpec_MachineClass_AllocationType_value = map[string]int32{
+		"Static":    0,
+		"Unlimited": 1,
+	}
+)
+
+func (x MachineSetSpec_MachineClass_AllocationType) Enum() *MachineSetSpec_MachineClass_AllocationType {
+	p := new(MachineSetSpec_MachineClass_AllocationType)
+	*p = x
+	return p
+}
+
+func (x MachineSetSpec_MachineClass_AllocationType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MachineSetSpec_MachineClass_AllocationType) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_specs_omni_proto_enumTypes[8].Descriptor()
+}
+
+func (MachineSetSpec_MachineClass_AllocationType) Type() protoreflect.EnumType {
+	return &file_omni_specs_omni_proto_enumTypes[8]
+}
+
+func (x MachineSetSpec_MachineClass_AllocationType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MachineSetSpec_MachineClass_AllocationType.Descriptor instead.
+func (MachineSetSpec_MachineClass_AllocationType) EnumDescriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{35, 0, 0}
+}
+
+type TalosUpgradeStatusSpec_Phase int32
+
+const (
+	TalosUpgradeStatusSpec_Unknown   TalosUpgradeStatusSpec_Phase = 0
+	TalosUpgradeStatusSpec_Upgrading TalosUpgradeStatusSpec_Phase = 1
+	TalosUpgradeStatusSpec_Done      TalosUpgradeStatusSpec_Phase = 2
+	TalosUpgradeStatusSpec_Failed    TalosUpgradeStatusSpec_Phase = 3
+	TalosUpgradeStatusSpec_Reverting TalosUpgradeStatusSpec_Phase = 4
+)
+
+// Enum value maps for TalosUpgradeStatusSpec_Phase.
+var (
+	TalosUpgradeStatusSpec_Phase_name = map[int32]string{
+		0: "Unknown",
+		1: "Upgrading",
+		2: "Done",
+		3: "Failed",
+		4: "Reverting",
+	}
+	TalosUpgradeStatusSpec_Phase_value = map[string]int32{
+		"Unknown":   0,
+		"Upgrading": 1,
+		"Done":      2,
+		"Failed":    3,
+		"Reverting": 4,
+	}
+)
+
+func (x TalosUpgradeStatusSpec_Phase) Enum() *TalosUpgradeStatusSpec_Phase {
+	p := new(TalosUpgradeStatusSpec_Phase)
+	*p = x
+	return p
+}
+
+func (x TalosUpgradeStatusSpec_Phase) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (TalosUpgradeStatusSpec_Phase) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_specs_omni_proto_enumTypes[9].Descriptor()
+}
+
+func (TalosUpgradeStatusSpec_Phase) Type() protoreflect.EnumType {
+	return &file_omni_specs_omni_proto_enumTypes[9]
+}
+
+func (x TalosUpgradeStatusSpec_Phase) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use TalosUpgradeStatusSpec_Phase.Descriptor instead.
+func (TalosUpgradeStatusSpec_Phase) EnumDescriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{36, 0}
+}
+
+type ControlPlaneStatusSpec_Condition_Status int32
+
+const (
+	ControlPlaneStatusSpec_Condition_Unknown  ControlPlaneStatusSpec_Condition_Status = 0
+	ControlPlaneStatusSpec_Condition_Ready    ControlPlaneStatusSpec_Condition_Status = 1
+	ControlPlaneStatusSpec_Condition_NotReady ControlPlaneStatusSpec_Condition_Status = 2
+)
+
+// Enum value maps for ControlPlaneStatusSpec_Condition_Status.
+var (
+	ControlPlaneStatusSpec_Condition_Status_name = map[int32]string{
+		0: "Unknown",
+		1: "Ready",
+		2: "NotReady",
+	}
+	ControlPlaneStatusSpec_Condition_Status_value = map[string]int32{
+		"Unknown":  0,
+		"Ready":    1,
+		"NotReady": 2,
+	}
+)
+
+func (x ControlPlaneStatusSpec_Condition_Status) Enum() *ControlPlaneStatusSpec_Condition_Status {
+	p := new(ControlPlaneStatusSpec_Condition_Status)
+	*p = x
+	return p
+}
+
+func (x ControlPlaneStatusSpec_Condition_Status) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ControlPlaneStatusSpec_Condition_Status) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_specs_omni_proto_enumTypes[10].Descriptor()
+}
+
+func (ControlPlaneStatusSpec_Condition_Status) Type() protoreflect.EnumType {
+	return &file_omni_specs_omni_proto_enumTypes[10]
+}
+
+func (x ControlPlaneStatusSpec_Condition_Status) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ControlPlaneStatusSpec_Condition_Status.Descriptor instead.
+func (ControlPlaneStatusSpec_Condition_Status) EnumDescriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{41, 0, 0}
+}
+
+type ControlPlaneStatusSpec_Condition_Severity int32
+
+const (
+	ControlPlaneStatusSpec_Condition_Info    ControlPlaneStatusSpec_Condition_Severity = 0
+	ControlPlaneStatusSpec_Condition_Warning ControlPlaneStatusSpec_Condition_Severity = 1
+	ControlPlaneStatusSpec_Condition_Error   ControlPlaneStatusSpec_Condition_Severity = 2
+)
+
+// Enum value maps for ControlPlaneStatusSpec_Condition_Severity.
+var (
+	ControlPlaneStatusSpec_Condition_Severity_name = map[int32]string{
+		0: "Info",
+		1: "Warning",
+		2: "Error",
+	}
+	ControlPlaneStatusSpec_Condition_Severity_value = map[string]int32{
+		"Info":    0,
+		"Warning": 1,
+		"Error":   2,
+	}
+)
+
+func (x ControlPlaneStatusSpec_Condition_Severity) Enum() *ControlPlaneStatusSpec_Condition_Severity {
+	p := new(ControlPlaneStatusSpec_Condition_Severity)
+	*p = x
+	return p
+}
+
+func (x ControlPlaneStatusSpec_Condition_Severity) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ControlPlaneStatusSpec_Condition_Severity) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_specs_omni_proto_enumTypes[11].Descriptor()
+}
+
+func (ControlPlaneStatusSpec_Condition_Severity) Type() protoreflect.EnumType {
+	return &file_omni_specs_omni_proto_enumTypes[11]
+}
+
+func (x ControlPlaneStatusSpec_Condition_Severity) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ControlPlaneStatusSpec_Condition_Severity.Descriptor instead.
+func (ControlPlaneStatusSpec_Condition_Severity) EnumDescriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{41, 0, 1}
+}
+
+type KubernetesUpgradeStatusSpec_Phase int32
+
+const (
+	KubernetesUpgradeStatusSpec_Unknown   KubernetesUpgradeStatusSpec_Phase = 0
+	KubernetesUpgradeStatusSpec_Upgrading KubernetesUpgradeStatusSpec_Phase = 1
+	KubernetesUpgradeStatusSpec_Done      KubernetesUpgradeStatusSpec_Phase = 2
+	KubernetesUpgradeStatusSpec_Failed    KubernetesUpgradeStatusSpec_Phase = 3
+	KubernetesUpgradeStatusSpec_Reverting KubernetesUpgradeStatusSpec_Phase = 4
+)
+
+// Enum value maps for KubernetesUpgradeStatusSpec_Phase.
+var (
+	KubernetesUpgradeStatusSpec_Phase_name = map[int32]string{
+		0: "Unknown",
+		1: "Upgrading",
+		2: "Done",
+		3: "Failed",
+		4: "Reverting",
+	}
+	KubernetesUpgradeStatusSpec_Phase_value = map[string]int32{
+		"Unknown":   0,
+		"Upgrading": 1,
+		"Done":      2,
+		"Failed":    3,
+		"Reverting": 4,
+	}
+)
+
+func (x KubernetesUpgradeStatusSpec_Phase) Enum() *KubernetesUpgradeStatusSpec_Phase {
+	p := new(KubernetesUpgradeStatusSpec_Phase)
+	*p = x
+	return p
+}
+
+func (x KubernetesUpgradeStatusSpec_Phase) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (KubernetesUpgradeStatusSpec_Phase) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_specs_omni_proto_enumTypes[12].Descriptor()
+}
+
+func (KubernetesUpgradeStatusSpec_Phase) Type() protoreflect.EnumType {
+	return &file_omni_specs_omni_proto_enumTypes[12]
+}
+
+func (x KubernetesUpgradeStatusSpec_Phase) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use KubernetesUpgradeStatusSpec_Phase.Descriptor instead.
+func (KubernetesUpgradeStatusSpec_Phase) EnumDescriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{44, 0}
+}
+
+type SchematicConfigurationSpec_Target int32
+
+const (
+	SchematicConfigurationSpec_Unknown        SchematicConfigurationSpec_Target = 0
+	SchematicConfigurationSpec_ClusterMachine SchematicConfigurationSpec_Target = 1
+	SchematicConfigurationSpec_MachineSet     SchematicConfigurationSpec_Target = 2
+	SchematicConfigurationSpec_Cluster        SchematicConfigurationSpec_Target = 3
+)
+
+// Enum value maps for SchematicConfigurationSpec_Target.
+var (
+	SchematicConfigurationSpec_Target_name = map[int32]string{
+		0: "Unknown",
+		1: "ClusterMachine",
+		2: "MachineSet",
+		3: "Cluster",
+	}
+	SchematicConfigurationSpec_Target_value = map[string]int32{
+		"Unknown":        0,
+		"ClusterMachine": 1,
+		"MachineSet":     2,
+		"Cluster":        3,
+	}
+)
+
+func (x SchematicConfigurationSpec_Target) Enum() *SchematicConfigurationSpec_Target {
+	p := new(SchematicConfigurationSpec_Target)
+	*p = x
+	return p
+}
+
+func (x SchematicConfigurationSpec_Target) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (SchematicConfigurationSpec_Target) Descriptor() protoreflect.EnumDescriptor {
+	return file_omni_specs_omni_proto_enumTypes[13].Descriptor()
+}
+
+func (SchematicConfigurationSpec_Target) Type() protoreflect.EnumType {
+	return &file_omni_specs_omni_proto_enumTypes[13]
+}
+
+func (x SchematicConfigurationSpec_Target) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use SchematicConfigurationSpec_Target.Descriptor instead.
+func (SchematicConfigurationSpec_Target) EnumDescriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{61, 0}
+}
+
+// MachineSpec describes a Machine.
+type MachineSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// IP which can be used to access Talos API.
+	ManagementAddress string `protobuf:"bytes,1,opt,name=management_address,json=managementAddress,proto3" json:"management_address,omitempty"`
+	// Connected is copied from the corresponding Link resource.
+	Connected bool `protobuf:"varint,2,opt,name=connected,proto3" json:"connected,omitempty"`
+}
+
+func (x *MachineSpec) Reset() {
+	*x = MachineSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineSpec) ProtoMessage() {}
+
+func (x *MachineSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineSpec.ProtoReflect.Descriptor instead.
+func (*MachineSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *MachineSpec) GetManagementAddress() string {
+	if x != nil {
+		return x.ManagementAddress
+	}
+	return ""
+}
+
+func (x *MachineSpec) GetConnected() bool {
+	if x != nil {
+		return x.Connected
+	}
+	return false
+}
+
+// MachineStatusSpec describes state of a Machine.
+type MachineStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Talos version.
+	TalosVersion string `protobuf:"bytes,1,opt,name=talos_version,json=talosVersion,proto3" json:"talos_version,omitempty"`
+	// Hardware-related information.
+	Hardware *MachineStatusSpec_HardwareStatus `protobuf:"bytes,2,opt,name=hardware,proto3" json:"hardware,omitempty"`
+	// Network-related information.
+	Network *MachineStatusSpec_NetworkStatus `protobuf:"bytes,3,opt,name=network,proto3" json:"network,omitempty"`
+	// Set if the last poll resulted in an error.
+	LastError string `protobuf:"bytes,4,opt,name=last_error,json=lastError,proto3" json:"last_error,omitempty"`
+	// Management address is copied from the machine resource.
+	ManagementAddress string `protobuf:"bytes,5,opt,name=management_address,json=managementAddress,proto3" json:"management_address,omitempty"`
+	// Connected is copied from the corresponding Link resource.
+	Connected bool `protobuf:"varint,6,opt,name=connected,proto3" json:"connected,omitempty"`
+	// Maintenance flag means that the node is running in the maintenance mode.
+	Maintenance bool `protobuf:"varint,7,opt,name=maintenance,proto3" json:"maintenance,omitempty"`
+	// Cluster is the name of the cluster the machine belongs to.
+	Cluster string `protobuf:"bytes,9,opt,name=cluster,proto3" json:"cluster,omitempty"`
+	// Role is the role of the machine in the cluster.
+	Role MachineStatusSpec_Role `protobuf:"varint,10,opt,name=role,proto3,enum=specs.MachineStatusSpec_Role" json:"role,omitempty"`
+	// Platform-specific information.
+	PlatformMetadata *MachineStatusSpec_PlatformMetadata `protobuf:"bytes,11,opt,name=platform_metadata,json=platformMetadata,proto3" json:"platform_metadata,omitempty"`
+	ImageLabels      map[string]string                   `protobuf:"bytes,13,rep,name=image_labels,json=imageLabels,proto3" json:"image_labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	Schematic        *MachineStatusSpec_Schematic        `protobuf:"bytes,14,opt,name=schematic,proto3" json:"schematic,omitempty"`
+}
+
+func (x *MachineStatusSpec) Reset() {
+	*x = MachineStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineStatusSpec) ProtoMessage() {}
+
+func (x *MachineStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineStatusSpec.ProtoReflect.Descriptor instead.
+func (*MachineStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *MachineStatusSpec) GetTalosVersion() string {
+	if x != nil {
+		return x.TalosVersion
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec) GetHardware() *MachineStatusSpec_HardwareStatus {
+	if x != nil {
+		return x.Hardware
+	}
+	return nil
+}
+
+func (x *MachineStatusSpec) GetNetwork() *MachineStatusSpec_NetworkStatus {
+	if x != nil {
+		return x.Network
+	}
+	return nil
+}
+
+func (x *MachineStatusSpec) GetLastError() string {
+	if x != nil {
+		return x.LastError
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec) GetManagementAddress() string {
+	if x != nil {
+		return x.ManagementAddress
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec) GetConnected() bool {
+	if x != nil {
+		return x.Connected
+	}
+	return false
+}
+
+func (x *MachineStatusSpec) GetMaintenance() bool {
+	if x != nil {
+		return x.Maintenance
+	}
+	return false
+}
+
+func (x *MachineStatusSpec) GetCluster() string {
+	if x != nil {
+		return x.Cluster
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec) GetRole() MachineStatusSpec_Role {
+	if x != nil {
+		return x.Role
+	}
+	return MachineStatusSpec_NONE
+}
+
+func (x *MachineStatusSpec) GetPlatformMetadata() *MachineStatusSpec_PlatformMetadata {
+	if x != nil {
+		return x.PlatformMetadata
+	}
+	return nil
+}
+
+func (x *MachineStatusSpec) GetImageLabels() map[string]string {
+	if x != nil {
+		return x.ImageLabels
+	}
+	return nil
+}
+
+func (x *MachineStatusSpec) GetSchematic() *MachineStatusSpec_Schematic {
+	if x != nil {
+		return x.Schematic
+	}
+	return nil
+}
+
+// TalosConfigSpec describes a Talos cluster config.
+type TalosConfigSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Ca certificate authority.
+	Ca string `protobuf:"bytes,1,opt,name=ca,proto3" json:"ca,omitempty"`
+	// Crt certificate.
+	Crt string `protobuf:"bytes,2,opt,name=crt,proto3" json:"crt,omitempty"`
+	// Key certificate key.
+	Key string `protobuf:"bytes,3,opt,name=key,proto3" json:"key,omitempty"`
+}
+
+func (x *TalosConfigSpec) Reset() {
+	*x = TalosConfigSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TalosConfigSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TalosConfigSpec) ProtoMessage() {}
+
+func (x *TalosConfigSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TalosConfigSpec.ProtoReflect.Descriptor instead.
+func (*TalosConfigSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *TalosConfigSpec) GetCa() string {
+	if x != nil {
+		return x.Ca
+	}
+	return ""
+}
+
+func (x *TalosConfigSpec) GetCrt() string {
+	if x != nil {
+		return x.Crt
+	}
+	return ""
+}
+
+func (x *TalosConfigSpec) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+// Cluster describes a Talos cluster.
+type ClusterSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// InstallImage the installer image to use.
+	//
+	// Deprecated: Marked as deprecated in omni/specs/omni.proto.
+	InstallImage string `protobuf:"bytes,1,opt,name=install_image,json=installImage,proto3" json:"install_image,omitempty"`
+	// KubernetesVersion to use on the node.
+	KubernetesVersion string `protobuf:"bytes,2,opt,name=kubernetes_version,json=kubernetesVersion,proto3" json:"kubernetes_version,omitempty"`
+	// TalosVersion cluster wide Talos version.
+	TalosVersion string `protobuf:"bytes,3,opt,name=talos_version,json=talosVersion,proto3" json:"talos_version,omitempty"`
+	// Features are the cluster features.
+	Features *ClusterSpec_Features `protobuf:"bytes,4,opt,name=features,proto3" json:"features,omitempty"`
+	// Backup describes the backup configuration. If it set to null that means that backups are disabled for this cluster.
+	BackupConfiguration *EtcdBackupConf `protobuf:"bytes,5,opt,name=backup_configuration,json=backupConfiguration,proto3" json:"backup_configuration,omitempty"`
+}
+
+func (x *ClusterSpec) Reset() {
+	*x = ClusterSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterSpec) ProtoMessage() {}
+
+func (x *ClusterSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterSpec.ProtoReflect.Descriptor instead.
+func (*ClusterSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{3}
+}
+
+// Deprecated: Marked as deprecated in omni/specs/omni.proto.
+func (x *ClusterSpec) GetInstallImage() string {
+	if x != nil {
+		return x.InstallImage
+	}
+	return ""
+}
+
+func (x *ClusterSpec) GetKubernetesVersion() string {
+	if x != nil {
+		return x.KubernetesVersion
+	}
+	return ""
+}
+
+func (x *ClusterSpec) GetTalosVersion() string {
+	if x != nil {
+		return x.TalosVersion
+	}
+	return ""
+}
+
+func (x *ClusterSpec) GetFeatures() *ClusterSpec_Features {
+	if x != nil {
+		return x.Features
+	}
+	return nil
+}
+
+func (x *ClusterSpec) GetBackupConfiguration() *EtcdBackupConf {
+	if x != nil {
+		return x.BackupConfiguration
+	}
+	return nil
+}
+
+// EtcdBackupConf describes the backup configuration.
+type EtcdBackupConf struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Interval is the interval between backups. If not set, backups are disabled.
+	Interval *durationpb.Duration `protobuf:"bytes,1,opt,name=interval,proto3" json:"interval,omitempty"`
+	// Enabled etcd backups.
+	Enabled bool `protobuf:"varint,2,opt,name=enabled,proto3" json:"enabled,omitempty"`
+}
+
+func (x *EtcdBackupConf) Reset() {
+	*x = EtcdBackupConf{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EtcdBackupConf) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EtcdBackupConf) ProtoMessage() {}
+
+func (x *EtcdBackupConf) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EtcdBackupConf.ProtoReflect.Descriptor instead.
+func (*EtcdBackupConf) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *EtcdBackupConf) GetInterval() *durationpb.Duration {
+	if x != nil {
+		return x.Interval
+	}
+	return nil
+}
+
+func (x *EtcdBackupConf) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+// EtcdBackupEncryptionSpec describes the backup encryption.
+type EtcdBackupEncryptionSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	EncryptionKey []byte `protobuf:"bytes,1,opt,name=encryption_key,json=encryptionKey,proto3" json:"encryption_key,omitempty"`
+}
+
+func (x *EtcdBackupEncryptionSpec) Reset() {
+	*x = EtcdBackupEncryptionSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EtcdBackupEncryptionSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EtcdBackupEncryptionSpec) ProtoMessage() {}
+
+func (x *EtcdBackupEncryptionSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EtcdBackupEncryptionSpec.ProtoReflect.Descriptor instead.
+func (*EtcdBackupEncryptionSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *EtcdBackupEncryptionSpec) GetEncryptionKey() []byte {
+	if x != nil {
+		return x.EncryptionKey
+	}
+	return nil
+}
+
+// EtcdBackupHeader describes the backup header.
+type EtcdBackupHeader struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Version is the version of the backup creator.
+	Version int64 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
+}
+
+func (x *EtcdBackupHeader) Reset() {
+	*x = EtcdBackupHeader{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EtcdBackupHeader) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EtcdBackupHeader) ProtoMessage() {}
+
+func (x *EtcdBackupHeader) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EtcdBackupHeader.ProtoReflect.Descriptor instead.
+func (*EtcdBackupHeader) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *EtcdBackupHeader) GetVersion() int64 {
+	if x != nil {
+		return x.Version
+	}
+	return 0
+}
+
+// EtcdBackupSpec describes the backup.
+type EtcdBackupSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// CreatedAt is the time when the backup was created.
+	CreatedAt *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	// Snapshot is the snapshot file name.
+	Snapshot string `protobuf:"bytes,2,opt,name=snapshot,proto3" json:"snapshot,omitempty"`
+	// Size specifies the etcd backup size.
+	Size uint64 `protobuf:"varint,3,opt,name=size,proto3" json:"size,omitempty"`
+}
+
+func (x *EtcdBackupSpec) Reset() {
+	*x = EtcdBackupSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EtcdBackupSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EtcdBackupSpec) ProtoMessage() {}
+
+func (x *EtcdBackupSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EtcdBackupSpec.ProtoReflect.Descriptor instead.
+func (*EtcdBackupSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *EtcdBackupSpec) GetCreatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return nil
+}
+
+func (x *EtcdBackupSpec) GetSnapshot() string {
+	if x != nil {
+		return x.Snapshot
+	}
+	return ""
+}
+
+func (x *EtcdBackupSpec) GetSize() uint64 {
+	if x != nil {
+		return x.Size
+	}
+	return 0
+}
+
+// BackupDataSpec describes the data needed for etcd backup.
+type BackupDataSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Interval                  *durationpb.Duration `protobuf:"bytes,1,opt,name=interval,proto3" json:"interval,omitempty"`
+	ClusterUuid               string               `protobuf:"bytes,2,opt,name=cluster_uuid,json=clusterUuid,proto3" json:"cluster_uuid,omitempty"`
+	EncryptionKey             []byte               `protobuf:"bytes,3,opt,name=encryption_key,json=encryptionKey,proto3" json:"encryption_key,omitempty"`
+	AesCbcEncryptionSecret    string               `protobuf:"bytes,4,opt,name=aes_cbc_encryption_secret,json=aesCbcEncryptionSecret,proto3" json:"aes_cbc_encryption_secret,omitempty"`
+	SecretboxEncryptionSecret string               `protobuf:"bytes,5,opt,name=secretbox_encryption_secret,json=secretboxEncryptionSecret,proto3" json:"secretbox_encryption_secret,omitempty"`
+}
+
+func (x *BackupDataSpec) Reset() {
+	*x = BackupDataSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BackupDataSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BackupDataSpec) ProtoMessage() {}
+
+func (x *BackupDataSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BackupDataSpec.ProtoReflect.Descriptor instead.
+func (*BackupDataSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *BackupDataSpec) GetInterval() *durationpb.Duration {
+	if x != nil {
+		return x.Interval
+	}
+	return nil
+}
+
+func (x *BackupDataSpec) GetClusterUuid() string {
+	if x != nil {
+		return x.ClusterUuid
+	}
+	return ""
+}
+
+func (x *BackupDataSpec) GetEncryptionKey() []byte {
+	if x != nil {
+		return x.EncryptionKey
+	}
+	return nil
+}
+
+func (x *BackupDataSpec) GetAesCbcEncryptionSecret() string {
+	if x != nil {
+		return x.AesCbcEncryptionSecret
+	}
+	return ""
+}
+
+func (x *BackupDataSpec) GetSecretboxEncryptionSecret() string {
+	if x != nil {
+		return x.SecretboxEncryptionSecret
+	}
+	return ""
+}
+
+// EtcdBackupS3ConfSpec describes the S3 configuration for the backup process.
+type EtcdBackupS3ConfSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Bucket          string `protobuf:"bytes,1,opt,name=bucket,proto3" json:"bucket,omitempty"`
+	Region          string `protobuf:"bytes,2,opt,name=region,proto3" json:"region,omitempty"`
+	Endpoint        string `protobuf:"bytes,3,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
+	AccessKeyId     string `protobuf:"bytes,4,opt,name=access_key_id,json=accessKeyId,proto3" json:"access_key_id,omitempty"`
+	SecretAccessKey string `protobuf:"bytes,5,opt,name=secret_access_key,json=secretAccessKey,proto3" json:"secret_access_key,omitempty"`
+	SessionToken    string `protobuf:"bytes,6,opt,name=session_token,json=sessionToken,proto3" json:"session_token,omitempty"`
+}
+
+func (x *EtcdBackupS3ConfSpec) Reset() {
+	*x = EtcdBackupS3ConfSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EtcdBackupS3ConfSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EtcdBackupS3ConfSpec) ProtoMessage() {}
+
+func (x *EtcdBackupS3ConfSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EtcdBackupS3ConfSpec.ProtoReflect.Descriptor instead.
+func (*EtcdBackupS3ConfSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *EtcdBackupS3ConfSpec) GetBucket() string {
+	if x != nil {
+		return x.Bucket
+	}
+	return ""
+}
+
+func (x *EtcdBackupS3ConfSpec) GetRegion() string {
+	if x != nil {
+		return x.Region
+	}
+	return ""
+}
+
+func (x *EtcdBackupS3ConfSpec) GetEndpoint() string {
+	if x != nil {
+		return x.Endpoint
+	}
+	return ""
+}
+
+func (x *EtcdBackupS3ConfSpec) GetAccessKeyId() string {
+	if x != nil {
+		return x.AccessKeyId
+	}
+	return ""
+}
+
+func (x *EtcdBackupS3ConfSpec) GetSecretAccessKey() string {
+	if x != nil {
+		return x.SecretAccessKey
+	}
+	return ""
+}
+
+func (x *EtcdBackupS3ConfSpec) GetSessionToken() string {
+	if x != nil {
+		return x.SessionToken
+	}
+	return ""
+}
+
+// EtcdBackupStatus describes cluster last backup status.
+type EtcdBackupStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Status is the status of the last backup.
+	Status EtcdBackupStatusSpec_Status `protobuf:"varint,1,opt,name=status,proto3,enum=specs.EtcdBackupStatusSpec_Status" json:"status,omitempty"`
+	// Error is the error message if the backup failed.
+	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
+	// LastBackupTime is the time of the last backup.
+	LastBackupTime *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=last_backup_time,json=lastBackupTime,proto3" json:"last_backup_time,omitempty"`
+	// LastBackupAttempt is the time of the last backup attempt.
+	LastBackupAttempt *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=last_backup_attempt,json=lastBackupAttempt,proto3" json:"last_backup_attempt,omitempty"`
+}
+
+func (x *EtcdBackupStatusSpec) Reset() {
+	*x = EtcdBackupStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EtcdBackupStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EtcdBackupStatusSpec) ProtoMessage() {}
+
+func (x *EtcdBackupStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EtcdBackupStatusSpec.ProtoReflect.Descriptor instead.
+func (*EtcdBackupStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *EtcdBackupStatusSpec) GetStatus() EtcdBackupStatusSpec_Status {
+	if x != nil {
+		return x.Status
+	}
+	return EtcdBackupStatusSpec_Unknown
+}
+
+func (x *EtcdBackupStatusSpec) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
+func (x *EtcdBackupStatusSpec) GetLastBackupTime() *timestamppb.Timestamp {
+	if x != nil {
+		return x.LastBackupTime
+	}
+	return nil
+}
+
+func (x *EtcdBackupStatusSpec) GetLastBackupAttempt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.LastBackupAttempt
+	}
+	return nil
+}
+
+// EtcdManualBackupSpec describes the manual backup request.
+type EtcdManualBackupSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// BackupAt is the time when the backup should be created.
+	BackupAt *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=backup_at,json=backupAt,proto3" json:"backup_at,omitempty"`
+}
+
+func (x *EtcdManualBackupSpec) Reset() {
+	*x = EtcdManualBackupSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EtcdManualBackupSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EtcdManualBackupSpec) ProtoMessage() {}
+
+func (x *EtcdManualBackupSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EtcdManualBackupSpec.ProtoReflect.Descriptor instead.
+func (*EtcdManualBackupSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *EtcdManualBackupSpec) GetBackupAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.BackupAt
+	}
+	return nil
+}
+
+// EtcdBackupStoreStatusSpec is internal resource that decribes store configuration name and configuration last error.
+type EtcdBackupStoreStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// ConfigurationName is the name of the configuration (disabled|local|s3).
+	ConfigurationName string `protobuf:"bytes,1,opt,name=configuration_name,json=configurationName,proto3" json:"configuration_name,omitempty"`
+	// ConfigurationError is the error message if the configuration is invalid.
+	ConfigurationError string `protobuf:"bytes,2,opt,name=configuration_error,json=configurationError,proto3" json:"configuration_error,omitempty"`
+}
+
+func (x *EtcdBackupStoreStatusSpec) Reset() {
+	*x = EtcdBackupStoreStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EtcdBackupStoreStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EtcdBackupStoreStatusSpec) ProtoMessage() {}
+
+func (x *EtcdBackupStoreStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EtcdBackupStoreStatusSpec.ProtoReflect.Descriptor instead.
+func (*EtcdBackupStoreStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *EtcdBackupStoreStatusSpec) GetConfigurationName() string {
+	if x != nil {
+		return x.ConfigurationName
+	}
+	return ""
+}
+
+func (x *EtcdBackupStoreStatusSpec) GetConfigurationError() string {
+	if x != nil {
+		return x.ConfigurationError
+	}
+	return ""
+}
+
+// EtcdBackupOverallStatusSpec describes the overall etcd backup system status.
+type EtcdBackupOverallStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// ConfigurationName is the name of the configuration (disabled|local|s3).
+	ConfigurationName string `protobuf:"bytes,1,opt,name=configuration_name,json=configurationName,proto3" json:"configuration_name,omitempty"`
+	// ConfigurationError is the error message if the configuration is invalid.
+	ConfigurationError string `protobuf:"bytes,2,opt,name=configuration_error,json=configurationError,proto3" json:"configuration_error,omitempty"`
+	// LastBackupStatus is the status of the last backup.
+	LastBackupStatus *EtcdBackupStatusSpec `protobuf:"bytes,3,opt,name=last_backup_status,json=lastBackupStatus,proto3" json:"last_backup_status,omitempty"`
+}
+
+func (x *EtcdBackupOverallStatusSpec) Reset() {
+	*x = EtcdBackupOverallStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EtcdBackupOverallStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EtcdBackupOverallStatusSpec) ProtoMessage() {}
+
+func (x *EtcdBackupOverallStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EtcdBackupOverallStatusSpec.ProtoReflect.Descriptor instead.
+func (*EtcdBackupOverallStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *EtcdBackupOverallStatusSpec) GetConfigurationName() string {
+	if x != nil {
+		return x.ConfigurationName
+	}
+	return ""
+}
+
+func (x *EtcdBackupOverallStatusSpec) GetConfigurationError() string {
+	if x != nil {
+		return x.ConfigurationError
+	}
+	return ""
+}
+
+func (x *EtcdBackupOverallStatusSpec) GetLastBackupStatus() *EtcdBackupStatusSpec {
+	if x != nil {
+		return x.LastBackupStatus
+	}
+	return nil
+}
+
+// ClusterMachineSpec describes a machine attached to a Cluster.
+type ClusterMachineSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// KubernetesVersion to use on the machine (copied from Cluster at the moment of creation).
+	KubernetesVersion string `protobuf:"bytes,2,opt,name=kubernetes_version,json=kubernetesVersion,proto3" json:"kubernetes_version,omitempty"`
+}
+
+func (x *ClusterMachineSpec) Reset() {
+	*x = ClusterMachineSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterMachineSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterMachineSpec) ProtoMessage() {}
+
+func (x *ClusterMachineSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterMachineSpec.ProtoReflect.Descriptor instead.
+func (*ClusterMachineSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *ClusterMachineSpec) GetKubernetesVersion() string {
+	if x != nil {
+		return x.KubernetesVersion
+	}
+	return ""
+}
+
+// ClusterMachineConfigPatchesSpec keeps the list of config patches to be applied on the machine.
+type ClusterMachineConfigPatchesSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// List of patches combined from all sources, as a final list of patches to apply.
+	Patches []string `protobuf:"bytes,1,rep,name=patches,proto3" json:"patches,omitempty"`
+}
+
+func (x *ClusterMachineConfigPatchesSpec) Reset() {
+	*x = ClusterMachineConfigPatchesSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterMachineConfigPatchesSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterMachineConfigPatchesSpec) ProtoMessage() {}
+
+func (x *ClusterMachineConfigPatchesSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterMachineConfigPatchesSpec.ProtoReflect.Descriptor instead.
+func (*ClusterMachineConfigPatchesSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *ClusterMachineConfigPatchesSpec) GetPatches() []string {
+	if x != nil {
+		return x.Patches
+	}
+	return nil
+}
+
+// ClusterMachineTalosVersionSpec describes a machine Talos version and schematic.
+type ClusterMachineTalosVersionSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TalosVersion string `protobuf:"bytes,1,opt,name=talos_version,json=talosVersion,proto3" json:"talos_version,omitempty"`
+	SchematicId  string `protobuf:"bytes,2,opt,name=schematic_id,json=schematicId,proto3" json:"schematic_id,omitempty"`
+}
+
+func (x *ClusterMachineTalosVersionSpec) Reset() {
+	*x = ClusterMachineTalosVersionSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[16]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterMachineTalosVersionSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterMachineTalosVersionSpec) ProtoMessage() {}
+
+func (x *ClusterMachineTalosVersionSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[16]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterMachineTalosVersionSpec.ProtoReflect.Descriptor instead.
+func (*ClusterMachineTalosVersionSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *ClusterMachineTalosVersionSpec) GetTalosVersion() string {
+	if x != nil {
+		return x.TalosVersion
+	}
+	return ""
+}
+
+func (x *ClusterMachineTalosVersionSpec) GetSchematicId() string {
+	if x != nil {
+		return x.SchematicId
+	}
+	return ""
+}
+
+// ClusterMachineConfigSpec stores generated Talos node machine config.
+type ClusterMachineConfigSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Data                  []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
+	ClusterMachineVersion string `protobuf:"bytes,2,opt,name=cluster_machine_version,json=clusterMachineVersion,proto3" json:"cluster_machine_version,omitempty"`
+	GenerationError       string `protobuf:"bytes,3,opt,name=generation_error,json=generationError,proto3" json:"generation_error,omitempty"`
+}
+
+func (x *ClusterMachineConfigSpec) Reset() {
+	*x = ClusterMachineConfigSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterMachineConfigSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterMachineConfigSpec) ProtoMessage() {}
+
+func (x *ClusterMachineConfigSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterMachineConfigSpec.ProtoReflect.Descriptor instead.
+func (*ClusterMachineConfigSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *ClusterMachineConfigSpec) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+func (x *ClusterMachineConfigSpec) GetClusterMachineVersion() string {
+	if x != nil {
+		return x.ClusterMachineVersion
+	}
+	return ""
+}
+
+func (x *ClusterMachineConfigSpec) GetGenerationError() string {
+	if x != nil {
+		return x.GenerationError
+	}
+	return ""
+}
+
+// ClusterMachineConfigSpec stores generated Talos node machine config.
+type RedactedClusterMachineConfigSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Data string `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *RedactedClusterMachineConfigSpec) Reset() {
+	*x = RedactedClusterMachineConfigSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RedactedClusterMachineConfigSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RedactedClusterMachineConfigSpec) ProtoMessage() {}
+
+func (x *RedactedClusterMachineConfigSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RedactedClusterMachineConfigSpec.ProtoReflect.Descriptor instead.
+func (*RedactedClusterMachineConfigSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *RedactedClusterMachineConfigSpec) GetData() string {
+	if x != nil {
+		return x.Data
+	}
+	return ""
+}
+
+// ClusterMachineIdentity keeps ClusterMachine related node information.
+type ClusterMachineIdentitySpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// NodeIdentity is Talos node identity from Identity resource.
+	NodeIdentity string `protobuf:"bytes,1,opt,name=node_identity,json=nodeIdentity,proto3" json:"node_identity,omitempty"`
+	// EtcdMemberId is the id of the node how it's represented in the etcd quorum.
+	EtcdMemberId uint64 `protobuf:"varint,2,opt,name=etcd_member_id,json=etcdMemberId,proto3" json:"etcd_member_id,omitempty"`
+	// Nodename is the Kubernetes node name.
+	Nodename string `protobuf:"bytes,3,opt,name=nodename,proto3" json:"nodename,omitempty"`
+	// NodeIps are the IPs of the Kubernetes node.
+	NodeIps []string `protobuf:"bytes,8,rep,name=node_ips,json=nodeIps,proto3" json:"node_ips,omitempty"`
+}
+
+func (x *ClusterMachineIdentitySpec) Reset() {
+	*x = ClusterMachineIdentitySpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterMachineIdentitySpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterMachineIdentitySpec) ProtoMessage() {}
+
+func (x *ClusterMachineIdentitySpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterMachineIdentitySpec.ProtoReflect.Descriptor instead.
+func (*ClusterMachineIdentitySpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *ClusterMachineIdentitySpec) GetNodeIdentity() string {
+	if x != nil {
+		return x.NodeIdentity
+	}
+	return ""
+}
+
+func (x *ClusterMachineIdentitySpec) GetEtcdMemberId() uint64 {
+	if x != nil {
+		return x.EtcdMemberId
+	}
+	return 0
+}
+
+func (x *ClusterMachineIdentitySpec) GetNodename() string {
+	if x != nil {
+		return x.Nodename
+	}
+	return ""
+}
+
+func (x *ClusterMachineIdentitySpec) GetNodeIps() []string {
+	if x != nil {
+		return x.NodeIps
+	}
+	return nil
+}
+
+// ClusterMachineTemplateSpec
+type ClusterMachineTemplateSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// InstallImage the installer image to use.
+	InstallImage string `protobuf:"bytes,1,opt,name=install_image,json=installImage,proto3" json:"install_image,omitempty"`
+	// KubernetesVersion to use on the node.
+	KubernetesVersion string `protobuf:"bytes,2,opt,name=kubernetes_version,json=kubernetesVersion,proto3" json:"kubernetes_version,omitempty"`
+	// InstallDisk Talos system disk.
+	InstallDisk string `protobuf:"bytes,3,opt,name=install_disk,json=installDisk,proto3" json:"install_disk,omitempty"`
+	// Patch represents machinery config patch.
+	Patch string `protobuf:"bytes,5,opt,name=patch,proto3" json:"patch,omitempty"`
+}
+
+func (x *ClusterMachineTemplateSpec) Reset() {
+	*x = ClusterMachineTemplateSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterMachineTemplateSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterMachineTemplateSpec) ProtoMessage() {}
+
+func (x *ClusterMachineTemplateSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterMachineTemplateSpec.ProtoReflect.Descriptor instead.
+func (*ClusterMachineTemplateSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *ClusterMachineTemplateSpec) GetInstallImage() string {
+	if x != nil {
+		return x.InstallImage
+	}
+	return ""
+}
+
+func (x *ClusterMachineTemplateSpec) GetKubernetesVersion() string {
+	if x != nil {
+		return x.KubernetesVersion
+	}
+	return ""
+}
+
+func (x *ClusterMachineTemplateSpec) GetInstallDisk() string {
+	if x != nil {
+		return x.InstallDisk
+	}
+	return ""
+}
+
+func (x *ClusterMachineTemplateSpec) GetPatch() string {
+	if x != nil {
+		return x.Patch
+	}
+	return ""
+}
+
+// ClusterMachineStatusSpec
+type ClusterMachineStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Ready is true if all services are healthy.
+	Ready bool                           `protobuf:"varint,1,opt,name=ready,proto3" json:"ready,omitempty"`
+	Stage ClusterMachineStatusSpec_Stage `protobuf:"varint,2,opt,name=stage,proto3,enum=specs.ClusterMachineStatusSpec_Stage" json:"stage,omitempty"`
+	// ApidAvailable is true if the node is a control plane node and the apid service is healthy.
+	ApidAvailable   bool   `protobuf:"varint,3,opt,name=apid_available,json=apidAvailable,proto3" json:"apid_available,omitempty"`
+	ConfigUpToDate  bool   `protobuf:"varint,4,opt,name=config_up_to_date,json=configUpToDate,proto3" json:"config_up_to_date,omitempty"`
+	LastConfigError string `protobuf:"bytes,5,opt,name=last_config_error,json=lastConfigError,proto3" json:"last_config_error,omitempty"`
+	// Management address is copied from the machine status resource.
+	ManagementAddress string            `protobuf:"bytes,6,opt,name=management_address,json=managementAddress,proto3" json:"management_address,omitempty"`
+	ConfigApplyStatus ConfigApplyStatus `protobuf:"varint,7,opt,name=config_apply_status,json=configApplyStatus,proto3,enum=specs.ConfigApplyStatus" json:"config_apply_status,omitempty"`
+}
+
+func (x *ClusterMachineStatusSpec) Reset() {
+	*x = ClusterMachineStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[21]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterMachineStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterMachineStatusSpec) ProtoMessage() {}
+
+func (x *ClusterMachineStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[21]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterMachineStatusSpec.ProtoReflect.Descriptor instead.
+func (*ClusterMachineStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{21}
+}
+
+func (x *ClusterMachineStatusSpec) GetReady() bool {
+	if x != nil {
+		return x.Ready
+	}
+	return false
+}
+
+func (x *ClusterMachineStatusSpec) GetStage() ClusterMachineStatusSpec_Stage {
+	if x != nil {
+		return x.Stage
+	}
+	return ClusterMachineStatusSpec_UNKNOWN
+}
+
+func (x *ClusterMachineStatusSpec) GetApidAvailable() bool {
+	if x != nil {
+		return x.ApidAvailable
+	}
+	return false
+}
+
+func (x *ClusterMachineStatusSpec) GetConfigUpToDate() bool {
+	if x != nil {
+		return x.ConfigUpToDate
+	}
+	return false
+}
+
+func (x *ClusterMachineStatusSpec) GetLastConfigError() string {
+	if x != nil {
+		return x.LastConfigError
+	}
+	return ""
+}
+
+func (x *ClusterMachineStatusSpec) GetManagementAddress() string {
+	if x != nil {
+		return x.ManagementAddress
+	}
+	return ""
+}
+
+func (x *ClusterMachineStatusSpec) GetConfigApplyStatus() ConfigApplyStatus {
+	if x != nil {
+		return x.ConfigApplyStatus
+	}
+	return ConfigApplyStatus_UNKNOWN
+}
+
+// Machines counts the number of machines in a set including health status.
+type Machines struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Total machines currently allocated.
+	Total uint32 `protobuf:"varint,1,opt,name=total,proto3" json:"total,omitempty"`
+	// Healthy machines.
+	Healthy uint32 `protobuf:"varint,2,opt,name=healthy,proto3" json:"healthy,omitempty"`
+	// Connected represents the number of machines in a machine set connected to the wireguard network.
+	Connected uint32 `protobuf:"varint,3,opt,name=connected,proto3" json:"connected,omitempty"`
+	// Requested machines count, same as total for manual allocation, may differ for machine class mode.
+	Requested uint32 `protobuf:"varint,4,opt,name=requested,proto3" json:"requested,omitempty"`
+}
+
+func (x *Machines) Reset() {
+	*x = Machines{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[22]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Machines) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Machines) ProtoMessage() {}
+
+func (x *Machines) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[22]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Machines.ProtoReflect.Descriptor instead.
+func (*Machines) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{22}
+}
+
+func (x *Machines) GetTotal() uint32 {
+	if x != nil {
+		return x.Total
+	}
+	return 0
+}
+
+func (x *Machines) GetHealthy() uint32 {
+	if x != nil {
+		return x.Healthy
+	}
+	return 0
+}
+
+func (x *Machines) GetConnected() uint32 {
+	if x != nil {
+		return x.Connected
+	}
+	return 0
+}
+
+func (x *Machines) GetRequested() uint32 {
+	if x != nil {
+		return x.Requested
+	}
+	return 0
+}
+
+// ClusterStatusSpec aggregates general information about a cluster.
+type ClusterStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Cluster is available when at least one controlplane node has APId up.
+	Available                 bool                    `protobuf:"varint,1,opt,name=available,proto3" json:"available,omitempty"`
+	Machines                  *Machines               `protobuf:"bytes,2,opt,name=machines,proto3" json:"machines,omitempty"`
+	Phase                     ClusterStatusSpec_Phase `protobuf:"varint,3,opt,name=phase,proto3,enum=specs.ClusterStatusSpec_Phase" json:"phase,omitempty"`
+	Ready                     bool                    `protobuf:"varint,4,opt,name=ready,proto3" json:"ready,omitempty"`
+	KubernetesAPIReady        bool                    `protobuf:"varint,5,opt,name=kubernetesAPIReady,proto3" json:"kubernetesAPIReady,omitempty"`
+	ControlplaneReady         bool                    `protobuf:"varint,6,opt,name=controlplaneReady,proto3" json:"controlplaneReady,omitempty"`
+	HasConnectedControlPlanes bool                    `protobuf:"varint,7,opt,name=has_connected_control_planes,json=hasConnectedControlPlanes,proto3" json:"has_connected_control_planes,omitempty"`
+}
+
+func (x *ClusterStatusSpec) Reset() {
+	*x = ClusterStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[23]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterStatusSpec) ProtoMessage() {}
+
+func (x *ClusterStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[23]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterStatusSpec.ProtoReflect.Descriptor instead.
+func (*ClusterStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{23}
+}
+
+func (x *ClusterStatusSpec) GetAvailable() bool {
+	if x != nil {
+		return x.Available
+	}
+	return false
+}
+
+func (x *ClusterStatusSpec) GetMachines() *Machines {
+	if x != nil {
+		return x.Machines
+	}
+	return nil
+}
+
+func (x *ClusterStatusSpec) GetPhase() ClusterStatusSpec_Phase {
+	if x != nil {
+		return x.Phase
+	}
+	return ClusterStatusSpec_UNKNOWN
+}
+
+func (x *ClusterStatusSpec) GetReady() bool {
+	if x != nil {
+		return x.Ready
+	}
+	return false
+}
+
+func (x *ClusterStatusSpec) GetKubernetesAPIReady() bool {
+	if x != nil {
+		return x.KubernetesAPIReady
+	}
+	return false
+}
+
+func (x *ClusterStatusSpec) GetControlplaneReady() bool {
+	if x != nil {
+		return x.ControlplaneReady
+	}
+	return false
+}
+
+func (x *ClusterStatusSpec) GetHasConnectedControlPlanes() bool {
+	if x != nil {
+		return x.HasConnectedControlPlanes
+	}
+	return false
+}
+
+// ClusterUUID keeps the UUID of the cluster.
+type ClusterUUID struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Uuid string `protobuf:"bytes,1,opt,name=uuid,proto3" json:"uuid,omitempty"`
+}
+
+func (x *ClusterUUID) Reset() {
+	*x = ClusterUUID{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[24]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterUUID) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterUUID) ProtoMessage() {}
+
+func (x *ClusterUUID) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[24]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterUUID.ProtoReflect.Descriptor instead.
+func (*ClusterUUID) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{24}
+}
+
+func (x *ClusterUUID) GetUuid() string {
+	if x != nil {
+		return x.Uuid
+	}
+	return ""
+}
+
+// ClusterConfigVersion keeps the version of Talos which was used for initial config generation.
+type ClusterConfigVersionSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
+}
+
+func (x *ClusterConfigVersionSpec) Reset() {
+	*x = ClusterConfigVersionSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[25]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterConfigVersionSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterConfigVersionSpec) ProtoMessage() {}
+
+func (x *ClusterConfigVersionSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[25]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterConfigVersionSpec.ProtoReflect.Descriptor instead.
+func (*ClusterConfigVersionSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{25}
+}
+
+func (x *ClusterConfigVersionSpec) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+// ClusterMachineConfigStatusSpec machine configuration status spec.
+type ClusterMachineConfigStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ClusterMachineConfigVersion string `protobuf:"bytes,3,opt,name=cluster_machine_config_version,json=clusterMachineConfigVersion,proto3" json:"cluster_machine_config_version,omitempty"`
+	ClusterMachineVersion       string `protobuf:"bytes,4,opt,name=cluster_machine_version,json=clusterMachineVersion,proto3" json:"cluster_machine_version,omitempty"`
+	ClusterMachineConfigSha256  string `protobuf:"bytes,5,opt,name=cluster_machine_config_sha256,json=clusterMachineConfigSha256,proto3" json:"cluster_machine_config_sha256,omitempty"`
+	LastConfigError             string `protobuf:"bytes,6,opt,name=last_config_error,json=lastConfigError,proto3" json:"last_config_error,omitempty"`
+	TalosVersion                string `protobuf:"bytes,7,opt,name=talos_version,json=talosVersion,proto3" json:"talos_version,omitempty"`
+	SchematicId                 string `protobuf:"bytes,8,opt,name=schematic_id,json=schematicId,proto3" json:"schematic_id,omitempty"`
+}
+
+func (x *ClusterMachineConfigStatusSpec) Reset() {
+	*x = ClusterMachineConfigStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[26]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterMachineConfigStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterMachineConfigStatusSpec) ProtoMessage() {}
+
+func (x *ClusterMachineConfigStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[26]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterMachineConfigStatusSpec.ProtoReflect.Descriptor instead.
+func (*ClusterMachineConfigStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{26}
+}
+
+func (x *ClusterMachineConfigStatusSpec) GetClusterMachineConfigVersion() string {
+	if x != nil {
+		return x.ClusterMachineConfigVersion
+	}
+	return ""
+}
+
+func (x *ClusterMachineConfigStatusSpec) GetClusterMachineVersion() string {
+	if x != nil {
+		return x.ClusterMachineVersion
+	}
+	return ""
+}
+
+func (x *ClusterMachineConfigStatusSpec) GetClusterMachineConfigSha256() string {
+	if x != nil {
+		return x.ClusterMachineConfigSha256
+	}
+	return ""
+}
+
+func (x *ClusterMachineConfigStatusSpec) GetLastConfigError() string {
+	if x != nil {
+		return x.LastConfigError
+	}
+	return ""
+}
+
+func (x *ClusterMachineConfigStatusSpec) GetTalosVersion() string {
+	if x != nil {
+		return x.TalosVersion
+	}
+	return ""
+}
+
+func (x *ClusterMachineConfigStatusSpec) GetSchematicId() string {
+	if x != nil {
+		return x.SchematicId
+	}
+	return ""
+}
+
+// ClusterBootstrapStatusSpec keeps track of bootstrap calls for a cluster.
+type ClusterBootstrapStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Bootstrapped bool `protobuf:"varint,1,opt,name=bootstrapped,proto3" json:"bootstrapped,omitempty"`
+}
+
+func (x *ClusterBootstrapStatusSpec) Reset() {
+	*x = ClusterBootstrapStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[27]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterBootstrapStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterBootstrapStatusSpec) ProtoMessage() {}
+
+func (x *ClusterBootstrapStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[27]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterBootstrapStatusSpec.ProtoReflect.Descriptor instead.
+func (*ClusterBootstrapStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{27}
+}
+
+func (x *ClusterBootstrapStatusSpec) GetBootstrapped() bool {
+	if x != nil {
+		return x.Bootstrapped
+	}
+	return false
+}
+
+// ClusterSecretsSpec describes cluster secrets.
+type ClusterSecretsSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Bytes holding serialized cluster secrets.
+	Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *ClusterSecretsSpec) Reset() {
+	*x = ClusterSecretsSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[28]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterSecretsSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterSecretsSpec) ProtoMessage() {}
+
+func (x *ClusterSecretsSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[28]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterSecretsSpec.ProtoReflect.Descriptor instead.
+func (*ClusterSecretsSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{28}
+}
+
+func (x *ClusterSecretsSpec) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+// LoadBalancerConfigSpec describes the configuration of a load balancer.
+type LoadBalancerConfigSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	BindPort string `protobuf:"bytes,2,opt,name=bind_port,json=bindPort,proto3" json:"bind_port,omitempty"`
+	// Full URL of the loadbalancer inside Omni environment.
+	SiderolinkEndpoint string `protobuf:"bytes,4,opt,name=siderolink_endpoint,json=siderolinkEndpoint,proto3" json:"siderolink_endpoint,omitempty"`
+	// IP adresses of the endpoints
+	Endpoints []string `protobuf:"bytes,3,rep,name=endpoints,proto3" json:"endpoints,omitempty"`
+}
+
+func (x *LoadBalancerConfigSpec) Reset() {
+	*x = LoadBalancerConfigSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[29]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LoadBalancerConfigSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LoadBalancerConfigSpec) ProtoMessage() {}
+
+func (x *LoadBalancerConfigSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[29]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LoadBalancerConfigSpec.ProtoReflect.Descriptor instead.
+func (*LoadBalancerConfigSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{29}
+}
+
+func (x *LoadBalancerConfigSpec) GetBindPort() string {
+	if x != nil {
+		return x.BindPort
+	}
+	return ""
+}
+
+func (x *LoadBalancerConfigSpec) GetSiderolinkEndpoint() string {
+	if x != nil {
+		return x.SiderolinkEndpoint
+	}
+	return ""
+}
+
+func (x *LoadBalancerConfigSpec) GetEndpoints() []string {
+	if x != nil {
+		return x.Endpoints
+	}
+	return nil
+}
+
+// LoadBalancerStatusSpec reflects the status of a load balancer.
+type LoadBalancerStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Healthy bool `protobuf:"varint,3,opt,name=healthy,proto3" json:"healthy,omitempty"`
+	Stopped bool `protobuf:"varint,4,opt,name=stopped,proto3" json:"stopped,omitempty"`
+}
+
+func (x *LoadBalancerStatusSpec) Reset() {
+	*x = LoadBalancerStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[30]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LoadBalancerStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LoadBalancerStatusSpec) ProtoMessage() {}
+
+func (x *LoadBalancerStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[30]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LoadBalancerStatusSpec.ProtoReflect.Descriptor instead.
+func (*LoadBalancerStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{30}
+}
+
+func (x *LoadBalancerStatusSpec) GetHealthy() bool {
+	if x != nil {
+		return x.Healthy
+	}
+	return false
+}
+
+func (x *LoadBalancerStatusSpec) GetStopped() bool {
+	if x != nil {
+		return x.Stopped
+	}
+	return false
+}
+
+// KubernetesVersionSpec represents an available Kubernetes version.
+type KubernetesVersionSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
+}
+
+func (x *KubernetesVersionSpec) Reset() {
+	*x = KubernetesVersionSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[31]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubernetesVersionSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubernetesVersionSpec) ProtoMessage() {}
+
+func (x *KubernetesVersionSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[31]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubernetesVersionSpec.ProtoReflect.Descriptor instead.
+func (*KubernetesVersionSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{31}
+}
+
+func (x *KubernetesVersionSpec) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+// TalosVersionSpec represents an available Talos version.
+type TalosVersionSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Version                      string   `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
+	CompatibleKubernetesVersions []string `protobuf:"bytes,2,rep,name=compatible_kubernetes_versions,json=compatibleKubernetesVersions,proto3" json:"compatible_kubernetes_versions,omitempty"`
+}
+
+func (x *TalosVersionSpec) Reset() {
+	*x = TalosVersionSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[32]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TalosVersionSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TalosVersionSpec) ProtoMessage() {}
+
+func (x *TalosVersionSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[32]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TalosVersionSpec.ProtoReflect.Descriptor instead.
+func (*TalosVersionSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{32}
+}
+
+func (x *TalosVersionSpec) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *TalosVersionSpec) GetCompatibleKubernetesVersions() []string {
+	if x != nil {
+		return x.CompatibleKubernetesVersions
+	}
+	return nil
+}
+
+// InstallationMediaSpec resource describes a Talos installation media that can be generated by the image factory. It also describes the necessary parameters to be passed to the image factory.
+type InstallationMediaSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Name is the human readable name of the image.
+	Name         string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Architecture string `protobuf:"bytes,2,opt,name=architecture,proto3" json:"architecture,omitempty"`
+	Profile      string `protobuf:"bytes,3,opt,name=profile,proto3" json:"profile,omitempty"`
+	ContentType  string `protobuf:"bytes,6,opt,name=contentType,proto3" json:"contentType,omitempty"`
+	// SrcFilePrefix defines the src filename to download the image from.
+	SrcFilePrefix string `protobuf:"bytes,7,opt,name=src_file_prefix,json=srcFilePrefix,proto3" json:"src_file_prefix,omitempty"`
+	// DestFilePrefix defines the dest filename to download the image to.
+	DestFilePrefix string `protobuf:"bytes,8,opt,name=dest_file_prefix,json=destFilePrefix,proto3" json:"dest_file_prefix,omitempty"`
+	// Extension defines the dest filename extension.
+	Extension string `protobuf:"bytes,9,opt,name=extension,proto3" json:"extension,omitempty"`
+	// NoSecureBoot means that the installation media doesn't support SecureBoot generation.
+	NoSecureBoot bool `protobuf:"varint,11,opt,name=no_secure_boot,json=noSecureBoot,proto3" json:"no_secure_boot,omitempty"`
+}
+
+func (x *InstallationMediaSpec) Reset() {
+	*x = InstallationMediaSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[33]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *InstallationMediaSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*InstallationMediaSpec) ProtoMessage() {}
+
+func (x *InstallationMediaSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[33]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use InstallationMediaSpec.ProtoReflect.Descriptor instead.
+func (*InstallationMediaSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{33}
+}
+
+func (x *InstallationMediaSpec) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *InstallationMediaSpec) GetArchitecture() string {
+	if x != nil {
+		return x.Architecture
+	}
+	return ""
+}
+
+func (x *InstallationMediaSpec) GetProfile() string {
+	if x != nil {
+		return x.Profile
+	}
+	return ""
+}
+
+func (x *InstallationMediaSpec) GetContentType() string {
+	if x != nil {
+		return x.ContentType
+	}
+	return ""
+}
+
+func (x *InstallationMediaSpec) GetSrcFilePrefix() string {
+	if x != nil {
+		return x.SrcFilePrefix
+	}
+	return ""
+}
+
+func (x *InstallationMediaSpec) GetDestFilePrefix() string {
+	if x != nil {
+		return x.DestFilePrefix
+	}
+	return ""
+}
+
+func (x *InstallationMediaSpec) GetExtension() string {
+	if x != nil {
+		return x.Extension
+	}
+	return ""
+}
+
+func (x *InstallationMediaSpec) GetNoSecureBoot() bool {
+	if x != nil {
+		return x.NoSecureBoot
+	}
+	return false
+}
+
+// ConfigPatchSpec represents the machine config patch.
+type ConfigPatchSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Data string `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *ConfigPatchSpec) Reset() {
+	*x = ConfigPatchSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[34]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ConfigPatchSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ConfigPatchSpec) ProtoMessage() {}
+
+func (x *ConfigPatchSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[34]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ConfigPatchSpec.ProtoReflect.Descriptor instead.
+func (*ConfigPatchSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{34}
+}
+
+func (x *ConfigPatchSpec) GetData() string {
+	if x != nil {
+		return x.Data
+	}
+	return ""
+}
+
+// MachineSetSpec describes the cluster machine group.
+type MachineSetSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// UpdateStrategy is the update strategy of the machine set.
+	UpdateStrategy MachineSetSpec_UpdateStrategy `protobuf:"varint,1,opt,name=update_strategy,json=updateStrategy,proto3,enum=specs.MachineSetSpec_UpdateStrategy" json:"update_strategy,omitempty"`
+	// MachineClass is the machine class to pick machines from for the machine set.
+	MachineClass *MachineSetSpec_MachineClass `protobuf:"bytes,2,opt,name=machine_class,json=machineClass,proto3" json:"machine_class,omitempty"`
+	// BootstrapSpec defines the bootstrapping spec of the machine set.
+	// This field is immutable, only valid for the control plane machine set and used only once at the creation time.
+	// When set, the machine set won't be created from scratch, instead, it will be bootstrapped using the given spec.
+	BootstrapSpec *MachineSetSpec_BootstrapSpec `protobuf:"bytes,3,opt,name=bootstrap_spec,json=bootstrapSpec,proto3" json:"bootstrap_spec,omitempty"`
+	// DeleteStrategy defines the delete strategy of the machine set.
+	DeleteStrategy MachineSetSpec_UpdateStrategy `protobuf:"varint,4,opt,name=delete_strategy,json=deleteStrategy,proto3,enum=specs.MachineSetSpec_UpdateStrategy" json:"delete_strategy,omitempty"`
+	// UpdateStrategyConfig defines the update strategy configuration.
+	UpdateStrategyConfig *MachineSetSpec_UpdateStrategyConfig `protobuf:"bytes,5,opt,name=update_strategy_config,json=updateStrategyConfig,proto3" json:"update_strategy_config,omitempty"`
+	// DeleteStrategyConfig defines the delete strategy configuration.
+	DeleteStrategyConfig *MachineSetSpec_UpdateStrategyConfig `protobuf:"bytes,6,opt,name=delete_strategy_config,json=deleteStrategyConfig,proto3" json:"delete_strategy_config,omitempty"`
+}
+
+func (x *MachineSetSpec) Reset() {
+	*x = MachineSetSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[35]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineSetSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineSetSpec) ProtoMessage() {}
+
+func (x *MachineSetSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[35]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineSetSpec.ProtoReflect.Descriptor instead.
+func (*MachineSetSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{35}
+}
+
+func (x *MachineSetSpec) GetUpdateStrategy() MachineSetSpec_UpdateStrategy {
+	if x != nil {
+		return x.UpdateStrategy
+	}
+	return MachineSetSpec_Unset
+}
+
+func (x *MachineSetSpec) GetMachineClass() *MachineSetSpec_MachineClass {
+	if x != nil {
+		return x.MachineClass
+	}
+	return nil
+}
+
+func (x *MachineSetSpec) GetBootstrapSpec() *MachineSetSpec_BootstrapSpec {
+	if x != nil {
+		return x.BootstrapSpec
+	}
+	return nil
+}
+
+func (x *MachineSetSpec) GetDeleteStrategy() MachineSetSpec_UpdateStrategy {
+	if x != nil {
+		return x.DeleteStrategy
+	}
+	return MachineSetSpec_Unset
+}
+
+func (x *MachineSetSpec) GetUpdateStrategyConfig() *MachineSetSpec_UpdateStrategyConfig {
+	if x != nil {
+		return x.UpdateStrategyConfig
+	}
+	return nil
+}
+
+func (x *MachineSetSpec) GetDeleteStrategyConfig() *MachineSetSpec_UpdateStrategyConfig {
+	if x != nil {
+		return x.DeleteStrategyConfig
+	}
+	return nil
+}
+
+// TalosUpgradeStatusSpec contains the status of the Talos upgrade process.
+type TalosUpgradeStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Current upgrade phase.
+	Phase TalosUpgradeStatusSpec_Phase `protobuf:"varint,1,opt,name=phase,proto3,enum=specs.TalosUpgradeStatusSpec_Phase" json:"phase,omitempty"`
+	// If phase is Failed, this contains the error message.
+	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
+	// If phase is Upgrading, this contains the current upgrade step.
+	Step string `protobuf:"bytes,3,opt,name=step,proto3" json:"step,omitempty"`
+	// If phase is Upgrading, this contains the current upgrade step progress.
+	Status string `protobuf:"bytes,4,opt,name=status,proto3" json:"status,omitempty"`
+	// Last successful upgrade version.
+	LastUpgradeVersion string `protobuf:"bytes,5,opt,name=last_upgrade_version,json=lastUpgradeVersion,proto3" json:"last_upgrade_version,omitempty"`
+	// Current version of the upgrade (if phase == Upgrading).
+	CurrentUpgradeVersion string `protobuf:"bytes,6,opt,name=current_upgrade_version,json=currentUpgradeVersion,proto3" json:"current_upgrade_version,omitempty"`
+	// List of versions available for upgrade.
+	UpgradeVersions []string `protobuf:"bytes,7,rep,name=upgrade_versions,json=upgradeVersions,proto3" json:"upgrade_versions,omitempty"`
+}
+
+func (x *TalosUpgradeStatusSpec) Reset() {
+	*x = TalosUpgradeStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[36]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TalosUpgradeStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TalosUpgradeStatusSpec) ProtoMessage() {}
+
+func (x *TalosUpgradeStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[36]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TalosUpgradeStatusSpec.ProtoReflect.Descriptor instead.
+func (*TalosUpgradeStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{36}
+}
+
+func (x *TalosUpgradeStatusSpec) GetPhase() TalosUpgradeStatusSpec_Phase {
+	if x != nil {
+		return x.Phase
+	}
+	return TalosUpgradeStatusSpec_Unknown
+}
+
+func (x *TalosUpgradeStatusSpec) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
+func (x *TalosUpgradeStatusSpec) GetStep() string {
+	if x != nil {
+		return x.Step
+	}
+	return ""
+}
+
+func (x *TalosUpgradeStatusSpec) GetStatus() string {
+	if x != nil {
+		return x.Status
+	}
+	return ""
+}
+
+func (x *TalosUpgradeStatusSpec) GetLastUpgradeVersion() string {
+	if x != nil {
+		return x.LastUpgradeVersion
+	}
+	return ""
+}
+
+func (x *TalosUpgradeStatusSpec) GetCurrentUpgradeVersion() string {
+	if x != nil {
+		return x.CurrentUpgradeVersion
+	}
+	return ""
+}
+
+func (x *TalosUpgradeStatusSpec) GetUpgradeVersions() []string {
+	if x != nil {
+		return x.UpgradeVersions
+	}
+	return nil
+}
+
+// MachineSetStatusSpec describes machine set status.
+type MachineSetStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Phase    MachineSetPhase `protobuf:"varint,1,opt,name=phase,proto3,enum=specs.MachineSetPhase" json:"phase,omitempty"`
+	Ready    bool            `protobuf:"varint,2,opt,name=ready,proto3" json:"ready,omitempty"`
+	Error    string          `protobuf:"bytes,3,opt,name=error,proto3" json:"error,omitempty"`
+	Machines *Machines       `protobuf:"bytes,4,opt,name=machines,proto3" json:"machines,omitempty"`
+	// config_hash is the combined hash of all cluster machines which are part of the machine set.
+	ConfigHash string `protobuf:"bytes,5,opt,name=config_hash,json=configHash,proto3" json:"config_hash,omitempty"`
+	// MachineClass is copied from the input MachineSet resource.
+	MachineClass *MachineSetSpec_MachineClass `protobuf:"bytes,6,opt,name=machine_class,json=machineClass,proto3" json:"machine_class,omitempty"`
+}
+
+func (x *MachineSetStatusSpec) Reset() {
+	*x = MachineSetStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[37]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineSetStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineSetStatusSpec) ProtoMessage() {}
+
+func (x *MachineSetStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[37]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineSetStatusSpec.ProtoReflect.Descriptor instead.
+func (*MachineSetStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{37}
+}
+
+func (x *MachineSetStatusSpec) GetPhase() MachineSetPhase {
+	if x != nil {
+		return x.Phase
+	}
+	return MachineSetPhase_Unknown
+}
+
+func (x *MachineSetStatusSpec) GetReady() bool {
+	if x != nil {
+		return x.Ready
+	}
+	return false
+}
+
+func (x *MachineSetStatusSpec) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
+func (x *MachineSetStatusSpec) GetMachines() *Machines {
+	if x != nil {
+		return x.Machines
+	}
+	return nil
+}
+
+func (x *MachineSetStatusSpec) GetConfigHash() string {
+	if x != nil {
+		return x.ConfigHash
+	}
+	return ""
+}
+
+func (x *MachineSetStatusSpec) GetMachineClass() *MachineSetSpec_MachineClass {
+	if x != nil {
+		return x.MachineClass
+	}
+	return nil
+}
+
+// MachineSetNodeSpec is a binding between ClusterMachine and MachineSet.
+type MachineSetNodeSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *MachineSetNodeSpec) Reset() {
+	*x = MachineSetNodeSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[38]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineSetNodeSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineSetNodeSpec) ProtoMessage() {}
+
+func (x *MachineSetNodeSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[38]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineSetNodeSpec.ProtoReflect.Descriptor instead.
+func (*MachineSetNodeSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{38}
+}
+
+// MachineLabelsSpec is the resource that adds user defined labels to the MachineStatus.
+type MachineLabelsSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *MachineLabelsSpec) Reset() {
+	*x = MachineLabelsSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[39]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineLabelsSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineLabelsSpec) ProtoMessage() {}
+
+func (x *MachineLabelsSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[39]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineLabelsSpec.ProtoReflect.Descriptor instead.
+func (*MachineLabelsSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{39}
+}
+
+// MachineStatusSnapshotSpec describes latest known status of MachineStatus Talos resource.
+type MachineStatusSnapshotSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MachineStatus *machine.MachineStatusEvent `protobuf:"bytes,1,opt,name=machine_status,json=machineStatus,proto3" json:"machine_status,omitempty"`
+}
+
+func (x *MachineStatusSnapshotSpec) Reset() {
+	*x = MachineStatusSnapshotSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[40]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineStatusSnapshotSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineStatusSnapshotSpec) ProtoMessage() {}
+
+func (x *MachineStatusSnapshotSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[40]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineStatusSnapshotSpec.ProtoReflect.Descriptor instead.
+func (*MachineStatusSnapshotSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{40}
+}
+
+func (x *MachineStatusSnapshotSpec) GetMachineStatus() *machine.MachineStatusEvent {
+	if x != nil {
+		return x.MachineStatus
+	}
+	return nil
+}
+
+// ControlPlaneStatusSpec contains the status of the MachineSets which manage control plane nodes.
+type ControlPlaneStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Conditions []*ControlPlaneStatusSpec_Condition `protobuf:"bytes,1,rep,name=conditions,proto3" json:"conditions,omitempty"`
+}
+
+func (x *ControlPlaneStatusSpec) Reset() {
+	*x = ControlPlaneStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[41]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ControlPlaneStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ControlPlaneStatusSpec) ProtoMessage() {}
+
+func (x *ControlPlaneStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[41]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ControlPlaneStatusSpec.ProtoReflect.Descriptor instead.
+func (*ControlPlaneStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{41}
+}
+
+func (x *ControlPlaneStatusSpec) GetConditions() []*ControlPlaneStatusSpec_Condition {
+	if x != nil {
+		return x.Conditions
+	}
+	return nil
+}
+
+// ClusterEndpointSpec contains a list of SideroLink (management) control plane endpoints.
+type ClusterEndpointSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// List of SideroLink addresses for control plane nodes.
+	ManagementAddresses []string `protobuf:"bytes,1,rep,name=management_addresses,json=managementAddresses,proto3" json:"management_addresses,omitempty"`
+}
+
+func (x *ClusterEndpointSpec) Reset() {
+	*x = ClusterEndpointSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[42]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterEndpointSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterEndpointSpec) ProtoMessage() {}
+
+func (x *ClusterEndpointSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[42]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterEndpointSpec.ProtoReflect.Descriptor instead.
+func (*ClusterEndpointSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{42}
+}
+
+func (x *ClusterEndpointSpec) GetManagementAddresses() []string {
+	if x != nil {
+		return x.ManagementAddresses
+	}
+	return nil
+}
+
+// KubernetesStatusSpec contains the status of the Kubernetes critical resources in the cluster.
+type KubernetesStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// status of each node, sorted by nodename
+	Nodes []*KubernetesStatusSpec_NodeStatus `protobuf:"bytes,1,rep,name=nodes,proto3" json:"nodes,omitempty"`
+	// status of each static pod on each node, sorted by nodename, then by pod's app
+	StaticPods []*KubernetesStatusSpec_NodeStaticPods `protobuf:"bytes,2,rep,name=static_pods,json=staticPods,proto3" json:"static_pods,omitempty"`
+}
+
+func (x *KubernetesStatusSpec) Reset() {
+	*x = KubernetesStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[43]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubernetesStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubernetesStatusSpec) ProtoMessage() {}
+
+func (x *KubernetesStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[43]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubernetesStatusSpec.ProtoReflect.Descriptor instead.
+func (*KubernetesStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{43}
+}
+
+func (x *KubernetesStatusSpec) GetNodes() []*KubernetesStatusSpec_NodeStatus {
+	if x != nil {
+		return x.Nodes
+	}
+	return nil
+}
+
+func (x *KubernetesStatusSpec) GetStaticPods() []*KubernetesStatusSpec_NodeStaticPods {
+	if x != nil {
+		return x.StaticPods
+	}
+	return nil
+}
+
+// KubernetesUpgradeStatus spec contains the status of the Kubernetes upgrade process.
+type KubernetesUpgradeStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Current upgrade phase.
+	Phase KubernetesUpgradeStatusSpec_Phase `protobuf:"varint,1,opt,name=phase,proto3,enum=specs.KubernetesUpgradeStatusSpec_Phase" json:"phase,omitempty"`
+	// If phase is Failed, this contains the error message.
+	Error string `protobuf:"bytes,2,opt,name=error,proto3" json:"error,omitempty"`
+	// If phase is Upgrading, this contains the current upgrade step.
+	Step string `protobuf:"bytes,3,opt,name=step,proto3" json:"step,omitempty"`
+	// If phase is Upgrading, this contains the current upgrade step progress.
+	Status string `protobuf:"bytes,4,opt,name=status,proto3" json:"status,omitempty"`
+	// Last successful upgrade version.
+	LastUpgradeVersion string `protobuf:"bytes,5,opt,name=last_upgrade_version,json=lastUpgradeVersion,proto3" json:"last_upgrade_version,omitempty"`
+	// Current version of the upgrade (if phase == Upgrading).
+	CurrentUpgradeVersion string `protobuf:"bytes,7,opt,name=current_upgrade_version,json=currentUpgradeVersion,proto3" json:"current_upgrade_version,omitempty"`
+	// List of versions available for upgrade.
+	UpgradeVersions []string `protobuf:"bytes,6,rep,name=upgrade_versions,json=upgradeVersions,proto3" json:"upgrade_versions,omitempty"`
+}
+
+func (x *KubernetesUpgradeStatusSpec) Reset() {
+	*x = KubernetesUpgradeStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[44]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubernetesUpgradeStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubernetesUpgradeStatusSpec) ProtoMessage() {}
+
+func (x *KubernetesUpgradeStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[44]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubernetesUpgradeStatusSpec.ProtoReflect.Descriptor instead.
+func (*KubernetesUpgradeStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{44}
+}
+
+func (x *KubernetesUpgradeStatusSpec) GetPhase() KubernetesUpgradeStatusSpec_Phase {
+	if x != nil {
+		return x.Phase
+	}
+	return KubernetesUpgradeStatusSpec_Unknown
+}
+
+func (x *KubernetesUpgradeStatusSpec) GetError() string {
+	if x != nil {
+		return x.Error
+	}
+	return ""
+}
+
+func (x *KubernetesUpgradeStatusSpec) GetStep() string {
+	if x != nil {
+		return x.Step
+	}
+	return ""
+}
+
+func (x *KubernetesUpgradeStatusSpec) GetStatus() string {
+	if x != nil {
+		return x.Status
+	}
+	return ""
+}
+
+func (x *KubernetesUpgradeStatusSpec) GetLastUpgradeVersion() string {
+	if x != nil {
+		return x.LastUpgradeVersion
+	}
+	return ""
+}
+
+func (x *KubernetesUpgradeStatusSpec) GetCurrentUpgradeVersion() string {
+	if x != nil {
+		return x.CurrentUpgradeVersion
+	}
+	return ""
+}
+
+func (x *KubernetesUpgradeStatusSpec) GetUpgradeVersions() []string {
+	if x != nil {
+		return x.UpgradeVersions
+	}
+	return nil
+}
+
+// KubernetesUpgradeManifestStatus contains status of Kubernetes upgrade manifest sync.
+type KubernetesUpgradeManifestStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Number of manifests out of sync.
+	OutOfSync int32 `protobuf:"varint,1,opt,name=out_of_sync,json=outOfSync,proto3" json:"out_of_sync,omitempty"`
+	// Last fatal error encountered (which prevented the sync).
+	LastFatalError string `protobuf:"bytes,2,opt,name=last_fatal_error,json=lastFatalError,proto3" json:"last_fatal_error,omitempty"`
+}
+
+func (x *KubernetesUpgradeManifestStatusSpec) Reset() {
+	*x = KubernetesUpgradeManifestStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[45]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubernetesUpgradeManifestStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubernetesUpgradeManifestStatusSpec) ProtoMessage() {}
+
+func (x *KubernetesUpgradeManifestStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[45]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubernetesUpgradeManifestStatusSpec.ProtoReflect.Descriptor instead.
+func (*KubernetesUpgradeManifestStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{45}
+}
+
+func (x *KubernetesUpgradeManifestStatusSpec) GetOutOfSync() int32 {
+	if x != nil {
+		return x.OutOfSync
+	}
+	return 0
+}
+
+func (x *KubernetesUpgradeManifestStatusSpec) GetLastFatalError() string {
+	if x != nil {
+		return x.LastFatalError
+	}
+	return ""
+}
+
+// DestroyStatusSpec describes the state of resource destroy.
+type DestroyStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Phase describes the current destroy phase.
+	Phase string `protobuf:"bytes,1,opt,name=phase,proto3" json:"phase,omitempty"`
+}
+
+func (x *DestroyStatusSpec) Reset() {
+	*x = DestroyStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[46]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DestroyStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DestroyStatusSpec) ProtoMessage() {}
+
+func (x *DestroyStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[46]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DestroyStatusSpec.ProtoReflect.Descriptor instead.
+func (*DestroyStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{46}
+}
+
+func (x *DestroyStatusSpec) GetPhase() string {
+	if x != nil {
+		return x.Phase
+	}
+	return ""
+}
+
+// OngoingTaskSpec describes any ongoing tasks.
+type OngoingTaskSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Title of the ongoing task.
+	Title string `protobuf:"bytes,1,opt,name=title,proto3" json:"title,omitempty"`
+	// Details contains the detailed task description.
+	//
+	// Types that are assignable to Details:
+	//
+	//	*OngoingTaskSpec_TalosUpgrade
+	//	*OngoingTaskSpec_KubernetesUpgrade
+	//	*OngoingTaskSpec_Destroy
+	Details isOngoingTaskSpec_Details `protobuf_oneof:"details"`
+}
+
+func (x *OngoingTaskSpec) Reset() {
+	*x = OngoingTaskSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[47]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *OngoingTaskSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*OngoingTaskSpec) ProtoMessage() {}
+
+func (x *OngoingTaskSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[47]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use OngoingTaskSpec.ProtoReflect.Descriptor instead.
+func (*OngoingTaskSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{47}
+}
+
+func (x *OngoingTaskSpec) GetTitle() string {
+	if x != nil {
+		return x.Title
+	}
+	return ""
+}
+
+func (m *OngoingTaskSpec) GetDetails() isOngoingTaskSpec_Details {
+	if m != nil {
+		return m.Details
+	}
+	return nil
+}
+
+func (x *OngoingTaskSpec) GetTalosUpgrade() *TalosUpgradeStatusSpec {
+	if x, ok := x.GetDetails().(*OngoingTaskSpec_TalosUpgrade); ok {
+		return x.TalosUpgrade
+	}
+	return nil
+}
+
+func (x *OngoingTaskSpec) GetKubernetesUpgrade() *KubernetesUpgradeStatusSpec {
+	if x, ok := x.GetDetails().(*OngoingTaskSpec_KubernetesUpgrade); ok {
+		return x.KubernetesUpgrade
+	}
+	return nil
+}
+
+func (x *OngoingTaskSpec) GetDestroy() *DestroyStatusSpec {
+	if x, ok := x.GetDetails().(*OngoingTaskSpec_Destroy); ok {
+		return x.Destroy
+	}
+	return nil
+}
+
+type isOngoingTaskSpec_Details interface {
+	isOngoingTaskSpec_Details()
+}
+
+type OngoingTaskSpec_TalosUpgrade struct {
+	TalosUpgrade *TalosUpgradeStatusSpec `protobuf:"bytes,2,opt,name=talos_upgrade,json=talosUpgrade,proto3,oneof"`
+}
+
+type OngoingTaskSpec_KubernetesUpgrade struct {
+	KubernetesUpgrade *KubernetesUpgradeStatusSpec `protobuf:"bytes,3,opt,name=kubernetes_upgrade,json=kubernetesUpgrade,proto3,oneof"`
+}
+
+type OngoingTaskSpec_Destroy struct {
+	Destroy *DestroyStatusSpec `protobuf:"bytes,4,opt,name=destroy,proto3,oneof"`
+}
+
+func (*OngoingTaskSpec_TalosUpgrade) isOngoingTaskSpec_Details() {}
+
+func (*OngoingTaskSpec_KubernetesUpgrade) isOngoingTaskSpec_Details() {}
+
+func (*OngoingTaskSpec_Destroy) isOngoingTaskSpec_Details() {}
+
+// ClusterMachineEncryptionKeySpec keeps generated encryption key for the machine disk encryption.
+type ClusterMachineEncryptionKeySpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Data stores generated encryption key for the machine.
+	Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *ClusterMachineEncryptionKeySpec) Reset() {
+	*x = ClusterMachineEncryptionKeySpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[48]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterMachineEncryptionKeySpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterMachineEncryptionKeySpec) ProtoMessage() {}
+
+func (x *ClusterMachineEncryptionKeySpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[48]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterMachineEncryptionKeySpec.ProtoReflect.Descriptor instead.
+func (*ClusterMachineEncryptionKeySpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{48}
+}
+
+func (x *ClusterMachineEncryptionKeySpec) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+// ExposedServiceSpec describes a Kubernetes service exposed through Omni from a workload cluster.
+type ExposedServiceSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Port is the host port the service is exposed on.
+	Port uint32 `protobuf:"varint,1,opt,name=port,proto3" json:"port,omitempty"`
+	// Label is the human-readable label of the service to be displayed on Omni Web.
+	Label string `protobuf:"bytes,2,opt,name=label,proto3" json:"label,omitempty"`
+	// IconBase64 is the icon of the service to be displayed on Omni Web.
+	IconBase64 string `protobuf:"bytes,3,opt,name=icon_base64,json=iconBase64,proto3" json:"icon_base64,omitempty"`
+}
+
+func (x *ExposedServiceSpec) Reset() {
+	*x = ExposedServiceSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[49]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExposedServiceSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExposedServiceSpec) ProtoMessage() {}
+
+func (x *ExposedServiceSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[49]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExposedServiceSpec.ProtoReflect.Descriptor instead.
+func (*ExposedServiceSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{49}
+}
+
+func (x *ExposedServiceSpec) GetPort() uint32 {
+	if x != nil {
+		return x.Port
+	}
+	return 0
+}
+
+func (x *ExposedServiceSpec) GetLabel() string {
+	if x != nil {
+		return x.Label
+	}
+	return ""
+}
+
+func (x *ExposedServiceSpec) GetIconBase64() string {
+	if x != nil {
+		return x.IconBase64
+	}
+	return ""
+}
+
+type FeaturesConfigSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// EnableWorkloadProxying enables workload proxying feature.
+	EnableWorkloadProxying bool `protobuf:"varint,1,opt,name=enable_workload_proxying,json=enableWorkloadProxying,proto3" json:"enable_workload_proxying,omitempty"`
+	// EtcdBackupSettings represents omni etcd backup settings.
+	EtcdBackupSettings *EtcdBackupSettings `protobuf:"bytes,2,opt,name=etcd_backup_settings,json=etcdBackupSettings,proto3" json:"etcd_backup_settings,omitempty"`
+}
+
+func (x *FeaturesConfigSpec) Reset() {
+	*x = FeaturesConfigSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[50]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *FeaturesConfigSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FeaturesConfigSpec) ProtoMessage() {}
+
+func (x *FeaturesConfigSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[50]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FeaturesConfigSpec.ProtoReflect.Descriptor instead.
+func (*FeaturesConfigSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{50}
+}
+
+func (x *FeaturesConfigSpec) GetEnableWorkloadProxying() bool {
+	if x != nil {
+		return x.EnableWorkloadProxying
+	}
+	return false
+}
+
+func (x *FeaturesConfigSpec) GetEtcdBackupSettings() *EtcdBackupSettings {
+	if x != nil {
+		return x.EtcdBackupSettings
+	}
+	return nil
+}
+
+type EtcdBackupSettings struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// TickInterval is the interval between checking for backups in controller.
+	TickInterval *durationpb.Duration `protobuf:"bytes,1,opt,name=tick_interval,json=tickInterval,proto3" json:"tick_interval,omitempty"`
+	// MinInterval is the minimum interval between backups.
+	MinInterval *durationpb.Duration `protobuf:"bytes,2,opt,name=min_interval,json=minInterval,proto3" json:"min_interval,omitempty"`
+	// MaxInterval is the maximum interval between backups.
+	MaxInterval *durationpb.Duration `protobuf:"bytes,3,opt,name=max_interval,json=maxInterval,proto3" json:"max_interval,omitempty"`
+}
+
+func (x *EtcdBackupSettings) Reset() {
+	*x = EtcdBackupSettings{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[51]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EtcdBackupSettings) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EtcdBackupSettings) ProtoMessage() {}
+
+func (x *EtcdBackupSettings) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[51]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EtcdBackupSettings.ProtoReflect.Descriptor instead.
+func (*EtcdBackupSettings) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{51}
+}
+
+func (x *EtcdBackupSettings) GetTickInterval() *durationpb.Duration {
+	if x != nil {
+		return x.TickInterval
+	}
+	return nil
+}
+
+func (x *EtcdBackupSettings) GetMinInterval() *durationpb.Duration {
+	if x != nil {
+		return x.MinInterval
+	}
+	return nil
+}
+
+func (x *EtcdBackupSettings) GetMaxInterval() *durationpb.Duration {
+	if x != nil {
+		return x.MaxInterval
+	}
+	return nil
+}
+
+// MachineClassSpec describes an Omni MachineClass resource spec.
+type MachineClassSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// MatchLabels is the list of labels to match the machine to make it part of the machine class.
+	MatchLabels []string `protobuf:"bytes,1,rep,name=match_labels,json=matchLabels,proto3" json:"match_labels,omitempty"`
+}
+
+func (x *MachineClassSpec) Reset() {
+	*x = MachineClassSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[52]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineClassSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineClassSpec) ProtoMessage() {}
+
+func (x *MachineClassSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[52]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineClassSpec.ProtoReflect.Descriptor instead.
+func (*MachineClassSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{52}
+}
+
+func (x *MachineClassSpec) GetMatchLabels() []string {
+	if x != nil {
+		return x.MatchLabels
+	}
+	return nil
+}
+
+// MachineConfigGenOptionsSpec describes machine related config generation inputs.
+type MachineConfigGenOptionsSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	InstallDisk string `protobuf:"bytes,1,opt,name=install_disk,json=installDisk,proto3" json:"install_disk,omitempty"`
+}
+
+func (x *MachineConfigGenOptionsSpec) Reset() {
+	*x = MachineConfigGenOptionsSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[53]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineConfigGenOptionsSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineConfigGenOptionsSpec) ProtoMessage() {}
+
+func (x *MachineConfigGenOptionsSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[53]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineConfigGenOptionsSpec.ProtoReflect.Descriptor instead.
+func (*MachineConfigGenOptionsSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{53}
+}
+
+func (x *MachineConfigGenOptionsSpec) GetInstallDisk() string {
+	if x != nil {
+		return x.InstallDisk
+	}
+	return ""
+}
+
+// EtcdAuditResult is updated when the etcd audit removes a member.
+//
+// This resource is used to re-trigger the controlplane status checks when etcd audit removes a member.
+type EtcdAuditResultSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// EtcdMemberIds contains the list of ids of the members that were last removed.
+	// The list is always sorted.
+	EtcdMemberIds []uint64 `protobuf:"varint,1,rep,packed,name=etcd_member_ids,json=etcdMemberIds,proto3" json:"etcd_member_ids,omitempty"`
+}
+
+func (x *EtcdAuditResultSpec) Reset() {
+	*x = EtcdAuditResultSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[54]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EtcdAuditResultSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EtcdAuditResultSpec) ProtoMessage() {}
+
+func (x *EtcdAuditResultSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[54]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EtcdAuditResultSpec.ProtoReflect.Descriptor instead.
+func (*EtcdAuditResultSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{54}
+}
+
+func (x *EtcdAuditResultSpec) GetEtcdMemberIds() []uint64 {
+	if x != nil {
+		return x.EtcdMemberIds
+	}
+	return nil
+}
+
+// KubeconfigSpec describes a Kubernetes client configuraiton for a cluster.
+type KubeconfigSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Marshalled kubeconfig.
+	Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *KubeconfigSpec) Reset() {
+	*x = KubeconfigSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[55]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubeconfigSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubeconfigSpec) ProtoMessage() {}
+
+func (x *KubeconfigSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[55]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubeconfigSpec.ProtoReflect.Descriptor instead.
+func (*KubeconfigSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{55}
+}
+
+func (x *KubeconfigSpec) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+// KubernetesUsageSpec represents kubernetes resource usage for a cluster.
+type KubernetesUsageSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Cpu     *KubernetesUsageSpec_Quantity `protobuf:"bytes,1,opt,name=cpu,proto3" json:"cpu,omitempty"`
+	Mem     *KubernetesUsageSpec_Quantity `protobuf:"bytes,2,opt,name=mem,proto3" json:"mem,omitempty"`
+	Storage *KubernetesUsageSpec_Quantity `protobuf:"bytes,3,opt,name=storage,proto3" json:"storage,omitempty"`
+	Pods    *KubernetesUsageSpec_Pod      `protobuf:"bytes,4,opt,name=pods,proto3" json:"pods,omitempty"`
+}
+
+func (x *KubernetesUsageSpec) Reset() {
+	*x = KubernetesUsageSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[56]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubernetesUsageSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubernetesUsageSpec) ProtoMessage() {}
+
+func (x *KubernetesUsageSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[56]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubernetesUsageSpec.ProtoReflect.Descriptor instead.
+func (*KubernetesUsageSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{56}
+}
+
+func (x *KubernetesUsageSpec) GetCpu() *KubernetesUsageSpec_Quantity {
+	if x != nil {
+		return x.Cpu
+	}
+	return nil
+}
+
+func (x *KubernetesUsageSpec) GetMem() *KubernetesUsageSpec_Quantity {
+	if x != nil {
+		return x.Mem
+	}
+	return nil
+}
+
+func (x *KubernetesUsageSpec) GetStorage() *KubernetesUsageSpec_Quantity {
+	if x != nil {
+		return x.Storage
+	}
+	return nil
+}
+
+func (x *KubernetesUsageSpec) GetPods() *KubernetesUsageSpec_Pod {
+	if x != nil {
+		return x.Pods
+	}
+	return nil
+}
+
+// ImagePullRequestSpec describes an Omni ImagePullRequest resource spec.
+type ImagePullRequestSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// NodeImageList are the images to be pulled into the node.
+	NodeImageList []*ImagePullRequestSpec_NodeImageList `protobuf:"bytes,1,rep,name=node_image_list,json=nodeImageList,proto3" json:"node_image_list,omitempty"`
+}
+
+func (x *ImagePullRequestSpec) Reset() {
+	*x = ImagePullRequestSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[57]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ImagePullRequestSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ImagePullRequestSpec) ProtoMessage() {}
+
+func (x *ImagePullRequestSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[57]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ImagePullRequestSpec.ProtoReflect.Descriptor instead.
+func (*ImagePullRequestSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{57}
+}
+
+func (x *ImagePullRequestSpec) GetNodeImageList() []*ImagePullRequestSpec_NodeImageList {
+	if x != nil {
+		return x.NodeImageList
+	}
+	return nil
+}
+
+// ImagePullStatusSpec describes an Omni ImagePullStatus resource spec.
+type ImagePullStatusSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	LastProcessedNode  string `protobuf:"bytes,1,opt,name=last_processed_node,json=lastProcessedNode,proto3" json:"last_processed_node,omitempty"`
+	LastProcessedImage string `protobuf:"bytes,2,opt,name=last_processed_image,json=lastProcessedImage,proto3" json:"last_processed_image,omitempty"`
+	LastProcessedError string `protobuf:"bytes,3,opt,name=last_processed_error,json=lastProcessedError,proto3" json:"last_processed_error,omitempty"`
+	ProcessedCount     uint32 `protobuf:"varint,4,opt,name=processed_count,json=processedCount,proto3" json:"processed_count,omitempty"`
+	TotalCount         uint32 `protobuf:"varint,5,opt,name=total_count,json=totalCount,proto3" json:"total_count,omitempty"`
+	// RequestVersion is the version of the ImagePullRequest that this status is for.
+	RequestVersion string `protobuf:"bytes,6,opt,name=request_version,json=requestVersion,proto3" json:"request_version,omitempty"`
+}
+
+func (x *ImagePullStatusSpec) Reset() {
+	*x = ImagePullStatusSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[58]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ImagePullStatusSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ImagePullStatusSpec) ProtoMessage() {}
+
+func (x *ImagePullStatusSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[58]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ImagePullStatusSpec.ProtoReflect.Descriptor instead.
+func (*ImagePullStatusSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{58}
+}
+
+func (x *ImagePullStatusSpec) GetLastProcessedNode() string {
+	if x != nil {
+		return x.LastProcessedNode
+	}
+	return ""
+}
+
+func (x *ImagePullStatusSpec) GetLastProcessedImage() string {
+	if x != nil {
+		return x.LastProcessedImage
+	}
+	return ""
+}
+
+func (x *ImagePullStatusSpec) GetLastProcessedError() string {
+	if x != nil {
+		return x.LastProcessedError
+	}
+	return ""
+}
+
+func (x *ImagePullStatusSpec) GetProcessedCount() uint32 {
+	if x != nil {
+		return x.ProcessedCount
+	}
+	return 0
+}
+
+func (x *ImagePullStatusSpec) GetTotalCount() uint32 {
+	if x != nil {
+		return x.TotalCount
+	}
+	return 0
+}
+
+func (x *ImagePullStatusSpec) GetRequestVersion() string {
+	if x != nil {
+		return x.RequestVersion
+	}
+	return ""
+}
+
+// SchematicSpec keeps all schematics generated by Omni.
+// For each schematic it keeps information about the list of extensions.
+type SchematicSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Extensions []string `protobuf:"bytes,1,rep,name=extensions,proto3" json:"extensions,omitempty"`
+}
+
+func (x *SchematicSpec) Reset() {
+	*x = SchematicSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[59]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SchematicSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SchematicSpec) ProtoMessage() {}
+
+func (x *SchematicSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[59]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SchematicSpec.ProtoReflect.Descriptor instead.
+func (*SchematicSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{59}
+}
+
+func (x *SchematicSpec) GetExtensions() []string {
+	if x != nil {
+		return x.Extensions
+	}
+	return nil
+}
+
+// TalosExtensionsSpec represents all available extensions for a particular Talos version.
+type TalosExtensionsSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Items []*TalosExtensionsSpec_Info `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
+}
+
+func (x *TalosExtensionsSpec) Reset() {
+	*x = TalosExtensionsSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[60]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TalosExtensionsSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TalosExtensionsSpec) ProtoMessage() {}
+
+func (x *TalosExtensionsSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[60]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TalosExtensionsSpec.ProtoReflect.Descriptor instead.
+func (*TalosExtensionsSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{60}
+}
+
+func (x *TalosExtensionsSpec) GetItems() []*TalosExtensionsSpec_Info {
+	if x != nil {
+		return x.Items
+	}
+	return nil
+}
+
+// SchematicConfigurationSpec is the desired Image Factory schematic for a machine, machine set or a cluster.
+type SchematicConfigurationSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	SchematicId string                            `protobuf:"bytes,1,opt,name=schematic_id,json=schematicId,proto3" json:"schematic_id,omitempty"`
+	Target      SchematicConfigurationSpec_Target `protobuf:"varint,2,opt,name=target,proto3,enum=specs.SchematicConfigurationSpec_Target" json:"target,omitempty"`
+}
+
+func (x *SchematicConfigurationSpec) Reset() {
+	*x = SchematicConfigurationSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[61]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SchematicConfigurationSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SchematicConfigurationSpec) ProtoMessage() {}
+
+func (x *SchematicConfigurationSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[61]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SchematicConfigurationSpec.ProtoReflect.Descriptor instead.
+func (*SchematicConfigurationSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{61}
+}
+
+func (x *SchematicConfigurationSpec) GetSchematicId() string {
+	if x != nil {
+		return x.SchematicId
+	}
+	return ""
+}
+
+func (x *SchematicConfigurationSpec) GetTarget() SchematicConfigurationSpec_Target {
+	if x != nil {
+		return x.Target
+	}
+	return SchematicConfigurationSpec_Unknown
+}
+
+// HardwareStatus describes machine hardware status.
+type MachineStatusSpec_HardwareStatus struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// CPU information.
+	Processors []*MachineStatusSpec_HardwareStatus_Processor `protobuf:"bytes,1,rep,name=processors,proto3" json:"processors,omitempty"`
+	// Memory information.
+	MemoryModules []*MachineStatusSpec_HardwareStatus_MemoryModule `protobuf:"bytes,2,rep,name=memory_modules,json=memoryModules,proto3" json:"memory_modules,omitempty"`
+	// Blockdevice information.
+	Blockdevices []*MachineStatusSpec_HardwareStatus_BlockDevice `protobuf:"bytes,3,rep,name=blockdevices,proto3" json:"blockdevices,omitempty"`
+	// Machine architecture.
+	Arch string `protobuf:"bytes,4,opt,name=arch,proto3" json:"arch,omitempty"`
+}
+
+func (x *MachineStatusSpec_HardwareStatus) Reset() {
+	*x = MachineStatusSpec_HardwareStatus{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[62]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineStatusSpec_HardwareStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineStatusSpec_HardwareStatus) ProtoMessage() {}
+
+func (x *MachineStatusSpec_HardwareStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[62]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineStatusSpec_HardwareStatus.ProtoReflect.Descriptor instead.
+func (*MachineStatusSpec_HardwareStatus) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{1, 0}
+}
+
+func (x *MachineStatusSpec_HardwareStatus) GetProcessors() []*MachineStatusSpec_HardwareStatus_Processor {
+	if x != nil {
+		return x.Processors
+	}
+	return nil
+}
+
+func (x *MachineStatusSpec_HardwareStatus) GetMemoryModules() []*MachineStatusSpec_HardwareStatus_MemoryModule {
+	if x != nil {
+		return x.MemoryModules
+	}
+	return nil
+}
+
+func (x *MachineStatusSpec_HardwareStatus) GetBlockdevices() []*MachineStatusSpec_HardwareStatus_BlockDevice {
+	if x != nil {
+		return x.Blockdevices
+	}
+	return nil
+}
+
+func (x *MachineStatusSpec_HardwareStatus) GetArch() string {
+	if x != nil {
+		return x.Arch
+	}
+	return ""
+}
+
+// NetworkStatus describes the status of a machine network .
+type MachineStatusSpec_NetworkStatus struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Current machine hostname.
+	Hostname string `protobuf:"bytes,1,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	// Current machine domainname.
+	Domainname string `protobuf:"bytes,2,opt,name=domainname,proto3" json:"domainname,omitempty"`
+	// List of machine IPs.
+	Addresses []string `protobuf:"bytes,3,rep,name=addresses,proto3" json:"addresses,omitempty"`
+	// List of default gateway IPs.
+	DefaultGateways []string `protobuf:"bytes,4,rep,name=default_gateways,json=defaultGateways,proto3" json:"default_gateways,omitempty"`
+	// List of physical network interfaces.
+	NetworkLinks []*MachineStatusSpec_NetworkStatus_NetworkLinkStatus `protobuf:"bytes,5,rep,name=network_links,json=networkLinks,proto3" json:"network_links,omitempty"`
+}
+
+func (x *MachineStatusSpec_NetworkStatus) Reset() {
+	*x = MachineStatusSpec_NetworkStatus{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[63]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineStatusSpec_NetworkStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineStatusSpec_NetworkStatus) ProtoMessage() {}
+
+func (x *MachineStatusSpec_NetworkStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[63]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineStatusSpec_NetworkStatus.ProtoReflect.Descriptor instead.
+func (*MachineStatusSpec_NetworkStatus) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{1, 1}
+}
+
+func (x *MachineStatusSpec_NetworkStatus) GetHostname() string {
+	if x != nil {
+		return x.Hostname
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_NetworkStatus) GetDomainname() string {
+	if x != nil {
+		return x.Domainname
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_NetworkStatus) GetAddresses() []string {
+	if x != nil {
+		return x.Addresses
+	}
+	return nil
+}
+
+func (x *MachineStatusSpec_NetworkStatus) GetDefaultGateways() []string {
+	if x != nil {
+		return x.DefaultGateways
+	}
+	return nil
+}
+
+func (x *MachineStatusSpec_NetworkStatus) GetNetworkLinks() []*MachineStatusSpec_NetworkStatus_NetworkLinkStatus {
+	if x != nil {
+		return x.NetworkLinks
+	}
+	return nil
+}
+
+// PlatformMetadata describes platform-specific information.
+type MachineStatusSpec_PlatformMetadata struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Platform is the name of the platform (e.g. `aws`, `gcp`, `azure`).
+	Platform string `protobuf:"bytes,1,opt,name=platform,proto3" json:"platform,omitempty"`
+	// Hostname is the hostname of the machine.
+	Hostname string `protobuf:"bytes,2,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	// Region (in the cloud).
+	Region string `protobuf:"bytes,3,opt,name=region,proto3" json:"region,omitempty"`
+	// Availability zone (in the cloud).
+	Zone string `protobuf:"bytes,4,opt,name=zone,proto3" json:"zone,omitempty"`
+	// Instance type (in the cloud).
+	InstanceType string `protobuf:"bytes,5,opt,name=instance_type,json=instanceType,proto3" json:"instance_type,omitempty"`
+	// Instance ID (in the cloud).
+	InstanceId string `protobuf:"bytes,6,opt,name=instance_id,json=instanceId,proto3" json:"instance_id,omitempty"`
+	// Provider ID (for the Node resource).
+	ProviderId string `protobuf:"bytes,7,opt,name=provider_id,json=providerId,proto3" json:"provider_id,omitempty"`
+	// Spot instance flag.
+	Spot bool `protobuf:"varint,8,opt,name=spot,proto3" json:"spot,omitempty"`
+}
+
+func (x *MachineStatusSpec_PlatformMetadata) Reset() {
+	*x = MachineStatusSpec_PlatformMetadata{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[64]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineStatusSpec_PlatformMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineStatusSpec_PlatformMetadata) ProtoMessage() {}
+
+func (x *MachineStatusSpec_PlatformMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[64]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineStatusSpec_PlatformMetadata.ProtoReflect.Descriptor instead.
+func (*MachineStatusSpec_PlatformMetadata) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{1, 2}
+}
+
+func (x *MachineStatusSpec_PlatformMetadata) GetPlatform() string {
+	if x != nil {
+		return x.Platform
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_PlatformMetadata) GetHostname() string {
+	if x != nil {
+		return x.Hostname
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_PlatformMetadata) GetRegion() string {
+	if x != nil {
+		return x.Region
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_PlatformMetadata) GetZone() string {
+	if x != nil {
+		return x.Zone
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_PlatformMetadata) GetInstanceType() string {
+	if x != nil {
+		return x.InstanceType
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_PlatformMetadata) GetInstanceId() string {
+	if x != nil {
+		return x.InstanceId
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_PlatformMetadata) GetProviderId() string {
+	if x != nil {
+		return x.ProviderId
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_PlatformMetadata) GetSpot() bool {
+	if x != nil {
+		return x.Spot
+	}
+	return false
+}
+
+type MachineStatusSpec_Schematic struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Id is the image factory schematic id used for the image generation.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Invalid marks the machine as having extensions installed bypassing image factory.
+	// Which makes it impossible to detect schematic id and manage the image generation
+	// using image factory.
+	Invalid bool `protobuf:"varint,2,opt,name=invalid,proto3" json:"invalid,omitempty"`
+}
+
+func (x *MachineStatusSpec_Schematic) Reset() {
+	*x = MachineStatusSpec_Schematic{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[65]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineStatusSpec_Schematic) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineStatusSpec_Schematic) ProtoMessage() {}
+
+func (x *MachineStatusSpec_Schematic) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[65]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineStatusSpec_Schematic.ProtoReflect.Descriptor instead.
+func (*MachineStatusSpec_Schematic) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{1, 3}
+}
+
+func (x *MachineStatusSpec_Schematic) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_Schematic) GetInvalid() bool {
+	if x != nil {
+		return x.Invalid
+	}
+	return false
+}
+
+// Processor describes machine CPU.
+type MachineStatusSpec_HardwareStatus_Processor struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Number of cores.
+	CoreCount uint32 `protobuf:"varint,1,opt,name=core_count,json=coreCount,proto3" json:"core_count,omitempty"`
+	// Number of threads.
+	ThreadCount uint32 `protobuf:"varint,2,opt,name=thread_count,json=threadCount,proto3" json:"thread_count,omitempty"`
+	// CPU frequency in MHz.
+	Frequency uint32 `protobuf:"varint,3,opt,name=frequency,proto3" json:"frequency,omitempty"`
+	// CPU manufacturer and model.
+	Description string `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`
+	// CPU manufacturer.
+	Manufacturer string `protobuf:"bytes,5,opt,name=manufacturer,proto3" json:"manufacturer,omitempty"`
+}
+
+func (x *MachineStatusSpec_HardwareStatus_Processor) Reset() {
+	*x = MachineStatusSpec_HardwareStatus_Processor{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[67]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineStatusSpec_HardwareStatus_Processor) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineStatusSpec_HardwareStatus_Processor) ProtoMessage() {}
+
+func (x *MachineStatusSpec_HardwareStatus_Processor) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[67]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineStatusSpec_HardwareStatus_Processor.ProtoReflect.Descriptor instead.
+func (*MachineStatusSpec_HardwareStatus_Processor) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{1, 0, 0}
+}
+
+func (x *MachineStatusSpec_HardwareStatus_Processor) GetCoreCount() uint32 {
+	if x != nil {
+		return x.CoreCount
+	}
+	return 0
+}
+
+func (x *MachineStatusSpec_HardwareStatus_Processor) GetThreadCount() uint32 {
+	if x != nil {
+		return x.ThreadCount
+	}
+	return 0
+}
+
+func (x *MachineStatusSpec_HardwareStatus_Processor) GetFrequency() uint32 {
+	if x != nil {
+		return x.Frequency
+	}
+	return 0
+}
+
+func (x *MachineStatusSpec_HardwareStatus_Processor) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_HardwareStatus_Processor) GetManufacturer() string {
+	if x != nil {
+		return x.Manufacturer
+	}
+	return ""
+}
+
+// MemoryModule describes machine memory.
+type MachineStatusSpec_HardwareStatus_MemoryModule struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Size of memory in MB.
+	SizeMb uint32 `protobuf:"varint,1,opt,name=size_mb,json=sizeMb,proto3" json:"size_mb,omitempty"`
+	// Memory manufacturer and model.
+	Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
+}
+
+func (x *MachineStatusSpec_HardwareStatus_MemoryModule) Reset() {
+	*x = MachineStatusSpec_HardwareStatus_MemoryModule{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[68]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineStatusSpec_HardwareStatus_MemoryModule) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineStatusSpec_HardwareStatus_MemoryModule) ProtoMessage() {}
+
+func (x *MachineStatusSpec_HardwareStatus_MemoryModule) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[68]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineStatusSpec_HardwareStatus_MemoryModule.ProtoReflect.Descriptor instead.
+func (*MachineStatusSpec_HardwareStatus_MemoryModule) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{1, 0, 1}
+}
+
+func (x *MachineStatusSpec_HardwareStatus_MemoryModule) GetSizeMb() uint32 {
+	if x != nil {
+		return x.SizeMb
+	}
+	return 0
+}
+
+func (x *MachineStatusSpec_HardwareStatus_MemoryModule) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+// BlockDevice describes a block device.
+type MachineStatusSpec_HardwareStatus_BlockDevice struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Size indicates the disk size in bytes.
+	Size uint64 `protobuf:"varint,1,opt,name=size,proto3" json:"size,omitempty"`
+	// Model idicates the disk model.
+	Model string `protobuf:"bytes,2,opt,name=model,proto3" json:"model,omitempty"`
+	// Linux blockdevice name (e.g. `/dev/sda`).
+	LinuxName string `protobuf:"bytes,3,opt,name=linux_name,json=linuxName,proto3" json:"linux_name,omitempty"`
+	// Name as in `/sys/block/<dev>/device/name`.
+	Name string `protobuf:"bytes,4,opt,name=name,proto3" json:"name,omitempty"`
+	// Serial as in `/sys/block/<dev>/device/serial`.
+	Serial string `protobuf:"bytes,5,opt,name=serial,proto3" json:"serial,omitempty"`
+	// Uuid as in `/sys/block/<dev>/device/uuid`.
+	Uuid string `protobuf:"bytes,7,opt,name=uuid,proto3" json:"uuid,omitempty"`
+	// Wwid as in `/sys/block/<dev>/device/wwid`.
+	Wwid string `protobuf:"bytes,8,opt,name=wwid,proto3" json:"wwid,omitempty"`
+	// Type is a type of the disk: nvme, ssd, hdd, sd card.
+	Type string `protobuf:"bytes,9,opt,name=type,proto3" json:"type,omitempty"`
+	// BusPath is the bus path of the disk.
+	BusPath string `protobuf:"bytes,10,opt,name=bus_path,json=busPath,proto3" json:"bus_path,omitempty"`
+	// SystemDisk is the system disk flag.
+	SystemDisk bool `protobuf:"varint,11,opt,name=system_disk,json=systemDisk,proto3" json:"system_disk,omitempty"`
+}
+
+func (x *MachineStatusSpec_HardwareStatus_BlockDevice) Reset() {
+	*x = MachineStatusSpec_HardwareStatus_BlockDevice{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[69]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineStatusSpec_HardwareStatus_BlockDevice) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineStatusSpec_HardwareStatus_BlockDevice) ProtoMessage() {}
+
+func (x *MachineStatusSpec_HardwareStatus_BlockDevice) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[69]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineStatusSpec_HardwareStatus_BlockDevice.ProtoReflect.Descriptor instead.
+func (*MachineStatusSpec_HardwareStatus_BlockDevice) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{1, 0, 2}
+}
+
+func (x *MachineStatusSpec_HardwareStatus_BlockDevice) GetSize() uint64 {
+	if x != nil {
+		return x.Size
+	}
+	return 0
+}
+
+func (x *MachineStatusSpec_HardwareStatus_BlockDevice) GetModel() string {
+	if x != nil {
+		return x.Model
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_HardwareStatus_BlockDevice) GetLinuxName() string {
+	if x != nil {
+		return x.LinuxName
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_HardwareStatus_BlockDevice) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_HardwareStatus_BlockDevice) GetSerial() string {
+	if x != nil {
+		return x.Serial
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_HardwareStatus_BlockDevice) GetUuid() string {
+	if x != nil {
+		return x.Uuid
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_HardwareStatus_BlockDevice) GetWwid() string {
+	if x != nil {
+		return x.Wwid
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_HardwareStatus_BlockDevice) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_HardwareStatus_BlockDevice) GetBusPath() string {
+	if x != nil {
+		return x.BusPath
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_HardwareStatus_BlockDevice) GetSystemDisk() bool {
+	if x != nil {
+		return x.SystemDisk
+	}
+	return false
+}
+
+// Physical network interfaces.
+type MachineStatusSpec_NetworkStatus_NetworkLinkStatus struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Linux interface name.
+	LinuxName string `protobuf:"bytes,1,opt,name=linux_name,json=linuxName,proto3" json:"linux_name,omitempty"`
+	// MAC address.
+	HardwareAddress string `protobuf:"bytes,2,opt,name=hardware_address,json=hardwareAddress,proto3" json:"hardware_address,omitempty"`
+	// Speed in Mbps.
+	SpeedMbps uint32 `protobuf:"varint,3,opt,name=speed_mbps,json=speedMbps,proto3" json:"speed_mbps,omitempty"`
+	// Link status.
+	LinkUp bool `protobuf:"varint,4,opt,name=link_up,json=linkUp,proto3" json:"link_up,omitempty"`
+	// Hardware description.
+	Description string `protobuf:"bytes,5,opt,name=description,proto3" json:"description,omitempty"`
+}
+
+func (x *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) Reset() {
+	*x = MachineStatusSpec_NetworkStatus_NetworkLinkStatus{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[70]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineStatusSpec_NetworkStatus_NetworkLinkStatus) ProtoMessage() {}
+
+func (x *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[70]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineStatusSpec_NetworkStatus_NetworkLinkStatus.ProtoReflect.Descriptor instead.
+func (*MachineStatusSpec_NetworkStatus_NetworkLinkStatus) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{1, 1, 0}
+}
+
+func (x *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) GetLinuxName() string {
+	if x != nil {
+		return x.LinuxName
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) GetHardwareAddress() string {
+	if x != nil {
+		return x.HardwareAddress
+	}
+	return ""
+}
+
+func (x *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) GetSpeedMbps() uint32 {
+	if x != nil {
+		return x.SpeedMbps
+	}
+	return 0
+}
+
+func (x *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) GetLinkUp() bool {
+	if x != nil {
+		return x.LinkUp
+	}
+	return false
+}
+
+func (x *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+type ClusterSpec_Features struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// EnableWorkloadProxy enables workload proxy.
+	EnableWorkloadProxy bool `protobuf:"varint,1,opt,name=enable_workload_proxy,json=enableWorkloadProxy,proto3" json:"enable_workload_proxy,omitempty"`
+	// DiskEncryption enables disk encryption on all nodes.
+	DiskEncryption bool `protobuf:"varint,2,opt,name=disk_encryption,json=diskEncryption,proto3" json:"disk_encryption,omitempty"`
+}
+
+func (x *ClusterSpec_Features) Reset() {
+	*x = ClusterSpec_Features{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[71]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterSpec_Features) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterSpec_Features) ProtoMessage() {}
+
+func (x *ClusterSpec_Features) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[71]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterSpec_Features.ProtoReflect.Descriptor instead.
+func (*ClusterSpec_Features) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{3, 0}
+}
+
+func (x *ClusterSpec_Features) GetEnableWorkloadProxy() bool {
+	if x != nil {
+		return x.EnableWorkloadProxy
+	}
+	return false
+}
+
+func (x *ClusterSpec_Features) GetDiskEncryption() bool {
+	if x != nil {
+		return x.DiskEncryption
+	}
+	return false
+}
+
+// MachineClass defines the machine class configuration.
+type MachineSetSpec_MachineClass struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Name defines the machine class id to select the machines from.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// MachineCount defines fixed amount of the machines to allocated from the machine class.
+	MachineCount uint32 `protobuf:"varint,2,opt,name=machine_count,json=machineCount,proto3" json:"machine_count,omitempty"`
+	// AllocationType defines special constants for the amount of machines to be allocated.
+	AllocationType MachineSetSpec_MachineClass_AllocationType `protobuf:"varint,3,opt,name=allocation_type,json=allocationType,proto3,enum=specs.MachineSetSpec_MachineClass_AllocationType" json:"allocation_type,omitempty"`
+}
+
+func (x *MachineSetSpec_MachineClass) Reset() {
+	*x = MachineSetSpec_MachineClass{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[72]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineSetSpec_MachineClass) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineSetSpec_MachineClass) ProtoMessage() {}
+
+func (x *MachineSetSpec_MachineClass) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[72]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineSetSpec_MachineClass.ProtoReflect.Descriptor instead.
+func (*MachineSetSpec_MachineClass) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{35, 0}
+}
+
+func (x *MachineSetSpec_MachineClass) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *MachineSetSpec_MachineClass) GetMachineCount() uint32 {
+	if x != nil {
+		return x.MachineCount
+	}
+	return 0
+}
+
+func (x *MachineSetSpec_MachineClass) GetAllocationType() MachineSetSpec_MachineClass_AllocationType {
+	if x != nil {
+		return x.AllocationType
+	}
+	return MachineSetSpec_MachineClass_Static
+}
+
+// BootstrapSpec defines the bootstrap spec for the control plane machine set.
+// It can contain a reference to an etcd backup, which can be used to bootstrap etcd.
+type MachineSetSpec_BootstrapSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// ClusterUuid is the UUID of the cluster to bootstrap. It can be obtained via `omnictl get clusteruuid <cluster-name>`
+	ClusterUuid string `protobuf:"bytes,1,opt,name=cluster_uuid,json=clusterUuid,proto3" json:"cluster_uuid,omitempty"`
+	// Snapshot is the file name of the etcd snapshot to restore from. It follows the format similar to `FFFFFFFFFFFFFFFF.snapshot`.
+	Snapshot string `protobuf:"bytes,2,opt,name=snapshot,proto3" json:"snapshot,omitempty"`
+}
+
+func (x *MachineSetSpec_BootstrapSpec) Reset() {
+	*x = MachineSetSpec_BootstrapSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[73]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineSetSpec_BootstrapSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineSetSpec_BootstrapSpec) ProtoMessage() {}
+
+func (x *MachineSetSpec_BootstrapSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[73]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineSetSpec_BootstrapSpec.ProtoReflect.Descriptor instead.
+func (*MachineSetSpec_BootstrapSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{35, 1}
+}
+
+func (x *MachineSetSpec_BootstrapSpec) GetClusterUuid() string {
+	if x != nil {
+		return x.ClusterUuid
+	}
+	return ""
+}
+
+func (x *MachineSetSpec_BootstrapSpec) GetSnapshot() string {
+	if x != nil {
+		return x.Snapshot
+	}
+	return ""
+}
+
+// RollingUpdateStrategyConfig defines the rolling update strategy configuration.
+type MachineSetSpec_RollingUpdateStrategyConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// MaxParallelism is the maximum number of machines that can be processed in parallel.
+	// When unset or set to 0, it defaults to 1.
+	MaxParallelism uint32 `protobuf:"varint,1,opt,name=max_parallelism,json=maxParallelism,proto3" json:"max_parallelism,omitempty"`
+}
+
+func (x *MachineSetSpec_RollingUpdateStrategyConfig) Reset() {
+	*x = MachineSetSpec_RollingUpdateStrategyConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[74]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineSetSpec_RollingUpdateStrategyConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineSetSpec_RollingUpdateStrategyConfig) ProtoMessage() {}
+
+func (x *MachineSetSpec_RollingUpdateStrategyConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[74]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineSetSpec_RollingUpdateStrategyConfig.ProtoReflect.Descriptor instead.
+func (*MachineSetSpec_RollingUpdateStrategyConfig) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{35, 2}
+}
+
+func (x *MachineSetSpec_RollingUpdateStrategyConfig) GetMaxParallelism() uint32 {
+	if x != nil {
+		return x.MaxParallelism
+	}
+	return 0
+}
+
+// UpdateConfig defines the update configuration.
+type MachineSetSpec_UpdateStrategyConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Rolling is the rolling update configuration.
+	// Used only when the UpdateStrategy is set to Rolling.
+	Rolling *MachineSetSpec_RollingUpdateStrategyConfig `protobuf:"bytes,1,opt,name=rolling,proto3" json:"rolling,omitempty"`
+}
+
+func (x *MachineSetSpec_UpdateStrategyConfig) Reset() {
+	*x = MachineSetSpec_UpdateStrategyConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[75]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MachineSetSpec_UpdateStrategyConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MachineSetSpec_UpdateStrategyConfig) ProtoMessage() {}
+
+func (x *MachineSetSpec_UpdateStrategyConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[75]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MachineSetSpec_UpdateStrategyConfig.ProtoReflect.Descriptor instead.
+func (*MachineSetSpec_UpdateStrategyConfig) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{35, 3}
+}
+
+func (x *MachineSetSpec_UpdateStrategyConfig) GetRolling() *MachineSetSpec_RollingUpdateStrategyConfig {
+	if x != nil {
+		return x.Rolling
+	}
+	return nil
+}
+
+type ControlPlaneStatusSpec_Condition struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Type     ConditionType                             `protobuf:"varint,1,opt,name=type,proto3,enum=specs.ConditionType" json:"type,omitempty"`
+	Reason   string                                    `protobuf:"bytes,2,opt,name=reason,proto3" json:"reason,omitempty"`
+	Status   ControlPlaneStatusSpec_Condition_Status   `protobuf:"varint,3,opt,name=status,proto3,enum=specs.ControlPlaneStatusSpec_Condition_Status" json:"status,omitempty"`
+	Severity ControlPlaneStatusSpec_Condition_Severity `protobuf:"varint,4,opt,name=severity,proto3,enum=specs.ControlPlaneStatusSpec_Condition_Severity" json:"severity,omitempty"`
+}
+
+func (x *ControlPlaneStatusSpec_Condition) Reset() {
+	*x = ControlPlaneStatusSpec_Condition{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[76]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ControlPlaneStatusSpec_Condition) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ControlPlaneStatusSpec_Condition) ProtoMessage() {}
+
+func (x *ControlPlaneStatusSpec_Condition) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[76]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ControlPlaneStatusSpec_Condition.ProtoReflect.Descriptor instead.
+func (*ControlPlaneStatusSpec_Condition) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{41, 0}
+}
+
+func (x *ControlPlaneStatusSpec_Condition) GetType() ConditionType {
+	if x != nil {
+		return x.Type
+	}
+	return ConditionType_UnknownCondition
+}
+
+func (x *ControlPlaneStatusSpec_Condition) GetReason() string {
+	if x != nil {
+		return x.Reason
+	}
+	return ""
+}
+
+func (x *ControlPlaneStatusSpec_Condition) GetStatus() ControlPlaneStatusSpec_Condition_Status {
+	if x != nil {
+		return x.Status
+	}
+	return ControlPlaneStatusSpec_Condition_Unknown
+}
+
+func (x *ControlPlaneStatusSpec_Condition) GetSeverity() ControlPlaneStatusSpec_Condition_Severity {
+	if x != nil {
+		return x.Severity
+	}
+	return ControlPlaneStatusSpec_Condition_Info
+}
+
+type KubernetesStatusSpec_NodeStatus struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Nodename       string `protobuf:"bytes,1,opt,name=nodename,proto3" json:"nodename,omitempty"`
+	KubeletVersion string `protobuf:"bytes,2,opt,name=kubelet_version,json=kubeletVersion,proto3" json:"kubelet_version,omitempty"`
+	Ready          bool   `protobuf:"varint,3,opt,name=ready,proto3" json:"ready,omitempty"`
+}
+
+func (x *KubernetesStatusSpec_NodeStatus) Reset() {
+	*x = KubernetesStatusSpec_NodeStatus{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[77]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubernetesStatusSpec_NodeStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubernetesStatusSpec_NodeStatus) ProtoMessage() {}
+
+func (x *KubernetesStatusSpec_NodeStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[77]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubernetesStatusSpec_NodeStatus.ProtoReflect.Descriptor instead.
+func (*KubernetesStatusSpec_NodeStatus) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{43, 0}
+}
+
+func (x *KubernetesStatusSpec_NodeStatus) GetNodename() string {
+	if x != nil {
+		return x.Nodename
+	}
+	return ""
+}
+
+func (x *KubernetesStatusSpec_NodeStatus) GetKubeletVersion() string {
+	if x != nil {
+		return x.KubeletVersion
+	}
+	return ""
+}
+
+func (x *KubernetesStatusSpec_NodeStatus) GetReady() bool {
+	if x != nil {
+		return x.Ready
+	}
+	return false
+}
+
+type KubernetesStatusSpec_StaticPodStatus struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	App     string `protobuf:"bytes,1,opt,name=app,proto3" json:"app,omitempty"`
+	Version string `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`
+	Ready   bool   `protobuf:"varint,3,opt,name=ready,proto3" json:"ready,omitempty"`
+}
+
+func (x *KubernetesStatusSpec_StaticPodStatus) Reset() {
+	*x = KubernetesStatusSpec_StaticPodStatus{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[78]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubernetesStatusSpec_StaticPodStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubernetesStatusSpec_StaticPodStatus) ProtoMessage() {}
+
+func (x *KubernetesStatusSpec_StaticPodStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[78]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubernetesStatusSpec_StaticPodStatus.ProtoReflect.Descriptor instead.
+func (*KubernetesStatusSpec_StaticPodStatus) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{43, 1}
+}
+
+func (x *KubernetesStatusSpec_StaticPodStatus) GetApp() string {
+	if x != nil {
+		return x.App
+	}
+	return ""
+}
+
+func (x *KubernetesStatusSpec_StaticPodStatus) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *KubernetesStatusSpec_StaticPodStatus) GetReady() bool {
+	if x != nil {
+		return x.Ready
+	}
+	return false
+}
+
+type KubernetesStatusSpec_NodeStaticPods struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Nodename   string                                  `protobuf:"bytes,1,opt,name=nodename,proto3" json:"nodename,omitempty"`
+	StaticPods []*KubernetesStatusSpec_StaticPodStatus `protobuf:"bytes,2,rep,name=static_pods,json=staticPods,proto3" json:"static_pods,omitempty"`
+}
+
+func (x *KubernetesStatusSpec_NodeStaticPods) Reset() {
+	*x = KubernetesStatusSpec_NodeStaticPods{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[79]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubernetesStatusSpec_NodeStaticPods) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubernetesStatusSpec_NodeStaticPods) ProtoMessage() {}
+
+func (x *KubernetesStatusSpec_NodeStaticPods) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[79]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubernetesStatusSpec_NodeStaticPods.ProtoReflect.Descriptor instead.
+func (*KubernetesStatusSpec_NodeStaticPods) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{43, 2}
+}
+
+func (x *KubernetesStatusSpec_NodeStaticPods) GetNodename() string {
+	if x != nil {
+		return x.Nodename
+	}
+	return ""
+}
+
+func (x *KubernetesStatusSpec_NodeStaticPods) GetStaticPods() []*KubernetesStatusSpec_StaticPodStatus {
+	if x != nil {
+		return x.StaticPods
+	}
+	return nil
+}
+
+type KubernetesUsageSpec_Quantity struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Requests float64 `protobuf:"fixed64,1,opt,name=requests,proto3" json:"requests,omitempty"`
+	Limits   float64 `protobuf:"fixed64,2,opt,name=limits,proto3" json:"limits,omitempty"`
+	Capacity float64 `protobuf:"fixed64,3,opt,name=capacity,proto3" json:"capacity,omitempty"`
+}
+
+func (x *KubernetesUsageSpec_Quantity) Reset() {
+	*x = KubernetesUsageSpec_Quantity{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[80]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubernetesUsageSpec_Quantity) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubernetesUsageSpec_Quantity) ProtoMessage() {}
+
+func (x *KubernetesUsageSpec_Quantity) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[80]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubernetesUsageSpec_Quantity.ProtoReflect.Descriptor instead.
+func (*KubernetesUsageSpec_Quantity) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{56, 0}
+}
+
+func (x *KubernetesUsageSpec_Quantity) GetRequests() float64 {
+	if x != nil {
+		return x.Requests
+	}
+	return 0
+}
+
+func (x *KubernetesUsageSpec_Quantity) GetLimits() float64 {
+	if x != nil {
+		return x.Limits
+	}
+	return 0
+}
+
+func (x *KubernetesUsageSpec_Quantity) GetCapacity() float64 {
+	if x != nil {
+		return x.Capacity
+	}
+	return 0
+}
+
+type KubernetesUsageSpec_Pod struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Count    int32 `protobuf:"varint,1,opt,name=count,proto3" json:"count,omitempty"`
+	Capacity int32 `protobuf:"varint,3,opt,name=capacity,proto3" json:"capacity,omitempty"`
+}
+
+func (x *KubernetesUsageSpec_Pod) Reset() {
+	*x = KubernetesUsageSpec_Pod{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[81]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KubernetesUsageSpec_Pod) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KubernetesUsageSpec_Pod) ProtoMessage() {}
+
+func (x *KubernetesUsageSpec_Pod) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[81]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KubernetesUsageSpec_Pod.ProtoReflect.Descriptor instead.
+func (*KubernetesUsageSpec_Pod) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{56, 1}
+}
+
+func (x *KubernetesUsageSpec_Pod) GetCount() int32 {
+	if x != nil {
+		return x.Count
+	}
+	return 0
+}
+
+func (x *KubernetesUsageSpec_Pod) GetCapacity() int32 {
+	if x != nil {
+		return x.Capacity
+	}
+	return 0
+}
+
+type ImagePullRequestSpec_NodeImageList struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Node   string   `protobuf:"bytes,1,opt,name=node,proto3" json:"node,omitempty"`
+	Images []string `protobuf:"bytes,2,rep,name=images,proto3" json:"images,omitempty"`
+}
+
+func (x *ImagePullRequestSpec_NodeImageList) Reset() {
+	*x = ImagePullRequestSpec_NodeImageList{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[82]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ImagePullRequestSpec_NodeImageList) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ImagePullRequestSpec_NodeImageList) ProtoMessage() {}
+
+func (x *ImagePullRequestSpec_NodeImageList) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[82]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ImagePullRequestSpec_NodeImageList.ProtoReflect.Descriptor instead.
+func (*ImagePullRequestSpec_NodeImageList) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{57, 0}
+}
+
+func (x *ImagePullRequestSpec_NodeImageList) GetNode() string {
+	if x != nil {
+		return x.Node
+	}
+	return ""
+}
+
+func (x *ImagePullRequestSpec_NodeImageList) GetImages() []string {
+	if x != nil {
+		return x.Images
+	}
+	return nil
+}
+
+// Info is a merged representation of the extensions manifest and image factory versions response.
+type TalosExtensionsSpec_Info struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name        string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Author      string `protobuf:"bytes,2,opt,name=author,proto3" json:"author,omitempty"`
+	Version     string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+	Description string `protobuf:"bytes,4,opt,name=description,proto3" json:"description,omitempty"`
+	Ref         string `protobuf:"bytes,5,opt,name=ref,proto3" json:"ref,omitempty"`
+	Digest      string `protobuf:"bytes,6,opt,name=digest,proto3" json:"digest,omitempty"`
+}
+
+func (x *TalosExtensionsSpec_Info) Reset() {
+	*x = TalosExtensionsSpec_Info{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_omni_proto_msgTypes[83]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TalosExtensionsSpec_Info) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TalosExtensionsSpec_Info) ProtoMessage() {}
+
+func (x *TalosExtensionsSpec_Info) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_omni_proto_msgTypes[83]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TalosExtensionsSpec_Info.ProtoReflect.Descriptor instead.
+func (*TalosExtensionsSpec_Info) Descriptor() ([]byte, []int) {
+	return file_omni_specs_omni_proto_rawDescGZIP(), []int{60, 0}
+}
+
+func (x *TalosExtensionsSpec_Info) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *TalosExtensionsSpec_Info) GetAuthor() string {
+	if x != nil {
+		return x.Author
+	}
+	return ""
+}
+
+func (x *TalosExtensionsSpec_Info) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *TalosExtensionsSpec_Info) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+func (x *TalosExtensionsSpec_Info) GetRef() string {
+	if x != nil {
+		return x.Ref
+	}
+	return ""
+}
+
+func (x *TalosExtensionsSpec_Info) GetDigest() string {
+	if x != nil {
+		return x.Digest
+	}
+	return ""
+}
+
+var File_omni_specs_omni_proto protoreflect.FileDescriptor
+
+var file_omni_specs_omni_proto_rawDesc = []byte{
+	0x0a, 0x15, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2f, 0x6f, 0x6d, 0x6e,
+	0x69, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x05, 0x73, 0x70, 0x65, 0x63, 0x73, 0x1a, 0x1b,
+	0x74, 0x61, 0x6c, 0x6f, 0x73, 0x2f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2f, 0x6d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d,
+	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x66, 0x0a, 0x0b,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x70, 0x65, 0x63, 0x12, 0x2d, 0x0a, 0x12, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73,
+	0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63,
+	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x4a, 0x04, 0x08, 0x03, 0x10, 0x04, 0x4a, 0x04,
+	0x08, 0x04, 0x10, 0x05, 0x22, 0x86, 0x12, 0x0a, 0x11, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x23, 0x0a, 0x0d, 0x74, 0x61,
+	0x6c, 0x6f, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0c, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x43, 0x0a, 0x08, 0x68, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x27, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x48, 0x61, 0x72, 0x64,
+	0x77, 0x61, 0x72, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x08, 0x68, 0x61, 0x72, 0x64,
+	0x77, 0x61, 0x72, 0x65, 0x12, 0x40, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e,
+	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x07, 0x6e,
+	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x65,
+	0x72, 0x72, 0x6f, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x61, 0x73, 0x74,
+	0x45, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x2d, 0x0a, 0x12, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x11, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x41, 0x64, 0x64,
+	0x72, 0x65, 0x73, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65,
+	0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
+	0x65, 0x64, 0x12, 0x20, 0x0a, 0x0b, 0x6d, 0x61, 0x69, 0x6e, 0x74, 0x65, 0x6e, 0x61, 0x6e, 0x63,
+	0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x6d, 0x61, 0x69, 0x6e, 0x74, 0x65, 0x6e,
+	0x61, 0x6e, 0x63, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x31,
+	0x0a, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1d, 0x2e, 0x73,
+	0x70, 0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x52, 0x6f, 0x6c, 0x65, 0x52, 0x04, 0x72, 0x6f, 0x6c,
+	0x65, 0x12, 0x56, 0x0a, 0x11, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x5f, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x73,
+	0x70, 0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x10, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72,
+	0x6d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x4c, 0x0a, 0x0c, 0x69, 0x6d, 0x61,
+	0x67, 0x65, 0x5f, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x29, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x4c,
+	0x61, 0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0b, 0x69, 0x6d, 0x61, 0x67,
+	0x65, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x12, 0x40, 0x0a, 0x09, 0x73, 0x63, 0x68, 0x65, 0x6d,
+	0x61, 0x74, 0x69, 0x63, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x73, 0x70, 0x65,
+	0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x53, 0x70, 0x65, 0x63, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x74, 0x69, 0x63, 0x52, 0x09,
+	0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x74, 0x69, 0x63, 0x1a, 0xa9, 0x06, 0x0a, 0x0e, 0x48, 0x61,
+	0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x51, 0x0a, 0x0a,
+	0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x31, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x48, 0x61, 0x72, 0x64, 0x77,
+	0x61, 0x72, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x2e, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73,
+	0x73, 0x6f, 0x72, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x73, 0x12,
+	0x5b, 0x0a, 0x0e, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x5f, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65,
+	0x63, 0x2e, 0x48, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x2e, 0x4d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x52, 0x0d, 0x6d,
+	0x65, 0x6d, 0x6f, 0x72, 0x79, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x57, 0x0a, 0x0c,
+	0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x33, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x48, 0x61, 0x72,
+	0x64, 0x77, 0x61, 0x72, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x2e, 0x42, 0x6c, 0x6f, 0x63,
+	0x6b, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x52, 0x0c, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x64, 0x65,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x61, 0x72, 0x63, 0x68, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x61, 0x72, 0x63, 0x68, 0x1a, 0xb1, 0x01, 0x0a, 0x09, 0x50, 0x72,
+	0x6f, 0x63, 0x65, 0x73, 0x73, 0x6f, 0x72, 0x12, 0x1d, 0x0a, 0x0a, 0x63, 0x6f, 0x72, 0x65, 0x5f,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x63, 0x6f, 0x72,
+	0x65, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x74, 0x68, 0x72, 0x65, 0x61, 0x64,
+	0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0b, 0x74, 0x68,
+	0x72, 0x65, 0x61, 0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x66, 0x72, 0x65,
+	0x71, 0x75, 0x65, 0x6e, 0x63, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x66, 0x72,
+	0x65, 0x71, 0x75, 0x65, 0x6e, 0x63, 0x79, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x22, 0x0a, 0x0c, 0x6d, 0x61, 0x6e,
+	0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x65, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0c, 0x6d, 0x61, 0x6e, 0x75, 0x66, 0x61, 0x63, 0x74, 0x75, 0x72, 0x65, 0x72, 0x1a, 0x49, 0x0a,
+	0x0c, 0x4d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x12, 0x17, 0x0a,
+	0x07, 0x73, 0x69, 0x7a, 0x65, 0x5f, 0x6d, 0x62, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x06,
+	0x73, 0x69, 0x7a, 0x65, 0x4d, 0x62, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73,
+	0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0xfa, 0x01, 0x0a, 0x0b, 0x42, 0x6c, 0x6f,
+	0x63, 0x6b, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x69, 0x7a, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x12, 0x14, 0x0a, 0x05,
+	0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x6f, 0x64,
+	0x65, 0x6c, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x69, 0x6e, 0x75, 0x78, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x69, 0x6e, 0x75, 0x78, 0x4e, 0x61, 0x6d,
+	0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x65, 0x72, 0x69, 0x61, 0x6c, 0x12, 0x12, 0x0a,
+	0x04, 0x75, 0x75, 0x69, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x75, 0x75, 0x69,
+	0x64, 0x12, 0x12, 0x0a, 0x04, 0x77, 0x77, 0x69, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x77, 0x77, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x09, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x62, 0x75, 0x73,
+	0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x62, 0x75, 0x73,
+	0x50, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x5f, 0x64,
+	0x69, 0x73, 0x6b, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x73, 0x79, 0x73, 0x74, 0x65,
+	0x6d, 0x44, 0x69, 0x73, 0x6b, 0x1a, 0xad, 0x03, 0x0a, 0x0d, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x6b, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e,
+	0x61, 0x6d, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x6e,
+	0x61, 0x6d, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x65, 0x73,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x65,
+	0x73, 0x12, 0x29, 0x0a, 0x10, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x67, 0x61, 0x74,
+	0x65, 0x77, 0x61, 0x79, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f, 0x64, 0x65, 0x66,
+	0x61, 0x75, 0x6c, 0x74, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x73, 0x12, 0x5d, 0x0a, 0x0d,
+	0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x6c, 0x69, 0x6e, 0x6b, 0x73, 0x18, 0x05, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x4e, 0x65,
+	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x2e, 0x4e, 0x65, 0x74, 0x77,
+	0x6f, 0x72, 0x6b, 0x4c, 0x69, 0x6e, 0x6b, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x0c, 0x6e,
+	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4c, 0x69, 0x6e, 0x6b, 0x73, 0x1a, 0xb7, 0x01, 0x0a, 0x11,
+	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4c, 0x69, 0x6e, 0x6b, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x6c, 0x69, 0x6e, 0x75, 0x78, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6c, 0x69, 0x6e, 0x75, 0x78, 0x4e, 0x61, 0x6d, 0x65,
+	0x12, 0x29, 0x0a, 0x10, 0x68, 0x61, 0x72, 0x64, 0x77, 0x61, 0x72, 0x65, 0x5f, 0x61, 0x64, 0x64,
+	0x72, 0x65, 0x73, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x68, 0x61, 0x72, 0x64,
+	0x77, 0x61, 0x72, 0x65, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x73,
+	0x70, 0x65, 0x65, 0x64, 0x5f, 0x6d, 0x62, 0x70, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x09, 0x73, 0x70, 0x65, 0x65, 0x64, 0x4d, 0x62, 0x70, 0x73, 0x12, 0x17, 0x0a, 0x07, 0x6c, 0x69,
+	0x6e, 0x6b, 0x5f, 0x75, 0x70, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x6c, 0x69, 0x6e,
+	0x6b, 0x55, 0x70, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x1a, 0xf1, 0x01, 0x0a, 0x10, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f,
+	0x72, 0x6d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x6c,
+	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x6c,
+	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x12, 0x1a, 0x0a, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x06, 0x72, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x7a, 0x6f,
+	0x6e, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x7a, 0x6f, 0x6e, 0x65, 0x12, 0x23,
+	0x0a, 0x0d, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x54,
+	0x79, 0x70, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x5f,
+	0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x63, 0x65, 0x49, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
+	0x5f, 0x69, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x70, 0x6f, 0x74, 0x18, 0x08, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x04, 0x73, 0x70, 0x6f, 0x74, 0x1a, 0x35, 0x0a, 0x09, 0x53, 0x63, 0x68,
+	0x65, 0x6d, 0x61, 0x74, 0x69, 0x63, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x69, 0x6e, 0x76, 0x61, 0x6c, 0x69,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x69, 0x6e, 0x76, 0x61, 0x6c, 0x69, 0x64,
+	0x1a, 0x3e, 0x0a, 0x10, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
+	0x22, 0x2f, 0x0a, 0x04, 0x52, 0x6f, 0x6c, 0x65, 0x12, 0x08, 0x0a, 0x04, 0x4e, 0x4f, 0x4e, 0x45,
+	0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x43, 0x4f, 0x4e, 0x54, 0x52, 0x4f, 0x4c, 0x5f, 0x50, 0x4c,
+	0x41, 0x4e, 0x45, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x57, 0x4f, 0x52, 0x4b, 0x45, 0x52, 0x10,
+	0x02, 0x4a, 0x04, 0x08, 0x08, 0x10, 0x09, 0x4a, 0x04, 0x08, 0x0c, 0x10, 0x0d, 0x22, 0x45, 0x0a,
+	0x0f, 0x54, 0x61, 0x6c, 0x6f, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x70, 0x65, 0x63,
+	0x12, 0x0e, 0x0a, 0x02, 0x63, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x63, 0x61,
+	0x12, 0x10, 0x0a, 0x03, 0x63, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x63,
+	0x72, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x03, 0x6b, 0x65, 0x79, 0x22, 0xf6, 0x02, 0x0a, 0x0b, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
+	0x53, 0x70, 0x65, 0x63, 0x12, 0x27, 0x0a, 0x0d, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x5f,
+	0x69, 0x6d, 0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52,
+	0x0c, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x12, 0x2d, 0x0a,
+	0x12, 0x6b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x6b, 0x75, 0x62, 0x65, 0x72,
+	0x6e, 0x65, 0x74, 0x65, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d,
+	0x74, 0x61, 0x6c, 0x6f, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0c, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x12, 0x37, 0x0a, 0x08, 0x66, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x43, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x46, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73,
+	0x52, 0x08, 0x66, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x12, 0x48, 0x0a, 0x14, 0x62, 0x61,
+	0x63, 0x6b, 0x75, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73,
+	0x2e, 0x45, 0x74, 0x63, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x52,
+	0x13, 0x62, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x1a, 0x67, 0x0a, 0x08, 0x46, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73,
+	0x12, 0x32, 0x0a, 0x15, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x6c,
+	0x6f, 0x61, 0x64, 0x5f, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x13, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x50,
+	0x72, 0x6f, 0x78, 0x79, 0x12, 0x27, 0x0a, 0x0f, 0x64, 0x69, 0x73, 0x6b, 0x5f, 0x65, 0x6e, 0x63,
+	0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x64,
+	0x69, 0x73, 0x6b, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x61, 0x0a,
+	0x0e, 0x45, 0x74, 0x63, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x12,
+	0x35, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x08, 0x69, 0x6e,
+	0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
+	0x22, 0x41, 0x0a, 0x18, 0x45, 0x74, 0x63, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x45, 0x6e,
+	0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x70, 0x65, 0x63, 0x12, 0x25, 0x0a, 0x0e,
+	0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x0d, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e,
+	0x4b, 0x65, 0x79, 0x22, 0x2c, 0x0a, 0x10, 0x45, 0x74, 0x63, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x75,
+	0x70, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x22, 0x7b, 0x0a, 0x0e, 0x45, 0x74, 0x63, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x53,
+	0x70, 0x65, 0x63, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61,
+	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74,
+	0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x1a,
+	0x0a, 0x08, 0x73, 0x6e, 0x61, 0x70, 0x73, 0x68, 0x6f, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x73, 0x6e, 0x61, 0x70, 0x73, 0x68, 0x6f, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x69,
+	0x7a, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x22, 0x8c,
+	0x02, 0x0a, 0x0e, 0x42, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x44, 0x61, 0x74, 0x61, 0x53, 0x70, 0x65,
+	0x63, 0x12, 0x35, 0x0a, 0x08, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x08,
+	0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x5f, 0x75, 0x75, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b,
+	0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x55, 0x75, 0x69, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x65,
+	0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x0d, 0x65, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x4b,
+	0x65, 0x79, 0x12, 0x39, 0x0a, 0x19, 0x61, 0x65, 0x73, 0x5f, 0x63, 0x62, 0x63, 0x5f, 0x65, 0x6e,
+	0x63, 0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x16, 0x61, 0x65, 0x73, 0x43, 0x62, 0x63, 0x45, 0x6e, 0x63,
+	0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x3e, 0x0a,
+	0x1b, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x62, 0x6f, 0x78, 0x5f, 0x65, 0x6e, 0x63, 0x72, 0x79,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x19, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x62, 0x6f, 0x78, 0x45, 0x6e, 0x63,
+	0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x22, 0xd7, 0x01,
+	0x0a, 0x14, 0x45, 0x74, 0x63, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x53, 0x33, 0x43, 0x6f,
+	0x6e, 0x66, 0x53, 0x70, 0x65, 0x63, 0x12, 0x16, 0x0a, 0x06, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x12, 0x16,
+	0x0a, 0x06, 0x72, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
+	0x72, 0x65, 0x67, 0x69, 0x6f, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69,
+	0x6e, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69,
+	0x6e, 0x74, 0x12, 0x22, 0x0a, 0x0d, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6b, 0x65, 0x79,
+	0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x61, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x2a, 0x0a, 0x11, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74,
+	0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4b,
+	0x65, 0x79, 0x12, 0x23, 0x0a, 0x0d, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x22, 0xb1, 0x02, 0x0a, 0x14, 0x45, 0x74, 0x63, 0x64,
+	0x42, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63,
+	0x12, 0x3a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x22, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x45, 0x74, 0x63, 0x64, 0x42, 0x61, 0x63,
+	0x6b, 0x75, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x14, 0x0a, 0x05,
+	0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72,
+	0x6f, 0x72, 0x12, 0x44, 0x0a, 0x10, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x62, 0x61, 0x63, 0x6b, 0x75,
+	0x70, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54,
+	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0e, 0x6c, 0x61, 0x73, 0x74, 0x42, 0x61,
+	0x63, 0x6b, 0x75, 0x70, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x4a, 0x0a, 0x13, 0x6c, 0x61, 0x73, 0x74,
+	0x5f, 0x62, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x5f, 0x61, 0x74, 0x74, 0x65, 0x6d, 0x70, 0x74, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
+	0x70, 0x52, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x42, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x41, 0x74, 0x74,
+	0x65, 0x6d, 0x70, 0x74, 0x22, 0x35, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x0b,
+	0x0a, 0x07, 0x55, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x10, 0x00, 0x12, 0x06, 0x0a, 0x02, 0x4f,
+	0x6b, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x10, 0x02, 0x12, 0x0b,
+	0x0a, 0x07, 0x52, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x10, 0x03, 0x22, 0x4f, 0x0a, 0x14, 0x45,
+	0x74, 0x63, 0x64, 0x4d, 0x61, 0x6e, 0x75, 0x61, 0x6c, 0x42, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x53,
+	0x70, 0x65, 0x63, 0x12, 0x37, 0x0a, 0x09, 0x62, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x5f, 0x61, 0x74,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x52, 0x08, 0x62, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x41, 0x74, 0x22, 0x7b, 0x0a, 0x19,
+	0x45, 0x74, 0x63, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x53,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x2d, 0x0a, 0x12, 0x63, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x13, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x22, 0xc8, 0x01, 0x0a, 0x1b, 0x45, 0x74,
+	0x63, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x4f, 0x76, 0x65, 0x72, 0x61, 0x6c, 0x6c, 0x53,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x2d, 0x0a, 0x12, 0x63, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x13, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x49, 0x0a, 0x12, 0x6c, 0x61, 0x73,
+	0x74, 0x5f, 0x62, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x45, 0x74,
+	0x63, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70,
+	0x65, 0x63, 0x52, 0x10, 0x6c, 0x61, 0x73, 0x74, 0x42, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x22, 0x49, 0x0a, 0x12, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x70, 0x65, 0x63, 0x12, 0x2d, 0x0a, 0x12, 0x6b, 0x75,
+	0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x6b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74,
+	0x65, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x02, 0x22,
+	0x3b, 0x0a, 0x1f, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x50, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x53, 0x70,
+	0x65, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x07, 0x70, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x22, 0x68, 0x0a, 0x1e,
+	0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x54, 0x61,
+	0x6c, 0x6f, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x70, 0x65, 0x63, 0x12, 0x23,
+	0x0a, 0x0d, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x56, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x74, 0x69, 0x63,
+	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x63, 0x68, 0x65, 0x6d,
+	0x61, 0x74, 0x69, 0x63, 0x49, 0x64, 0x22, 0x91, 0x01, 0x0a, 0x18, 0x43, 0x6c, 0x75, 0x73, 0x74,
+	0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53,
+	0x70, 0x65, 0x63, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x12, 0x36, 0x0a, 0x17, 0x63, 0x6c, 0x75, 0x73, 0x74,
+	0x65, 0x72, 0x5f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65,
+	0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x29, 0x0a, 0x10, 0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x72,
+	0x72, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x67, 0x65, 0x6e, 0x65, 0x72,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x22, 0x36, 0x0a, 0x20, 0x52, 0x65,
+	0x64, 0x61, 0x63, 0x74, 0x65, 0x64, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x70, 0x65, 0x63, 0x12, 0x12,
+	0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x64, 0x61,
+	0x74, 0x61, 0x22, 0x9e, 0x01, 0x0a, 0x1a, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x53, 0x70, 0x65,
+	0x63, 0x12, 0x23, 0x0a, 0x0d, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69,
+	0x74, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x6e, 0x6f, 0x64, 0x65, 0x49, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x24, 0x0a, 0x0e, 0x65, 0x74, 0x63, 0x64, 0x5f, 0x6d,
+	0x65, 0x6d, 0x62, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0c,
+	0x65, 0x74, 0x63, 0x64, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x08,
+	0x6e, 0x6f, 0x64, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x6e, 0x6f, 0x64, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6e, 0x6f, 0x64, 0x65,
+	0x5f, 0x69, 0x70, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x6e, 0x6f, 0x64, 0x65,
+	0x49, 0x70, 0x73, 0x22, 0xa9, 0x01, 0x0a, 0x1a, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x53, 0x70,
+	0x65, 0x63, 0x12, 0x23, 0x0a, 0x0d, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x5f, 0x69, 0x6d,
+	0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x69, 0x6e, 0x73, 0x74, 0x61,
+	0x6c, 0x6c, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x12, 0x2d, 0x0a, 0x12, 0x6b, 0x75, 0x62, 0x65, 0x72,
+	0x6e, 0x65, 0x74, 0x65, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x11, 0x6b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x56,
+	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6c,
+	0x6c, 0x5f, 0x64, 0x69, 0x73, 0x6b, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x69, 0x6e,
+	0x73, 0x74, 0x61, 0x6c, 0x6c, 0x44, 0x69, 0x73, 0x6b, 0x12, 0x14, 0x0a, 0x05, 0x70, 0x61, 0x74,
+	0x63, 0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x70, 0x61, 0x74, 0x63, 0x68, 0x22,
+	0x8b, 0x04, 0x0a, 0x18, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x14, 0x0a, 0x05,
+	0x72, 0x65, 0x61, 0x64, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x72, 0x65, 0x61,
+	0x64, 0x79, 0x12, 0x3b, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x25, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65,
+	0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70,
+	0x65, 0x63, 0x2e, 0x53, 0x74, 0x61, 0x67, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x67, 0x65, 0x12,
+	0x25, 0x0a, 0x0e, 0x61, 0x70, 0x69, 0x64, 0x5f, 0x61, 0x76, 0x61, 0x69, 0x6c, 0x61, 0x62, 0x6c,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x61, 0x70, 0x69, 0x64, 0x41, 0x76, 0x61,
+	0x69, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x29, 0x0a, 0x11, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x5f, 0x75, 0x70, 0x5f, 0x74, 0x6f, 0x5f, 0x64, 0x61, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x55, 0x70, 0x54, 0x6f, 0x44, 0x61, 0x74,
+	0x65, 0x12, 0x2a, 0x0a, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6c, 0x61,
+	0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x2d, 0x0a,
+	0x12, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x61, 0x64, 0x64, 0x72,
+	0x65, 0x73, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x48, 0x0a, 0x13,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x61, 0x70, 0x70, 0x6c, 0x79, 0x5f, 0x73, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x73, 0x70, 0x65, 0x63,
+	0x73, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x53, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x52, 0x11, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x41, 0x70, 0x70, 0x6c, 0x79,
+	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xa4, 0x01, 0x0a, 0x05, 0x53, 0x74, 0x61, 0x67, 0x65,
+	0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x0b, 0x0a,
+	0x07, 0x42, 0x4f, 0x4f, 0x54, 0x49, 0x4e, 0x47, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x49, 0x4e,
+	0x53, 0x54, 0x41, 0x4c, 0x4c, 0x49, 0x4e, 0x47, 0x10, 0x02, 0x12, 0x0d, 0x0a, 0x09, 0x55, 0x50,
+	0x47, 0x52, 0x41, 0x44, 0x49, 0x4e, 0x47, 0x10, 0x06, 0x12, 0x0f, 0x0a, 0x0b, 0x43, 0x4f, 0x4e,
+	0x46, 0x49, 0x47, 0x55, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x03, 0x12, 0x0b, 0x0a, 0x07, 0x52, 0x55,
+	0x4e, 0x4e, 0x49, 0x4e, 0x47, 0x10, 0x04, 0x12, 0x0d, 0x0a, 0x09, 0x52, 0x45, 0x42, 0x4f, 0x4f,
+	0x54, 0x49, 0x4e, 0x47, 0x10, 0x07, 0x12, 0x11, 0x0a, 0x0d, 0x53, 0x48, 0x55, 0x54, 0x54, 0x49,
+	0x4e, 0x47, 0x5f, 0x44, 0x4f, 0x57, 0x4e, 0x10, 0x08, 0x12, 0x12, 0x0a, 0x0e, 0x42, 0x45, 0x46,
+	0x4f, 0x52, 0x45, 0x5f, 0x44, 0x45, 0x53, 0x54, 0x52, 0x4f, 0x59, 0x10, 0x09, 0x12, 0x0e, 0x0a,
+	0x0a, 0x44, 0x45, 0x53, 0x54, 0x52, 0x4f, 0x59, 0x49, 0x4e, 0x47, 0x10, 0x05, 0x22, 0x76, 0x0a,
+	0x08, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x74,
+	0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x12,
+	0x18, 0x0a, 0x07, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d,
+	0x52, 0x07, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x79, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x63, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x72, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x09, 0x72, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x65, 0x64, 0x22, 0x9e, 0x03, 0x0a, 0x11, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65,
+	0x72, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x1c, 0x0a, 0x09, 0x61,
+	0x76, 0x61, 0x69, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09,
+	0x61, 0x76, 0x61, 0x69, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x2b, 0x0a, 0x08, 0x6d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x73, 0x70,
+	0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x52, 0x08, 0x6d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x34, 0x0a, 0x05, 0x70, 0x68, 0x61, 0x73, 0x65, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1e, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x43, 0x6c,
+	0x75, 0x73, 0x74, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e,
+	0x50, 0x68, 0x61, 0x73, 0x65, 0x52, 0x05, 0x70, 0x68, 0x61, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05,
+	0x72, 0x65, 0x61, 0x64, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x72, 0x65, 0x61,
+	0x64, 0x79, 0x12, 0x2e, 0x0a, 0x12, 0x6b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73,
+	0x41, 0x50, 0x49, 0x52, 0x65, 0x61, 0x64, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12,
+	0x6b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x41, 0x50, 0x49, 0x52, 0x65, 0x61,
+	0x64, 0x79, 0x12, 0x2c, 0x0a, 0x11, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61,
+	0x6e, 0x65, 0x52, 0x65, 0x61, 0x64, 0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x63,
+	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x52, 0x65, 0x61, 0x64, 0x79,
+	0x12, 0x3f, 0x0a, 0x1c, 0x68, 0x61, 0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65,
+	0x64, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x5f, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x73,
+	0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x19, 0x68, 0x61, 0x73, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
+	0x63, 0x74, 0x65, 0x64, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x50, 0x6c, 0x61, 0x6e, 0x65,
+	0x73, 0x22, 0x53, 0x0a, 0x05, 0x50, 0x68, 0x61, 0x73, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e,
+	0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x0e, 0x0a, 0x0a, 0x53, 0x43, 0x41, 0x4c, 0x49,
+	0x4e, 0x47, 0x5f, 0x55, 0x50, 0x10, 0x01, 0x12, 0x10, 0x0a, 0x0c, 0x53, 0x43, 0x41, 0x4c, 0x49,
+	0x4e, 0x47, 0x5f, 0x44, 0x4f, 0x57, 0x4e, 0x10, 0x02, 0x12, 0x0b, 0x0a, 0x07, 0x52, 0x55, 0x4e,
+	0x4e, 0x49, 0x4e, 0x47, 0x10, 0x03, 0x12, 0x0e, 0x0a, 0x0a, 0x44, 0x45, 0x53, 0x54, 0x52, 0x4f,
+	0x59, 0x49, 0x4e, 0x47, 0x10, 0x04, 0x22, 0x21, 0x0a, 0x0b, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65,
+	0x72, 0x55, 0x55, 0x49, 0x44, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x75, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x75, 0x75, 0x69, 0x64, 0x22, 0x34, 0x0a, 0x18, 0x43, 0x6c, 0x75,
+	0x73, 0x74, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x53, 0x70, 0x65, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22,
+	0xe0, 0x02, 0x0a, 0x1e, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70,
+	0x65, 0x63, 0x12, 0x43, 0x0a, 0x1e, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x6d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x76, 0x65, 0x72,
+	0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x1b, 0x63, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x36, 0x0a, 0x17, 0x63, 0x6c, 0x75, 0x73, 0x74,
+	0x65, 0x72, 0x5f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65,
+	0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x41, 0x0a, 0x1d, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x6d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x73, 0x68, 0x61, 0x32, 0x35, 0x36,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x1a, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x68, 0x61, 0x32,
+	0x35, 0x36, 0x12, 0x2a, 0x0a, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x6c,
+	0x61, 0x73, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x23,
+	0x0a, 0x0d, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x56, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x74, 0x69, 0x63,
+	0x5f, 0x69, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x63, 0x68, 0x65, 0x6d,
+	0x61, 0x74, 0x69, 0x63, 0x49, 0x64, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x02, 0x4a, 0x04, 0x08, 0x02,
+	0x10, 0x03, 0x22, 0x40, 0x0a, 0x1a, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x42, 0x6f, 0x6f,
+	0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63,
+	0x12, 0x22, 0x0a, 0x0c, 0x62, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x70, 0x65, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x62, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61,
+	0x70, 0x70, 0x65, 0x64, 0x22, 0x28, 0x0a, 0x12, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x53,
+	0x65, 0x63, 0x72, 0x65, 0x74, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0x8a,
+	0x01, 0x0a, 0x16, 0x4c, 0x6f, 0x61, 0x64, 0x42, 0x61, 0x6c, 0x61, 0x6e, 0x63, 0x65, 0x72, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x70, 0x65, 0x63, 0x12, 0x1b, 0x0a, 0x09, 0x62, 0x69, 0x6e,
+	0x64, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x62, 0x69,
+	0x6e, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x2f, 0x0a, 0x13, 0x73, 0x69, 0x64, 0x65, 0x72, 0x6f,
+	0x6c, 0x69, 0x6e, 0x6b, 0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x12, 0x73, 0x69, 0x64, 0x65, 0x72, 0x6f, 0x6c, 0x69, 0x6e, 0x6b, 0x45,
+	0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f,
+	0x69, 0x6e, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x65, 0x6e, 0x64, 0x70,
+	0x6f, 0x69, 0x6e, 0x74, 0x73, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x02, 0x22, 0x58, 0x0a, 0x16, 0x4c,
+	0x6f, 0x61, 0x64, 0x42, 0x61, 0x6c, 0x61, 0x6e, 0x63, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x79,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x68, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x79, 0x12,
+	0x18, 0x0a, 0x07, 0x73, 0x74, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x07, 0x73, 0x74, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x4a, 0x04, 0x08, 0x01, 0x10, 0x02, 0x4a,
+	0x04, 0x08, 0x02, 0x10, 0x03, 0x22, 0x31, 0x0a, 0x15, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65,
+	0x74, 0x65, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x70, 0x65, 0x63, 0x12, 0x18,
+	0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x72, 0x0a, 0x10, 0x54, 0x61, 0x6c, 0x6f,
+	0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x70, 0x65, 0x63, 0x12, 0x18, 0x0a, 0x07,
+	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76,
+	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x44, 0x0a, 0x1e, 0x63, 0x6f, 0x6d, 0x70, 0x61, 0x74,
+	0x69, 0x62, 0x6c, 0x65, 0x5f, 0x6b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x5f,
+	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x1c,
+	0x63, 0x6f, 0x6d, 0x70, 0x61, 0x74, 0x69, 0x62, 0x6c, 0x65, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e,
+	0x65, 0x74, 0x65, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0xa1, 0x02, 0x0a,
+	0x15, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x65, 0x64,
+	0x69, 0x61, 0x53, 0x70, 0x65, 0x63, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x61, 0x72,
+	0x63, 0x68, 0x69, 0x74, 0x65, 0x63, 0x74, 0x75, 0x72, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0c, 0x61, 0x72, 0x63, 0x68, 0x69, 0x74, 0x65, 0x63, 0x74, 0x75, 0x72, 0x65, 0x12, 0x18,
+	0x0a, 0x07, 0x70, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x07, 0x70, 0x72, 0x6f, 0x66, 0x69, 0x6c, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x63, 0x6f, 0x6e, 0x74,
+	0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63,
+	0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x12, 0x26, 0x0a, 0x0f, 0x73, 0x72,
+	0x63, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x07, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0d, 0x73, 0x72, 0x63, 0x46, 0x69, 0x6c, 0x65, 0x50, 0x72, 0x65, 0x66,
+	0x69, 0x78, 0x12, 0x28, 0x0a, 0x10, 0x64, 0x65, 0x73, 0x74, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x5f,
+	0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x64, 0x65,
+	0x73, 0x74, 0x46, 0x69, 0x6c, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x12, 0x1c, 0x0a, 0x09,
+	0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x09, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x24, 0x0a, 0x0e, 0x6e, 0x6f,
+	0x5f, 0x73, 0x65, 0x63, 0x75, 0x72, 0x65, 0x5f, 0x62, 0x6f, 0x6f, 0x74, 0x18, 0x0b, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x0c, 0x6e, 0x6f, 0x53, 0x65, 0x63, 0x75, 0x72, 0x65, 0x42, 0x6f, 0x6f, 0x74,
+	0x22, 0x25, 0x0a, 0x0f, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x50, 0x61, 0x74, 0x63, 0x68, 0x53,
+	0x70, 0x65, 0x63, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0x81, 0x08, 0x0a, 0x0e, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x53, 0x65, 0x74, 0x53, 0x70, 0x65, 0x63, 0x12, 0x4d, 0x0a, 0x0f, 0x75, 0x70,
+	0x64, 0x61, 0x74, 0x65, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x24, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x53, 0x65, 0x74, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x52, 0x0e, 0x75, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x12, 0x47, 0x0a, 0x0d, 0x6d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x5f, 0x63, 0x6c, 0x61, 0x73, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x22, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x53, 0x65, 0x74, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x43,
+	0x6c, 0x61, 0x73, 0x73, 0x52, 0x0c, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x43, 0x6c, 0x61,
+	0x73, 0x73, 0x12, 0x4a, 0x0a, 0x0e, 0x62, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x5f,
+	0x73, 0x70, 0x65, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x73, 0x70, 0x65,
+	0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x65, 0x74, 0x53, 0x70, 0x65,
+	0x63, 0x2e, 0x42, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x53, 0x70, 0x65, 0x63, 0x52,
+	0x0d, 0x62, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61, 0x70, 0x53, 0x70, 0x65, 0x63, 0x12, 0x4d,
+	0x0a, 0x0f, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67,
+	0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x24, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x65, 0x74, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x52, 0x0e, 0x64,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x12, 0x60, 0x0a,
+	0x16, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79,
+	0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e,
+	0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x65, 0x74,
+	0x53, 0x70, 0x65, 0x63, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x72, 0x61, 0x74,
+	0x65, 0x67, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x14, 0x75, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
+	0x60, 0x0a, 0x16, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65,
+	0x67, 0x79, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x2a, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53,
+	0x65, 0x74, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x72,
+	0x61, 0x74, 0x65, 0x67, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x14, 0x64, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x1a, 0xd0, 0x01, 0x0a, 0x0c, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x43, 0x6c, 0x61,
+	0x73, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0c, 0x6d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x5a, 0x0a, 0x0f, 0x61,
+	0x6c, 0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x31, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x53, 0x65, 0x74, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x2e, 0x41, 0x6c, 0x6c, 0x6f, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x22, 0x2b, 0x0a, 0x0e, 0x41, 0x6c, 0x6c, 0x6f, 0x63,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0a, 0x0a, 0x06, 0x53, 0x74, 0x61,
+	0x74, 0x69, 0x63, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09, 0x55, 0x6e, 0x6c, 0x69, 0x6d, 0x69, 0x74,
+	0x65, 0x64, 0x10, 0x01, 0x1a, 0x4e, 0x0a, 0x0d, 0x42, 0x6f, 0x6f, 0x74, 0x73, 0x74, 0x72, 0x61,
+	0x70, 0x53, 0x70, 0x65, 0x63, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
+	0x5f, 0x75, 0x75, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6c, 0x75,
+	0x73, 0x74, 0x65, 0x72, 0x55, 0x75, 0x69, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x6e, 0x61, 0x70,
+	0x73, 0x68, 0x6f, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x6e, 0x61, 0x70,
+	0x73, 0x68, 0x6f, 0x74, 0x1a, 0x46, 0x0a, 0x1b, 0x52, 0x6f, 0x6c, 0x6c, 0x69, 0x6e, 0x67, 0x55,
+	0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x12, 0x27, 0x0a, 0x0f, 0x6d, 0x61, 0x78, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6c,
+	0x6c, 0x65, 0x6c, 0x69, 0x73, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x6d, 0x61,
+	0x78, 0x50, 0x61, 0x72, 0x61, 0x6c, 0x6c, 0x65, 0x6c, 0x69, 0x73, 0x6d, 0x1a, 0x63, 0x0a, 0x14,
+	0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x4b, 0x0a, 0x07, 0x72, 0x6f, 0x6c, 0x6c, 0x69, 0x6e, 0x67, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x65, 0x74, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x52, 0x6f, 0x6c,
+	0x6c, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65,
+	0x67, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x07, 0x72, 0x6f, 0x6c, 0x6c, 0x69, 0x6e,
+	0x67, 0x22, 0x28, 0x0a, 0x0e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x53, 0x74, 0x72, 0x61, 0x74,
+	0x65, 0x67, 0x79, 0x12, 0x09, 0x0a, 0x05, 0x55, 0x6e, 0x73, 0x65, 0x74, 0x10, 0x00, 0x12, 0x0b,
+	0x0a, 0x07, 0x52, 0x6f, 0x6c, 0x6c, 0x69, 0x6e, 0x67, 0x10, 0x01, 0x22, 0xf4, 0x02, 0x0a, 0x16,
+	0x54, 0x61, 0x6c, 0x6f, 0x73, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x39, 0x0a, 0x05, 0x70, 0x68, 0x61, 0x73, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x23, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x54, 0x61,
+	0x6c, 0x6f, 0x73, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x53, 0x70, 0x65, 0x63, 0x2e, 0x50, 0x68, 0x61, 0x73, 0x65, 0x52, 0x05, 0x70, 0x68, 0x61, 0x73,
+	0x65, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x74, 0x65, 0x70, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x73, 0x74, 0x65, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x73,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x12, 0x30, 0x0a, 0x14, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x75, 0x70, 0x67, 0x72,
+	0x61, 0x64, 0x65, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x12, 0x6c, 0x61, 0x73, 0x74, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x56, 0x65,
+	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x36, 0x0a, 0x17, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74,
+	0x5f, 0x75, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x55,
+	0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x29, 0x0a,
+	0x10, 0x75, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e,
+	0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f, 0x75, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65,
+	0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x48, 0x0a, 0x05, 0x50, 0x68, 0x61, 0x73,
+	0x65, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x10, 0x00, 0x12, 0x0d,
+	0x0a, 0x09, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x69, 0x6e, 0x67, 0x10, 0x01, 0x12, 0x08, 0x0a,
+	0x04, 0x44, 0x6f, 0x6e, 0x65, 0x10, 0x02, 0x12, 0x0a, 0x0a, 0x06, 0x46, 0x61, 0x69, 0x6c, 0x65,
+	0x64, 0x10, 0x03, 0x12, 0x0d, 0x0a, 0x09, 0x52, 0x65, 0x76, 0x65, 0x72, 0x74, 0x69, 0x6e, 0x67,
+	0x10, 0x04, 0x22, 0x87, 0x02, 0x0a, 0x14, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x65,
+	0x74, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x2c, 0x0a, 0x05, 0x70,
+	0x68, 0x61, 0x73, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x16, 0x2e, 0x73, 0x70, 0x65,
+	0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x65, 0x74, 0x50, 0x68, 0x61,
+	0x73, 0x65, 0x52, 0x05, 0x70, 0x68, 0x61, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x72, 0x65, 0x61,
+	0x64, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x72, 0x65, 0x61, 0x64, 0x79, 0x12,
+	0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x2b, 0x0a, 0x08, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65,
+	0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x52, 0x08, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e,
+	0x65, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x68, 0x61, 0x73,
+	0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x48,
+	0x61, 0x73, 0x68, 0x12, 0x47, 0x0a, 0x0d, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x63,
+	0x6c, 0x61, 0x73, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x73, 0x70, 0x65,
+	0x63, 0x73, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x65, 0x74, 0x53, 0x70, 0x65,
+	0x63, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x52, 0x0c,
+	0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x22, 0x14, 0x0a, 0x12,
+	0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x65, 0x74, 0x4e, 0x6f, 0x64, 0x65, 0x53, 0x70,
+	0x65, 0x63, 0x22, 0x13, 0x0a, 0x11, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4c, 0x61, 0x62,
+	0x65, 0x6c, 0x73, 0x53, 0x70, 0x65, 0x63, 0x22, 0x5f, 0x0a, 0x19, 0x4d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x6e, 0x61, 0x70, 0x73, 0x68, 0x6f, 0x74,
+	0x53, 0x70, 0x65, 0x63, 0x12, 0x42, 0x0a, 0x0e, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x6d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x2e, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x52, 0x0d, 0x6d, 0x61, 0x63, 0x68, 0x69,
+	0x6e, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0xa5, 0x03, 0x0a, 0x16, 0x43, 0x6f, 0x6e,
+	0x74, 0x72, 0x6f, 0x6c, 0x50, 0x6c, 0x61, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53,
+	0x70, 0x65, 0x63, 0x12, 0x47, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e,
+	0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x50, 0x6c, 0x61, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0xc1, 0x02, 0x0a,
+	0x09, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x28, 0x0a, 0x04, 0x74, 0x79,
+	0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x14, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73,
+	0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04,
+	0x74, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x72, 0x65, 0x61, 0x73, 0x6f, 0x6e, 0x12, 0x46, 0x0a, 0x06,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2e, 0x2e, 0x73,
+	0x70, 0x65, 0x63, 0x73, 0x2e, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x50, 0x6c, 0x61, 0x6e,
+	0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x43, 0x6f, 0x6e, 0x64,
+	0x69, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x12, 0x4c, 0x0a, 0x08, 0x73, 0x65, 0x76, 0x65, 0x72, 0x69, 0x74, 0x79,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x30, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x43,
+	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x50, 0x6c, 0x61, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x2e,
+	0x53, 0x65, 0x76, 0x65, 0x72, 0x69, 0x74, 0x79, 0x52, 0x08, 0x73, 0x65, 0x76, 0x65, 0x72, 0x69,
+	0x74, 0x79, 0x22, 0x2e, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x0b, 0x0a, 0x07,
+	0x55, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x52, 0x65, 0x61,
+	0x64, 0x79, 0x10, 0x01, 0x12, 0x0c, 0x0a, 0x08, 0x4e, 0x6f, 0x74, 0x52, 0x65, 0x61, 0x64, 0x79,
+	0x10, 0x02, 0x22, 0x2c, 0x0a, 0x08, 0x53, 0x65, 0x76, 0x65, 0x72, 0x69, 0x74, 0x79, 0x12, 0x08,
+	0x0a, 0x04, 0x49, 0x6e, 0x66, 0x6f, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x57, 0x61, 0x72, 0x6e,
+	0x69, 0x6e, 0x67, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x10, 0x02,
+	0x22, 0x48, 0x0a, 0x13, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x45, 0x6e, 0x64, 0x70, 0x6f,
+	0x69, 0x6e, 0x74, 0x53, 0x70, 0x65, 0x63, 0x12, 0x31, 0x0a, 0x14, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x65, 0x73, 0x18,
+	0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x65, 0x73, 0x22, 0xdb, 0x03, 0x0a, 0x14, 0x4b,
+	0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53,
+	0x70, 0x65, 0x63, 0x12, 0x3c, 0x0a, 0x05, 0x6e, 0x6f, 0x64, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x26, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4b, 0x75, 0x62, 0x65, 0x72,
+	0x6e, 0x65, 0x74, 0x65, 0x73, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e,
+	0x4e, 0x6f, 0x64, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x05, 0x6e, 0x6f, 0x64, 0x65,
+	0x73, 0x12, 0x4b, 0x0a, 0x0b, 0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x5f, 0x70, 0x6f, 0x64, 0x73,
+	0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4b,
+	0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53,
+	0x70, 0x65, 0x63, 0x2e, 0x4e, 0x6f, 0x64, 0x65, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x50, 0x6f,
+	0x64, 0x73, 0x52, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x50, 0x6f, 0x64, 0x73, 0x1a, 0x67,
+	0x0a, 0x0a, 0x4e, 0x6f, 0x64, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x1a, 0x0a, 0x08,
+	0x6e, 0x6f, 0x64, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x6e, 0x6f, 0x64, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x6b, 0x75, 0x62, 0x65,
+	0x6c, 0x65, 0x74, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0e, 0x6b, 0x75, 0x62, 0x65, 0x6c, 0x65, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x12, 0x14, 0x0a, 0x05, 0x72, 0x65, 0x61, 0x64, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x05, 0x72, 0x65, 0x61, 0x64, 0x79, 0x1a, 0x53, 0x0a, 0x0f, 0x53, 0x74, 0x61, 0x74, 0x69,
+	0x63, 0x50, 0x6f, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x61, 0x70,
+	0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x61, 0x70, 0x70, 0x12, 0x18, 0x0a, 0x07,
+	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76,
+	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x14, 0x0a, 0x05, 0x72, 0x65, 0x61, 0x64, 0x79, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x72, 0x65, 0x61, 0x64, 0x79, 0x1a, 0x7a, 0x0a, 0x0e,
+	0x4e, 0x6f, 0x64, 0x65, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x50, 0x6f, 0x64, 0x73, 0x12, 0x1a,
+	0x0a, 0x08, 0x6e, 0x6f, 0x64, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x6e, 0x6f, 0x64, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x4c, 0x0a, 0x0b, 0x73, 0x74,
+	0x61, 0x74, 0x69, 0x63, 0x5f, 0x70, 0x6f, 0x64, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x2b, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74,
+	0x65, 0x73, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x53, 0x74, 0x61,
+	0x74, 0x69, 0x63, 0x50, 0x6f, 0x64, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x0a, 0x73, 0x74,
+	0x61, 0x74, 0x69, 0x63, 0x50, 0x6f, 0x64, 0x73, 0x22, 0xfe, 0x02, 0x0a, 0x1b, 0x4b, 0x75, 0x62,
+	0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x3e, 0x0a, 0x05, 0x70, 0x68, 0x61, 0x73,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x28, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e,
+	0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64,
+	0x65, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x50, 0x68, 0x61, 0x73,
+	0x65, 0x52, 0x05, 0x70, 0x68, 0x61, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f,
+	0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x12,
+	0x0a, 0x04, 0x73, 0x74, 0x65, 0x70, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x73, 0x74,
+	0x65, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x30, 0x0a, 0x14, 0x6c, 0x61,
+	0x73, 0x74, 0x5f, 0x75, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x6c, 0x61, 0x73, 0x74, 0x55, 0x70,
+	0x67, 0x72, 0x61, 0x64, 0x65, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x36, 0x0a, 0x17,
+	0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x75, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x5f,
+	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x63,
+	0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x56, 0x65, 0x72,
+	0x73, 0x69, 0x6f, 0x6e, 0x12, 0x29, 0x0a, 0x10, 0x75, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x5f,
+	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0f,
+	0x75, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x22,
+	0x48, 0x0a, 0x05, 0x50, 0x68, 0x61, 0x73, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x6e, 0x6b, 0x6e,
+	0x6f, 0x77, 0x6e, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x69,
+	0x6e, 0x67, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x44, 0x6f, 0x6e, 0x65, 0x10, 0x02, 0x12, 0x0a,
+	0x0a, 0x06, 0x46, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x10, 0x03, 0x12, 0x0d, 0x0a, 0x09, 0x52, 0x65,
+	0x76, 0x65, 0x72, 0x74, 0x69, 0x6e, 0x67, 0x10, 0x04, 0x22, 0x6f, 0x0a, 0x23, 0x4b, 0x75, 0x62,
+	0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x4d, 0x61,
+	0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63,
+	0x12, 0x1e, 0x0a, 0x0b, 0x6f, 0x75, 0x74, 0x5f, 0x6f, 0x66, 0x5f, 0x73, 0x79, 0x6e, 0x63, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x09, 0x6f, 0x75, 0x74, 0x4f, 0x66, 0x53, 0x79, 0x6e, 0x63,
+	0x12, 0x28, 0x0a, 0x10, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x66, 0x61, 0x74, 0x61, 0x6c, 0x5f, 0x65,
+	0x72, 0x72, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x6c, 0x61, 0x73, 0x74,
+	0x46, 0x61, 0x74, 0x61, 0x6c, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x22, 0x29, 0x0a, 0x11, 0x44, 0x65,
+	0x73, 0x74, 0x72, 0x6f, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12,
+	0x14, 0x0a, 0x05, 0x70, 0x68, 0x61, 0x73, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x70, 0x68, 0x61, 0x73, 0x65, 0x22, 0x83, 0x02, 0x0a, 0x0f, 0x4f, 0x6e, 0x67, 0x6f, 0x69, 0x6e,
+	0x67, 0x54, 0x61, 0x73, 0x6b, 0x53, 0x70, 0x65, 0x63, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x69, 0x74,
+	0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x69, 0x74, 0x6c, 0x65, 0x12,
+	0x44, 0x0a, 0x0d, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x5f, 0x75, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x54,
+	0x61, 0x6c, 0x6f, 0x73, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x53, 0x70, 0x65, 0x63, 0x48, 0x00, 0x52, 0x0c, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x55, 0x70,
+	0x67, 0x72, 0x61, 0x64, 0x65, 0x12, 0x53, 0x0a, 0x12, 0x6b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65,
+	0x74, 0x65, 0x73, 0x5f, 0x75, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x22, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e,
+	0x65, 0x74, 0x65, 0x73, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x53, 0x70, 0x65, 0x63, 0x48, 0x00, 0x52, 0x11, 0x6b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65,
+	0x74, 0x65, 0x73, 0x55, 0x70, 0x67, 0x72, 0x61, 0x64, 0x65, 0x12, 0x34, 0x0a, 0x07, 0x64, 0x65,
+	0x73, 0x74, 0x72, 0x6f, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x73, 0x70,
+	0x65, 0x63, 0x73, 0x2e, 0x44, 0x65, 0x73, 0x74, 0x72, 0x6f, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x53, 0x70, 0x65, 0x63, 0x48, 0x00, 0x52, 0x07, 0x64, 0x65, 0x73, 0x74, 0x72, 0x6f, 0x79,
+	0x42, 0x09, 0x0a, 0x07, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x22, 0x35, 0x0a, 0x1f, 0x43,
+	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x45, 0x6e, 0x63,
+	0x72, 0x79, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x4b, 0x65, 0x79, 0x53, 0x70, 0x65, 0x63, 0x12, 0x12,
+	0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x64, 0x61,
+	0x74, 0x61, 0x22, 0x5f, 0x0a, 0x12, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x64, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x53, 0x70, 0x65, 0x63, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x14, 0x0a, 0x05,
+	0x6c, 0x61, 0x62, 0x65, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6c, 0x61, 0x62,
+	0x65, 0x6c, 0x12, 0x1f, 0x0a, 0x0b, 0x69, 0x63, 0x6f, 0x6e, 0x5f, 0x62, 0x61, 0x73, 0x65, 0x36,
+	0x34, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x69, 0x63, 0x6f, 0x6e, 0x42, 0x61, 0x73,
+	0x65, 0x36, 0x34, 0x22, 0x9b, 0x01, 0x0a, 0x12, 0x46, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x70, 0x65, 0x63, 0x12, 0x38, 0x0a, 0x18, 0x65, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x70, 0x72,
+	0x6f, 0x78, 0x79, 0x69, 0x6e, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x16, 0x65, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x57, 0x6f, 0x72, 0x6b, 0x6c, 0x6f, 0x61, 0x64, 0x50, 0x72, 0x6f, 0x78,
+	0x79, 0x69, 0x6e, 0x67, 0x12, 0x4b, 0x0a, 0x14, 0x65, 0x74, 0x63, 0x64, 0x5f, 0x62, 0x61, 0x63,
+	0x6b, 0x75, 0x70, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x19, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x45, 0x74, 0x63, 0x64, 0x42,
+	0x61, 0x63, 0x6b, 0x75, 0x70, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x52, 0x12, 0x65,
+	0x74, 0x63, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67,
+	0x73, 0x22, 0xd6, 0x01, 0x0a, 0x12, 0x45, 0x74, 0x63, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x75, 0x70,
+	0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x3e, 0x0a, 0x0d, 0x74, 0x69, 0x63, 0x6b,
+	0x5f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0c, 0x74, 0x69, 0x63, 0x6b,
+	0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x3c, 0x0a, 0x0c, 0x6d, 0x69, 0x6e, 0x5f,
+	0x69, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x6d, 0x69, 0x6e, 0x49, 0x6e,
+	0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x3c, 0x0a, 0x0c, 0x6d, 0x61, 0x78, 0x5f, 0x69, 0x6e,
+	0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44,
+	0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0b, 0x6d, 0x61, 0x78, 0x49, 0x6e, 0x74, 0x65,
+	0x72, 0x76, 0x61, 0x6c, 0x4a, 0x04, 0x08, 0x04, 0x10, 0x05, 0x22, 0x35, 0x0a, 0x10, 0x4d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x21,
+	0x0a, 0x0c, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x5f, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x18, 0x01,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x0b, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x4c, 0x61, 0x62, 0x65, 0x6c,
+	0x73, 0x22, 0x40, 0x0a, 0x1b, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x47, 0x65, 0x6e, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x53, 0x70, 0x65, 0x63,
+	0x12, 0x21, 0x0a, 0x0c, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x5f, 0x64, 0x69, 0x73, 0x6b,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6c, 0x6c, 0x44,
+	0x69, 0x73, 0x6b, 0x22, 0x3d, 0x0a, 0x13, 0x45, 0x74, 0x63, 0x64, 0x41, 0x75, 0x64, 0x69, 0x74,
+	0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x53, 0x70, 0x65, 0x63, 0x12, 0x26, 0x0a, 0x0f, 0x65, 0x74,
+	0x63, 0x64, 0x5f, 0x6d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x04, 0x52, 0x0d, 0x65, 0x74, 0x63, 0x64, 0x4d, 0x65, 0x6d, 0x62, 0x65, 0x72, 0x49,
+	0x64, 0x73, 0x22, 0x24, 0x0a, 0x0e, 0x4b, 0x75, 0x62, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x53, 0x70, 0x65, 0x63, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0x8b, 0x03, 0x0a, 0x13, 0x4b, 0x75, 0x62,
+	0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x55, 0x73, 0x61, 0x67, 0x65, 0x53, 0x70, 0x65, 0x63,
+	0x12, 0x35, 0x0a, 0x03, 0x63, 0x70, 0x75, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e,
+	0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73,
+	0x55, 0x73, 0x61, 0x67, 0x65, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x51, 0x75, 0x61, 0x6e, 0x74, 0x69,
+	0x74, 0x79, 0x52, 0x03, 0x63, 0x70, 0x75, 0x12, 0x35, 0x0a, 0x03, 0x6d, 0x65, 0x6d, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4b, 0x75, 0x62,
+	0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x55, 0x73, 0x61, 0x67, 0x65, 0x53, 0x70, 0x65, 0x63,
+	0x2e, 0x51, 0x75, 0x61, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x52, 0x03, 0x6d, 0x65, 0x6d, 0x12, 0x3d,
+	0x0a, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x23, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74,
+	0x65, 0x73, 0x55, 0x73, 0x61, 0x67, 0x65, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x51, 0x75, 0x61, 0x6e,
+	0x74, 0x69, 0x74, 0x79, 0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x12, 0x32, 0x0a,
+	0x04, 0x70, 0x6f, 0x64, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x73, 0x70,
+	0x65, 0x63, 0x73, 0x2e, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x55, 0x73,
+	0x61, 0x67, 0x65, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x50, 0x6f, 0x64, 0x52, 0x04, 0x70, 0x6f, 0x64,
+	0x73, 0x1a, 0x5a, 0x0a, 0x08, 0x51, 0x75, 0x61, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x12, 0x1a, 0x0a,
+	0x08, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x01, 0x52,
+	0x08, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x6c, 0x69, 0x6d,
+	0x69, 0x74, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x01, 0x52, 0x06, 0x6c, 0x69, 0x6d, 0x69, 0x74,
+	0x73, 0x12, 0x1a, 0x0a, 0x08, 0x63, 0x61, 0x70, 0x61, 0x63, 0x69, 0x74, 0x79, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x01, 0x52, 0x08, 0x63, 0x61, 0x70, 0x61, 0x63, 0x69, 0x74, 0x79, 0x1a, 0x37, 0x0a,
+	0x03, 0x50, 0x6f, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x05, 0x52, 0x05, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x63, 0x61,
+	0x70, 0x61, 0x63, 0x69, 0x74, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x08, 0x63, 0x61,
+	0x70, 0x61, 0x63, 0x69, 0x74, 0x79, 0x22, 0xa6, 0x01, 0x0a, 0x14, 0x49, 0x6d, 0x61, 0x67, 0x65,
+	0x50, 0x75, 0x6c, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x53, 0x70, 0x65, 0x63, 0x12,
+	0x51, 0x0a, 0x0f, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x69, 0x6d, 0x61, 0x67, 0x65, 0x5f, 0x6c, 0x69,
+	0x73, 0x74, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73,
+	0x2e, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x50, 0x75, 0x6c, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x4e, 0x6f, 0x64, 0x65, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x4c,
+	0x69, 0x73, 0x74, 0x52, 0x0d, 0x6e, 0x6f, 0x64, 0x65, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x4c, 0x69,
+	0x73, 0x74, 0x1a, 0x3b, 0x0a, 0x0d, 0x4e, 0x6f, 0x64, 0x65, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x4c,
+	0x69, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x6e, 0x6f, 0x64, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x69, 0x6d, 0x61, 0x67, 0x65,
+	0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x69, 0x6d, 0x61, 0x67, 0x65, 0x73, 0x22,
+	0x9c, 0x02, 0x0a, 0x13, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x50, 0x75, 0x6c, 0x6c, 0x53, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x2e, 0x0a, 0x13, 0x6c, 0x61, 0x73, 0x74, 0x5f,
+	0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x65, 0x64, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x6c, 0x61, 0x73, 0x74, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73,
+	0x73, 0x65, 0x64, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x30, 0x0a, 0x14, 0x6c, 0x61, 0x73, 0x74, 0x5f,
+	0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x65, 0x64, 0x5f, 0x69, 0x6d, 0x61, 0x67, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x6c, 0x61, 0x73, 0x74, 0x50, 0x72, 0x6f, 0x63, 0x65,
+	0x73, 0x73, 0x65, 0x64, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x12, 0x30, 0x0a, 0x14, 0x6c, 0x61, 0x73,
+	0x74, 0x5f, 0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x65, 0x64, 0x5f, 0x65, 0x72, 0x72, 0x6f,
+	0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x6c, 0x61, 0x73, 0x74, 0x50, 0x72, 0x6f,
+	0x63, 0x65, 0x73, 0x73, 0x65, 0x64, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x27, 0x0a, 0x0f, 0x70,
+	0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x65, 0x64, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x0d, 0x52, 0x0e, 0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x65, 0x64, 0x43,
+	0x6f, 0x75, 0x6e, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f, 0x63, 0x6f,
+	0x75, 0x6e, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x74, 0x6f, 0x74, 0x61, 0x6c,
+	0x43, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e,
+	0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x2f,
+	0x0a, 0x0d, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x74, 0x69, 0x63, 0x53, 0x70, 0x65, 0x63, 0x12,
+	0x1e, 0x0a, 0x0a, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x0a, 0x65, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x22,
+	0xe7, 0x01, 0x0a, 0x13, 0x54, 0x61, 0x6c, 0x6f, 0x73, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69,
+	0x6f, 0x6e, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x35, 0x0a, 0x05, 0x69, 0x74, 0x65, 0x6d, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2e, 0x54,
+	0x61, 0x6c, 0x6f, 0x73, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x53, 0x70,
+	0x65, 0x63, 0x2e, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x05, 0x69, 0x74, 0x65, 0x6d, 0x73, 0x1a, 0x98,
+	0x01, 0x0a, 0x04, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x61,
+	0x75, 0x74, 0x68, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x61, 0x75, 0x74,
+	0x68, 0x6f, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x0a,
+	0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x10, 0x0a, 0x03, 0x72, 0x65, 0x66, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x65,
+	0x66, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x69, 0x67, 0x65, 0x73, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x06, 0x64, 0x69, 0x67, 0x65, 0x73, 0x74, 0x22, 0xc9, 0x01, 0x0a, 0x1a, 0x53, 0x63,
+	0x68, 0x65, 0x6d, 0x61, 0x74, 0x69, 0x63, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x53, 0x70, 0x65, 0x63, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x63, 0x68, 0x65,
+	0x6d, 0x61, 0x74, 0x69, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b,
+	0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x74, 0x69, 0x63, 0x49, 0x64, 0x12, 0x40, 0x0a, 0x06, 0x74,
+	0x61, 0x72, 0x67, 0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x28, 0x2e, 0x73, 0x70,
+	0x65, 0x63, 0x73, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x74, 0x69, 0x63, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x54,
+	0x61, 0x72, 0x67, 0x65, 0x74, 0x52, 0x06, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x22, 0x46, 0x0a,
+	0x06, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x6e, 0x6b, 0x6e, 0x6f,
+	0x77, 0x6e, 0x10, 0x00, 0x12, 0x12, 0x0a, 0x0e, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x4d, 0x61, 0x63, 0x68,
+	0x69, 0x6e, 0x65, 0x53, 0x65, 0x74, 0x10, 0x02, 0x12, 0x0b, 0x0a, 0x07, 0x43, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x10, 0x03, 0x2a, 0x46, 0x0a, 0x11, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x41,
+	0x70, 0x70, 0x6c, 0x79, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e,
+	0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x50, 0x45, 0x4e, 0x44, 0x49,
+	0x4e, 0x47, 0x10, 0x01, 0x12, 0x0b, 0x0a, 0x07, 0x41, 0x50, 0x50, 0x4c, 0x49, 0x45, 0x44, 0x10,
+	0x02, 0x12, 0x0a, 0x0a, 0x06, 0x46, 0x41, 0x49, 0x4c, 0x45, 0x44, 0x10, 0x03, 0x2a, 0x7a, 0x0a,
+	0x0f, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x53, 0x65, 0x74, 0x50, 0x68, 0x61, 0x73, 0x65,
+	0x12, 0x0b, 0x0a, 0x07, 0x55, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x10, 0x00, 0x12, 0x0d, 0x0a,
+	0x09, 0x53, 0x63, 0x61, 0x6c, 0x69, 0x6e, 0x67, 0x55, 0x70, 0x10, 0x01, 0x12, 0x0f, 0x0a, 0x0b,
+	0x53, 0x63, 0x61, 0x6c, 0x69, 0x6e, 0x67, 0x44, 0x6f, 0x77, 0x6e, 0x10, 0x02, 0x12, 0x0b, 0x0a,
+	0x07, 0x52, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x10, 0x03, 0x12, 0x0e, 0x0a, 0x0a, 0x44, 0x65,
+	0x73, 0x74, 0x72, 0x6f, 0x79, 0x69, 0x6e, 0x67, 0x10, 0x04, 0x12, 0x0a, 0x0a, 0x06, 0x46, 0x61,
+	0x69, 0x6c, 0x65, 0x64, 0x10, 0x05, 0x12, 0x11, 0x0a, 0x0d, 0x52, 0x65, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x75, 0x72, 0x69, 0x6e, 0x67, 0x10, 0x06, 0x2a, 0x48, 0x0a, 0x0d, 0x43, 0x6f, 0x6e,
+	0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x10, 0x55, 0x6e,
+	0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x43, 0x6f, 0x6e, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x10, 0x00,
+	0x12, 0x08, 0x0a, 0x04, 0x45, 0x74, 0x63, 0x64, 0x10, 0x01, 0x12, 0x17, 0x0a, 0x13, 0x57, 0x69,
+	0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x10, 0x02, 0x42, 0x32, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
+	0x6d, 0x2f, 0x73, 0x69, 0x64, 0x65, 0x72, 0x6f, 0x6c, 0x61, 0x62, 0x73, 0x2f, 0x6f, 0x6d, 0x6e,
+	0x69, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x6f, 0x6d, 0x6e,
+	0x69, 0x2f, 0x73, 0x70, 0x65, 0x63, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_omni_specs_omni_proto_rawDescOnce sync.Once
+	file_omni_specs_omni_proto_rawDescData = file_omni_specs_omni_proto_rawDesc
+)
+
+func file_omni_specs_omni_proto_rawDescGZIP() []byte {
+	file_omni_specs_omni_proto_rawDescOnce.Do(func() {
+		file_omni_specs_omni_proto_rawDescData = protoimpl.X.CompressGZIP(file_omni_specs_omni_proto_rawDescData)
+	})
+	return file_omni_specs_omni_proto_rawDescData
+}
+
+var file_omni_specs_omni_proto_enumTypes = make([]protoimpl.EnumInfo, 14)
+var file_omni_specs_omni_proto_msgTypes = make([]protoimpl.MessageInfo, 84)
+var file_omni_specs_omni_proto_goTypes = []interface{}{
+	(ConfigApplyStatus)(0),                                    // 0: specs.ConfigApplyStatus
+	(MachineSetPhase)(0),                                      // 1: specs.MachineSetPhase
+	(ConditionType)(0),                                        // 2: specs.ConditionType
+	(MachineStatusSpec_Role)(0),                               // 3: specs.MachineStatusSpec.Role
+	(EtcdBackupStatusSpec_Status)(0),                          // 4: specs.EtcdBackupStatusSpec.Status
+	(ClusterMachineStatusSpec_Stage)(0),                       // 5: specs.ClusterMachineStatusSpec.Stage
+	(ClusterStatusSpec_Phase)(0),                              // 6: specs.ClusterStatusSpec.Phase
+	(MachineSetSpec_UpdateStrategy)(0),                        // 7: specs.MachineSetSpec.UpdateStrategy
+	(MachineSetSpec_MachineClass_AllocationType)(0),           // 8: specs.MachineSetSpec.MachineClass.AllocationType
+	(TalosUpgradeStatusSpec_Phase)(0),                         // 9: specs.TalosUpgradeStatusSpec.Phase
+	(ControlPlaneStatusSpec_Condition_Status)(0),              // 10: specs.ControlPlaneStatusSpec.Condition.Status
+	(ControlPlaneStatusSpec_Condition_Severity)(0),            // 11: specs.ControlPlaneStatusSpec.Condition.Severity
+	(KubernetesUpgradeStatusSpec_Phase)(0),                    // 12: specs.KubernetesUpgradeStatusSpec.Phase
+	(SchematicConfigurationSpec_Target)(0),                    // 13: specs.SchematicConfigurationSpec.Target
+	(*MachineSpec)(nil),                                       // 14: specs.MachineSpec
+	(*MachineStatusSpec)(nil),                                 // 15: specs.MachineStatusSpec
+	(*TalosConfigSpec)(nil),                                   // 16: specs.TalosConfigSpec
+	(*ClusterSpec)(nil),                                       // 17: specs.ClusterSpec
+	(*EtcdBackupConf)(nil),                                    // 18: specs.EtcdBackupConf
+	(*EtcdBackupEncryptionSpec)(nil),                          // 19: specs.EtcdBackupEncryptionSpec
+	(*EtcdBackupHeader)(nil),                                  // 20: specs.EtcdBackupHeader
+	(*EtcdBackupSpec)(nil),                                    // 21: specs.EtcdBackupSpec
+	(*BackupDataSpec)(nil),                                    // 22: specs.BackupDataSpec
+	(*EtcdBackupS3ConfSpec)(nil),                              // 23: specs.EtcdBackupS3ConfSpec
+	(*EtcdBackupStatusSpec)(nil),                              // 24: specs.EtcdBackupStatusSpec
+	(*EtcdManualBackupSpec)(nil),                              // 25: specs.EtcdManualBackupSpec
+	(*EtcdBackupStoreStatusSpec)(nil),                         // 26: specs.EtcdBackupStoreStatusSpec
+	(*EtcdBackupOverallStatusSpec)(nil),                       // 27: specs.EtcdBackupOverallStatusSpec
+	(*ClusterMachineSpec)(nil),                                // 28: specs.ClusterMachineSpec
+	(*ClusterMachineConfigPatchesSpec)(nil),                   // 29: specs.ClusterMachineConfigPatchesSpec
+	(*ClusterMachineTalosVersionSpec)(nil),                    // 30: specs.ClusterMachineTalosVersionSpec
+	(*ClusterMachineConfigSpec)(nil),                          // 31: specs.ClusterMachineConfigSpec
+	(*RedactedClusterMachineConfigSpec)(nil),                  // 32: specs.RedactedClusterMachineConfigSpec
+	(*ClusterMachineIdentitySpec)(nil),                        // 33: specs.ClusterMachineIdentitySpec
+	(*ClusterMachineTemplateSpec)(nil),                        // 34: specs.ClusterMachineTemplateSpec
+	(*ClusterMachineStatusSpec)(nil),                          // 35: specs.ClusterMachineStatusSpec
+	(*Machines)(nil),                                          // 36: specs.Machines
+	(*ClusterStatusSpec)(nil),                                 // 37: specs.ClusterStatusSpec
+	(*ClusterUUID)(nil),                                       // 38: specs.ClusterUUID
+	(*ClusterConfigVersionSpec)(nil),                          // 39: specs.ClusterConfigVersionSpec
+	(*ClusterMachineConfigStatusSpec)(nil),                    // 40: specs.ClusterMachineConfigStatusSpec
+	(*ClusterBootstrapStatusSpec)(nil),                        // 41: specs.ClusterBootstrapStatusSpec
+	(*ClusterSecretsSpec)(nil),                                // 42: specs.ClusterSecretsSpec
+	(*LoadBalancerConfigSpec)(nil),                            // 43: specs.LoadBalancerConfigSpec
+	(*LoadBalancerStatusSpec)(nil),                            // 44: specs.LoadBalancerStatusSpec
+	(*KubernetesVersionSpec)(nil),                             // 45: specs.KubernetesVersionSpec
+	(*TalosVersionSpec)(nil),                                  // 46: specs.TalosVersionSpec
+	(*InstallationMediaSpec)(nil),                             // 47: specs.InstallationMediaSpec
+	(*ConfigPatchSpec)(nil),                                   // 48: specs.ConfigPatchSpec
+	(*MachineSetSpec)(nil),                                    // 49: specs.MachineSetSpec
+	(*TalosUpgradeStatusSpec)(nil),                            // 50: specs.TalosUpgradeStatusSpec
+	(*MachineSetStatusSpec)(nil),                              // 51: specs.MachineSetStatusSpec
+	(*MachineSetNodeSpec)(nil),                                // 52: specs.MachineSetNodeSpec
+	(*MachineLabelsSpec)(nil),                                 // 53: specs.MachineLabelsSpec
+	(*MachineStatusSnapshotSpec)(nil),                         // 54: specs.MachineStatusSnapshotSpec
+	(*ControlPlaneStatusSpec)(nil),                            // 55: specs.ControlPlaneStatusSpec
+	(*ClusterEndpointSpec)(nil),                               // 56: specs.ClusterEndpointSpec
+	(*KubernetesStatusSpec)(nil),                              // 57: specs.KubernetesStatusSpec
+	(*KubernetesUpgradeStatusSpec)(nil),                       // 58: specs.KubernetesUpgradeStatusSpec
+	(*KubernetesUpgradeManifestStatusSpec)(nil),               // 59: specs.KubernetesUpgradeManifestStatusSpec
+	(*DestroyStatusSpec)(nil),                                 // 60: specs.DestroyStatusSpec
+	(*OngoingTaskSpec)(nil),                                   // 61: specs.OngoingTaskSpec
+	(*ClusterMachineEncryptionKeySpec)(nil),                   // 62: specs.ClusterMachineEncryptionKeySpec
+	(*ExposedServiceSpec)(nil),                                // 63: specs.ExposedServiceSpec
+	(*FeaturesConfigSpec)(nil),                                // 64: specs.FeaturesConfigSpec
+	(*EtcdBackupSettings)(nil),                                // 65: specs.EtcdBackupSettings
+	(*MachineClassSpec)(nil),                                  // 66: specs.MachineClassSpec
+	(*MachineConfigGenOptionsSpec)(nil),                       // 67: specs.MachineConfigGenOptionsSpec
+	(*EtcdAuditResultSpec)(nil),                               // 68: specs.EtcdAuditResultSpec
+	(*KubeconfigSpec)(nil),                                    // 69: specs.KubeconfigSpec
+	(*KubernetesUsageSpec)(nil),                               // 70: specs.KubernetesUsageSpec
+	(*ImagePullRequestSpec)(nil),                              // 71: specs.ImagePullRequestSpec
+	(*ImagePullStatusSpec)(nil),                               // 72: specs.ImagePullStatusSpec
+	(*SchematicSpec)(nil),                                     // 73: specs.SchematicSpec
+	(*TalosExtensionsSpec)(nil),                               // 74: specs.TalosExtensionsSpec
+	(*SchematicConfigurationSpec)(nil),                        // 75: specs.SchematicConfigurationSpec
+	(*MachineStatusSpec_HardwareStatus)(nil),                  // 76: specs.MachineStatusSpec.HardwareStatus
+	(*MachineStatusSpec_NetworkStatus)(nil),                   // 77: specs.MachineStatusSpec.NetworkStatus
+	(*MachineStatusSpec_PlatformMetadata)(nil),                // 78: specs.MachineStatusSpec.PlatformMetadata
+	(*MachineStatusSpec_Schematic)(nil),                       // 79: specs.MachineStatusSpec.Schematic
+	nil,                                                       // 80: specs.MachineStatusSpec.ImageLabelsEntry
+	(*MachineStatusSpec_HardwareStatus_Processor)(nil),        // 81: specs.MachineStatusSpec.HardwareStatus.Processor
+	(*MachineStatusSpec_HardwareStatus_MemoryModule)(nil),     // 82: specs.MachineStatusSpec.HardwareStatus.MemoryModule
+	(*MachineStatusSpec_HardwareStatus_BlockDevice)(nil),      // 83: specs.MachineStatusSpec.HardwareStatus.BlockDevice
+	(*MachineStatusSpec_NetworkStatus_NetworkLinkStatus)(nil), // 84: specs.MachineStatusSpec.NetworkStatus.NetworkLinkStatus
+	(*ClusterSpec_Features)(nil),                              // 85: specs.ClusterSpec.Features
+	(*MachineSetSpec_MachineClass)(nil),                       // 86: specs.MachineSetSpec.MachineClass
+	(*MachineSetSpec_BootstrapSpec)(nil),                      // 87: specs.MachineSetSpec.BootstrapSpec
+	(*MachineSetSpec_RollingUpdateStrategyConfig)(nil),        // 88: specs.MachineSetSpec.RollingUpdateStrategyConfig
+	(*MachineSetSpec_UpdateStrategyConfig)(nil),               // 89: specs.MachineSetSpec.UpdateStrategyConfig
+	(*ControlPlaneStatusSpec_Condition)(nil),                  // 90: specs.ControlPlaneStatusSpec.Condition
+	(*KubernetesStatusSpec_NodeStatus)(nil),                   // 91: specs.KubernetesStatusSpec.NodeStatus
+	(*KubernetesStatusSpec_StaticPodStatus)(nil),              // 92: specs.KubernetesStatusSpec.StaticPodStatus
+	(*KubernetesStatusSpec_NodeStaticPods)(nil),               // 93: specs.KubernetesStatusSpec.NodeStaticPods
+	(*KubernetesUsageSpec_Quantity)(nil),                      // 94: specs.KubernetesUsageSpec.Quantity
+	(*KubernetesUsageSpec_Pod)(nil),                           // 95: specs.KubernetesUsageSpec.Pod
+	(*ImagePullRequestSpec_NodeImageList)(nil),                // 96: specs.ImagePullRequestSpec.NodeImageList
+	(*TalosExtensionsSpec_Info)(nil),                          // 97: specs.TalosExtensionsSpec.Info
+	(*durationpb.Duration)(nil),                               // 98: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),                             // 99: google.protobuf.Timestamp
+	(*machine.MachineStatusEvent)(nil),                        // 100: machine.MachineStatusEvent
+}
+var file_omni_specs_omni_proto_depIdxs = []int32{
+	76,  // 0: specs.MachineStatusSpec.hardware:type_name -> specs.MachineStatusSpec.HardwareStatus
+	77,  // 1: specs.MachineStatusSpec.network:type_name -> specs.MachineStatusSpec.NetworkStatus
+	3,   // 2: specs.MachineStatusSpec.role:type_name -> specs.MachineStatusSpec.Role
+	78,  // 3: specs.MachineStatusSpec.platform_metadata:type_name -> specs.MachineStatusSpec.PlatformMetadata
+	80,  // 4: specs.MachineStatusSpec.image_labels:type_name -> specs.MachineStatusSpec.ImageLabelsEntry
+	79,  // 5: specs.MachineStatusSpec.schematic:type_name -> specs.MachineStatusSpec.Schematic
+	85,  // 6: specs.ClusterSpec.features:type_name -> specs.ClusterSpec.Features
+	18,  // 7: specs.ClusterSpec.backup_configuration:type_name -> specs.EtcdBackupConf
+	98,  // 8: specs.EtcdBackupConf.interval:type_name -> google.protobuf.Duration
+	99,  // 9: specs.EtcdBackupSpec.created_at:type_name -> google.protobuf.Timestamp
+	98,  // 10: specs.BackupDataSpec.interval:type_name -> google.protobuf.Duration
+	4,   // 11: specs.EtcdBackupStatusSpec.status:type_name -> specs.EtcdBackupStatusSpec.Status
+	99,  // 12: specs.EtcdBackupStatusSpec.last_backup_time:type_name -> google.protobuf.Timestamp
+	99,  // 13: specs.EtcdBackupStatusSpec.last_backup_attempt:type_name -> google.protobuf.Timestamp
+	99,  // 14: specs.EtcdManualBackupSpec.backup_at:type_name -> google.protobuf.Timestamp
+	24,  // 15: specs.EtcdBackupOverallStatusSpec.last_backup_status:type_name -> specs.EtcdBackupStatusSpec
+	5,   // 16: specs.ClusterMachineStatusSpec.stage:type_name -> specs.ClusterMachineStatusSpec.Stage
+	0,   // 17: specs.ClusterMachineStatusSpec.config_apply_status:type_name -> specs.ConfigApplyStatus
+	36,  // 18: specs.ClusterStatusSpec.machines:type_name -> specs.Machines
+	6,   // 19: specs.ClusterStatusSpec.phase:type_name -> specs.ClusterStatusSpec.Phase
+	7,   // 20: specs.MachineSetSpec.update_strategy:type_name -> specs.MachineSetSpec.UpdateStrategy
+	86,  // 21: specs.MachineSetSpec.machine_class:type_name -> specs.MachineSetSpec.MachineClass
+	87,  // 22: specs.MachineSetSpec.bootstrap_spec:type_name -> specs.MachineSetSpec.BootstrapSpec
+	7,   // 23: specs.MachineSetSpec.delete_strategy:type_name -> specs.MachineSetSpec.UpdateStrategy
+	89,  // 24: specs.MachineSetSpec.update_strategy_config:type_name -> specs.MachineSetSpec.UpdateStrategyConfig
+	89,  // 25: specs.MachineSetSpec.delete_strategy_config:type_name -> specs.MachineSetSpec.UpdateStrategyConfig
+	9,   // 26: specs.TalosUpgradeStatusSpec.phase:type_name -> specs.TalosUpgradeStatusSpec.Phase
+	1,   // 27: specs.MachineSetStatusSpec.phase:type_name -> specs.MachineSetPhase
+	36,  // 28: specs.MachineSetStatusSpec.machines:type_name -> specs.Machines
+	86,  // 29: specs.MachineSetStatusSpec.machine_class:type_name -> specs.MachineSetSpec.MachineClass
+	100, // 30: specs.MachineStatusSnapshotSpec.machine_status:type_name -> machine.MachineStatusEvent
+	90,  // 31: specs.ControlPlaneStatusSpec.conditions:type_name -> specs.ControlPlaneStatusSpec.Condition
+	91,  // 32: specs.KubernetesStatusSpec.nodes:type_name -> specs.KubernetesStatusSpec.NodeStatus
+	93,  // 33: specs.KubernetesStatusSpec.static_pods:type_name -> specs.KubernetesStatusSpec.NodeStaticPods
+	12,  // 34: specs.KubernetesUpgradeStatusSpec.phase:type_name -> specs.KubernetesUpgradeStatusSpec.Phase
+	50,  // 35: specs.OngoingTaskSpec.talos_upgrade:type_name -> specs.TalosUpgradeStatusSpec
+	58,  // 36: specs.OngoingTaskSpec.kubernetes_upgrade:type_name -> specs.KubernetesUpgradeStatusSpec
+	60,  // 37: specs.OngoingTaskSpec.destroy:type_name -> specs.DestroyStatusSpec
+	65,  // 38: specs.FeaturesConfigSpec.etcd_backup_settings:type_name -> specs.EtcdBackupSettings
+	98,  // 39: specs.EtcdBackupSettings.tick_interval:type_name -> google.protobuf.Duration
+	98,  // 40: specs.EtcdBackupSettings.min_interval:type_name -> google.protobuf.Duration
+	98,  // 41: specs.EtcdBackupSettings.max_interval:type_name -> google.protobuf.Duration
+	94,  // 42: specs.KubernetesUsageSpec.cpu:type_name -> specs.KubernetesUsageSpec.Quantity
+	94,  // 43: specs.KubernetesUsageSpec.mem:type_name -> specs.KubernetesUsageSpec.Quantity
+	94,  // 44: specs.KubernetesUsageSpec.storage:type_name -> specs.KubernetesUsageSpec.Quantity
+	95,  // 45: specs.KubernetesUsageSpec.pods:type_name -> specs.KubernetesUsageSpec.Pod
+	96,  // 46: specs.ImagePullRequestSpec.node_image_list:type_name -> specs.ImagePullRequestSpec.NodeImageList
+	97,  // 47: specs.TalosExtensionsSpec.items:type_name -> specs.TalosExtensionsSpec.Info
+	13,  // 48: specs.SchematicConfigurationSpec.target:type_name -> specs.SchematicConfigurationSpec.Target
+	81,  // 49: specs.MachineStatusSpec.HardwareStatus.processors:type_name -> specs.MachineStatusSpec.HardwareStatus.Processor
+	82,  // 50: specs.MachineStatusSpec.HardwareStatus.memory_modules:type_name -> specs.MachineStatusSpec.HardwareStatus.MemoryModule
+	83,  // 51: specs.MachineStatusSpec.HardwareStatus.blockdevices:type_name -> specs.MachineStatusSpec.HardwareStatus.BlockDevice
+	84,  // 52: specs.MachineStatusSpec.NetworkStatus.network_links:type_name -> specs.MachineStatusSpec.NetworkStatus.NetworkLinkStatus
+	8,   // 53: specs.MachineSetSpec.MachineClass.allocation_type:type_name -> specs.MachineSetSpec.MachineClass.AllocationType
+	88,  // 54: specs.MachineSetSpec.UpdateStrategyConfig.rolling:type_name -> specs.MachineSetSpec.RollingUpdateStrategyConfig
+	2,   // 55: specs.ControlPlaneStatusSpec.Condition.type:type_name -> specs.ConditionType
+	10,  // 56: specs.ControlPlaneStatusSpec.Condition.status:type_name -> specs.ControlPlaneStatusSpec.Condition.Status
+	11,  // 57: specs.ControlPlaneStatusSpec.Condition.severity:type_name -> specs.ControlPlaneStatusSpec.Condition.Severity
+	92,  // 58: specs.KubernetesStatusSpec.NodeStaticPods.static_pods:type_name -> specs.KubernetesStatusSpec.StaticPodStatus
+	59,  // [59:59] is the sub-list for method output_type
+	59,  // [59:59] is the sub-list for method input_type
+	59,  // [59:59] is the sub-list for extension type_name
+	59,  // [59:59] is the sub-list for extension extendee
+	0,   // [0:59] is the sub-list for field type_name
+}
+
+func init() { file_omni_specs_omni_proto_init() }
+func file_omni_specs_omni_proto_init() {
+	if File_omni_specs_omni_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_omni_specs_omni_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TalosConfigSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EtcdBackupConf); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EtcdBackupEncryptionSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EtcdBackupHeader); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EtcdBackupSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BackupDataSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EtcdBackupS3ConfSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EtcdBackupStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EtcdManualBackupSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EtcdBackupStoreStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EtcdBackupOverallStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterMachineSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterMachineConfigPatchesSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterMachineTalosVersionSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterMachineConfigSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RedactedClusterMachineConfigSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterMachineIdentitySpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterMachineTemplateSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterMachineStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Machines); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterUUID); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterConfigVersionSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterMachineConfigStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterBootstrapStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterSecretsSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[29].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LoadBalancerConfigSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[30].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LoadBalancerStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[31].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubernetesVersionSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[32].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TalosVersionSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[33].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*InstallationMediaSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[34].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ConfigPatchSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[35].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineSetSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[36].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TalosUpgradeStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[37].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineSetStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[38].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineSetNodeSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[39].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineLabelsSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[40].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineStatusSnapshotSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[41].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ControlPlaneStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[42].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterEndpointSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[43].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubernetesStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[44].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubernetesUpgradeStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[45].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubernetesUpgradeManifestStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[46].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DestroyStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[47].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*OngoingTaskSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[48].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterMachineEncryptionKeySpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[49].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ExposedServiceSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[50].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*FeaturesConfigSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[51].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EtcdBackupSettings); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[52].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineClassSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[53].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineConfigGenOptionsSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[54].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EtcdAuditResultSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[55].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubeconfigSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[56].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubernetesUsageSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[57].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ImagePullRequestSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[58].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ImagePullStatusSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[59].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SchematicSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[60].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TalosExtensionsSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[61].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SchematicConfigurationSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[62].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineStatusSpec_HardwareStatus); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[63].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineStatusSpec_NetworkStatus); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[64].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineStatusSpec_PlatformMetadata); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[65].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineStatusSpec_Schematic); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[67].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineStatusSpec_HardwareStatus_Processor); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[68].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineStatusSpec_HardwareStatus_MemoryModule); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[69].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineStatusSpec_HardwareStatus_BlockDevice); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[70].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineStatusSpec_NetworkStatus_NetworkLinkStatus); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[71].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterSpec_Features); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[72].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineSetSpec_MachineClass); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[73].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineSetSpec_BootstrapSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[74].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineSetSpec_RollingUpdateStrategyConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[75].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MachineSetSpec_UpdateStrategyConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[76].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ControlPlaneStatusSpec_Condition); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[77].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubernetesStatusSpec_NodeStatus); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[78].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubernetesStatusSpec_StaticPodStatus); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[79].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubernetesStatusSpec_NodeStaticPods); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[80].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubernetesUsageSpec_Quantity); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[81].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KubernetesUsageSpec_Pod); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[82].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ImagePullRequestSpec_NodeImageList); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_omni_proto_msgTypes[83].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TalosExtensionsSpec_Info); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_omni_specs_omni_proto_msgTypes[47].OneofWrappers = []interface{}{
+		(*OngoingTaskSpec_TalosUpgrade)(nil),
+		(*OngoingTaskSpec_KubernetesUpgrade)(nil),
+		(*OngoingTaskSpec_Destroy)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_omni_specs_omni_proto_rawDesc,
+			NumEnums:      14,
+			NumMessages:   84,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_omni_specs_omni_proto_goTypes,
+		DependencyIndexes: file_omni_specs_omni_proto_depIdxs,
+		EnumInfos:         file_omni_specs_omni_proto_enumTypes,
+		MessageInfos:      file_omni_specs_omni_proto_msgTypes,
+	}.Build()
+	File_omni_specs_omni_proto = out.File
+	file_omni_specs_omni_proto_rawDesc = nil
+	file_omni_specs_omni_proto_goTypes = nil
+	file_omni_specs_omni_proto_depIdxs = nil
+}
diff --git a/client/api/omni/specs/omni.proto b/client/api/omni/specs/omni.proto
new file mode 100644
index 000000000..9c9b129d8
--- /dev/null
+++ b/client/api/omni/specs/omni.proto
@@ -0,0 +1,933 @@
+syntax = "proto3";
+package specs;
+
+option go_package = "github.com/siderolabs/omni/client/api/omni/specs";
+
+import "talos/machine/machine.proto";
+import "google/protobuf/timestamp.proto";
+import "google/protobuf/duration.proto";
+
+// MachineSpec describes a Machine.
+message MachineSpec {
+  // IP which can be used to access Talos API.
+  string management_address = 1;
+  // Connected is copied from the corresponding Link resource.
+  bool connected = 2;
+  reserved 3;
+  reserved 4;
+}
+
+// MachineStatusSpec describes state of a Machine.
+message MachineStatusSpec {
+  // HardwareStatus describes machine hardware status.
+  message HardwareStatus {
+    // Processor describes machine CPU.
+    message Processor {
+      // Number of cores.
+      uint32 core_count = 1;
+      // Number of threads.
+      uint32 thread_count = 2;
+      // CPU frequency in MHz.
+      uint32 frequency = 3;
+      // CPU manufacturer and model.
+      string description = 4;
+      // CPU manufacturer.
+      string manufacturer = 5;
+    }
+
+    // MemoryModule describes machine memory.
+    message MemoryModule {
+      // Size of memory in MB.
+      uint32 size_mb = 1;
+      // Memory manufacturer and model.
+      string description = 2;
+    }
+
+    // BlockDevice describes a block device.
+    message BlockDevice {
+      // Size indicates the disk size in bytes.
+      uint64 size = 1;
+      // Model idicates the disk model.
+      string model = 2;
+      // Linux blockdevice name (e.g. `/dev/sda`).
+      string linux_name = 3;
+      // Name as in `/sys/block/<dev>/device/name`.
+      string name = 4;
+      // Serial as in `/sys/block/<dev>/device/serial`.
+      string serial = 5;
+      // Uuid as in `/sys/block/<dev>/device/uuid`.
+      string uuid = 7;
+      // Wwid as in `/sys/block/<dev>/device/wwid`.
+      string wwid = 8;
+      // Type is a type of the disk: nvme, ssd, hdd, sd card.
+      string type = 9;
+      // BusPath is the bus path of the disk.
+      string bus_path = 10;
+      // SystemDisk is the system disk flag.
+      bool system_disk = 11;
+    }
+
+    // CPU information.
+    repeated Processor processors = 1;
+    // Memory information.
+    repeated MemoryModule memory_modules = 2;
+    // Blockdevice information.
+    repeated BlockDevice blockdevices = 3;
+    // Machine architecture.
+    string arch = 4;
+  }
+
+  // NetworkStatus describes the status of a machine network .
+  message NetworkStatus {
+    // Physical network interfaces.
+    message NetworkLinkStatus {
+      // Linux interface name.
+      string linux_name = 1;
+      // MAC address.
+      string hardware_address = 2;
+      // Speed in Mbps.
+      uint32 speed_mbps = 3;
+      // Link status.
+      bool link_up = 4;
+      // Hardware description.
+      string description = 5;
+    };
+
+    // Current machine hostname.
+    string hostname = 1;
+    // Current machine domainname.
+    string domainname = 2;
+    // List of machine IPs.
+    repeated string addresses = 3;
+    // List of default gateway IPs.
+    repeated string default_gateways = 4;
+    // List of physical network interfaces.
+    repeated NetworkLinkStatus network_links = 5;
+  }
+
+  // PlatformMetadata describes platform-specific information.
+  message PlatformMetadata {
+    // Platform is the name of the platform (e.g. `aws`, `gcp`, `azure`).
+    string platform = 1;
+    // Hostname is the hostname of the machine.
+    string hostname = 2;
+    // Region (in the cloud).
+    string region = 3;
+    // Availability zone (in the cloud).
+    string zone = 4;
+    // Instance type (in the cloud).
+    string instance_type = 5;
+    // Instance ID (in the cloud).
+    string instance_id = 6;
+    // Provider ID (for the Node resource).
+    string provider_id = 7;
+    // Spot instance flag.
+    bool spot = 8;
+  }
+
+  message Schematic {
+    // Id is the image factory schematic id used for the image generation.
+    string id = 1;
+
+    // Invalid marks the machine as having extensions installed bypassing image factory.
+    // Which makes it impossible to detect schematic id and manage the image generation
+    // using image factory.
+    bool invalid = 2;
+  }
+
+  // Talos version.
+  string talos_version = 1;
+
+  // Hardware-related information.
+  HardwareStatus hardware = 2;
+
+  // Network-related information.
+  NetworkStatus network = 3;
+
+  // Set if the last poll resulted in an error.
+  string last_error = 4;
+
+  // Management address is copied from the machine resource.
+  string management_address = 5;
+
+  // Connected is copied from the corresponding Link resource.
+  bool connected = 6;
+
+  // Maintenance flag means that the node is running in the maintenance mode.
+  bool maintenance = 7;
+
+  reserved 8;
+
+  // Cluster is the name of the cluster the machine belongs to.
+  string cluster = 9;
+
+  enum Role {
+    NONE = 0;
+    CONTROL_PLANE = 1;
+    WORKER = 2;
+  }
+
+  // Role is the role of the machine in the cluster.
+  Role role = 10;
+
+  // Platform-specific information.
+  PlatformMetadata platform_metadata = 11;
+
+  reserved 12;
+
+  map<string, string> image_labels = 13;
+
+  Schematic schematic = 14;
+}
+
+// TalosConfigSpec describes a Talos cluster config.
+message TalosConfigSpec {
+  // Ca certificate authority.
+  string ca = 1;
+
+  // Crt certificate.
+  string crt = 2;
+
+  // Key certificate key.
+  string key = 3;
+}
+
+// Cluster describes a Talos cluster.
+message ClusterSpec {
+  message Features {
+    // EnableWorkloadProxy enables workload proxy.
+    bool enable_workload_proxy = 1;
+    // DiskEncryption enables disk encryption on all nodes.
+    bool disk_encryption = 2;
+  }
+
+  // InstallImage the installer image to use.
+  string install_image = 1 [deprecated = true];
+
+  // KubernetesVersion to use on the node.
+  string kubernetes_version = 2;
+
+  // TalosVersion cluster wide Talos version.
+  string talos_version = 3;
+
+  // Features are the cluster features.
+  Features features = 4;
+
+  // Backup describes the backup configuration. If it set to null that means that backups are disabled for this cluster.
+  EtcdBackupConf backup_configuration = 5;
+}
+
+// EtcdBackupConf describes the backup configuration.
+message EtcdBackupConf {
+  // Interval is the interval between backups. If not set, backups are disabled.
+  google.protobuf.Duration interval = 1;
+  // Enabled etcd backups.
+  bool enabled = 2;
+}
+
+// EtcdBackupEncryptionSpec describes the backup encryption.
+message EtcdBackupEncryptionSpec {
+  bytes encryption_key = 1;
+}
+
+// EtcdBackupHeader describes the backup header.
+message EtcdBackupHeader {
+  // Version is the version of the backup creator.
+  int64 version = 1;
+}
+
+// EtcdBackupSpec describes the backup.
+message EtcdBackupSpec {
+  // CreatedAt is the time when the backup was created.
+  google.protobuf.Timestamp created_at = 1;
+
+  // Snapshot is the snapshot file name.
+  string snapshot = 2;
+
+  // Size specifies the etcd backup size.
+  uint64 size = 3;
+}
+
+// BackupDataSpec describes the data needed for etcd backup.
+message BackupDataSpec {
+  google.protobuf.Duration interval = 1;
+  string cluster_uuid = 2;
+  bytes encryption_key = 3;
+  string aes_cbc_encryption_secret = 4;
+  string secretbox_encryption_secret = 5;
+}
+
+// EtcdBackupS3ConfSpec describes the S3 configuration for the backup process.
+message EtcdBackupS3ConfSpec {
+  string bucket = 1;
+  string region = 2;
+  string endpoint = 3;
+  string access_key_id = 4;
+  string secret_access_key = 5;
+  string session_token = 6;
+}
+
+// EtcdBackupStatus describes cluster last backup status.
+message EtcdBackupStatusSpec {
+  enum Status {
+    Unknown = 0;
+    Ok = 1;
+    Error = 2;
+    Running = 3;
+  }
+
+  // Status is the status of the last backup.
+  Status status = 1;
+
+  // Error is the error message if the backup failed.
+  string error = 2;
+
+  // LastBackupTime is the time of the last backup.
+  google.protobuf.Timestamp last_backup_time = 3;
+
+  // LastBackupAttempt is the time of the last backup attempt.
+  google.protobuf.Timestamp last_backup_attempt = 4;
+}
+
+// EtcdManualBackupSpec describes the manual backup request.
+message EtcdManualBackupSpec {
+  // BackupAt is the time when the backup should be created.
+  google.protobuf.Timestamp backup_at = 1;
+}
+
+// EtcdBackupStoreStatusSpec is internal resource that decribes store configuration name and configuration last error.
+message EtcdBackupStoreStatusSpec {
+  // ConfigurationName is the name of the configuration (disabled|local|s3).
+  string configuration_name = 1;
+
+  // ConfigurationError is the error message if the configuration is invalid.
+  string configuration_error = 2;
+}
+
+// EtcdBackupOverallStatusSpec describes the overall etcd backup system status.
+message EtcdBackupOverallStatusSpec {
+  // ConfigurationName is the name of the configuration (disabled|local|s3).
+  string configuration_name = 1;
+
+  // ConfigurationError is the error message if the configuration is invalid.
+  string configuration_error = 2;
+
+  // LastBackupStatus is the status of the last backup.
+  EtcdBackupStatusSpec last_backup_status = 3;
+}
+
+// ClusterMachineSpec describes a machine attached to a Cluster.
+message ClusterMachineSpec {
+  reserved 1;
+  // KubernetesVersion to use on the machine (copied from Cluster at the moment of creation).
+  string kubernetes_version = 2;
+}
+
+// ClusterMachineConfigPatchesSpec keeps the list of config patches to be applied on the machine.
+message ClusterMachineConfigPatchesSpec {
+  // List of patches combined from all sources, as a final list of patches to apply.
+  repeated string patches = 1;
+}
+
+// ClusterMachineTalosVersionSpec describes a machine Talos version and schematic.
+message ClusterMachineTalosVersionSpec {
+  string talos_version = 1;
+  string schematic_id = 2;
+}
+
+// ClusterMachineConfigSpec stores generated Talos node machine config.
+message ClusterMachineConfigSpec {
+  bytes data = 1;
+  string cluster_machine_version = 2;
+  string generation_error = 3;
+}
+
+// ClusterMachineConfigSpec stores generated Talos node machine config.
+message RedactedClusterMachineConfigSpec {
+  string data = 1;
+}
+
+// ClusterMachineIdentity keeps ClusterMachine related node information.
+message ClusterMachineIdentitySpec {
+  // NodeIdentity is Talos node identity from Identity resource.
+  string node_identity = 1;
+  // EtcdMemberId is the id of the node how it's represented in the etcd quorum.
+  uint64 etcd_member_id = 2;
+  // Nodename is the Kubernetes node name.
+  string nodename = 3;
+  // NodeIps are the IPs of the Kubernetes node.
+  repeated string node_ips = 8;
+}
+
+// ClusterMachineTemplateSpec
+message ClusterMachineTemplateSpec {
+  // InstallImage the installer image to use.
+  string install_image = 1;
+
+  // KubernetesVersion to use on the node.
+  string kubernetes_version = 2;
+
+  // InstallDisk Talos system disk.
+  string install_disk = 3;
+
+  // Patch represents machinery config patch.
+  string patch = 5;
+}
+
+enum ConfigApplyStatus {
+  UNKNOWN = 0;
+  PENDING = 1;
+  APPLIED = 2;
+  FAILED = 3;
+}
+
+// ClusterMachineStatusSpec
+message ClusterMachineStatusSpec {
+  // Ready is true if all services are healthy.
+  bool ready = 1;
+
+  enum Stage {
+    UNKNOWN = 0;
+    BOOTING = 1;
+    INSTALLING = 2;
+    UPGRADING = 6;
+    CONFIGURING = 3;
+    RUNNING = 4;
+    REBOOTING = 7;
+    SHUTTING_DOWN = 8;
+    BEFORE_DESTROY = 9;
+    DESTROYING = 5;
+  }
+
+  Stage stage = 2;
+
+  // ApidAvailable is true if the node is a control plane node and the apid service is healthy.
+  bool apid_available = 3;
+
+  bool config_up_to_date = 4;
+  string last_config_error = 5;
+
+  // Management address is copied from the machine status resource.
+  string management_address = 6;
+
+  ConfigApplyStatus config_apply_status = 7;
+}
+
+// Machines counts the number of machines in a set including health status.
+message Machines {
+  // Total machines currently allocated.
+  uint32 total = 1;
+  // Healthy machines.
+  uint32 healthy = 2;
+  // Connected represents the number of machines in a machine set connected to the wireguard network.
+  uint32 connected = 3;
+  // Requested machines count, same as total for manual allocation, may differ for machine class mode.
+  uint32 requested = 4;
+}
+
+// ClusterStatusSpec aggregates general information about a cluster.
+message ClusterStatusSpec {
+  // Cluster is available when at least one controlplane node has APId up.
+  bool available = 1;
+
+  Machines machines = 2;
+
+  enum Phase {
+    UNKNOWN = 0;
+    SCALING_UP = 1;
+    SCALING_DOWN = 2;
+    RUNNING = 3;
+    DESTROYING = 4;
+  }
+
+  Phase phase = 3;
+
+  bool ready = 4;
+  bool kubernetesAPIReady = 5;
+  bool controlplaneReady = 6;
+  bool has_connected_control_planes = 7;
+}
+
+// ClusterUUID keeps the UUID of the cluster.
+message ClusterUUID {
+  string uuid = 1;
+}
+
+// ClusterConfigVersion keeps the version of Talos which was used for initial config generation.
+message ClusterConfigVersionSpec {
+  string version = 1;
+}
+
+// ClusterMachineConfigStatusSpec machine configuration status spec.
+message ClusterMachineConfigStatusSpec {
+  reserved 1;
+  reserved 2;
+
+  string cluster_machine_config_version = 3;
+  string cluster_machine_version = 4;
+  string cluster_machine_config_sha256 = 5;
+  string last_config_error = 6;
+  string talos_version = 7;
+  string schematic_id = 8;
+}
+
+// ClusterBootstrapStatusSpec keeps track of bootstrap calls for a cluster.
+message ClusterBootstrapStatusSpec {
+  bool bootstrapped = 1;
+}
+
+// ClusterSecretsSpec describes cluster secrets.
+message ClusterSecretsSpec {
+  // Bytes holding serialized cluster secrets.
+  bytes data = 1;
+}
+
+// LoadBalancerConfigSpec describes the configuration of a load balancer.
+message LoadBalancerConfigSpec {
+  reserved 1;
+  string bind_port = 2;
+  // Full URL of the loadbalancer inside Omni environment.
+  string  siderolink_endpoint = 4;
+  // IP adresses of the endpoints
+  repeated string endpoints = 3;
+}
+
+// LoadBalancerStatusSpec reflects the status of a load balancer.
+message LoadBalancerStatusSpec {
+  reserved 1;
+  reserved 2;
+  bool healthy = 3;
+  bool stopped = 4;
+}
+
+// KubernetesVersionSpec represents an available Kubernetes version.
+message KubernetesVersionSpec {
+  string version = 1;
+}
+
+// TalosVersionSpec represents an available Talos version.
+message TalosVersionSpec {
+  string version = 1;
+  repeated string compatible_kubernetes_versions = 2;
+}
+
+// InstallationMediaSpec resource describes a Talos installation media that can be generated by the image factory. It also describes the necessary parameters to be passed to the image factory.
+message InstallationMediaSpec {
+  // Name is the human readable name of the image.
+  string name = 1;
+  string architecture = 2;
+  string profile = 3;
+  string contentType = 6;
+  // SrcFilePrefix defines the src filename to download the image from.
+  string src_file_prefix = 7;
+  // DestFilePrefix defines the dest filename to download the image to.
+  string dest_file_prefix = 8;
+  // Extension defines the dest filename extension.
+  string extension = 9;
+  // NoSecureBoot means that the installation media doesn't support SecureBoot generation.
+  bool no_secure_boot = 11;
+}
+
+// ConfigPatchSpec represents the machine config patch.
+message ConfigPatchSpec {
+  string data = 1;
+}
+
+// MachineSetPhaseSpec is machine set phase.
+enum MachineSetPhase {
+  Unknown = 0;
+  ScalingUp = 1;
+  ScalingDown = 2;
+  Running = 3;
+  Destroying = 4;
+  Failed = 5;
+  Reconfiguring = 6;
+}
+
+// MachineSetSpec describes the cluster machine group.
+message MachineSetSpec {
+  // MachineClass defines the machine class configuration.
+  message MachineClass {
+    enum AllocationType {
+      // Static uses the count defined in the count field.
+      Static = 0;
+      // Unlimited allocates all available machines from the machine class.
+      Unlimited = 1;
+    }
+
+    // Name defines the machine class id to select the machines from.
+    string name = 1;
+    // MachineCount defines fixed amount of the machines to allocated from the machine class.
+    uint32 machine_count = 2;
+    // AllocationType defines special constants for the amount of machines to be allocated.
+    AllocationType allocation_type = 3;
+  }
+
+  // BootstrapSpec defines the bootstrap spec for the control plane machine set.
+  // It can contain a reference to an etcd backup, which can be used to bootstrap etcd.
+  message BootstrapSpec {
+    // ClusterUuid is the UUID of the cluster to bootstrap. It can be obtained via `omnictl get clusteruuid <cluster-name>`
+    string cluster_uuid = 1;
+
+    // Snapshot is the file name of the etcd snapshot to restore from. It follows the format similar to `FFFFFFFFFFFFFFFF.snapshot`.
+    string snapshot = 2;
+  }
+
+  // UpdateStrategy defines the update strategy of the machine set.
+  enum UpdateStrategy {
+    Unset = 0;
+    Rolling = 1;
+  }
+
+  // RollingUpdateStrategyConfig defines the rolling update strategy configuration.
+  message RollingUpdateStrategyConfig {
+    // MaxParallelism is the maximum number of machines that can be processed in parallel.
+    // When unset or set to 0, it defaults to 1.
+    uint32 max_parallelism = 1;
+  }
+
+  // UpdateConfig defines the update configuration.
+  message UpdateStrategyConfig {
+    // Rolling is the rolling update configuration.
+    // Used only when the UpdateStrategy is set to Rolling.
+    RollingUpdateStrategyConfig rolling = 1;
+  }
+
+  // UpdateStrategy is the update strategy of the machine set.
+  UpdateStrategy update_strategy = 1;
+
+  // MachineClass is the machine class to pick machines from for the machine set.
+  MachineClass machine_class = 2;
+
+  // BootstrapSpec defines the bootstrapping spec of the machine set.
+  // This field is immutable, only valid for the control plane machine set and used only once at the creation time.
+  // When set, the machine set won't be created from scratch, instead, it will be bootstrapped using the given spec.
+  BootstrapSpec bootstrap_spec = 3;
+
+  // DeleteStrategy defines the delete strategy of the machine set.
+  UpdateStrategy delete_strategy = 4;
+
+  // UpdateStrategyConfig defines the update strategy configuration.
+  UpdateStrategyConfig update_strategy_config = 5;
+
+  // DeleteStrategyConfig defines the delete strategy configuration.
+  UpdateStrategyConfig delete_strategy_config = 6;
+}
+
+// TalosUpgradeStatusSpec contains the status of the Talos upgrade process.
+message TalosUpgradeStatusSpec {
+  enum Phase {
+    Unknown = 0;
+    Upgrading = 1;
+    Done = 2;
+    Failed = 3;
+    Reverting = 4;
+  }
+
+  // Current upgrade phase.
+  Phase phase = 1;
+
+  // If phase is Failed, this contains the error message.
+  string error = 2;
+
+  // If phase is Upgrading, this contains the current upgrade step.
+  string step = 3;
+
+  // If phase is Upgrading, this contains the current upgrade step progress.
+  string status = 4;
+
+  // Last successful upgrade version.
+  string last_upgrade_version = 5;
+
+  // Current version of the upgrade (if phase == Upgrading).
+  string current_upgrade_version = 6;
+
+  // List of versions available for upgrade.
+  repeated string upgrade_versions = 7;
+}
+
+// MachineSetStatusSpec describes machine set status.
+message MachineSetStatusSpec {
+  MachineSetPhase phase = 1;
+  bool ready = 2;
+  string error = 3;
+  Machines machines = 4;
+  // config_hash is the combined hash of all cluster machines which are part of the machine set.
+  string config_hash = 5;
+  // MachineClass is copied from the input MachineSet resource.
+  MachineSetSpec.MachineClass machine_class = 6;
+}
+
+// MachineSetNodeSpec is a binding between ClusterMachine and MachineSet.
+message MachineSetNodeSpec {}
+
+// MachineLabelsSpec is the resource that adds user defined labels to the MachineStatus.
+message MachineLabelsSpec {}
+
+// MachineStatusSnapshotSpec describes latest known status of MachineStatus Talos resource.
+message MachineStatusSnapshotSpec {
+  machine.MachineStatusEvent machine_status = 1;
+}
+
+enum ConditionType {
+  UnknownCondition = 0;
+  Etcd = 1;
+  WireguardConnection = 2;
+}
+
+// ControlPlaneStatusSpec contains the status of the MachineSets which manage control plane nodes.
+message ControlPlaneStatusSpec {
+  message Condition {
+    enum Status {
+      Unknown = 0;
+      Ready = 1;
+      NotReady = 2;
+    }
+
+    enum Severity {
+      Info = 0;
+      Warning = 1;
+      Error = 2;
+    }
+
+    ConditionType type = 1;
+    string reason = 2;
+    Status status = 3;
+    Severity severity = 4;
+  }
+
+  repeated Condition conditions = 1;
+}
+
+// ClusterEndpointSpec contains a list of SideroLink (management) control plane endpoints.
+message ClusterEndpointSpec {
+  // List of SideroLink addresses for control plane nodes.
+  repeated string management_addresses = 1;
+}
+
+// KubernetesStatusSpec contains the status of the Kubernetes critical resources in the cluster.
+message KubernetesStatusSpec {
+  message NodeStatus {
+    string nodename = 1;
+    string kubelet_version = 2;
+    bool ready = 3;
+  }
+
+  // status of each node, sorted by nodename
+  repeated NodeStatus nodes = 1;
+
+  message StaticPodStatus {
+    string app = 1;
+    string version = 2;
+    bool ready = 3;
+  }
+
+  message NodeStaticPods {
+    string nodename = 1;
+    repeated StaticPodStatus static_pods = 2;
+  }
+
+  // status of each static pod on each node, sorted by nodename, then by pod's app
+  repeated NodeStaticPods static_pods = 2;
+}
+
+// KubernetesUpgradeStatus spec contains the status of the Kubernetes upgrade process.
+message KubernetesUpgradeStatusSpec {
+  enum Phase {
+    Unknown = 0;
+    Upgrading = 1;
+    Done = 2;
+    Failed = 3;
+    Reverting = 4;
+  }
+
+  // Current upgrade phase.
+  Phase phase = 1;
+
+  // If phase is Failed, this contains the error message.
+  string error = 2;
+
+  // If phase is Upgrading, this contains the current upgrade step.
+  string step = 3;
+
+  // If phase is Upgrading, this contains the current upgrade step progress.
+  string status = 4;
+
+  // Last successful upgrade version.
+  string last_upgrade_version = 5;
+
+  // Current version of the upgrade (if phase == Upgrading).
+  string current_upgrade_version = 7;
+
+  // List of versions available for upgrade.
+  repeated string upgrade_versions = 6;
+}
+
+// KubernetesUpgradeManifestStatus contains status of Kubernetes upgrade manifest sync.
+message KubernetesUpgradeManifestStatusSpec {
+  // Number of manifests out of sync.
+  int32 out_of_sync = 1;
+  // Last fatal error encountered (which prevented the sync).
+  string last_fatal_error = 2;
+}
+
+// DestroyStatusSpec describes the state of resource destroy.
+message DestroyStatusSpec {
+  // Phase describes the current destroy phase.
+  string phase = 1;
+}
+
+// OngoingTaskSpec describes any ongoing tasks.
+message OngoingTaskSpec {
+  // Title of the ongoing task.
+  string title = 1;
+
+  // Details contains the detailed task description.
+  oneof details {
+    TalosUpgradeStatusSpec talos_upgrade = 2;
+    KubernetesUpgradeStatusSpec kubernetes_upgrade = 3;
+    DestroyStatusSpec destroy = 4;
+  }
+}
+
+// ClusterMachineEncryptionKeySpec keeps generated encryption key for the machine disk encryption.
+message ClusterMachineEncryptionKeySpec {
+  // Data stores generated encryption key for the machine.
+  bytes data = 1;
+}
+
+// ExposedServiceSpec describes a Kubernetes service exposed through Omni from a workload cluster.
+message ExposedServiceSpec {
+  // Port is the host port the service is exposed on.
+  uint32 port = 1;
+
+  // Label is the human-readable label of the service to be displayed on Omni Web.
+  string label = 2;
+
+  // IconBase64 is the icon of the service to be displayed on Omni Web.
+  string icon_base64 = 3;
+}
+
+message FeaturesConfigSpec {
+  // EnableWorkloadProxying enables workload proxying feature.
+  bool enable_workload_proxying = 1;
+
+  // EtcdBackupSettings represents omni etcd backup settings.
+  EtcdBackupSettings etcd_backup_settings = 2;
+}
+
+message EtcdBackupSettings {
+  // TickInterval is the interval between checking for backups in controller.
+  google.protobuf.Duration tick_interval = 1;
+
+  // MinInterval is the minimum interval between backups.
+  google.protobuf.Duration min_interval = 2;
+
+  // MaxInterval is the maximum interval between backups.
+  google.protobuf.Duration max_interval = 3;
+
+  reserved 4;
+}
+
+// MachineClassSpec describes an Omni MachineClass resource spec.
+message MachineClassSpec {
+  // MatchLabels is the list of labels to match the machine to make it part of the machine class.
+  repeated string match_labels = 1;
+}
+
+// MachineConfigGenOptionsSpec describes machine related config generation inputs.
+message MachineConfigGenOptionsSpec {
+  string install_disk = 1;
+}
+
+// EtcdAuditResult is updated when the etcd audit removes a member.
+//
+// This resource is used to re-trigger the controlplane status checks when etcd audit removes a member.
+message EtcdAuditResultSpec {
+  // EtcdMemberIds contains the list of ids of the members that were last removed.
+  // The list is always sorted.
+  repeated uint64 etcd_member_ids = 1;
+}
+
+// KubeconfigSpec describes a Kubernetes client configuraiton for a cluster.
+message KubeconfigSpec {
+  // Marshalled kubeconfig.
+  bytes data = 1;
+}
+
+// KubernetesUsageSpec represents kubernetes resource usage for a cluster.
+message KubernetesUsageSpec {
+  message Quantity {
+    double requests = 1;
+    double limits = 2;
+    double capacity = 3;
+  }
+
+  message Pod {
+    int32 count = 1;
+    int32 capacity = 3;
+  }
+
+  Quantity cpu = 1;
+  Quantity mem = 2;
+  Quantity storage = 3;
+  Pod pods = 4;
+}
+
+// ImagePullRequestSpec describes an Omni ImagePullRequest resource spec.
+message ImagePullRequestSpec {
+  message NodeImageList {
+    string node = 1;
+    repeated string images = 2;
+  }
+
+  // NodeImageList are the images to be pulled into the node.
+  repeated NodeImageList node_image_list = 1;
+}
+
+// ImagePullStatusSpec describes an Omni ImagePullStatus resource spec.
+message ImagePullStatusSpec {
+  string last_processed_node = 1;
+  string last_processed_image = 2;
+  string last_processed_error = 3;
+  uint32 processed_count = 4;
+  uint32 total_count = 5;
+
+  // RequestVersion is the version of the ImagePullRequest that this status is for.
+  string request_version = 6;
+}
+
+// SchematicSpec keeps all schematics generated by Omni.
+// For each schematic it keeps information about the list of extensions.
+message SchematicSpec {
+  repeated string extensions = 1;
+}
+
+// TalosExtensionsSpec represents all available extensions for a particular Talos version.
+message TalosExtensionsSpec {
+  // Info is a merged representation of the extensions manifest and image factory versions response.
+  message Info {
+    string name = 1;
+    string author = 2;
+    string version = 3;
+    string description = 4;
+    string ref = 5;
+    string digest = 6;
+  }
+
+  repeated Info items = 1;
+}
+
+// SchematicConfigurationSpec is the desired Image Factory schematic for a machine, machine set or a cluster.
+message SchematicConfigurationSpec {
+  enum Target {
+    Unknown = 0;
+    ClusterMachine = 1;
+    MachineSet = 2;
+    Cluster = 3;
+  }
+
+  string schematic_id = 1;
+
+  Target target = 2;
+}
\ No newline at end of file
diff --git a/client/api/omni/specs/omni_vtproto.pb.go b/client/api/omni/specs/omni_vtproto.pb.go
new file mode 100644
index 000000000..60df3acca
--- /dev/null
+++ b/client/api/omni/specs/omni_vtproto.pb.go
@@ -0,0 +1,22572 @@
+// Code generated by protoc-gen-go-vtproto. DO NOT EDIT.
+// protoc-gen-go-vtproto version: v0.6.0
+// source: omni/specs/omni.proto
+
+package specs
+
+import (
+	binary "encoding/binary"
+	fmt "fmt"
+	io "io"
+	math "math"
+
+	protohelpers "github.com/planetscale/vtprotobuf/protohelpers"
+	durationpb1 "github.com/planetscale/vtprotobuf/types/known/durationpb"
+	timestamppb1 "github.com/planetscale/vtprotobuf/types/known/timestamppb"
+	machine "github.com/siderolabs/talos/pkg/machinery/api/machine"
+	proto "google.golang.org/protobuf/proto"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+func (m *MachineSpec) CloneVT() *MachineSpec {
+	if m == nil {
+		return (*MachineSpec)(nil)
+	}
+	r := new(MachineSpec)
+	r.ManagementAddress = m.ManagementAddress
+	r.Connected = m.Connected
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineStatusSpec_HardwareStatus_Processor) CloneVT() *MachineStatusSpec_HardwareStatus_Processor {
+	if m == nil {
+		return (*MachineStatusSpec_HardwareStatus_Processor)(nil)
+	}
+	r := new(MachineStatusSpec_HardwareStatus_Processor)
+	r.CoreCount = m.CoreCount
+	r.ThreadCount = m.ThreadCount
+	r.Frequency = m.Frequency
+	r.Description = m.Description
+	r.Manufacturer = m.Manufacturer
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineStatusSpec_HardwareStatus_Processor) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineStatusSpec_HardwareStatus_MemoryModule) CloneVT() *MachineStatusSpec_HardwareStatus_MemoryModule {
+	if m == nil {
+		return (*MachineStatusSpec_HardwareStatus_MemoryModule)(nil)
+	}
+	r := new(MachineStatusSpec_HardwareStatus_MemoryModule)
+	r.SizeMb = m.SizeMb
+	r.Description = m.Description
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineStatusSpec_HardwareStatus_MemoryModule) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineStatusSpec_HardwareStatus_BlockDevice) CloneVT() *MachineStatusSpec_HardwareStatus_BlockDevice {
+	if m == nil {
+		return (*MachineStatusSpec_HardwareStatus_BlockDevice)(nil)
+	}
+	r := new(MachineStatusSpec_HardwareStatus_BlockDevice)
+	r.Size = m.Size
+	r.Model = m.Model
+	r.LinuxName = m.LinuxName
+	r.Name = m.Name
+	r.Serial = m.Serial
+	r.Uuid = m.Uuid
+	r.Wwid = m.Wwid
+	r.Type = m.Type
+	r.BusPath = m.BusPath
+	r.SystemDisk = m.SystemDisk
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineStatusSpec_HardwareStatus_BlockDevice) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineStatusSpec_HardwareStatus) CloneVT() *MachineStatusSpec_HardwareStatus {
+	if m == nil {
+		return (*MachineStatusSpec_HardwareStatus)(nil)
+	}
+	r := new(MachineStatusSpec_HardwareStatus)
+	r.Arch = m.Arch
+	if rhs := m.Processors; rhs != nil {
+		tmpContainer := make([]*MachineStatusSpec_HardwareStatus_Processor, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.Processors = tmpContainer
+	}
+	if rhs := m.MemoryModules; rhs != nil {
+		tmpContainer := make([]*MachineStatusSpec_HardwareStatus_MemoryModule, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.MemoryModules = tmpContainer
+	}
+	if rhs := m.Blockdevices; rhs != nil {
+		tmpContainer := make([]*MachineStatusSpec_HardwareStatus_BlockDevice, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.Blockdevices = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineStatusSpec_HardwareStatus) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) CloneVT() *MachineStatusSpec_NetworkStatus_NetworkLinkStatus {
+	if m == nil {
+		return (*MachineStatusSpec_NetworkStatus_NetworkLinkStatus)(nil)
+	}
+	r := new(MachineStatusSpec_NetworkStatus_NetworkLinkStatus)
+	r.LinuxName = m.LinuxName
+	r.HardwareAddress = m.HardwareAddress
+	r.SpeedMbps = m.SpeedMbps
+	r.LinkUp = m.LinkUp
+	r.Description = m.Description
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineStatusSpec_NetworkStatus) CloneVT() *MachineStatusSpec_NetworkStatus {
+	if m == nil {
+		return (*MachineStatusSpec_NetworkStatus)(nil)
+	}
+	r := new(MachineStatusSpec_NetworkStatus)
+	r.Hostname = m.Hostname
+	r.Domainname = m.Domainname
+	if rhs := m.Addresses; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.Addresses = tmpContainer
+	}
+	if rhs := m.DefaultGateways; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.DefaultGateways = tmpContainer
+	}
+	if rhs := m.NetworkLinks; rhs != nil {
+		tmpContainer := make([]*MachineStatusSpec_NetworkStatus_NetworkLinkStatus, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.NetworkLinks = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineStatusSpec_NetworkStatus) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineStatusSpec_PlatformMetadata) CloneVT() *MachineStatusSpec_PlatformMetadata {
+	if m == nil {
+		return (*MachineStatusSpec_PlatformMetadata)(nil)
+	}
+	r := new(MachineStatusSpec_PlatformMetadata)
+	r.Platform = m.Platform
+	r.Hostname = m.Hostname
+	r.Region = m.Region
+	r.Zone = m.Zone
+	r.InstanceType = m.InstanceType
+	r.InstanceId = m.InstanceId
+	r.ProviderId = m.ProviderId
+	r.Spot = m.Spot
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineStatusSpec_PlatformMetadata) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineStatusSpec_Schematic) CloneVT() *MachineStatusSpec_Schematic {
+	if m == nil {
+		return (*MachineStatusSpec_Schematic)(nil)
+	}
+	r := new(MachineStatusSpec_Schematic)
+	r.Id = m.Id
+	r.Invalid = m.Invalid
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineStatusSpec_Schematic) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineStatusSpec) CloneVT() *MachineStatusSpec {
+	if m == nil {
+		return (*MachineStatusSpec)(nil)
+	}
+	r := new(MachineStatusSpec)
+	r.TalosVersion = m.TalosVersion
+	r.Hardware = m.Hardware.CloneVT()
+	r.Network = m.Network.CloneVT()
+	r.LastError = m.LastError
+	r.ManagementAddress = m.ManagementAddress
+	r.Connected = m.Connected
+	r.Maintenance = m.Maintenance
+	r.Cluster = m.Cluster
+	r.Role = m.Role
+	r.PlatformMetadata = m.PlatformMetadata.CloneVT()
+	r.Schematic = m.Schematic.CloneVT()
+	if rhs := m.ImageLabels; rhs != nil {
+		tmpContainer := make(map[string]string, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v
+		}
+		r.ImageLabels = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *TalosConfigSpec) CloneVT() *TalosConfigSpec {
+	if m == nil {
+		return (*TalosConfigSpec)(nil)
+	}
+	r := new(TalosConfigSpec)
+	r.Ca = m.Ca
+	r.Crt = m.Crt
+	r.Key = m.Key
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *TalosConfigSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterSpec_Features) CloneVT() *ClusterSpec_Features {
+	if m == nil {
+		return (*ClusterSpec_Features)(nil)
+	}
+	r := new(ClusterSpec_Features)
+	r.EnableWorkloadProxy = m.EnableWorkloadProxy
+	r.DiskEncryption = m.DiskEncryption
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterSpec_Features) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterSpec) CloneVT() *ClusterSpec {
+	if m == nil {
+		return (*ClusterSpec)(nil)
+	}
+	r := new(ClusterSpec)
+	r.InstallImage = m.InstallImage
+	r.KubernetesVersion = m.KubernetesVersion
+	r.TalosVersion = m.TalosVersion
+	r.Features = m.Features.CloneVT()
+	r.BackupConfiguration = m.BackupConfiguration.CloneVT()
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *EtcdBackupConf) CloneVT() *EtcdBackupConf {
+	if m == nil {
+		return (*EtcdBackupConf)(nil)
+	}
+	r := new(EtcdBackupConf)
+	r.Interval = (*durationpb.Duration)((*durationpb1.Duration)(m.Interval).CloneVT())
+	r.Enabled = m.Enabled
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *EtcdBackupConf) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *EtcdBackupEncryptionSpec) CloneVT() *EtcdBackupEncryptionSpec {
+	if m == nil {
+		return (*EtcdBackupEncryptionSpec)(nil)
+	}
+	r := new(EtcdBackupEncryptionSpec)
+	if rhs := m.EncryptionKey; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.EncryptionKey = tmpBytes
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *EtcdBackupEncryptionSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *EtcdBackupHeader) CloneVT() *EtcdBackupHeader {
+	if m == nil {
+		return (*EtcdBackupHeader)(nil)
+	}
+	r := new(EtcdBackupHeader)
+	r.Version = m.Version
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *EtcdBackupHeader) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *EtcdBackupSpec) CloneVT() *EtcdBackupSpec {
+	if m == nil {
+		return (*EtcdBackupSpec)(nil)
+	}
+	r := new(EtcdBackupSpec)
+	r.CreatedAt = (*timestamppb.Timestamp)((*timestamppb1.Timestamp)(m.CreatedAt).CloneVT())
+	r.Snapshot = m.Snapshot
+	r.Size = m.Size
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *EtcdBackupSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *BackupDataSpec) CloneVT() *BackupDataSpec {
+	if m == nil {
+		return (*BackupDataSpec)(nil)
+	}
+	r := new(BackupDataSpec)
+	r.Interval = (*durationpb.Duration)((*durationpb1.Duration)(m.Interval).CloneVT())
+	r.ClusterUuid = m.ClusterUuid
+	r.AesCbcEncryptionSecret = m.AesCbcEncryptionSecret
+	r.SecretboxEncryptionSecret = m.SecretboxEncryptionSecret
+	if rhs := m.EncryptionKey; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.EncryptionKey = tmpBytes
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *BackupDataSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *EtcdBackupS3ConfSpec) CloneVT() *EtcdBackupS3ConfSpec {
+	if m == nil {
+		return (*EtcdBackupS3ConfSpec)(nil)
+	}
+	r := new(EtcdBackupS3ConfSpec)
+	r.Bucket = m.Bucket
+	r.Region = m.Region
+	r.Endpoint = m.Endpoint
+	r.AccessKeyId = m.AccessKeyId
+	r.SecretAccessKey = m.SecretAccessKey
+	r.SessionToken = m.SessionToken
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *EtcdBackupS3ConfSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *EtcdBackupStatusSpec) CloneVT() *EtcdBackupStatusSpec {
+	if m == nil {
+		return (*EtcdBackupStatusSpec)(nil)
+	}
+	r := new(EtcdBackupStatusSpec)
+	r.Status = m.Status
+	r.Error = m.Error
+	r.LastBackupTime = (*timestamppb.Timestamp)((*timestamppb1.Timestamp)(m.LastBackupTime).CloneVT())
+	r.LastBackupAttempt = (*timestamppb.Timestamp)((*timestamppb1.Timestamp)(m.LastBackupAttempt).CloneVT())
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *EtcdBackupStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *EtcdManualBackupSpec) CloneVT() *EtcdManualBackupSpec {
+	if m == nil {
+		return (*EtcdManualBackupSpec)(nil)
+	}
+	r := new(EtcdManualBackupSpec)
+	r.BackupAt = (*timestamppb.Timestamp)((*timestamppb1.Timestamp)(m.BackupAt).CloneVT())
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *EtcdManualBackupSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *EtcdBackupStoreStatusSpec) CloneVT() *EtcdBackupStoreStatusSpec {
+	if m == nil {
+		return (*EtcdBackupStoreStatusSpec)(nil)
+	}
+	r := new(EtcdBackupStoreStatusSpec)
+	r.ConfigurationName = m.ConfigurationName
+	r.ConfigurationError = m.ConfigurationError
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *EtcdBackupStoreStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *EtcdBackupOverallStatusSpec) CloneVT() *EtcdBackupOverallStatusSpec {
+	if m == nil {
+		return (*EtcdBackupOverallStatusSpec)(nil)
+	}
+	r := new(EtcdBackupOverallStatusSpec)
+	r.ConfigurationName = m.ConfigurationName
+	r.ConfigurationError = m.ConfigurationError
+	r.LastBackupStatus = m.LastBackupStatus.CloneVT()
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *EtcdBackupOverallStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterMachineSpec) CloneVT() *ClusterMachineSpec {
+	if m == nil {
+		return (*ClusterMachineSpec)(nil)
+	}
+	r := new(ClusterMachineSpec)
+	r.KubernetesVersion = m.KubernetesVersion
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterMachineSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterMachineConfigPatchesSpec) CloneVT() *ClusterMachineConfigPatchesSpec {
+	if m == nil {
+		return (*ClusterMachineConfigPatchesSpec)(nil)
+	}
+	r := new(ClusterMachineConfigPatchesSpec)
+	if rhs := m.Patches; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.Patches = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterMachineConfigPatchesSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterMachineTalosVersionSpec) CloneVT() *ClusterMachineTalosVersionSpec {
+	if m == nil {
+		return (*ClusterMachineTalosVersionSpec)(nil)
+	}
+	r := new(ClusterMachineTalosVersionSpec)
+	r.TalosVersion = m.TalosVersion
+	r.SchematicId = m.SchematicId
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterMachineTalosVersionSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterMachineConfigSpec) CloneVT() *ClusterMachineConfigSpec {
+	if m == nil {
+		return (*ClusterMachineConfigSpec)(nil)
+	}
+	r := new(ClusterMachineConfigSpec)
+	r.ClusterMachineVersion = m.ClusterMachineVersion
+	r.GenerationError = m.GenerationError
+	if rhs := m.Data; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.Data = tmpBytes
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterMachineConfigSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *RedactedClusterMachineConfigSpec) CloneVT() *RedactedClusterMachineConfigSpec {
+	if m == nil {
+		return (*RedactedClusterMachineConfigSpec)(nil)
+	}
+	r := new(RedactedClusterMachineConfigSpec)
+	r.Data = m.Data
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *RedactedClusterMachineConfigSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterMachineIdentitySpec) CloneVT() *ClusterMachineIdentitySpec {
+	if m == nil {
+		return (*ClusterMachineIdentitySpec)(nil)
+	}
+	r := new(ClusterMachineIdentitySpec)
+	r.NodeIdentity = m.NodeIdentity
+	r.EtcdMemberId = m.EtcdMemberId
+	r.Nodename = m.Nodename
+	if rhs := m.NodeIps; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.NodeIps = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterMachineIdentitySpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterMachineTemplateSpec) CloneVT() *ClusterMachineTemplateSpec {
+	if m == nil {
+		return (*ClusterMachineTemplateSpec)(nil)
+	}
+	r := new(ClusterMachineTemplateSpec)
+	r.InstallImage = m.InstallImage
+	r.KubernetesVersion = m.KubernetesVersion
+	r.InstallDisk = m.InstallDisk
+	r.Patch = m.Patch
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterMachineTemplateSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterMachineStatusSpec) CloneVT() *ClusterMachineStatusSpec {
+	if m == nil {
+		return (*ClusterMachineStatusSpec)(nil)
+	}
+	r := new(ClusterMachineStatusSpec)
+	r.Ready = m.Ready
+	r.Stage = m.Stage
+	r.ApidAvailable = m.ApidAvailable
+	r.ConfigUpToDate = m.ConfigUpToDate
+	r.LastConfigError = m.LastConfigError
+	r.ManagementAddress = m.ManagementAddress
+	r.ConfigApplyStatus = m.ConfigApplyStatus
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterMachineStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *Machines) CloneVT() *Machines {
+	if m == nil {
+		return (*Machines)(nil)
+	}
+	r := new(Machines)
+	r.Total = m.Total
+	r.Healthy = m.Healthy
+	r.Connected = m.Connected
+	r.Requested = m.Requested
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *Machines) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterStatusSpec) CloneVT() *ClusterStatusSpec {
+	if m == nil {
+		return (*ClusterStatusSpec)(nil)
+	}
+	r := new(ClusterStatusSpec)
+	r.Available = m.Available
+	r.Machines = m.Machines.CloneVT()
+	r.Phase = m.Phase
+	r.Ready = m.Ready
+	r.KubernetesAPIReady = m.KubernetesAPIReady
+	r.ControlplaneReady = m.ControlplaneReady
+	r.HasConnectedControlPlanes = m.HasConnectedControlPlanes
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterUUID) CloneVT() *ClusterUUID {
+	if m == nil {
+		return (*ClusterUUID)(nil)
+	}
+	r := new(ClusterUUID)
+	r.Uuid = m.Uuid
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterUUID) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterConfigVersionSpec) CloneVT() *ClusterConfigVersionSpec {
+	if m == nil {
+		return (*ClusterConfigVersionSpec)(nil)
+	}
+	r := new(ClusterConfigVersionSpec)
+	r.Version = m.Version
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterConfigVersionSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterMachineConfigStatusSpec) CloneVT() *ClusterMachineConfigStatusSpec {
+	if m == nil {
+		return (*ClusterMachineConfigStatusSpec)(nil)
+	}
+	r := new(ClusterMachineConfigStatusSpec)
+	r.ClusterMachineConfigVersion = m.ClusterMachineConfigVersion
+	r.ClusterMachineVersion = m.ClusterMachineVersion
+	r.ClusterMachineConfigSha256 = m.ClusterMachineConfigSha256
+	r.LastConfigError = m.LastConfigError
+	r.TalosVersion = m.TalosVersion
+	r.SchematicId = m.SchematicId
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterMachineConfigStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterBootstrapStatusSpec) CloneVT() *ClusterBootstrapStatusSpec {
+	if m == nil {
+		return (*ClusterBootstrapStatusSpec)(nil)
+	}
+	r := new(ClusterBootstrapStatusSpec)
+	r.Bootstrapped = m.Bootstrapped
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterBootstrapStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterSecretsSpec) CloneVT() *ClusterSecretsSpec {
+	if m == nil {
+		return (*ClusterSecretsSpec)(nil)
+	}
+	r := new(ClusterSecretsSpec)
+	if rhs := m.Data; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.Data = tmpBytes
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterSecretsSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *LoadBalancerConfigSpec) CloneVT() *LoadBalancerConfigSpec {
+	if m == nil {
+		return (*LoadBalancerConfigSpec)(nil)
+	}
+	r := new(LoadBalancerConfigSpec)
+	r.BindPort = m.BindPort
+	r.SiderolinkEndpoint = m.SiderolinkEndpoint
+	if rhs := m.Endpoints; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.Endpoints = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *LoadBalancerConfigSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *LoadBalancerStatusSpec) CloneVT() *LoadBalancerStatusSpec {
+	if m == nil {
+		return (*LoadBalancerStatusSpec)(nil)
+	}
+	r := new(LoadBalancerStatusSpec)
+	r.Healthy = m.Healthy
+	r.Stopped = m.Stopped
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *LoadBalancerStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubernetesVersionSpec) CloneVT() *KubernetesVersionSpec {
+	if m == nil {
+		return (*KubernetesVersionSpec)(nil)
+	}
+	r := new(KubernetesVersionSpec)
+	r.Version = m.Version
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubernetesVersionSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *TalosVersionSpec) CloneVT() *TalosVersionSpec {
+	if m == nil {
+		return (*TalosVersionSpec)(nil)
+	}
+	r := new(TalosVersionSpec)
+	r.Version = m.Version
+	if rhs := m.CompatibleKubernetesVersions; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.CompatibleKubernetesVersions = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *TalosVersionSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *InstallationMediaSpec) CloneVT() *InstallationMediaSpec {
+	if m == nil {
+		return (*InstallationMediaSpec)(nil)
+	}
+	r := new(InstallationMediaSpec)
+	r.Name = m.Name
+	r.Architecture = m.Architecture
+	r.Profile = m.Profile
+	r.ContentType = m.ContentType
+	r.SrcFilePrefix = m.SrcFilePrefix
+	r.DestFilePrefix = m.DestFilePrefix
+	r.Extension = m.Extension
+	r.NoSecureBoot = m.NoSecureBoot
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *InstallationMediaSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ConfigPatchSpec) CloneVT() *ConfigPatchSpec {
+	if m == nil {
+		return (*ConfigPatchSpec)(nil)
+	}
+	r := new(ConfigPatchSpec)
+	r.Data = m.Data
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ConfigPatchSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineSetSpec_MachineClass) CloneVT() *MachineSetSpec_MachineClass {
+	if m == nil {
+		return (*MachineSetSpec_MachineClass)(nil)
+	}
+	r := new(MachineSetSpec_MachineClass)
+	r.Name = m.Name
+	r.MachineCount = m.MachineCount
+	r.AllocationType = m.AllocationType
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineSetSpec_MachineClass) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineSetSpec_BootstrapSpec) CloneVT() *MachineSetSpec_BootstrapSpec {
+	if m == nil {
+		return (*MachineSetSpec_BootstrapSpec)(nil)
+	}
+	r := new(MachineSetSpec_BootstrapSpec)
+	r.ClusterUuid = m.ClusterUuid
+	r.Snapshot = m.Snapshot
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineSetSpec_BootstrapSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineSetSpec_RollingUpdateStrategyConfig) CloneVT() *MachineSetSpec_RollingUpdateStrategyConfig {
+	if m == nil {
+		return (*MachineSetSpec_RollingUpdateStrategyConfig)(nil)
+	}
+	r := new(MachineSetSpec_RollingUpdateStrategyConfig)
+	r.MaxParallelism = m.MaxParallelism
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineSetSpec_RollingUpdateStrategyConfig) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineSetSpec_UpdateStrategyConfig) CloneVT() *MachineSetSpec_UpdateStrategyConfig {
+	if m == nil {
+		return (*MachineSetSpec_UpdateStrategyConfig)(nil)
+	}
+	r := new(MachineSetSpec_UpdateStrategyConfig)
+	r.Rolling = m.Rolling.CloneVT()
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineSetSpec_UpdateStrategyConfig) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineSetSpec) CloneVT() *MachineSetSpec {
+	if m == nil {
+		return (*MachineSetSpec)(nil)
+	}
+	r := new(MachineSetSpec)
+	r.UpdateStrategy = m.UpdateStrategy
+	r.MachineClass = m.MachineClass.CloneVT()
+	r.BootstrapSpec = m.BootstrapSpec.CloneVT()
+	r.DeleteStrategy = m.DeleteStrategy
+	r.UpdateStrategyConfig = m.UpdateStrategyConfig.CloneVT()
+	r.DeleteStrategyConfig = m.DeleteStrategyConfig.CloneVT()
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineSetSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *TalosUpgradeStatusSpec) CloneVT() *TalosUpgradeStatusSpec {
+	if m == nil {
+		return (*TalosUpgradeStatusSpec)(nil)
+	}
+	r := new(TalosUpgradeStatusSpec)
+	r.Phase = m.Phase
+	r.Error = m.Error
+	r.Step = m.Step
+	r.Status = m.Status
+	r.LastUpgradeVersion = m.LastUpgradeVersion
+	r.CurrentUpgradeVersion = m.CurrentUpgradeVersion
+	if rhs := m.UpgradeVersions; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.UpgradeVersions = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *TalosUpgradeStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineSetStatusSpec) CloneVT() *MachineSetStatusSpec {
+	if m == nil {
+		return (*MachineSetStatusSpec)(nil)
+	}
+	r := new(MachineSetStatusSpec)
+	r.Phase = m.Phase
+	r.Ready = m.Ready
+	r.Error = m.Error
+	r.Machines = m.Machines.CloneVT()
+	r.ConfigHash = m.ConfigHash
+	r.MachineClass = m.MachineClass.CloneVT()
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineSetStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineSetNodeSpec) CloneVT() *MachineSetNodeSpec {
+	if m == nil {
+		return (*MachineSetNodeSpec)(nil)
+	}
+	r := new(MachineSetNodeSpec)
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineSetNodeSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineLabelsSpec) CloneVT() *MachineLabelsSpec {
+	if m == nil {
+		return (*MachineLabelsSpec)(nil)
+	}
+	r := new(MachineLabelsSpec)
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineLabelsSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineStatusSnapshotSpec) CloneVT() *MachineStatusSnapshotSpec {
+	if m == nil {
+		return (*MachineStatusSnapshotSpec)(nil)
+	}
+	r := new(MachineStatusSnapshotSpec)
+	if rhs := m.MachineStatus; rhs != nil {
+		if vtpb, ok := interface{}(rhs).(interface {
+			CloneVT() *machine.MachineStatusEvent
+		}); ok {
+			r.MachineStatus = vtpb.CloneVT()
+		} else {
+			r.MachineStatus = proto.Clone(rhs).(*machine.MachineStatusEvent)
+		}
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineStatusSnapshotSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ControlPlaneStatusSpec_Condition) CloneVT() *ControlPlaneStatusSpec_Condition {
+	if m == nil {
+		return (*ControlPlaneStatusSpec_Condition)(nil)
+	}
+	r := new(ControlPlaneStatusSpec_Condition)
+	r.Type = m.Type
+	r.Reason = m.Reason
+	r.Status = m.Status
+	r.Severity = m.Severity
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ControlPlaneStatusSpec_Condition) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ControlPlaneStatusSpec) CloneVT() *ControlPlaneStatusSpec {
+	if m == nil {
+		return (*ControlPlaneStatusSpec)(nil)
+	}
+	r := new(ControlPlaneStatusSpec)
+	if rhs := m.Conditions; rhs != nil {
+		tmpContainer := make([]*ControlPlaneStatusSpec_Condition, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.Conditions = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ControlPlaneStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterEndpointSpec) CloneVT() *ClusterEndpointSpec {
+	if m == nil {
+		return (*ClusterEndpointSpec)(nil)
+	}
+	r := new(ClusterEndpointSpec)
+	if rhs := m.ManagementAddresses; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.ManagementAddresses = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterEndpointSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubernetesStatusSpec_NodeStatus) CloneVT() *KubernetesStatusSpec_NodeStatus {
+	if m == nil {
+		return (*KubernetesStatusSpec_NodeStatus)(nil)
+	}
+	r := new(KubernetesStatusSpec_NodeStatus)
+	r.Nodename = m.Nodename
+	r.KubeletVersion = m.KubeletVersion
+	r.Ready = m.Ready
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubernetesStatusSpec_NodeStatus) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubernetesStatusSpec_StaticPodStatus) CloneVT() *KubernetesStatusSpec_StaticPodStatus {
+	if m == nil {
+		return (*KubernetesStatusSpec_StaticPodStatus)(nil)
+	}
+	r := new(KubernetesStatusSpec_StaticPodStatus)
+	r.App = m.App
+	r.Version = m.Version
+	r.Ready = m.Ready
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubernetesStatusSpec_StaticPodStatus) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubernetesStatusSpec_NodeStaticPods) CloneVT() *KubernetesStatusSpec_NodeStaticPods {
+	if m == nil {
+		return (*KubernetesStatusSpec_NodeStaticPods)(nil)
+	}
+	r := new(KubernetesStatusSpec_NodeStaticPods)
+	r.Nodename = m.Nodename
+	if rhs := m.StaticPods; rhs != nil {
+		tmpContainer := make([]*KubernetesStatusSpec_StaticPodStatus, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.StaticPods = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubernetesStatusSpec_NodeStaticPods) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubernetesStatusSpec) CloneVT() *KubernetesStatusSpec {
+	if m == nil {
+		return (*KubernetesStatusSpec)(nil)
+	}
+	r := new(KubernetesStatusSpec)
+	if rhs := m.Nodes; rhs != nil {
+		tmpContainer := make([]*KubernetesStatusSpec_NodeStatus, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.Nodes = tmpContainer
+	}
+	if rhs := m.StaticPods; rhs != nil {
+		tmpContainer := make([]*KubernetesStatusSpec_NodeStaticPods, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.StaticPods = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubernetesStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubernetesUpgradeStatusSpec) CloneVT() *KubernetesUpgradeStatusSpec {
+	if m == nil {
+		return (*KubernetesUpgradeStatusSpec)(nil)
+	}
+	r := new(KubernetesUpgradeStatusSpec)
+	r.Phase = m.Phase
+	r.Error = m.Error
+	r.Step = m.Step
+	r.Status = m.Status
+	r.LastUpgradeVersion = m.LastUpgradeVersion
+	r.CurrentUpgradeVersion = m.CurrentUpgradeVersion
+	if rhs := m.UpgradeVersions; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.UpgradeVersions = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubernetesUpgradeStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubernetesUpgradeManifestStatusSpec) CloneVT() *KubernetesUpgradeManifestStatusSpec {
+	if m == nil {
+		return (*KubernetesUpgradeManifestStatusSpec)(nil)
+	}
+	r := new(KubernetesUpgradeManifestStatusSpec)
+	r.OutOfSync = m.OutOfSync
+	r.LastFatalError = m.LastFatalError
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubernetesUpgradeManifestStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *DestroyStatusSpec) CloneVT() *DestroyStatusSpec {
+	if m == nil {
+		return (*DestroyStatusSpec)(nil)
+	}
+	r := new(DestroyStatusSpec)
+	r.Phase = m.Phase
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *DestroyStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *OngoingTaskSpec) CloneVT() *OngoingTaskSpec {
+	if m == nil {
+		return (*OngoingTaskSpec)(nil)
+	}
+	r := new(OngoingTaskSpec)
+	r.Title = m.Title
+	if m.Details != nil {
+		r.Details = m.Details.(interface {
+			CloneVT() isOngoingTaskSpec_Details
+		}).CloneVT()
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *OngoingTaskSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *OngoingTaskSpec_TalosUpgrade) CloneVT() isOngoingTaskSpec_Details {
+	if m == nil {
+		return (*OngoingTaskSpec_TalosUpgrade)(nil)
+	}
+	r := new(OngoingTaskSpec_TalosUpgrade)
+	r.TalosUpgrade = m.TalosUpgrade.CloneVT()
+	return r
+}
+
+func (m *OngoingTaskSpec_KubernetesUpgrade) CloneVT() isOngoingTaskSpec_Details {
+	if m == nil {
+		return (*OngoingTaskSpec_KubernetesUpgrade)(nil)
+	}
+	r := new(OngoingTaskSpec_KubernetesUpgrade)
+	r.KubernetesUpgrade = m.KubernetesUpgrade.CloneVT()
+	return r
+}
+
+func (m *OngoingTaskSpec_Destroy) CloneVT() isOngoingTaskSpec_Details {
+	if m == nil {
+		return (*OngoingTaskSpec_Destroy)(nil)
+	}
+	r := new(OngoingTaskSpec_Destroy)
+	r.Destroy = m.Destroy.CloneVT()
+	return r
+}
+
+func (m *ClusterMachineEncryptionKeySpec) CloneVT() *ClusterMachineEncryptionKeySpec {
+	if m == nil {
+		return (*ClusterMachineEncryptionKeySpec)(nil)
+	}
+	r := new(ClusterMachineEncryptionKeySpec)
+	if rhs := m.Data; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.Data = tmpBytes
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterMachineEncryptionKeySpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ExposedServiceSpec) CloneVT() *ExposedServiceSpec {
+	if m == nil {
+		return (*ExposedServiceSpec)(nil)
+	}
+	r := new(ExposedServiceSpec)
+	r.Port = m.Port
+	r.Label = m.Label
+	r.IconBase64 = m.IconBase64
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ExposedServiceSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *FeaturesConfigSpec) CloneVT() *FeaturesConfigSpec {
+	if m == nil {
+		return (*FeaturesConfigSpec)(nil)
+	}
+	r := new(FeaturesConfigSpec)
+	r.EnableWorkloadProxying = m.EnableWorkloadProxying
+	r.EtcdBackupSettings = m.EtcdBackupSettings.CloneVT()
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *FeaturesConfigSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *EtcdBackupSettings) CloneVT() *EtcdBackupSettings {
+	if m == nil {
+		return (*EtcdBackupSettings)(nil)
+	}
+	r := new(EtcdBackupSettings)
+	r.TickInterval = (*durationpb.Duration)((*durationpb1.Duration)(m.TickInterval).CloneVT())
+	r.MinInterval = (*durationpb.Duration)((*durationpb1.Duration)(m.MinInterval).CloneVT())
+	r.MaxInterval = (*durationpb.Duration)((*durationpb1.Duration)(m.MaxInterval).CloneVT())
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *EtcdBackupSettings) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineClassSpec) CloneVT() *MachineClassSpec {
+	if m == nil {
+		return (*MachineClassSpec)(nil)
+	}
+	r := new(MachineClassSpec)
+	if rhs := m.MatchLabels; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.MatchLabels = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineClassSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *MachineConfigGenOptionsSpec) CloneVT() *MachineConfigGenOptionsSpec {
+	if m == nil {
+		return (*MachineConfigGenOptionsSpec)(nil)
+	}
+	r := new(MachineConfigGenOptionsSpec)
+	r.InstallDisk = m.InstallDisk
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *MachineConfigGenOptionsSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *EtcdAuditResultSpec) CloneVT() *EtcdAuditResultSpec {
+	if m == nil {
+		return (*EtcdAuditResultSpec)(nil)
+	}
+	r := new(EtcdAuditResultSpec)
+	if rhs := m.EtcdMemberIds; rhs != nil {
+		tmpContainer := make([]uint64, len(rhs))
+		copy(tmpContainer, rhs)
+		r.EtcdMemberIds = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *EtcdAuditResultSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubeconfigSpec) CloneVT() *KubeconfigSpec {
+	if m == nil {
+		return (*KubeconfigSpec)(nil)
+	}
+	r := new(KubeconfigSpec)
+	if rhs := m.Data; rhs != nil {
+		tmpBytes := make([]byte, len(rhs))
+		copy(tmpBytes, rhs)
+		r.Data = tmpBytes
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubeconfigSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubernetesUsageSpec_Quantity) CloneVT() *KubernetesUsageSpec_Quantity {
+	if m == nil {
+		return (*KubernetesUsageSpec_Quantity)(nil)
+	}
+	r := new(KubernetesUsageSpec_Quantity)
+	r.Requests = m.Requests
+	r.Limits = m.Limits
+	r.Capacity = m.Capacity
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubernetesUsageSpec_Quantity) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubernetesUsageSpec_Pod) CloneVT() *KubernetesUsageSpec_Pod {
+	if m == nil {
+		return (*KubernetesUsageSpec_Pod)(nil)
+	}
+	r := new(KubernetesUsageSpec_Pod)
+	r.Count = m.Count
+	r.Capacity = m.Capacity
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubernetesUsageSpec_Pod) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *KubernetesUsageSpec) CloneVT() *KubernetesUsageSpec {
+	if m == nil {
+		return (*KubernetesUsageSpec)(nil)
+	}
+	r := new(KubernetesUsageSpec)
+	r.Cpu = m.Cpu.CloneVT()
+	r.Mem = m.Mem.CloneVT()
+	r.Storage = m.Storage.CloneVT()
+	r.Pods = m.Pods.CloneVT()
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *KubernetesUsageSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ImagePullRequestSpec_NodeImageList) CloneVT() *ImagePullRequestSpec_NodeImageList {
+	if m == nil {
+		return (*ImagePullRequestSpec_NodeImageList)(nil)
+	}
+	r := new(ImagePullRequestSpec_NodeImageList)
+	r.Node = m.Node
+	if rhs := m.Images; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.Images = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ImagePullRequestSpec_NodeImageList) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ImagePullRequestSpec) CloneVT() *ImagePullRequestSpec {
+	if m == nil {
+		return (*ImagePullRequestSpec)(nil)
+	}
+	r := new(ImagePullRequestSpec)
+	if rhs := m.NodeImageList; rhs != nil {
+		tmpContainer := make([]*ImagePullRequestSpec_NodeImageList, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.NodeImageList = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ImagePullRequestSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ImagePullStatusSpec) CloneVT() *ImagePullStatusSpec {
+	if m == nil {
+		return (*ImagePullStatusSpec)(nil)
+	}
+	r := new(ImagePullStatusSpec)
+	r.LastProcessedNode = m.LastProcessedNode
+	r.LastProcessedImage = m.LastProcessedImage
+	r.LastProcessedError = m.LastProcessedError
+	r.ProcessedCount = m.ProcessedCount
+	r.TotalCount = m.TotalCount
+	r.RequestVersion = m.RequestVersion
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ImagePullStatusSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *SchematicSpec) CloneVT() *SchematicSpec {
+	if m == nil {
+		return (*SchematicSpec)(nil)
+	}
+	r := new(SchematicSpec)
+	if rhs := m.Extensions; rhs != nil {
+		tmpContainer := make([]string, len(rhs))
+		copy(tmpContainer, rhs)
+		r.Extensions = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *SchematicSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *TalosExtensionsSpec_Info) CloneVT() *TalosExtensionsSpec_Info {
+	if m == nil {
+		return (*TalosExtensionsSpec_Info)(nil)
+	}
+	r := new(TalosExtensionsSpec_Info)
+	r.Name = m.Name
+	r.Author = m.Author
+	r.Version = m.Version
+	r.Description = m.Description
+	r.Ref = m.Ref
+	r.Digest = m.Digest
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *TalosExtensionsSpec_Info) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *TalosExtensionsSpec) CloneVT() *TalosExtensionsSpec {
+	if m == nil {
+		return (*TalosExtensionsSpec)(nil)
+	}
+	r := new(TalosExtensionsSpec)
+	if rhs := m.Items; rhs != nil {
+		tmpContainer := make([]*TalosExtensionsSpec_Info, len(rhs))
+		for k, v := range rhs {
+			tmpContainer[k] = v.CloneVT()
+		}
+		r.Items = tmpContainer
+	}
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *TalosExtensionsSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *SchematicConfigurationSpec) CloneVT() *SchematicConfigurationSpec {
+	if m == nil {
+		return (*SchematicConfigurationSpec)(nil)
+	}
+	r := new(SchematicConfigurationSpec)
+	r.SchematicId = m.SchematicId
+	r.Target = m.Target
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *SchematicConfigurationSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (this *MachineSpec) EqualVT(that *MachineSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.ManagementAddress != that.ManagementAddress {
+		return false
+	}
+	if this.Connected != that.Connected {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineStatusSpec_HardwareStatus_Processor) EqualVT(that *MachineStatusSpec_HardwareStatus_Processor) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.CoreCount != that.CoreCount {
+		return false
+	}
+	if this.ThreadCount != that.ThreadCount {
+		return false
+	}
+	if this.Frequency != that.Frequency {
+		return false
+	}
+	if this.Description != that.Description {
+		return false
+	}
+	if this.Manufacturer != that.Manufacturer {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineStatusSpec_HardwareStatus_Processor) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineStatusSpec_HardwareStatus_Processor)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineStatusSpec_HardwareStatus_MemoryModule) EqualVT(that *MachineStatusSpec_HardwareStatus_MemoryModule) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.SizeMb != that.SizeMb {
+		return false
+	}
+	if this.Description != that.Description {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineStatusSpec_HardwareStatus_MemoryModule) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineStatusSpec_HardwareStatus_MemoryModule)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineStatusSpec_HardwareStatus_BlockDevice) EqualVT(that *MachineStatusSpec_HardwareStatus_BlockDevice) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Size != that.Size {
+		return false
+	}
+	if this.Model != that.Model {
+		return false
+	}
+	if this.LinuxName != that.LinuxName {
+		return false
+	}
+	if this.Name != that.Name {
+		return false
+	}
+	if this.Serial != that.Serial {
+		return false
+	}
+	if this.Uuid != that.Uuid {
+		return false
+	}
+	if this.Wwid != that.Wwid {
+		return false
+	}
+	if this.Type != that.Type {
+		return false
+	}
+	if this.BusPath != that.BusPath {
+		return false
+	}
+	if this.SystemDisk != that.SystemDisk {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineStatusSpec_HardwareStatus_BlockDevice) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineStatusSpec_HardwareStatus_BlockDevice)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineStatusSpec_HardwareStatus) EqualVT(that *MachineStatusSpec_HardwareStatus) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Processors) != len(that.Processors) {
+		return false
+	}
+	for i, vx := range this.Processors {
+		vy := that.Processors[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &MachineStatusSpec_HardwareStatus_Processor{}
+			}
+			if q == nil {
+				q = &MachineStatusSpec_HardwareStatus_Processor{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if len(this.MemoryModules) != len(that.MemoryModules) {
+		return false
+	}
+	for i, vx := range this.MemoryModules {
+		vy := that.MemoryModules[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &MachineStatusSpec_HardwareStatus_MemoryModule{}
+			}
+			if q == nil {
+				q = &MachineStatusSpec_HardwareStatus_MemoryModule{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if len(this.Blockdevices) != len(that.Blockdevices) {
+		return false
+	}
+	for i, vx := range this.Blockdevices {
+		vy := that.Blockdevices[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &MachineStatusSpec_HardwareStatus_BlockDevice{}
+			}
+			if q == nil {
+				q = &MachineStatusSpec_HardwareStatus_BlockDevice{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if this.Arch != that.Arch {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineStatusSpec_HardwareStatus) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineStatusSpec_HardwareStatus)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) EqualVT(that *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.LinuxName != that.LinuxName {
+		return false
+	}
+	if this.HardwareAddress != that.HardwareAddress {
+		return false
+	}
+	if this.SpeedMbps != that.SpeedMbps {
+		return false
+	}
+	if this.LinkUp != that.LinkUp {
+		return false
+	}
+	if this.Description != that.Description {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineStatusSpec_NetworkStatus_NetworkLinkStatus)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineStatusSpec_NetworkStatus) EqualVT(that *MachineStatusSpec_NetworkStatus) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Hostname != that.Hostname {
+		return false
+	}
+	if this.Domainname != that.Domainname {
+		return false
+	}
+	if len(this.Addresses) != len(that.Addresses) {
+		return false
+	}
+	for i, vx := range this.Addresses {
+		vy := that.Addresses[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if len(this.DefaultGateways) != len(that.DefaultGateways) {
+		return false
+	}
+	for i, vx := range this.DefaultGateways {
+		vy := that.DefaultGateways[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if len(this.NetworkLinks) != len(that.NetworkLinks) {
+		return false
+	}
+	for i, vx := range this.NetworkLinks {
+		vy := that.NetworkLinks[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &MachineStatusSpec_NetworkStatus_NetworkLinkStatus{}
+			}
+			if q == nil {
+				q = &MachineStatusSpec_NetworkStatus_NetworkLinkStatus{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineStatusSpec_NetworkStatus) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineStatusSpec_NetworkStatus)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineStatusSpec_PlatformMetadata) EqualVT(that *MachineStatusSpec_PlatformMetadata) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Platform != that.Platform {
+		return false
+	}
+	if this.Hostname != that.Hostname {
+		return false
+	}
+	if this.Region != that.Region {
+		return false
+	}
+	if this.Zone != that.Zone {
+		return false
+	}
+	if this.InstanceType != that.InstanceType {
+		return false
+	}
+	if this.InstanceId != that.InstanceId {
+		return false
+	}
+	if this.ProviderId != that.ProviderId {
+		return false
+	}
+	if this.Spot != that.Spot {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineStatusSpec_PlatformMetadata) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineStatusSpec_PlatformMetadata)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineStatusSpec_Schematic) EqualVT(that *MachineStatusSpec_Schematic) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Id != that.Id {
+		return false
+	}
+	if this.Invalid != that.Invalid {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineStatusSpec_Schematic) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineStatusSpec_Schematic)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineStatusSpec) EqualVT(that *MachineStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.TalosVersion != that.TalosVersion {
+		return false
+	}
+	if !this.Hardware.EqualVT(that.Hardware) {
+		return false
+	}
+	if !this.Network.EqualVT(that.Network) {
+		return false
+	}
+	if this.LastError != that.LastError {
+		return false
+	}
+	if this.ManagementAddress != that.ManagementAddress {
+		return false
+	}
+	if this.Connected != that.Connected {
+		return false
+	}
+	if this.Maintenance != that.Maintenance {
+		return false
+	}
+	if this.Cluster != that.Cluster {
+		return false
+	}
+	if this.Role != that.Role {
+		return false
+	}
+	if !this.PlatformMetadata.EqualVT(that.PlatformMetadata) {
+		return false
+	}
+	if len(this.ImageLabels) != len(that.ImageLabels) {
+		return false
+	}
+	for i, vx := range this.ImageLabels {
+		vy, ok := that.ImageLabels[i]
+		if !ok {
+			return false
+		}
+		if vx != vy {
+			return false
+		}
+	}
+	if !this.Schematic.EqualVT(that.Schematic) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *TalosConfigSpec) EqualVT(that *TalosConfigSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Ca != that.Ca {
+		return false
+	}
+	if this.Crt != that.Crt {
+		return false
+	}
+	if this.Key != that.Key {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *TalosConfigSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*TalosConfigSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterSpec_Features) EqualVT(that *ClusterSpec_Features) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.EnableWorkloadProxy != that.EnableWorkloadProxy {
+		return false
+	}
+	if this.DiskEncryption != that.DiskEncryption {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterSpec_Features) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterSpec_Features)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterSpec) EqualVT(that *ClusterSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.InstallImage != that.InstallImage {
+		return false
+	}
+	if this.KubernetesVersion != that.KubernetesVersion {
+		return false
+	}
+	if this.TalosVersion != that.TalosVersion {
+		return false
+	}
+	if !this.Features.EqualVT(that.Features) {
+		return false
+	}
+	if !this.BackupConfiguration.EqualVT(that.BackupConfiguration) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *EtcdBackupConf) EqualVT(that *EtcdBackupConf) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !(*durationpb1.Duration)(this.Interval).EqualVT((*durationpb1.Duration)(that.Interval)) {
+		return false
+	}
+	if this.Enabled != that.Enabled {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *EtcdBackupConf) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*EtcdBackupConf)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *EtcdBackupEncryptionSpec) EqualVT(that *EtcdBackupEncryptionSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if string(this.EncryptionKey) != string(that.EncryptionKey) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *EtcdBackupEncryptionSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*EtcdBackupEncryptionSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *EtcdBackupHeader) EqualVT(that *EtcdBackupHeader) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Version != that.Version {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *EtcdBackupHeader) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*EtcdBackupHeader)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *EtcdBackupSpec) EqualVT(that *EtcdBackupSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !(*timestamppb1.Timestamp)(this.CreatedAt).EqualVT((*timestamppb1.Timestamp)(that.CreatedAt)) {
+		return false
+	}
+	if this.Snapshot != that.Snapshot {
+		return false
+	}
+	if this.Size != that.Size {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *EtcdBackupSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*EtcdBackupSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *BackupDataSpec) EqualVT(that *BackupDataSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !(*durationpb1.Duration)(this.Interval).EqualVT((*durationpb1.Duration)(that.Interval)) {
+		return false
+	}
+	if this.ClusterUuid != that.ClusterUuid {
+		return false
+	}
+	if string(this.EncryptionKey) != string(that.EncryptionKey) {
+		return false
+	}
+	if this.AesCbcEncryptionSecret != that.AesCbcEncryptionSecret {
+		return false
+	}
+	if this.SecretboxEncryptionSecret != that.SecretboxEncryptionSecret {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *BackupDataSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*BackupDataSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *EtcdBackupS3ConfSpec) EqualVT(that *EtcdBackupS3ConfSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Bucket != that.Bucket {
+		return false
+	}
+	if this.Region != that.Region {
+		return false
+	}
+	if this.Endpoint != that.Endpoint {
+		return false
+	}
+	if this.AccessKeyId != that.AccessKeyId {
+		return false
+	}
+	if this.SecretAccessKey != that.SecretAccessKey {
+		return false
+	}
+	if this.SessionToken != that.SessionToken {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *EtcdBackupS3ConfSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*EtcdBackupS3ConfSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *EtcdBackupStatusSpec) EqualVT(that *EtcdBackupStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Status != that.Status {
+		return false
+	}
+	if this.Error != that.Error {
+		return false
+	}
+	if !(*timestamppb1.Timestamp)(this.LastBackupTime).EqualVT((*timestamppb1.Timestamp)(that.LastBackupTime)) {
+		return false
+	}
+	if !(*timestamppb1.Timestamp)(this.LastBackupAttempt).EqualVT((*timestamppb1.Timestamp)(that.LastBackupAttempt)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *EtcdBackupStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*EtcdBackupStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *EtcdManualBackupSpec) EqualVT(that *EtcdManualBackupSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !(*timestamppb1.Timestamp)(this.BackupAt).EqualVT((*timestamppb1.Timestamp)(that.BackupAt)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *EtcdManualBackupSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*EtcdManualBackupSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *EtcdBackupStoreStatusSpec) EqualVT(that *EtcdBackupStoreStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.ConfigurationName != that.ConfigurationName {
+		return false
+	}
+	if this.ConfigurationError != that.ConfigurationError {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *EtcdBackupStoreStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*EtcdBackupStoreStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *EtcdBackupOverallStatusSpec) EqualVT(that *EtcdBackupOverallStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.ConfigurationName != that.ConfigurationName {
+		return false
+	}
+	if this.ConfigurationError != that.ConfigurationError {
+		return false
+	}
+	if !this.LastBackupStatus.EqualVT(that.LastBackupStatus) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *EtcdBackupOverallStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*EtcdBackupOverallStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterMachineSpec) EqualVT(that *ClusterMachineSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.KubernetesVersion != that.KubernetesVersion {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterMachineSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterMachineSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterMachineConfigPatchesSpec) EqualVT(that *ClusterMachineConfigPatchesSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Patches) != len(that.Patches) {
+		return false
+	}
+	for i, vx := range this.Patches {
+		vy := that.Patches[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterMachineConfigPatchesSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterMachineConfigPatchesSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterMachineTalosVersionSpec) EqualVT(that *ClusterMachineTalosVersionSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.TalosVersion != that.TalosVersion {
+		return false
+	}
+	if this.SchematicId != that.SchematicId {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterMachineTalosVersionSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterMachineTalosVersionSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterMachineConfigSpec) EqualVT(that *ClusterMachineConfigSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if string(this.Data) != string(that.Data) {
+		return false
+	}
+	if this.ClusterMachineVersion != that.ClusterMachineVersion {
+		return false
+	}
+	if this.GenerationError != that.GenerationError {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterMachineConfigSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterMachineConfigSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *RedactedClusterMachineConfigSpec) EqualVT(that *RedactedClusterMachineConfigSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Data != that.Data {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *RedactedClusterMachineConfigSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*RedactedClusterMachineConfigSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterMachineIdentitySpec) EqualVT(that *ClusterMachineIdentitySpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.NodeIdentity != that.NodeIdentity {
+		return false
+	}
+	if this.EtcdMemberId != that.EtcdMemberId {
+		return false
+	}
+	if this.Nodename != that.Nodename {
+		return false
+	}
+	if len(this.NodeIps) != len(that.NodeIps) {
+		return false
+	}
+	for i, vx := range this.NodeIps {
+		vy := that.NodeIps[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterMachineIdentitySpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterMachineIdentitySpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterMachineTemplateSpec) EqualVT(that *ClusterMachineTemplateSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.InstallImage != that.InstallImage {
+		return false
+	}
+	if this.KubernetesVersion != that.KubernetesVersion {
+		return false
+	}
+	if this.InstallDisk != that.InstallDisk {
+		return false
+	}
+	if this.Patch != that.Patch {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterMachineTemplateSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterMachineTemplateSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterMachineStatusSpec) EqualVT(that *ClusterMachineStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Ready != that.Ready {
+		return false
+	}
+	if this.Stage != that.Stage {
+		return false
+	}
+	if this.ApidAvailable != that.ApidAvailable {
+		return false
+	}
+	if this.ConfigUpToDate != that.ConfigUpToDate {
+		return false
+	}
+	if this.LastConfigError != that.LastConfigError {
+		return false
+	}
+	if this.ManagementAddress != that.ManagementAddress {
+		return false
+	}
+	if this.ConfigApplyStatus != that.ConfigApplyStatus {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterMachineStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterMachineStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *Machines) EqualVT(that *Machines) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Total != that.Total {
+		return false
+	}
+	if this.Healthy != that.Healthy {
+		return false
+	}
+	if this.Connected != that.Connected {
+		return false
+	}
+	if this.Requested != that.Requested {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *Machines) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*Machines)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterStatusSpec) EqualVT(that *ClusterStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Available != that.Available {
+		return false
+	}
+	if !this.Machines.EqualVT(that.Machines) {
+		return false
+	}
+	if this.Phase != that.Phase {
+		return false
+	}
+	if this.Ready != that.Ready {
+		return false
+	}
+	if this.KubernetesAPIReady != that.KubernetesAPIReady {
+		return false
+	}
+	if this.ControlplaneReady != that.ControlplaneReady {
+		return false
+	}
+	if this.HasConnectedControlPlanes != that.HasConnectedControlPlanes {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterUUID) EqualVT(that *ClusterUUID) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Uuid != that.Uuid {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterUUID) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterUUID)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterConfigVersionSpec) EqualVT(that *ClusterConfigVersionSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Version != that.Version {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterConfigVersionSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterConfigVersionSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterMachineConfigStatusSpec) EqualVT(that *ClusterMachineConfigStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.ClusterMachineConfigVersion != that.ClusterMachineConfigVersion {
+		return false
+	}
+	if this.ClusterMachineVersion != that.ClusterMachineVersion {
+		return false
+	}
+	if this.ClusterMachineConfigSha256 != that.ClusterMachineConfigSha256 {
+		return false
+	}
+	if this.LastConfigError != that.LastConfigError {
+		return false
+	}
+	if this.TalosVersion != that.TalosVersion {
+		return false
+	}
+	if this.SchematicId != that.SchematicId {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterMachineConfigStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterMachineConfigStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterBootstrapStatusSpec) EqualVT(that *ClusterBootstrapStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Bootstrapped != that.Bootstrapped {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterBootstrapStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterBootstrapStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterSecretsSpec) EqualVT(that *ClusterSecretsSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if string(this.Data) != string(that.Data) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterSecretsSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterSecretsSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *LoadBalancerConfigSpec) EqualVT(that *LoadBalancerConfigSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.BindPort != that.BindPort {
+		return false
+	}
+	if len(this.Endpoints) != len(that.Endpoints) {
+		return false
+	}
+	for i, vx := range this.Endpoints {
+		vy := that.Endpoints[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if this.SiderolinkEndpoint != that.SiderolinkEndpoint {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *LoadBalancerConfigSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*LoadBalancerConfigSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *LoadBalancerStatusSpec) EqualVT(that *LoadBalancerStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Healthy != that.Healthy {
+		return false
+	}
+	if this.Stopped != that.Stopped {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *LoadBalancerStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*LoadBalancerStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubernetesVersionSpec) EqualVT(that *KubernetesVersionSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Version != that.Version {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubernetesVersionSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubernetesVersionSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *TalosVersionSpec) EqualVT(that *TalosVersionSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Version != that.Version {
+		return false
+	}
+	if len(this.CompatibleKubernetesVersions) != len(that.CompatibleKubernetesVersions) {
+		return false
+	}
+	for i, vx := range this.CompatibleKubernetesVersions {
+		vy := that.CompatibleKubernetesVersions[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *TalosVersionSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*TalosVersionSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *InstallationMediaSpec) EqualVT(that *InstallationMediaSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Name != that.Name {
+		return false
+	}
+	if this.Architecture != that.Architecture {
+		return false
+	}
+	if this.Profile != that.Profile {
+		return false
+	}
+	if this.ContentType != that.ContentType {
+		return false
+	}
+	if this.SrcFilePrefix != that.SrcFilePrefix {
+		return false
+	}
+	if this.DestFilePrefix != that.DestFilePrefix {
+		return false
+	}
+	if this.Extension != that.Extension {
+		return false
+	}
+	if this.NoSecureBoot != that.NoSecureBoot {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *InstallationMediaSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*InstallationMediaSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ConfigPatchSpec) EqualVT(that *ConfigPatchSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Data != that.Data {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ConfigPatchSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ConfigPatchSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineSetSpec_MachineClass) EqualVT(that *MachineSetSpec_MachineClass) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Name != that.Name {
+		return false
+	}
+	if this.MachineCount != that.MachineCount {
+		return false
+	}
+	if this.AllocationType != that.AllocationType {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineSetSpec_MachineClass) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineSetSpec_MachineClass)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineSetSpec_BootstrapSpec) EqualVT(that *MachineSetSpec_BootstrapSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.ClusterUuid != that.ClusterUuid {
+		return false
+	}
+	if this.Snapshot != that.Snapshot {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineSetSpec_BootstrapSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineSetSpec_BootstrapSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineSetSpec_RollingUpdateStrategyConfig) EqualVT(that *MachineSetSpec_RollingUpdateStrategyConfig) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.MaxParallelism != that.MaxParallelism {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineSetSpec_RollingUpdateStrategyConfig) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineSetSpec_RollingUpdateStrategyConfig)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineSetSpec_UpdateStrategyConfig) EqualVT(that *MachineSetSpec_UpdateStrategyConfig) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !this.Rolling.EqualVT(that.Rolling) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineSetSpec_UpdateStrategyConfig) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineSetSpec_UpdateStrategyConfig)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineSetSpec) EqualVT(that *MachineSetSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.UpdateStrategy != that.UpdateStrategy {
+		return false
+	}
+	if !this.MachineClass.EqualVT(that.MachineClass) {
+		return false
+	}
+	if !this.BootstrapSpec.EqualVT(that.BootstrapSpec) {
+		return false
+	}
+	if this.DeleteStrategy != that.DeleteStrategy {
+		return false
+	}
+	if !this.UpdateStrategyConfig.EqualVT(that.UpdateStrategyConfig) {
+		return false
+	}
+	if !this.DeleteStrategyConfig.EqualVT(that.DeleteStrategyConfig) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineSetSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineSetSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *TalosUpgradeStatusSpec) EqualVT(that *TalosUpgradeStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Phase != that.Phase {
+		return false
+	}
+	if this.Error != that.Error {
+		return false
+	}
+	if this.Step != that.Step {
+		return false
+	}
+	if this.Status != that.Status {
+		return false
+	}
+	if this.LastUpgradeVersion != that.LastUpgradeVersion {
+		return false
+	}
+	if this.CurrentUpgradeVersion != that.CurrentUpgradeVersion {
+		return false
+	}
+	if len(this.UpgradeVersions) != len(that.UpgradeVersions) {
+		return false
+	}
+	for i, vx := range this.UpgradeVersions {
+		vy := that.UpgradeVersions[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *TalosUpgradeStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*TalosUpgradeStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineSetStatusSpec) EqualVT(that *MachineSetStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Phase != that.Phase {
+		return false
+	}
+	if this.Ready != that.Ready {
+		return false
+	}
+	if this.Error != that.Error {
+		return false
+	}
+	if !this.Machines.EqualVT(that.Machines) {
+		return false
+	}
+	if this.ConfigHash != that.ConfigHash {
+		return false
+	}
+	if !this.MachineClass.EqualVT(that.MachineClass) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineSetStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineSetStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineSetNodeSpec) EqualVT(that *MachineSetNodeSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineSetNodeSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineSetNodeSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineLabelsSpec) EqualVT(that *MachineLabelsSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineLabelsSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineLabelsSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineStatusSnapshotSpec) EqualVT(that *MachineStatusSnapshotSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if equal, ok := interface{}(this.MachineStatus).(interface {
+		EqualVT(*machine.MachineStatusEvent) bool
+	}); ok {
+		if !equal.EqualVT(that.MachineStatus) {
+			return false
+		}
+	} else if !proto.Equal(this.MachineStatus, that.MachineStatus) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineStatusSnapshotSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineStatusSnapshotSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ControlPlaneStatusSpec_Condition) EqualVT(that *ControlPlaneStatusSpec_Condition) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Type != that.Type {
+		return false
+	}
+	if this.Reason != that.Reason {
+		return false
+	}
+	if this.Status != that.Status {
+		return false
+	}
+	if this.Severity != that.Severity {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ControlPlaneStatusSpec_Condition) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ControlPlaneStatusSpec_Condition)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ControlPlaneStatusSpec) EqualVT(that *ControlPlaneStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Conditions) != len(that.Conditions) {
+		return false
+	}
+	for i, vx := range this.Conditions {
+		vy := that.Conditions[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &ControlPlaneStatusSpec_Condition{}
+			}
+			if q == nil {
+				q = &ControlPlaneStatusSpec_Condition{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ControlPlaneStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ControlPlaneStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterEndpointSpec) EqualVT(that *ClusterEndpointSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.ManagementAddresses) != len(that.ManagementAddresses) {
+		return false
+	}
+	for i, vx := range this.ManagementAddresses {
+		vy := that.ManagementAddresses[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterEndpointSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterEndpointSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubernetesStatusSpec_NodeStatus) EqualVT(that *KubernetesStatusSpec_NodeStatus) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Nodename != that.Nodename {
+		return false
+	}
+	if this.KubeletVersion != that.KubeletVersion {
+		return false
+	}
+	if this.Ready != that.Ready {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubernetesStatusSpec_NodeStatus) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubernetesStatusSpec_NodeStatus)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubernetesStatusSpec_StaticPodStatus) EqualVT(that *KubernetesStatusSpec_StaticPodStatus) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.App != that.App {
+		return false
+	}
+	if this.Version != that.Version {
+		return false
+	}
+	if this.Ready != that.Ready {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubernetesStatusSpec_StaticPodStatus) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubernetesStatusSpec_StaticPodStatus)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubernetesStatusSpec_NodeStaticPods) EqualVT(that *KubernetesStatusSpec_NodeStaticPods) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Nodename != that.Nodename {
+		return false
+	}
+	if len(this.StaticPods) != len(that.StaticPods) {
+		return false
+	}
+	for i, vx := range this.StaticPods {
+		vy := that.StaticPods[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &KubernetesStatusSpec_StaticPodStatus{}
+			}
+			if q == nil {
+				q = &KubernetesStatusSpec_StaticPodStatus{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubernetesStatusSpec_NodeStaticPods) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubernetesStatusSpec_NodeStaticPods)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubernetesStatusSpec) EqualVT(that *KubernetesStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Nodes) != len(that.Nodes) {
+		return false
+	}
+	for i, vx := range this.Nodes {
+		vy := that.Nodes[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &KubernetesStatusSpec_NodeStatus{}
+			}
+			if q == nil {
+				q = &KubernetesStatusSpec_NodeStatus{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	if len(this.StaticPods) != len(that.StaticPods) {
+		return false
+	}
+	for i, vx := range this.StaticPods {
+		vy := that.StaticPods[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &KubernetesStatusSpec_NodeStaticPods{}
+			}
+			if q == nil {
+				q = &KubernetesStatusSpec_NodeStaticPods{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubernetesStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubernetesStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubernetesUpgradeStatusSpec) EqualVT(that *KubernetesUpgradeStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Phase != that.Phase {
+		return false
+	}
+	if this.Error != that.Error {
+		return false
+	}
+	if this.Step != that.Step {
+		return false
+	}
+	if this.Status != that.Status {
+		return false
+	}
+	if this.LastUpgradeVersion != that.LastUpgradeVersion {
+		return false
+	}
+	if len(this.UpgradeVersions) != len(that.UpgradeVersions) {
+		return false
+	}
+	for i, vx := range this.UpgradeVersions {
+		vy := that.UpgradeVersions[i]
+		if vx != vy {
+			return false
+		}
+	}
+	if this.CurrentUpgradeVersion != that.CurrentUpgradeVersion {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubernetesUpgradeStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubernetesUpgradeStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubernetesUpgradeManifestStatusSpec) EqualVT(that *KubernetesUpgradeManifestStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.OutOfSync != that.OutOfSync {
+		return false
+	}
+	if this.LastFatalError != that.LastFatalError {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubernetesUpgradeManifestStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubernetesUpgradeManifestStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *DestroyStatusSpec) EqualVT(that *DestroyStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Phase != that.Phase {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *DestroyStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*DestroyStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *OngoingTaskSpec) EqualVT(that *OngoingTaskSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Details == nil && that.Details != nil {
+		return false
+	} else if this.Details != nil {
+		if that.Details == nil {
+			return false
+		}
+		if !this.Details.(interface {
+			EqualVT(isOngoingTaskSpec_Details) bool
+		}).EqualVT(that.Details) {
+			return false
+		}
+	}
+	if this.Title != that.Title {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *OngoingTaskSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*OngoingTaskSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *OngoingTaskSpec_TalosUpgrade) EqualVT(thatIface isOngoingTaskSpec_Details) bool {
+	that, ok := thatIface.(*OngoingTaskSpec_TalosUpgrade)
+	if !ok {
+		return false
+	}
+	if this == that {
+		return true
+	}
+	if this == nil && that != nil || this != nil && that == nil {
+		return false
+	}
+	if p, q := this.TalosUpgrade, that.TalosUpgrade; p != q {
+		if p == nil {
+			p = &TalosUpgradeStatusSpec{}
+		}
+		if q == nil {
+			q = &TalosUpgradeStatusSpec{}
+		}
+		if !p.EqualVT(q) {
+			return false
+		}
+	}
+	return true
+}
+
+func (this *OngoingTaskSpec_KubernetesUpgrade) EqualVT(thatIface isOngoingTaskSpec_Details) bool {
+	that, ok := thatIface.(*OngoingTaskSpec_KubernetesUpgrade)
+	if !ok {
+		return false
+	}
+	if this == that {
+		return true
+	}
+	if this == nil && that != nil || this != nil && that == nil {
+		return false
+	}
+	if p, q := this.KubernetesUpgrade, that.KubernetesUpgrade; p != q {
+		if p == nil {
+			p = &KubernetesUpgradeStatusSpec{}
+		}
+		if q == nil {
+			q = &KubernetesUpgradeStatusSpec{}
+		}
+		if !p.EqualVT(q) {
+			return false
+		}
+	}
+	return true
+}
+
+func (this *OngoingTaskSpec_Destroy) EqualVT(thatIface isOngoingTaskSpec_Details) bool {
+	that, ok := thatIface.(*OngoingTaskSpec_Destroy)
+	if !ok {
+		return false
+	}
+	if this == that {
+		return true
+	}
+	if this == nil && that != nil || this != nil && that == nil {
+		return false
+	}
+	if p, q := this.Destroy, that.Destroy; p != q {
+		if p == nil {
+			p = &DestroyStatusSpec{}
+		}
+		if q == nil {
+			q = &DestroyStatusSpec{}
+		}
+		if !p.EqualVT(q) {
+			return false
+		}
+	}
+	return true
+}
+
+func (this *ClusterMachineEncryptionKeySpec) EqualVT(that *ClusterMachineEncryptionKeySpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if string(this.Data) != string(that.Data) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterMachineEncryptionKeySpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterMachineEncryptionKeySpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ExposedServiceSpec) EqualVT(that *ExposedServiceSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Port != that.Port {
+		return false
+	}
+	if this.Label != that.Label {
+		return false
+	}
+	if this.IconBase64 != that.IconBase64 {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ExposedServiceSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ExposedServiceSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *FeaturesConfigSpec) EqualVT(that *FeaturesConfigSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.EnableWorkloadProxying != that.EnableWorkloadProxying {
+		return false
+	}
+	if !this.EtcdBackupSettings.EqualVT(that.EtcdBackupSettings) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *FeaturesConfigSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*FeaturesConfigSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *EtcdBackupSettings) EqualVT(that *EtcdBackupSettings) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !(*durationpb1.Duration)(this.TickInterval).EqualVT((*durationpb1.Duration)(that.TickInterval)) {
+		return false
+	}
+	if !(*durationpb1.Duration)(this.MinInterval).EqualVT((*durationpb1.Duration)(that.MinInterval)) {
+		return false
+	}
+	if !(*durationpb1.Duration)(this.MaxInterval).EqualVT((*durationpb1.Duration)(that.MaxInterval)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *EtcdBackupSettings) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*EtcdBackupSettings)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineClassSpec) EqualVT(that *MachineClassSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.MatchLabels) != len(that.MatchLabels) {
+		return false
+	}
+	for i, vx := range this.MatchLabels {
+		vy := that.MatchLabels[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineClassSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineClassSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *MachineConfigGenOptionsSpec) EqualVT(that *MachineConfigGenOptionsSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.InstallDisk != that.InstallDisk {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *MachineConfigGenOptionsSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*MachineConfigGenOptionsSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *EtcdAuditResultSpec) EqualVT(that *EtcdAuditResultSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.EtcdMemberIds) != len(that.EtcdMemberIds) {
+		return false
+	}
+	for i, vx := range this.EtcdMemberIds {
+		vy := that.EtcdMemberIds[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *EtcdAuditResultSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*EtcdAuditResultSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubeconfigSpec) EqualVT(that *KubeconfigSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if string(this.Data) != string(that.Data) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubeconfigSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubeconfigSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubernetesUsageSpec_Quantity) EqualVT(that *KubernetesUsageSpec_Quantity) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Requests != that.Requests {
+		return false
+	}
+	if this.Limits != that.Limits {
+		return false
+	}
+	if this.Capacity != that.Capacity {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubernetesUsageSpec_Quantity) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubernetesUsageSpec_Quantity)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubernetesUsageSpec_Pod) EqualVT(that *KubernetesUsageSpec_Pod) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Count != that.Count {
+		return false
+	}
+	if this.Capacity != that.Capacity {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubernetesUsageSpec_Pod) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubernetesUsageSpec_Pod)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *KubernetesUsageSpec) EqualVT(that *KubernetesUsageSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if !this.Cpu.EqualVT(that.Cpu) {
+		return false
+	}
+	if !this.Mem.EqualVT(that.Mem) {
+		return false
+	}
+	if !this.Storage.EqualVT(that.Storage) {
+		return false
+	}
+	if !this.Pods.EqualVT(that.Pods) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *KubernetesUsageSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*KubernetesUsageSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ImagePullRequestSpec_NodeImageList) EqualVT(that *ImagePullRequestSpec_NodeImageList) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Node != that.Node {
+		return false
+	}
+	if len(this.Images) != len(that.Images) {
+		return false
+	}
+	for i, vx := range this.Images {
+		vy := that.Images[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ImagePullRequestSpec_NodeImageList) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ImagePullRequestSpec_NodeImageList)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ImagePullRequestSpec) EqualVT(that *ImagePullRequestSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.NodeImageList) != len(that.NodeImageList) {
+		return false
+	}
+	for i, vx := range this.NodeImageList {
+		vy := that.NodeImageList[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &ImagePullRequestSpec_NodeImageList{}
+			}
+			if q == nil {
+				q = &ImagePullRequestSpec_NodeImageList{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ImagePullRequestSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ImagePullRequestSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ImagePullStatusSpec) EqualVT(that *ImagePullStatusSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.LastProcessedNode != that.LastProcessedNode {
+		return false
+	}
+	if this.LastProcessedImage != that.LastProcessedImage {
+		return false
+	}
+	if this.LastProcessedError != that.LastProcessedError {
+		return false
+	}
+	if this.ProcessedCount != that.ProcessedCount {
+		return false
+	}
+	if this.TotalCount != that.TotalCount {
+		return false
+	}
+	if this.RequestVersion != that.RequestVersion {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ImagePullStatusSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ImagePullStatusSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *SchematicSpec) EqualVT(that *SchematicSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Extensions) != len(that.Extensions) {
+		return false
+	}
+	for i, vx := range this.Extensions {
+		vy := that.Extensions[i]
+		if vx != vy {
+			return false
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *SchematicSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*SchematicSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *TalosExtensionsSpec_Info) EqualVT(that *TalosExtensionsSpec_Info) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Name != that.Name {
+		return false
+	}
+	if this.Author != that.Author {
+		return false
+	}
+	if this.Version != that.Version {
+		return false
+	}
+	if this.Description != that.Description {
+		return false
+	}
+	if this.Ref != that.Ref {
+		return false
+	}
+	if this.Digest != that.Digest {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *TalosExtensionsSpec_Info) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*TalosExtensionsSpec_Info)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *TalosExtensionsSpec) EqualVT(that *TalosExtensionsSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if len(this.Items) != len(that.Items) {
+		return false
+	}
+	for i, vx := range this.Items {
+		vy := that.Items[i]
+		if p, q := vx, vy; p != q {
+			if p == nil {
+				p = &TalosExtensionsSpec_Info{}
+			}
+			if q == nil {
+				q = &TalosExtensionsSpec_Info{}
+			}
+			if !p.EqualVT(q) {
+				return false
+			}
+		}
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *TalosExtensionsSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*TalosExtensionsSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *SchematicConfigurationSpec) EqualVT(that *SchematicConfigurationSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.SchematicId != that.SchematicId {
+		return false
+	}
+	if this.Target != that.Target {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *SchematicConfigurationSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*SchematicConfigurationSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (m *MachineSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Connected {
+		i--
+		if m.Connected {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.ManagementAddress) > 0 {
+		i -= len(m.ManagementAddress)
+		copy(dAtA[i:], m.ManagementAddress)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ManagementAddress)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineStatusSpec_HardwareStatus_Processor) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineStatusSpec_HardwareStatus_Processor) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineStatusSpec_HardwareStatus_Processor) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Manufacturer) > 0 {
+		i -= len(m.Manufacturer)
+		copy(dAtA[i:], m.Manufacturer)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Manufacturer)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.Description) > 0 {
+		i -= len(m.Description)
+		copy(dAtA[i:], m.Description)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Description)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.Frequency != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Frequency))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.ThreadCount != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.ThreadCount))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.CoreCount != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.CoreCount))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineStatusSpec_HardwareStatus_MemoryModule) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineStatusSpec_HardwareStatus_MemoryModule) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineStatusSpec_HardwareStatus_MemoryModule) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Description) > 0 {
+		i -= len(m.Description)
+		copy(dAtA[i:], m.Description)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Description)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.SizeMb != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.SizeMb))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineStatusSpec_HardwareStatus_BlockDevice) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineStatusSpec_HardwareStatus_BlockDevice) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineStatusSpec_HardwareStatus_BlockDevice) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.SystemDisk {
+		i--
+		if m.SystemDisk {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x58
+	}
+	if len(m.BusPath) > 0 {
+		i -= len(m.BusPath)
+		copy(dAtA[i:], m.BusPath)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.BusPath)))
+		i--
+		dAtA[i] = 0x52
+	}
+	if len(m.Type) > 0 {
+		i -= len(m.Type)
+		copy(dAtA[i:], m.Type)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Type)))
+		i--
+		dAtA[i] = 0x4a
+	}
+	if len(m.Wwid) > 0 {
+		i -= len(m.Wwid)
+		copy(dAtA[i:], m.Wwid)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Wwid)))
+		i--
+		dAtA[i] = 0x42
+	}
+	if len(m.Uuid) > 0 {
+		i -= len(m.Uuid)
+		copy(dAtA[i:], m.Uuid)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Uuid)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.Serial) > 0 {
+		i -= len(m.Serial)
+		copy(dAtA[i:], m.Serial)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Serial)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.LinuxName) > 0 {
+		i -= len(m.LinuxName)
+		copy(dAtA[i:], m.LinuxName)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.LinuxName)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Model) > 0 {
+		i -= len(m.Model)
+		copy(dAtA[i:], m.Model)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Model)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Size != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Size))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineStatusSpec_HardwareStatus) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineStatusSpec_HardwareStatus) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineStatusSpec_HardwareStatus) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Arch) > 0 {
+		i -= len(m.Arch)
+		copy(dAtA[i:], m.Arch)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Arch)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.Blockdevices) > 0 {
+		for iNdEx := len(m.Blockdevices) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Blockdevices[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.MemoryModules) > 0 {
+		for iNdEx := len(m.MemoryModules) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.MemoryModules[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Processors) > 0 {
+		for iNdEx := len(m.Processors) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Processors[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Description) > 0 {
+		i -= len(m.Description)
+		copy(dAtA[i:], m.Description)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Description)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.LinkUp {
+		i--
+		if m.LinkUp {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.SpeedMbps != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.SpeedMbps))
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.HardwareAddress) > 0 {
+		i -= len(m.HardwareAddress)
+		copy(dAtA[i:], m.HardwareAddress)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.HardwareAddress)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.LinuxName) > 0 {
+		i -= len(m.LinuxName)
+		copy(dAtA[i:], m.LinuxName)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.LinuxName)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineStatusSpec_NetworkStatus) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineStatusSpec_NetworkStatus) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineStatusSpec_NetworkStatus) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.NetworkLinks) > 0 {
+		for iNdEx := len(m.NetworkLinks) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.NetworkLinks[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x2a
+		}
+	}
+	if len(m.DefaultGateways) > 0 {
+		for iNdEx := len(m.DefaultGateways) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.DefaultGateways[iNdEx])
+			copy(dAtA[i:], m.DefaultGateways[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.DefaultGateways[iNdEx])))
+			i--
+			dAtA[i] = 0x22
+		}
+	}
+	if len(m.Addresses) > 0 {
+		for iNdEx := len(m.Addresses) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Addresses[iNdEx])
+			copy(dAtA[i:], m.Addresses[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Addresses[iNdEx])))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.Domainname) > 0 {
+		i -= len(m.Domainname)
+		copy(dAtA[i:], m.Domainname)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Domainname)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Hostname) > 0 {
+		i -= len(m.Hostname)
+		copy(dAtA[i:], m.Hostname)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Hostname)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineStatusSpec_PlatformMetadata) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineStatusSpec_PlatformMetadata) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineStatusSpec_PlatformMetadata) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Spot {
+		i--
+		if m.Spot {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x40
+	}
+	if len(m.ProviderId) > 0 {
+		i -= len(m.ProviderId)
+		copy(dAtA[i:], m.ProviderId)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ProviderId)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.InstanceId) > 0 {
+		i -= len(m.InstanceId)
+		copy(dAtA[i:], m.InstanceId)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.InstanceId)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.InstanceType) > 0 {
+		i -= len(m.InstanceType)
+		copy(dAtA[i:], m.InstanceType)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.InstanceType)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.Zone) > 0 {
+		i -= len(m.Zone)
+		copy(dAtA[i:], m.Zone)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Zone)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.Region) > 0 {
+		i -= len(m.Region)
+		copy(dAtA[i:], m.Region)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Region)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Hostname) > 0 {
+		i -= len(m.Hostname)
+		copy(dAtA[i:], m.Hostname)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Hostname)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Platform) > 0 {
+		i -= len(m.Platform)
+		copy(dAtA[i:], m.Platform)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Platform)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineStatusSpec_Schematic) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineStatusSpec_Schematic) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineStatusSpec_Schematic) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Invalid {
+		i--
+		if m.Invalid {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.Id) > 0 {
+		i -= len(m.Id)
+		copy(dAtA[i:], m.Id)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Id)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Schematic != nil {
+		size, err := m.Schematic.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x72
+	}
+	if len(m.ImageLabels) > 0 {
+		for k := range m.ImageLabels {
+			v := m.ImageLabels[k]
+			baseI := i
+			i -= len(v)
+			copy(dAtA[i:], v)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(v)))
+			i--
+			dAtA[i] = 0x12
+			i -= len(k)
+			copy(dAtA[i:], k)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(k)))
+			i--
+			dAtA[i] = 0xa
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(baseI-i))
+			i--
+			dAtA[i] = 0x6a
+		}
+	}
+	if m.PlatformMetadata != nil {
+		size, err := m.PlatformMetadata.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x5a
+	}
+	if m.Role != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Role))
+		i--
+		dAtA[i] = 0x50
+	}
+	if len(m.Cluster) > 0 {
+		i -= len(m.Cluster)
+		copy(dAtA[i:], m.Cluster)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Cluster)))
+		i--
+		dAtA[i] = 0x4a
+	}
+	if m.Maintenance {
+		i--
+		if m.Maintenance {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x38
+	}
+	if m.Connected {
+		i--
+		if m.Connected {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x30
+	}
+	if len(m.ManagementAddress) > 0 {
+		i -= len(m.ManagementAddress)
+		copy(dAtA[i:], m.ManagementAddress)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ManagementAddress)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.LastError) > 0 {
+		i -= len(m.LastError)
+		copy(dAtA[i:], m.LastError)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.LastError)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.Network != nil {
+		size, err := m.Network.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.Hardware != nil {
+		size, err := m.Hardware.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.TalosVersion) > 0 {
+		i -= len(m.TalosVersion)
+		copy(dAtA[i:], m.TalosVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.TalosVersion)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *TalosConfigSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TalosConfigSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *TalosConfigSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Key) > 0 {
+		i -= len(m.Key)
+		copy(dAtA[i:], m.Key)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Key)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Crt) > 0 {
+		i -= len(m.Crt)
+		copy(dAtA[i:], m.Crt)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Crt)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Ca) > 0 {
+		i -= len(m.Ca)
+		copy(dAtA[i:], m.Ca)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Ca)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterSpec_Features) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterSpec_Features) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterSpec_Features) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.DiskEncryption {
+		i--
+		if m.DiskEncryption {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.EnableWorkloadProxy {
+		i--
+		if m.EnableWorkloadProxy {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.BackupConfiguration != nil {
+		size, err := m.BackupConfiguration.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.Features != nil {
+		size, err := m.Features.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.TalosVersion) > 0 {
+		i -= len(m.TalosVersion)
+		copy(dAtA[i:], m.TalosVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.TalosVersion)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.KubernetesVersion) > 0 {
+		i -= len(m.KubernetesVersion)
+		copy(dAtA[i:], m.KubernetesVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.KubernetesVersion)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.InstallImage) > 0 {
+		i -= len(m.InstallImage)
+		copy(dAtA[i:], m.InstallImage)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.InstallImage)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *EtcdBackupConf) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EtcdBackupConf) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *EtcdBackupConf) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Enabled {
+		i--
+		if m.Enabled {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Interval != nil {
+		size, err := (*durationpb1.Duration)(m.Interval).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *EtcdBackupEncryptionSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EtcdBackupEncryptionSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *EtcdBackupEncryptionSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.EncryptionKey) > 0 {
+		i -= len(m.EncryptionKey)
+		copy(dAtA[i:], m.EncryptionKey)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.EncryptionKey)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *EtcdBackupHeader) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EtcdBackupHeader) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *EtcdBackupHeader) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Version != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Version))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *EtcdBackupSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EtcdBackupSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *EtcdBackupSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Size != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Size))
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.Snapshot) > 0 {
+		i -= len(m.Snapshot)
+		copy(dAtA[i:], m.Snapshot)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Snapshot)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.CreatedAt != nil {
+		size, err := (*timestamppb1.Timestamp)(m.CreatedAt).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *BackupDataSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *BackupDataSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *BackupDataSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.SecretboxEncryptionSecret) > 0 {
+		i -= len(m.SecretboxEncryptionSecret)
+		copy(dAtA[i:], m.SecretboxEncryptionSecret)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.SecretboxEncryptionSecret)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.AesCbcEncryptionSecret) > 0 {
+		i -= len(m.AesCbcEncryptionSecret)
+		copy(dAtA[i:], m.AesCbcEncryptionSecret)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.AesCbcEncryptionSecret)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.EncryptionKey) > 0 {
+		i -= len(m.EncryptionKey)
+		copy(dAtA[i:], m.EncryptionKey)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.EncryptionKey)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.ClusterUuid) > 0 {
+		i -= len(m.ClusterUuid)
+		copy(dAtA[i:], m.ClusterUuid)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ClusterUuid)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Interval != nil {
+		size, err := (*durationpb1.Duration)(m.Interval).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *EtcdBackupS3ConfSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EtcdBackupS3ConfSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *EtcdBackupS3ConfSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.SessionToken) > 0 {
+		i -= len(m.SessionToken)
+		copy(dAtA[i:], m.SessionToken)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.SessionToken)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.SecretAccessKey) > 0 {
+		i -= len(m.SecretAccessKey)
+		copy(dAtA[i:], m.SecretAccessKey)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.SecretAccessKey)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.AccessKeyId) > 0 {
+		i -= len(m.AccessKeyId)
+		copy(dAtA[i:], m.AccessKeyId)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.AccessKeyId)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.Endpoint) > 0 {
+		i -= len(m.Endpoint)
+		copy(dAtA[i:], m.Endpoint)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Endpoint)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Region) > 0 {
+		i -= len(m.Region)
+		copy(dAtA[i:], m.Region)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Region)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Bucket) > 0 {
+		i -= len(m.Bucket)
+		copy(dAtA[i:], m.Bucket)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Bucket)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *EtcdBackupStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EtcdBackupStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *EtcdBackupStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.LastBackupAttempt != nil {
+		size, err := (*timestamppb1.Timestamp)(m.LastBackupAttempt).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.LastBackupTime != nil {
+		size, err := (*timestamppb1.Timestamp)(m.LastBackupTime).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Error) > 0 {
+		i -= len(m.Error)
+		copy(dAtA[i:], m.Error)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Error)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Status != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Status))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *EtcdManualBackupSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EtcdManualBackupSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *EtcdManualBackupSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.BackupAt != nil {
+		size, err := (*timestamppb1.Timestamp)(m.BackupAt).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *EtcdBackupStoreStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EtcdBackupStoreStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *EtcdBackupStoreStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.ConfigurationError) > 0 {
+		i -= len(m.ConfigurationError)
+		copy(dAtA[i:], m.ConfigurationError)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ConfigurationError)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.ConfigurationName) > 0 {
+		i -= len(m.ConfigurationName)
+		copy(dAtA[i:], m.ConfigurationName)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ConfigurationName)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *EtcdBackupOverallStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EtcdBackupOverallStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *EtcdBackupOverallStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.LastBackupStatus != nil {
+		size, err := m.LastBackupStatus.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.ConfigurationError) > 0 {
+		i -= len(m.ConfigurationError)
+		copy(dAtA[i:], m.ConfigurationError)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ConfigurationError)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.ConfigurationName) > 0 {
+		i -= len(m.ConfigurationName)
+		copy(dAtA[i:], m.ConfigurationName)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ConfigurationName)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterMachineSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterMachineSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterMachineSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.KubernetesVersion) > 0 {
+		i -= len(m.KubernetesVersion)
+		copy(dAtA[i:], m.KubernetesVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.KubernetesVersion)))
+		i--
+		dAtA[i] = 0x12
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterMachineConfigPatchesSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterMachineConfigPatchesSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterMachineConfigPatchesSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Patches) > 0 {
+		for iNdEx := len(m.Patches) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Patches[iNdEx])
+			copy(dAtA[i:], m.Patches[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Patches[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterMachineTalosVersionSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterMachineTalosVersionSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterMachineTalosVersionSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.SchematicId) > 0 {
+		i -= len(m.SchematicId)
+		copy(dAtA[i:], m.SchematicId)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.SchematicId)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.TalosVersion) > 0 {
+		i -= len(m.TalosVersion)
+		copy(dAtA[i:], m.TalosVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.TalosVersion)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterMachineConfigSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterMachineConfigSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterMachineConfigSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.GenerationError) > 0 {
+		i -= len(m.GenerationError)
+		copy(dAtA[i:], m.GenerationError)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.GenerationError)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.ClusterMachineVersion) > 0 {
+		i -= len(m.ClusterMachineVersion)
+		copy(dAtA[i:], m.ClusterMachineVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ClusterMachineVersion)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Data) > 0 {
+		i -= len(m.Data)
+		copy(dAtA[i:], m.Data)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Data)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *RedactedClusterMachineConfigSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *RedactedClusterMachineConfigSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *RedactedClusterMachineConfigSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Data) > 0 {
+		i -= len(m.Data)
+		copy(dAtA[i:], m.Data)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Data)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterMachineIdentitySpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterMachineIdentitySpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterMachineIdentitySpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.NodeIps) > 0 {
+		for iNdEx := len(m.NodeIps) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.NodeIps[iNdEx])
+			copy(dAtA[i:], m.NodeIps[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.NodeIps[iNdEx])))
+			i--
+			dAtA[i] = 0x42
+		}
+	}
+	if len(m.Nodename) > 0 {
+		i -= len(m.Nodename)
+		copy(dAtA[i:], m.Nodename)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Nodename)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.EtcdMemberId != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.EtcdMemberId))
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.NodeIdentity) > 0 {
+		i -= len(m.NodeIdentity)
+		copy(dAtA[i:], m.NodeIdentity)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.NodeIdentity)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterMachineTemplateSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterMachineTemplateSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterMachineTemplateSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Patch) > 0 {
+		i -= len(m.Patch)
+		copy(dAtA[i:], m.Patch)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Patch)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.InstallDisk) > 0 {
+		i -= len(m.InstallDisk)
+		copy(dAtA[i:], m.InstallDisk)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.InstallDisk)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.KubernetesVersion) > 0 {
+		i -= len(m.KubernetesVersion)
+		copy(dAtA[i:], m.KubernetesVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.KubernetesVersion)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.InstallImage) > 0 {
+		i -= len(m.InstallImage)
+		copy(dAtA[i:], m.InstallImage)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.InstallImage)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterMachineStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterMachineStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterMachineStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.ConfigApplyStatus != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.ConfigApplyStatus))
+		i--
+		dAtA[i] = 0x38
+	}
+	if len(m.ManagementAddress) > 0 {
+		i -= len(m.ManagementAddress)
+		copy(dAtA[i:], m.ManagementAddress)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ManagementAddress)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.LastConfigError) > 0 {
+		i -= len(m.LastConfigError)
+		copy(dAtA[i:], m.LastConfigError)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.LastConfigError)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.ConfigUpToDate {
+		i--
+		if m.ConfigUpToDate {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.ApidAvailable {
+		i--
+		if m.ApidAvailable {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Stage != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Stage))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Ready {
+		i--
+		if m.Ready {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *Machines) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *Machines) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *Machines) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Requested != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Requested))
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.Connected != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Connected))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Healthy != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Healthy))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Total != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Total))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.HasConnectedControlPlanes {
+		i--
+		if m.HasConnectedControlPlanes {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x38
+	}
+	if m.ControlplaneReady {
+		i--
+		if m.ControlplaneReady {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x30
+	}
+	if m.KubernetesAPIReady {
+		i--
+		if m.KubernetesAPIReady {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.Ready {
+		i--
+		if m.Ready {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.Phase != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Phase))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Machines != nil {
+		size, err := m.Machines.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Available {
+		i--
+		if m.Available {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterUUID) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterUUID) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterUUID) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Uuid) > 0 {
+		i -= len(m.Uuid)
+		copy(dAtA[i:], m.Uuid)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Uuid)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterConfigVersionSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterConfigVersionSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterConfigVersionSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Version) > 0 {
+		i -= len(m.Version)
+		copy(dAtA[i:], m.Version)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Version)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterMachineConfigStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterMachineConfigStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterMachineConfigStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.SchematicId) > 0 {
+		i -= len(m.SchematicId)
+		copy(dAtA[i:], m.SchematicId)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.SchematicId)))
+		i--
+		dAtA[i] = 0x42
+	}
+	if len(m.TalosVersion) > 0 {
+		i -= len(m.TalosVersion)
+		copy(dAtA[i:], m.TalosVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.TalosVersion)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.LastConfigError) > 0 {
+		i -= len(m.LastConfigError)
+		copy(dAtA[i:], m.LastConfigError)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.LastConfigError)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.ClusterMachineConfigSha256) > 0 {
+		i -= len(m.ClusterMachineConfigSha256)
+		copy(dAtA[i:], m.ClusterMachineConfigSha256)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ClusterMachineConfigSha256)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.ClusterMachineVersion) > 0 {
+		i -= len(m.ClusterMachineVersion)
+		copy(dAtA[i:], m.ClusterMachineVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ClusterMachineVersion)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.ClusterMachineConfigVersion) > 0 {
+		i -= len(m.ClusterMachineConfigVersion)
+		copy(dAtA[i:], m.ClusterMachineConfigVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ClusterMachineConfigVersion)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterBootstrapStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterBootstrapStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterBootstrapStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Bootstrapped {
+		i--
+		if m.Bootstrapped {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterSecretsSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterSecretsSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterSecretsSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Data) > 0 {
+		i -= len(m.Data)
+		copy(dAtA[i:], m.Data)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Data)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *LoadBalancerConfigSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LoadBalancerConfigSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *LoadBalancerConfigSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.SiderolinkEndpoint) > 0 {
+		i -= len(m.SiderolinkEndpoint)
+		copy(dAtA[i:], m.SiderolinkEndpoint)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.SiderolinkEndpoint)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.Endpoints) > 0 {
+		for iNdEx := len(m.Endpoints) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Endpoints[iNdEx])
+			copy(dAtA[i:], m.Endpoints[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Endpoints[iNdEx])))
+			i--
+			dAtA[i] = 0x1a
+		}
+	}
+	if len(m.BindPort) > 0 {
+		i -= len(m.BindPort)
+		copy(dAtA[i:], m.BindPort)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.BindPort)))
+		i--
+		dAtA[i] = 0x12
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *LoadBalancerStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *LoadBalancerStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *LoadBalancerStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Stopped {
+		i--
+		if m.Stopped {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.Healthy {
+		i--
+		if m.Healthy {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubernetesVersionSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesVersionSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubernetesVersionSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Version) > 0 {
+		i -= len(m.Version)
+		copy(dAtA[i:], m.Version)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Version)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *TalosVersionSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TalosVersionSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *TalosVersionSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.CompatibleKubernetesVersions) > 0 {
+		for iNdEx := len(m.CompatibleKubernetesVersions) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.CompatibleKubernetesVersions[iNdEx])
+			copy(dAtA[i:], m.CompatibleKubernetesVersions[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.CompatibleKubernetesVersions[iNdEx])))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Version) > 0 {
+		i -= len(m.Version)
+		copy(dAtA[i:], m.Version)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Version)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *InstallationMediaSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *InstallationMediaSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *InstallationMediaSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.NoSecureBoot {
+		i--
+		if m.NoSecureBoot {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x58
+	}
+	if len(m.Extension) > 0 {
+		i -= len(m.Extension)
+		copy(dAtA[i:], m.Extension)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Extension)))
+		i--
+		dAtA[i] = 0x4a
+	}
+	if len(m.DestFilePrefix) > 0 {
+		i -= len(m.DestFilePrefix)
+		copy(dAtA[i:], m.DestFilePrefix)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.DestFilePrefix)))
+		i--
+		dAtA[i] = 0x42
+	}
+	if len(m.SrcFilePrefix) > 0 {
+		i -= len(m.SrcFilePrefix)
+		copy(dAtA[i:], m.SrcFilePrefix)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.SrcFilePrefix)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.ContentType) > 0 {
+		i -= len(m.ContentType)
+		copy(dAtA[i:], m.ContentType)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ContentType)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.Profile) > 0 {
+		i -= len(m.Profile)
+		copy(dAtA[i:], m.Profile)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Profile)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Architecture) > 0 {
+		i -= len(m.Architecture)
+		copy(dAtA[i:], m.Architecture)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Architecture)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ConfigPatchSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ConfigPatchSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ConfigPatchSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Data) > 0 {
+		i -= len(m.Data)
+		copy(dAtA[i:], m.Data)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Data)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineSetSpec_MachineClass) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineSetSpec_MachineClass) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineSetSpec_MachineClass) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.AllocationType != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.AllocationType))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.MachineCount != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.MachineCount))
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineSetSpec_BootstrapSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineSetSpec_BootstrapSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineSetSpec_BootstrapSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Snapshot) > 0 {
+		i -= len(m.Snapshot)
+		copy(dAtA[i:], m.Snapshot)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Snapshot)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.ClusterUuid) > 0 {
+		i -= len(m.ClusterUuid)
+		copy(dAtA[i:], m.ClusterUuid)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ClusterUuid)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineSetSpec_RollingUpdateStrategyConfig) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineSetSpec_RollingUpdateStrategyConfig) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineSetSpec_RollingUpdateStrategyConfig) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.MaxParallelism != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.MaxParallelism))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineSetSpec_UpdateStrategyConfig) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineSetSpec_UpdateStrategyConfig) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineSetSpec_UpdateStrategyConfig) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Rolling != nil {
+		size, err := m.Rolling.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineSetSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineSetSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineSetSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.DeleteStrategyConfig != nil {
+		size, err := m.DeleteStrategyConfig.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x32
+	}
+	if m.UpdateStrategyConfig != nil {
+		size, err := m.UpdateStrategyConfig.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.DeleteStrategy != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.DeleteStrategy))
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.BootstrapSpec != nil {
+		size, err := m.BootstrapSpec.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.MachineClass != nil {
+		size, err := m.MachineClass.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.UpdateStrategy != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.UpdateStrategy))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *TalosUpgradeStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TalosUpgradeStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *TalosUpgradeStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.UpgradeVersions) > 0 {
+		for iNdEx := len(m.UpgradeVersions) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.UpgradeVersions[iNdEx])
+			copy(dAtA[i:], m.UpgradeVersions[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.UpgradeVersions[iNdEx])))
+			i--
+			dAtA[i] = 0x3a
+		}
+	}
+	if len(m.CurrentUpgradeVersion) > 0 {
+		i -= len(m.CurrentUpgradeVersion)
+		copy(dAtA[i:], m.CurrentUpgradeVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.CurrentUpgradeVersion)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.LastUpgradeVersion) > 0 {
+		i -= len(m.LastUpgradeVersion)
+		copy(dAtA[i:], m.LastUpgradeVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.LastUpgradeVersion)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.Status) > 0 {
+		i -= len(m.Status)
+		copy(dAtA[i:], m.Status)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Status)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.Step) > 0 {
+		i -= len(m.Step)
+		copy(dAtA[i:], m.Step)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Step)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Error) > 0 {
+		i -= len(m.Error)
+		copy(dAtA[i:], m.Error)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Error)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Phase != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Phase))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineSetStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineSetStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineSetStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.MachineClass != nil {
+		size, err := m.MachineClass.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.ConfigHash) > 0 {
+		i -= len(m.ConfigHash)
+		copy(dAtA[i:], m.ConfigHash)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ConfigHash)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if m.Machines != nil {
+		size, err := m.Machines.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.Error) > 0 {
+		i -= len(m.Error)
+		copy(dAtA[i:], m.Error)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Error)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.Ready {
+		i--
+		if m.Ready {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.Phase != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Phase))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineSetNodeSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineSetNodeSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineSetNodeSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineLabelsSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineLabelsSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineLabelsSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineStatusSnapshotSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineStatusSnapshotSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineStatusSnapshotSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.MachineStatus != nil {
+		if vtmsg, ok := interface{}(m.MachineStatus).(interface {
+			MarshalToSizedBufferVT([]byte) (int, error)
+		}); ok {
+			size, err := vtmsg.MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		} else {
+			encoded, err := proto.Marshal(m.MachineStatus)
+			if err != nil {
+				return 0, err
+			}
+			i -= len(encoded)
+			copy(dAtA[i:], encoded)
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(encoded)))
+		}
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ControlPlaneStatusSpec_Condition) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ControlPlaneStatusSpec_Condition) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ControlPlaneStatusSpec_Condition) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Severity != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Severity))
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.Status != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Status))
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.Reason) > 0 {
+		i -= len(m.Reason)
+		copy(dAtA[i:], m.Reason)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Reason)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Type != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Type))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ControlPlaneStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ControlPlaneStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ControlPlaneStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Conditions) > 0 {
+		for iNdEx := len(m.Conditions) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Conditions[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterEndpointSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterEndpointSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterEndpointSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.ManagementAddresses) > 0 {
+		for iNdEx := len(m.ManagementAddresses) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.ManagementAddresses[iNdEx])
+			copy(dAtA[i:], m.ManagementAddresses[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ManagementAddresses[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubernetesStatusSpec_NodeStatus) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesStatusSpec_NodeStatus) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubernetesStatusSpec_NodeStatus) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Ready {
+		i--
+		if m.Ready {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.KubeletVersion) > 0 {
+		i -= len(m.KubeletVersion)
+		copy(dAtA[i:], m.KubeletVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.KubeletVersion)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Nodename) > 0 {
+		i -= len(m.Nodename)
+		copy(dAtA[i:], m.Nodename)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Nodename)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubernetesStatusSpec_StaticPodStatus) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesStatusSpec_StaticPodStatus) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubernetesStatusSpec_StaticPodStatus) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Ready {
+		i--
+		if m.Ready {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.Version) > 0 {
+		i -= len(m.Version)
+		copy(dAtA[i:], m.Version)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Version)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.App) > 0 {
+		i -= len(m.App)
+		copy(dAtA[i:], m.App)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.App)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubernetesStatusSpec_NodeStaticPods) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesStatusSpec_NodeStaticPods) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubernetesStatusSpec_NodeStaticPods) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.StaticPods) > 0 {
+		for iNdEx := len(m.StaticPods) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.StaticPods[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Nodename) > 0 {
+		i -= len(m.Nodename)
+		copy(dAtA[i:], m.Nodename)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Nodename)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubernetesStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubernetesStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.StaticPods) > 0 {
+		for iNdEx := len(m.StaticPods) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.StaticPods[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Nodes) > 0 {
+		for iNdEx := len(m.Nodes) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Nodes[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubernetesUpgradeStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesUpgradeStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubernetesUpgradeStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.CurrentUpgradeVersion) > 0 {
+		i -= len(m.CurrentUpgradeVersion)
+		copy(dAtA[i:], m.CurrentUpgradeVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.CurrentUpgradeVersion)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.UpgradeVersions) > 0 {
+		for iNdEx := len(m.UpgradeVersions) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.UpgradeVersions[iNdEx])
+			copy(dAtA[i:], m.UpgradeVersions[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.UpgradeVersions[iNdEx])))
+			i--
+			dAtA[i] = 0x32
+		}
+	}
+	if len(m.LastUpgradeVersion) > 0 {
+		i -= len(m.LastUpgradeVersion)
+		copy(dAtA[i:], m.LastUpgradeVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.LastUpgradeVersion)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.Status) > 0 {
+		i -= len(m.Status)
+		copy(dAtA[i:], m.Status)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Status)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.Step) > 0 {
+		i -= len(m.Step)
+		copy(dAtA[i:], m.Step)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Step)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Error) > 0 {
+		i -= len(m.Error)
+		copy(dAtA[i:], m.Error)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Error)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Phase != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Phase))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubernetesUpgradeManifestStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesUpgradeManifestStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubernetesUpgradeManifestStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.LastFatalError) > 0 {
+		i -= len(m.LastFatalError)
+		copy(dAtA[i:], m.LastFatalError)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.LastFatalError)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.OutOfSync != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.OutOfSync))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *DestroyStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DestroyStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *DestroyStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Phase) > 0 {
+		i -= len(m.Phase)
+		copy(dAtA[i:], m.Phase)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Phase)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *OngoingTaskSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *OngoingTaskSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *OngoingTaskSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if vtmsg, ok := m.Details.(interface {
+		MarshalToSizedBufferVT([]byte) (int, error)
+	}); ok {
+		size, err := vtmsg.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+	}
+	if len(m.Title) > 0 {
+		i -= len(m.Title)
+		copy(dAtA[i:], m.Title)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Title)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *OngoingTaskSpec_TalosUpgrade) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *OngoingTaskSpec_TalosUpgrade) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.TalosUpgrade != nil {
+		size, err := m.TalosUpgrade.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OngoingTaskSpec_KubernetesUpgrade) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *OngoingTaskSpec_KubernetesUpgrade) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.KubernetesUpgrade != nil {
+		size, err := m.KubernetesUpgrade.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	return len(dAtA) - i, nil
+}
+func (m *OngoingTaskSpec_Destroy) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *OngoingTaskSpec_Destroy) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	i := len(dAtA)
+	if m.Destroy != nil {
+		size, err := m.Destroy.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x22
+	}
+	return len(dAtA) - i, nil
+}
+func (m *ClusterMachineEncryptionKeySpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterMachineEncryptionKeySpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterMachineEncryptionKeySpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Data) > 0 {
+		i -= len(m.Data)
+		copy(dAtA[i:], m.Data)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Data)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ExposedServiceSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ExposedServiceSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ExposedServiceSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.IconBase64) > 0 {
+		i -= len(m.IconBase64)
+		copy(dAtA[i:], m.IconBase64)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.IconBase64)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Label) > 0 {
+		i -= len(m.Label)
+		copy(dAtA[i:], m.Label)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Label)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Port != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Port))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *FeaturesConfigSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *FeaturesConfigSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *FeaturesConfigSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.EtcdBackupSettings != nil {
+		size, err := m.EtcdBackupSettings.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.EnableWorkloadProxying {
+		i--
+		if m.EnableWorkloadProxying {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *EtcdBackupSettings) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EtcdBackupSettings) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *EtcdBackupSettings) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.MaxInterval != nil {
+		size, err := (*durationpb1.Duration)(m.MaxInterval).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.MinInterval != nil {
+		size, err := (*durationpb1.Duration)(m.MinInterval).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.TickInterval != nil {
+		size, err := (*durationpb1.Duration)(m.TickInterval).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineClassSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineClassSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineClassSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.MatchLabels) > 0 {
+		for iNdEx := len(m.MatchLabels) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.MatchLabels[iNdEx])
+			copy(dAtA[i:], m.MatchLabels[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.MatchLabels[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineConfigGenOptionsSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *MachineConfigGenOptionsSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *MachineConfigGenOptionsSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.InstallDisk) > 0 {
+		i -= len(m.InstallDisk)
+		copy(dAtA[i:], m.InstallDisk)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.InstallDisk)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *EtcdAuditResultSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *EtcdAuditResultSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *EtcdAuditResultSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.EtcdMemberIds) > 0 {
+		var pksize2 int
+		for _, num := range m.EtcdMemberIds {
+			pksize2 += protohelpers.SizeOfVarint(uint64(num))
+		}
+		i -= pksize2
+		j1 := i
+		for _, num := range m.EtcdMemberIds {
+			for num >= 1<<7 {
+				dAtA[j1] = uint8(uint64(num)&0x7f | 0x80)
+				num >>= 7
+				j1++
+			}
+			dAtA[j1] = uint8(num)
+			j1++
+		}
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(pksize2))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubeconfigSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubeconfigSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubeconfigSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Data) > 0 {
+		i -= len(m.Data)
+		copy(dAtA[i:], m.Data)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Data)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubernetesUsageSpec_Quantity) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesUsageSpec_Quantity) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubernetesUsageSpec_Quantity) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Capacity != 0 {
+		i -= 8
+		binary.LittleEndian.PutUint64(dAtA[i:], uint64(math.Float64bits(float64(m.Capacity))))
+		i--
+		dAtA[i] = 0x19
+	}
+	if m.Limits != 0 {
+		i -= 8
+		binary.LittleEndian.PutUint64(dAtA[i:], uint64(math.Float64bits(float64(m.Limits))))
+		i--
+		dAtA[i] = 0x11
+	}
+	if m.Requests != 0 {
+		i -= 8
+		binary.LittleEndian.PutUint64(dAtA[i:], uint64(math.Float64bits(float64(m.Requests))))
+		i--
+		dAtA[i] = 0x9
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubernetesUsageSpec_Pod) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesUsageSpec_Pod) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubernetesUsageSpec_Pod) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Capacity != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Capacity))
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.Count != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Count))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *KubernetesUsageSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *KubernetesUsageSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *KubernetesUsageSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Pods != nil {
+		size, err := m.Pods.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x22
+	}
+	if m.Storage != nil {
+		size, err := m.Storage.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.Mem != nil {
+		size, err := m.Mem.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x12
+	}
+	if m.Cpu != nil {
+		size, err := m.Cpu.MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ImagePullRequestSpec_NodeImageList) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ImagePullRequestSpec_NodeImageList) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ImagePullRequestSpec_NodeImageList) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Images) > 0 {
+		for iNdEx := len(m.Images) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Images[iNdEx])
+			copy(dAtA[i:], m.Images[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Images[iNdEx])))
+			i--
+			dAtA[i] = 0x12
+		}
+	}
+	if len(m.Node) > 0 {
+		i -= len(m.Node)
+		copy(dAtA[i:], m.Node)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Node)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ImagePullRequestSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ImagePullRequestSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ImagePullRequestSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.NodeImageList) > 0 {
+		for iNdEx := len(m.NodeImageList) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.NodeImageList[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ImagePullStatusSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ImagePullStatusSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ImagePullStatusSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.RequestVersion) > 0 {
+		i -= len(m.RequestVersion)
+		copy(dAtA[i:], m.RequestVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.RequestVersion)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if m.TotalCount != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.TotalCount))
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.ProcessedCount != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.ProcessedCount))
+		i--
+		dAtA[i] = 0x20
+	}
+	if len(m.LastProcessedError) > 0 {
+		i -= len(m.LastProcessedError)
+		copy(dAtA[i:], m.LastProcessedError)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.LastProcessedError)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.LastProcessedImage) > 0 {
+		i -= len(m.LastProcessedImage)
+		copy(dAtA[i:], m.LastProcessedImage)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.LastProcessedImage)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.LastProcessedNode) > 0 {
+		i -= len(m.LastProcessedNode)
+		copy(dAtA[i:], m.LastProcessedNode)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.LastProcessedNode)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *SchematicSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SchematicSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *SchematicSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Extensions) > 0 {
+		for iNdEx := len(m.Extensions) - 1; iNdEx >= 0; iNdEx-- {
+			i -= len(m.Extensions[iNdEx])
+			copy(dAtA[i:], m.Extensions[iNdEx])
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Extensions[iNdEx])))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *TalosExtensionsSpec_Info) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TalosExtensionsSpec_Info) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *TalosExtensionsSpec_Info) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Digest) > 0 {
+		i -= len(m.Digest)
+		copy(dAtA[i:], m.Digest)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Digest)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.Ref) > 0 {
+		i -= len(m.Ref)
+		copy(dAtA[i:], m.Ref)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Ref)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.Description) > 0 {
+		i -= len(m.Description)
+		copy(dAtA[i:], m.Description)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Description)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.Version) > 0 {
+		i -= len(m.Version)
+		copy(dAtA[i:], m.Version)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Version)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Author) > 0 {
+		i -= len(m.Author)
+		copy(dAtA[i:], m.Author)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Author)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Name) > 0 {
+		i -= len(m.Name)
+		copy(dAtA[i:], m.Name)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Name)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *TalosExtensionsSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *TalosExtensionsSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *TalosExtensionsSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Items) > 0 {
+		for iNdEx := len(m.Items) - 1; iNdEx >= 0; iNdEx-- {
+			size, err := m.Items[iNdEx].MarshalToSizedBufferVT(dAtA[:i])
+			if err != nil {
+				return 0, err
+			}
+			i -= size
+			i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+			i--
+			dAtA[i] = 0xa
+		}
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *SchematicConfigurationSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SchematicConfigurationSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *SchematicConfigurationSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Target != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Target))
+		i--
+		dAtA[i] = 0x10
+	}
+	if len(m.SchematicId) > 0 {
+		i -= len(m.SchematicId)
+		copy(dAtA[i:], m.SchematicId)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.SchematicId)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *MachineSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ManagementAddress)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Connected {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineStatusSpec_HardwareStatus_Processor) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.CoreCount != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.CoreCount))
+	}
+	if m.ThreadCount != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.ThreadCount))
+	}
+	if m.Frequency != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Frequency))
+	}
+	l = len(m.Description)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Manufacturer)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineStatusSpec_HardwareStatus_MemoryModule) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.SizeMb != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.SizeMb))
+	}
+	l = len(m.Description)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineStatusSpec_HardwareStatus_BlockDevice) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Size != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Size))
+	}
+	l = len(m.Model)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.LinuxName)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Serial)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Uuid)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Wwid)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Type)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.BusPath)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.SystemDisk {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineStatusSpec_HardwareStatus) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Processors) > 0 {
+		for _, e := range m.Processors {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	if len(m.MemoryModules) > 0 {
+		for _, e := range m.MemoryModules {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	if len(m.Blockdevices) > 0 {
+		for _, e := range m.Blockdevices {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	l = len(m.Arch)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.LinuxName)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.HardwareAddress)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.SpeedMbps != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.SpeedMbps))
+	}
+	if m.LinkUp {
+		n += 2
+	}
+	l = len(m.Description)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineStatusSpec_NetworkStatus) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Hostname)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Domainname)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.Addresses) > 0 {
+		for _, s := range m.Addresses {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	if len(m.DefaultGateways) > 0 {
+		for _, s := range m.DefaultGateways {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	if len(m.NetworkLinks) > 0 {
+		for _, e := range m.NetworkLinks {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineStatusSpec_PlatformMetadata) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Platform)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Hostname)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Region)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Zone)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.InstanceType)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.InstanceId)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ProviderId)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Spot {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineStatusSpec_Schematic) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Id)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Invalid {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.TalosVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Hardware != nil {
+		l = m.Hardware.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Network != nil {
+		l = m.Network.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.LastError)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ManagementAddress)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Connected {
+		n += 2
+	}
+	if m.Maintenance {
+		n += 2
+	}
+	l = len(m.Cluster)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Role != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Role))
+	}
+	if m.PlatformMetadata != nil {
+		l = m.PlatformMetadata.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.ImageLabels) > 0 {
+		for k, v := range m.ImageLabels {
+			_ = k
+			_ = v
+			mapEntrySize := 1 + len(k) + protohelpers.SizeOfVarint(uint64(len(k))) + 1 + len(v) + protohelpers.SizeOfVarint(uint64(len(v)))
+			n += mapEntrySize + 1 + protohelpers.SizeOfVarint(uint64(mapEntrySize))
+		}
+	}
+	if m.Schematic != nil {
+		l = m.Schematic.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *TalosConfigSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Ca)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Crt)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Key)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterSpec_Features) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.EnableWorkloadProxy {
+		n += 2
+	}
+	if m.DiskEncryption {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.InstallImage)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.KubernetesVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.TalosVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Features != nil {
+		l = m.Features.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.BackupConfiguration != nil {
+		l = m.BackupConfiguration.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *EtcdBackupConf) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Interval != nil {
+		l = (*durationpb1.Duration)(m.Interval).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Enabled {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *EtcdBackupEncryptionSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.EncryptionKey)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *EtcdBackupHeader) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Version != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Version))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *EtcdBackupSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.CreatedAt != nil {
+		l = (*timestamppb1.Timestamp)(m.CreatedAt).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Snapshot)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Size != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Size))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *BackupDataSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Interval != nil {
+		l = (*durationpb1.Duration)(m.Interval).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ClusterUuid)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.EncryptionKey)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.AesCbcEncryptionSecret)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.SecretboxEncryptionSecret)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *EtcdBackupS3ConfSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Bucket)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Region)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Endpoint)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.AccessKeyId)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.SecretAccessKey)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.SessionToken)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *EtcdBackupStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Status != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Status))
+	}
+	l = len(m.Error)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.LastBackupTime != nil {
+		l = (*timestamppb1.Timestamp)(m.LastBackupTime).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.LastBackupAttempt != nil {
+		l = (*timestamppb1.Timestamp)(m.LastBackupAttempt).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *EtcdManualBackupSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.BackupAt != nil {
+		l = (*timestamppb1.Timestamp)(m.BackupAt).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *EtcdBackupStoreStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ConfigurationName)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ConfigurationError)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *EtcdBackupOverallStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ConfigurationName)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ConfigurationError)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.LastBackupStatus != nil {
+		l = m.LastBackupStatus.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterMachineSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.KubernetesVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterMachineConfigPatchesSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Patches) > 0 {
+		for _, s := range m.Patches {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterMachineTalosVersionSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.TalosVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.SchematicId)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterMachineConfigSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Data)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ClusterMachineVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.GenerationError)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *RedactedClusterMachineConfigSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Data)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterMachineIdentitySpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.NodeIdentity)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.EtcdMemberId != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.EtcdMemberId))
+	}
+	l = len(m.Nodename)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.NodeIps) > 0 {
+		for _, s := range m.NodeIps {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterMachineTemplateSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.InstallImage)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.KubernetesVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.InstallDisk)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Patch)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterMachineStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Ready {
+		n += 2
+	}
+	if m.Stage != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Stage))
+	}
+	if m.ApidAvailable {
+		n += 2
+	}
+	if m.ConfigUpToDate {
+		n += 2
+	}
+	l = len(m.LastConfigError)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ManagementAddress)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.ConfigApplyStatus != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.ConfigApplyStatus))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *Machines) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Total != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Total))
+	}
+	if m.Healthy != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Healthy))
+	}
+	if m.Connected != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Connected))
+	}
+	if m.Requested != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Requested))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Available {
+		n += 2
+	}
+	if m.Machines != nil {
+		l = m.Machines.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Phase != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Phase))
+	}
+	if m.Ready {
+		n += 2
+	}
+	if m.KubernetesAPIReady {
+		n += 2
+	}
+	if m.ControlplaneReady {
+		n += 2
+	}
+	if m.HasConnectedControlPlanes {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterUUID) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Uuid)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterConfigVersionSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Version)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterMachineConfigStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ClusterMachineConfigVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ClusterMachineVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ClusterMachineConfigSha256)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.LastConfigError)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.TalosVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.SchematicId)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterBootstrapStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Bootstrapped {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterSecretsSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Data)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *LoadBalancerConfigSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.BindPort)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.Endpoints) > 0 {
+		for _, s := range m.Endpoints {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	l = len(m.SiderolinkEndpoint)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *LoadBalancerStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Healthy {
+		n += 2
+	}
+	if m.Stopped {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubernetesVersionSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Version)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *TalosVersionSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Version)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.CompatibleKubernetesVersions) > 0 {
+		for _, s := range m.CompatibleKubernetesVersions {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *InstallationMediaSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Architecture)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Profile)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ContentType)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.SrcFilePrefix)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.DestFilePrefix)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Extension)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.NoSecureBoot {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ConfigPatchSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Data)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineSetSpec_MachineClass) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.MachineCount != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.MachineCount))
+	}
+	if m.AllocationType != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.AllocationType))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineSetSpec_BootstrapSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.ClusterUuid)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Snapshot)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineSetSpec_RollingUpdateStrategyConfig) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.MaxParallelism != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.MaxParallelism))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineSetSpec_UpdateStrategyConfig) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Rolling != nil {
+		l = m.Rolling.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineSetSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.UpdateStrategy != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.UpdateStrategy))
+	}
+	if m.MachineClass != nil {
+		l = m.MachineClass.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.BootstrapSpec != nil {
+		l = m.BootstrapSpec.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.DeleteStrategy != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.DeleteStrategy))
+	}
+	if m.UpdateStrategyConfig != nil {
+		l = m.UpdateStrategyConfig.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.DeleteStrategyConfig != nil {
+		l = m.DeleteStrategyConfig.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *TalosUpgradeStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Phase != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Phase))
+	}
+	l = len(m.Error)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Step)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Status)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.LastUpgradeVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.CurrentUpgradeVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.UpgradeVersions) > 0 {
+		for _, s := range m.UpgradeVersions {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineSetStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Phase != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Phase))
+	}
+	if m.Ready {
+		n += 2
+	}
+	l = len(m.Error)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Machines != nil {
+		l = m.Machines.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ConfigHash)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.MachineClass != nil {
+		l = m.MachineClass.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineSetNodeSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineLabelsSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineStatusSnapshotSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.MachineStatus != nil {
+		if size, ok := interface{}(m.MachineStatus).(interface {
+			SizeVT() int
+		}); ok {
+			l = size.SizeVT()
+		} else {
+			l = proto.Size(m.MachineStatus)
+		}
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ControlPlaneStatusSpec_Condition) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Type != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Type))
+	}
+	l = len(m.Reason)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Status != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Status))
+	}
+	if m.Severity != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Severity))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ControlPlaneStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Conditions) > 0 {
+		for _, e := range m.Conditions {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterEndpointSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.ManagementAddresses) > 0 {
+		for _, s := range m.ManagementAddresses {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubernetesStatusSpec_NodeStatus) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Nodename)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.KubeletVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Ready {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubernetesStatusSpec_StaticPodStatus) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.App)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Version)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Ready {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubernetesStatusSpec_NodeStaticPods) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Nodename)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.StaticPods) > 0 {
+		for _, e := range m.StaticPods {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubernetesStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Nodes) > 0 {
+		for _, e := range m.Nodes {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	if len(m.StaticPods) > 0 {
+		for _, e := range m.StaticPods {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubernetesUpgradeStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Phase != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Phase))
+	}
+	l = len(m.Error)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Step)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Status)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.LastUpgradeVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.UpgradeVersions) > 0 {
+		for _, s := range m.UpgradeVersions {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	l = len(m.CurrentUpgradeVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubernetesUpgradeManifestStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.OutOfSync != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.OutOfSync))
+	}
+	l = len(m.LastFatalError)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *DestroyStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Phase)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *OngoingTaskSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Title)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if vtmsg, ok := m.Details.(interface{ SizeVT() int }); ok {
+		n += vtmsg.SizeVT()
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *OngoingTaskSpec_TalosUpgrade) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.TalosUpgrade != nil {
+		l = m.TalosUpgrade.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	return n
+}
+func (m *OngoingTaskSpec_KubernetesUpgrade) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.KubernetesUpgrade != nil {
+		l = m.KubernetesUpgrade.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	return n
+}
+func (m *OngoingTaskSpec_Destroy) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Destroy != nil {
+		l = m.Destroy.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	return n
+}
+func (m *ClusterMachineEncryptionKeySpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Data)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ExposedServiceSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Port != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Port))
+	}
+	l = len(m.Label)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.IconBase64)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *FeaturesConfigSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.EnableWorkloadProxying {
+		n += 2
+	}
+	if m.EtcdBackupSettings != nil {
+		l = m.EtcdBackupSettings.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *EtcdBackupSettings) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.TickInterval != nil {
+		l = (*durationpb1.Duration)(m.TickInterval).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.MinInterval != nil {
+		l = (*durationpb1.Duration)(m.MinInterval).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.MaxInterval != nil {
+		l = (*durationpb1.Duration)(m.MaxInterval).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineClassSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.MatchLabels) > 0 {
+		for _, s := range m.MatchLabels {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineConfigGenOptionsSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.InstallDisk)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *EtcdAuditResultSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.EtcdMemberIds) > 0 {
+		l = 0
+		for _, e := range m.EtcdMemberIds {
+			l += protohelpers.SizeOfVarint(uint64(e))
+		}
+		n += 1 + protohelpers.SizeOfVarint(uint64(l)) + l
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubeconfigSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Data)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubernetesUsageSpec_Quantity) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Requests != 0 {
+		n += 9
+	}
+	if m.Limits != 0 {
+		n += 9
+	}
+	if m.Capacity != 0 {
+		n += 9
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubernetesUsageSpec_Pod) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Count != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Count))
+	}
+	if m.Capacity != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Capacity))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *KubernetesUsageSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Cpu != nil {
+		l = m.Cpu.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Mem != nil {
+		l = m.Mem.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Storage != nil {
+		l = m.Storage.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Pods != nil {
+		l = m.Pods.SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ImagePullRequestSpec_NodeImageList) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Node)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if len(m.Images) > 0 {
+		for _, s := range m.Images {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ImagePullRequestSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.NodeImageList) > 0 {
+		for _, e := range m.NodeImageList {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ImagePullStatusSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.LastProcessedNode)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.LastProcessedImage)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.LastProcessedError)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.ProcessedCount != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.ProcessedCount))
+	}
+	if m.TotalCount != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.TotalCount))
+	}
+	l = len(m.RequestVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *SchematicSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Extensions) > 0 {
+		for _, s := range m.Extensions {
+			l = len(s)
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *TalosExtensionsSpec_Info) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Name)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Author)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Version)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Description)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Ref)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Digest)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *TalosExtensionsSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if len(m.Items) > 0 {
+		for _, e := range m.Items {
+			l = e.SizeVT()
+			n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+		}
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *SchematicConfigurationSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.SchematicId)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Target != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Target))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *MachineSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ManagementAddress", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ManagementAddress = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Connected", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Connected = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineStatusSpec_HardwareStatus_Processor) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineStatusSpec_HardwareStatus_Processor: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineStatusSpec_HardwareStatus_Processor: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CoreCount", wireType)
+			}
+			m.CoreCount = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.CoreCount |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ThreadCount", wireType)
+			}
+			m.ThreadCount = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ThreadCount |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Frequency", wireType)
+			}
+			m.Frequency = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Frequency |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Description", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Description = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Manufacturer", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Manufacturer = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineStatusSpec_HardwareStatus_MemoryModule) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineStatusSpec_HardwareStatus_MemoryModule: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineStatusSpec_HardwareStatus_MemoryModule: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SizeMb", wireType)
+			}
+			m.SizeMb = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.SizeMb |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Description", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Description = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineStatusSpec_HardwareStatus_BlockDevice) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineStatusSpec_HardwareStatus_BlockDevice: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineStatusSpec_HardwareStatus_BlockDevice: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Size", wireType)
+			}
+			m.Size = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Size |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Model", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Model = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LinuxName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LinuxName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Serial", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Serial = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Uuid", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Uuid = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Wwid", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Wwid = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Type = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 10:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BusPath", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.BusPath = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SystemDisk", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.SystemDisk = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineStatusSpec_HardwareStatus) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineStatusSpec_HardwareStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineStatusSpec_HardwareStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Processors", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Processors = append(m.Processors, &MachineStatusSpec_HardwareStatus_Processor{})
+			if err := m.Processors[len(m.Processors)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MemoryModules", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.MemoryModules = append(m.MemoryModules, &MachineStatusSpec_HardwareStatus_MemoryModule{})
+			if err := m.MemoryModules[len(m.MemoryModules)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Blockdevices", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Blockdevices = append(m.Blockdevices, &MachineStatusSpec_HardwareStatus_BlockDevice{})
+			if err := m.Blockdevices[len(m.Blockdevices)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Arch", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Arch = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineStatusSpec_NetworkStatus_NetworkLinkStatus) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineStatusSpec_NetworkStatus_NetworkLinkStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineStatusSpec_NetworkStatus_NetworkLinkStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LinuxName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LinuxName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HardwareAddress", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.HardwareAddress = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SpeedMbps", wireType)
+			}
+			m.SpeedMbps = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.SpeedMbps |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LinkUp", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.LinkUp = bool(v != 0)
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Description", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Description = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineStatusSpec_NetworkStatus) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineStatusSpec_NetworkStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineStatusSpec_NetworkStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Hostname", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Hostname = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Domainname", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Domainname = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Addresses", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Addresses = append(m.Addresses, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DefaultGateways", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DefaultGateways = append(m.DefaultGateways, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NetworkLinks", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NetworkLinks = append(m.NetworkLinks, &MachineStatusSpec_NetworkStatus_NetworkLinkStatus{})
+			if err := m.NetworkLinks[len(m.NetworkLinks)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineStatusSpec_PlatformMetadata) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineStatusSpec_PlatformMetadata: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineStatusSpec_PlatformMetadata: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Platform", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Platform = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Hostname", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Hostname = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Region", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Region = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Zone", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Zone = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InstanceType", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.InstanceType = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InstanceId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.InstanceId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ProviderId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ProviderId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spot", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Spot = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineStatusSpec_Schematic) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineStatusSpec_Schematic: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineStatusSpec_Schematic: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Id", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Id = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Invalid", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Invalid = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TalosVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TalosVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Hardware", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Hardware == nil {
+				m.Hardware = &MachineStatusSpec_HardwareStatus{}
+			}
+			if err := m.Hardware.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Network", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Network == nil {
+				m.Network = &MachineStatusSpec_NetworkStatus{}
+			}
+			if err := m.Network.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastError", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LastError = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ManagementAddress", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ManagementAddress = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Connected", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Connected = bool(v != 0)
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Maintenance", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Maintenance = bool(v != 0)
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Cluster", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Cluster = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Role", wireType)
+			}
+			m.Role = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Role |= MachineStatusSpec_Role(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 11:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PlatformMetadata", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.PlatformMetadata == nil {
+				m.PlatformMetadata = &MachineStatusSpec_PlatformMetadata{}
+			}
+			if err := m.PlatformMetadata.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 13:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ImageLabels", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.ImageLabels == nil {
+				m.ImageLabels = make(map[string]string)
+			}
+			var mapkey string
+			var mapvalue string
+			for iNdEx < postIndex {
+				entryPreIndex := iNdEx
+				var wire uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					wire |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				fieldNum := int32(wire >> 3)
+				if fieldNum == 1 {
+					var stringLenmapkey uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapkey |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapkey := int(stringLenmapkey)
+					if intStringLenmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postStringIndexmapkey := iNdEx + intStringLenmapkey
+					if postStringIndexmapkey < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postStringIndexmapkey > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapkey = string(dAtA[iNdEx:postStringIndexmapkey])
+					iNdEx = postStringIndexmapkey
+				} else if fieldNum == 2 {
+					var stringLenmapvalue uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						stringLenmapvalue |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					intStringLenmapvalue := int(stringLenmapvalue)
+					if intStringLenmapvalue < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					postStringIndexmapvalue := iNdEx + intStringLenmapvalue
+					if postStringIndexmapvalue < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if postStringIndexmapvalue > l {
+						return io.ErrUnexpectedEOF
+					}
+					mapvalue = string(dAtA[iNdEx:postStringIndexmapvalue])
+					iNdEx = postStringIndexmapvalue
+				} else {
+					iNdEx = entryPreIndex
+					skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+					if err != nil {
+						return err
+					}
+					if (skippy < 0) || (iNdEx+skippy) < 0 {
+						return protohelpers.ErrInvalidLength
+					}
+					if (iNdEx + skippy) > postIndex {
+						return io.ErrUnexpectedEOF
+					}
+					iNdEx += skippy
+				}
+			}
+			m.ImageLabels[mapkey] = mapvalue
+			iNdEx = postIndex
+		case 14:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Schematic", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Schematic == nil {
+				m.Schematic = &MachineStatusSpec_Schematic{}
+			}
+			if err := m.Schematic.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TalosConfigSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TalosConfigSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TalosConfigSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ca", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Ca = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Crt", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Crt = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Key", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Key = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterSpec_Features) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterSpec_Features: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterSpec_Features: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EnableWorkloadProxy", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.EnableWorkloadProxy = bool(v != 0)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DiskEncryption", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.DiskEncryption = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InstallImage", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.InstallImage = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.KubernetesVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TalosVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TalosVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Features", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Features == nil {
+				m.Features = &ClusterSpec_Features{}
+			}
+			if err := m.Features.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BackupConfiguration", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.BackupConfiguration == nil {
+				m.BackupConfiguration = &EtcdBackupConf{}
+			}
+			if err := m.BackupConfiguration.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EtcdBackupConf) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EtcdBackupConf: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EtcdBackupConf: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Interval", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Interval == nil {
+				m.Interval = &durationpb.Duration{}
+			}
+			if err := (*durationpb1.Duration)(m.Interval).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Enabled", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Enabled = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EtcdBackupEncryptionSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EtcdBackupEncryptionSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EtcdBackupEncryptionSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EncryptionKey", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.EncryptionKey = append(m.EncryptionKey[:0], dAtA[iNdEx:postIndex]...)
+			if m.EncryptionKey == nil {
+				m.EncryptionKey = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EtcdBackupHeader) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EtcdBackupHeader: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EtcdBackupHeader: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			m.Version = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Version |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EtcdBackupSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EtcdBackupSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EtcdBackupSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CreatedAt", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.CreatedAt == nil {
+				m.CreatedAt = &timestamppb.Timestamp{}
+			}
+			if err := (*timestamppb1.Timestamp)(m.CreatedAt).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Snapshot", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Snapshot = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Size", wireType)
+			}
+			m.Size = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Size |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *BackupDataSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: BackupDataSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: BackupDataSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Interval", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Interval == nil {
+				m.Interval = &durationpb.Duration{}
+			}
+			if err := (*durationpb1.Duration)(m.Interval).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusterUuid", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ClusterUuid = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EncryptionKey", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.EncryptionKey = append(m.EncryptionKey[:0], dAtA[iNdEx:postIndex]...)
+			if m.EncryptionKey == nil {
+				m.EncryptionKey = []byte{}
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AesCbcEncryptionSecret", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AesCbcEncryptionSecret = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SecretboxEncryptionSecret", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SecretboxEncryptionSecret = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EtcdBackupS3ConfSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EtcdBackupS3ConfSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EtcdBackupS3ConfSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Bucket", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Bucket = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Region", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Region = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Endpoint", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Endpoint = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AccessKeyId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AccessKeyId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SecretAccessKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SecretAccessKey = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SessionToken", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SessionToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EtcdBackupStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EtcdBackupStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EtcdBackupStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			m.Status = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Status |= EtcdBackupStatusSpec_Status(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Error = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastBackupTime", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.LastBackupTime == nil {
+				m.LastBackupTime = &timestamppb.Timestamp{}
+			}
+			if err := (*timestamppb1.Timestamp)(m.LastBackupTime).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastBackupAttempt", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.LastBackupAttempt == nil {
+				m.LastBackupAttempt = &timestamppb.Timestamp{}
+			}
+			if err := (*timestamppb1.Timestamp)(m.LastBackupAttempt).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EtcdManualBackupSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EtcdManualBackupSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EtcdManualBackupSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BackupAt", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.BackupAt == nil {
+				m.BackupAt = &timestamppb.Timestamp{}
+			}
+			if err := (*timestamppb1.Timestamp)(m.BackupAt).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EtcdBackupStoreStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EtcdBackupStoreStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EtcdBackupStoreStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConfigurationName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ConfigurationName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConfigurationError", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ConfigurationError = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EtcdBackupOverallStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EtcdBackupOverallStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EtcdBackupOverallStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConfigurationName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ConfigurationName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConfigurationError", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ConfigurationError = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastBackupStatus", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.LastBackupStatus == nil {
+				m.LastBackupStatus = &EtcdBackupStatusSpec{}
+			}
+			if err := m.LastBackupStatus.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterMachineSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterMachineSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterMachineSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.KubernetesVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterMachineConfigPatchesSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterMachineConfigPatchesSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterMachineConfigPatchesSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Patches", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Patches = append(m.Patches, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterMachineTalosVersionSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterMachineTalosVersionSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterMachineTalosVersionSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TalosVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TalosVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchematicId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SchematicId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterMachineConfigSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterMachineConfigSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterMachineConfigSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = append(m.Data[:0], dAtA[iNdEx:postIndex]...)
+			if m.Data == nil {
+				m.Data = []byte{}
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusterMachineVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ClusterMachineVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field GenerationError", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.GenerationError = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *RedactedClusterMachineConfigSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: RedactedClusterMachineConfigSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: RedactedClusterMachineConfigSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterMachineIdentitySpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterMachineIdentitySpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterMachineIdentitySpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeIdentity", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NodeIdentity = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EtcdMemberId", wireType)
+			}
+			m.EtcdMemberId = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.EtcdMemberId |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Nodename", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Nodename = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeIps", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NodeIps = append(m.NodeIps, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterMachineTemplateSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterMachineTemplateSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterMachineTemplateSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InstallImage", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.InstallImage = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.KubernetesVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InstallDisk", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.InstallDisk = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Patch", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Patch = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterMachineStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterMachineStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterMachineStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ready", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Ready = bool(v != 0)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Stage", wireType)
+			}
+			m.Stage = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Stage |= ClusterMachineStatusSpec_Stage(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ApidAvailable", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.ApidAvailable = bool(v != 0)
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConfigUpToDate", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.ConfigUpToDate = bool(v != 0)
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastConfigError", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LastConfigError = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ManagementAddress", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ManagementAddress = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConfigApplyStatus", wireType)
+			}
+			m.ConfigApplyStatus = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ConfigApplyStatus |= ConfigApplyStatus(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *Machines) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: Machines: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: Machines: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Total", wireType)
+			}
+			m.Total = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Total |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Healthy", wireType)
+			}
+			m.Healthy = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Healthy |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Connected", wireType)
+			}
+			m.Connected = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Connected |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Requested", wireType)
+			}
+			m.Requested = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Requested |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Available", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Available = bool(v != 0)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Machines", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Machines == nil {
+				m.Machines = &Machines{}
+			}
+			if err := m.Machines.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Phase", wireType)
+			}
+			m.Phase = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Phase |= ClusterStatusSpec_Phase(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ready", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Ready = bool(v != 0)
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesAPIReady", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.KubernetesAPIReady = bool(v != 0)
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ControlplaneReady", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.ControlplaneReady = bool(v != 0)
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field HasConnectedControlPlanes", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.HasConnectedControlPlanes = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterUUID) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterUUID: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterUUID: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Uuid", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Uuid = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterConfigVersionSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterConfigVersionSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterConfigVersionSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterMachineConfigStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterMachineConfigStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterMachineConfigStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusterMachineConfigVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ClusterMachineConfigVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusterMachineVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ClusterMachineVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusterMachineConfigSha256", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ClusterMachineConfigSha256 = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastConfigError", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LastConfigError = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TalosVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.TalosVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchematicId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SchematicId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterBootstrapStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterBootstrapStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterBootstrapStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Bootstrapped", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Bootstrapped = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterSecretsSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterSecretsSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterSecretsSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = append(m.Data[:0], dAtA[iNdEx:postIndex]...)
+			if m.Data == nil {
+				m.Data = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LoadBalancerConfigSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LoadBalancerConfigSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LoadBalancerConfigSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BindPort", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.BindPort = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Endpoints", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Endpoints = append(m.Endpoints, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SiderolinkEndpoint", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SiderolinkEndpoint = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *LoadBalancerStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: LoadBalancerStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: LoadBalancerStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Healthy", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Healthy = bool(v != 0)
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Stopped", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Stopped = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesVersionSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesVersionSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesVersionSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TalosVersionSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TalosVersionSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TalosVersionSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CompatibleKubernetesVersions", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CompatibleKubernetesVersions = append(m.CompatibleKubernetesVersions, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *InstallationMediaSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: InstallationMediaSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: InstallationMediaSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Architecture", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Architecture = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Profile", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Profile = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ContentType", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ContentType = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SrcFilePrefix", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SrcFilePrefix = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DestFilePrefix", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.DestFilePrefix = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 9:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Extension", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Extension = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NoSecureBoot", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.NoSecureBoot = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ConfigPatchSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ConfigPatchSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ConfigPatchSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineSetSpec_MachineClass) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineSetSpec_MachineClass: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineSetSpec_MachineClass: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MachineCount", wireType)
+			}
+			m.MachineCount = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MachineCount |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AllocationType", wireType)
+			}
+			m.AllocationType = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.AllocationType |= MachineSetSpec_MachineClass_AllocationType(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineSetSpec_BootstrapSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineSetSpec_BootstrapSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineSetSpec_BootstrapSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ClusterUuid", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ClusterUuid = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Snapshot", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Snapshot = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineSetSpec_RollingUpdateStrategyConfig) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineSetSpec_RollingUpdateStrategyConfig: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineSetSpec_RollingUpdateStrategyConfig: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MaxParallelism", wireType)
+			}
+			m.MaxParallelism = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.MaxParallelism |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineSetSpec_UpdateStrategyConfig) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineSetSpec_UpdateStrategyConfig: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineSetSpec_UpdateStrategyConfig: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Rolling", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Rolling == nil {
+				m.Rolling = &MachineSetSpec_RollingUpdateStrategyConfig{}
+			}
+			if err := m.Rolling.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineSetSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineSetSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineSetSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UpdateStrategy", wireType)
+			}
+			m.UpdateStrategy = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.UpdateStrategy |= MachineSetSpec_UpdateStrategy(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MachineClass", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.MachineClass == nil {
+				m.MachineClass = &MachineSetSpec_MachineClass{}
+			}
+			if err := m.MachineClass.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BootstrapSpec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.BootstrapSpec == nil {
+				m.BootstrapSpec = &MachineSetSpec_BootstrapSpec{}
+			}
+			if err := m.BootstrapSpec.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeleteStrategy", wireType)
+			}
+			m.DeleteStrategy = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.DeleteStrategy |= MachineSetSpec_UpdateStrategy(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UpdateStrategyConfig", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.UpdateStrategyConfig == nil {
+				m.UpdateStrategyConfig = &MachineSetSpec_UpdateStrategyConfig{}
+			}
+			if err := m.UpdateStrategyConfig.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field DeleteStrategyConfig", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.DeleteStrategyConfig == nil {
+				m.DeleteStrategyConfig = &MachineSetSpec_UpdateStrategyConfig{}
+			}
+			if err := m.DeleteStrategyConfig.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TalosUpgradeStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TalosUpgradeStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TalosUpgradeStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Phase", wireType)
+			}
+			m.Phase = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Phase |= TalosUpgradeStatusSpec_Phase(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Error = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Step", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Step = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Status = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastUpgradeVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LastUpgradeVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CurrentUpgradeVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CurrentUpgradeVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UpgradeVersions", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UpgradeVersions = append(m.UpgradeVersions, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineSetStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineSetStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineSetStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Phase", wireType)
+			}
+			m.Phase = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Phase |= MachineSetPhase(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ready", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Ready = bool(v != 0)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Error = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Machines", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Machines == nil {
+				m.Machines = &Machines{}
+			}
+			if err := m.Machines.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ConfigHash", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ConfigHash = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MachineClass", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.MachineClass == nil {
+				m.MachineClass = &MachineSetSpec_MachineClass{}
+			}
+			if err := m.MachineClass.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineSetNodeSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineSetNodeSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineSetNodeSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineLabelsSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineLabelsSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineLabelsSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineStatusSnapshotSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineStatusSnapshotSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineStatusSnapshotSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MachineStatus", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.MachineStatus == nil {
+				m.MachineStatus = &machine.MachineStatusEvent{}
+			}
+			if unmarshal, ok := interface{}(m.MachineStatus).(interface {
+				UnmarshalVT([]byte) error
+			}); ok {
+				if err := unmarshal.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				if err := proto.Unmarshal(dAtA[iNdEx:postIndex], m.MachineStatus); err != nil {
+					return err
+				}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ControlPlaneStatusSpec_Condition) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ControlPlaneStatusSpec_Condition: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ControlPlaneStatusSpec_Condition: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Type", wireType)
+			}
+			m.Type = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Type |= ConditionType(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Reason", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Reason = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			m.Status = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Status |= ControlPlaneStatusSpec_Condition_Status(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Severity", wireType)
+			}
+			m.Severity = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Severity |= ControlPlaneStatusSpec_Condition_Severity(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ControlPlaneStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ControlPlaneStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ControlPlaneStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Conditions", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Conditions = append(m.Conditions, &ControlPlaneStatusSpec_Condition{})
+			if err := m.Conditions[len(m.Conditions)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterEndpointSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterEndpointSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterEndpointSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ManagementAddresses", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ManagementAddresses = append(m.ManagementAddresses, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesStatusSpec_NodeStatus) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesStatusSpec_NodeStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesStatusSpec_NodeStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Nodename", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Nodename = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubeletVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.KubeletVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ready", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Ready = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesStatusSpec_StaticPodStatus) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesStatusSpec_StaticPodStatus: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesStatusSpec_StaticPodStatus: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field App", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.App = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ready", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Ready = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesStatusSpec_NodeStaticPods) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesStatusSpec_NodeStaticPods: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesStatusSpec_NodeStaticPods: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Nodename", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Nodename = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StaticPods", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.StaticPods = append(m.StaticPods, &KubernetesStatusSpec_StaticPodStatus{})
+			if err := m.StaticPods[len(m.StaticPods)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Nodes", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Nodes = append(m.Nodes, &KubernetesStatusSpec_NodeStatus{})
+			if err := m.Nodes[len(m.Nodes)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field StaticPods", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.StaticPods = append(m.StaticPods, &KubernetesStatusSpec_NodeStaticPods{})
+			if err := m.StaticPods[len(m.StaticPods)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesUpgradeStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesUpgradeStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesUpgradeStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Phase", wireType)
+			}
+			m.Phase = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Phase |= KubernetesUpgradeStatusSpec_Phase(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Error", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Error = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Step", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Step = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Status", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Status = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastUpgradeVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LastUpgradeVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field UpgradeVersions", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.UpgradeVersions = append(m.UpgradeVersions, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CurrentUpgradeVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.CurrentUpgradeVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesUpgradeManifestStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesUpgradeManifestStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesUpgradeManifestStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field OutOfSync", wireType)
+			}
+			m.OutOfSync = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.OutOfSync |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastFatalError", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LastFatalError = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *DestroyStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DestroyStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DestroyStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Phase", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Phase = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *OngoingTaskSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: OngoingTaskSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: OngoingTaskSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Title", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Title = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TalosUpgrade", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Details.(*OngoingTaskSpec_TalosUpgrade); ok {
+				if err := oneof.TalosUpgrade.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &TalosUpgradeStatusSpec{}
+				if err := v.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Details = &OngoingTaskSpec_TalosUpgrade{TalosUpgrade: v}
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field KubernetesUpgrade", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Details.(*OngoingTaskSpec_KubernetesUpgrade); ok {
+				if err := oneof.KubernetesUpgrade.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &KubernetesUpgradeStatusSpec{}
+				if err := v.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Details = &OngoingTaskSpec_KubernetesUpgrade{KubernetesUpgrade: v}
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Destroy", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if oneof, ok := m.Details.(*OngoingTaskSpec_Destroy); ok {
+				if err := oneof.Destroy.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+			} else {
+				v := &DestroyStatusSpec{}
+				if err := v.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+					return err
+				}
+				m.Details = &OngoingTaskSpec_Destroy{Destroy: v}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterMachineEncryptionKeySpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterMachineEncryptionKeySpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterMachineEncryptionKeySpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = append(m.Data[:0], dAtA[iNdEx:postIndex]...)
+			if m.Data == nil {
+				m.Data = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ExposedServiceSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ExposedServiceSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ExposedServiceSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Port", wireType)
+			}
+			m.Port = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Port |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Label", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Label = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field IconBase64", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.IconBase64 = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *FeaturesConfigSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: FeaturesConfigSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: FeaturesConfigSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EnableWorkloadProxying", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.EnableWorkloadProxying = bool(v != 0)
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field EtcdBackupSettings", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.EtcdBackupSettings == nil {
+				m.EtcdBackupSettings = &EtcdBackupSettings{}
+			}
+			if err := m.EtcdBackupSettings.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EtcdBackupSettings) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EtcdBackupSettings: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EtcdBackupSettings: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TickInterval", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.TickInterval == nil {
+				m.TickInterval = &durationpb.Duration{}
+			}
+			if err := (*durationpb1.Duration)(m.TickInterval).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MinInterval", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.MinInterval == nil {
+				m.MinInterval = &durationpb.Duration{}
+			}
+			if err := (*durationpb1.Duration)(m.MinInterval).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MaxInterval", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.MaxInterval == nil {
+				m.MaxInterval = &durationpb.Duration{}
+			}
+			if err := (*durationpb1.Duration)(m.MaxInterval).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineClassSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineClassSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineClassSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field MatchLabels", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.MatchLabels = append(m.MatchLabels, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *MachineConfigGenOptionsSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: MachineConfigGenOptionsSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: MachineConfigGenOptionsSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InstallDisk", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.InstallDisk = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *EtcdAuditResultSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: EtcdAuditResultSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: EtcdAuditResultSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType == 0 {
+				var v uint64
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					v |= uint64(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				m.EtcdMemberIds = append(m.EtcdMemberIds, v)
+			} else if wireType == 2 {
+				var packedLen int
+				for shift := uint(0); ; shift += 7 {
+					if shift >= 64 {
+						return protohelpers.ErrIntOverflow
+					}
+					if iNdEx >= l {
+						return io.ErrUnexpectedEOF
+					}
+					b := dAtA[iNdEx]
+					iNdEx++
+					packedLen |= int(b&0x7F) << shift
+					if b < 0x80 {
+						break
+					}
+				}
+				if packedLen < 0 {
+					return protohelpers.ErrInvalidLength
+				}
+				postIndex := iNdEx + packedLen
+				if postIndex < 0 {
+					return protohelpers.ErrInvalidLength
+				}
+				if postIndex > l {
+					return io.ErrUnexpectedEOF
+				}
+				var elementCount int
+				var count int
+				for _, integer := range dAtA[iNdEx:postIndex] {
+					if integer < 128 {
+						count++
+					}
+				}
+				elementCount = count
+				if elementCount != 0 && len(m.EtcdMemberIds) == 0 {
+					m.EtcdMemberIds = make([]uint64, 0, elementCount)
+				}
+				for iNdEx < postIndex {
+					var v uint64
+					for shift := uint(0); ; shift += 7 {
+						if shift >= 64 {
+							return protohelpers.ErrIntOverflow
+						}
+						if iNdEx >= l {
+							return io.ErrUnexpectedEOF
+						}
+						b := dAtA[iNdEx]
+						iNdEx++
+						v |= uint64(b&0x7F) << shift
+						if b < 0x80 {
+							break
+						}
+					}
+					m.EtcdMemberIds = append(m.EtcdMemberIds, v)
+				}
+			} else {
+				return fmt.Errorf("proto: wrong wireType = %d for field EtcdMemberIds", wireType)
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubeconfigSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubeconfigSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubeconfigSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Data", wireType)
+			}
+			var byteLen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				byteLen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if byteLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + byteLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Data = append(m.Data[:0], dAtA[iNdEx:postIndex]...)
+			if m.Data == nil {
+				m.Data = []byte{}
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesUsageSpec_Quantity) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesUsageSpec_Quantity: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesUsageSpec_Quantity: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 1 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Requests", wireType)
+			}
+			var v uint64
+			if (iNdEx + 8) > l {
+				return io.ErrUnexpectedEOF
+			}
+			v = uint64(binary.LittleEndian.Uint64(dAtA[iNdEx:]))
+			iNdEx += 8
+			m.Requests = float64(math.Float64frombits(v))
+		case 2:
+			if wireType != 1 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Limits", wireType)
+			}
+			var v uint64
+			if (iNdEx + 8) > l {
+				return io.ErrUnexpectedEOF
+			}
+			v = uint64(binary.LittleEndian.Uint64(dAtA[iNdEx:]))
+			iNdEx += 8
+			m.Limits = float64(math.Float64frombits(v))
+		case 3:
+			if wireType != 1 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Capacity", wireType)
+			}
+			var v uint64
+			if (iNdEx + 8) > l {
+				return io.ErrUnexpectedEOF
+			}
+			v = uint64(binary.LittleEndian.Uint64(dAtA[iNdEx:]))
+			iNdEx += 8
+			m.Capacity = float64(math.Float64frombits(v))
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesUsageSpec_Pod) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesUsageSpec_Pod: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesUsageSpec_Pod: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Count", wireType)
+			}
+			m.Count = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Count |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Capacity", wireType)
+			}
+			m.Capacity = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Capacity |= int32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *KubernetesUsageSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: KubernetesUsageSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: KubernetesUsageSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Cpu", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Cpu == nil {
+				m.Cpu = &KubernetesUsageSpec_Quantity{}
+			}
+			if err := m.Cpu.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Mem", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Mem == nil {
+				m.Mem = &KubernetesUsageSpec_Quantity{}
+			}
+			if err := m.Mem.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Storage", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Storage == nil {
+				m.Storage = &KubernetesUsageSpec_Quantity{}
+			}
+			if err := m.Storage.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Pods", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Pods == nil {
+				m.Pods = &KubernetesUsageSpec_Pod{}
+			}
+			if err := m.Pods.UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ImagePullRequestSpec_NodeImageList) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ImagePullRequestSpec_NodeImageList: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ImagePullRequestSpec_NodeImageList: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Node", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Node = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Images", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Images = append(m.Images, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ImagePullRequestSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ImagePullRequestSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ImagePullRequestSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeImageList", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NodeImageList = append(m.NodeImageList, &ImagePullRequestSpec_NodeImageList{})
+			if err := m.NodeImageList[len(m.NodeImageList)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ImagePullStatusSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ImagePullStatusSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ImagePullStatusSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastProcessedNode", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LastProcessedNode = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastProcessedImage", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LastProcessedImage = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastProcessedError", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LastProcessedError = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ProcessedCount", wireType)
+			}
+			m.ProcessedCount = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.ProcessedCount |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field TotalCount", wireType)
+			}
+			m.TotalCount = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.TotalCount |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field RequestVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.RequestVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SchematicSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SchematicSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SchematicSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Extensions", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Extensions = append(m.Extensions, string(dAtA[iNdEx:postIndex]))
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TalosExtensionsSpec_Info) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TalosExtensionsSpec_Info: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TalosExtensionsSpec_Info: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Name", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Name = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Author", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Author = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Version = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Description", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Description = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Ref", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Ref = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Digest", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Digest = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *TalosExtensionsSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: TalosExtensionsSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: TalosExtensionsSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Items", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Items = append(m.Items, &TalosExtensionsSpec_Info{})
+			if err := m.Items[len(m.Items)-1].UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SchematicConfigurationSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SchematicConfigurationSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SchematicConfigurationSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field SchematicId", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.SchematicId = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Target", wireType)
+			}
+			m.Target = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Target |= SchematicConfigurationSpec_Target(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/client/api/omni/specs/omni_yaml.go b/client/api/omni/specs/omni_yaml.go
new file mode 100644
index 000000000..956786727
--- /dev/null
+++ b/client/api/omni/specs/omni_yaml.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package specs
+
+import (
+	"github.com/siderolabs/gen/xslices"
+	"gopkg.in/yaml.v3"
+)
+
+// MarshalYAML implements yaml.Marshaler interface.
+func (c *ClusterMachineSpec) MarshalYAML() (any, error) {
+	return &yaml.Node{
+		Kind: yaml.MappingNode,
+		Tag:  "!!map",
+		Content: []*yaml.Node{
+			{Kind: yaml.ScalarNode, Tag: "!!str", Value: "kubernetes_version"},
+			{Kind: yaml.ScalarNode, Tag: "!!str", Value: c.KubernetesVersion},
+		},
+	}, nil
+}
+
+// MarshalYAML implements yaml.Marshaler interface.
+func (c *ClusterMachineConfigPatchesSpec) MarshalYAML() (any, error) {
+	contents := xslices.Map(c.Patches, func(patch string) *yaml.Node {
+		style := yaml.FlowStyle
+		if len(patch) > 0 && (patch[0] == '\n' || patch[0] == ' ') {
+			style = yaml.SingleQuotedStyle
+		}
+
+		return &yaml.Node{
+			Kind:  yaml.ScalarNode,
+			Tag:   "!!str",
+			Style: style,
+			Value: patch,
+		}
+	})
+
+	return &yaml.Node{
+		Kind: yaml.MappingNode,
+		Tag:  "!!map",
+		Content: []*yaml.Node{
+			{Kind: yaml.ScalarNode, Tag: "!!str", Value: "patches"},
+			{Kind: yaml.SequenceNode, Tag: "!!seq", Content: contents},
+		},
+	}, nil
+}
diff --git a/client/api/omni/specs/siderolink.pb.go b/client/api/omni/specs/siderolink.pb.go
new file mode 100644
index 000000000..840ffc257
--- /dev/null
+++ b/client/api/omni/specs/siderolink.pb.go
@@ -0,0 +1,497 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.32.0
+// 	protoc        v4.24.4
+// source: omni/specs/siderolink.proto
+
+package specs
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// SiderolinkConfigSpec describes siderolink wireguard server state to persist it across restarts.
+type SiderolinkConfigSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	PrivateKey         string `protobuf:"bytes,1,opt,name=private_key,json=privateKey,proto3" json:"private_key,omitempty"`
+	PublicKey          string `protobuf:"bytes,2,opt,name=public_key,json=publicKey,proto3" json:"public_key,omitempty"`
+	WireguardEndpoint  string `protobuf:"bytes,3,opt,name=wireguard_endpoint,json=wireguardEndpoint,proto3" json:"wireguard_endpoint,omitempty"`
+	Subnet             string `protobuf:"bytes,5,opt,name=subnet,proto3" json:"subnet,omitempty"`
+	ServerAddress      string `protobuf:"bytes,6,opt,name=server_address,json=serverAddress,proto3" json:"server_address,omitempty"`
+	JoinToken          string `protobuf:"bytes,7,opt,name=join_token,json=joinToken,proto3" json:"join_token,omitempty"`
+	AdvertisedEndpoint string `protobuf:"bytes,8,opt,name=advertised_endpoint,json=advertisedEndpoint,proto3" json:"advertised_endpoint,omitempty"`
+}
+
+func (x *SiderolinkConfigSpec) Reset() {
+	*x = SiderolinkConfigSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_siderolink_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SiderolinkConfigSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SiderolinkConfigSpec) ProtoMessage() {}
+
+func (x *SiderolinkConfigSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_siderolink_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SiderolinkConfigSpec.ProtoReflect.Descriptor instead.
+func (*SiderolinkConfigSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_siderolink_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *SiderolinkConfigSpec) GetPrivateKey() string {
+	if x != nil {
+		return x.PrivateKey
+	}
+	return ""
+}
+
+func (x *SiderolinkConfigSpec) GetPublicKey() string {
+	if x != nil {
+		return x.PublicKey
+	}
+	return ""
+}
+
+func (x *SiderolinkConfigSpec) GetWireguardEndpoint() string {
+	if x != nil {
+		return x.WireguardEndpoint
+	}
+	return ""
+}
+
+func (x *SiderolinkConfigSpec) GetSubnet() string {
+	if x != nil {
+		return x.Subnet
+	}
+	return ""
+}
+
+func (x *SiderolinkConfigSpec) GetServerAddress() string {
+	if x != nil {
+		return x.ServerAddress
+	}
+	return ""
+}
+
+func (x *SiderolinkConfigSpec) GetJoinToken() string {
+	if x != nil {
+		return x.JoinToken
+	}
+	return ""
+}
+
+func (x *SiderolinkConfigSpec) GetAdvertisedEndpoint() string {
+	if x != nil {
+		return x.AdvertisedEndpoint
+	}
+	return ""
+}
+
+// SiderolinkConnectionSpec describes each node connection information.
+type SiderolinkSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	NodeSubnet    string `protobuf:"bytes,1,opt,name=node_subnet,json=nodeSubnet,proto3" json:"node_subnet,omitempty"`
+	NodePublicKey string `protobuf:"bytes,2,opt,name=node_public_key,json=nodePublicKey,proto3" json:"node_public_key,omitempty"`
+	LastEndpoint  string `protobuf:"bytes,3,opt,name=last_endpoint,json=lastEndpoint,proto3" json:"last_endpoint,omitempty"`
+	Connected     bool   `protobuf:"varint,4,opt,name=connected,proto3" json:"connected,omitempty"`
+}
+
+func (x *SiderolinkSpec) Reset() {
+	*x = SiderolinkSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_siderolink_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SiderolinkSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SiderolinkSpec) ProtoMessage() {}
+
+func (x *SiderolinkSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_siderolink_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SiderolinkSpec.ProtoReflect.Descriptor instead.
+func (*SiderolinkSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_siderolink_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *SiderolinkSpec) GetNodeSubnet() string {
+	if x != nil {
+		return x.NodeSubnet
+	}
+	return ""
+}
+
+func (x *SiderolinkSpec) GetNodePublicKey() string {
+	if x != nil {
+		return x.NodePublicKey
+	}
+	return ""
+}
+
+func (x *SiderolinkSpec) GetLastEndpoint() string {
+	if x != nil {
+		return x.LastEndpoint
+	}
+	return ""
+}
+
+func (x *SiderolinkSpec) GetConnected() bool {
+	if x != nil {
+		return x.Connected
+	}
+	return false
+}
+
+// SiderolinkConnectionSpec describes each node connection information.
+type SiderolinkCounterSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	BytesReceived int64                  `protobuf:"varint,1,opt,name=bytes_received,json=bytesReceived,proto3" json:"bytes_received,omitempty"`
+	BytesSent     int64                  `protobuf:"varint,2,opt,name=bytes_sent,json=bytesSent,proto3" json:"bytes_sent,omitempty"`
+	LastAlive     *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=last_alive,json=lastAlive,proto3" json:"last_alive,omitempty"`
+}
+
+func (x *SiderolinkCounterSpec) Reset() {
+	*x = SiderolinkCounterSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_siderolink_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SiderolinkCounterSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SiderolinkCounterSpec) ProtoMessage() {}
+
+func (x *SiderolinkCounterSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_siderolink_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SiderolinkCounterSpec.ProtoReflect.Descriptor instead.
+func (*SiderolinkCounterSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_siderolink_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *SiderolinkCounterSpec) GetBytesReceived() int64 {
+	if x != nil {
+		return x.BytesReceived
+	}
+	return 0
+}
+
+func (x *SiderolinkCounterSpec) GetBytesSent() int64 {
+	if x != nil {
+		return x.BytesSent
+	}
+	return 0
+}
+
+func (x *SiderolinkCounterSpec) GetLastAlive() *timestamppb.Timestamp {
+	if x != nil {
+		return x.LastAlive
+	}
+	return nil
+}
+
+// ConnectionParamsSpec describes generated kernel parameters for connecting
+// the Talos node to Omni.
+type ConnectionParamsSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Args keeps the generated kernel arguments string.
+	Args string `protobuf:"bytes,1,opt,name=args,proto3" json:"args,omitempty"`
+	// ApiEndpoint is the service gRPC API endpoint (external domain/ip, schema and port).
+	ApiEndpoint string `protobuf:"bytes,2,opt,name=api_endpoint,json=apiEndpoint,proto3" json:"api_endpoint,omitempty"`
+	// WireguardEndpoint is the service IP visible from the internal SideroLink network.
+	WireguardEndpoint string `protobuf:"bytes,3,opt,name=wireguard_endpoint,json=wireguardEndpoint,proto3" json:"wireguard_endpoint,omitempty"`
+	// JoinToken is a join token required to connect to SideroLink.
+	JoinToken string `protobuf:"bytes,4,opt,name=join_token,json=joinToken,proto3" json:"join_token,omitempty"`
+}
+
+func (x *ConnectionParamsSpec) Reset() {
+	*x = ConnectionParamsSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_siderolink_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ConnectionParamsSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ConnectionParamsSpec) ProtoMessage() {}
+
+func (x *ConnectionParamsSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_siderolink_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ConnectionParamsSpec.ProtoReflect.Descriptor instead.
+func (*ConnectionParamsSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_siderolink_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *ConnectionParamsSpec) GetArgs() string {
+	if x != nil {
+		return x.Args
+	}
+	return ""
+}
+
+func (x *ConnectionParamsSpec) GetApiEndpoint() string {
+	if x != nil {
+		return x.ApiEndpoint
+	}
+	return ""
+}
+
+func (x *ConnectionParamsSpec) GetWireguardEndpoint() string {
+	if x != nil {
+		return x.WireguardEndpoint
+	}
+	return ""
+}
+
+func (x *ConnectionParamsSpec) GetJoinToken() string {
+	if x != nil {
+		return x.JoinToken
+	}
+	return ""
+}
+
+var File_omni_specs_siderolink_proto protoreflect.FileDescriptor
+
+var file_omni_specs_siderolink_proto_rawDesc = []byte{
+	0x0a, 0x1b, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2f, 0x73, 0x69, 0x64,
+	0x65, 0x72, 0x6f, 0x6c, 0x69, 0x6e, 0x6b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x05, 0x73,
+	0x70, 0x65, 0x63, 0x73, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x94, 0x02, 0x0a, 0x14, 0x53, 0x69, 0x64, 0x65, 0x72, 0x6f,
+	0x6c, 0x69, 0x6e, 0x6b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x53, 0x70, 0x65, 0x63, 0x12, 0x1f,
+	0x0a, 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12,
+	0x1d, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x09, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x2d,
+	0x0a, 0x12, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x5f, 0x65, 0x6e, 0x64, 0x70,
+	0x6f, 0x69, 0x6e, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x77, 0x69, 0x72, 0x65,
+	0x67, 0x75, 0x61, 0x72, 0x64, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x16, 0x0a,
+	0x06, 0x73, 0x75, 0x62, 0x6e, 0x65, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73,
+	0x75, 0x62, 0x6e, 0x65, 0x74, 0x12, 0x25, 0x0a, 0x0e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f,
+	0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x73,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x1d, 0x0a, 0x0a,
+	0x6a, 0x6f, 0x69, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x6a, 0x6f, 0x69, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x2f, 0x0a, 0x13, 0x61,
+	0x64, 0x76, 0x65, 0x72, 0x74, 0x69, 0x73, 0x65, 0x64, 0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69,
+	0x6e, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x61, 0x64, 0x76, 0x65, 0x72, 0x74,
+	0x69, 0x73, 0x65, 0x64, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x22, 0xa8, 0x01, 0x0a,
+	0x0e, 0x53, 0x69, 0x64, 0x65, 0x72, 0x6f, 0x6c, 0x69, 0x6e, 0x6b, 0x53, 0x70, 0x65, 0x63, 0x12,
+	0x1f, 0x0a, 0x0b, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x73, 0x75, 0x62, 0x6e, 0x65, 0x74, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6e, 0x6f, 0x64, 0x65, 0x53, 0x75, 0x62, 0x6e, 0x65, 0x74,
+	0x12, 0x26, 0x0a, 0x0f, 0x6e, 0x6f, 0x64, 0x65, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f,
+	0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x6e, 0x6f, 0x64, 0x65, 0x50,
+	0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x23, 0x0a, 0x0d, 0x6c, 0x61, 0x73, 0x74,
+	0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0c, 0x6c, 0x61, 0x73, 0x74, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x1c, 0x0a,
+	0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x4a, 0x04, 0x08, 0x05, 0x10,
+	0x06, 0x4a, 0x04, 0x08, 0x06, 0x10, 0x07, 0x22, 0x98, 0x01, 0x0a, 0x15, 0x53, 0x69, 0x64, 0x65,
+	0x72, 0x6f, 0x6c, 0x69, 0x6e, 0x6b, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x65, 0x72, 0x53, 0x70, 0x65,
+	0x63, 0x12, 0x25, 0x0a, 0x0e, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f, 0x72, 0x65, 0x63, 0x65, 0x69,
+	0x76, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x62, 0x79, 0x74, 0x65, 0x73,
+	0x52, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x62, 0x79, 0x74, 0x65,
+	0x73, 0x5f, 0x73, 0x65, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x62, 0x79,
+	0x74, 0x65, 0x73, 0x53, 0x65, 0x6e, 0x74, 0x12, 0x39, 0x0a, 0x0a, 0x6c, 0x61, 0x73, 0x74, 0x5f,
+	0x61, 0x6c, 0x69, 0x76, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x6c, 0x61, 0x73, 0x74, 0x41, 0x6c, 0x69,
+	0x76, 0x65, 0x22, 0x9b, 0x01, 0x0a, 0x14, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x12, 0x0a, 0x04, 0x61,
+	0x72, 0x67, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x61, 0x72, 0x67, 0x73, 0x12,
+	0x21, 0x0a, 0x0c, 0x61, 0x70, 0x69, 0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x61, 0x70, 0x69, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69,
+	0x6e, 0x74, 0x12, 0x2d, 0x0a, 0x12, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x5f,
+	0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11,
+	0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6a, 0x6f, 0x69, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6a, 0x6f, 0x69, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
+	0x42, 0x32, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73,
+	0x69, 0x64, 0x65, 0x72, 0x6f, 0x6c, 0x61, 0x62, 0x73, 0x2f, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x63,
+	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x73,
+	0x70, 0x65, 0x63, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_omni_specs_siderolink_proto_rawDescOnce sync.Once
+	file_omni_specs_siderolink_proto_rawDescData = file_omni_specs_siderolink_proto_rawDesc
+)
+
+func file_omni_specs_siderolink_proto_rawDescGZIP() []byte {
+	file_omni_specs_siderolink_proto_rawDescOnce.Do(func() {
+		file_omni_specs_siderolink_proto_rawDescData = protoimpl.X.CompressGZIP(file_omni_specs_siderolink_proto_rawDescData)
+	})
+	return file_omni_specs_siderolink_proto_rawDescData
+}
+
+var file_omni_specs_siderolink_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_omni_specs_siderolink_proto_goTypes = []interface{}{
+	(*SiderolinkConfigSpec)(nil),  // 0: specs.SiderolinkConfigSpec
+	(*SiderolinkSpec)(nil),        // 1: specs.SiderolinkSpec
+	(*SiderolinkCounterSpec)(nil), // 2: specs.SiderolinkCounterSpec
+	(*ConnectionParamsSpec)(nil),  // 3: specs.ConnectionParamsSpec
+	(*timestamppb.Timestamp)(nil), // 4: google.protobuf.Timestamp
+}
+var file_omni_specs_siderolink_proto_depIdxs = []int32{
+	4, // 0: specs.SiderolinkCounterSpec.last_alive:type_name -> google.protobuf.Timestamp
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_omni_specs_siderolink_proto_init() }
+func file_omni_specs_siderolink_proto_init() {
+	if File_omni_specs_siderolink_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_omni_specs_siderolink_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SiderolinkConfigSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_siderolink_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SiderolinkSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_siderolink_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SiderolinkCounterSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_siderolink_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ConnectionParamsSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_omni_specs_siderolink_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_omni_specs_siderolink_proto_goTypes,
+		DependencyIndexes: file_omni_specs_siderolink_proto_depIdxs,
+		MessageInfos:      file_omni_specs_siderolink_proto_msgTypes,
+	}.Build()
+	File_omni_specs_siderolink_proto = out.File
+	file_omni_specs_siderolink_proto_rawDesc = nil
+	file_omni_specs_siderolink_proto_goTypes = nil
+	file_omni_specs_siderolink_proto_depIdxs = nil
+}
diff --git a/client/api/omni/specs/siderolink.proto b/client/api/omni/specs/siderolink.proto
new file mode 100644
index 000000000..b88bdaeb7
--- /dev/null
+++ b/client/api/omni/specs/siderolink.proto
@@ -0,0 +1,47 @@
+syntax = "proto3";
+package specs;
+
+option go_package = "github.com/siderolabs/omni/client/api/omni/specs";
+
+import "google/protobuf/timestamp.proto";
+
+// SiderolinkConfigSpec describes siderolink wireguard server state to persist it across restarts.
+message SiderolinkConfigSpec {
+  string private_key = 1;
+  string public_key = 2;
+  string wireguard_endpoint = 3;
+  string subnet = 5;
+  string server_address = 6;
+  string join_token = 7;
+  string advertised_endpoint = 8;
+}
+
+// SiderolinkConnectionSpec describes each node connection information.
+message SiderolinkSpec {
+  string node_subnet = 1;
+  string node_public_key = 2;
+  string last_endpoint = 3;
+  bool connected = 4;
+  reserved 5;
+  reserved 6;
+}
+
+// SiderolinkConnectionSpec describes each node connection information.
+message SiderolinkCounterSpec {
+  int64 bytes_received = 1;
+  int64 bytes_sent = 2;
+  google.protobuf.Timestamp last_alive = 3;
+}
+
+// ConnectionParamsSpec describes generated kernel parameters for connecting
+// the Talos node to Omni.
+message ConnectionParamsSpec {
+  // Args keeps the generated kernel arguments string.
+  string args = 1;
+  // ApiEndpoint is the service gRPC API endpoint (external domain/ip, schema and port).
+  string api_endpoint = 2;
+  // WireguardEndpoint is the service IP visible from the internal SideroLink network.
+  string wireguard_endpoint = 3;
+  // JoinToken is a join token required to connect to SideroLink.
+  string join_token = 4;
+}
diff --git a/client/api/omni/specs/siderolink_vtproto.pb.go b/client/api/omni/specs/siderolink_vtproto.pb.go
new file mode 100644
index 000000000..da8880a91
--- /dev/null
+++ b/client/api/omni/specs/siderolink_vtproto.pb.go
@@ -0,0 +1,1339 @@
+// Code generated by protoc-gen-go-vtproto. DO NOT EDIT.
+// protoc-gen-go-vtproto version: v0.6.0
+// source: omni/specs/siderolink.proto
+
+package specs
+
+import (
+	fmt "fmt"
+	io "io"
+
+	protohelpers "github.com/planetscale/vtprotobuf/protohelpers"
+	timestamppb1 "github.com/planetscale/vtprotobuf/types/known/timestamppb"
+	proto "google.golang.org/protobuf/proto"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+func (m *SiderolinkConfigSpec) CloneVT() *SiderolinkConfigSpec {
+	if m == nil {
+		return (*SiderolinkConfigSpec)(nil)
+	}
+	r := new(SiderolinkConfigSpec)
+	r.PrivateKey = m.PrivateKey
+	r.PublicKey = m.PublicKey
+	r.WireguardEndpoint = m.WireguardEndpoint
+	r.Subnet = m.Subnet
+	r.ServerAddress = m.ServerAddress
+	r.JoinToken = m.JoinToken
+	r.AdvertisedEndpoint = m.AdvertisedEndpoint
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *SiderolinkConfigSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *SiderolinkSpec) CloneVT() *SiderolinkSpec {
+	if m == nil {
+		return (*SiderolinkSpec)(nil)
+	}
+	r := new(SiderolinkSpec)
+	r.NodeSubnet = m.NodeSubnet
+	r.NodePublicKey = m.NodePublicKey
+	r.LastEndpoint = m.LastEndpoint
+	r.Connected = m.Connected
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *SiderolinkSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *SiderolinkCounterSpec) CloneVT() *SiderolinkCounterSpec {
+	if m == nil {
+		return (*SiderolinkCounterSpec)(nil)
+	}
+	r := new(SiderolinkCounterSpec)
+	r.BytesReceived = m.BytesReceived
+	r.BytesSent = m.BytesSent
+	r.LastAlive = (*timestamppb.Timestamp)((*timestamppb1.Timestamp)(m.LastAlive).CloneVT())
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *SiderolinkCounterSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ConnectionParamsSpec) CloneVT() *ConnectionParamsSpec {
+	if m == nil {
+		return (*ConnectionParamsSpec)(nil)
+	}
+	r := new(ConnectionParamsSpec)
+	r.Args = m.Args
+	r.ApiEndpoint = m.ApiEndpoint
+	r.WireguardEndpoint = m.WireguardEndpoint
+	r.JoinToken = m.JoinToken
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ConnectionParamsSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (this *SiderolinkConfigSpec) EqualVT(that *SiderolinkConfigSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.PrivateKey != that.PrivateKey {
+		return false
+	}
+	if this.PublicKey != that.PublicKey {
+		return false
+	}
+	if this.WireguardEndpoint != that.WireguardEndpoint {
+		return false
+	}
+	if this.Subnet != that.Subnet {
+		return false
+	}
+	if this.ServerAddress != that.ServerAddress {
+		return false
+	}
+	if this.JoinToken != that.JoinToken {
+		return false
+	}
+	if this.AdvertisedEndpoint != that.AdvertisedEndpoint {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *SiderolinkConfigSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*SiderolinkConfigSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *SiderolinkSpec) EqualVT(that *SiderolinkSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.NodeSubnet != that.NodeSubnet {
+		return false
+	}
+	if this.NodePublicKey != that.NodePublicKey {
+		return false
+	}
+	if this.LastEndpoint != that.LastEndpoint {
+		return false
+	}
+	if this.Connected != that.Connected {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *SiderolinkSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*SiderolinkSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *SiderolinkCounterSpec) EqualVT(that *SiderolinkCounterSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.BytesReceived != that.BytesReceived {
+		return false
+	}
+	if this.BytesSent != that.BytesSent {
+		return false
+	}
+	if !(*timestamppb1.Timestamp)(this.LastAlive).EqualVT((*timestamppb1.Timestamp)(that.LastAlive)) {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *SiderolinkCounterSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*SiderolinkCounterSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ConnectionParamsSpec) EqualVT(that *ConnectionParamsSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Args != that.Args {
+		return false
+	}
+	if this.ApiEndpoint != that.ApiEndpoint {
+		return false
+	}
+	if this.WireguardEndpoint != that.WireguardEndpoint {
+		return false
+	}
+	if this.JoinToken != that.JoinToken {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ConnectionParamsSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ConnectionParamsSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (m *SiderolinkConfigSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SiderolinkConfigSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *SiderolinkConfigSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.AdvertisedEndpoint) > 0 {
+		i -= len(m.AdvertisedEndpoint)
+		copy(dAtA[i:], m.AdvertisedEndpoint)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.AdvertisedEndpoint)))
+		i--
+		dAtA[i] = 0x42
+	}
+	if len(m.JoinToken) > 0 {
+		i -= len(m.JoinToken)
+		copy(dAtA[i:], m.JoinToken)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.JoinToken)))
+		i--
+		dAtA[i] = 0x3a
+	}
+	if len(m.ServerAddress) > 0 {
+		i -= len(m.ServerAddress)
+		copy(dAtA[i:], m.ServerAddress)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ServerAddress)))
+		i--
+		dAtA[i] = 0x32
+	}
+	if len(m.Subnet) > 0 {
+		i -= len(m.Subnet)
+		copy(dAtA[i:], m.Subnet)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Subnet)))
+		i--
+		dAtA[i] = 0x2a
+	}
+	if len(m.WireguardEndpoint) > 0 {
+		i -= len(m.WireguardEndpoint)
+		copy(dAtA[i:], m.WireguardEndpoint)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.WireguardEndpoint)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.PublicKey) > 0 {
+		i -= len(m.PublicKey)
+		copy(dAtA[i:], m.PublicKey)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.PublicKey)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.PrivateKey) > 0 {
+		i -= len(m.PrivateKey)
+		copy(dAtA[i:], m.PrivateKey)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.PrivateKey)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *SiderolinkSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SiderolinkSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *SiderolinkSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Connected {
+		i--
+		if m.Connected {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if len(m.LastEndpoint) > 0 {
+		i -= len(m.LastEndpoint)
+		copy(dAtA[i:], m.LastEndpoint)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.LastEndpoint)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.NodePublicKey) > 0 {
+		i -= len(m.NodePublicKey)
+		copy(dAtA[i:], m.NodePublicKey)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.NodePublicKey)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.NodeSubnet) > 0 {
+		i -= len(m.NodeSubnet)
+		copy(dAtA[i:], m.NodeSubnet)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.NodeSubnet)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *SiderolinkCounterSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SiderolinkCounterSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *SiderolinkCounterSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.LastAlive != nil {
+		size, err := (*timestamppb1.Timestamp)(m.LastAlive).MarshalToSizedBufferVT(dAtA[:i])
+		if err != nil {
+			return 0, err
+		}
+		i -= size
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(size))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if m.BytesSent != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.BytesSent))
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.BytesReceived != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.BytesReceived))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ConnectionParamsSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ConnectionParamsSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ConnectionParamsSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.JoinToken) > 0 {
+		i -= len(m.JoinToken)
+		copy(dAtA[i:], m.JoinToken)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.JoinToken)))
+		i--
+		dAtA[i] = 0x22
+	}
+	if len(m.WireguardEndpoint) > 0 {
+		i -= len(m.WireguardEndpoint)
+		copy(dAtA[i:], m.WireguardEndpoint)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.WireguardEndpoint)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.ApiEndpoint) > 0 {
+		i -= len(m.ApiEndpoint)
+		copy(dAtA[i:], m.ApiEndpoint)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.ApiEndpoint)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.Args) > 0 {
+		i -= len(m.Args)
+		copy(dAtA[i:], m.Args)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Args)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *SiderolinkConfigSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.PrivateKey)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.PublicKey)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.WireguardEndpoint)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Subnet)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ServerAddress)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.JoinToken)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.AdvertisedEndpoint)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *SiderolinkSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.NodeSubnet)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.NodePublicKey)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.LastEndpoint)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.Connected {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *SiderolinkCounterSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.BytesReceived != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.BytesReceived))
+	}
+	if m.BytesSent != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.BytesSent))
+	}
+	if m.LastAlive != nil {
+		l = (*timestamppb1.Timestamp)(m.LastAlive).SizeVT()
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ConnectionParamsSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Args)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.ApiEndpoint)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.WireguardEndpoint)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.JoinToken)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *SiderolinkConfigSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SiderolinkConfigSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SiderolinkConfigSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PrivateKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PrivateKey = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field PublicKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.PublicKey = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WireguardEndpoint", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.WireguardEndpoint = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Subnet", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Subnet = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ServerAddress", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ServerAddress = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 7:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field JoinToken", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.JoinToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 8:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field AdvertisedEndpoint", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.AdvertisedEndpoint = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SiderolinkSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SiderolinkSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SiderolinkSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodeSubnet", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NodeSubnet = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field NodePublicKey", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.NodePublicKey = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastEndpoint", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.LastEndpoint = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Connected", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Connected = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SiderolinkCounterSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SiderolinkCounterSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SiderolinkCounterSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BytesReceived", wireType)
+			}
+			m.BytesReceived = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.BytesReceived |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BytesSent", wireType)
+			}
+			m.BytesSent = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.BytesSent |= int64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field LastAlive", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + msglen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.LastAlive == nil {
+				m.LastAlive = &timestamppb.Timestamp{}
+			}
+			if err := (*timestamppb1.Timestamp)(m.LastAlive).UnmarshalVT(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ConnectionParamsSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ConnectionParamsSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ConnectionParamsSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Args", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Args = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ApiEndpoint", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ApiEndpoint = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field WireguardEndpoint", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.WireguardEndpoint = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field JoinToken", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.JoinToken = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/client/api/omni/specs/system.pb.go b/client/api/omni/specs/system.pb.go
new file mode 100644
index 000000000..f853685a7
--- /dev/null
+++ b/client/api/omni/specs/system.pb.go
@@ -0,0 +1,286 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.32.0
+// 	protoc        v4.24.4
+// source: omni/specs/system.proto
+
+package specs
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// DBVersionSpec keeps the current version of the COSI DB.
+type DBVersionSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Version uint64 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"`
+}
+
+func (x *DBVersionSpec) Reset() {
+	*x = DBVersionSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_system_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DBVersionSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DBVersionSpec) ProtoMessage() {}
+
+func (x *DBVersionSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_system_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DBVersionSpec.ProtoReflect.Descriptor instead.
+func (*DBVersionSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_system_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *DBVersionSpec) GetVersion() uint64 {
+	if x != nil {
+		return x.Version
+	}
+	return 0
+}
+
+// SysVersionSpec keeps the current version of Omni.
+type SysVersionSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	BackendVersion    string `protobuf:"bytes,1,opt,name=backend_version,json=backendVersion,proto3" json:"backend_version,omitempty"`
+	InstanceName      string `protobuf:"bytes,2,opt,name=instance_name,json=instanceName,proto3" json:"instance_name,omitempty"`
+	BackendApiVersion uint32 `protobuf:"varint,3,opt,name=backend_api_version,json=backendApiVersion,proto3" json:"backend_api_version,omitempty"`
+}
+
+func (x *SysVersionSpec) Reset() {
+	*x = SysVersionSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_system_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SysVersionSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SysVersionSpec) ProtoMessage() {}
+
+func (x *SysVersionSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_system_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SysVersionSpec.ProtoReflect.Descriptor instead.
+func (*SysVersionSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_system_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *SysVersionSpec) GetBackendVersion() string {
+	if x != nil {
+		return x.BackendVersion
+	}
+	return ""
+}
+
+func (x *SysVersionSpec) GetInstanceName() string {
+	if x != nil {
+		return x.InstanceName
+	}
+	return ""
+}
+
+func (x *SysVersionSpec) GetBackendApiVersion() uint32 {
+	if x != nil {
+		return x.BackendApiVersion
+	}
+	return 0
+}
+
+// CertRefreshTickSpec is a certificate refresh tick.
+type CertRefreshTickSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *CertRefreshTickSpec) Reset() {
+	*x = CertRefreshTickSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_system_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CertRefreshTickSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CertRefreshTickSpec) ProtoMessage() {}
+
+func (x *CertRefreshTickSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_system_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CertRefreshTickSpec.ProtoReflect.Descriptor instead.
+func (*CertRefreshTickSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_system_proto_rawDescGZIP(), []int{2}
+}
+
+var File_omni_specs_system_proto protoreflect.FileDescriptor
+
+var file_omni_specs_system_proto_rawDesc = []byte{
+	0x0a, 0x17, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2f, 0x73, 0x79, 0x73,
+	0x74, 0x65, 0x6d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x05, 0x73, 0x70, 0x65, 0x63, 0x73,
+	0x22, 0x29, 0x0a, 0x0d, 0x44, 0x42, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x70, 0x65,
+	0x63, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x8e, 0x01, 0x0a, 0x0e,
+	0x53, 0x79, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x70, 0x65, 0x63, 0x12, 0x27,
+	0x0a, 0x0f, 0x62, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x62, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64,
+	0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x69, 0x6e, 0x73, 0x74, 0x61,
+	0x6e, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
+	0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2e, 0x0a, 0x13,
+	0x62, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x5f, 0x61, 0x70, 0x69, 0x5f, 0x76, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x11, 0x62, 0x61, 0x63, 0x6b, 0x65,
+	0x6e, 0x64, 0x41, 0x70, 0x69, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x15, 0x0a, 0x13,
+	0x43, 0x65, 0x72, 0x74, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x54, 0x69, 0x63, 0x6b, 0x53,
+	0x70, 0x65, 0x63, 0x42, 0x32, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
+	0x6d, 0x2f, 0x73, 0x69, 0x64, 0x65, 0x72, 0x6f, 0x6c, 0x61, 0x62, 0x73, 0x2f, 0x6f, 0x6d, 0x6e,
+	0x69, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x6f, 0x6d, 0x6e,
+	0x69, 0x2f, 0x73, 0x70, 0x65, 0x63, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_omni_specs_system_proto_rawDescOnce sync.Once
+	file_omni_specs_system_proto_rawDescData = file_omni_specs_system_proto_rawDesc
+)
+
+func file_omni_specs_system_proto_rawDescGZIP() []byte {
+	file_omni_specs_system_proto_rawDescOnce.Do(func() {
+		file_omni_specs_system_proto_rawDescData = protoimpl.X.CompressGZIP(file_omni_specs_system_proto_rawDescData)
+	})
+	return file_omni_specs_system_proto_rawDescData
+}
+
+var file_omni_specs_system_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_omni_specs_system_proto_goTypes = []interface{}{
+	(*DBVersionSpec)(nil),       // 0: specs.DBVersionSpec
+	(*SysVersionSpec)(nil),      // 1: specs.SysVersionSpec
+	(*CertRefreshTickSpec)(nil), // 2: specs.CertRefreshTickSpec
+}
+var file_omni_specs_system_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_omni_specs_system_proto_init() }
+func file_omni_specs_system_proto_init() {
+	if File_omni_specs_system_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_omni_specs_system_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DBVersionSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_system_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SysVersionSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_system_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CertRefreshTickSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_omni_specs_system_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_omni_specs_system_proto_goTypes,
+		DependencyIndexes: file_omni_specs_system_proto_depIdxs,
+		MessageInfos:      file_omni_specs_system_proto_msgTypes,
+	}.Build()
+	File_omni_specs_system_proto = out.File
+	file_omni_specs_system_proto_rawDesc = nil
+	file_omni_specs_system_proto_goTypes = nil
+	file_omni_specs_system_proto_depIdxs = nil
+}
diff --git a/client/api/omni/specs/system.proto b/client/api/omni/specs/system.proto
new file mode 100644
index 000000000..3cf3c496a
--- /dev/null
+++ b/client/api/omni/specs/system.proto
@@ -0,0 +1,20 @@
+syntax = "proto3";
+package specs;
+
+option go_package = "github.com/siderolabs/omni/client/api/omni/specs";
+
+// DBVersionSpec keeps the current version of the COSI DB.
+message DBVersionSpec {
+  uint64 version = 1;
+}
+
+// SysVersionSpec keeps the current version of Omni.
+message SysVersionSpec {
+  string backend_version = 1;
+  string instance_name = 2;
+  uint32 backend_api_version = 3;
+}
+
+// CertRefreshTickSpec is a certificate refresh tick.
+message CertRefreshTickSpec {
+}
diff --git a/client/api/omni/specs/system_vtproto.pb.go b/client/api/omni/specs/system_vtproto.pb.go
new file mode 100644
index 000000000..3e3dfcf77
--- /dev/null
+++ b/client/api/omni/specs/system_vtproto.pb.go
@@ -0,0 +1,556 @@
+// Code generated by protoc-gen-go-vtproto. DO NOT EDIT.
+// protoc-gen-go-vtproto version: v0.6.0
+// source: omni/specs/system.proto
+
+package specs
+
+import (
+	fmt "fmt"
+	io "io"
+
+	protohelpers "github.com/planetscale/vtprotobuf/protohelpers"
+	proto "google.golang.org/protobuf/proto"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+func (m *DBVersionSpec) CloneVT() *DBVersionSpec {
+	if m == nil {
+		return (*DBVersionSpec)(nil)
+	}
+	r := new(DBVersionSpec)
+	r.Version = m.Version
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *DBVersionSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *SysVersionSpec) CloneVT() *SysVersionSpec {
+	if m == nil {
+		return (*SysVersionSpec)(nil)
+	}
+	r := new(SysVersionSpec)
+	r.BackendVersion = m.BackendVersion
+	r.InstanceName = m.InstanceName
+	r.BackendApiVersion = m.BackendApiVersion
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *SysVersionSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *CertRefreshTickSpec) CloneVT() *CertRefreshTickSpec {
+	if m == nil {
+		return (*CertRefreshTickSpec)(nil)
+	}
+	r := new(CertRefreshTickSpec)
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *CertRefreshTickSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (this *DBVersionSpec) EqualVT(that *DBVersionSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Version != that.Version {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *DBVersionSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*DBVersionSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *SysVersionSpec) EqualVT(that *SysVersionSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.BackendVersion != that.BackendVersion {
+		return false
+	}
+	if this.InstanceName != that.InstanceName {
+		return false
+	}
+	if this.BackendApiVersion != that.BackendApiVersion {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *SysVersionSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*SysVersionSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *CertRefreshTickSpec) EqualVT(that *CertRefreshTickSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CertRefreshTickSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*CertRefreshTickSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (m *DBVersionSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *DBVersionSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *DBVersionSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.Version != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.Version))
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *SysVersionSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *SysVersionSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *SysVersionSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.BackendApiVersion != 0 {
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(m.BackendApiVersion))
+		i--
+		dAtA[i] = 0x18
+	}
+	if len(m.InstanceName) > 0 {
+		i -= len(m.InstanceName)
+		copy(dAtA[i:], m.InstanceName)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.InstanceName)))
+		i--
+		dAtA[i] = 0x12
+	}
+	if len(m.BackendVersion) > 0 {
+		i -= len(m.BackendVersion)
+		copy(dAtA[i:], m.BackendVersion)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.BackendVersion)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CertRefreshTickSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CertRefreshTickSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CertRefreshTickSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *DBVersionSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.Version != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.Version))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *SysVersionSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.BackendVersion)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.InstanceName)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	if m.BackendApiVersion != 0 {
+		n += 1 + protohelpers.SizeOfVarint(uint64(m.BackendApiVersion))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CertRefreshTickSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *DBVersionSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: DBVersionSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: DBVersionSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Version", wireType)
+			}
+			m.Version = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Version |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *SysVersionSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: SysVersionSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: SysVersionSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BackendVersion", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.BackendVersion = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field InstanceName", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.InstanceName = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field BackendApiVersion", wireType)
+			}
+			m.BackendApiVersion = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.BackendApiVersion |= uint32(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *CertRefreshTickSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CertRefreshTickSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CertRefreshTickSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/client/api/omni/specs/virtual.pb.go b/client/api/omni/specs/virtual.pb.go
new file mode 100644
index 000000000..13140efb9
--- /dev/null
+++ b/client/api/omni/specs/virtual.pb.go
@@ -0,0 +1,489 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.32.0
+// 	protoc        v4.24.4
+// source: omni/specs/virtual.proto
+
+package specs
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type CurrentUserSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Identity string `protobuf:"bytes,1,opt,name=identity,proto3" json:"identity,omitempty"`
+	Role     string `protobuf:"bytes,3,opt,name=role,proto3" json:"role,omitempty"`
+}
+
+func (x *CurrentUserSpec) Reset() {
+	*x = CurrentUserSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_virtual_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CurrentUserSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CurrentUserSpec) ProtoMessage() {}
+
+func (x *CurrentUserSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_virtual_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CurrentUserSpec.ProtoReflect.Descriptor instead.
+func (*CurrentUserSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_virtual_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CurrentUserSpec) GetIdentity() string {
+	if x != nil {
+		return x.Identity
+	}
+	return ""
+}
+
+func (x *CurrentUserSpec) GetRole() string {
+	if x != nil {
+		return x.Role
+	}
+	return ""
+}
+
+type PermissionsSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	CanReadClusters               bool `protobuf:"varint,1,opt,name=can_read_clusters,json=canReadClusters,proto3" json:"can_read_clusters,omitempty"`
+	CanCreateClusters             bool `protobuf:"varint,2,opt,name=can_create_clusters,json=canCreateClusters,proto3" json:"can_create_clusters,omitempty"`
+	CanManageUsers                bool `protobuf:"varint,3,opt,name=can_manage_users,json=canManageUsers,proto3" json:"can_manage_users,omitempty"`
+	CanReadMachines               bool `protobuf:"varint,4,opt,name=can_read_machines,json=canReadMachines,proto3" json:"can_read_machines,omitempty"`
+	CanRemoveMachines             bool `protobuf:"varint,5,opt,name=can_remove_machines,json=canRemoveMachines,proto3" json:"can_remove_machines,omitempty"`
+	CanReadMachineLogs            bool `protobuf:"varint,6,opt,name=can_read_machine_logs,json=canReadMachineLogs,proto3" json:"can_read_machine_logs,omitempty"`
+	CanReadMachineConfigPatches   bool `protobuf:"varint,9,opt,name=can_read_machine_config_patches,json=canReadMachineConfigPatches,proto3" json:"can_read_machine_config_patches,omitempty"`
+	CanManageMachineConfigPatches bool `protobuf:"varint,10,opt,name=can_manage_machine_config_patches,json=canManageMachineConfigPatches,proto3" json:"can_manage_machine_config_patches,omitempty"`
+	CanManageBackupStore          bool `protobuf:"varint,11,opt,name=can_manage_backup_store,json=canManageBackupStore,proto3" json:"can_manage_backup_store,omitempty"`
+}
+
+func (x *PermissionsSpec) Reset() {
+	*x = PermissionsSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_virtual_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PermissionsSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PermissionsSpec) ProtoMessage() {}
+
+func (x *PermissionsSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_virtual_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PermissionsSpec.ProtoReflect.Descriptor instead.
+func (*PermissionsSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_virtual_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *PermissionsSpec) GetCanReadClusters() bool {
+	if x != nil {
+		return x.CanReadClusters
+	}
+	return false
+}
+
+func (x *PermissionsSpec) GetCanCreateClusters() bool {
+	if x != nil {
+		return x.CanCreateClusters
+	}
+	return false
+}
+
+func (x *PermissionsSpec) GetCanManageUsers() bool {
+	if x != nil {
+		return x.CanManageUsers
+	}
+	return false
+}
+
+func (x *PermissionsSpec) GetCanReadMachines() bool {
+	if x != nil {
+		return x.CanReadMachines
+	}
+	return false
+}
+
+func (x *PermissionsSpec) GetCanRemoveMachines() bool {
+	if x != nil {
+		return x.CanRemoveMachines
+	}
+	return false
+}
+
+func (x *PermissionsSpec) GetCanReadMachineLogs() bool {
+	if x != nil {
+		return x.CanReadMachineLogs
+	}
+	return false
+}
+
+func (x *PermissionsSpec) GetCanReadMachineConfigPatches() bool {
+	if x != nil {
+		return x.CanReadMachineConfigPatches
+	}
+	return false
+}
+
+func (x *PermissionsSpec) GetCanManageMachineConfigPatches() bool {
+	if x != nil {
+		return x.CanManageMachineConfigPatches
+	}
+	return false
+}
+
+func (x *PermissionsSpec) GetCanManageBackupStore() bool {
+	if x != nil {
+		return x.CanManageBackupStore
+	}
+	return false
+}
+
+type ClusterPermissionsSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	CanAddMachines             bool `protobuf:"varint,1,opt,name=can_add_machines,json=canAddMachines,proto3" json:"can_add_machines,omitempty"`
+	CanRemoveMachines          bool `protobuf:"varint,2,opt,name=can_remove_machines,json=canRemoveMachines,proto3" json:"can_remove_machines,omitempty"`
+	CanRebootMachines          bool `protobuf:"varint,3,opt,name=can_reboot_machines,json=canRebootMachines,proto3" json:"can_reboot_machines,omitempty"`
+	CanUpdateKubernetes        bool `protobuf:"varint,4,opt,name=can_update_kubernetes,json=canUpdateKubernetes,proto3" json:"can_update_kubernetes,omitempty"`
+	CanDownloadKubeconfig      bool `protobuf:"varint,5,opt,name=can_download_kubeconfig,json=canDownloadKubeconfig,proto3" json:"can_download_kubeconfig,omitempty"`
+	CanSyncKubernetesManifests bool `protobuf:"varint,6,opt,name=can_sync_kubernetes_manifests,json=canSyncKubernetesManifests,proto3" json:"can_sync_kubernetes_manifests,omitempty"`
+	CanUpdateTalos             bool `protobuf:"varint,7,opt,name=can_update_talos,json=canUpdateTalos,proto3" json:"can_update_talos,omitempty"`
+	CanDownloadTalosconfig     bool `protobuf:"varint,8,opt,name=can_download_talosconfig,json=canDownloadTalosconfig,proto3" json:"can_download_talosconfig,omitempty"`
+	CanReadConfigPatches       bool `protobuf:"varint,9,opt,name=can_read_config_patches,json=canReadConfigPatches,proto3" json:"can_read_config_patches,omitempty"`
+	CanManageConfigPatches     bool `protobuf:"varint,10,opt,name=can_manage_config_patches,json=canManageConfigPatches,proto3" json:"can_manage_config_patches,omitempty"`
+	CanManageClusterFeatures   bool `protobuf:"varint,11,opt,name=can_manage_cluster_features,json=canManageClusterFeatures,proto3" json:"can_manage_cluster_features,omitempty"`
+}
+
+func (x *ClusterPermissionsSpec) Reset() {
+	*x = ClusterPermissionsSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_omni_specs_virtual_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClusterPermissionsSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClusterPermissionsSpec) ProtoMessage() {}
+
+func (x *ClusterPermissionsSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_omni_specs_virtual_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClusterPermissionsSpec.ProtoReflect.Descriptor instead.
+func (*ClusterPermissionsSpec) Descriptor() ([]byte, []int) {
+	return file_omni_specs_virtual_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ClusterPermissionsSpec) GetCanAddMachines() bool {
+	if x != nil {
+		return x.CanAddMachines
+	}
+	return false
+}
+
+func (x *ClusterPermissionsSpec) GetCanRemoveMachines() bool {
+	if x != nil {
+		return x.CanRemoveMachines
+	}
+	return false
+}
+
+func (x *ClusterPermissionsSpec) GetCanRebootMachines() bool {
+	if x != nil {
+		return x.CanRebootMachines
+	}
+	return false
+}
+
+func (x *ClusterPermissionsSpec) GetCanUpdateKubernetes() bool {
+	if x != nil {
+		return x.CanUpdateKubernetes
+	}
+	return false
+}
+
+func (x *ClusterPermissionsSpec) GetCanDownloadKubeconfig() bool {
+	if x != nil {
+		return x.CanDownloadKubeconfig
+	}
+	return false
+}
+
+func (x *ClusterPermissionsSpec) GetCanSyncKubernetesManifests() bool {
+	if x != nil {
+		return x.CanSyncKubernetesManifests
+	}
+	return false
+}
+
+func (x *ClusterPermissionsSpec) GetCanUpdateTalos() bool {
+	if x != nil {
+		return x.CanUpdateTalos
+	}
+	return false
+}
+
+func (x *ClusterPermissionsSpec) GetCanDownloadTalosconfig() bool {
+	if x != nil {
+		return x.CanDownloadTalosconfig
+	}
+	return false
+}
+
+func (x *ClusterPermissionsSpec) GetCanReadConfigPatches() bool {
+	if x != nil {
+		return x.CanReadConfigPatches
+	}
+	return false
+}
+
+func (x *ClusterPermissionsSpec) GetCanManageConfigPatches() bool {
+	if x != nil {
+		return x.CanManageConfigPatches
+	}
+	return false
+}
+
+func (x *ClusterPermissionsSpec) GetCanManageClusterFeatures() bool {
+	if x != nil {
+		return x.CanManageClusterFeatures
+	}
+	return false
+}
+
+var File_omni_specs_virtual_proto protoreflect.FileDescriptor
+
+var file_omni_specs_virtual_proto_rawDesc = []byte{
+	0x0a, 0x18, 0x6f, 0x6d, 0x6e, 0x69, 0x2f, 0x73, 0x70, 0x65, 0x63, 0x73, 0x2f, 0x76, 0x69, 0x72,
+	0x74, 0x75, 0x61, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x05, 0x73, 0x70, 0x65, 0x63,
+	0x73, 0x22, 0x47, 0x0a, 0x0f, 0x43, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x55, 0x73, 0x65, 0x72,
+	0x53, 0x70, 0x65, 0x63, 0x12, 0x1a, 0x0a, 0x08, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79,
+	0x12, 0x12, 0x0a, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x72, 0x6f, 0x6c, 0x65, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x22, 0xed, 0x03, 0x0a, 0x0f, 0x50,
+	0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x2a,
+	0x0a, 0x11, 0x63, 0x61, 0x6e, 0x5f, 0x72, 0x65, 0x61, 0x64, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74,
+	0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0f, 0x63, 0x61, 0x6e, 0x52, 0x65,
+	0x61, 0x64, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x13, 0x63, 0x61,
+	0x6e, 0x5f, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
+	0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x63, 0x61, 0x6e, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x63, 0x61,
+	0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x73, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x63, 0x61, 0x6e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x55,
+	0x73, 0x65, 0x72, 0x73, 0x12, 0x2a, 0x0a, 0x11, 0x63, 0x61, 0x6e, 0x5f, 0x72, 0x65, 0x61, 0x64,
+	0x5f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x0f, 0x63, 0x61, 0x6e, 0x52, 0x65, 0x61, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73,
+	0x12, 0x2e, 0x0a, 0x13, 0x63, 0x61, 0x6e, 0x5f, 0x72, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x5f, 0x6d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x63,
+	0x61, 0x6e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73,
+	0x12, 0x31, 0x0a, 0x15, 0x63, 0x61, 0x6e, 0x5f, 0x72, 0x65, 0x61, 0x64, 0x5f, 0x6d, 0x61, 0x63,
+	0x68, 0x69, 0x6e, 0x65, 0x5f, 0x6c, 0x6f, 0x67, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x12, 0x63, 0x61, 0x6e, 0x52, 0x65, 0x61, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x4c,
+	0x6f, 0x67, 0x73, 0x12, 0x44, 0x0a, 0x1f, 0x63, 0x61, 0x6e, 0x5f, 0x72, 0x65, 0x61, 0x64, 0x5f,
+	0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x70,
+	0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1b, 0x63, 0x61,
+	0x6e, 0x52, 0x65, 0x61, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x50, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x12, 0x48, 0x0a, 0x21, 0x63, 0x61, 0x6e,
+	0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x5f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x5f,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x70, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x18, 0x0a,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x1d, 0x63, 0x61, 0x6e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x4d,
+	0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x50, 0x61, 0x74, 0x63,
+	0x68, 0x65, 0x73, 0x12, 0x35, 0x0a, 0x17, 0x63, 0x61, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x5f, 0x62, 0x61, 0x63, 0x6b, 0x75, 0x70, 0x5f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x18, 0x0b,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x63, 0x61, 0x6e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x42,
+	0x61, 0x63, 0x6b, 0x75, 0x70, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x22, 0xe6, 0x04, 0x0a, 0x16, 0x43,
+	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x73, 0x53, 0x70, 0x65, 0x63, 0x12, 0x28, 0x0a, 0x10, 0x63, 0x61, 0x6e, 0x5f, 0x61, 0x64, 0x64,
+	0x5f, 0x6d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x0e, 0x63, 0x61, 0x6e, 0x41, 0x64, 0x64, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12,
+	0x2e, 0x0a, 0x13, 0x63, 0x61, 0x6e, 0x5f, 0x72, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x5f, 0x6d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x63, 0x61,
+	0x6e, 0x52, 0x65, 0x6d, 0x6f, 0x76, 0x65, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12,
+	0x2e, 0x0a, 0x13, 0x63, 0x61, 0x6e, 0x5f, 0x72, 0x65, 0x62, 0x6f, 0x6f, 0x74, 0x5f, 0x6d, 0x61,
+	0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x63, 0x61,
+	0x6e, 0x52, 0x65, 0x62, 0x6f, 0x6f, 0x74, 0x4d, 0x61, 0x63, 0x68, 0x69, 0x6e, 0x65, 0x73, 0x12,
+	0x32, 0x0a, 0x15, 0x63, 0x61, 0x6e, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x75,
+	0x62, 0x65, 0x72, 0x6e, 0x65, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13,
+	0x63, 0x61, 0x6e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x4b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65,
+	0x74, 0x65, 0x73, 0x12, 0x36, 0x0a, 0x17, 0x63, 0x61, 0x6e, 0x5f, 0x64, 0x6f, 0x77, 0x6e, 0x6c,
+	0x6f, 0x61, 0x64, 0x5f, 0x6b, 0x75, 0x62, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x15, 0x63, 0x61, 0x6e, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61,
+	0x64, 0x4b, 0x75, 0x62, 0x65, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x41, 0x0a, 0x1d, 0x63,
+	0x61, 0x6e, 0x5f, 0x73, 0x79, 0x6e, 0x63, 0x5f, 0x6b, 0x75, 0x62, 0x65, 0x72, 0x6e, 0x65, 0x74,
+	0x65, 0x73, 0x5f, 0x6d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x73, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x1a, 0x63, 0x61, 0x6e, 0x53, 0x79, 0x6e, 0x63, 0x4b, 0x75, 0x62, 0x65, 0x72,
+	0x6e, 0x65, 0x74, 0x65, 0x73, 0x4d, 0x61, 0x6e, 0x69, 0x66, 0x65, 0x73, 0x74, 0x73, 0x12, 0x28,
+	0x0a, 0x10, 0x63, 0x61, 0x6e, 0x5f, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x61, 0x6c,
+	0x6f, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0e, 0x63, 0x61, 0x6e, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x54, 0x61, 0x6c, 0x6f, 0x73, 0x12, 0x38, 0x0a, 0x18, 0x63, 0x61, 0x6e, 0x5f,
+	0x64, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x74, 0x61, 0x6c, 0x6f, 0x73, 0x63, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x16, 0x63, 0x61, 0x6e, 0x44,
+	0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x54, 0x61, 0x6c, 0x6f, 0x73, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x12, 0x35, 0x0a, 0x17, 0x63, 0x61, 0x6e, 0x5f, 0x72, 0x65, 0x61, 0x64, 0x5f, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x70, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x18, 0x09, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x14, 0x63, 0x61, 0x6e, 0x52, 0x65, 0x61, 0x64, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x50, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x12, 0x39, 0x0a, 0x19, 0x63, 0x61, 0x6e,
+	0x5f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x70,
+	0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x16, 0x63, 0x61,
+	0x6e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x50, 0x61, 0x74,
+	0x63, 0x68, 0x65, 0x73, 0x12, 0x3d, 0x0a, 0x1b, 0x63, 0x61, 0x6e, 0x5f, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x66, 0x65, 0x61, 0x74, 0x75,
+	0x72, 0x65, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x18, 0x63, 0x61, 0x6e, 0x4d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x46, 0x65, 0x61, 0x74, 0x75,
+	0x72, 0x65, 0x73, 0x42, 0x32, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
+	0x6d, 0x2f, 0x73, 0x69, 0x64, 0x65, 0x72, 0x6f, 0x6c, 0x61, 0x62, 0x73, 0x2f, 0x6f, 0x6d, 0x6e,
+	0x69, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x6f, 0x6d, 0x6e,
+	0x69, 0x2f, 0x73, 0x70, 0x65, 0x63, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_omni_specs_virtual_proto_rawDescOnce sync.Once
+	file_omni_specs_virtual_proto_rawDescData = file_omni_specs_virtual_proto_rawDesc
+)
+
+func file_omni_specs_virtual_proto_rawDescGZIP() []byte {
+	file_omni_specs_virtual_proto_rawDescOnce.Do(func() {
+		file_omni_specs_virtual_proto_rawDescData = protoimpl.X.CompressGZIP(file_omni_specs_virtual_proto_rawDescData)
+	})
+	return file_omni_specs_virtual_proto_rawDescData
+}
+
+var file_omni_specs_virtual_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_omni_specs_virtual_proto_goTypes = []interface{}{
+	(*CurrentUserSpec)(nil),        // 0: specs.CurrentUserSpec
+	(*PermissionsSpec)(nil),        // 1: specs.PermissionsSpec
+	(*ClusterPermissionsSpec)(nil), // 2: specs.ClusterPermissionsSpec
+}
+var file_omni_specs_virtual_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_omni_specs_virtual_proto_init() }
+func file_omni_specs_virtual_proto_init() {
+	if File_omni_specs_virtual_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_omni_specs_virtual_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CurrentUserSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_virtual_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PermissionsSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_omni_specs_virtual_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClusterPermissionsSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_omni_specs_virtual_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   3,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_omni_specs_virtual_proto_goTypes,
+		DependencyIndexes: file_omni_specs_virtual_proto_depIdxs,
+		MessageInfos:      file_omni_specs_virtual_proto_msgTypes,
+	}.Build()
+	File_omni_specs_virtual_proto = out.File
+	file_omni_specs_virtual_proto_rawDesc = nil
+	file_omni_specs_virtual_proto_goTypes = nil
+	file_omni_specs_virtual_proto_depIdxs = nil
+}
diff --git a/client/api/omni/specs/virtual.proto b/client/api/omni/specs/virtual.proto
new file mode 100644
index 000000000..5fdaa9084
--- /dev/null
+++ b/client/api/omni/specs/virtual.proto
@@ -0,0 +1,36 @@
+syntax = "proto3";
+package specs;
+
+option go_package = "github.com/siderolabs/omni/client/api/omni/specs";
+
+message CurrentUserSpec {
+  string identity = 1;
+  reserved 2;
+  string role = 3;
+}
+
+message PermissionsSpec {
+  bool can_read_clusters = 1;
+  bool can_create_clusters = 2;
+  bool can_manage_users = 3;
+  bool can_read_machines = 4;
+  bool can_remove_machines = 5;
+  bool can_read_machine_logs = 6;
+  bool can_read_machine_config_patches = 9;
+  bool can_manage_machine_config_patches = 10;
+  bool can_manage_backup_store = 11;
+}
+
+message ClusterPermissionsSpec {
+  bool can_add_machines = 1;
+  bool can_remove_machines = 2;
+  bool can_reboot_machines = 3;
+  bool can_update_kubernetes = 4;
+  bool can_download_kubeconfig = 5;
+  bool can_sync_kubernetes_manifests = 6;
+  bool can_update_talos = 7;
+  bool can_download_talosconfig = 8;
+  bool can_read_config_patches = 9;
+  bool can_manage_config_patches = 10;
+  bool can_manage_cluster_features = 11;
+}
diff --git a/client/api/omni/specs/virtual_vtproto.pb.go b/client/api/omni/specs/virtual_vtproto.pb.go
new file mode 100644
index 000000000..9e404056c
--- /dev/null
+++ b/client/api/omni/specs/virtual_vtproto.pb.go
@@ -0,0 +1,1234 @@
+// Code generated by protoc-gen-go-vtproto. DO NOT EDIT.
+// protoc-gen-go-vtproto version: v0.6.0
+// source: omni/specs/virtual.proto
+
+package specs
+
+import (
+	fmt "fmt"
+	io "io"
+
+	protohelpers "github.com/planetscale/vtprotobuf/protohelpers"
+	proto "google.golang.org/protobuf/proto"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+func (m *CurrentUserSpec) CloneVT() *CurrentUserSpec {
+	if m == nil {
+		return (*CurrentUserSpec)(nil)
+	}
+	r := new(CurrentUserSpec)
+	r.Identity = m.Identity
+	r.Role = m.Role
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *CurrentUserSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *PermissionsSpec) CloneVT() *PermissionsSpec {
+	if m == nil {
+		return (*PermissionsSpec)(nil)
+	}
+	r := new(PermissionsSpec)
+	r.CanReadClusters = m.CanReadClusters
+	r.CanCreateClusters = m.CanCreateClusters
+	r.CanManageUsers = m.CanManageUsers
+	r.CanReadMachines = m.CanReadMachines
+	r.CanRemoveMachines = m.CanRemoveMachines
+	r.CanReadMachineLogs = m.CanReadMachineLogs
+	r.CanReadMachineConfigPatches = m.CanReadMachineConfigPatches
+	r.CanManageMachineConfigPatches = m.CanManageMachineConfigPatches
+	r.CanManageBackupStore = m.CanManageBackupStore
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *PermissionsSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (m *ClusterPermissionsSpec) CloneVT() *ClusterPermissionsSpec {
+	if m == nil {
+		return (*ClusterPermissionsSpec)(nil)
+	}
+	r := new(ClusterPermissionsSpec)
+	r.CanAddMachines = m.CanAddMachines
+	r.CanRemoveMachines = m.CanRemoveMachines
+	r.CanRebootMachines = m.CanRebootMachines
+	r.CanUpdateKubernetes = m.CanUpdateKubernetes
+	r.CanDownloadKubeconfig = m.CanDownloadKubeconfig
+	r.CanSyncKubernetesManifests = m.CanSyncKubernetesManifests
+	r.CanUpdateTalos = m.CanUpdateTalos
+	r.CanDownloadTalosconfig = m.CanDownloadTalosconfig
+	r.CanReadConfigPatches = m.CanReadConfigPatches
+	r.CanManageConfigPatches = m.CanManageConfigPatches
+	r.CanManageClusterFeatures = m.CanManageClusterFeatures
+	if len(m.unknownFields) > 0 {
+		r.unknownFields = make([]byte, len(m.unknownFields))
+		copy(r.unknownFields, m.unknownFields)
+	}
+	return r
+}
+
+func (m *ClusterPermissionsSpec) CloneMessageVT() proto.Message {
+	return m.CloneVT()
+}
+
+func (this *CurrentUserSpec) EqualVT(that *CurrentUserSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.Identity != that.Identity {
+		return false
+	}
+	if this.Role != that.Role {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *CurrentUserSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*CurrentUserSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *PermissionsSpec) EqualVT(that *PermissionsSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.CanReadClusters != that.CanReadClusters {
+		return false
+	}
+	if this.CanCreateClusters != that.CanCreateClusters {
+		return false
+	}
+	if this.CanManageUsers != that.CanManageUsers {
+		return false
+	}
+	if this.CanReadMachines != that.CanReadMachines {
+		return false
+	}
+	if this.CanRemoveMachines != that.CanRemoveMachines {
+		return false
+	}
+	if this.CanReadMachineLogs != that.CanReadMachineLogs {
+		return false
+	}
+	if this.CanReadMachineConfigPatches != that.CanReadMachineConfigPatches {
+		return false
+	}
+	if this.CanManageMachineConfigPatches != that.CanManageMachineConfigPatches {
+		return false
+	}
+	if this.CanManageBackupStore != that.CanManageBackupStore {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *PermissionsSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*PermissionsSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (this *ClusterPermissionsSpec) EqualVT(that *ClusterPermissionsSpec) bool {
+	if this == that {
+		return true
+	} else if this == nil || that == nil {
+		return false
+	}
+	if this.CanAddMachines != that.CanAddMachines {
+		return false
+	}
+	if this.CanRemoveMachines != that.CanRemoveMachines {
+		return false
+	}
+	if this.CanRebootMachines != that.CanRebootMachines {
+		return false
+	}
+	if this.CanUpdateKubernetes != that.CanUpdateKubernetes {
+		return false
+	}
+	if this.CanDownloadKubeconfig != that.CanDownloadKubeconfig {
+		return false
+	}
+	if this.CanSyncKubernetesManifests != that.CanSyncKubernetesManifests {
+		return false
+	}
+	if this.CanUpdateTalos != that.CanUpdateTalos {
+		return false
+	}
+	if this.CanDownloadTalosconfig != that.CanDownloadTalosconfig {
+		return false
+	}
+	if this.CanReadConfigPatches != that.CanReadConfigPatches {
+		return false
+	}
+	if this.CanManageConfigPatches != that.CanManageConfigPatches {
+		return false
+	}
+	if this.CanManageClusterFeatures != that.CanManageClusterFeatures {
+		return false
+	}
+	return string(this.unknownFields) == string(that.unknownFields)
+}
+
+func (this *ClusterPermissionsSpec) EqualMessageVT(thatMsg proto.Message) bool {
+	that, ok := thatMsg.(*ClusterPermissionsSpec)
+	if !ok {
+		return false
+	}
+	return this.EqualVT(that)
+}
+func (m *CurrentUserSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *CurrentUserSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *CurrentUserSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if len(m.Role) > 0 {
+		i -= len(m.Role)
+		copy(dAtA[i:], m.Role)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Role)))
+		i--
+		dAtA[i] = 0x1a
+	}
+	if len(m.Identity) > 0 {
+		i -= len(m.Identity)
+		copy(dAtA[i:], m.Identity)
+		i = protohelpers.EncodeVarint(dAtA, i, uint64(len(m.Identity)))
+		i--
+		dAtA[i] = 0xa
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *PermissionsSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *PermissionsSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *PermissionsSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.CanManageBackupStore {
+		i--
+		if m.CanManageBackupStore {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x58
+	}
+	if m.CanManageMachineConfigPatches {
+		i--
+		if m.CanManageMachineConfigPatches {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x50
+	}
+	if m.CanReadMachineConfigPatches {
+		i--
+		if m.CanReadMachineConfigPatches {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x48
+	}
+	if m.CanReadMachineLogs {
+		i--
+		if m.CanReadMachineLogs {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x30
+	}
+	if m.CanRemoveMachines {
+		i--
+		if m.CanRemoveMachines {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.CanReadMachines {
+		i--
+		if m.CanReadMachines {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.CanManageUsers {
+		i--
+		if m.CanManageUsers {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.CanCreateClusters {
+		i--
+		if m.CanCreateClusters {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.CanReadClusters {
+		i--
+		if m.CanReadClusters {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *ClusterPermissionsSpec) MarshalVT() (dAtA []byte, err error) {
+	if m == nil {
+		return nil, nil
+	}
+	size := m.SizeVT()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalToSizedBufferVT(dAtA[:size])
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ClusterPermissionsSpec) MarshalToVT(dAtA []byte) (int, error) {
+	size := m.SizeVT()
+	return m.MarshalToSizedBufferVT(dAtA[:size])
+}
+
+func (m *ClusterPermissionsSpec) MarshalToSizedBufferVT(dAtA []byte) (int, error) {
+	if m == nil {
+		return 0, nil
+	}
+	i := len(dAtA)
+	_ = i
+	var l int
+	_ = l
+	if m.unknownFields != nil {
+		i -= len(m.unknownFields)
+		copy(dAtA[i:], m.unknownFields)
+	}
+	if m.CanManageClusterFeatures {
+		i--
+		if m.CanManageClusterFeatures {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x58
+	}
+	if m.CanManageConfigPatches {
+		i--
+		if m.CanManageConfigPatches {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x50
+	}
+	if m.CanReadConfigPatches {
+		i--
+		if m.CanReadConfigPatches {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x48
+	}
+	if m.CanDownloadTalosconfig {
+		i--
+		if m.CanDownloadTalosconfig {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x40
+	}
+	if m.CanUpdateTalos {
+		i--
+		if m.CanUpdateTalos {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x38
+	}
+	if m.CanSyncKubernetesManifests {
+		i--
+		if m.CanSyncKubernetesManifests {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x30
+	}
+	if m.CanDownloadKubeconfig {
+		i--
+		if m.CanDownloadKubeconfig {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x28
+	}
+	if m.CanUpdateKubernetes {
+		i--
+		if m.CanUpdateKubernetes {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x20
+	}
+	if m.CanRebootMachines {
+		i--
+		if m.CanRebootMachines {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x18
+	}
+	if m.CanRemoveMachines {
+		i--
+		if m.CanRemoveMachines {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x10
+	}
+	if m.CanAddMachines {
+		i--
+		if m.CanAddMachines {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i--
+		dAtA[i] = 0x8
+	}
+	return len(dAtA) - i, nil
+}
+
+func (m *CurrentUserSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	l = len(m.Identity)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	l = len(m.Role)
+	if l > 0 {
+		n += 1 + l + protohelpers.SizeOfVarint(uint64(l))
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *PermissionsSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.CanReadClusters {
+		n += 2
+	}
+	if m.CanCreateClusters {
+		n += 2
+	}
+	if m.CanManageUsers {
+		n += 2
+	}
+	if m.CanReadMachines {
+		n += 2
+	}
+	if m.CanRemoveMachines {
+		n += 2
+	}
+	if m.CanReadMachineLogs {
+		n += 2
+	}
+	if m.CanReadMachineConfigPatches {
+		n += 2
+	}
+	if m.CanManageMachineConfigPatches {
+		n += 2
+	}
+	if m.CanManageBackupStore {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *ClusterPermissionsSpec) SizeVT() (n int) {
+	if m == nil {
+		return 0
+	}
+	var l int
+	_ = l
+	if m.CanAddMachines {
+		n += 2
+	}
+	if m.CanRemoveMachines {
+		n += 2
+	}
+	if m.CanRebootMachines {
+		n += 2
+	}
+	if m.CanUpdateKubernetes {
+		n += 2
+	}
+	if m.CanDownloadKubeconfig {
+		n += 2
+	}
+	if m.CanSyncKubernetesManifests {
+		n += 2
+	}
+	if m.CanUpdateTalos {
+		n += 2
+	}
+	if m.CanDownloadTalosconfig {
+		n += 2
+	}
+	if m.CanReadConfigPatches {
+		n += 2
+	}
+	if m.CanManageConfigPatches {
+		n += 2
+	}
+	if m.CanManageClusterFeatures {
+		n += 2
+	}
+	n += len(m.unknownFields)
+	return n
+}
+
+func (m *CurrentUserSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: CurrentUserSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: CurrentUserSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Identity", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Identity = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Role", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= uint64(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Role = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *PermissionsSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: PermissionsSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: PermissionsSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanReadClusters", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanReadClusters = bool(v != 0)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanCreateClusters", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanCreateClusters = bool(v != 0)
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanManageUsers", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanManageUsers = bool(v != 0)
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanReadMachines", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanReadMachines = bool(v != 0)
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanRemoveMachines", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanRemoveMachines = bool(v != 0)
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanReadMachineLogs", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanReadMachineLogs = bool(v != 0)
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanReadMachineConfigPatches", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanReadMachineConfigPatches = bool(v != 0)
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanManageMachineConfigPatches", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanManageMachineConfigPatches = bool(v != 0)
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanManageBackupStore", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanManageBackupStore = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ClusterPermissionsSpec) UnmarshalVT(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return protohelpers.ErrIntOverflow
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= uint64(b&0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ClusterPermissionsSpec: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ClusterPermissionsSpec: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanAddMachines", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanAddMachines = bool(v != 0)
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanRemoveMachines", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanRemoveMachines = bool(v != 0)
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanRebootMachines", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanRebootMachines = bool(v != 0)
+		case 4:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanUpdateKubernetes", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanUpdateKubernetes = bool(v != 0)
+		case 5:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanDownloadKubeconfig", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanDownloadKubeconfig = bool(v != 0)
+		case 6:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanSyncKubernetesManifests", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanSyncKubernetesManifests = bool(v != 0)
+		case 7:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanUpdateTalos", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanUpdateTalos = bool(v != 0)
+		case 8:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanDownloadTalosconfig", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanDownloadTalosconfig = bool(v != 0)
+		case 9:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanReadConfigPatches", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanReadConfigPatches = bool(v != 0)
+		case 10:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanManageConfigPatches", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanManageConfigPatches = bool(v != 0)
+		case 11:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field CanManageClusterFeatures", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return protohelpers.ErrIntOverflow
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= int(b&0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.CanManageClusterFeatures = bool(v != 0)
+		default:
+			iNdEx = preIndex
+			skippy, err := protohelpers.Skip(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if (skippy < 0) || (iNdEx+skippy) < 0 {
+				return protohelpers.ErrInvalidLength
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.unknownFields = append(m.unknownFields, dAtA[iNdEx:iNdEx+skippy]...)
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
diff --git a/client/api/talos/machine/machine.pb.gw.go b/client/api/talos/machine/machine.pb.gw.go
new file mode 100644
index 000000000..b901f5124
--- /dev/null
+++ b/client/api/talos/machine/machine.pb.gw.go
@@ -0,0 +1,3016 @@
+// Code generated by protoc-gen-grpc-gateway. DO NOT EDIT.
+// source: talos/machine/machine.proto
+
+/*
+Package machine is a reverse proxy.
+
+It translates gRPC into RESTful JSON APIs.
+*/
+package machine
+
+import (
+	"context"
+	"io"
+	"net/http"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/grpc-ecosystem/grpc-gateway/v2/utilities"
+	extCommon "github.com/siderolabs/talos/pkg/machinery/api/common"
+	extMachine "github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/grpclog"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+	extEmptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// Suppress "imported and not used" errors
+var _ codes.Code
+var _ io.Reader
+var _ status.Status
+var _ = runtime.String
+var _ = utilities.NewDoubleArray
+var _ = metadata.Join
+
+func request_MachineService_ApplyConfiguration_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ApplyConfigurationRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.ApplyConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_ApplyConfiguration_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ApplyConfigurationRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.ApplyConfiguration(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Bootstrap_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.BootstrapRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Bootstrap(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_Bootstrap_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.BootstrapRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Bootstrap(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Containers_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ContainersRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Containers(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_Containers_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ContainersRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Containers(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Copy_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (extMachine.MachineService_CopyClient, runtime.ServerMetadata, error) {
+	var protoReq extMachine.CopyRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	stream, err := client.Copy(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+
+}
+
+func request_MachineService_CPUInfo_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.CPUInfo(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_CPUInfo_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.CPUInfo(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_DiskStats_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.DiskStats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_DiskStats_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.DiskStats(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Dmesg_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (extMachine.MachineService_DmesgClient, runtime.ServerMetadata, error) {
+	var protoReq extMachine.DmesgRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	stream, err := client.Dmesg(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+
+}
+
+func request_MachineService_Events_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (extMachine.MachineService_EventsClient, runtime.ServerMetadata, error) {
+	var protoReq extMachine.EventsRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	stream, err := client.Events(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+
+}
+
+func request_MachineService_EtcdMemberList_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.EtcdMemberListRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.EtcdMemberList(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_EtcdMemberList_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.EtcdMemberListRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.EtcdMemberList(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_EtcdRemoveMember_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.EtcdRemoveMemberRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.EtcdRemoveMember(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_EtcdRemoveMember_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.EtcdRemoveMemberRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.EtcdRemoveMember(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_EtcdLeaveCluster_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.EtcdLeaveClusterRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.EtcdLeaveCluster(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_EtcdLeaveCluster_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.EtcdLeaveClusterRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.EtcdLeaveCluster(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_EtcdForfeitLeadership_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.EtcdForfeitLeadershipRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.EtcdForfeitLeadership(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_EtcdForfeitLeadership_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.EtcdForfeitLeadershipRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.EtcdForfeitLeadership(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_EtcdRecover_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var metadata runtime.ServerMetadata
+	stream, err := client.EtcdRecover(ctx)
+	if err != nil {
+		grpclog.Infof("Failed to start streaming: %v", err)
+		return nil, metadata, err
+	}
+	dec := marshaler.NewDecoder(req.Body)
+	for {
+		var protoReq extCommon.Data
+		err = dec.Decode(&protoReq)
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			grpclog.Infof("Failed to decode request: %v", err)
+			return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+		}
+		if err = stream.Send(&protoReq); err != nil {
+			if err == io.EOF {
+				break
+			}
+			grpclog.Infof("Failed to send request: %v", err)
+			return nil, metadata, err
+		}
+	}
+
+	if err := stream.CloseSend(); err != nil {
+		grpclog.Infof("Failed to terminate client stream: %v", err)
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		grpclog.Infof("Failed to get header from client: %v", err)
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+
+	msg, err := stream.CloseAndRecv()
+	metadata.TrailerMD = stream.Trailer()
+	return msg, metadata, err
+
+}
+
+func request_MachineService_EtcdSnapshot_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (extMachine.MachineService_EtcdSnapshotClient, runtime.ServerMetadata, error) {
+	var protoReq extMachine.EtcdSnapshotRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	stream, err := client.EtcdSnapshot(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+
+}
+
+func request_MachineService_GenerateConfiguration_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.GenerateConfigurationRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.GenerateConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_GenerateConfiguration_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.GenerateConfigurationRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.GenerateConfiguration(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Hostname_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Hostname(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_Hostname_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Hostname(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Kubeconfig_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (extMachine.MachineService_KubeconfigClient, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	stream, err := client.Kubeconfig(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+
+}
+
+func request_MachineService_List_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (extMachine.MachineService_ListClient, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ListRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	stream, err := client.List(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+
+}
+
+func request_MachineService_DiskUsage_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (extMachine.MachineService_DiskUsageClient, runtime.ServerMetadata, error) {
+	var protoReq extMachine.DiskUsageRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	stream, err := client.DiskUsage(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+
+}
+
+func request_MachineService_LoadAvg_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.LoadAvg(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_LoadAvg_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.LoadAvg(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Logs_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (extMachine.MachineService_LogsClient, runtime.ServerMetadata, error) {
+	var protoReq extMachine.LogsRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	stream, err := client.Logs(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+
+}
+
+func request_MachineService_Memory_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Memory(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_Memory_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Memory(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Mounts_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Mounts(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_Mounts_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Mounts(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_NetworkDeviceStats_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.NetworkDeviceStats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_NetworkDeviceStats_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.NetworkDeviceStats(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Processes_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Processes(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_Processes_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Processes(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Read_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (extMachine.MachineService_ReadClient, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ReadRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	stream, err := client.Read(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+
+}
+
+func request_MachineService_Reboot_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.RebootRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Reboot(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_Reboot_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.RebootRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Reboot(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Restart_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.RestartRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Restart(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_Restart_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.RestartRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Restart(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Rollback_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.RollbackRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Rollback(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_Rollback_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.RollbackRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Rollback(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Reset_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ResetRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Reset(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_Reset_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ResetRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Reset(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_ServiceList_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.ServiceList(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_ServiceList_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.ServiceList(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_ServiceRestart_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ServiceRestartRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.ServiceRestart(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_ServiceRestart_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ServiceRestartRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.ServiceRestart(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_ServiceStart_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ServiceStartRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.ServiceStart(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_ServiceStart_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ServiceStartRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.ServiceStart(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_ServiceStop_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ServiceStopRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.ServiceStop(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_ServiceStop_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ServiceStopRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.ServiceStop(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Shutdown_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ShutdownRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Shutdown(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_Shutdown_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.ShutdownRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Shutdown(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Stats_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.StatsRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Stats(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_Stats_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.StatsRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Stats(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_SystemStat_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.SystemStat(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_SystemStat_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.SystemStat(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Upgrade_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.UpgradeRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Upgrade(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_Upgrade_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.UpgradeRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Upgrade(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_Version_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.Version(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_Version_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extEmptypb.Empty
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.Version(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_GenerateClientConfiguration_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.GenerateClientConfigurationRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := client.GenerateClientConfiguration(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+
+}
+
+func local_request_MachineService_GenerateClientConfiguration_0(ctx context.Context, marshaler runtime.Marshaler, server extMachine.MachineServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var protoReq extMachine.GenerateClientConfigurationRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	msg, err := server.GenerateClientConfiguration(ctx, &protoReq)
+	return msg, metadata, err
+
+}
+
+func request_MachineService_PacketCapture_0(ctx context.Context, marshaler runtime.Marshaler, client extMachine.MachineServiceClient, req *http.Request, pathParams map[string]string) (extMachine.MachineService_PacketCaptureClient, runtime.ServerMetadata, error) {
+	var protoReq extMachine.PacketCaptureRequest
+	var metadata runtime.ServerMetadata
+
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && err != io.EOF {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+
+	stream, err := client.PacketCapture(ctx, &protoReq)
+	if err != nil {
+		return nil, metadata, err
+	}
+	header, err := stream.Header()
+	if err != nil {
+		return nil, metadata, err
+	}
+	metadata.HeaderMD = header
+	return stream, metadata, nil
+
+}
+
+// RegisterMachineServiceHandlerServer registers the http handlers for service MachineService to "mux".
+// UnaryRPC     :call MachineServiceServer directly.
+// StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
+// Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterMachineServiceHandlerFromEndpoint instead.
+func RegisterMachineServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server extMachine.MachineServiceServer) error {
+
+	mux.Handle("POST", pattern_MachineService_ApplyConfiguration_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/ApplyConfiguration", runtime.WithHTTPPathPattern("/machine.MachineService/ApplyConfiguration"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_ApplyConfiguration_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_ApplyConfiguration_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Bootstrap_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/Bootstrap", runtime.WithHTTPPathPattern("/machine.MachineService/Bootstrap"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_Bootstrap_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Bootstrap_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Containers_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/Containers", runtime.WithHTTPPathPattern("/machine.MachineService/Containers"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_Containers_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Containers_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Copy_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	mux.Handle("POST", pattern_MachineService_CPUInfo_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/CPUInfo", runtime.WithHTTPPathPattern("/machine.MachineService/CPUInfo"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_CPUInfo_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_CPUInfo_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_DiskStats_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/DiskStats", runtime.WithHTTPPathPattern("/machine.MachineService/DiskStats"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_DiskStats_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_DiskStats_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Dmesg_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	mux.Handle("POST", pattern_MachineService_Events_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	mux.Handle("POST", pattern_MachineService_EtcdMemberList_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/EtcdMemberList", runtime.WithHTTPPathPattern("/machine.MachineService/EtcdMemberList"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_EtcdMemberList_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_EtcdMemberList_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_EtcdRemoveMember_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/EtcdRemoveMember", runtime.WithHTTPPathPattern("/machine.MachineService/EtcdRemoveMember"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_EtcdRemoveMember_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_EtcdRemoveMember_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_EtcdLeaveCluster_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/EtcdLeaveCluster", runtime.WithHTTPPathPattern("/machine.MachineService/EtcdLeaveCluster"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_EtcdLeaveCluster_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_EtcdLeaveCluster_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_EtcdForfeitLeadership_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/EtcdForfeitLeadership", runtime.WithHTTPPathPattern("/machine.MachineService/EtcdForfeitLeadership"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_EtcdForfeitLeadership_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_EtcdForfeitLeadership_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_EtcdRecover_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	mux.Handle("POST", pattern_MachineService_EtcdSnapshot_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	mux.Handle("POST", pattern_MachineService_GenerateConfiguration_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/GenerateConfiguration", runtime.WithHTTPPathPattern("/machine.MachineService/GenerateConfiguration"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_GenerateConfiguration_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_GenerateConfiguration_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Hostname_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/Hostname", runtime.WithHTTPPathPattern("/machine.MachineService/Hostname"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_Hostname_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Hostname_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Kubeconfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	mux.Handle("POST", pattern_MachineService_List_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	mux.Handle("POST", pattern_MachineService_DiskUsage_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	mux.Handle("POST", pattern_MachineService_LoadAvg_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/LoadAvg", runtime.WithHTTPPathPattern("/machine.MachineService/LoadAvg"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_LoadAvg_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_LoadAvg_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Logs_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	mux.Handle("POST", pattern_MachineService_Memory_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/Memory", runtime.WithHTTPPathPattern("/machine.MachineService/Memory"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_Memory_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Memory_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Mounts_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/Mounts", runtime.WithHTTPPathPattern("/machine.MachineService/Mounts"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_Mounts_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Mounts_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_NetworkDeviceStats_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/NetworkDeviceStats", runtime.WithHTTPPathPattern("/machine.MachineService/NetworkDeviceStats"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_NetworkDeviceStats_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_NetworkDeviceStats_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Processes_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/Processes", runtime.WithHTTPPathPattern("/machine.MachineService/Processes"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_Processes_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Processes_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Read_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	mux.Handle("POST", pattern_MachineService_Reboot_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/Reboot", runtime.WithHTTPPathPattern("/machine.MachineService/Reboot"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_Reboot_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Reboot_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Restart_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/Restart", runtime.WithHTTPPathPattern("/machine.MachineService/Restart"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_Restart_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Restart_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Rollback_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/Rollback", runtime.WithHTTPPathPattern("/machine.MachineService/Rollback"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_Rollback_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Rollback_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Reset_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/Reset", runtime.WithHTTPPathPattern("/machine.MachineService/Reset"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_Reset_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Reset_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_ServiceList_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/ServiceList", runtime.WithHTTPPathPattern("/machine.MachineService/ServiceList"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_ServiceList_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_ServiceList_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_ServiceRestart_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/ServiceRestart", runtime.WithHTTPPathPattern("/machine.MachineService/ServiceRestart"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_ServiceRestart_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_ServiceRestart_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_ServiceStart_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/ServiceStart", runtime.WithHTTPPathPattern("/machine.MachineService/ServiceStart"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_ServiceStart_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_ServiceStart_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_ServiceStop_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/ServiceStop", runtime.WithHTTPPathPattern("/machine.MachineService/ServiceStop"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_ServiceStop_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_ServiceStop_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Shutdown_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/Shutdown", runtime.WithHTTPPathPattern("/machine.MachineService/Shutdown"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_Shutdown_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Shutdown_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Stats_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/Stats", runtime.WithHTTPPathPattern("/machine.MachineService/Stats"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_Stats_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Stats_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_SystemStat_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/SystemStat", runtime.WithHTTPPathPattern("/machine.MachineService/SystemStat"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_SystemStat_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_SystemStat_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Upgrade_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/Upgrade", runtime.WithHTTPPathPattern("/machine.MachineService/Upgrade"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_Upgrade_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Upgrade_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Version_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/Version", runtime.WithHTTPPathPattern("/machine.MachineService/Version"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_Version_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Version_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_GenerateClientConfiguration_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateIncomingContext(ctx, mux, req, "/machine.MachineService/GenerateClientConfiguration", runtime.WithHTTPPathPattern("/machine.MachineService/GenerateClientConfiguration"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_MachineService_GenerateClientConfiguration_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_GenerateClientConfiguration_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_PacketCapture_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		err := status.Error(codes.Unimplemented, "streaming calls are not yet supported in the in-process transport")
+		_, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+		return
+	})
+
+	return nil
+}
+
+// RegisterMachineServiceHandlerFromEndpoint is same as RegisterMachineServiceHandler but
+// automatically dials to "endpoint" and closes the connection when "ctx" gets done.
+func RegisterMachineServiceHandlerFromEndpoint(ctx context.Context, mux *runtime.ServeMux, endpoint string, opts []grpc.DialOption) (err error) {
+	conn, err := grpc.DialContext(ctx, endpoint, opts...)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+			return
+		}
+		go func() {
+			<-ctx.Done()
+			if cerr := conn.Close(); cerr != nil {
+				grpclog.Infof("Failed to close conn to %s: %v", endpoint, cerr)
+			}
+		}()
+	}()
+
+	return RegisterMachineServiceHandler(ctx, mux, conn)
+}
+
+// RegisterMachineServiceHandler registers the http handlers for service MachineService to "mux".
+// The handlers forward requests to the grpc endpoint over "conn".
+func RegisterMachineServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn *grpc.ClientConn) error {
+	return RegisterMachineServiceHandlerClient(ctx, mux, extMachine.NewMachineServiceClient(conn))
+}
+
+// RegisterMachineServiceHandlerClient registers the http handlers for service MachineService
+// to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "extMachine.MachineServiceClient".
+// Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "extMachine.MachineServiceClient"
+// doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
+// "extMachine.MachineServiceClient" to call the correct interceptors.
+func RegisterMachineServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client extMachine.MachineServiceClient) error {
+
+	mux.Handle("POST", pattern_MachineService_ApplyConfiguration_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/ApplyConfiguration", runtime.WithHTTPPathPattern("/machine.MachineService/ApplyConfiguration"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_ApplyConfiguration_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_ApplyConfiguration_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Bootstrap_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Bootstrap", runtime.WithHTTPPathPattern("/machine.MachineService/Bootstrap"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Bootstrap_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Bootstrap_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Containers_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Containers", runtime.WithHTTPPathPattern("/machine.MachineService/Containers"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Containers_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Containers_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Copy_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Copy", runtime.WithHTTPPathPattern("/machine.MachineService/Copy"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Copy_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Copy_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_CPUInfo_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/CPUInfo", runtime.WithHTTPPathPattern("/machine.MachineService/CPUInfo"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_CPUInfo_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_CPUInfo_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_DiskStats_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/DiskStats", runtime.WithHTTPPathPattern("/machine.MachineService/DiskStats"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_DiskStats_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_DiskStats_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Dmesg_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Dmesg", runtime.WithHTTPPathPattern("/machine.MachineService/Dmesg"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Dmesg_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Dmesg_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Events_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Events", runtime.WithHTTPPathPattern("/machine.MachineService/Events"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Events_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Events_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_EtcdMemberList_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/EtcdMemberList", runtime.WithHTTPPathPattern("/machine.MachineService/EtcdMemberList"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_EtcdMemberList_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_EtcdMemberList_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_EtcdRemoveMember_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/EtcdRemoveMember", runtime.WithHTTPPathPattern("/machine.MachineService/EtcdRemoveMember"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_EtcdRemoveMember_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_EtcdRemoveMember_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_EtcdLeaveCluster_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/EtcdLeaveCluster", runtime.WithHTTPPathPattern("/machine.MachineService/EtcdLeaveCluster"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_EtcdLeaveCluster_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_EtcdLeaveCluster_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_EtcdForfeitLeadership_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/EtcdForfeitLeadership", runtime.WithHTTPPathPattern("/machine.MachineService/EtcdForfeitLeadership"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_EtcdForfeitLeadership_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_EtcdForfeitLeadership_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_EtcdRecover_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/EtcdRecover", runtime.WithHTTPPathPattern("/machine.MachineService/EtcdRecover"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_EtcdRecover_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_EtcdRecover_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_EtcdSnapshot_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/EtcdSnapshot", runtime.WithHTTPPathPattern("/machine.MachineService/EtcdSnapshot"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_EtcdSnapshot_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_EtcdSnapshot_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_GenerateConfiguration_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/GenerateConfiguration", runtime.WithHTTPPathPattern("/machine.MachineService/GenerateConfiguration"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_GenerateConfiguration_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_GenerateConfiguration_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Hostname_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Hostname", runtime.WithHTTPPathPattern("/machine.MachineService/Hostname"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Hostname_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Hostname_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Kubeconfig_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Kubeconfig", runtime.WithHTTPPathPattern("/machine.MachineService/Kubeconfig"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Kubeconfig_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Kubeconfig_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_List_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/List", runtime.WithHTTPPathPattern("/machine.MachineService/List"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_List_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_List_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_DiskUsage_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/DiskUsage", runtime.WithHTTPPathPattern("/machine.MachineService/DiskUsage"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_DiskUsage_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_DiskUsage_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_LoadAvg_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/LoadAvg", runtime.WithHTTPPathPattern("/machine.MachineService/LoadAvg"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_LoadAvg_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_LoadAvg_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Logs_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Logs", runtime.WithHTTPPathPattern("/machine.MachineService/Logs"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Logs_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Logs_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Memory_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Memory", runtime.WithHTTPPathPattern("/machine.MachineService/Memory"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Memory_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Memory_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Mounts_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Mounts", runtime.WithHTTPPathPattern("/machine.MachineService/Mounts"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Mounts_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Mounts_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_NetworkDeviceStats_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/NetworkDeviceStats", runtime.WithHTTPPathPattern("/machine.MachineService/NetworkDeviceStats"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_NetworkDeviceStats_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_NetworkDeviceStats_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Processes_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Processes", runtime.WithHTTPPathPattern("/machine.MachineService/Processes"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Processes_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Processes_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Read_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Read", runtime.WithHTTPPathPattern("/machine.MachineService/Read"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Read_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Read_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Reboot_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Reboot", runtime.WithHTTPPathPattern("/machine.MachineService/Reboot"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Reboot_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Reboot_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Restart_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Restart", runtime.WithHTTPPathPattern("/machine.MachineService/Restart"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Restart_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Restart_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Rollback_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Rollback", runtime.WithHTTPPathPattern("/machine.MachineService/Rollback"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Rollback_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Rollback_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Reset_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Reset", runtime.WithHTTPPathPattern("/machine.MachineService/Reset"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Reset_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Reset_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_ServiceList_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/ServiceList", runtime.WithHTTPPathPattern("/machine.MachineService/ServiceList"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_ServiceList_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_ServiceList_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_ServiceRestart_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/ServiceRestart", runtime.WithHTTPPathPattern("/machine.MachineService/ServiceRestart"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_ServiceRestart_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_ServiceRestart_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_ServiceStart_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/ServiceStart", runtime.WithHTTPPathPattern("/machine.MachineService/ServiceStart"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_ServiceStart_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_ServiceStart_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_ServiceStop_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/ServiceStop", runtime.WithHTTPPathPattern("/machine.MachineService/ServiceStop"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_ServiceStop_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_ServiceStop_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Shutdown_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Shutdown", runtime.WithHTTPPathPattern("/machine.MachineService/Shutdown"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Shutdown_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Shutdown_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Stats_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Stats", runtime.WithHTTPPathPattern("/machine.MachineService/Stats"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Stats_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Stats_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_SystemStat_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/SystemStat", runtime.WithHTTPPathPattern("/machine.MachineService/SystemStat"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_SystemStat_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_SystemStat_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Upgrade_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Upgrade", runtime.WithHTTPPathPattern("/machine.MachineService/Upgrade"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Upgrade_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Upgrade_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_Version_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/Version", runtime.WithHTTPPathPattern("/machine.MachineService/Version"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_Version_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_Version_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_GenerateClientConfiguration_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/GenerateClientConfiguration", runtime.WithHTTPPathPattern("/machine.MachineService/GenerateClientConfiguration"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_GenerateClientConfiguration_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_GenerateClientConfiguration_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+
+	})
+
+	mux.Handle("POST", pattern_MachineService_PacketCapture_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		var err error
+		var annotatedContext context.Context
+		annotatedContext, err = runtime.AnnotateContext(ctx, mux, req, "/machine.MachineService/PacketCapture", runtime.WithHTTPPathPattern("/machine.MachineService/PacketCapture"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_MachineService_PacketCapture_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+
+		forward_MachineService_PacketCapture_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
+
+	})
+
+	return nil
+}
+
+var (
+	pattern_MachineService_ApplyConfiguration_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "ApplyConfiguration"}, ""))
+
+	pattern_MachineService_Bootstrap_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Bootstrap"}, ""))
+
+	pattern_MachineService_Containers_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Containers"}, ""))
+
+	pattern_MachineService_Copy_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Copy"}, ""))
+
+	pattern_MachineService_CPUInfo_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "CPUInfo"}, ""))
+
+	pattern_MachineService_DiskStats_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "DiskStats"}, ""))
+
+	pattern_MachineService_Dmesg_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Dmesg"}, ""))
+
+	pattern_MachineService_Events_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Events"}, ""))
+
+	pattern_MachineService_EtcdMemberList_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "EtcdMemberList"}, ""))
+
+	pattern_MachineService_EtcdRemoveMember_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "EtcdRemoveMember"}, ""))
+
+	pattern_MachineService_EtcdLeaveCluster_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "EtcdLeaveCluster"}, ""))
+
+	pattern_MachineService_EtcdForfeitLeadership_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "EtcdForfeitLeadership"}, ""))
+
+	pattern_MachineService_EtcdRecover_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "EtcdRecover"}, ""))
+
+	pattern_MachineService_EtcdSnapshot_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "EtcdSnapshot"}, ""))
+
+	pattern_MachineService_GenerateConfiguration_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "GenerateConfiguration"}, ""))
+
+	pattern_MachineService_Hostname_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Hostname"}, ""))
+
+	pattern_MachineService_Kubeconfig_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Kubeconfig"}, ""))
+
+	pattern_MachineService_List_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "List"}, ""))
+
+	pattern_MachineService_DiskUsage_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "DiskUsage"}, ""))
+
+	pattern_MachineService_LoadAvg_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "LoadAvg"}, ""))
+
+	pattern_MachineService_Logs_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Logs"}, ""))
+
+	pattern_MachineService_Memory_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Memory"}, ""))
+
+	pattern_MachineService_Mounts_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Mounts"}, ""))
+
+	pattern_MachineService_NetworkDeviceStats_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "NetworkDeviceStats"}, ""))
+
+	pattern_MachineService_Processes_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Processes"}, ""))
+
+	pattern_MachineService_Read_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Read"}, ""))
+
+	pattern_MachineService_Reboot_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Reboot"}, ""))
+
+	pattern_MachineService_Restart_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Restart"}, ""))
+
+	pattern_MachineService_Rollback_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Rollback"}, ""))
+
+	pattern_MachineService_Reset_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Reset"}, ""))
+
+	pattern_MachineService_ServiceList_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "ServiceList"}, ""))
+
+	pattern_MachineService_ServiceRestart_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "ServiceRestart"}, ""))
+
+	pattern_MachineService_ServiceStart_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "ServiceStart"}, ""))
+
+	pattern_MachineService_ServiceStop_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "ServiceStop"}, ""))
+
+	pattern_MachineService_Shutdown_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Shutdown"}, ""))
+
+	pattern_MachineService_Stats_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Stats"}, ""))
+
+	pattern_MachineService_SystemStat_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "SystemStat"}, ""))
+
+	pattern_MachineService_Upgrade_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Upgrade"}, ""))
+
+	pattern_MachineService_Version_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "Version"}, ""))
+
+	pattern_MachineService_GenerateClientConfiguration_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "GenerateClientConfiguration"}, ""))
+
+	pattern_MachineService_PacketCapture_0 = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"machine.MachineService", "PacketCapture"}, ""))
+)
+
+var (
+	forward_MachineService_ApplyConfiguration_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Bootstrap_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Containers_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Copy_0 = runtime.ForwardResponseStream
+
+	forward_MachineService_CPUInfo_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_DiskStats_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Dmesg_0 = runtime.ForwardResponseStream
+
+	forward_MachineService_Events_0 = runtime.ForwardResponseStream
+
+	forward_MachineService_EtcdMemberList_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_EtcdRemoveMember_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_EtcdLeaveCluster_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_EtcdForfeitLeadership_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_EtcdRecover_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_EtcdSnapshot_0 = runtime.ForwardResponseStream
+
+	forward_MachineService_GenerateConfiguration_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Hostname_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Kubeconfig_0 = runtime.ForwardResponseStream
+
+	forward_MachineService_List_0 = runtime.ForwardResponseStream
+
+	forward_MachineService_DiskUsage_0 = runtime.ForwardResponseStream
+
+	forward_MachineService_LoadAvg_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Logs_0 = runtime.ForwardResponseStream
+
+	forward_MachineService_Memory_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Mounts_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_NetworkDeviceStats_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Processes_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Read_0 = runtime.ForwardResponseStream
+
+	forward_MachineService_Reboot_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Restart_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Rollback_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Reset_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_ServiceList_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_ServiceRestart_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_ServiceStart_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_ServiceStop_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Shutdown_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Stats_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_SystemStat_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Upgrade_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_Version_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_GenerateClientConfiguration_0 = runtime.ForwardResponseMessage
+
+	forward_MachineService_PacketCapture_0 = runtime.ForwardResponseStream
+)
diff --git a/client/api/talos/machine/machine.proto b/client/api/talos/machine/machine.proto
new file mode 100644
index 000000000..f2d6cdfff
--- /dev/null
+++ b/client/api/talos/machine/machine.proto
@@ -0,0 +1,1097 @@
+syntax = "proto3";
+
+package machine;
+
+option go_package = "github.com/siderolabs/talos/pkg/machinery/api/machine";
+
+import "common/common.proto";
+import "google/protobuf/any.proto";
+import "google/protobuf/duration.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/timestamp.proto";
+
+// The machine service definition.
+service MachineService {
+  rpc ApplyConfiguration(ApplyConfigurationRequest) returns (ApplyConfigurationResponse);
+  // Bootstrap method makes control plane node enter etcd bootstrap mode.
+  //
+  // Node aborts etcd join sequence and creates single-node etcd cluster.
+  //
+  // If recover_etcd argument is specified, etcd is recovered from a snapshot
+  // uploaded with EtcdRecover.
+  rpc Bootstrap(BootstrapRequest) returns (BootstrapResponse);
+  rpc Containers(ContainersRequest) returns (ContainersResponse);
+  rpc Copy(CopyRequest) returns (stream common.Data);
+  rpc CPUInfo(google.protobuf.Empty) returns (CPUInfoResponse);
+  rpc DiskStats(google.protobuf.Empty) returns (DiskStatsResponse);
+  rpc Dmesg(DmesgRequest) returns (stream common.Data);
+  rpc Events(EventsRequest) returns (stream Event);
+  rpc EtcdMemberList(EtcdMemberListRequest) returns (EtcdMemberListResponse);
+  rpc EtcdRemoveMember(EtcdRemoveMemberRequest) returns (EtcdRemoveMemberResponse);
+  rpc EtcdLeaveCluster(EtcdLeaveClusterRequest) returns (EtcdLeaveClusterResponse);
+  rpc EtcdForfeitLeadership(EtcdForfeitLeadershipRequest) returns (EtcdForfeitLeadershipResponse);
+  // EtcdRecover method uploads etcd data snapshot created with EtcdSnapshot
+  // to the node.
+  //
+  // Snapshot can be later used to recover the cluster via Bootstrap method.
+  rpc EtcdRecover(stream common.Data) returns (EtcdRecoverResponse);
+  // EtcdSnapshot method creates etcd data snapshot (backup) from the local etcd instance
+  // and streams it back to the client.
+  //
+  // This method is available only on control plane nodes (which run etcd).
+  rpc EtcdSnapshot(EtcdSnapshotRequest) returns (stream common.Data);
+  rpc GenerateConfiguration(GenerateConfigurationRequest) returns (GenerateConfigurationResponse);
+  rpc Hostname(google.protobuf.Empty) returns (HostnameResponse);
+  rpc Kubeconfig(google.protobuf.Empty) returns (stream common.Data);
+  rpc List(ListRequest) returns (stream FileInfo);
+  rpc DiskUsage(DiskUsageRequest) returns (stream DiskUsageInfo);
+  rpc LoadAvg(google.protobuf.Empty) returns (LoadAvgResponse);
+  rpc Logs(LogsRequest) returns (stream common.Data);
+  rpc Memory(google.protobuf.Empty) returns (MemoryResponse);
+  rpc Mounts(google.protobuf.Empty) returns (MountsResponse);
+  rpc NetworkDeviceStats(google.protobuf.Empty) returns (NetworkDeviceStatsResponse);
+  rpc Processes(google.protobuf.Empty) returns (ProcessesResponse);
+  rpc Read(ReadRequest) returns (stream common.Data);
+  rpc Reboot(RebootRequest) returns (RebootResponse);
+  rpc Restart(RestartRequest) returns (RestartResponse);
+  rpc Rollback(RollbackRequest) returns (RollbackResponse);
+  rpc Reset(ResetRequest) returns (ResetResponse);
+  rpc ServiceList(google.protobuf.Empty) returns (ServiceListResponse);
+  rpc ServiceRestart(ServiceRestartRequest) returns (ServiceRestartResponse);
+  rpc ServiceStart(ServiceStartRequest) returns (ServiceStartResponse);
+  rpc ServiceStop(ServiceStopRequest) returns (ServiceStopResponse);
+  rpc Shutdown(ShutdownRequest) returns (ShutdownResponse);
+  rpc Stats(StatsRequest) returns (StatsResponse);
+  rpc SystemStat(google.protobuf.Empty) returns (SystemStatResponse);
+  rpc Upgrade(UpgradeRequest) returns (UpgradeResponse);
+  rpc Version(google.protobuf.Empty) returns (VersionResponse);
+  // GenerateClientConfiguration generates talosctl client configuration (talosconfig).
+  rpc GenerateClientConfiguration(GenerateClientConfigurationRequest) returns (GenerateClientConfigurationResponse);
+  // PacketCapture performs packet capture and streams back pcap file.
+  rpc PacketCapture(PacketCaptureRequest) returns (stream common.Data);
+}
+
+// rpc applyConfiguration
+// ApplyConfiguration describes a request to assert a new configuration upon a
+// node.
+message ApplyConfigurationRequest {
+  enum Mode {
+    REBOOT = 0;
+    AUTO = 1;
+    NO_REBOOT = 2;
+    STAGED = 3;
+    TRY = 4;
+  }
+  bytes data = 1;
+  // replaced by mode
+  bool on_reboot = 2 [
+    (common.remove_deprecated_field) = "v1.4",
+    deprecated = true
+  ];
+  // replaced by mode
+  bool immediate = 3 [
+    (common.remove_deprecated_field) = "v1.4",
+    deprecated = true
+  ];
+  Mode mode = 4;
+  bool dry_run = 5;
+  google.protobuf.Duration try_mode_timeout = 6;
+}
+
+// ApplyConfigurationResponse describes the response to a configuration request.
+message ApplyConfiguration {
+  common.Metadata metadata = 1;
+  // Configuration validation warnings.
+  repeated string warnings = 2;
+  // States which mode was actually chosen.
+  ApplyConfigurationRequest.Mode mode = 3;
+  // Human-readable message explaining the result of the apply configuration call.
+  string mode_details = 4;
+}
+
+message ApplyConfigurationResponse {
+  repeated ApplyConfiguration messages = 1;
+}
+
+// rpc reboot
+message RebootRequest {
+  enum Mode {
+    DEFAULT = 0;
+    POWERCYCLE = 1;
+  }
+  Mode mode = 1;
+}
+
+// The reboot message containing the reboot status.
+message Reboot {
+  common.Metadata metadata = 1;
+  string actor_id = 2;
+}
+
+message RebootResponse {
+  repeated Reboot messages = 1;
+}
+
+// rpc Bootstrap
+message BootstrapRequest {
+  // Enable etcd recovery from the snapshot.
+  //
+  // Snapshot should be uploaded before this call via EtcdRecover RPC.
+  bool recover_etcd = 1;
+  // Skip hash check on the snapshot (etcd).
+  //
+  // Enable this when recovering from data directory copy to skip integrity check.
+  bool recover_skip_hash_check = 2;
+}
+
+// The bootstrap message containing the bootstrap status.
+message Bootstrap {
+  common.Metadata metadata = 1;
+}
+
+message BootstrapResponse {
+  repeated Bootstrap messages = 1;
+}
+
+// rpc events
+message SequenceEvent {
+  string sequence = 1;
+  enum Action {
+    NOOP = 0;
+    START = 1;
+    STOP = 2;
+  }
+  Action action = 2;
+  common.Error error = 3;
+}
+
+message PhaseEvent {
+  string phase = 1;
+  enum Action {
+    START = 0;
+    STOP = 1;
+  }
+  Action action = 2;
+}
+
+message TaskEvent {
+  string task = 1;
+  enum Action {
+    START = 0;
+    STOP = 1;
+  }
+  Action action = 2;
+}
+
+message ServiceStateEvent {
+  string service = 1;
+  enum Action {
+    INITIALIZED = 0;
+    PREPARING = 1;
+    WAITING = 2;
+    RUNNING = 3;
+    STOPPING = 4;
+    FINISHED = 5;
+    FAILED = 6;
+    SKIPPED = 7;
+  }
+  Action action = 2;
+  string message = 3;
+  ServiceHealth health = 4;
+}
+
+message RestartEvent {
+  int64 cmd = 1;
+}
+
+// ConfigLoadErrorEvent is reported when the config loading has failed.
+message ConfigLoadErrorEvent {
+  string error = 1;
+}
+
+// ConfigValidationErrorEvent is reported when config validation has failed.
+message ConfigValidationErrorEvent {
+  string error = 1;
+}
+
+// AddressEvent reports node endpoints aggregated from k8s.Endpoints and network.Hostname.
+message AddressEvent {
+  string hostname = 1;
+  repeated string addresses = 2;
+}
+
+// MachineStatusEvent reports changes to the MachineStatus resource.
+message MachineStatusEvent {
+  message MachineStatus {
+    message UnmetCondition {
+      string name = 1;
+      string reason = 2;
+    }
+    bool ready = 1;
+    repeated UnmetCondition unmet_conditions = 2;
+  }
+  enum MachineStage {
+    UNKNOWN = 0;
+    BOOTING = 1;
+    INSTALLING = 2;
+    MAINTENANCE = 3;
+    RUNNING = 4;
+    REBOOTING = 5;
+    SHUTTING_DOWN = 6;
+    RESETTING = 7;
+    UPGRADING = 8;
+  }
+  MachineStage stage = 1;
+  MachineStatus status = 2;
+}
+
+message EventsRequest {
+  int32 tail_events = 1;
+  string tail_id = 2;
+  int32 tail_seconds = 3;
+  string with_actor_id = 4;
+}
+
+message Event {
+  common.Metadata metadata = 1;
+  google.protobuf.Any data = 2;
+  string id = 3;
+  string actor_id = 4;
+}
+
+// rpc reset
+message ResetPartitionSpec {
+  string label = 1;
+  bool wipe = 2;
+}
+
+message ResetRequest {
+  // Graceful indicates whether node should leave etcd before the upgrade, it also
+  // enforces etcd checks before leaving.
+  bool graceful = 1;
+  // Reboot indicates whether node should reboot or halt after resetting.
+  bool reboot = 2;
+  // System_partitions_to_wipe lists specific system disk partitions to be reset (wiped).
+  // If system_partitions_to_wipe is empty, all the partitions are erased.
+  repeated ResetPartitionSpec system_partitions_to_wipe = 3;
+}
+
+// The reset message containing the restart status.
+message Reset {
+  common.Metadata metadata = 1;
+  string actor_id = 2;
+}
+
+message ResetResponse {
+  repeated Reset messages = 1;
+}
+
+// rpc shutdown
+// The messages message containing the shutdown status.
+message Shutdown {
+  common.Metadata metadata = 1;
+  string actor_id = 2;
+}
+
+message ShutdownRequest {
+  // Force indicates whether node should shutdown without first cordening and draining
+  bool force = 1;
+}
+
+message ShutdownResponse {
+  repeated Shutdown messages = 1;
+}
+
+// rpc upgrade
+message UpgradeRequest {
+  string image = 1;
+  bool preserve = 2;
+  bool stage = 3;
+  bool force = 4;
+}
+
+message Upgrade {
+  common.Metadata metadata = 1;
+  string ack = 2;
+  string actor_id = 3;
+}
+
+message UpgradeResponse {
+  repeated Upgrade messages = 1;
+}
+
+// rpc servicelist
+message ServiceList {
+  common.Metadata metadata = 1;
+  repeated ServiceInfo services = 2;
+}
+
+message ServiceListResponse {
+  repeated ServiceList messages = 1;
+}
+
+message ServiceInfo {
+  string id = 1;
+  string state = 2;
+  ServiceEvents events = 3;
+  ServiceHealth health = 4;
+}
+
+message ServiceEvents {
+  repeated ServiceEvent events = 1;
+}
+
+message ServiceEvent {
+  string msg = 1;
+  string state = 2;
+  google.protobuf.Timestamp ts = 3;
+}
+
+message ServiceHealth {
+  bool unknown = 1;
+  bool healthy = 2;
+  string last_message = 3;
+  google.protobuf.Timestamp last_change = 4;
+}
+
+// rpc servicestart
+message ServiceStartRequest {
+  string id = 1;
+}
+
+message ServiceStart {
+  common.Metadata metadata = 1;
+  string resp = 2;
+}
+
+message ServiceStartResponse {
+  repeated ServiceStart messages = 1;
+}
+
+message ServiceStopRequest {
+  string id = 1;
+}
+
+message ServiceStop {
+  common.Metadata metadata = 1;
+  string resp = 2;
+}
+
+message ServiceStopResponse {
+  repeated ServiceStop messages = 1;
+}
+
+message ServiceRestartRequest {
+  string id = 1;
+}
+
+message ServiceRestart {
+  common.Metadata metadata = 1;
+  string resp = 2;
+}
+
+message ServiceRestartResponse {
+  repeated ServiceRestart messages = 1;
+}
+
+// CopyRequest describes a request to copy data out of Talos node
+//
+// Copy produces .tar.gz archive which is streamed back to the caller
+message CopyRequest {
+  // Root path to start copying data out, it might be either a file or directory
+  string root_path = 1;
+}
+
+// ListRequest describes a request to list the contents of a directory.
+message ListRequest {
+  // Root indicates the root directory for the list. If not indicated, '/' is
+  // presumed.
+  string root = 1;
+  // Recurse indicates that subdirectories should be recursed.
+  bool recurse = 2;
+  // RecursionDepth indicates how many levels of subdirectories should be
+  // recursed. The default (0) indicates that no limit should be enforced.
+  int32 recursion_depth = 3;
+  // File type.
+  enum Type {
+    // Regular file (not directory, symlink, etc).
+    REGULAR = 0;
+    // Directory.
+    DIRECTORY = 1;
+    // Symbolic link.
+    SYMLINK = 2;
+  }
+  // Types indicates what file type should be returned. If not indicated,
+  // all files will be returned.
+  repeated Type types = 4;
+}
+
+// DiskUsageRequest describes a request to list disk usage of directories and regular files
+message DiskUsageRequest {
+  // RecursionDepth indicates how many levels of subdirectories should be
+  // recursed. The default (0) indicates that no limit should be enforced.
+  int32 recursion_depth = 1;
+  // All write sizes for all files, not just directories.
+  bool all = 2;
+  // Threshold exclude entries smaller than SIZE if positive,
+  // or entries greater than SIZE if negative.
+  int64 threshold = 3;
+  // DiskUsagePaths is the list of directories to calculate disk usage for.
+  repeated string paths = 4;
+}
+
+// FileInfo describes a file or directory's information
+message FileInfo {
+  common.Metadata metadata = 1;
+  // Name is the name (including prefixed path) of the file or directory
+  string name = 2;
+  // Size indicates the number of bytes contained within the file
+  int64 size = 3;
+  // Mode is the bitmap of UNIX mode/permission flags of the file
+  uint32 mode = 4;
+  // Modified indicates the UNIX timestamp at which the file was last modified
+  int64 modified = 5;
+  // IsDir indicates that the file is a directory
+  bool is_dir = 6;
+  // Error describes any error encountered while trying to read the file
+  // information.
+  string error = 7;
+  // Link is filled with symlink target
+  string link = 8;
+  // RelativeName is the name of the file or directory relative to the RootPath
+  string relative_name = 9;
+  // Owner uid
+  uint32 uid = 10;
+  // Owner gid
+  uint32 gid = 11;
+}
+
+// DiskUsageInfo describes a file or directory's information for du command
+message DiskUsageInfo {
+  common.Metadata metadata = 1;
+  // Name is the name (including prefixed path) of the file or directory
+  string name = 2;
+  // Size indicates the number of bytes contained within the file
+  int64 size = 3;
+  // Error describes any error encountered while trying to read the file
+  // information.
+  string error = 4;
+  // RelativeName is the name of the file or directory relative to the RootPath
+  string relative_name = 5;
+}
+
+// The messages message containing the requested df stats.
+message Mounts {
+  common.Metadata metadata = 1;
+  repeated MountStat stats = 2;
+}
+
+message MountsResponse {
+  repeated Mounts messages = 1;
+}
+
+// The messages message containing the requested processes.
+message MountStat {
+  string filesystem = 1;
+  uint64 size = 2;
+  uint64 available = 3;
+  string mounted_on = 4;
+}
+
+message Version {
+  common.Metadata metadata = 1;
+  VersionInfo version = 2;
+  PlatformInfo platform = 3;
+  // Features describe individual Talos features that can be switched on or off.
+  FeaturesInfo features = 4;
+}
+
+message VersionResponse {
+  repeated Version messages = 1;
+}
+
+message VersionInfo {
+  string tag = 1;
+  string sha = 2;
+  string built = 3;
+  string go_version = 4;
+  string os = 5;
+  string arch = 6;
+}
+
+message PlatformInfo {
+  string name = 1;
+  string mode = 2;
+}
+
+// FeaturesInfo describes individual Talos features that can be switched on or off.
+message FeaturesInfo {
+  // RBAC is true if role-based access control is enabled.
+  bool rbac = 1;
+}
+
+// rpc logs
+// The request message containing the process name.
+message LogsRequest {
+  string namespace = 1;
+  string id = 2;
+  // driver might be default "containerd" or "cri"
+  common.ContainerDriver driver = 3;
+  bool follow = 4;
+  int32 tail_lines = 5;
+}
+
+message ReadRequest {
+  string path = 1;
+}
+
+// rpc rollback
+message RollbackRequest {}
+
+message Rollback {
+  common.Metadata metadata = 1;
+}
+
+message RollbackResponse {
+  repeated Rollback messages = 1;
+}
+
+// rpc Containers
+
+message ContainersRequest {
+  string namespace = 1;
+  // driver might be default "containerd" or "cri"
+  common.ContainerDriver driver = 2;
+}
+
+// The messages message containing the requested containers.
+message ContainerInfo {
+  string namespace = 1;
+  string id = 2;
+  string image = 3;
+  uint32 pid = 4;
+  string status = 5;
+  string pod_id = 6;
+  string name = 7;
+}
+
+// The messages message containing the requested containers.
+message Container {
+  common.Metadata metadata = 1;
+  repeated ContainerInfo containers = 2;
+}
+
+message ContainersResponse {
+  repeated Container messages = 1;
+}
+
+// dmesg
+message DmesgRequest {
+  bool follow = 1;
+  bool tail = 2;
+}
+
+// rpc processes
+message ProcessesResponse {
+  repeated Process messages = 1;
+}
+
+message Process {
+  common.Metadata metadata = 1;
+  repeated ProcessInfo processes = 2;
+}
+
+message ProcessInfo {
+  int32 pid = 1;
+  int32 ppid = 2;
+  string state = 3;
+  int32 threads = 4;
+  double cpu_time = 5;
+  uint64 virtual_memory = 6;
+  uint64 resident_memory = 7;
+  string command = 8;
+  string executable = 9;
+  string args = 10;
+}
+
+// rpc restart
+// The request message containing the process to restart.
+message RestartRequest {
+  string namespace = 1;
+  string id = 2;
+  // driver might be default "containerd" or "cri"
+  common.ContainerDriver driver = 3;
+}
+
+message Restart {
+  common.Metadata metadata = 1;
+}
+
+// The messages message containing the restart status.
+message RestartResponse {
+  repeated Restart messages = 1;
+}
+
+// rpc stats
+
+// The request message containing the containerd namespace.
+message StatsRequest {
+  string namespace = 1;
+  // driver might be default "containerd" or "cri"
+  common.ContainerDriver driver = 2;
+}
+
+// The messages message containing the requested stats.
+message Stats {
+  common.Metadata metadata = 1;
+  repeated Stat stats = 2;
+}
+
+message StatsResponse {
+  repeated Stats messages = 1;
+}
+
+// The messages message containing the requested stat.
+message Stat {
+  string namespace = 1;
+  string id = 2;
+  uint64 memory_usage = 4;
+  uint64 cpu_usage = 5;
+  string pod_id = 6;
+  string name = 7;
+}
+
+message Memory {
+  common.Metadata metadata = 1;
+  MemInfo meminfo = 2;
+}
+
+message MemoryResponse {
+  repeated Memory messages = 1;
+}
+
+message MemInfo {
+  uint64 memtotal = 1;
+  uint64 memfree = 2;
+  uint64 memavailable = 3;
+  uint64 buffers = 4;
+  uint64 cached = 5;
+  uint64 swapcached = 6;
+  uint64 active = 7;
+  uint64 inactive = 8;
+  uint64 activeanon = 9;
+  uint64 inactiveanon = 10;
+  uint64 activefile = 11;
+  uint64 inactivefile = 12;
+  uint64 unevictable = 13;
+  uint64 mlocked = 14;
+  uint64 swaptotal = 15;
+  uint64 swapfree = 16;
+  uint64 dirty = 17;
+  uint64 writeback = 18;
+  uint64 anonpages = 19;
+  uint64 mapped = 20;
+  uint64 shmem = 21;
+  uint64 slab = 22;
+  uint64 sreclaimable = 23;
+  uint64 sunreclaim = 24;
+  uint64 kernelstack = 25;
+  uint64 pagetables = 26;
+  uint64 nfsunstable = 27;
+  uint64 bounce = 28;
+  uint64 writebacktmp = 29;
+  uint64 commitlimit = 30;
+  uint64 committedas = 31;
+  uint64 vmalloctotal = 32;
+  uint64 vmallocused = 33;
+  uint64 vmallocchunk = 34;
+  uint64 hardwarecorrupted = 35;
+  uint64 anonhugepages = 36;
+  uint64 shmemhugepages = 37;
+  uint64 shmempmdmapped = 38;
+  uint64 cmatotal = 39;
+  uint64 cmafree = 40;
+  uint64 hugepagestotal = 41;
+  uint64 hugepagesfree = 42;
+  uint64 hugepagesrsvd = 43;
+  uint64 hugepagessurp = 44;
+  uint64 hugepagesize = 45;
+  uint64 directmap4k = 46;
+  uint64 directmap2m = 47;
+  uint64 directmap1g = 48;
+}
+
+// rpc Hostname
+
+message HostnameResponse {
+  repeated Hostname messages = 1;
+}
+
+message Hostname {
+  common.Metadata metadata = 1;
+  string hostname = 2;
+}
+
+// rpc LoadAvg
+
+message LoadAvgResponse {
+  repeated LoadAvg messages = 1;
+}
+
+message LoadAvg {
+  common.Metadata metadata = 1;
+  double load1 = 2;
+  double load5 = 3;
+  double load15 = 4;
+}
+
+// rpc SystemStat
+
+message SystemStatResponse {
+  repeated SystemStat messages = 1;
+}
+
+message SystemStat {
+  common.Metadata metadata = 1;
+  uint64 boot_time = 2;
+  CPUStat cpu_total = 3;
+  repeated CPUStat cpu = 4;
+  uint64 irq_total = 5;
+  repeated uint64 irq = 6;
+  uint64 context_switches = 7;
+  uint64 process_created = 8;
+  uint64 process_running = 9;
+  uint64 process_blocked = 10;
+  uint64 soft_irq_total = 11;
+  SoftIRQStat soft_irq = 12;
+}
+
+message CPUStat {
+  double user = 1;
+  double nice = 2;
+  double system = 3;
+  double idle = 4;
+  double iowait = 5;
+  double irq = 6;
+  double soft_irq = 7;
+  double steal = 8;
+  double guest = 9;
+  double guest_nice = 10;
+}
+
+message SoftIRQStat {
+  uint64 hi = 1;
+  uint64 timer = 2;
+  uint64 net_tx = 3;
+  uint64 net_rx = 4;
+  uint64 block = 5;
+  uint64 block_io_poll = 6;
+  uint64 tasklet = 7;
+  uint64 sched = 8;
+  uint64 hrtimer = 9;
+  uint64 rcu = 10;
+}
+
+// rpc CPUInfo
+
+message CPUInfoResponse {
+  repeated CPUsInfo messages = 1;
+}
+
+message CPUsInfo {
+  common.Metadata metadata = 1;
+  repeated CPUInfo cpu_info = 2;
+}
+
+message CPUInfo {
+  uint32 processor = 1;
+  string vendor_id = 2;
+  string cpu_family = 3;
+  string model = 4;
+  string model_name = 5;
+  string stepping = 6;
+  string microcode = 7;
+  double cpu_mhz = 8;
+  string cache_size = 9;
+  string physical_id = 10;
+  uint32 siblings = 11;
+  string core_id = 12;
+  uint32 cpu_cores = 13;
+  string apic_id = 14;
+  string initial_apic_id = 15;
+  string fpu = 16;
+  string fpu_exception = 17;
+  uint32 cpu_id_level = 18;
+  string wp = 19;
+  repeated string flags = 20;
+  repeated string bugs = 21;
+  double bogo_mips = 22;
+  uint32 cl_flush_size = 23;
+  uint32 cache_alignment = 24;
+  string address_sizes = 25;
+  string power_management = 26;
+}
+
+// rpc NetworkDeviceStats
+
+message NetworkDeviceStatsResponse {
+  repeated NetworkDeviceStats messages = 1;
+}
+
+message NetworkDeviceStats {
+  common.Metadata metadata = 1;
+  NetDev total = 2;
+  repeated NetDev devices = 3;
+}
+
+message NetDev {
+  string name = 1;
+  uint64 rx_bytes = 2;
+  uint64 rx_packets = 3;
+  uint64 rx_errors = 4;
+  uint64 rx_dropped = 5;
+  uint64 rx_fifo = 6;
+  uint64 rx_frame = 7;
+  uint64 rx_compressed = 8;
+  uint64 rx_multicast = 9;
+  uint64 tx_bytes = 10;
+  uint64 tx_packets = 11;
+  uint64 tx_errors = 12;
+  uint64 tx_dropped = 13;
+  uint64 tx_fifo = 14;
+  uint64 tx_collisions = 15;
+  uint64 tx_carrier = 16;
+  uint64 tx_compressed = 17;
+}
+
+// rpc DiskStats
+
+message DiskStatsResponse {
+  repeated DiskStats messages = 1;
+}
+
+message DiskStats {
+  common.Metadata metadata = 1;
+  DiskStat total = 2;
+  repeated DiskStat devices = 3;
+}
+
+message DiskStat {
+  string name = 1;
+  uint64 read_completed = 2;
+  uint64 read_merged = 3;
+  uint64 read_sectors = 4;
+  uint64 read_time_ms = 5;
+  uint64 write_completed = 6;
+  uint64 write_merged = 7;
+  uint64 write_sectors = 8;
+  uint64 write_time_ms = 9;
+  uint64 io_in_progress = 10;
+  uint64 io_time_ms = 11;
+  uint64 io_time_weighted_ms = 12;
+  uint64 discard_completed = 13;
+  uint64 discard_merged = 14;
+  uint64 discard_sectors = 15;
+  uint64 discard_time_ms = 16;
+}
+
+message EtcdLeaveClusterRequest {}
+
+message EtcdLeaveCluster {
+  common.Metadata metadata = 1;
+}
+
+message EtcdLeaveClusterResponse {
+  repeated EtcdLeaveCluster messages = 1;
+}
+
+message EtcdRemoveMemberRequest {
+  string member = 1;
+}
+
+message EtcdRemoveMember {
+  common.Metadata metadata = 1;
+}
+
+message EtcdRemoveMemberResponse {
+  repeated EtcdRemoveMember messages = 1;
+}
+
+message EtcdForfeitLeadershipRequest {}
+
+message EtcdForfeitLeadership {
+  common.Metadata metadata = 1;
+  string member = 2;
+}
+
+message EtcdForfeitLeadershipResponse {
+  repeated EtcdForfeitLeadership messages = 1;
+}
+
+message EtcdMemberListRequest {
+  bool query_local = 1;
+}
+
+// EtcdMember describes a single etcd member.
+message EtcdMember {
+  // member ID.
+  uint64 id = 2;
+  // human-readable name of the member.
+  string hostname = 3;
+  // the list of URLs the member exposes to clients for communication.
+  repeated string peer_urls = 4;
+  // the list of URLs the member exposes to the cluster for communication.
+  repeated string client_urls = 5;
+  // learner flag
+  bool is_learner = 6;
+}
+
+// EtcdMembers contains the list of members registered on the host.
+message EtcdMembers {
+  common.Metadata metadata = 1;
+  // list of member hostnames.
+  repeated string legacy_members = 2;
+  // the list of etcd members registered on the node.
+  repeated EtcdMember members = 3;
+}
+
+message EtcdMemberListResponse {
+  repeated EtcdMembers messages = 1;
+}
+
+message EtcdSnapshotRequest {}
+
+message EtcdRecover {
+  common.Metadata metadata = 1;
+}
+
+message EtcdRecoverResponse {
+  repeated EtcdRecover messages = 1;
+}
+
+// rpc generateConfiguration
+
+message RouteConfig {
+  string network = 1;
+  string gateway = 2;
+  uint32 metric = 3;
+}
+
+message DHCPOptionsConfig {
+  uint32 route_metric = 1;
+}
+
+message NetworkDeviceConfig {
+  string interface = 1;
+  string cidr = 2;
+  int32 mtu = 3;
+  bool dhcp = 4;
+  bool ignore = 5;
+  DHCPOptionsConfig dhcp_options = 6;
+  repeated RouteConfig routes = 7;
+}
+
+message NetworkConfig {
+  string hostname = 1;
+  repeated NetworkDeviceConfig interfaces = 2;
+}
+
+message InstallConfig {
+  string install_disk = 1;
+  string install_image = 2;
+}
+
+message MachineConfig {
+  enum MachineType {
+    TYPE_UNKNOWN = 0;
+    TYPE_INIT = 1;
+    TYPE_CONTROL_PLANE = 2;
+    TYPE_WORKER = 3;
+  }
+  MachineType type = 1;
+  InstallConfig install_config = 2;
+  NetworkConfig network_config = 3;
+  string kubernetes_version = 4;
+}
+
+message ControlPlaneConfig {
+  string endpoint = 1;
+}
+
+message CNIConfig {
+  string name = 1;
+  repeated string urls = 2;
+}
+
+message ClusterNetworkConfig {
+  string dns_domain = 1;
+  CNIConfig cni_config = 2;
+}
+
+message ClusterConfig {
+  string name = 1;
+  ControlPlaneConfig control_plane = 2;
+  ClusterNetworkConfig cluster_network = 3;
+  bool allow_scheduling_on_control_planes = 4;
+}
+
+// GenerateConfigurationRequest describes a request to generate a new configuration
+// on a node.
+message GenerateConfigurationRequest {
+  string config_version = 1;
+  ClusterConfig cluster_config = 2;
+  MachineConfig machine_config = 3;
+  google.protobuf.Timestamp override_time = 4;
+}
+
+// GenerateConfiguration describes the response to a generate configuration request.
+message GenerateConfiguration {
+  common.Metadata metadata = 1;
+  repeated bytes data = 2;
+  bytes talosconfig = 3;
+}
+
+message GenerateConfigurationResponse {
+  repeated GenerateConfiguration messages = 1;
+}
+
+message GenerateClientConfigurationRequest {
+  // Roles in the generated client certificate.
+  repeated string roles = 1;
+  // Client certificate TTL.
+  google.protobuf.Duration crt_ttl = 2;
+}
+
+message GenerateClientConfiguration {
+  common.Metadata metadata = 1;
+  // PEM-encoded CA certificate.
+  bytes ca = 2;
+  // PEM-encoded generated client certificate.
+  bytes crt = 3;
+  // PEM-encoded generated client key.
+  bytes key = 4;
+  // Client configuration (talosconfig) file content.
+  bytes talosconfig = 5;
+}
+
+message GenerateClientConfigurationResponse {
+  repeated GenerateClientConfiguration messages = 1;
+}
+
+message PacketCaptureRequest {
+  // Interface name to perform packet capture on.
+  string interface = 1;
+  // Enable promiscuous mode.
+  bool promiscuous = 2;
+  // Snap length in bytes.
+  uint32 snap_len = 3;
+  // BPF filter.
+  repeated BPFInstruction bpf_filter = 4;
+}
+
+message BPFInstruction {
+  uint32 op = 1;
+  uint32 jt = 2;
+  uint32 jf = 3;
+  uint32 k = 4;
+}
diff --git a/client/api/v1alpha1/resource.proto b/client/api/v1alpha1/resource.proto
new file mode 100644
index 000000000..3a8caf703
--- /dev/null
+++ b/client/api/v1alpha1/resource.proto
@@ -0,0 +1,72 @@
+syntax = "proto3";
+
+// Resource package defines protobuf serialization of COSI resources.
+package cosi.resource;
+
+option go_package = "github.com/cosi-project/runtime/api/v1alpha1";
+
+import "google/protobuf/timestamp.proto";
+
+// Metadata represents resource metadata.
+//
+// (namespace, type, id) is a resource pointer.
+// (version) is a current resource version.
+// (owner) is filled in for controller-managed resources with controller name.
+// (phase) indicates whether resource is going through tear down phase.
+// (finalizers) are attached controllers blocking teardown of the resource.
+// (labels) and (annotations) are free-form key-value pairs; labels allow queries.
+message Metadata {
+    string namespace = 1;
+    string type = 2;
+    string id = 3;
+    string version = 4;
+    string owner = 5;
+    string phase = 6;
+    google.protobuf.Timestamp created = 7;
+    google.protobuf.Timestamp updated = 8;
+    repeated string finalizers = 9;
+    map<string, string> annotations = 11;
+    map<string, string> labels = 10;
+}
+
+// Spec defines content of the resource.
+message Spec {
+    // Protobuf-serialized representation of the resource.
+    bytes proto_spec = 1;
+    // YAML representation of the spec (optional).
+    string yaml_spec = 2;
+}
+
+// Resource is a combination of metadata and spec.
+message Resource {
+    Metadata metadata = 1;
+    Spec spec = 2;
+}
+
+// LabelTerm is an expression on a label.
+message LabelTerm {
+    enum Operation {
+        // Label exists.
+        EXISTS = 0;
+        // Label value is equal.
+        EQUAL = 1;
+        // Label doesn't exist.
+        NOT_EXISTS = 2;
+    }
+
+    string key = 1;
+    Operation op = 2;
+    string value = 3;
+}
+
+// LabelQuery is a query on resource metadata labels.
+//
+// Terms are combined with AND.
+message LabelQuery {
+    repeated LabelTerm terms = 1;
+}
+
+// IDQuery is a query on resource metadata ID.
+message IDQuery {
+    string regexp = 1;
+}
diff --git a/client/go.mod b/client/go.mod
new file mode 100644
index 000000000..1428c1772
--- /dev/null
+++ b/client/go.mod
@@ -0,0 +1,100 @@
+module github.com/siderolabs/omni/client
+
+go 1.22.0
+
+replace (
+	// forked go-yaml that introduces RawYAML interface, which can be used to populate YAML fields using bytes
+	// which are then encoded as a valid YAML blocks with proper indentiation
+	gopkg.in/yaml.v3 => github.com/unix4ever/yaml v0.0.0-20220527175918-f17b0f05cf2c
+	// our fork for tcpproxy with fixes
+	inet.af/tcpproxy => github.com/smira/tcpproxy v0.0.0-20201015133617-de5f7797b95b
+)
+
+require (
+	github.com/adrg/xdg v0.4.0
+	github.com/blang/semver v3.5.1+incompatible
+	github.com/cosi-project/runtime v0.4.0-alpha.6
+	github.com/fatih/color v1.16.0
+	github.com/google/uuid v1.4.0
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0
+	github.com/hashicorp/go-multierror v1.1.1
+	github.com/hexops/gotextdiff v1.0.3
+	github.com/mattn/go-isatty v0.0.20
+	github.com/planetscale/vtprotobuf v0.6.0
+	github.com/sergi/go-diff v1.3.1
+	github.com/siderolabs/gen v0.4.7
+	github.com/siderolabs/go-api-signature v0.3.1
+	github.com/siderolabs/go-kubeconfig v0.1.0
+	github.com/siderolabs/go-pointer v1.0.0
+	github.com/siderolabs/talos/pkg/machinery v1.6.4
+	github.com/spf13/cobra v1.8.0
+	github.com/stretchr/testify v1.8.4
+	github.com/xlab/treeprint v1.2.0
+	go.uber.org/zap v1.26.0
+	golang.org/x/term v0.15.0
+	google.golang.org/grpc v1.61.0
+	google.golang.org/protobuf v1.32.0
+	gopkg.in/yaml.v3 v3.0.1
+	k8s.io/client-go v0.28.4
+)
+
+require (
+	github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c // indirect
+	github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f // indirect
+	github.com/ProtonMail/gopenpgp/v2 v2.7.4 // indirect
+	github.com/cloudflare/circl v1.3.6 // indirect
+	github.com/containerd/go-cni v1.1.9 // indirect
+	github.com/containernetworking/cni v1.1.2 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/gertd/go-pluralize v0.2.1 // indirect
+	github.com/go-logr/logr v1.3.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/josharian/native v1.1.0 // indirect
+	github.com/jsimonetti/rtnetlink v1.4.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mdlayher/ethtool v0.1.0 // indirect
+	github.com/mdlayher/genetlink v1.3.2 // indirect
+	github.com/mdlayher/netlink v1.7.2 // indirect
+	github.com/mdlayher/socket v0.5.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/opencontainers/runtime-spec v1.1.0 // indirect
+	github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	github.com/siderolabs/crypto v0.4.1 // indirect
+	github.com/siderolabs/go-blockdevice v0.4.7 // indirect
+	github.com/siderolabs/net v0.4.0 // indirect
+	github.com/siderolabs/protoenc v0.2.1 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	golang.org/x/crypto v0.16.0 // indirect
+	golang.org/x/net v0.19.0 // indirect
+	golang.org/x/oauth2 v0.15.0 // indirect
+	golang.org/x/sync v0.6.0 // indirect
+	golang.org/x/sys v0.15.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	k8s.io/apimachinery v0.28.4 // indirect
+	k8s.io/klog/v2 v2.110.1 // indirect
+	k8s.io/utils v0.0.0-20231127182322-b307cd553661 // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
+)
diff --git a/client/go.sum b/client/go.sum
new file mode 100644
index 000000000..e7b2f4007
--- /dev/null
+++ b/client/go.sum
@@ -0,0 +1,368 @@
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c h1:kMFnB0vCcX7IL/m9Y5LO+KQYv+t1CQOiFe6+SV2J7bE=
+github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f h1:tCbYj7/299ekTTXpdwKYF8eBlsYsDVoggDAuAjoK66k=
+github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f/go.mod h1:gcr0kNtGBqin9zDW9GOHcVntrwnjrK+qdJ06mWYBybw=
+github.com/ProtonMail/gopenpgp/v2 v2.7.4 h1:Vz/8+HViFFnf2A6XX8JOvZMrA6F5puwNvvF21O1mRlo=
+github.com/ProtonMail/gopenpgp/v2 v2.7.4/go.mod h1:IhkNEDaxec6NyzSI0PlxapinnwPVIESk8/76da3Ct3g=
+github.com/adrg/xdg v0.4.0 h1:RzRqFcjH4nE5C6oTAxhBtoE2IRyjBSa62SCbyPidvls=
+github.com/adrg/xdg v0.4.0/go.mod h1:N6ag73EX4wyxeaoeHctc1mas01KZgsj5tYiAIwqJE/E=
+github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
+github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/brianvoe/gofakeit/v6 v6.24.0 h1:74yq7RRz/noddscZHRS2T84oHZisW9muwbb8sRnU52A=
+github.com/brianvoe/gofakeit/v6 v6.24.0/go.mod h1:Ow6qC71xtwm79anlwKRlWZW6zVq9D2XHE4QSSMP/rU8=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/cilium/ebpf v0.12.3 h1:8ht6F9MquybnY97at+VDZb3eQQr8ev79RueWeVaEcG4=
+github.com/cilium/ebpf v0.12.3/go.mod h1:TctK1ivibvI3znr66ljgi4hqOT8EYQjz1KWBfb1UVgM=
+github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
+github.com/cloudflare/circl v1.3.6 h1:/xbKIqSHbZXHwkhbrhrt2YOHIwYJlXH94E3tI/gDlUg=
+github.com/cloudflare/circl v1.3.6/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
+github.com/containerd/go-cni v1.1.9 h1:ORi7P1dYzCwVM6XPN4n3CbkuOx/NZ2DOqy+SHRdo9rU=
+github.com/containerd/go-cni v1.1.9/go.mod h1:XYrZJ1d5W6E2VOvjffL3IZq0Dz6bsVlERHbekNK90PM=
+github.com/containernetworking/cni v1.1.2 h1:wtRGZVv7olUHMOqouPpn3cXJWpJgM6+EUl31EQbXALQ=
+github.com/containernetworking/cni v1.1.2/go.mod h1:sDpYKmGVENF3s6uvMvGgldDWeG8dMxakj/u+i9ht9vw=
+github.com/cosi-project/runtime v0.4.0-alpha.6 h1:GFxRH6fc/9z0ffDjod6P7SzjqhKOk6BgoDBgBEOjTvo=
+github.com/cosi-project/runtime v0.4.0-alpha.6/go.mod h1:JE9yuyufGRCd28AyCWFkTNf3UMiZJT722bpfPEPnsNE=
+github.com/cpuguy83/go-md2man/v2 v2.0.3 h1:qMCsGGgs+MAzDFyp9LpAe1Lqy/fY/qCovCm0qnXZOBM=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/emicklei/go-restful/v3 v3.9.0 h1:XwGDlfxEnQZzuopoqxwSEllNcCOM9DhhFyhFIIGKwxE=
+github.com/emicklei/go-restful/v3 v3.9.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI=
+github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
+github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/gertd/go-pluralize v0.2.1 h1:M3uASbVjMnTsPb0PNqg+E/24Vwigyo/tvyMTtAlLgiA=
+github.com/gertd/go-pluralize v0.2.1/go.mod h1:rbYaKDbsXxmRfr8uygAEKhOWsjyrrqrkHVpZvoOp8zk=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
+github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
+github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
+github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
+github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
+github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
+github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec=
+github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/uuid v1.4.0 h1:MtMxsa51/r9yyhkyLsVeVt0B+BGQZzpQiTQ4eHZ8bc4=
+github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0 h1:Wqo399gCIufwto+VfwCSvsnfGpF/w5E9CNxSwbpD6No=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.0/go.mod h1:qmOFXW2epJhM0qSnUUYpldc7gVz2KMQwJ/QYCDIa7XU=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
+github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
+github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
+github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
+github.com/jsimonetti/rtnetlink v1.4.0 h1:Z1BF0fRgcETPEa0Kt0MRk3yV5+kF1FWTni6KUFKrq2I=
+github.com/jsimonetti/rtnetlink v1.4.0/go.mod h1:5W1jDvWdnthFJ7fxYX1GMK07BUpI4oskfOqvPteYS6E=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mdlayher/ethtool v0.1.0 h1:XAWHsmKhyPOo42qq/yTPb0eFBGUKKTR1rE0dVrWVQ0Y=
+github.com/mdlayher/ethtool v0.1.0/go.mod h1:fBMLn2UhfRGtcH5ZFjr+6GUiHEjZsItFD7fSn7jbZVQ=
+github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
+github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
+github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
+github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
+github.com/mdlayher/socket v0.5.0 h1:ilICZmJcQz70vrWVes1MFera4jGiWNocSkykwwoy3XI=
+github.com/mdlayher/socket v0.5.0/go.mod h1:WkcBFfvyG8QENs5+hfQPl1X6Jpd2yeLIYgrGFmJiJxI=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
+github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
+github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
+github.com/onsi/ginkgo/v2 v2.9.4 h1:xR7vG4IXt5RWx6FfIjyAtsoMAtnc3C/rFXBBd2AjZwE=
+github.com/onsi/ginkgo/v2 v2.9.4/go.mod h1:gCQYp2Q+kSoIj7ykSVb9nskRSsR6PUj4AiLywzIhbKM=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
+github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
+github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE=
+github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg=
+github.com/opencontainers/runtime-spec v1.1.0 h1:HHUyrt9mwHUjtasSbXSMvs4cyFxh+Bll4AjJ9odEGpg=
+github.com/opencontainers/runtime-spec v1.1.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 h1:KoWmjvw+nsYOo29YJK9vDA65RGE3NrOnUtO7a+RF9HU=
+github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/planetscale/vtprotobuf v0.6.0 h1:nBeETjudeJ5ZgBHUz1fVHvbqUKnYOXNhsIEabROxmNA=
+github.com/planetscale/vtprotobuf v0.6.0/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
+github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
+github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
+github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
+github.com/siderolabs/crypto v0.4.1 h1:PP84WSDDyCCbjYKePcc0IaMSPXDndz8V3cQ9hMRSvpA=
+github.com/siderolabs/crypto v0.4.1/go.mod h1:nJmvkqWy1Hngbzw3eg2TdtJ/ZYHHofQK1NbmmYywW8k=
+github.com/siderolabs/gen v0.4.7 h1:lM69UYggT7yzpubf7hEFaNujPdY55Y9zvQf/NC18GvA=
+github.com/siderolabs/gen v0.4.7/go.mod h1:4PBYMdXxTg292IDRq4CGn5AymyDxJVEDvobVKDqFBEA=
+github.com/siderolabs/go-api-signature v0.3.1 h1:ePXOxBT2fxRICsDntXed9kivmVK269nZe5UXvOxgtnM=
+github.com/siderolabs/go-api-signature v0.3.1/go.mod h1:RZQFRiZ4midsdC9XCGhhWyS8QcIWtpEFeigvqoDPYJY=
+github.com/siderolabs/go-blockdevice v0.4.7 h1:2bk4WpEEflGxjrNwp57ye24Pr+cYgAiAeNMWiQOuWbQ=
+github.com/siderolabs/go-blockdevice v0.4.7/go.mod h1:4PeOuk71pReJj1JQEXDE7kIIQJPVe8a+HZQa+qjxSEA=
+github.com/siderolabs/go-kubeconfig v0.1.0 h1:t/2oMWkLSdWHXglKPMz8ySXnx6ZjHckeGY79NaDcBTo=
+github.com/siderolabs/go-kubeconfig v0.1.0/go.mod h1:eM3mO02Td6wYDvdi9zTbMrj1Q4WqEFN8XQ6pNjCUWkI=
+github.com/siderolabs/go-pointer v1.0.0 h1:6TshPKep2doDQJAAtHUuHWXbca8ZfyRySjSBT/4GsMU=
+github.com/siderolabs/go-pointer v1.0.0/go.mod h1:HTRFUNYa3R+k0FFKNv11zgkaCLzEkWVzoYZ433P3kHc=
+github.com/siderolabs/go-retry v0.3.3 h1:zKV+S1vumtO72E6sYsLlmIdV/G/GcYSBLiEx/c9oCEg=
+github.com/siderolabs/go-retry v0.3.3/go.mod h1:Ff/VGc7v7un4uQg3DybgrmOWHEmJ8BzZds/XNn/BqMI=
+github.com/siderolabs/net v0.4.0 h1:1bOgVay/ijPkJz4qct98nHsiB/ysLQU0KLoBC4qLm7I=
+github.com/siderolabs/net v0.4.0/go.mod h1:/ibG+Hm9HU27agp5r9Q3eZicEfjquzNzQNux5uEk0kM=
+github.com/siderolabs/protoenc v0.2.1 h1:BqxEmeWQeMpNP3R6WrPqDatX8sM/r4t97OP8mFmg6GA=
+github.com/siderolabs/protoenc v0.2.1/go.mod h1:StTHxjet1g11GpNAWiATgc8K0HMKiFSEVVFOa/H0otc=
+github.com/siderolabs/talos/pkg/machinery v1.6.4 h1:xzkHpHqVnio3IL2z44f/dG3TNVvSafZFvuyqlR6J7nY=
+github.com/siderolabs/talos/pkg/machinery v1.6.4/go.mod h1:0x8zKxjyasg7n03lHXo5FX8ZaodFSSaompcGYa4alPE=
+github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
+github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/unix4ever/yaml v0.0.0-20220527175918-f17b0f05cf2c h1:Vn6nVVu9MdOYvXPkJP83iX5jVIfvxFC9v9xIKb+DlaQ=
+github.com/unix4ever/yaml v0.0.0-20220527175918-f17b0f05cf2c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
+github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
+go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY=
+golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/exp v0.0.0-20230224173230-c95f2b4c22f2 h1:Jvc7gsqn21cJHCmAWx0LiimpP18LZmUxkT5Mp7EZ1mI=
+golang.org/x/exp v0.0.0-20230224173230-c95f2b4c22f2/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
+golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/oauth2 v0.15.0 h1:s8pnnxNVzjWyrvYdFUQq5llS1PX2zhPXmccZv99h7uQ=
+golang.org/x/oauth2 v0.15.0/go.mod h1:q48ptWNTY5XWf+JNten23lcvHpLJ0ZSxF5ttTHKVCAM=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
+golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
+golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
+golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.8.0 h1:vSDcovVPld282ceKgDimkRSC8kpaH1dgyc9UMzlt84Y=
+golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
+google.golang.org/genproto v0.0.0-20231212172506-995d672761c0 h1:YJ5pD9rF8o9Qtta0Cmy9rdBwkSjrTCT6XTiUQVOtIos=
+google.golang.org/genproto v0.0.0-20231212172506-995d672761c0/go.mod h1:l/k7rMz0vFTBPy+tFSGvXEd3z+BcoG1k7EHbqm+YBsY=
+google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917 h1:rcS6EyEaoCO52hQDupoSfrxI3R6C2Tq741is7X8OvnM=
+google.golang.org/genproto/googleapis/api v0.0.0-20240102182953-50ed04b92917/go.mod h1:CmlNWB9lSezaYELKS5Ym1r44VrrbPUa7JTvw+6MbpJ0=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 h1:6G8oQ016D88m1xAKljMlBOOGWDZkes4kMhgGFlf8WcQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917/go.mod h1:xtjpI3tXFPP051KaWnhvxkiubL/6dJ18vLVf7q2pTOU=
+google.golang.org/grpc v1.61.0 h1:TOvOcuXn30kRao+gfcvsebNEa5iZIiLkisYEkf7R7o0=
+google.golang.org/grpc v1.61.0/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
+google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+k8s.io/api v0.28.4 h1:8ZBrLjwosLl/NYgv1P7EQLqoO8MGQApnbgH8tu3BMzY=
+k8s.io/api v0.28.4/go.mod h1:axWTGrY88s/5YE+JSt4uUi6NMM+gur1en2REMR7IRj0=
+k8s.io/apimachinery v0.28.4 h1:zOSJe1mc+GxuMnFzD4Z/U1wst50X28ZNsn5bhgIIao8=
+k8s.io/apimachinery v0.28.4/go.mod h1:wI37ncBvfAoswfq626yPTe6Bz1c22L7uaJ8dho83mgg=
+k8s.io/client-go v0.28.4 h1:Np5ocjlZcTrkyRJ3+T3PkXDpe4UpatQxj85+xjaD2wY=
+k8s.io/client-go v0.28.4/go.mod h1:0VDZFpgoZfelyP5Wqu0/r/TRYcLYuJ2U1KEeoaPa1N4=
+k8s.io/klog/v2 v2.110.1 h1:U/Af64HJf7FcwMcXyKm2RPM22WZzyR7OSpYj5tg3cL0=
+k8s.io/klog/v2 v2.110.1/go.mod h1:YGtd1984u+GgbuZ7e08/yBuAfKLSO0+uR1Fhi6ExXjo=
+k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 h1:LyMgNKD2P8Wn1iAwQU5OhxCKlKJy0sHc+PcDwFB24dQ=
+k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9/go.mod h1:wZK2AVp1uHCp4VamDVgBP2COHZjqD1T68Rf0CM3YjSM=
+k8s.io/utils v0.0.0-20231127182322-b307cd553661 h1:FepOBzJ0GXm8t0su67ln2wAZjbQ6RxQGZDnzuLcrUTI=
+k8s.io/utils v0.0.0-20231127182322-b307cd553661/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
+sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
diff --git a/client/pkg/access/access.go b/client/pkg/access/access.go
new file mode 100644
index 000000000..60aecf4e5
--- /dev/null
+++ b/client/pkg/access/access.go
@@ -0,0 +1,11 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package access contains commands related to API access for the client.
+package access
+
+const (
+	// ServiceAccountNameSuffix is appended to the name of all service accounts.
+	ServiceAccountNameSuffix = "@serviceaccount.omni.sidero.dev"
+)
diff --git a/client/pkg/client/client.go b/client/pkg/client/client.go
new file mode 100644
index 000000000..dbd126cb0
--- /dev/null
+++ b/client/pkg/client/client.go
@@ -0,0 +1,132 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package client provides Omni API client.
+package client
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"net/url"
+
+	"github.com/siderolabs/go-api-signature/pkg/client/auth"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/encoding/gzip"
+
+	"github.com/siderolabs/omni/client/pkg/client/management"
+	"github.com/siderolabs/omni/client/pkg/client/oidc"
+	"github.com/siderolabs/omni/client/pkg/client/omni"
+	"github.com/siderolabs/omni/client/pkg/client/talos"
+	"github.com/siderolabs/omni/client/pkg/constants"
+)
+
+// Client is Omni API client.
+type Client struct {
+	conn *grpc.ClientConn
+
+	endpoint string
+}
+
+// New creates a new Omni API client.
+func New(ctx context.Context, endpoint string, opts ...Option) (*Client, error) {
+	u, err := url.Parse(endpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	if u.Port() == "" && u.Scheme == "https" {
+		u.Host = net.JoinHostPort(u.Host, "443")
+	}
+
+	if u.Scheme == "http" {
+		u.Scheme = "grpc"
+	}
+
+	if u.Port() == "" && u.Scheme == "grpc" {
+		u.Host = net.JoinHostPort(u.Host, "80")
+	}
+
+	var (
+		options         Options
+		grpcDialOptions []grpc.DialOption
+	)
+
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	if options.AuthInterceptor != nil {
+		grpcDialOptions = append(grpcDialOptions,
+			grpc.WithUnaryInterceptor(options.AuthInterceptor.Unary()),
+			grpc.WithStreamInterceptor(options.AuthInterceptor.Stream()))
+	}
+
+	grpcDialOptions = append(grpcDialOptions, options.AdditionalGRPCDialOptions...)
+
+	switch u.Scheme {
+	case "https":
+		grpcDialOptions = append(grpcDialOptions, grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{
+			InsecureSkipVerify: options.InsecureSkipTLSVerify,
+		})))
+	default:
+		grpcDialOptions = append(grpcDialOptions, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	}
+
+	grpcDialOptions = append(grpcDialOptions,
+		grpc.WithDefaultCallOptions(
+			grpc.MaxCallRecvMsgSize(constants.GRPCMaxMessageSize),
+			grpc.UseCompressor(gzip.Name),
+		),
+		grpc.WithSharedWriteBuffer(true),
+	)
+
+	c := &Client{
+		endpoint: u.String(),
+	}
+
+	c.conn, err = grpc.DialContext(ctx, u.Host, grpcDialOptions...)
+	if err != nil {
+		return nil, err
+	}
+
+	return c, nil
+}
+
+// Close the client.
+func (c *Client) Close() error {
+	return c.conn.Close()
+}
+
+// Omni provides access to Omni resource API.
+func (c *Client) Omni() *omni.Client {
+	return omni.NewClient(c.conn)
+}
+
+// Management provides access to the management API.
+func (c *Client) Management() *management.Client {
+	return management.NewClient(c.conn)
+}
+
+// OIDC provides access to the OIDC API.
+func (c *Client) OIDC() *oidc.Client {
+	return oidc.NewClient(c.conn)
+}
+
+// Auth provides access to the auth API.
+func (c *Client) Auth() *auth.Client {
+	return auth.NewClient(c.conn)
+}
+
+// Talos provides access to Talos machine API.
+func (c *Client) Talos() *talos.Client {
+	return talos.NewClient(c.conn)
+}
+
+// Endpoint returns the endpoint this client is configured to talk to.
+func (c *Client) Endpoint() string {
+	return c.endpoint
+}
diff --git a/client/pkg/client/example_test.go b/client/pkg/client/example_test.go
new file mode 100644
index 000000000..cdd736eaa
--- /dev/null
+++ b/client/pkg/client/example_test.go
@@ -0,0 +1,130 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package client_test
+
+import (
+	"context"
+	"log"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"google.golang.org/protobuf/types/known/emptypb"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/template"
+	"github.com/siderolabs/omni/client/pkg/version"
+)
+
+//nolint:wsl,testableexamples
+func Example() {
+	// This example shows how to use Omni client to access resources.
+
+	// Setup versions information. You can embed that into `go build` too.
+	version.Name = "omni"
+	version.SHA = "build SHA"
+	version.Tag = "v0.9.1"
+
+	// For this example we will use Omni service account.
+	// You can create your service account in advance:
+	//
+	// omnictl serviceaccount create example.account
+	// Created service account "example.account" with public key ID "<REDACTED>"
+	//
+	// Set the following environment variables to use the service account:
+	// OMNI_ENDPOINT=https://<account>.omni.siderolabs.io:443
+	// OMNI_SERVICE_ACCOUNT_KEY=base64encodedkey
+	//
+	// Note: Store the service account key securely, it will not be displayed again
+
+	ctx := context.Background()
+
+	// Creating a new client.
+	client, err := client.New(ctx, "https://<account>.omni.siderolabs.io:443", client.WithServiceAccount(
+		"base64encodedkey", // From the generated service account.
+	))
+	if err != nil {
+		log.Fatalf("failed to create omni client %s", err)
+	}
+
+	// Omni service is using COSI https://github.com/cosi-project/runtime/.
+	// The same client is used to get resources in Talos.
+	st := client.Omni().State()
+
+	// Getting the resources from the Omni state.
+	machines, err := safe.StateList[*omni.MachineStatus](ctx, st, omni.NewMachineStatus(resources.DefaultNamespace, "").Metadata())
+	if err != nil {
+		log.Fatalf("failed to get machines %s", err)
+	}
+
+	var (
+		cluster string
+		machine *omni.MachineStatus
+	)
+
+	for iter := machines.Iterator(); iter.Next(); {
+		item := iter.Value()
+
+		log.Printf("machine %s, connected: %t", item.Metadata(), item.TypedSpec().Value.GetConnected())
+
+		// Check cluster assignment for a machine.
+		// Find a machine which is allocated into a cluster for the later use.
+		if c, ok := item.Metadata().Labels().Get(omni.LabelCluster); ok && machine == nil {
+			cluster = c
+			machine = item
+		}
+	}
+
+	// Creating an empty cluster via template.
+	// Alternative is to use template.Load to load a cluster template.
+	template := template.WithCluster("example.cluster")
+
+	if _, err = template.Sync(ctx, st); err != nil {
+		log.Fatalf("failed to sync cluster %s", err)
+	}
+
+	log.Printf("sync cluster")
+
+	// Delete cluster.
+	if _, err = template.Delete(ctx, st); err != nil {
+		log.Fatalf("failed to delete the cluster %s", err)
+	}
+
+	log.Printf("destroyed cluster")
+
+	// No machines found, exit.
+	if machine == nil {
+		log.Printf("no allocated machines found, exit")
+
+		return
+	}
+
+	// Using Talos through Omni.
+	// Use cluster and machine which we previously found.
+	cpuInfo, err := client.Talos().WithCluster(
+		cluster,
+	).WithNodes(
+		machine.Metadata().ID(), // You can use machine UUID as Omni will properly resolve it into machine IP.
+	).CPUInfo(ctx, &emptypb.Empty{})
+	if err != nil {
+		log.Fatalf("failed to read machine CPU info %s", err)
+	}
+
+	for _, message := range cpuInfo.Messages {
+		for i, info := range message.CpuInfo {
+			log.Printf("machine %s, CPU %d family %s", machine.Metadata(), i, info.CpuFamily)
+		}
+
+		if len(message.CpuInfo) == 0 {
+			log.Printf("no CPU info for machine %s", machine.Metadata())
+		}
+	}
+
+	// Talking to Omni specific APIs: getting talosconfig.
+	_, err = client.Management().Talosconfig(ctx)
+	if err != nil {
+		log.Fatalf("failed to get talosconfig %s", err)
+	}
+}
diff --git a/client/pkg/client/management/management.go b/client/pkg/client/management/management.go
new file mode 100644
index 000000000..7084bcc24
--- /dev/null
+++ b/client/pkg/client/management/management.go
@@ -0,0 +1,316 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package management provides client for Omni management API.
+package management
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/emptypb"
+
+	"github.com/siderolabs/omni/client/api/omni/management"
+)
+
+// TalosconfigOption is a functional option for Talosconfig.
+type TalosconfigOption func(*management.TalosconfigRequest)
+
+// WithAdminTalosconfig sets whether the Talosconfig request should return an admin Talosconfig.
+func WithAdminTalosconfig(adminConfig bool) TalosconfigOption {
+	return func(req *management.TalosconfigRequest) {
+		req.Admin = adminConfig
+	}
+}
+
+// KubeconfigOption is a functional option for Kubeconfig.
+type KubeconfigOption func(request *management.KubeconfigRequest)
+
+// WithServiceAccount sets whether the Kubeconfig request should return a user or service account type kubeconfig.
+func WithServiceAccount(ttl time.Duration, user string, groups ...string) KubeconfigOption {
+	return func(request *management.KubeconfigRequest) {
+		request.ServiceAccount = true
+		request.ServiceAccountTtl = durationpb.New(ttl)
+		request.ServiceAccountUser = user
+		request.ServiceAccountGroups = groups
+	}
+}
+
+// Client for Management API .
+type Client struct {
+	conn management.ManagementServiceClient
+}
+
+// NewClient builds a client out of gRPC connection.
+func NewClient(conn *grpc.ClientConn) *Client {
+	return &Client{
+		conn: management.NewManagementServiceClient(conn),
+	}
+}
+
+// WithCluster sets the cluster name context.
+func (client *Client) WithCluster(clusterName string) *ClusterClient {
+	return &ClusterClient{
+		client:      client,
+		clusterName: clusterName,
+	}
+}
+
+// Talosconfig retrieves Talos client configuration for the whole instance.
+func (client *Client) Talosconfig(ctx context.Context, opts ...TalosconfigOption) ([]byte, error) {
+	request := management.TalosconfigRequest{}
+
+	for _, opt := range opts {
+		opt(&request)
+	}
+
+	talosconfigResp, err := client.conn.Talosconfig(ctx, &request)
+
+	return talosconfigResp.GetTalosconfig(), err
+}
+
+// Omniconfig retrieves Omni configuration for the clients.
+func (client *Client) Omniconfig(ctx context.Context) ([]byte, error) {
+	omniconfig, err := client.conn.Omniconfig(ctx, &emptypb.Empty{})
+	if err != nil {
+		return nil, fmt.Errorf("failed to get omniconfig: %w", err)
+	}
+
+	return omniconfig.Omniconfig, nil
+}
+
+// LogsReader returns the io.Reader for the logs with each message separated by '\n'.
+func (client *Client) LogsReader(ctx context.Context, machineID string, follow bool, tailLines int32) (io.Reader, error) {
+	logStream, err := client.conn.MachineLogs(ctx, &management.MachineLogsRequest{
+		MachineId: machineID,
+		Follow:    follow,
+		TailLines: tailLines,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return &LogReader{
+		ctx:    ctx,
+		client: logStream,
+	}, nil
+}
+
+// CreateSchematic using the image factory.
+func (client *Client) CreateSchematic(ctx context.Context, req *management.CreateSchematicRequest) (*management.CreateSchematicResponse, error) {
+	schematic, err := client.conn.CreateSchematic(ctx, req)
+	if err != nil {
+		return nil, err
+	}
+
+	return schematic, nil
+}
+
+// CreateServiceAccount creates a service account and returns the public key ID.
+func (client *Client) CreateServiceAccount(ctx context.Context, armoredPGPPublicKey string, role string, useUserRole bool) (string, error) {
+	resp, err := client.conn.CreateServiceAccount(ctx, &management.CreateServiceAccountRequest{
+		ArmoredPgpPublicKey: armoredPGPPublicKey,
+		Role:                role,
+		UseUserRole:         useUserRole,
+	})
+	if err != nil {
+		return "", err
+	}
+
+	return resp.PublicKeyId, nil
+}
+
+// RenewServiceAccount renews a service account and returns the public key ID.
+func (client *Client) RenewServiceAccount(ctx context.Context, name, armoredPGPPublicKey string) (string, error) {
+	resp, err := client.conn.RenewServiceAccount(ctx, &management.RenewServiceAccountRequest{
+		Name:                name,
+		ArmoredPgpPublicKey: armoredPGPPublicKey,
+	})
+	if err != nil {
+		return "", err
+	}
+
+	return resp.PublicKeyId, nil
+}
+
+// ListServiceAccounts lists service accounts.
+func (client *Client) ListServiceAccounts(ctx context.Context) ([]*management.ListServiceAccountsResponse_ServiceAccount, error) {
+	response, err := client.conn.ListServiceAccounts(ctx, &emptypb.Empty{})
+	if err != nil {
+		return nil, err
+	}
+
+	return response.GetServiceAccounts(), nil
+}
+
+// DestroyServiceAccount deletes a service account.
+func (client *Client) DestroyServiceAccount(ctx context.Context, name string) error {
+	_, err := client.conn.DestroyServiceAccount(ctx, &management.DestroyServiceAccountRequest{
+		Name: name,
+	})
+
+	return err
+}
+
+// LogReader is a log client reader which implements io.Reader.
+type LogReader struct {
+	ctx    context.Context //nolint:containedctx
+	client management.ManagementService_MachineLogsClient
+
+	buf bytes.Buffer
+}
+
+// Read reads from the log stream.
+func (l *LogReader) Read(p []byte) (int, error) {
+	if l.buf.Len() > 0 {
+		return l.buf.Read(p)
+	}
+
+	for {
+		if l.ctx.Err() != nil {
+			return 0, io.EOF
+		}
+
+		recv, err := l.client.Recv()
+		if err != nil {
+			if expectedErr(err) {
+				return 0, io.EOF
+			}
+
+			return 0, err
+		}
+
+		err = writeLine(&l.buf, recv.Bytes)
+		if err != nil {
+			return 0, fmt.Errorf("failed to write log msg: %w", err)
+		}
+
+		if l.buf.Len() > 0 {
+			return l.buf.Read(p)
+		}
+	}
+}
+
+type byteWriter interface {
+	io.Writer
+	io.ByteWriter
+}
+
+func writeLine(writer byteWriter, line []byte) error {
+	_, err := writer.Write(line)
+	if err != nil {
+		return err
+	}
+
+	err = writer.WriteByte('\n')
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func expectedErr(err error) bool {
+	return errors.Is(err, context.Canceled) ||
+		errors.Is(err, context.DeadlineExceeded) ||
+		errors.Is(err, io.EOF) ||
+		status.Code(err) == codes.Canceled
+}
+
+// ClusterClient is a client for a specific cluster.
+type ClusterClient struct {
+	client      *Client
+	clusterName string
+}
+
+// Kubeconfig retrieves Kubernetes client configuration for the cluster.
+func (client *ClusterClient) Kubeconfig(ctx context.Context, opts ...KubeconfigOption) ([]byte, error) {
+	ctx = metadata.AppendToOutgoingContext(ctx, "context", client.clusterName)
+
+	request := management.KubeconfigRequest{}
+
+	for _, opt := range opts {
+		opt(&request)
+	}
+
+	kubeconfigResp, err := client.client.conn.Kubeconfig(ctx, &request)
+
+	return kubeconfigResp.GetKubeconfig(), err
+}
+
+// Talosconfig retrieves Talos client configuration for the cluster.
+func (client *ClusterClient) Talosconfig(ctx context.Context, opts ...TalosconfigOption) ([]byte, error) {
+	ctx = metadata.AppendToOutgoingContext(ctx, "context", client.clusterName)
+
+	request := management.TalosconfigRequest{}
+
+	for _, opt := range opts {
+		opt(&request)
+	}
+
+	talosconfigResp, err := client.client.conn.Talosconfig(ctx, &request)
+
+	return talosconfigResp.GetTalosconfig(), err
+}
+
+// KubernetesUpgradePreChecks runs the pre-checks for an upgrade.
+func (client *ClusterClient) KubernetesUpgradePreChecks(ctx context.Context, newVersion string) error {
+	ctx = metadata.AppendToOutgoingContext(ctx, "context", client.clusterName)
+
+	resp, err := client.client.conn.KubernetesUpgradePreChecks(ctx, &management.KubernetesUpgradePreChecksRequest{
+		NewVersion: newVersion,
+	})
+	if err != nil {
+		return err
+	}
+
+	if resp.Ok {
+		return nil
+	}
+
+	return fmt.Errorf("%s", resp.GetReason())
+}
+
+// KubernetesSyncManifestHandler is called for each sync event.
+type KubernetesSyncManifestHandler func(*management.KubernetesSyncManifestResponse) error
+
+// KubernetesSyncManifests syncs the bootstrap Kubernetes manifests.
+func (client *ClusterClient) KubernetesSyncManifests(ctx context.Context, dryRun bool, handler KubernetesSyncManifestHandler) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	ctx = metadata.AppendToOutgoingContext(ctx, "context", client.clusterName)
+
+	cli, err := client.client.conn.KubernetesSyncManifests(ctx, &management.KubernetesSyncManifestRequest{
+		DryRun: dryRun,
+	})
+	if err != nil {
+		return err
+	}
+
+	for {
+		msg, err := cli.Recv()
+		if err != nil {
+			if errors.Is(err, io.EOF) || status.Code(err) == codes.Canceled {
+				return nil
+			}
+
+			return err
+		}
+
+		err = handler(msg)
+		if err != nil {
+			return err
+		}
+	}
+}
diff --git a/client/pkg/client/oidc/oidc.go b/client/pkg/client/oidc/oidc.go
new file mode 100644
index 000000000..4c79f7638
--- /dev/null
+++ b/client/pkg/client/oidc/oidc.go
@@ -0,0 +1,37 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package oidc provides client for Omni OIDC API.
+package oidc
+
+import (
+	"context"
+
+	"google.golang.org/grpc"
+
+	"github.com/siderolabs/omni/client/api/omni/oidc"
+)
+
+// Client for Management API .
+type Client struct {
+	conn oidc.OIDCServiceClient
+}
+
+// NewClient builds a client out of gRPC connection.
+func NewClient(conn *grpc.ClientConn) *Client {
+	return &Client{
+		conn: oidc.NewOIDCServiceClient(conn),
+	}
+}
+
+// Authenticate confirms the OIDC auth request.
+func (client *Client) Authenticate(ctx context.Context, requestID string) (string, error) {
+	resp, err := client.conn.Authenticate(ctx,
+		&oidc.AuthenticateRequest{
+			AuthRequestId: requestID,
+		},
+	)
+
+	return resp.GetRedirectUrl(), err
+}
diff --git a/client/pkg/client/omni/omni.go b/client/pkg/client/omni/omni.go
new file mode 100644
index 000000000..7be31bc16
--- /dev/null
+++ b/client/pkg/client/omni/omni.go
@@ -0,0 +1,38 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package omni provides client for Omni resource access.
+package omni
+
+import (
+	"github.com/cosi-project/runtime/api/v1alpha1"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/protobuf/client"
+	"google.golang.org/grpc"
+
+	_ "github.com/siderolabs/omni/client/pkg/omni/resources/auth" // import resources to register protobufs
+	_ "github.com/siderolabs/omni/client/pkg/omni/resources/k8s"
+	_ "github.com/siderolabs/omni/client/pkg/omni/resources/oidc"
+	_ "github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	_ "github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	_ "github.com/siderolabs/omni/client/pkg/omni/resources/system"
+	_ "github.com/siderolabs/omni/client/pkg/omni/resources/virtual"
+)
+
+// Client for Omni resource API (COSI).
+type Client struct {
+	state state.State
+}
+
+// NewClient builds a client out of gRPC connection.
+func NewClient(conn *grpc.ClientConn) *Client {
+	return &Client{
+		state: state.WrapCore(client.NewAdapter(v1alpha1.NewStateClient(conn))),
+	}
+}
+
+// State provides access to the COSI resource state.
+func (client *Client) State() state.State { //nolint:ireturn
+	return client.state
+}
diff --git a/client/pkg/client/options.go b/client/pkg/client/options.go
new file mode 100644
index 000000000..46ee786b4
--- /dev/null
+++ b/client/pkg/client/options.go
@@ -0,0 +1,64 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package client provides Omni API client.
+package client
+
+import (
+	"github.com/siderolabs/go-api-signature/pkg/client/interceptor"
+	"github.com/siderolabs/go-api-signature/pkg/pgp/client"
+	"google.golang.org/grpc"
+
+	"github.com/siderolabs/omni/client/pkg/version"
+)
+
+// Options is the options for the client.
+type Options struct {
+	AuthInterceptor *interceptor.Interceptor
+
+	AdditionalGRPCDialOptions []grpc.DialOption
+
+	InsecureSkipTLSVerify bool
+}
+
+// Option is a functional option for the client.
+type Option func(*Options)
+
+// WithInsecureSkipTLSVerify creates the client with insecure TLS verification.
+func WithInsecureSkipTLSVerify(insecureSkipTLSVerify bool) Option {
+	return func(options *Options) {
+		options.InsecureSkipTLSVerify = insecureSkipTLSVerify
+	}
+}
+
+// WithServiceAccount creates the client authenticating with the given service account.
+func WithServiceAccount(serviceAccountBase64 string) Option {
+	return func(options *Options) {
+		options.AuthInterceptor = signatureAuthInterceptor("", "", serviceAccountBase64)
+	}
+}
+
+// WithUserAccount is used for accessing Omni by a human.
+func WithUserAccount(contextName, identity string) Option {
+	return func(options *Options) {
+		options.AuthInterceptor = signatureAuthInterceptor(contextName, identity, "")
+	}
+}
+
+func signatureAuthInterceptor(contextName, identity, serviceAccountBase64 string) *interceptor.Interceptor {
+	return interceptor.New(interceptor.Options{
+		UserKeyProvider:      client.NewKeyProvider("omni/keys"),
+		ContextName:          contextName,
+		Identity:             identity,
+		ClientName:           version.Name + " " + version.Tag,
+		ServiceAccountBase64: serviceAccountBase64,
+	})
+}
+
+// WithGrpcOpts adds additional gRPC dial options to the client.
+func WithGrpcOpts(opts ...grpc.DialOption) Option {
+	return func(options *Options) {
+		options.AdditionalGRPCDialOptions = append(options.AdditionalGRPCDialOptions, opts...)
+	}
+}
diff --git a/client/pkg/client/talos/talos.go b/client/pkg/client/talos/talos.go
new file mode 100644
index 000000000..308962158
--- /dev/null
+++ b/client/pkg/client/talos/talos.go
@@ -0,0 +1,80 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package talos provides helpers for accessing Talos Machine API.
+package talos
+
+import (
+	"context"
+
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+
+	"github.com/siderolabs/omni/client/api/common"
+)
+
+// NewClient wraps gRPC connection interface which adds nodes, cluster name
+// to each request.
+func NewClient(conn grpc.ClientConnInterface) *Client {
+	c := &Client{
+		conn: conn,
+	}
+
+	c.MachineServiceClient = machine.NewMachineServiceClient(c)
+
+	return c
+}
+
+// Client adds runtime, cluster and nodes metadata to all gRPC calls.
+type Client struct {
+	machine.MachineServiceClient
+	conn        grpc.ClientConnInterface
+	clusterName string
+	nodes       []string
+}
+
+// WithCluster adds clusterName to the request metadata.
+func (c *Client) WithCluster(clusterName string) *Client {
+	c.clusterName = clusterName
+
+	return c
+}
+
+// WithNodes adds nodes to the request metadata.
+func (c *Client) WithNodes(nodes ...string) *Client {
+	c.nodes = nodes
+
+	return c
+}
+
+// Invoke performs a unary RPC and returns after the response is received
+// into reply.
+func (c *Client) Invoke(ctx context.Context, method string, args any, reply any, opts ...grpc.CallOption) error {
+	return c.conn.Invoke(c.appendMetadata(ctx), method, args, reply, opts...)
+}
+
+// NewStream begins a streaming RPC.
+func (c *Client) NewStream(ctx context.Context, desc *grpc.StreamDesc, method string, opts ...grpc.CallOption) (grpc.ClientStream, error) {
+	return c.conn.NewStream(c.appendMetadata(ctx), desc, method, opts...)
+}
+
+func (c *Client) appendMetadata(ctx context.Context) context.Context {
+	ctx = metadata.AppendToOutgoingContext(ctx, "runtime", common.Runtime_Talos.String())
+
+	if c.clusterName != "" {
+		ctx = metadata.AppendToOutgoingContext(ctx, "context", c.clusterName)
+	}
+
+	if len(c.nodes) > 0 {
+		pairs := make([]string, 0, len(c.nodes)*2)
+		for _, node := range c.nodes {
+			pairs = append(pairs, "nodes", node)
+		}
+
+		ctx = metadata.AppendToOutgoingContext(ctx, pairs...)
+	}
+
+	return ctx
+}
diff --git a/client/pkg/constants/constants.go b/client/pkg/constants/constants.go
new file mode 100644
index 000000000..9547b3f17
--- /dev/null
+++ b/client/pkg/constants/constants.go
@@ -0,0 +1,75 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package constants contains global backend constants.
+package constants
+
+import "time"
+
+// SecureBoot defines query parameter for enabling secure boot for the generated image.
+// tsgen:SecureBoot
+const SecureBoot = "secureboot"
+
+// DefaultTalosVersion is pre-selected in the UI, default image and used in the integration tests.
+//
+// tsgen:DefaultTalosVersion
+const DefaultTalosVersion = "1.6.4"
+
+const (
+	// TalosRegistry is the default Talos repository URL.
+	TalosRegistry = "ghcr.io/siderolabs/installer"
+
+	// ImageFactoryBaseURL is the default Image Factory base URL.
+	ImageFactoryBaseURL = "https://factory.talos.dev"
+
+	// KubernetesRegistry is the default kubernetes repository URL.
+	KubernetesRegistry = "ghcr.io/siderolabs/kubelet"
+)
+
+const (
+	// PatchWeightInstallDisk is the weight of the install disk config patch.
+	// tsgen:PatchWeightInstallDisk
+	PatchWeightInstallDisk = 0
+	// PatchBaseWeightCluster is the base weight for cluster patches.
+	// tsgen:PatchBaseWeightCluster
+	PatchBaseWeightCluster = 200
+	// PatchBaseWeightMachineSet is the base weight for machine set patches.
+	// tsgen:PatchBaseWeightMachineSet
+	PatchBaseWeightMachineSet = 400
+	// PatchBaseWeightClusterMachine is the base weight for cluster machine patches.
+	// tsgen:PatchBaseWeightClusterMachine
+	PatchBaseWeightClusterMachine = 400
+)
+
+const (
+	// DefaultAccessGroup specifies the default Kubernetes group asserted in the token claims if the user has modify access to the clusters.
+	//
+	// If not, the user will only have the groups specified in the ACLs (AccessPolicies) in the token claims (will be empty if there is no matching ACL).
+	DefaultAccessGroup = "system:masters"
+)
+
+// GRPCMaxMessageSize is the maximum message size for gRPC server.
+const GRPCMaxMessageSize = 32 * 1024 * 1024
+
+// DisableValidation force disable resource validation on the Omni runtime for a particular resource (only for debug build).
+const DisableValidation = "disable-validation"
+
+const (
+	// EncryptionPatchPrefix is the prefix of the encryption config patch.
+	EncryptionPatchPrefix = "950"
+)
+
+const (
+	// EncryptionConfigName human-readable encryption config patch name annotation.
+	EncryptionConfigName = "disk encryption config"
+
+	// EncryptionConfigDescription description of the encryption config patch.
+	EncryptionConfigDescription = "Makes machine encrypt disks using Omni as a KMS server"
+)
+
+// CertificateValidityTime is the default validity time for certificates.
+const CertificateValidityTime = time.Hour * 24 * 365 // 1 year
+
+// KubernetesAdminCertCommonName is the common name of the Kubernetes admin certificate.
+const KubernetesAdminCertCommonName = "omni:admin"
diff --git a/client/pkg/constants/debug_disabled.go b/client/pkg/constants/debug_disabled.go
new file mode 100644
index 000000000..57630f913
--- /dev/null
+++ b/client/pkg/constants/debug_disabled.go
@@ -0,0 +1,10 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+//go:build sidero.debug
+
+package constants
+
+// IsDebugBuild is set to true when the build is a debug build (WITH_DEBUG=true).
+const IsDebugBuild = true
diff --git a/client/pkg/constants/debug_enabled.go b/client/pkg/constants/debug_enabled.go
new file mode 100644
index 000000000..9385db8d1
--- /dev/null
+++ b/client/pkg/constants/debug_enabled.go
@@ -0,0 +1,10 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+//go:build !sidero.debug
+
+package constants
+
+// IsDebugBuild is set to true when the build is a debug build (WITH_DEBUG=true).
+const IsDebugBuild = false
diff --git a/client/pkg/constants/talos.go b/client/pkg/constants/talos.go
new file mode 100644
index 000000000..6ab0a99a1
--- /dev/null
+++ b/client/pkg/constants/talos.go
@@ -0,0 +1,55 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package constants
+
+import (
+	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
+	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
+	"github.com/siderolabs/talos/pkg/machinery/resources/network"
+	"github.com/siderolabs/talos/pkg/machinery/resources/perf"
+	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"
+	"github.com/siderolabs/talos/pkg/machinery/resources/v1alpha1"
+)
+
+// Copy Talos constants to generate them for Typescript.
+const (
+	// Types.
+	// tsgen:TalosServiceType
+	_ = v1alpha1.ServiceType
+	// tsgen:TalosCPUType
+	_ = perf.CPUType
+	// tsgen:TalosMemoryType
+	_ = perf.MemoryType
+	// tsgen:TalosNodenameType
+	_ = k8s.NodenameType
+	// tsgen:TalosMemberType
+	_ = cluster.MemberType
+	// tsgen:TalosNodeAddressType
+	_ = network.NodeAddressType
+	// tsgen:TalosMountStatusType
+	_ = runtime.MountStatusType
+
+	// Resource ids.
+	// tsgen:TalosNodenameID
+	_ = k8s.NodenameID
+	// tsgen:TalosAddressRoutedNoK8s
+	_ = "routed-no-k8s"
+	// tsgen:TalosCPUID
+	_ = perf.CPUID
+	// tsgen:TalosMemoryID
+	_ = perf.MemoryID
+
+	// Namespaces.
+	// tsgen:TalosPerfNamespace
+	_ = perf.NamespaceName
+	// tsgen:TalosClusterNamespace
+	_ = cluster.NamespaceName
+	// tsgen:TalosRuntimeNamespace
+	_ = v1alpha1.NamespaceName
+	// tsgen:TalosK8sNamespace
+	_ = k8s.NamespaceName
+	// tsgen:TalosNetworkNamespace
+	_ = network.NamespaceName
+)
diff --git a/client/pkg/cosi/labels/labels.go b/client/pkg/cosi/labels/labels.go
new file mode 100644
index 000000000..47994d80a
--- /dev/null
+++ b/client/pkg/cosi/labels/labels.go
@@ -0,0 +1,37 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package labels implements label selector parser.
+package labels
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// ParseQuery creates resource.LabelQuery from the string formatted selector.
+func ParseQuery(selector string) (*resource.LabelQuery, error) {
+	return (&parser{
+		l: &lexer{
+			s: selector,
+		},
+	}).parse()
+}
+
+// ParseSelectors creates resource.LabelQuery from the string formatted selectors.
+func ParseSelectors(selectors []string) (resource.LabelQueries, error) {
+	res := make([]resource.LabelQuery, 0, len(selectors))
+
+	for _, selector := range selectors {
+		query, err := ParseQuery(selector)
+		if err != nil {
+			return nil, status.Error(codes.InvalidArgument, err.Error())
+		}
+
+		res = append(res, *query)
+	}
+
+	return res, nil
+}
diff --git a/client/pkg/cosi/labels/labels_test.go b/client/pkg/cosi/labels/labels_test.go
new file mode 100644
index 000000000..09e638d17
--- /dev/null
+++ b/client/pkg/cosi/labels/labels_test.go
@@ -0,0 +1,211 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package labels_test
+
+import (
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/pkg/cosi/labels"
+)
+
+func TestParseQuery(t *testing.T) {
+	for _, tt := range []struct {
+		expected *resource.LabelQuery
+		query    string
+	}{
+		{
+			query: "!a",
+			expected: &resource.LabelQuery{
+				Terms: []resource.LabelTerm{
+					{
+						Key:    "a",
+						Op:     resource.LabelOpExists,
+						Invert: true,
+					},
+				},
+			},
+		},
+		{
+			query: "a",
+			expected: &resource.LabelQuery{
+				Terms: []resource.LabelTerm{
+					{
+						Key: "a",
+						Op:  resource.LabelOpExists,
+					},
+				},
+			},
+		},
+		{
+			query: "a != b",
+			expected: &resource.LabelQuery{
+				Terms: []resource.LabelTerm{
+					{
+						Key:    "a",
+						Op:     resource.LabelOpEqual,
+						Value:  []string{"b"},
+						Invert: true,
+					},
+				},
+			},
+		},
+		{
+			query: "a == b",
+			expected: &resource.LabelQuery{
+				Terms: []resource.LabelTerm{
+					{
+						Key:   "a",
+						Op:    resource.LabelOpEqual,
+						Value: []string{"b"},
+					},
+				},
+			},
+		},
+		{
+			query: "a = b",
+			expected: &resource.LabelQuery{
+				Terms: []resource.LabelTerm{
+					{
+						Key:   "a",
+						Op:    resource.LabelOpEqual,
+						Value: []string{"b"},
+					},
+				},
+			},
+		},
+		{
+			query: "a < b",
+			expected: &resource.LabelQuery{
+				Terms: []resource.LabelTerm{
+					{
+						Key:   "a",
+						Op:    resource.LabelOpLTNumeric,
+						Value: []string{"b"},
+					},
+				},
+			},
+		},
+		{
+			query: "a <= b",
+			expected: &resource.LabelQuery{
+				Terms: []resource.LabelTerm{
+					{
+						Key:   "a",
+						Op:    resource.LabelOpLTENumeric,
+						Value: []string{"b"},
+					},
+				},
+			},
+		},
+		{
+			query: "a > b",
+			expected: &resource.LabelQuery{
+				Terms: []resource.LabelTerm{
+					{
+						Key:    "a",
+						Op:     resource.LabelOpLTENumeric,
+						Value:  []string{"b"},
+						Invert: true,
+					},
+				},
+			},
+		},
+		{
+			query: "a >= 㰀㰀",
+			expected: &resource.LabelQuery{
+				Terms: []resource.LabelTerm{
+					{
+						Key:    "a",
+						Op:     resource.LabelOpLTNumeric,
+						Value:  []string{"㰀㰀"},
+						Invert: true,
+					},
+				},
+			},
+		},
+		{
+			query: "a >= b",
+			expected: &resource.LabelQuery{
+				Terms: []resource.LabelTerm{
+					{
+						Key:    "a",
+						Op:     resource.LabelOpLTNumeric,
+						Value:  []string{"b"},
+						Invert: true,
+					},
+				},
+			},
+		},
+		{
+			query: "a notin (a, b, c, d)",
+			expected: &resource.LabelQuery{
+				Terms: []resource.LabelTerm{
+					{
+						Key:    "a",
+						Op:     resource.LabelOpIn,
+						Value:  []string{"a", "b", "c", "d"},
+						Invert: true,
+					},
+				},
+			},
+		},
+		{
+			query: "a in (a, b, c, d)",
+			expected: &resource.LabelQuery{
+				Terms: []resource.LabelTerm{
+					{
+						Key:   "a",
+						Op:    resource.LabelOpIn,
+						Value: []string{"a", "b", "c", "d"},
+					},
+				},
+			},
+		},
+		{
+			query: "a in a, b, c, d",
+		},
+		{
+			query: "a in a",
+		},
+		{
+			query: "!a= 1",
+		},
+		{
+			query: "a, b > 0",
+			expected: &resource.LabelQuery{
+				Terms: []resource.LabelTerm{
+					{
+						Key: "a",
+						Op:  resource.LabelOpExists,
+					},
+					{
+						Key:    "b",
+						Op:     resource.LabelOpLTENumeric,
+						Value:  []string{"0"},
+						Invert: true,
+					},
+				},
+			},
+		},
+	} {
+		t.Run(tt.query, func(t *testing.T) {
+			require := require.New(t)
+
+			res, err := labels.ParseQuery(tt.query)
+
+			if tt.expected == nil {
+				require.Error(err)
+
+				return
+			}
+
+			require.NoError(err)
+			require.Equal(tt.expected, res)
+		})
+	}
+}
diff --git a/client/pkg/cosi/labels/lexer.go b/client/pkg/cosi/labels/lexer.go
new file mode 100644
index 000000000..8761a95ac
--- /dev/null
+++ b/client/pkg/cosi/labels/lexer.go
@@ -0,0 +1,247 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package labels
+
+import (
+	"fmt"
+	"unicode/utf8"
+)
+
+// lexerToken represents constant definition for lexer token.
+type lexerToken int
+
+// newToken parses token from string.
+func newToken(s string) (lexerToken, bool) {
+	switch s {
+	case ")":
+		return closedParToken, true
+	case "(":
+		return openParToken, true
+	case ",":
+		return commaToken, true
+	case "!":
+		return doesNotExistToken, true
+	case "!=":
+		return neqToken, true
+	case "==":
+		return doubleEQToken, true
+	case "=":
+		return eqToken, true
+	case ">":
+		return gtToken, true
+	case ">=":
+		return gteToken, true
+	case "<":
+		return ltToken, true
+	case "<=":
+		return lteToken, true
+	case "notin":
+		return notInToken, true
+	case "in":
+		return inToken, true
+	default:
+		return 0, false
+	}
+}
+
+// String converts token to string.
+func (t lexerToken) String() string {
+	//nolint:exhaustive
+	switch t {
+	case closedParToken:
+		return ")"
+	case openParToken:
+		return "("
+	case commaToken:
+		return ","
+	case doesNotExistToken:
+		return "!"
+	case doubleEQToken:
+		return "=="
+	case eqToken:
+		return "="
+	case gtToken:
+		return ">"
+	case gteToken:
+		return ">="
+	case ltToken:
+		return "<"
+	case lteToken:
+		return "<="
+	case neqToken:
+		return "!="
+	case notInToken:
+		return "notin"
+	case inToken:
+		return "in"
+	default:
+		return ""
+	}
+}
+
+const (
+	// errorToken represents scan error.
+	errorToken lexerToken = iota
+	// endOfStringToken represents end of string.
+	endOfStringToken
+	// closedParToken represents close parenthesis.
+	closedParToken
+	// commaToken represents the comma.
+	commaToken
+	// doesNotExistToken represents logic not.
+	doesNotExistToken
+	// doubleEQToken represents double equals.
+	doubleEQToken
+	// eqToken represents equal.
+	eqToken
+	// gtToken represents greater than.
+	gtToken
+	// gteToken represents greater than or equal.
+	gteToken
+	// IdentifierToken represents identifier, e.g. keys and values.
+	IdentifierToken
+	// inToken represents in.
+	inToken
+	// ltToken represents less than.
+	ltToken
+	// lteToken represents less than or equal.
+	lteToken
+	// neqToken represents not equal.
+	neqToken
+	// notInToken represents not in.
+	notInToken
+	// openParToken represents open parenthesis.
+	openParToken
+)
+
+// isWhitespace returns true if the rune is a space, tab, or newline.
+func isWhitespace(ch rune) bool {
+	return ch == ' ' || ch == '\t' || ch == '\r' || ch == '\n'
+}
+
+// isSpecialSymbol detects if the character ch can be an operator.
+func isSpecialSymbol(ch rune) bool {
+	switch ch {
+	case '=', '!', '(', ')', ',', '>', '<':
+		return true
+	}
+
+	return false
+}
+
+// lexer represents the lexer struct for label selector.
+// It contains necessary information to tokenize the input string.
+type lexer struct {
+	// s stores the string to be tokenized
+	s string
+	// pos is the position currently tokenized
+	pos int
+}
+
+// read returns the character currently lexed
+// increment the position and check the buffer overflow.
+func (l *lexer) read() (rune, int) {
+	if l.pos >= len(l.s) {
+		return 0, 0
+	}
+
+	b, width := utf8.DecodeRuneInString(l.s[l.pos:])
+	l.pos += width
+
+	return b, width
+}
+
+// scanIDOrKeyword scans string to recognize literal token (for example 'in') or an identifier.
+func (l *lexer) scanIDOrKeyword() (tok lexerToken, lit string) {
+	var buffer []rune
+IdentifierLoop:
+	for {
+		switch ch, width := l.read(); {
+		case ch == 0:
+			break IdentifierLoop
+		case isSpecialSymbol(ch) || isWhitespace(ch):
+			l.pos -= width
+
+			break IdentifierLoop
+		default:
+			buffer = append(buffer, ch)
+		}
+	}
+
+	s := string(buffer)
+	if val, ok := newToken(s); ok { // is a literal token?
+		return val, s
+	}
+
+	return IdentifierToken, s // otherwise is an identifier
+}
+
+// scanSpecialSymbol scans string starting with special symbol.
+// special symbol identify non literal operators. "!=", "==", "=".
+func (l *lexer) scanSpecialSymbol() (lexerToken, string) {
+	var (
+		buffer  []rune
+		token   lexerToken
+		literal string
+	)
+
+SpecialSymbolLoop:
+	for {
+		switch ch, width := l.read(); {
+		case ch == 0:
+			break SpecialSymbolLoop
+		case isSpecialSymbol(ch):
+			buffer = append(buffer, ch)
+
+			if t, ok := newToken(string(buffer)); ok {
+				token = t
+				literal = string(buffer)
+			} else if token != 0 {
+				l.pos -= width
+
+				break SpecialSymbolLoop
+			}
+		default:
+			l.pos -= width
+
+			break SpecialSymbolLoop
+		}
+	}
+
+	if token == 0 {
+		return errorToken, fmt.Sprintf("error expected: keyword found '%s'", string(buffer))
+	}
+
+	return token, literal
+}
+
+// skipWhiteSpaces consumes all blank characters
+// returning the first non blank character.
+func (l *lexer) skipWhiteSpaces(ch rune, width int) (rune, int) {
+	for {
+		if !isWhitespace(ch) {
+			return ch, width
+		}
+
+		ch, width = l.read()
+	}
+}
+
+// lex returns a pair of Token and the literal.
+// Literal is meaningful only for IdentifierToken token.
+func (l *lexer) lex() (tok lexerToken, lit string) {
+	switch ch, width := l.skipWhiteSpaces(l.read()); {
+	case ch == 0:
+		return endOfStringToken, ""
+	case isSpecialSymbol(ch):
+		l.pos -= width
+
+		return l.scanSpecialSymbol()
+	default:
+		l.pos -= width
+
+		return l.scanIDOrKeyword()
+	}
+}
diff --git a/client/pkg/cosi/labels/parser.go b/client/pkg/cosi/labels/parser.go
new file mode 100644
index 000000000..f6c156144
--- /dev/null
+++ b/client/pkg/cosi/labels/parser.go
@@ -0,0 +1,298 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package labels
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/siderolabs/gen/maps"
+	"github.com/siderolabs/gen/xslices"
+)
+
+// scannedItem contains the Token and the literal produced by the lexer.
+type scannedItem struct {
+	literal string
+	token   lexerToken
+}
+
+// parser data structure contains the label selector parser data structure.
+type parser struct {
+	currentItem *scannedItem
+	l           *lexer
+	position    int
+}
+
+// parserContext represents context during parsing:
+// some literal for example 'in' and 'notin' can be
+// recognized as operator for example 'x in (a)' but
+// it can be recognized as value for example 'value in (in)'.
+type parserContext int
+
+const (
+	keyAndOperatorContext parserContext = iota
+	valuesContext
+)
+
+// lookahead func returns the current token and string. No increment of current position.
+func (p *parser) lookahead(context parserContext) (lexerToken, string) {
+	if p.currentItem == nil {
+		token, literal := p.l.lex()
+
+		p.currentItem = &scannedItem{
+			token:   token,
+			literal: literal,
+		}
+	}
+
+	token, literal := p.currentItem.token, p.currentItem.literal
+
+	if context == valuesContext {
+		//nolint:exhaustive
+		switch token {
+		case inToken, notInToken:
+			token = IdentifierToken
+		}
+	}
+
+	return token, literal
+}
+
+// consume returns current token and string. Increments the position.
+func (p *parser) consume(context parserContext) (lexerToken, string) {
+	tok, lit := p.lookahead(context)
+
+	p.position++
+
+	p.currentItem = nil
+
+	return tok, lit
+}
+
+// parse runs the left recursive descending algorithm
+// on input string. It returns a list of Term objects.
+func (p *parser) parse() (*resource.LabelQuery, error) {
+	var terms []resource.LabelTerm
+
+	for {
+		tok, lit := p.lookahead(valuesContext)
+		//nolint:exhaustive
+		switch tok {
+		case IdentifierToken, doesNotExistToken:
+			r, err := p.parseTerm()
+			if err != nil {
+				return nil, fmt.Errorf("unable to parse term: %w", err)
+			}
+
+			terms = append(terms, *r)
+
+			t, l := p.consume(valuesContext)
+			//nolint:exhaustive
+			switch t {
+			case endOfStringToken:
+				return &resource.LabelQuery{
+					Terms: terms,
+				}, nil
+			case commaToken:
+				t2, l2 := p.lookahead(valuesContext)
+				if t2 != IdentifierToken && t2 != doesNotExistToken {
+					return nil, fmt.Errorf("found '%s', expected: identifier after ','", l2)
+				}
+			default:
+				return nil, fmt.Errorf("found '%s', expected: ',' or 'end of string'", l)
+			}
+		case endOfStringToken:
+			return &resource.LabelQuery{
+				Terms: terms,
+			}, nil
+		default:
+			return nil, fmt.Errorf("found '%s', expected: !, identifier, or 'end of string'", lit)
+		}
+	}
+}
+
+func (p *parser) parseTerm() (*resource.LabelTerm, error) {
+	var (
+		term resource.LabelTerm
+		err  error
+	)
+
+	tok, key := p.consume(valuesContext)
+
+	doesNotExist := tok == doesNotExistToken
+
+	if doesNotExist {
+		tok, key = p.consume(valuesContext)
+
+		term.Invert = true
+	}
+
+	term.Key = key
+
+	if tok != IdentifierToken {
+		err = fmt.Errorf("found '%s', expected: identifier", key)
+
+		return nil, err
+	}
+
+	if t, _ := p.lookahead(valuesContext); t == endOfStringToken || t == commaToken {
+		term.Op = resource.LabelOpExists
+
+		return &term, nil
+	} else if doesNotExist {
+		return nil, fmt.Errorf("expected EOF or ',', found %s", tok.String())
+	}
+
+	tok, lit := p.consume(keyAndOperatorContext)
+	//nolint:exhaustive
+	switch tok {
+	case notInToken:
+		term.Invert = true
+
+		fallthrough
+	case inToken:
+		term.Op = resource.LabelOpIn
+	case neqToken:
+		term.Invert = true
+
+		fallthrough
+	case eqToken, doubleEQToken:
+		term.Op = resource.LabelOpEqual
+	// >= is inverse to <
+	case gteToken:
+		term.Invert = true
+
+		fallthrough
+	case ltToken:
+		term.Op = resource.LabelOpLTNumeric
+	// > is inverse to <=
+	case gtToken:
+		term.Invert = true
+
+		fallthrough
+	case lteToken:
+		term.Op = resource.LabelOpLTENumeric
+	default:
+		allowedTokens := []lexerToken{
+			doubleEQToken,
+			eqToken,
+			neqToken,
+			gteToken,
+			gtToken,
+			inToken,
+			notInToken,
+			lteToken,
+			ltToken,
+		}
+
+		return nil, fmt.Errorf("found '%s', expected: %v", lit, strings.Join(xslices.Map(allowedTokens, func(t lexerToken) string { return t.String() }), ", "))
+	}
+
+	if term.Op == resource.LabelOpIn {
+		term.Value, err = p.parseValues()
+
+		return &term, err
+	}
+
+	term.Value, err = p.parseExactValue()
+
+	return &term, err
+}
+
+// parseValues parses the values for set based matching (x,y,z).
+func (p *parser) parseValues() ([]string, error) {
+	tok, lit := p.consume(valuesContext)
+	if tok != openParToken {
+		return nil, fmt.Errorf("found '%s' expected: '('", lit)
+	}
+
+	tok, lit = p.lookahead(valuesContext)
+	//nolint:exhaustive
+	switch tok {
+	case IdentifierToken, commaToken:
+		s, err := p.parseIdentifiersList() // handles general cases
+		if err != nil {
+			return nil, err
+		}
+
+		if tok, _ = p.consume(valuesContext); tok != closedParToken {
+			return nil, fmt.Errorf("found '%s', expected: ')'", lit)
+		}
+
+		res := maps.Keys(s)
+		sort.Strings(res)
+
+		return res, nil
+	case closedParToken: // handles "()"
+		p.consume(valuesContext)
+
+		return []string{""}, nil
+	default:
+		return nil, fmt.Errorf("found '%s', expected: ',', ')' or identifier", lit)
+	}
+}
+
+// parseIdentifiersList parses a (possibly empty) list
+// of comma separated (possibly empty) identifiers.
+func (p *parser) parseIdentifiersList() (map[string]struct{}, error) {
+	s := map[string]struct{}{}
+
+	for {
+		tok, lit := p.consume(valuesContext)
+		//nolint:exhaustive
+		switch tok {
+		case IdentifierToken:
+			s[lit] = struct{}{}
+
+			tok2, lit2 := p.lookahead(valuesContext)
+
+			//nolint:exhaustive
+			switch tok2 {
+			case commaToken:
+				continue
+			case closedParToken:
+				return s, nil
+			default:
+				return nil, fmt.Errorf("found '%s', expected: ',' or ')'", lit2)
+			}
+		case commaToken: // handled here since we can have "(,"
+			if len(s) == 0 {
+				s[""] = struct{}{} // to handle (,
+			}
+
+			tok2, _ := p.lookahead(valuesContext)
+			if tok2 == closedParToken {
+				s[""] = struct{}{} // to handle ,)  Double "" removed by StringSet
+
+				return s, nil
+			}
+
+			if tok2 == commaToken {
+				p.consume(valuesContext)
+
+				s[""] = struct{}{} // to handle ,, Double "" removed by StringSet
+			}
+		default: // it can be operator
+			return s, fmt.Errorf("found '%s', expected: ',', or identifier", lit)
+		}
+	}
+}
+
+// parseExactValue parses the only value for exact match style.
+func (p *parser) parseExactValue() ([]string, error) {
+	tok, _ := p.lookahead(valuesContext)
+	if tok == endOfStringToken || tok == commaToken {
+		return []string{""}, nil
+	}
+
+	tok, lit := p.consume(valuesContext)
+	if tok == IdentifierToken {
+		return []string{lit}, nil
+	}
+
+	return nil, fmt.Errorf("found '%s', expected: identifier", lit)
+}
diff --git a/client/pkg/example_test.go b/client/pkg/example_test.go
new file mode 100644
index 000000000..dedfb8fec
--- /dev/null
+++ b/client/pkg/example_test.go
@@ -0,0 +1,33 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package pkg_test
+
+import (
+	"os"
+
+	"github.com/siderolabs/omni/client/pkg/omnictl"
+	"github.com/siderolabs/omni/client/pkg/version"
+)
+
+//nolint:wsl,testableexamples
+func Example() {
+	// This is an example of building omnictl executable.
+
+	version.Name = "omni"
+	version.SHA = "build SHA" // Optional.
+	version.Tag = "v0.29.0"   // Optional.
+	version.API = 1           // Required: omnictl validates that the client has the same API version as the server.
+
+	// You can disable this validation and warnings by setting:
+	// version.SuppressVersionWarning = true
+
+	// Initialize Root cmd version.
+	omnictl.RootCmd.Version = version.String()
+
+	// Run Root command.
+	if err := omnictl.RootCmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}
diff --git a/client/pkg/meta/labels.go b/client/pkg/meta/labels.go
new file mode 100644
index 000000000..1291bda61
--- /dev/null
+++ b/client/pkg/meta/labels.go
@@ -0,0 +1,31 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package meta keeps Talos meta partition utils.
+package meta
+
+import "gopkg.in/yaml.v3"
+
+// ImageLabels describes structure that is stored in the Talos metadata and keeps machine labels
+// that are initially assigned to the machine when it connects to Omni.
+type ImageLabels struct {
+	Labels       map[string]string `yaml:"machineLabels"`
+	LegacyLabels map[string]string `yaml:"machineInitialLabels,omitempty"`
+}
+
+// Encode converts labels to the serialized value to be stored in the meta partition.
+func (l ImageLabels) Encode() ([]byte, error) {
+	return yaml.Marshal(l)
+}
+
+// ParseLabels reads label from the encoded metadata value.
+func ParseLabels(data []byte) (*ImageLabels, error) {
+	labels := &ImageLabels{}
+
+	if err := yaml.Unmarshal(data, &labels); err != nil {
+		return nil, err
+	}
+
+	return labels, nil
+}
diff --git a/client/pkg/meta/meta.go b/client/pkg/meta/meta.go
new file mode 100644
index 000000000..e47235e3e
--- /dev/null
+++ b/client/pkg/meta/meta.go
@@ -0,0 +1,38 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package meta keeps Talos meta partition utils.
+package meta
+
+// StateEncryptionConfig is github.com/siderolabs/talos/internal/pkg/meta.StateEncryptionConfig.
+const StateEncryptionConfig = 9
+
+// MetalNetworkPlatformConfig is github.com/siderolabs/talos/internal/pkg/meta.MetalNetworkPlatformConfig.
+// tsgen:MetalNetworkPlatformConfig
+const MetalNetworkPlatformConfig = 10
+
+// LabelsMeta is github.com/siderolabs/talos/internal/pkg/meta.UserReserved1.
+// Omni stores initial machine labels under that key.
+// tsgen:LabelsMeta
+const LabelsMeta = 12
+
+// UserReserved2 is github.com/siderolabs/talos/internal/pkg/meta.UserReserved2.
+const UserReserved2 = 13
+
+// UserReserved3 is github.com/siderolabs/talos/internal/pkg/meta.UserReserved3.
+const UserReserved3 = 14
+
+// CanSetMetaKey checks if the meta key can be set using Omni/Image Factory.
+// To avoid messing up things which are internal to Talos.
+func CanSetMetaKey(key int) bool {
+	switch key {
+	case LabelsMeta,
+		MetalNetworkPlatformConfig,
+		UserReserved2,
+		UserReserved3:
+		return true
+	}
+
+	return false
+}
diff --git a/client/pkg/omni/resources/auth/access_policy.go b/client/pkg/omni/resources/auth/access_policy.go
new file mode 100644
index 000000000..d0cce86c9
--- /dev/null
+++ b/client/pkg/omni/resources/auth/access_policy.go
@@ -0,0 +1,52 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package auth
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+const (
+	// AccessPolicyID is the ID of AccessPolicy resource.
+	AccessPolicyID = "access-policy"
+
+	// AccessPolicyType is the type of AccessPolicy resource.
+	//
+	// tsgen:AccessPolicyType
+	AccessPolicyType = resource.Type("AccessPolicies.omni.sidero.dev")
+)
+
+// NewAccessPolicy creates new AccessPolicy resource.
+func NewAccessPolicy() *AccessPolicy {
+	return typed.NewResource[AccessPolicySpec, AccessPolicyExtension](
+		resource.NewMetadata(resources.DefaultNamespace, AccessPolicyType, AccessPolicyID, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.AccessPolicySpec{}),
+	)
+}
+
+// AccessPolicy resource describes a user ACL.
+type AccessPolicy = typed.Resource[AccessPolicySpec, AccessPolicyExtension]
+
+// AccessPolicySpec wraps specs.AccessPolicySpec.
+type AccessPolicySpec = protobuf.ResourceSpec[specs.AccessPolicySpec, *specs.AccessPolicySpec]
+
+// AccessPolicyExtension providers auxiliary methods for AccessPolicy resource.
+type AccessPolicyExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (AccessPolicyExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             AccessPolicyType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/auth/auth.go b/client/pkg/omni/resources/auth/auth.go
new file mode 100644
index 000000000..c8af32443
--- /dev/null
+++ b/client/pkg/omni/resources/auth/auth.go
@@ -0,0 +1,18 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package auth provides resources related to the authentication.
+package auth
+
+import "github.com/siderolabs/omni/client/pkg/omni/resources/registry"
+
+func init() {
+	registry.MustRegisterResource(AuthConfigType, &Config{})
+	registry.MustRegisterResource(IdentityType, &Identity{})
+	registry.MustRegisterResource(PublicKeyType, &PublicKey{})
+	registry.MustRegisterResource(UserType, &User{})
+	registry.MustRegisterResource(AccessPolicyType, &AccessPolicy{})
+	registry.MustRegisterResource(SAMLAssertionType, &SAMLAssertion{})
+	registry.MustRegisterResource(SAMLLabelRuleType, &SAMLLabelRule{})
+}
diff --git a/client/pkg/omni/resources/auth/config.go b/client/pkg/omni/resources/auth/config.go
new file mode 100644
index 000000000..fe67dbfd2
--- /dev/null
+++ b/client/pkg/omni/resources/auth/config.go
@@ -0,0 +1,64 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package auth
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+const (
+	// ConfigID is the resource ID under which the authentication parameters for auth0 & webauthn will be written to COSI state.
+	// tsgen:AuthConfigID
+	ConfigID = "auth-config"
+)
+
+// NewAuthConfig creates new Config state.
+func NewAuthConfig() *Config {
+	return typed.NewResource[ConfigSpec, ConfigExtension](
+		resource.NewMetadata(resources.DefaultNamespace, AuthConfigType, ConfigID, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.AuthConfigSpec{}),
+	)
+}
+
+const (
+	// AuthConfigType is the type of Config resource.
+	//
+	// tsgen:AuthConfigType
+	AuthConfigType = resource.Type("AuthConfigs.omni.sidero.dev")
+)
+
+// Config resource is the Omni authentication configuration.
+//
+// Config resource ID is a human-readable string without white-space that uniquely identifies the installation media.
+type Config = typed.Resource[ConfigSpec, ConfigExtension]
+
+// ConfigSpec wraps specs.AuthConfigSpec.
+type ConfigSpec = protobuf.ResourceSpec[specs.AuthConfigSpec, *specs.AuthConfigSpec]
+
+// ConfigExtension providers auxiliary methods for Config resource.
+type ConfigExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ConfigExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             AuthConfigType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
+
+// Enabled check is config settings has any auth enabled.
+func Enabled(res *Config) bool {
+	spec := res.TypedSpec().Value
+
+	return spec.Auth0.Enabled || spec.Webauthn.Enabled || spec.Saml.Enabled
+}
diff --git a/client/pkg/omni/resources/auth/identity.go b/client/pkg/omni/resources/auth/identity.go
new file mode 100644
index 000000000..1a98bc793
--- /dev/null
+++ b/client/pkg/omni/resources/auth/identity.go
@@ -0,0 +1,49 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package auth
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewIdentity creates a new Identity resource.
+func NewIdentity(ns, id string) *Identity {
+	return typed.NewResource[IdentitySpec, IdentityExtension](
+		resource.NewMetadata(ns, IdentityType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.IdentitySpec{}),
+	)
+}
+
+const (
+	// IdentityType is the type of Identity resource.
+	//
+	// tsgen:IdentityType
+	IdentityType = resource.Type("Identities.omni.sidero.dev")
+)
+
+// Identity resource describes a user identity.
+type Identity = typed.Resource[IdentitySpec, IdentityExtension]
+
+// IdentitySpec wraps specs.IdentitySpec.
+type IdentitySpec = protobuf.ResourceSpec[specs.IdentitySpec, *specs.IdentitySpec]
+
+// IdentityExtension providers auxiliary methods for Identity resource.
+type IdentityExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (IdentityExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             IdentityType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/auth/labels.go b/client/pkg/omni/resources/auth/labels.go
new file mode 100644
index 000000000..9bf14a3d2
--- /dev/null
+++ b/client/pkg/omni/resources/auth/labels.go
@@ -0,0 +1,32 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package auth
+
+const (
+	// SAMLLabelPrefix is the prefix added to all SAML attributes on the User resource.
+	// tsgen:SAMLLabelPrefix
+	SAMLLabelPrefix = "saml.omni.sidero.dev/"
+)
+
+const (
+	// LabelPublicKeyUserID is the label that defines the user ID of the public key.
+	LabelPublicKeyUserID = "user-id"
+
+	// LabelIdentityUserID is a label linking identity to the user.
+	// tsgen:LabelIdentityUserID
+	LabelIdentityUserID = "user-id"
+
+	// LabelIdentityTypeServiceAccount is set when the type of the identity is service account.
+	// tsgen:LabelIdentityTypeServiceAccount
+	LabelIdentityTypeServiceAccount = "type-service-account"
+)
+
+const (
+	// LabelSAMLRole is the roles attribute that is copied from SAML assertion.
+	LabelSAMLRole = SAMLLabelPrefix + "role"
+
+	// LabelSAMLGroups is the groups attribute that is copied from SAML assertion.
+	LabelSAMLGroups = SAMLLabelPrefix + "groups"
+)
diff --git a/client/pkg/omni/resources/auth/public_key.go b/client/pkg/omni/resources/auth/public_key.go
new file mode 100644
index 000000000..a1c3882df
--- /dev/null
+++ b/client/pkg/omni/resources/auth/public_key.go
@@ -0,0 +1,49 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package auth
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewPublicKey creates a new PublicKey resource.
+func NewPublicKey(ns, id string) *PublicKey {
+	return typed.NewResource[PublicKeySpec, PublicKeyExtension](
+		resource.NewMetadata(ns, PublicKeyType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.PublicKeySpec{}),
+	)
+}
+
+const (
+	// PublicKeyType is the type of PublicKey resource.
+	//
+	// tsgen:PublicKeyType
+	PublicKeyType = resource.Type("PublicKeys.omni.sidero.dev")
+)
+
+// PublicKey resource describes a user public key.
+type PublicKey = typed.Resource[PublicKeySpec, PublicKeyExtension]
+
+// PublicKeySpec wraps specs.PublicKeySpec.
+type PublicKeySpec = protobuf.ResourceSpec[specs.PublicKeySpec, *specs.PublicKeySpec]
+
+// PublicKeyExtension providers auxiliary methods for PublicKey resource.
+type PublicKeyExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (PublicKeyExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             PublicKeyType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/auth/saml_assertion.go b/client/pkg/omni/resources/auth/saml_assertion.go
new file mode 100644
index 000000000..a5c033e4d
--- /dev/null
+++ b/client/pkg/omni/resources/auth/saml_assertion.go
@@ -0,0 +1,47 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package auth
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewSAMLAssertion creates a new SAMLAssertion resource.
+func NewSAMLAssertion(ns, id string) *SAMLAssertion {
+	return typed.NewResource[SAMLAssertionSpec, SAMLAssertionExtension](
+		resource.NewMetadata(ns, SAMLAssertionType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.SAMLAssertionSpec{}),
+	)
+}
+
+const (
+	// SAMLAssertionType is the type of SAMLAssertion resource.
+	SAMLAssertionType = resource.Type("SAMLAssertions.omni.sidero.dev")
+)
+
+// SAMLAssertion resource describes SAML assertion.
+type SAMLAssertion = typed.Resource[SAMLAssertionSpec, SAMLAssertionExtension]
+
+// SAMLAssertionSpec wraps specs.SAMLAssertionSpec.
+type SAMLAssertionSpec = protobuf.ResourceSpec[specs.SAMLAssertionSpec, *specs.SAMLAssertionSpec]
+
+// SAMLAssertionExtension providers auxiliary methods for SAMLAssertion resource.
+type SAMLAssertionExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (SAMLAssertionExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             SAMLAssertionType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/auth/saml_label_rule.go b/client/pkg/omni/resources/auth/saml_label_rule.go
new file mode 100644
index 000000000..8464ff340
--- /dev/null
+++ b/client/pkg/omni/resources/auth/saml_label_rule.go
@@ -0,0 +1,58 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package auth
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewSAMLLabelRule creates a new SAMLLabelRule resource.
+func NewSAMLLabelRule(ns, id string) *SAMLLabelRule {
+	return typed.NewResource[SAMLLabelRuleSpec, SAMLLabelRuleExtension](
+		resource.NewMetadata(ns, SAMLLabelRuleType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.SAMLLabelRuleSpec{}),
+	)
+}
+
+const (
+	// SAMLLabelRuleType is the type of SAMLLabelRule resource.
+	//
+	// tsgen:SAMLLabelRuleType
+	SAMLLabelRuleType = resource.Type("SAMLLabelRules.omni.sidero.dev")
+)
+
+// SAMLLabelRule resource describes a SAML label rule.
+type SAMLLabelRule = typed.Resource[SAMLLabelRuleSpec, SAMLLabelRuleExtension]
+
+// SAMLLabelRuleSpec wraps specs.SAMLLabelRuleSpec.
+type SAMLLabelRuleSpec = protobuf.ResourceSpec[specs.SAMLLabelRuleSpec, *specs.SAMLLabelRuleSpec]
+
+// SAMLLabelRuleExtension providers auxiliary methods for SAMLLabelRule resource.
+type SAMLLabelRuleExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (SAMLLabelRuleExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             SAMLLabelRuleType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Role On Registration",
+				JSONPath: "{.assignroleonregistration}",
+			},
+			{
+				Name:     "Match Labels",
+				JSONPath: "{.matchlabels}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/auth/user.go b/client/pkg/omni/resources/auth/user.go
new file mode 100644
index 000000000..83d3cdf51
--- /dev/null
+++ b/client/pkg/omni/resources/auth/user.go
@@ -0,0 +1,49 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package auth
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewUser creates a new User resource.
+func NewUser(ns, id string) *User {
+	return typed.NewResource[UserSpec, UserExtension](
+		resource.NewMetadata(ns, UserType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.UserSpec{}),
+	)
+}
+
+const (
+	// UserType is the type of User resource.
+	//
+	// tsgen:UserType
+	UserType = resource.Type("Users.omni.sidero.dev")
+)
+
+// User resource describes a user.
+type User = typed.Resource[UserSpec, UserExtension]
+
+// UserSpec wraps specs.UserSpec.
+type UserSpec = protobuf.ResourceSpec[specs.UserSpec, *specs.UserSpec]
+
+// UserExtension providers auxiliary methods for User resource.
+type UserExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (UserExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             UserType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/common/common.go b/client/pkg/omni/resources/common/common.go
new file mode 100644
index 000000000..421a8f9c8
--- /dev/null
+++ b/client/pkg/omni/resources/common/common.go
@@ -0,0 +1,30 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package common contains common variables related to resources.
+package common
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+
+	authres "github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// UserManagedResourceTypes is a list of resource types that are managed by the user.
+var UserManagedResourceTypes = []resource.Type{
+	authres.IdentityType,
+	authres.UserType,
+	authres.AccessPolicyType,
+	authres.SAMLLabelRuleType,
+	omni.ClusterType,
+	omni.ConfigPatchType,
+	omni.EtcdManualBackupType,
+	omni.MachineClassType,
+	omni.MachineLabelsType,
+	omni.MachineSetType,
+	omni.MachineSetNodeType,
+	omni.EtcdBackupS3ConfType,
+	omni.SchematicConfigurationType,
+}
diff --git a/client/pkg/omni/resources/k8s/k8s.go b/client/pkg/omni/resources/k8s/k8s.go
new file mode 100644
index 000000000..451220d5d
--- /dev/null
+++ b/client/pkg/omni/resources/k8s/k8s.go
@@ -0,0 +1,12 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package k8s provides resources related to the Kubernetes.
+package k8s
+
+import "github.com/siderolabs/omni/client/pkg/omni/resources/registry"
+
+func init() {
+	registry.MustRegisterResource(KubernetesResourceType, &KubernetesResource{})
+}
diff --git a/client/pkg/omni/resources/k8s/kubernetes_resource.go b/client/pkg/omni/resources/k8s/kubernetes_resource.go
new file mode 100644
index 000000000..c0accbd61
--- /dev/null
+++ b/client/pkg/omni/resources/k8s/kubernetes_resource.go
@@ -0,0 +1,51 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package k8s contains Kubernetes resource wrapper.
+package k8s
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewKubernetesResource creates new cluster config version resource.
+func NewKubernetesResource(ns string, id resource.ID, spec KubernetesResourceSpec) *KubernetesResource {
+	return typed.NewResource[KubernetesResourceSpec, KubernetesResourceExtension](
+		resource.NewMetadata(ns, KubernetesResourceType, id, resource.VersionUndefined),
+		spec,
+	)
+}
+
+// KubernetesResourceType is the type of KubernetesResource resource.
+//
+// tsgen:KubernetesResourceType
+const KubernetesResourceType = resource.Type("KubernetesResources.omni.sidero.dev")
+
+// KubernetesResource wraps the Kubernetes Resource.
+type KubernetesResource = typed.Resource[KubernetesResourceSpec, KubernetesResourceExtension]
+
+// KubernetesResourceSpec wraps specs.KubernetesResourceSpec.
+type KubernetesResourceSpec string
+
+// DeepCopy implements DeepCopyable interface.
+func (s KubernetesResourceSpec) DeepCopy() KubernetesResourceSpec {
+	return s
+}
+
+// KubernetesResourceExtension provides auxiliary methods for KubernetesResource.
+type KubernetesResourceExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (KubernetesResourceExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             KubernetesResourceType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/oidc/jwt_public_key.go b/client/pkg/omni/resources/oidc/jwt_public_key.go
new file mode 100644
index 000000000..f768304f0
--- /dev/null
+++ b/client/pkg/omni/resources/oidc/jwt_public_key.go
@@ -0,0 +1,43 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package oidc
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+)
+
+// NewJWTPublicKey creates new JWTPublicKey state.
+func NewJWTPublicKey(ns, id string) *JWTPublicKey {
+	return typed.NewResource[JWTPublicKeySpec, JWTPublicKeyExtension](
+		resource.NewMetadata(ns, JWTPublicKeyType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.JWTPublicKeySpec{}),
+	)
+}
+
+// JWTPublicKeyType is the type of JWTPublicKey resource.
+const JWTPublicKeyType = resource.Type("JWTPublicKeys.system.sidero.dev")
+
+// JWTPublicKey resource describes current DB version (migrations state).
+type JWTPublicKey = typed.Resource[JWTPublicKeySpec, JWTPublicKeyExtension]
+
+// JWTPublicKeySpec wraps specs.JWTPublicKeySpec.
+type JWTPublicKeySpec = protobuf.ResourceSpec[specs.JWTPublicKeySpec, *specs.JWTPublicKeySpec]
+
+// JWTPublicKeyExtension providers auxiliary methods for JWTPublicKey resource.
+type JWTPublicKeyExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (JWTPublicKeyExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             JWTPublicKeyType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: NamespaceName,
+	}
+}
diff --git a/client/pkg/omni/resources/oidc/oidc.go b/client/pkg/omni/resources/oidc/oidc.go
new file mode 100644
index 000000000..987a3612c
--- /dev/null
+++ b/client/pkg/omni/resources/oidc/oidc.go
@@ -0,0 +1,19 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package oidc provides resources related to the OpenID provider.
+package oidc
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/registry"
+)
+
+// NamespaceName is the namespace for OIDC resources.
+const NamespaceName resource.Namespace = "oidc"
+
+func init() {
+	registry.MustRegisterResource(JWTPublicKeyType, &JWTPublicKey{})
+}
diff --git a/client/pkg/omni/resources/omni/annotations.go b/client/pkg/omni/resources/omni/annotations.go
new file mode 100644
index 000000000..cdd078d29
--- /dev/null
+++ b/client/pkg/omni/resources/omni/annotations.go
@@ -0,0 +1,23 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+const (
+	// MachineLocked locks any updates on a machine set node.
+	// tsgen:MachineLocked
+	MachineLocked = SystemLabelPrefix + "locked"
+
+	// ResourceManagedByClusterTemplates is an annotation which indicates that a resource is managed by cluster templates.
+	// tsgen:ResourceManagedByClusterTemplates
+	ResourceManagedByClusterTemplates = SystemLabelPrefix + "managed-by-cluster-templates"
+
+	// ConfigPatchName human readable patch name.
+	// tsgen:ConfigPatchName
+	ConfigPatchName = "name"
+
+	// ConfigPatchDescription human readable patch description.
+	// tsgen:ConfigPatchDescription
+	ConfigPatchDescription = "description"
+)
diff --git a/client/pkg/omni/resources/omni/backup_conf.go b/client/pkg/omni/resources/omni/backup_conf.go
new file mode 100644
index 000000000..9a724b39a
--- /dev/null
+++ b/client/pkg/omni/resources/omni/backup_conf.go
@@ -0,0 +1,74 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewEtcdBackupS3Conf creates new resource which holds for backup s3 configuration.
+func NewEtcdBackupS3Conf() *EtcdBackupS3Conf {
+	return typed.NewResource[EtcdBackupS3ConfSpec, EtcdBackupS3ConfExtension](
+		resource.NewMetadata(resources.DefaultNamespace, EtcdBackupS3ConfType, EtcdBackupS3ConfID, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.EtcdBackupS3ConfSpec{}),
+	)
+}
+
+const (
+	// EtcdBackupS3ConfID is the ID of the EtcdBackupS3Conf resource.
+	// tsgen:EtcdBackupS3ConfID
+	EtcdBackupS3ConfID = resource.ID("etcd-backup-s3-conf")
+
+	// EtcdBackupS3ConfType is the type of the EtcdBackupS3Conf resource.
+	// tsgen:EtcdBackupS3ConfType
+	EtcdBackupS3ConfType = resource.Type("EtcdBackupS3Configs.omni.sidero.dev")
+)
+
+// EtcdBackupS3Conf describes data needed for the etcd backup.
+type EtcdBackupS3Conf = typed.Resource[EtcdBackupS3ConfSpec, EtcdBackupS3ConfExtension]
+
+// EtcdBackupS3ConfSpec wraps specs.EtcdBackupS3ConfSpec.
+type EtcdBackupS3ConfSpec = protobuf.ResourceSpec[specs.EtcdBackupS3ConfSpec, *specs.EtcdBackupS3ConfSpec]
+
+// EtcdBackupS3ConfExtension provides auxiliary methods for EtcdBackupS3Conf resource.
+type EtcdBackupS3ConfExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (EtcdBackupS3ConfExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             EtcdBackupS3ConfType,
+		DefaultNamespace: resources.DefaultNamespace,
+		Aliases:          []resource.Type{},
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Bucket",
+				JSONPath: "{.bucket}",
+			},
+			{
+				Name:     "Region",
+				JSONPath: "{.region}",
+			},
+			{
+				Name:     "Endpoint",
+				JSONPath: "{.endpoint}",
+			},
+			{
+				Name:     "Access Key ID",
+				JSONPath: "{.accesskeyid}",
+			},
+			{
+				Name:     "Session Token",
+				JSONPath: "{.sessiontoken}",
+			},
+		},
+		Sensitivity: meta.Sensitive,
+	}
+}
diff --git a/client/pkg/omni/resources/omni/backup_data.go b/client/pkg/omni/resources/omni/backup_data.go
new file mode 100644
index 000000000..0ad30d471
--- /dev/null
+++ b/client/pkg/omni/resources/omni/backup_data.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewBackupData creates new resource which holds data for the next etcd backup.
+func NewBackupData(id resource.ID) *BackupData {
+	return typed.NewResource[BackupDataSpec, BackupDataExtension](
+		resource.NewMetadata(resources.DefaultNamespace, BackupDataType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.BackupDataSpec{}),
+	)
+}
+
+const (
+	// BackupDataType is the type of the BackupData resource.
+	// tsgen:BackupDataType
+	BackupDataType = resource.Type("BackupDatas.omni.sidero.dev")
+)
+
+// BackupData describes data needed for the etcd backup.
+type BackupData = typed.Resource[BackupDataSpec, BackupDataExtension]
+
+// BackupDataSpec wraps specs.BackupDataSpec.
+type BackupDataSpec = protobuf.ResourceSpec[specs.BackupDataSpec, *specs.BackupDataSpec]
+
+// BackupDataExtension provides auxiliary methods for BackupData resource.
+type BackupDataExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (BackupDataExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             BackupDataType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster.go b/client/pkg/omni/resources/omni/cluster.go
new file mode 100644
index 000000000..7d914ec9a
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster.go
@@ -0,0 +1,74 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"fmt"
+	"net/url"
+	"path/filepath"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewCluster creates new cluster resource.
+func NewCluster(ns string, id resource.ID) *Cluster {
+	return typed.NewResource[ClusterSpec, ClusterExtension](
+		resource.NewMetadata(ns, ClusterType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterSpec{}),
+	)
+}
+
+const (
+	// ClusterType is the type of the Cluster resource.
+	// tsgen:ClusterType
+	ClusterType = resource.Type("Clusters.omni.sidero.dev")
+)
+
+// Cluster describes client config for Talos API.
+type Cluster = typed.Resource[ClusterSpec, ClusterExtension]
+
+// ClusterSpec wraps specs.ClusterSpec.
+type ClusterSpec = protobuf.ResourceSpec[specs.ClusterSpec, *specs.ClusterSpec]
+
+// ClusterExtension provides auxiliary methods for Cluster resource.
+type ClusterExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
+
+// GetInstallImage extracts Talos version from the cluster resource and adds the installer image url.
+func GetInstallImage(vanillaInstallerBaseURL, factoryBaseURL, schematic, version string) (string, error) {
+	version = strings.TrimLeft(version, "v")
+
+	if schematic == "" {
+		return fmt.Sprintf("%s:v%s", vanillaInstallerBaseURL, version), nil
+	}
+
+	u, err := url.Parse(factoryBaseURL)
+	if err != nil {
+		return "", fmt.Errorf("failed to parse image factory url %w", err)
+	}
+
+	return filepath.Join(u.Host, "installer", fmt.Sprintf("%s:v%s", schematic, version)), nil
+}
+
+// GetEncryptionEnabled returns cluster disk encryption feature flag state.
+func GetEncryptionEnabled(cluster *Cluster) bool {
+	return cluster.TypedSpec().Value.Features != nil && cluster.TypedSpec().Value.Features.DiskEncryption
+}
diff --git a/client/pkg/omni/resources/omni/cluster_bootstrap_status.go b/client/pkg/omni/resources/omni/cluster_bootstrap_status.go
new file mode 100644
index 000000000..9405da990
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_bootstrap_status.go
@@ -0,0 +1,53 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterBootstrapStatus creates new cluster bootstrap status resource.
+func NewClusterBootstrapStatus(ns string, id resource.ID) *ClusterBootstrapStatus {
+	return typed.NewResource[ClusterBootstrapStatusSpec, ClusterBootstrapStatusExtension](
+		resource.NewMetadata(ns, ClusterBootstrapStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterBootstrapStatusSpec{}),
+	)
+}
+
+const (
+	// ClusterBootstrapStatusType is the type of the ClusterMachineConfigStatus resource.
+	// tsgen:ClusterBootstrapStatusType
+	ClusterBootstrapStatusType = resource.Type("ClusterBootstrapStatuses.omni.sidero.dev")
+)
+
+// ClusterBootstrapStatus describes a cluster machine status.
+type ClusterBootstrapStatus = typed.Resource[ClusterBootstrapStatusSpec, ClusterBootstrapStatusExtension]
+
+// ClusterBootstrapStatusSpec wraps specs.ClusterBootstrapStatusSpec.
+type ClusterBootstrapStatusSpec = protobuf.ResourceSpec[specs.ClusterBootstrapStatusSpec, *specs.ClusterBootstrapStatusSpec]
+
+// ClusterBootstrapStatusExtension provides auxiliary methods for ClusterBootstrapStatus resource.
+type ClusterBootstrapStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterBootstrapStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterBootstrapStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Bootstrapped",
+				JSONPath: "{.bootstrapped}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster_config_version.go b/client/pkg/omni/resources/omni/cluster_config_version.go
new file mode 100644
index 000000000..f423b3327
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_config_version.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterConfigVersion creates new cluster config version resource.
+func NewClusterConfigVersion(ns string, id resource.ID) *ClusterConfigVersion {
+	return typed.NewResource[ClusterConfigVersionSpec, ClusterConfigVersionExtension](
+		resource.NewMetadata(ns, ClusterConfigVersionType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterConfigVersionSpec{}),
+	)
+}
+
+const (
+	// ClusterConfigVersionType is the type of the ClusterConfigVersion resource.
+	// tsgen:ClusterConfigVersionType
+	ClusterConfigVersionType = resource.Type("ClusterConfigVersions.omni.sidero.dev")
+)
+
+// ClusterConfigVersion contains the version contract for the time when the cluster was created initially.
+type ClusterConfigVersion = typed.Resource[ClusterConfigVersionSpec, ClusterConfigVersionExtension]
+
+// ClusterConfigVersionSpec wraps specs.ClusterConfigVersionSpec.
+type ClusterConfigVersionSpec = protobuf.ResourceSpec[specs.ClusterConfigVersionSpec, *specs.ClusterConfigVersionSpec]
+
+// ClusterConfigVersionExtension provides auxiliary methods for ClusterConfigVersion resource.
+type ClusterConfigVersionExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterConfigVersionExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterConfigVersionType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     nil,
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster_destroy_status.go b/client/pkg/omni/resources/omni/cluster_destroy_status.go
new file mode 100644
index 000000000..2f96de165
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_destroy_status.go
@@ -0,0 +1,53 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterDestroyStatus creates new cluster destroy status.
+func NewClusterDestroyStatus(ns string, id resource.ID) *ClusterDestroyStatus {
+	return typed.NewResource[ClusterDestroyStatusSpec, ClusterDestroyStatusExtension](
+		resource.NewMetadata(ns, ClusterDestroyStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.DestroyStatusSpec{}),
+	)
+}
+
+const (
+	// ClusterDestroyStatusType is the type of the ClusterDestroyStatus resource.
+	// tsgen:ClusterDestroyStatusType
+	ClusterDestroyStatusType = resource.Type("ClusterDestroyStatuses.omni.sidero.dev")
+)
+
+// ClusterDestroyStatus contains the state of cluster destroy for clusters in TearingDown phase.
+type ClusterDestroyStatus = typed.Resource[ClusterDestroyStatusSpec, ClusterDestroyStatusExtension]
+
+// ClusterDestroyStatusSpec wraps specs.ClusterDestroyStatusSpec.
+type ClusterDestroyStatusSpec = protobuf.ResourceSpec[specs.DestroyStatusSpec, *specs.DestroyStatusSpec]
+
+// ClusterDestroyStatusExtension provides auxiliary methods for ClusterDestroyStatus resource.
+type ClusterDestroyStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterDestroyStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterDestroyStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Phase",
+				JSONPath: "{.phase}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster_endpoint.go b/client/pkg/omni/resources/omni/cluster_endpoint.go
new file mode 100644
index 000000000..78010d580
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_endpoint.go
@@ -0,0 +1,53 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterEndpoint creates new cluster machine status resource.
+func NewClusterEndpoint(ns string, id resource.ID) *ClusterEndpoint {
+	return typed.NewResource[ClusterEndpointSpec, ClusterEndpointExtension](
+		resource.NewMetadata(ns, ClusterEndpointType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterEndpointSpec{}),
+	)
+}
+
+const (
+	// ClusterEndpointType is the type of the ClusterEndpoint resource.
+	// tsgen:ClusterEndpointType
+	ClusterEndpointType = resource.Type("ClusterEndpoints.omni.sidero.dev")
+)
+
+// ClusterEndpoint contains the summary for the cluster health, availability, number of nodes.
+type ClusterEndpoint = typed.Resource[ClusterEndpointSpec, ClusterEndpointExtension]
+
+// ClusterEndpointSpec wraps specs.ClusterEndpointSpec.
+type ClusterEndpointSpec = protobuf.ResourceSpec[specs.ClusterEndpointSpec, *specs.ClusterEndpointSpec]
+
+// ClusterEndpointExtension provides auxiliary methods for ClusterEndpoint resource.
+type ClusterEndpointExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterEndpointExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterEndpointType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Endpoints",
+				JSONPath: "{.managementaddresses}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster_machine.go b/client/pkg/omni/resources/omni/cluster_machine.go
new file mode 100644
index 000000000..cc9ece199
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_machine.go
@@ -0,0 +1,46 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterMachine creates new cluster machine resource.
+func NewClusterMachine(ns string, id resource.ID) *ClusterMachine {
+	return typed.NewResource[ClusterMachineSpec, ClusterMachineExtension](
+		resource.NewMetadata(ns, ClusterMachineType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterMachineSpec{}),
+	)
+}
+
+// ClusterMachineType is the type of the ClusterMachine resource.
+// tsgen:ClusterMachineType
+const ClusterMachineType = resource.Type("ClusterMachines.omni.sidero.dev")
+
+// ClusterMachine describes a machine belonging to a cluster.
+type ClusterMachine = typed.Resource[ClusterMachineSpec, ClusterMachineExtension]
+
+// ClusterMachineSpec wraps specs.ClusterMachineSpec.
+type ClusterMachineSpec = protobuf.ResourceSpec[specs.ClusterMachineSpec, *specs.ClusterMachineSpec]
+
+// ClusterMachineExtension provides auxiliary methods for ClusterMachine resource.
+type ClusterMachineExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterMachineExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterMachineType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster_machine_config.go b/client/pkg/omni/resources/omni/cluster_machine_config.go
new file mode 100644
index 000000000..d5e7620b1
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_machine_config.go
@@ -0,0 +1,49 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterMachineConfig creates new cluster machine config resource.
+func NewClusterMachineConfig(ns string, id resource.ID) *ClusterMachineConfig {
+	return typed.NewResource[ClusterMachineConfigSpec, ClusterMachineConfigExtension](
+		resource.NewMetadata(ns, ClusterMachineConfigType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterMachineConfigSpec{}),
+	)
+}
+
+const (
+	// ClusterMachineConfigType is the type of the ClusterMachineConfig resource.
+	// tsgen:ClusterMachineConfigType
+	ClusterMachineConfigType = resource.Type("ClusterMachineConfigs.omni.sidero.dev")
+)
+
+// ClusterMachineConfig is the final machine config generated from the template, cluster machine, loadbalancer status
+// and siderolink config.
+type ClusterMachineConfig = typed.Resource[ClusterMachineConfigSpec, ClusterMachineConfigExtension]
+
+// ClusterMachineConfigSpec wraps specs.ClusterMachineConfigSpec.
+type ClusterMachineConfigSpec = protobuf.ResourceSpec[specs.ClusterMachineConfigSpec, *specs.ClusterMachineConfigSpec]
+
+// ClusterMachineConfigExtension provides auxiliary methods for ClusterMachineConfig resource.
+type ClusterMachineConfigExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterMachineConfigExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterMachineConfigType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster_machine_config_patches.go b/client/pkg/omni/resources/omni/cluster_machine_config_patches.go
new file mode 100644
index 000000000..02531d952
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_machine_config_patches.go
@@ -0,0 +1,46 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterMachineConfigPatches creates new cluster machine config patches resource.
+func NewClusterMachineConfigPatches(ns string, id resource.ID) *ClusterMachineConfigPatches {
+	return typed.NewResource[ClusterMachineConfigPatchesSpec, ClusterMachineConfigPatchesExtension](
+		resource.NewMetadata(ns, ClusterMachineConfigPatchesType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterMachineConfigPatchesSpec{}),
+	)
+}
+
+// ClusterMachineConfigPatchesType is the type of the ClusterMachineConfigPatches resource.
+// tsgen:ClusterMachineConfigPatchesType
+const ClusterMachineConfigPatchesType = resource.Type("ClusterMachineConfigPatches.omni.sidero.dev")
+
+// ClusterMachineConfigPatches describes a config patch list related to the cluster machine.
+type ClusterMachineConfigPatches = typed.Resource[ClusterMachineConfigPatchesSpec, ClusterMachineConfigPatchesExtension]
+
+// ClusterMachineConfigPatchesSpec wraps specs.ClusterMachineConfigPatchesSpec.
+type ClusterMachineConfigPatchesSpec = protobuf.ResourceSpec[specs.ClusterMachineConfigPatchesSpec, *specs.ClusterMachineConfigPatchesSpec]
+
+// ClusterMachineConfigPatchesExtension provides auxiliary methods for ClusterMachineConfigPatches resource.
+type ClusterMachineConfigPatchesExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterMachineConfigPatchesExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterMachineConfigPatchesType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster_machine_config_patches_test.go b/client/pkg/omni/resources/omni/cluster_machine_config_patches_test.go
new file mode 100644
index 000000000..f17e5ce91
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_machine_config_patches_test.go
@@ -0,0 +1,86 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/siderolabs/gen/xtesting/must"
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+const (
+	newLineAndText = `
+    master: 2
+	workers: 3`
+
+	justText = `master: 1
+text: "test"`
+)
+
+func TestClusterMachineConfigPatchesSpecW_marshal(t *testing.T) {
+	original := omni.NewClusterMachineConfigPatches("default", "1")
+	original.TypedSpec().Value.Patches = []string{newLineAndText, justText}
+
+	out := must.Value(yaml.Marshal(must.Value(resource.MarshalYAML(original))(t)))(t)
+
+	var dest protobuf.YAMLResource
+
+	err := yaml.Unmarshal(out, &dest)
+	require.NoError(t, err)
+
+	fmt.Println(string(out))
+
+	if !resource.Equal(original, dest.Resource()) {
+		t.Log("original -->", string(must.Value(yaml.Marshal(original.Spec()))(t)))
+		t.Log("result  -->", string(must.Value(yaml.Marshal(dest.Resource().Spec()))(t)))
+		t.FailNow()
+	}
+}
+
+func ExampleClusterMachineSpec_marshal() {
+	original := omni.NewClusterMachineConfigPatches("default", "1")
+	original.TypedSpec().Value.Patches = []string{newLineAndText, justText}
+
+	current := time.Date(2022, 12, 9, 0, 0, 0, 0, time.UTC)
+	original.Metadata().SetCreated(current)
+	original.Metadata().SetUpdated(current)
+
+	wrap, err := resource.MarshalYAML(original)
+	if err != nil {
+		panic(err)
+	}
+
+	out, err := yaml.Marshal(wrap)
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Println(string(out))
+
+	// Output:
+	// metadata:
+	//     namespace: default
+	//     type: ClusterMachineConfigPatches.omni.sidero.dev
+	//     id: 1
+	//     version: undefined
+	//     owner:
+	//     phase: running
+	//     created: 2022-12-09T00:00:00Z
+	//     updated: 2022-12-09T00:00:00Z
+	// spec:
+	//     patches:
+	//         - "\n    master: 2\n\tworkers: 3"
+	//         - |-
+	//           master: 1
+	//           text: "test"
+}
diff --git a/client/pkg/omni/resources/omni/cluster_machine_config_status.go b/client/pkg/omni/resources/omni/cluster_machine_config_status.go
new file mode 100644
index 000000000..3e41b96e0
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_machine_config_status.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterMachineConfigStatus creates new cluster machine status resource.
+func NewClusterMachineConfigStatus(ns string, id resource.ID) *ClusterMachineConfigStatus {
+	return typed.NewResource[ClusterMachineConfigStatusSpec, ClusterMachineConfigStatusExtension](
+		resource.NewMetadata(ns, ClusterMachineConfigStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterMachineConfigStatusSpec{}),
+	)
+}
+
+const (
+	// ClusterMachineConfigStatusType is the type of the ClusterMachineConfigStatus resource.
+	// tsgen:ClusterMachineConfigStatusType
+	ClusterMachineConfigStatusType = resource.Type("ClusterMachineConfigStatuses.omni.sidero.dev")
+)
+
+// ClusterMachineConfigStatus describes a cluster machine status.
+type ClusterMachineConfigStatus = typed.Resource[ClusterMachineConfigStatusSpec, ClusterMachineConfigStatusExtension]
+
+// ClusterMachineConfigStatusSpec wraps specs.ClusterMachineConfigStatusSpec.
+type ClusterMachineConfigStatusSpec = protobuf.ResourceSpec[specs.ClusterMachineConfigStatusSpec, *specs.ClusterMachineConfigStatusSpec]
+
+// ClusterMachineConfigStatusExtension provides auxiliary methods for ClusterMachineConfigStatus resource.
+type ClusterMachineConfigStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterMachineConfigStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterMachineConfigStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster_machine_encryption_key.go b/client/pkg/omni/resources/omni/cluster_machine_encryption_key.go
new file mode 100644
index 000000000..02dc55731
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_machine_encryption_key.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterMachineEncryptionKey creates new cluster machine encryption key resource.
+func NewClusterMachineEncryptionKey(ns string, id resource.ID) *ClusterMachineEncryptionKey {
+	return typed.NewResource[ClusterMachineEncryptionKeySpec, ClusterMachineEncryptionKeyExtension](
+		resource.NewMetadata(ns, ClusterMachineEncryptionKeyType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterMachineEncryptionKeySpec{}),
+	)
+}
+
+const (
+	// ClusterMachineEncryptionKeyType is the type of the ClusterMachineEncryptionKey resource.
+	// tsgen:ClusterMachineEncryptionKeyType
+	ClusterMachineEncryptionKeyType = resource.Type("ClusterMachineEncryptionKeys.omni.sidero.dev")
+)
+
+// ClusterMachineEncryptionKey is the generated AES256 encryption key.
+type ClusterMachineEncryptionKey = typed.Resource[ClusterMachineEncryptionKeySpec, ClusterMachineEncryptionKeyExtension]
+
+// ClusterMachineEncryptionKeySpec wraps specs.ClusterMachineEncryptionKeySpec.
+type ClusterMachineEncryptionKeySpec = protobuf.ResourceSpec[specs.ClusterMachineEncryptionKeySpec, *specs.ClusterMachineEncryptionKeySpec]
+
+// ClusterMachineEncryptionKeyExtension provides auxiliary methods for ClusterMachineEncryptionKey resource.
+type ClusterMachineEncryptionKeyExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterMachineEncryptionKeyExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterMachineEncryptionKeyType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster_machine_identity.go b/client/pkg/omni/resources/omni/cluster_machine_identity.go
new file mode 100644
index 000000000..e855136bc
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_machine_identity.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterMachineIdentity creates new cluster machine identity resource.
+func NewClusterMachineIdentity(ns string, id resource.ID) *ClusterMachineIdentity {
+	return typed.NewResource[ClusterMachineIdentitySpec, ClusterMachineIdentityExtension](
+		resource.NewMetadata(ns, ClusterMachineIdentityType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterMachineIdentitySpec{}),
+	)
+}
+
+const (
+	// ClusterMachineIdentityType is the type of the ClusterMachineIdentity resource.
+	// tsgen:ClusterMachineIdentityType
+	ClusterMachineIdentityType = resource.Type("ClusterMachineIdentities.omni.sidero.dev")
+)
+
+// ClusterMachineIdentity contains machine identifiers when it's part of a cluster.
+type ClusterMachineIdentity = typed.Resource[ClusterMachineIdentitySpec, ClusterMachineIdentityExtension]
+
+// ClusterMachineIdentitySpec wraps specs.ClusterMachineIdentitySpec.
+type ClusterMachineIdentitySpec = protobuf.ResourceSpec[specs.ClusterMachineIdentitySpec, *specs.ClusterMachineIdentitySpec]
+
+// ClusterMachineIdentityExtension provides auxiliary methods for ClusterMachineIdentity resource.
+type ClusterMachineIdentityExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterMachineIdentityExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterMachineIdentityType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster_machine_installer_options.go b/client/pkg/omni/resources/omni/cluster_machine_installer_options.go
new file mode 100644
index 000000000..33551aa2e
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_machine_installer_options.go
@@ -0,0 +1,47 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterMachineTalosVersion creates a new ClusterMachineTalosVersion state.
+func NewClusterMachineTalosVersion(ns, id string) *ClusterMachineTalosVersion {
+	return typed.NewResource[ClusterMachineTalosVersionSpec, ClusterMachineTalosVersionExtension](
+		resource.NewMetadata(ns, ClusterMachineTalosVersionType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterMachineTalosVersionSpec{}),
+	)
+}
+
+// ClusterMachineTalosVersionType is the type of the ClusterMachineTalosVersion resource.
+//
+// tsgen:ClusterMachineTalosVersionType
+const ClusterMachineTalosVersionType = resource.Type("ClusterMachineTalosVersions.omni.sidero.dev")
+
+// ClusterMachineTalosVersion resource holds information about a machine relevant to its membership in a cluster.
+type ClusterMachineTalosVersion = typed.Resource[ClusterMachineTalosVersionSpec, ClusterMachineTalosVersionExtension]
+
+// ClusterMachineTalosVersionSpec wraps specs.ClusterMachineTalosVersionSpec.
+type ClusterMachineTalosVersionSpec = protobuf.ResourceSpec[specs.ClusterMachineTalosVersionSpec, *specs.ClusterMachineTalosVersionSpec]
+
+// ClusterMachineTalosVersionExtension providers auxiliary methods for ClusterMachineTalosVersion resource.
+type ClusterMachineTalosVersionExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterMachineTalosVersionExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterMachineTalosVersionType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster_machine_status.go b/client/pkg/omni/resources/omni/cluster_machine_status.go
new file mode 100644
index 000000000..007e6b44c
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_machine_status.go
@@ -0,0 +1,60 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterMachineStatus creates a new ClusterMachineStatus state.
+func NewClusterMachineStatus(ns, id string) *ClusterMachineStatus {
+	return typed.NewResource[ClusterMachineStatusSpec, ClusterMachineStatusExtension](
+		resource.NewMetadata(ns, ClusterMachineStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterMachineStatusSpec{}),
+	)
+}
+
+// ClusterMachineStatusType is the type of the ClusterMachineStatus resource.
+//
+// tsgen:ClusterMachineStatusType
+const ClusterMachineStatusType = resource.Type("ClusterMachineStatuses.omni.sidero.dev")
+
+// ClusterMachineStatus resource holds information about a machine relevant to its membership in a cluster.
+type ClusterMachineStatus = typed.Resource[ClusterMachineStatusSpec, ClusterMachineStatusExtension]
+
+// ClusterMachineStatusSpec wraps specs.ClusterMachineStatusSpec.
+type ClusterMachineStatusSpec = protobuf.ResourceSpec[specs.ClusterMachineStatusSpec, *specs.ClusterMachineStatusSpec]
+
+// ClusterMachineStatusExtension providers auxiliary methods for ClusterMachineStatus resource.
+type ClusterMachineStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterMachineStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterMachineStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Ready",
+				JSONPath: "{.ready}",
+			},
+			{
+				Name:     "Stage",
+				JSONPath: "{.stage}",
+			},
+			{
+				Name:     "apid",
+				JSONPath: "{.apidavailable}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster_machine_template.go b/client/pkg/omni/resources/omni/cluster_machine_template.go
new file mode 100644
index 000000000..edfd21914
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_machine_template.go
@@ -0,0 +1,62 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterMachineTemplate creates new cluster machine status resource.
+func NewClusterMachineTemplate(ns string, id resource.ID) *ClusterMachineTemplate {
+	return typed.NewResource[ClusterMachineTemplateSpec, ClusterMachineTemplateExtension](
+		resource.NewMetadata(ns, ClusterMachineTemplateType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterMachineTemplateSpec{}),
+	)
+}
+
+const (
+	// ClusterMachineTemplateType is the type of the ClusterMachineTemplate resource.
+	// tsgen:ClusterMachineTemplateType
+	ClusterMachineTemplateType = resource.Type("ClusterMachineTemplates.omni.sidero.dev")
+)
+
+// ClusterMachineTemplate describes a cluster machine config generation template
+// It's similar to generate.Input struct in the Talos repo.
+type ClusterMachineTemplate = typed.Resource[ClusterMachineTemplateSpec, ClusterMachineTemplateExtension]
+
+// ClusterMachineTemplateSpec wraps specs.ClusterMachineTemplateSpec.
+type ClusterMachineTemplateSpec = protobuf.ResourceSpec[specs.ClusterMachineTemplateSpec, *specs.ClusterMachineTemplateSpec]
+
+// ClusterMachineTemplateExtension provides auxiliary methods for ClusterMachineTemplate resource.
+type ClusterMachineTemplateExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterMachineTemplateExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterMachineTemplateType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "InstallImage",
+				JSONPath: "{.installimage}",
+			},
+			{
+				Name:     "Kubernetes",
+				JSONPath: "{.kubernetesversion}",
+			},
+			{
+				Name:     "Disk",
+				JSONPath: "{.installdisk}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster_status.go b/client/pkg/omni/resources/omni/cluster_status.go
new file mode 100644
index 000000000..665e663dc
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_status.go
@@ -0,0 +1,65 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterStatus creates new cluster machine status resource.
+func NewClusterStatus(ns string, id resource.ID) *ClusterStatus {
+	return typed.NewResource[ClusterStatusSpec, ClusterStatusExtension](
+		resource.NewMetadata(ns, ClusterStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterStatusSpec{}),
+	)
+}
+
+const (
+	// ClusterStatusType is the type of the ClusterStatus resource.
+	// tsgen:ClusterStatusType
+	ClusterStatusType = resource.Type("ClusterStatuses.omni.sidero.dev")
+)
+
+// ClusterStatus contains the summary for the cluster health, availability, number of nodes.
+type ClusterStatus = typed.Resource[ClusterStatusSpec, ClusterStatusExtension]
+
+// ClusterStatusSpec wraps specs.ClusterStatusSpec.
+type ClusterStatusSpec = protobuf.ResourceSpec[specs.ClusterStatusSpec, *specs.ClusterStatusSpec]
+
+// ClusterStatusExtension provides auxiliary methods for ClusterStatus resource.
+type ClusterStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Available",
+				JSONPath: "{.available}",
+			},
+			{
+				Name:     "Phase",
+				JSONPath: "{.phase}",
+			},
+			{
+				Name:     "Machines",
+				JSONPath: "{.machines.total}",
+			},
+			{
+				Name:     "Healthy",
+				JSONPath: "{.machines.healthy}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/cluster_uuid.go b/client/pkg/omni/resources/omni/cluster_uuid.go
new file mode 100644
index 000000000..7ea11f4c3
--- /dev/null
+++ b/client/pkg/omni/resources/omni/cluster_uuid.go
@@ -0,0 +1,53 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterUUID creates new cluster UUID resource.
+func NewClusterUUID(id resource.ID) *ClusterUUID {
+	return typed.NewResource[ClusterUUIDSpec, ClusterUUIDExtension](
+		resource.NewMetadata(resources.DefaultNamespace, ClusterUUIDType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterUUID{}),
+	)
+}
+
+const (
+	// ClusterUUIDType is the type of the Cluster UUID resource.
+	// tsgen:ClusterUUIDType
+	ClusterUUIDType = resource.Type("ClusterUUIDs.omni.sidero.dev")
+)
+
+// ClusterUUID describes cluster UUID attached to cluster.
+type ClusterUUID = typed.Resource[ClusterUUIDSpec, ClusterUUIDExtension]
+
+// ClusterUUIDSpec wraps specs.ClusterUUID.
+type ClusterUUIDSpec = protobuf.ResourceSpec[specs.ClusterUUID, *specs.ClusterUUID]
+
+// ClusterUUIDExtension provides auxiliary methods for ClusterUUID resource.
+type ClusterUUIDExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterUUIDExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterUUIDType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "UUID",
+				JSONPath: "{.uuid}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/config_patch.go b/client/pkg/omni/resources/omni/config_patch.go
new file mode 100644
index 000000000..ff462ef5f
--- /dev/null
+++ b/client/pkg/omni/resources/omni/config_patch.go
@@ -0,0 +1,148 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+	"github.com/hashicorp/go-multierror"
+	"github.com/siderolabs/gen/pair"
+	"github.com/siderolabs/talos/pkg/machinery/config/configloader"
+	talosrole "github.com/siderolabs/talos/pkg/machinery/role"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+var forbiddenFields = []string{
+	"cluster.clusterName",
+	"cluster.id",
+	"cluster.controlPlane.endpoint",
+	"cluster.token",
+	"cluster.secret",
+	"cluster.aescbcEncryptionSecret",
+	"cluster.secretboxEncryptionSecret",
+	"machine.token",
+	"machine.ca",
+	"machine.type",
+	"machine.install.extensions",
+}
+
+var forbiddenSliceElements = map[string]map[any]struct{}{
+	"machine.features.kubernetesTalosAPIAccess.allowedRoles": {
+		string(talosrole.Admin): {},
+	},
+}
+
+// NewConfigPatch creates new ConfigPatch resource.
+func NewConfigPatch(ns string, id resource.ID, labels ...pair.Pair[string, string]) *ConfigPatch {
+	res := typed.NewResource[ConfigPatchSpec, ConfigPatchExtension](
+		resource.NewMetadata(ns, ConfigPatchType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ConfigPatchSpec{}),
+	)
+
+	for _, label := range labels {
+		res.Metadata().Labels().Set(label.F1, label.F2)
+	}
+
+	return res
+}
+
+const (
+	// ConfigPatchType is the type of the ConfigPatch resource.
+	// tsgen:ConfigPatchType
+	ConfigPatchType = resource.Type("ConfigPatches.omni.sidero.dev")
+)
+
+// ConfigPatch describes machine config patch.
+type ConfigPatch = typed.Resource[ConfigPatchSpec, ConfigPatchExtension]
+
+// ConfigPatchSpec wraps specs.ConfigPatchSpec.
+type ConfigPatchSpec = protobuf.ResourceSpec[specs.ConfigPatchSpec, *specs.ConfigPatchSpec]
+
+// ConfigPatchExtension provides auxiliary methods for ConfigPatch resource.
+type ConfigPatchExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ConfigPatchExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ConfigPatchType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+		Sensitivity:      meta.Sensitive,
+	}
+}
+
+// ValidateConfigPatch parses the config patch data using Talos config loader,
+// then validates that the config patch doesn't have fields that are controlled by omni.
+func ValidateConfigPatch(data string) error {
+	_, err := configloader.NewFromBytes([]byte(data))
+	if err != nil {
+		return err
+	}
+
+	var config map[string]any
+
+	err = yaml.Unmarshal([]byte(data), &config)
+	if err != nil {
+		return err
+	}
+
+	var multiErr error
+
+	for _, field := range forbiddenFields {
+		if _, ok := getField(config, field); ok {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("overriding %q is not allowed in the config patch", field))
+		}
+	}
+
+	for field, forbiddenElementSet := range forbiddenSliceElements {
+		val, ok := getField(config, field)
+		if !ok {
+			continue
+		}
+
+		slice, ok := val.([]any)
+		if !ok {
+			continue
+		}
+
+		for _, element := range slice {
+			if _, ok = forbiddenElementSet[element]; ok {
+				multiErr = multierror.Append(multiErr, fmt.Errorf("element %q is not allowed in field %q", element, field))
+			}
+		}
+	}
+
+	return multiErr
+}
+
+func getField(config map[string]any, field string) (any, bool) {
+	parts := strings.Split(field, ".")
+
+	var obj any
+
+	obj = config
+	for _, part := range parts {
+		current, ok := obj.(map[string]any)
+		if !ok {
+			return nil, false
+		}
+
+		obj, ok = current[part]
+		if !ok {
+			return nil, false
+		}
+	}
+
+	return obj, true
+}
diff --git a/client/pkg/omni/resources/omni/config_patch_test.go b/client/pkg/omni/resources/omni/config_patch_test.go
new file mode 100644
index 000000000..74973dfde
--- /dev/null
+++ b/client/pkg/omni/resources/omni/config_patch_test.go
@@ -0,0 +1,83 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+func TestValidateConfigPatchValidate(t *testing.T) {
+	for _, tt := range []struct {
+		name          string
+		config        string
+		expectedError string
+	}{
+		{
+			name: "valid",
+			config: strings.TrimSpace(`
+machine:
+  network:
+    hostname: abcd
+`),
+		},
+		{
+			name: "token",
+			config: strings.TrimSpace(`
+machine:
+  token: aaa
+`),
+			expectedError: "1 error occurred:\n\t* overriding \"machine.token\" is not allowed in the config patch\n\n",
+		},
+		{
+			name: "several fields",
+			config: strings.TrimSpace(`
+machine:
+  token: bab
+  ca:
+    crt: YWFhCg==
+`),
+			expectedError: "2 errors occurred:\n\t* overriding \"machine.token\" is not allowed in the config patch\n\t* overriding \"machine.ca\" is not allowed in the config patch\n\n",
+		},
+		{
+			name: "different configs",
+			config: strings.TrimSpace(`
+machine:
+  ca:
+    crt: YWFhCg==
+cluster:
+  name: default
+`),
+			expectedError: "unknown keys found during decoding:\ncluster:\n    name: default\n",
+		},
+		{
+			name: "os admin talos API access",
+			config: strings.TrimSpace(`
+machine:
+  features:
+    kubernetesTalosAPIAccess:
+      allowedRoles:
+        - os:reader
+        - os:admin
+        - os:operator
+`),
+			expectedError: "1 error occurred:\n\t* element \"os:admin\" is not allowed in field \"machine.features.kubernetesTalosAPIAccess.allowedRoles\"\n\n",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			err := omni.ValidateConfigPatch(tt.config)
+			if tt.expectedError != "" {
+				require.Error(t, err, tt.expectedError)
+				require.EqualError(t, err, tt.expectedError)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
diff --git a/client/pkg/omni/resources/omni/control_plane_status.go b/client/pkg/omni/resources/omni/control_plane_status.go
new file mode 100644
index 000000000..cba6378fe
--- /dev/null
+++ b/client/pkg/omni/resources/omni/control_plane_status.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewControlPlaneStatus creates new ControlPlaneStatus resource.
+func NewControlPlaneStatus(ns string, id resource.ID) *ControlPlaneStatus {
+	return typed.NewResource[ControlPlaneStatusSpec, ControlPlaneStatusExtension](
+		resource.NewMetadata(ns, ControlPlaneStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ControlPlaneStatusSpec{}),
+	)
+}
+
+const (
+	// ControlPlaneStatusType is the type of the ControlPlaneStatus resource.
+	// tsgen:ControlPlaneStatusType
+	ControlPlaneStatusType = resource.Type("ControlPlaneStatuses.omni.sidero.dev")
+)
+
+// ControlPlaneStatus describes control plane machine set additional status.
+type ControlPlaneStatus = typed.Resource[ControlPlaneStatusSpec, ControlPlaneStatusExtension]
+
+// ControlPlaneStatusSpec wraps specs.ControlPlaneStatusSpec.
+type ControlPlaneStatusSpec = protobuf.ResourceSpec[specs.ControlPlaneStatusSpec, *specs.ControlPlaneStatusSpec]
+
+// ControlPlaneStatusExtension provides auxiliary methods for ControlPlaneStatus resource.
+type ControlPlaneStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ControlPlaneStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ControlPlaneStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/etcd_audit_result.go b/client/pkg/omni/resources/omni/etcd_audit_result.go
new file mode 100644
index 000000000..fd3fae336
--- /dev/null
+++ b/client/pkg/omni/resources/omni/etcd_audit_result.go
@@ -0,0 +1,45 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewEtcdAuditResult creates new etcd audit result.
+func NewEtcdAuditResult(ns string, id resource.ID) *EtcdAuditResult {
+	return typed.NewResource[EtcdAuditResultSpec, EtcdAuditResultExtension](
+		resource.NewMetadata(ns, EtcdAuditResultType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.EtcdAuditResultSpec{}),
+	)
+}
+
+// EtcdAuditResultType is the type of the EtcdAuditResult resource.
+const EtcdAuditResultType = resource.Type("EtcdAuditResults.omni.sidero.dev")
+
+// EtcdAuditResult describes etcd backup encryption data.
+type EtcdAuditResult = typed.Resource[EtcdAuditResultSpec, EtcdAuditResultExtension]
+
+// EtcdAuditResultSpec wraps specs.EtcdAuditResultSpec.
+type EtcdAuditResultSpec = protobuf.ResourceSpec[specs.EtcdAuditResultSpec, *specs.EtcdAuditResultSpec]
+
+// EtcdAuditResultExtension provides auxiliary methods for EtcdAuditResult resource.
+type EtcdAuditResultExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (EtcdAuditResultExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             EtcdAuditResultType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/etcd_backup.go b/client/pkg/omni/resources/omni/etcd_backup.go
new file mode 100644
index 000000000..ae108949f
--- /dev/null
+++ b/client/pkg/omni/resources/omni/etcd_backup.go
@@ -0,0 +1,60 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewEtcdBackup creates new etcd backup info.
+func NewEtcdBackup(clusterName string, t time.Time) *EtcdBackup {
+	return typed.NewResource[EtcdBackupSpec, EtcdBackupExtension](
+		resource.NewMetadata(resources.ExternalNamespace, EtcdBackupType, fmt.Sprintf("%s-%d", clusterName, t.Unix()), resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.EtcdBackupSpec{}),
+	)
+}
+
+const (
+	// EtcdBackupType is the type of the EtcdBackup resource.
+	// tsgen:EtcdBackupType
+	EtcdBackupType = resource.Type("EtcdBackups.omni.sidero.dev")
+)
+
+// EtcdBackup describes etcd backup data.
+type EtcdBackup = typed.Resource[EtcdBackupSpec, EtcdBackupExtension]
+
+// EtcdBackupSpec wraps specs.EtcdBackupSpec.
+type EtcdBackupSpec = protobuf.ResourceSpec[specs.EtcdBackupSpec, *specs.EtcdBackupSpec]
+
+// EtcdBackupExtension provides auxiliary methods for EtcdBackup resource.
+type EtcdBackupExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (EtcdBackupExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             EtcdBackupType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.ExternalNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Created At",
+				JSONPath: "{.createdat}",
+			},
+			{
+				Name:     "Snapshot",
+				JSONPath: "{.snapshot}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/etcd_backup_conf_status.go b/client/pkg/omni/resources/omni/etcd_backup_conf_status.go
new file mode 100644
index 000000000..87ce365f3
--- /dev/null
+++ b/client/pkg/omni/resources/omni/etcd_backup_conf_status.go
@@ -0,0 +1,61 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewEtcdBackupStoreStatus creates new etcd backup configuration status info.
+func NewEtcdBackupStoreStatus() *EtcdBackupStoreStatus {
+	return typed.NewResource[EtcdBackupStoreStatusSpec, EtcdBackupStoreStatusExtension](
+		resource.NewMetadata(resources.EphemeralNamespace, EtcdBackupStoreStatusType, EtcdBackupStoreStatusID, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.EtcdBackupStoreStatusSpec{}),
+	)
+}
+
+const (
+	// EtcdBackupStoreStatusID is the ID of the EtcdBackupStoreStatus resource.
+	// tsgen:EtcdBackupStoreStatusID
+	EtcdBackupStoreStatusID = resource.ID("etcdbackup-store-status")
+
+	// EtcdBackupStoreStatusType is the type of the [EtcdBackupStoreStatus] resource.
+	// tsgen:EtcdBackupStoreStatusType
+	EtcdBackupStoreStatusType = resource.Type("EtcdBackupStoreStatuses.omni.sidero.dev")
+)
+
+// EtcdBackupStoreStatus describes etcd backup status.
+type EtcdBackupStoreStatus = typed.Resource[EtcdBackupStoreStatusSpec, EtcdBackupStoreStatusExtension]
+
+// EtcdBackupStoreStatusSpec wraps specs.EtcdBackupStoreStatusSpec.
+type EtcdBackupStoreStatusSpec = protobuf.ResourceSpec[specs.EtcdBackupStoreStatusSpec, *specs.EtcdBackupStoreStatusSpec]
+
+// EtcdBackupStoreStatusExtension provides auxiliary methods for EtcdBackupStoreStatus resource.
+type EtcdBackupStoreStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (EtcdBackupStoreStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             EtcdBackupStoreStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.EphemeralNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Configuration Name",
+				JSONPath: "{.configurationname}",
+			},
+			{
+				Name:     "Configuration Error",
+				JSONPath: "{.configurationerror}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/etcd_backup_encryption.go b/client/pkg/omni/resources/omni/etcd_backup_encryption.go
new file mode 100644
index 000000000..611b9f725
--- /dev/null
+++ b/client/pkg/omni/resources/omni/etcd_backup_encryption.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewEtcdBackupEncryption creates new etcd backup encryption info.
+func NewEtcdBackupEncryption(ns string, id resource.ID) *EtcdBackupEncryption {
+	return typed.NewResource[EtcdBackupEncryptionSpec, EtcdBackupEncryptionExtension](
+		resource.NewMetadata(ns, EtcdBackupEncryptionType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.EtcdBackupEncryptionSpec{}),
+	)
+}
+
+const (
+	// EtcdBackupEncryptionType is the type of the EtcdBackupEncryption resource.
+	// tsgen:EtcdBackupEncryptionType
+	EtcdBackupEncryptionType = resource.Type("EtcdBackupEncryptions.omni.sidero.dev")
+)
+
+// EtcdBackupEncryption describes etcd backup encryption data.
+type EtcdBackupEncryption = typed.Resource[EtcdBackupEncryptionSpec, EtcdBackupEncryptionExtension]
+
+// EtcdBackupEncryptionSpec wraps specs.EtcdBackupEncryptionSpec.
+type EtcdBackupEncryptionSpec = protobuf.ResourceSpec[specs.EtcdBackupEncryptionSpec, *specs.EtcdBackupEncryptionSpec]
+
+// EtcdBackupEncryptionExtension provides auxiliary methods for EtcdBackupEncryption resource.
+type EtcdBackupEncryptionExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (EtcdBackupEncryptionExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             EtcdBackupEncryptionType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/etcd_backup_overall_status.go b/client/pkg/omni/resources/omni/etcd_backup_overall_status.go
new file mode 100644
index 000000000..395e095c9
--- /dev/null
+++ b/client/pkg/omni/resources/omni/etcd_backup_overall_status.go
@@ -0,0 +1,77 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewEtcdBackupOverallStatus creates new etcd backup status info.
+func NewEtcdBackupOverallStatus() *EtcdBackupOverallStatus {
+	return typed.NewResource[EtcdBackupOverallStatusSpec, EtcdBackupOverallStatusExtension](
+		resource.NewMetadata(resources.DefaultNamespace, EtcdBackupOverallStatusType, EtcdBackupOverallStatusID, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.EtcdBackupOverallStatusSpec{}),
+	)
+}
+
+const (
+	// EtcdBackupOverallStatusID is the ID of the EtcdBackupOverallStatus resource.
+	// tsgen:EtcdBackupOverallStatusID
+	EtcdBackupOverallStatusID = resource.ID("etcdbackup-overall-status")
+
+	// EtcdBackupOverallStatusType is the type of the [EtcdBackupOverallStatus] resource.
+	// tsgen:EtcdBackupOverallStatusType
+	EtcdBackupOverallStatusType = resource.Type("EtcdBackupOverallStatuses.omni.sidero.dev")
+)
+
+// EtcdBackupOverallStatus describes etcd backup status.
+type EtcdBackupOverallStatus = typed.Resource[EtcdBackupOverallStatusSpec, EtcdBackupOverallStatusExtension]
+
+// EtcdBackupOverallStatusSpec wraps specs.EtcdBackupOverallStatusSpec.
+type EtcdBackupOverallStatusSpec = protobuf.ResourceSpec[specs.EtcdBackupOverallStatusSpec, *specs.EtcdBackupOverallStatusSpec]
+
+// EtcdBackupOverallStatusExtension provides auxiliary methods for EtcdBackupOverallStatus resource.
+type EtcdBackupOverallStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (EtcdBackupOverallStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             EtcdBackupOverallStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Configuration Name",
+				JSONPath: "{.configurationname}",
+			},
+			{
+				Name:     "Configuration Error",
+				JSONPath: "{.configurationerror}",
+			},
+			{
+				Name:     "Last Backup Status",
+				JSONPath: "{.lastbackupstatus.status}",
+			},
+			{
+				Name:     "Last Backup Error",
+				JSONPath: "{.lastbackupstatus.error}",
+			},
+			{
+				Name:     "Last Backup Time",
+				JSONPath: "{.lastbackupstatus.lastbackuptime}",
+			},
+			{
+				Name:     "Configuration Attempt",
+				JSONPath: "{.lastbackupstatus.lastbackupattempt}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/etcd_backup_status.go b/client/pkg/omni/resources/omni/etcd_backup_status.go
new file mode 100644
index 000000000..8e29b7bee
--- /dev/null
+++ b/client/pkg/omni/resources/omni/etcd_backup_status.go
@@ -0,0 +1,65 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewEtcdBackupStatus creates new etcd backup status info.
+func NewEtcdBackupStatus(id resource.ID) *EtcdBackupStatus {
+	return typed.NewResource[EtcdBackupStatusSpec, EtcdBackupStatusExtension](
+		resource.NewMetadata(resources.DefaultNamespace, EtcdBackupStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.EtcdBackupStatusSpec{}),
+	)
+}
+
+const (
+	// EtcdBackupStatusType is the type of the EtcdBackupStatus resource.
+	// tsgen:EtcdBackupStatusType
+	EtcdBackupStatusType = resource.Type("EtcdBackupStatuses.omni.sidero.dev")
+)
+
+// EtcdBackupStatus describes etcd backup status.
+type EtcdBackupStatus = typed.Resource[EtcdBackupStatusSpec, EtcdBackupStatusExtension]
+
+// EtcdBackupStatusSpec wraps specs.EtcdBackupStatusSpec.
+type EtcdBackupStatusSpec = protobuf.ResourceSpec[specs.EtcdBackupStatusSpec, *specs.EtcdBackupStatusSpec]
+
+// EtcdBackupStatusExtension provides auxiliary methods for EtcdBackupStatus resource.
+type EtcdBackupStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (EtcdBackupStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             EtcdBackupStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Status",
+				JSONPath: "{.status}",
+			},
+			{
+				Name:     "Error",
+				JSONPath: "{.error}",
+			},
+			{
+				Name:     "Last Backup",
+				JSONPath: "{.lastbackuptime}",
+			},
+			{
+				Name:     "Last Backup Attempt",
+				JSONPath: "{.lastbackupattempt}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/etcd_manual_backup.go b/client/pkg/omni/resources/omni/etcd_manual_backup.go
new file mode 100644
index 000000000..301b6b874
--- /dev/null
+++ b/client/pkg/omni/resources/omni/etcd_manual_backup.go
@@ -0,0 +1,53 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewEtcdManualBackup creates new etcd manual backup resource.
+func NewEtcdManualBackup(id resource.ID) *EtcdManualBackup {
+	return typed.NewResource[EtcdManualBackupSpec, EtcdManualBackupExtension](
+		resource.NewMetadata(resources.EphemeralNamespace, EtcdManualBackupType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.EtcdManualBackupSpec{}),
+	)
+}
+
+const (
+	// EtcdManualBackupType is the type of the EtcdManualBackup resource.
+	// tsgen:EtcdManualBackupType
+	EtcdManualBackupType = resource.Type("EtcdManualBackups.omni.sidero.dev")
+)
+
+// EtcdManualBackup describes requested etcd manual backup.
+type EtcdManualBackup = typed.Resource[EtcdManualBackupSpec, EtcdManualBackupExtension]
+
+// EtcdManualBackupSpec wraps specs.EtcdManualBackupSpec.
+type EtcdManualBackupSpec = protobuf.ResourceSpec[specs.EtcdManualBackupSpec, *specs.EtcdManualBackupSpec]
+
+// EtcdManualBackupExtension provides auxiliary methods for EtcdManualBackup resource.
+type EtcdManualBackupExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (EtcdManualBackupExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             EtcdManualBackupType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.EphemeralNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Backup At",
+				JSONPath: "{.backupat}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/exposed_service.go b/client/pkg/omni/resources/omni/exposed_service.go
new file mode 100644
index 000000000..a2e69b3c9
--- /dev/null
+++ b/client/pkg/omni/resources/omni/exposed_service.go
@@ -0,0 +1,57 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewExposedService creates new ExposedService resource.
+func NewExposedService(ns string, id resource.ID) *ExposedService {
+	return typed.NewResource[ExposedServiceSpec, ExposedServiceExtension](
+		resource.NewMetadata(ns, ExposedServiceType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ExposedServiceSpec{}),
+	)
+}
+
+const (
+	// ExposedServiceType is the type of the ExposedService resource.
+	// tsgen:ExposedServiceType
+	ExposedServiceType = resource.Type("ExposedServices.omni.sidero.dev")
+)
+
+// ExposedService holds the information about an exposed service for workload cluster proxying feature.
+type ExposedService = typed.Resource[ExposedServiceSpec, ExposedServiceExtension]
+
+// ExposedServiceSpec wraps specs.ExposedServiceSpec.
+type ExposedServiceSpec = protobuf.ResourceSpec[specs.ExposedServiceSpec, *specs.ExposedServiceSpec]
+
+// ExposedServiceExtension provides auxiliary methods for ExposedService resource.
+type ExposedServiceExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ExposedServiceExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ExposedServiceType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Port",
+				JSONPath: "{.port}",
+			},
+			{
+				Name:     "Label",
+				JSONPath: "{.label}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/features_config.go b/client/pkg/omni/resources/omni/features_config.go
new file mode 100644
index 000000000..97f92625b
--- /dev/null
+++ b/client/pkg/omni/resources/omni/features_config.go
@@ -0,0 +1,60 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+const (
+	// FeaturesConfigID is the resource ID under which the features configuration will be written to COSI state.
+	// tsgen:FeaturesConfigID
+	FeaturesConfigID = "features-config"
+)
+
+// NewFeaturesConfig creates new FeaturesConfig state.
+func NewFeaturesConfig(ns string, id resource.ID) *FeaturesConfig {
+	return typed.NewResource[FeaturesConfigSpec, FeaturesConfigExtension](
+		resource.NewMetadata(ns, FeaturesConfigType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.FeaturesConfigSpec{}),
+	)
+}
+
+const (
+	// FeaturesConfigType is the type of FeaturesConfig resource.
+	//
+	// tsgen:FeaturesConfigType
+	FeaturesConfigType = resource.Type("FeaturesConfigs.omni.sidero.dev")
+)
+
+// FeaturesConfig resource describes the features that are enabled in Omni and their configuration.
+type FeaturesConfig = typed.Resource[FeaturesConfigSpec, FeaturesConfigExtension]
+
+// FeaturesConfigSpec wraps specs.FeaturesConfigSpec.
+type FeaturesConfigSpec = protobuf.ResourceSpec[specs.FeaturesConfigSpec, *specs.FeaturesConfigSpec]
+
+// FeaturesConfigExtension providers auxiliary methods for FeaturesConfig resource.
+type FeaturesConfigExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (FeaturesConfigExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             FeaturesConfigType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Workload Proxying",
+				JSONPath: "{.enableworkloadproxying}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/image_pull_request.go b/client/pkg/omni/resources/omni/image_pull_request.go
new file mode 100644
index 000000000..289d07ed1
--- /dev/null
+++ b/client/pkg/omni/resources/omni/image_pull_request.go
@@ -0,0 +1,47 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewImagePullRequest creates a new ImagePullRequest state.
+func NewImagePullRequest(ns, id string) *ImagePullRequest {
+	return typed.NewResource[ImagePullRequestSpec, ImagePullRequestExtension](
+		resource.NewMetadata(ns, ImagePullRequestType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ImagePullRequestSpec{}),
+	)
+}
+
+// ImagePullRequestType is the type of the ImagePullRequest resource.
+//
+// tsgen:ImagePullRequestType
+const ImagePullRequestType = resource.Type("ImagePullRequests.omni.sidero.dev")
+
+// ImagePullRequest resource contains a request to pull a set of container images to a set of nodes.
+type ImagePullRequest = typed.Resource[ImagePullRequestSpec, ImagePullRequestExtension]
+
+// ImagePullRequestSpec wraps specs.ImagePullRequestSpec.
+type ImagePullRequestSpec = protobuf.ResourceSpec[specs.ImagePullRequestSpec, *specs.ImagePullRequestSpec]
+
+// ImagePullRequestExtension providers auxiliary methods for ImagePullRequest resource.
+type ImagePullRequestExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ImagePullRequestExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ImagePullRequestType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/image_pull_status.go b/client/pkg/omni/resources/omni/image_pull_status.go
new file mode 100644
index 000000000..6f3bde18e
--- /dev/null
+++ b/client/pkg/omni/resources/omni/image_pull_status.go
@@ -0,0 +1,72 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewImagePullStatus creates a new ImagePullStatus state.
+func NewImagePullStatus(ns, id string) *ImagePullStatus {
+	return typed.NewResource[ImagePullStatusSpec, ImagePullStatusExtension](
+		resource.NewMetadata(ns, ImagePullStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ImagePullStatusSpec{}),
+	)
+}
+
+// ImagePullStatusType is the type of the ImagePullStatus resource.
+//
+// tsgen:ImagePullStatusType
+const ImagePullStatusType = resource.Type("ImagePullStatuses.omni.sidero.dev")
+
+// ImagePullStatus resource contains a request to pull a set of container images to a set of nodes.
+type ImagePullStatus = typed.Resource[ImagePullStatusSpec, ImagePullStatusExtension]
+
+// ImagePullStatusSpec wraps specs.ImagePullStatusSpec.
+type ImagePullStatusSpec = protobuf.ResourceSpec[specs.ImagePullStatusSpec, *specs.ImagePullStatusSpec]
+
+// ImagePullStatusExtension providers auxiliary methods for ImagePullStatus resource.
+type ImagePullStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ImagePullStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ImagePullStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Processed",
+				JSONPath: "{.processedcount}",
+			},
+			{
+				Name:     "Total",
+				JSONPath: "{.totalcount}",
+			},
+			{
+				Name:     "Last Node",
+				JSONPath: "{.lastprocessednode}",
+			},
+			{
+				Name:     "Last Image",
+				JSONPath: "{.lastprocessedimage}",
+			},
+			{
+				Name:     "Last Error",
+				JSONPath: "{.lastprocessederror}",
+			},
+			{
+				Name:     "Request Version",
+				JSONPath: "{.requestversion}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/installation_media.go b/client/pkg/omni/resources/omni/installation_media.go
new file mode 100644
index 000000000..5d1c86637
--- /dev/null
+++ b/client/pkg/omni/resources/omni/installation_media.go
@@ -0,0 +1,51 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewInstallationMedia creates new InstallationMedia state.
+func NewInstallationMedia(ns, filename string) *InstallationMedia {
+	return typed.NewResource[InstallationMediaSpec, InstallationMediaExtension](
+		resource.NewMetadata(ns, InstallationMediaType, filename, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.InstallationMediaSpec{}),
+	)
+}
+
+const (
+	// InstallationMediaType is the type of InstallationMedia resource.
+	//
+	// tsgen:InstallationMediaType
+	InstallationMediaType = resource.Type("InstallationMedias.omni.sidero.dev")
+)
+
+// InstallationMedia resource describes a Talos installation media that can be generated by the image factory. It also describes the necessary parameters to be passed to the image factory.
+//
+// InstallationMedia resource ID is a human-readable string without white-space that uniquely identifies the installation media.
+type InstallationMedia = typed.Resource[InstallationMediaSpec, InstallationMediaExtension]
+
+// InstallationMediaSpec wraps specs.InstallationMediaSpec.
+type InstallationMediaSpec = protobuf.ResourceSpec[specs.InstallationMediaSpec, *specs.InstallationMediaSpec]
+
+// InstallationMediaExtension providers auxiliary methods for InstallationMedia resource.
+type InstallationMediaExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (InstallationMediaExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             InstallationMediaType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.EphemeralNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/kubeconfig.go b/client/pkg/omni/resources/omni/kubeconfig.go
new file mode 100644
index 000000000..fbc3b8d8f
--- /dev/null
+++ b/client/pkg/omni/resources/omni/kubeconfig.go
@@ -0,0 +1,47 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewKubeconfig creates new Kubeconfig resource.
+func NewKubeconfig(ns resource.Namespace, id resource.ID) *Kubeconfig {
+	return typed.NewResource[KubeconfigSpec, KubeconfigExtension](
+		resource.NewMetadata(ns, KubeconfigType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.KubeconfigSpec{}),
+	)
+}
+
+const (
+	// KubeconfigType is the type of the Kubeconfig resource.
+	KubeconfigType = resource.Type("Kubeconfigs.omni.sidero.dev")
+)
+
+// Kubeconfig describes client config for Kubernetes API.
+type Kubeconfig = typed.Resource[KubeconfigSpec, KubeconfigExtension]
+
+// KubeconfigSpec wraps specs.KubeconfigSpec.
+type KubeconfigSpec = protobuf.ResourceSpec[specs.KubeconfigSpec, *specs.KubeconfigSpec]
+
+// KubeconfigExtension provides auxiliary methods for Kubeconfig resource.
+type KubeconfigExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (KubeconfigExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             KubeconfigType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/kubernetes_status.go b/client/pkg/omni/resources/omni/kubernetes_status.go
new file mode 100644
index 000000000..5654b7164
--- /dev/null
+++ b/client/pkg/omni/resources/omni/kubernetes_status.go
@@ -0,0 +1,47 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewKubernetesStatus creates new Kubernetes component version/readiness state.
+func NewKubernetesStatus(ns, id string) *KubernetesStatus {
+	return typed.NewResource[KubernetesStatusSpec, KubernetesStatusExtension](
+		resource.NewMetadata(ns, KubernetesStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.KubernetesStatusSpec{}),
+	)
+}
+
+// KubernetesStatusType is a resource type that contains the state of Kubernetes components in the cluster.
+//
+// tsgen:KubernetesStatusType
+const KubernetesStatusType = resource.Type("KubernetesStatuses.omni.sidero.dev")
+
+// KubernetesStatus is a resource type that contains the state of Kubernetes components in the cluster.
+type KubernetesStatus = typed.Resource[KubernetesStatusSpec, KubernetesStatusExtension]
+
+// KubernetesStatusSpec wraps specs.KubernetesStatusSpec.
+type KubernetesStatusSpec = protobuf.ResourceSpec[specs.KubernetesStatusSpec, *specs.KubernetesStatusSpec]
+
+// KubernetesStatusExtension providers auxiliary methods for KubernetesStatus resource.
+type KubernetesStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (KubernetesStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             KubernetesStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/kubernetes_upgrade_manifest_status.go b/client/pkg/omni/resources/omni/kubernetes_upgrade_manifest_status.go
new file mode 100644
index 000000000..5ee02b1ee
--- /dev/null
+++ b/client/pkg/omni/resources/omni/kubernetes_upgrade_manifest_status.go
@@ -0,0 +1,47 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewKubernetesUpgradeManifestStatus creates new LoadBalancer state.
+func NewKubernetesUpgradeManifestStatus(ns, id string) *KubernetesUpgradeManifestStatus {
+	return typed.NewResource[KubernetesUpgradeManifestStatusSpec, KubernetesUpgradeManifestStatusExtension](
+		resource.NewMetadata(ns, KubernetesUpgradeManifestStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.KubernetesUpgradeManifestStatusSpec{}),
+	)
+}
+
+// KubernetesUpgradeManifestStatusType is a resource type that contains the configuration of a load balancer.
+//
+// tsgen:KubernetesUpgradeManifestStatusType
+const KubernetesUpgradeManifestStatusType = resource.Type("KubernetesUpgradeManifestStatuses.omni.sidero.dev")
+
+// KubernetesUpgradeManifestStatus is a resource type that contains the configuration of a load balancer.
+type KubernetesUpgradeManifestStatus = typed.Resource[KubernetesUpgradeManifestStatusSpec, KubernetesUpgradeManifestStatusExtension]
+
+// KubernetesUpgradeManifestStatusSpec wraps specs.KubernetesUpgradeManifestStatusSpec.
+type KubernetesUpgradeManifestStatusSpec = protobuf.ResourceSpec[specs.KubernetesUpgradeManifestStatusSpec, *specs.KubernetesUpgradeManifestStatusSpec]
+
+// KubernetesUpgradeManifestStatusExtension providers auxiliary methods for KubernetesUpgradeManifestStatus resource.
+type KubernetesUpgradeManifestStatusExtension struct{}
+
+// ResourceDefinition implements typed.ResourceDefinition interface.
+func (KubernetesUpgradeManifestStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             KubernetesUpgradeManifestStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/kubernetes_upgrade_status.go b/client/pkg/omni/resources/omni/kubernetes_upgrade_status.go
new file mode 100644
index 000000000..53a303fab
--- /dev/null
+++ b/client/pkg/omni/resources/omni/kubernetes_upgrade_status.go
@@ -0,0 +1,47 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewKubernetesUpgradeStatus creates new LoadBalancer state.
+func NewKubernetesUpgradeStatus(ns, id string) *KubernetesUpgradeStatus {
+	return typed.NewResource[KubernetesUpgradeStatusSpec, KubernetesUpgradeStatusExtension](
+		resource.NewMetadata(ns, KubernetesUpgradeStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.KubernetesUpgradeStatusSpec{}),
+	)
+}
+
+// KubernetesUpgradeStatusType is a resource type that contains the configuration of a load balancer.
+//
+// tsgen:KubernetesUpgradeStatusType
+const KubernetesUpgradeStatusType = resource.Type("KubernetesUpgradeStatuses.omni.sidero.dev")
+
+// KubernetesUpgradeStatus is a resource type that contains the configuration of a load balancer.
+type KubernetesUpgradeStatus = typed.Resource[KubernetesUpgradeStatusSpec, KubernetesUpgradeStatusExtension]
+
+// KubernetesUpgradeStatusSpec wraps specs.KubernetesUpgradeStatusSpec.
+type KubernetesUpgradeStatusSpec = protobuf.ResourceSpec[specs.KubernetesUpgradeStatusSpec, *specs.KubernetesUpgradeStatusSpec]
+
+// KubernetesUpgradeStatusExtension providers auxiliary methods for KubernetesUpgradeStatus resource.
+type KubernetesUpgradeStatusExtension struct{}
+
+// ResourceDefinition implements typed.ResourceDefinition interface.
+func (KubernetesUpgradeStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             KubernetesUpgradeStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/kubernetes_version.go b/client/pkg/omni/resources/omni/kubernetes_version.go
new file mode 100644
index 000000000..8ddc459f8
--- /dev/null
+++ b/client/pkg/omni/resources/omni/kubernetes_version.go
@@ -0,0 +1,49 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// KubernetesVersionType is the type of KubernetesVersions resource.
+//
+// tsgen:KubernetesVersionType
+const KubernetesVersionType = resource.Type("KubernetesVersions.omni.sidero.dev")
+
+// KubernetesVersion represents discovered Kubernetes versions to be installed.
+type KubernetesVersion = typed.Resource[KubernetesVersionSpec, KubernetesVersionExtension]
+
+// NewKubernetesVersion creates new KubernetesVersion resource.
+func NewKubernetesVersion(ns resource.Namespace, id resource.ID) *KubernetesVersion {
+	return typed.NewResource[KubernetesVersionSpec, KubernetesVersionExtension](
+		resource.NewMetadata(ns, KubernetesVersionType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(
+			&specs.KubernetesVersionSpec{},
+		),
+	)
+}
+
+// KubernetesVersionExtension provides auxiliary methods for KubernetesVersion.
+type KubernetesVersionExtension struct{}
+
+// KubernetesVersionSpec wraps specs.KubernetesVersionSpec.
+type KubernetesVersionSpec = protobuf.ResourceSpec[specs.KubernetesVersionSpec, *specs.KubernetesVersionSpec]
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (KubernetesVersionExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             KubernetesVersionType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/labels.go b/client/pkg/omni/resources/omni/labels.go
new file mode 100644
index 000000000..3f13622fa
--- /dev/null
+++ b/client/pkg/omni/resources/omni/labels.go
@@ -0,0 +1,149 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package omni provides resources describing the Machines, Clusters, etc.
+package omni
+
+const (
+	// SystemLabelPrefix is the prefix of all labels which are managed by the COSI controllers.
+	// tsgen:SystemLabelPrefix.
+	SystemLabelPrefix = "omni.sidero.dev/"
+)
+
+const (
+	// Global Labels.
+
+	// LabelControlPlaneRole indicates that the machine is a control plane.
+	// tsgen:LabelControlPlaneRole
+	LabelControlPlaneRole = SystemLabelPrefix + "role-controlplane"
+
+	// LabelWorkerRole indicates that the machine is a worker.
+	// tsgen:LabelWorkerRole
+	LabelWorkerRole = SystemLabelPrefix + "role-worker"
+
+	// LabelCluster defines the cluster relation label.
+	// tsgen:LabelCluster
+	LabelCluster = SystemLabelPrefix + LabelSuffixCluster
+
+	// LabelClusterUUID defines the cluster UUID relation label.
+	// tsgen:LabelClusterUUID
+	LabelClusterUUID = SystemLabelPrefix + "cluster-uuid"
+
+	// LabelHostname defines machine hostname.
+	// tsgen:LabelHostname
+	LabelHostname = SystemLabelPrefix + LabelSuffixHostname
+
+	// LabelMachineSet defines the machine set relation label.
+	// tsgen:LabelMachineSet
+	LabelMachineSet = SystemLabelPrefix + "machine-set"
+
+	// LabelClusterMachine defines the cluster machine relation label.
+	// tsgen:LabelClusterMachine
+	LabelClusterMachine = SystemLabelPrefix + "cluster-machine"
+
+	// LabelMachine defines the machine relation label.
+	// tsgen:LabelMachine
+	LabelMachine = SystemLabelPrefix + "machine"
+
+	// LabelSkipTeardown is the test label that configures machine set controller to skip teardown sequence for the cluster machine.
+	LabelSkipTeardown = SystemLabelPrefix + "machine-set-skip-teardown"
+
+	// LabelSystemPatch marks the patch as the system patch, so it shouldn't be editable by the user.
+	// tsgen:LabelSystemPatch
+	LabelSystemPatch = SystemLabelPrefix + "system-patch"
+
+	// LabelExposedServiceAlias is the alias of the exposed service.
+	// tsgen:LabelExposedServiceAlias
+	LabelExposedServiceAlias = SystemLabelPrefix + "exposed-service-alias"
+)
+
+const (
+	// LabelSuffixPlatform is the suffix of the platform label.
+	LabelSuffixPlatform = "platform"
+	// LabelSuffixArch is the suffix of the arch label.
+	LabelSuffixArch = "arch"
+	// LabelSuffixHostname is the suffix of the hostname label.
+	LabelSuffixHostname = "hostname"
+	// LabelSuffixCluster is the suffix of the cluster label.
+	LabelSuffixCluster = "cluster"
+)
+
+const (
+	// MachineStatus labels.
+
+	// MachineStatusLabelConnected is set if the machine is connected.
+	// tsgen:MachineStatusLabelConnected
+	MachineStatusLabelConnected = SystemLabelPrefix + "connected"
+
+	// MachineStatusLabelDisconnected is set if the machine is disconnected.
+	// tsgen:MachineStatusLabelDisconnected
+	MachineStatusLabelDisconnected = SystemLabelPrefix + "disconnected"
+
+	// MachineStatusLabelInvalidState is set if Omni can access Talos apid, but has no access.
+	// tsgen:MachineStatusLabelInvalidState
+	MachineStatusLabelInvalidState = SystemLabelPrefix + "invalid-state"
+
+	// MachineStatusLabelReportingEvents is set if the machine is reporting events.
+	// tsgen:MachineStatusLabelReportingEvents
+	MachineStatusLabelReportingEvents = SystemLabelPrefix + "reporting-events"
+
+	// MachineStatusLabelAvailable is set if the machine is available to be added to a cluster.
+	// tsgen:MachineStatusLabelAvailable
+	MachineStatusLabelAvailable = SystemLabelPrefix + "available"
+
+	// MachineStatusLabelArch describes the machine architecture.
+	// tsgen:MachineStatusLabelArch
+	MachineStatusLabelArch = SystemLabelPrefix + LabelSuffixArch
+
+	// MachineStatusLabelCPU describes the machine CPU.
+	// tsgen:MachineStatusLabelCPU
+	MachineStatusLabelCPU = SystemLabelPrefix + "cpu"
+
+	// MachineStatusLabelCores describes the number of machine cores.
+	// tsgen:MachineStatusLabelCores
+	MachineStatusLabelCores = SystemLabelPrefix + "cores"
+
+	// MachineStatusLabelMem describes the total memory available on the machine.
+	// tsgen:MachineStatusLabelMem
+	MachineStatusLabelMem = SystemLabelPrefix + "mem"
+
+	// MachineStatusLabelStorage describes the total storage capacity of the machine.
+	// tsgen:MachineStatusLabelStorage
+	MachineStatusLabelStorage = SystemLabelPrefix + "storage"
+
+	// MachineStatusLabelNet describes the machine network adapters speed.
+	// tsgen:MachineStatusLabelNet
+	MachineStatusLabelNet = SystemLabelPrefix + "net"
+
+	// MachineStatusLabelPlatform describes the machine platform.
+	// tsgen:MachineStatusLabelPlatform
+	MachineStatusLabelPlatform = SystemLabelPrefix + LabelSuffixPlatform
+
+	// MachineStatusLabelRegion describes the machine region (for machines running in the clouds).
+	// tsgen:MachineStatusLabelRegion
+	MachineStatusLabelRegion = SystemLabelPrefix + "region"
+
+	// MachineStatusLabelZone describes the machine zone (for machines running in the clouds).
+	// tsgen:MachineStatusLabelZone
+	MachineStatusLabelZone = SystemLabelPrefix + "zone"
+
+	// MachineStatusLabelInstance describes the machine instance type (for machines running in the clouds).
+	// tsgen:MachineStatusLabelInstance
+	MachineStatusLabelInstance = SystemLabelPrefix + "instance"
+)
+
+const (
+	// ClusterMachineStatus labels.
+
+	// ClusterMachineStatusLabelNodeName is set to the node name.
+	// tsgen:ClusterMachineStatusLabelNodeName
+	ClusterMachineStatusLabelNodeName = SystemLabelPrefix + "node-name"
+)
+
+const (
+	// Machine labels.
+
+	// MachineAddressLabel is used for faster lookup of the machine by address.
+	MachineAddressLabel = SystemLabelPrefix + "address"
+)
diff --git a/client/pkg/omni/resources/omni/loadbalancer_config.go b/client/pkg/omni/resources/omni/loadbalancer_config.go
new file mode 100644
index 000000000..0f8623138
--- /dev/null
+++ b/client/pkg/omni/resources/omni/loadbalancer_config.go
@@ -0,0 +1,45 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewLoadBalancerConfig creates new LoadBalancer state.
+func NewLoadBalancerConfig(ns, id string) *LoadBalancerConfig {
+	return typed.NewResource[LoadBalancerConfigSpec, LoadBalancerConfigExtension](
+		resource.NewMetadata(ns, LoadBalancerConfigType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.LoadBalancerConfigSpec{}),
+	)
+}
+
+// LoadBalancerConfigType is a resource type that contains the configuration of a load balancer.
+const LoadBalancerConfigType = resource.Type("LoadBalancerConfigs.omni.sidero.dev")
+
+// LoadBalancerConfig is a resource type that contains the configuration of a load balancer.
+type LoadBalancerConfig = typed.Resource[LoadBalancerConfigSpec, LoadBalancerConfigExtension]
+
+// LoadBalancerConfigSpec wraps specs.LoadBalancerConfigSpec.
+type LoadBalancerConfigSpec = protobuf.ResourceSpec[specs.LoadBalancerConfigSpec, *specs.LoadBalancerConfigSpec]
+
+// LoadBalancerConfigExtension providers auxiliary methods for LoadBalancerConfig resource.
+type LoadBalancerConfigExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (LoadBalancerConfigExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             LoadBalancerConfigType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/loadbalancer_status.go b/client/pkg/omni/resources/omni/loadbalancer_status.go
new file mode 100644
index 000000000..55570b166
--- /dev/null
+++ b/client/pkg/omni/resources/omni/loadbalancer_status.go
@@ -0,0 +1,50 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewLoadBalancerStatus creates new LoadBalancerStatus state.
+func NewLoadBalancerStatus(ns, id string) *LoadBalancerStatus {
+	return typed.NewResource[LoadBalancerStatusSpec, LoadBalancerStatusExtension](
+		resource.NewMetadata(ns, LoadBalancerStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.LoadBalancerStatusSpec{}),
+	)
+}
+
+// LoadBalancerStatusType is a resource type that reports the status of a load balancer.
+const LoadBalancerStatusType = resource.Type("LoadBalancerStatuses.omni.sidero.dev")
+
+// LoadBalancerStatus is a resource that reports the status of a load balancer.
+type LoadBalancerStatus = typed.Resource[LoadBalancerStatusSpec, LoadBalancerStatusExtension]
+
+// LoadBalancerStatusSpec wraps specs.LoadBalancerStatusSpec.
+type LoadBalancerStatusSpec = protobuf.ResourceSpec[specs.LoadBalancerStatusSpec, *specs.LoadBalancerStatusSpec]
+
+// LoadBalancerStatusExtension providers auxiliary methods for LoadBalancerStatus resource.
+type LoadBalancerStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (LoadBalancerStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             LoadBalancerStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Healthy",
+				JSONPath: "{.healthy}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/machine.go b/client/pkg/omni/resources/omni/machine.go
new file mode 100644
index 000000000..99440fad1
--- /dev/null
+++ b/client/pkg/omni/resources/omni/machine.go
@@ -0,0 +1,91 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"strconv"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewMachine creates new Machine state.
+func NewMachine(ns, id string) *Machine {
+	return typed.NewResource[MachineSpec, MachineExtension](
+		resource.NewMetadata(ns, MachineType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.MachineSpec{}),
+	)
+}
+
+// MachineType is the type of Machine resource.
+//
+// tsgen:MachineType
+const MachineType = resource.Type("Machines.omni.sidero.dev")
+
+// Machine resource describes connected Talos server (bare-metal, VM, RPi, etc).
+//
+// Machine resource ID is a machine UUID.
+type Machine = typed.Resource[MachineSpec, MachineExtension]
+
+// MachineSpec wraps specs.MachineSpec.
+type MachineSpec = protobuf.ResourceSpec[specs.MachineSpec, *specs.MachineSpec]
+
+// MachineExtension providers auxiliary methods for Machine resource.
+type MachineExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (MachineExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             MachineType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Address",
+				JSONPath: "{.managementaddress}",
+			},
+			{
+				Name:     "Connected",
+				JSONPath: "{.connected}",
+			},
+			{
+				Name:     "Reboots",
+				JSONPath: "{.rebootcount}",
+			},
+		},
+	}
+}
+
+// Make implements [typed.Maker] interface.
+func (MachineExtension) Make(_ *resource.Metadata, spec *MachineSpec) any {
+	return (*machineAux)(spec)
+}
+
+type machineAux MachineSpec
+
+func (m *machineAux) Match(searchFor string) bool {
+	val := m.Value
+
+	return strings.Contains(val.ManagementAddress, searchFor)
+}
+
+func (m *machineAux) Field(fieldName string) (string, bool) {
+	val := m.Value
+
+	switch fieldName {
+	case "management_address":
+		return val.ManagementAddress, true
+	case "connected":
+		return strconv.FormatBool(val.Connected), true
+	default:
+		return "", false
+	}
+}
diff --git a/client/pkg/omni/resources/omni/machine_class.go b/client/pkg/omni/resources/omni/machine_class.go
new file mode 100644
index 000000000..46fd8eb8f
--- /dev/null
+++ b/client/pkg/omni/resources/omni/machine_class.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewMachineClass creates new MachineClass resource.
+func NewMachineClass(ns string, id resource.ID) *MachineClass {
+	return typed.NewResource[MachineClassSpec, MachineClassExtension](
+		resource.NewMetadata(ns, MachineClassType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.MachineClassSpec{}),
+	)
+}
+
+const (
+	// MachineClassType is the type of the MachineClass resource.
+	// tsgen:MachineClassType
+	MachineClassType = resource.Type("MachineClasses.omni.sidero.dev")
+)
+
+// MachineClass describes machine set resource.
+type MachineClass = typed.Resource[MachineClassSpec, MachineClassExtension]
+
+// MachineClassSpec wraps specs.MachineClassSpec.
+type MachineClassSpec = protobuf.ResourceSpec[specs.MachineClassSpec, *specs.MachineClassSpec]
+
+// MachineClassExtension provides auxiliary methods for MachineClass resource.
+type MachineClassExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (MachineClassExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             MachineClassType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/machine_config_gen_options.go b/client/pkg/omni/resources/omni/machine_config_gen_options.go
new file mode 100644
index 000000000..41e689401
--- /dev/null
+++ b/client/pkg/omni/resources/omni/machine_config_gen_options.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewMachineConfigGenOptions creates new MachineConfigGenOptions resource.
+func NewMachineConfigGenOptions(ns string, id resource.ID) *MachineConfigGenOptions {
+	return typed.NewResource[MachineConfigGenOptionsSpec, MachineConfigGenOptionsExtension](
+		resource.NewMetadata(ns, MachineConfigGenOptionsType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.MachineConfigGenOptionsSpec{}),
+	)
+}
+
+const (
+	// MachineConfigGenOptionsType is the type of the MachineConfigGenOptions resource.
+	// tsgen:MachineConfigGenOptionsType
+	MachineConfigGenOptionsType = resource.Type("MachineConfigGenOptions.omni.sidero.dev")
+)
+
+// MachineConfigGenOptions describes machine config resource.
+type MachineConfigGenOptions = typed.Resource[MachineConfigGenOptionsSpec, MachineConfigGenOptionsExtension]
+
+// MachineConfigGenOptionsSpec wraps specs.MachineConfigGenOptionsSpec.
+type MachineConfigGenOptionsSpec = protobuf.ResourceSpec[specs.MachineConfigGenOptionsSpec, *specs.MachineConfigGenOptionsSpec]
+
+// MachineConfigGenOptionsExtension provides auxiliary methods for MachineConfigGenOptions resource.
+type MachineConfigGenOptionsExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (MachineConfigGenOptionsExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             MachineConfigGenOptionsType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/machine_labels.go b/client/pkg/omni/resources/omni/machine_labels.go
new file mode 100644
index 000000000..01ade0767
--- /dev/null
+++ b/client/pkg/omni/resources/omni/machine_labels.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewMachineLabels creates new cluster machine status resource.
+func NewMachineLabels(ns string, id resource.ID) *MachineLabels {
+	return typed.NewResource[MachineLabelsSpec, MachineLabelsExtension](
+		resource.NewMetadata(ns, MachineLabelsType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.MachineLabelsSpec{}),
+	)
+}
+
+const (
+	// MachineLabelsType is the type of the MachineLabels resource.
+	// tsgen:MachineLabelsType
+	MachineLabelsType = resource.Type("MachineLabels.omni.sidero.dev")
+)
+
+// MachineLabels contains the summary for the cluster health, availability, number of nodes.
+type MachineLabels = typed.Resource[MachineLabelsSpec, MachineLabelsExtension]
+
+// MachineLabelsSpec wraps specs.MachineLabelsSpec.
+type MachineLabelsSpec = protobuf.ResourceSpec[specs.MachineLabelsSpec, *specs.MachineLabelsSpec]
+
+// MachineLabelsExtension provides auxiliary methods for MachineLabels resource.
+type MachineLabelsExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (MachineLabelsExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             MachineLabelsType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/machine_set.go b/client/pkg/omni/resources/omni/machine_set.go
new file mode 100644
index 000000000..4de951357
--- /dev/null
+++ b/client/pkg/omni/resources/omni/machine_set.go
@@ -0,0 +1,75 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// ControlPlanesIDSuffix is the suffix for the MachineSet control planes of a cluster.
+//
+// tsgen:ControlPlanesIDSuffix
+const ControlPlanesIDSuffix = "control-planes"
+
+// DefaultWorkersIDSuffix is the suffix for the MachineSet workers of a cluster.
+//
+// tsgen:DefaultWorkersIDSuffix
+const DefaultWorkersIDSuffix = "workers"
+
+// ControlPlanesResourceID returns the name for the MachineSet control planes of a cluster.
+func ControlPlanesResourceID(clusterName string) string {
+	return fmt.Sprintf("%s-%s", clusterName, ControlPlanesIDSuffix)
+}
+
+// WorkersResourceID returns the name for the default MachineSet workers of a cluster.
+func WorkersResourceID(clusterName string) string {
+	return fmt.Sprintf("%s-%s", clusterName, DefaultWorkersIDSuffix)
+}
+
+// AdditionalWorkersResourceID returns the name for the additional MachineSet workers of a cluster.
+func AdditionalWorkersResourceID(clusterName, name string) string {
+	return fmt.Sprintf("%s-%s", clusterName, name)
+}
+
+// NewMachineSet creates new MachineSet resource.
+func NewMachineSet(ns string, id resource.ID) *MachineSet {
+	return typed.NewResource[MachineSetSpec, MachineSetExtension](
+		resource.NewMetadata(ns, MachineSetType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.MachineSetSpec{}),
+	)
+}
+
+const (
+	// MachineSetType is the type of the MachineSet resource.
+	// tsgen:MachineSetType
+	MachineSetType = resource.Type("MachineSets.omni.sidero.dev")
+)
+
+// MachineSet describes machine set resource.
+type MachineSet = typed.Resource[MachineSetSpec, MachineSetExtension]
+
+// MachineSetSpec wraps specs.MachineSetSpec.
+type MachineSetSpec = protobuf.ResourceSpec[specs.MachineSetSpec, *specs.MachineSetSpec]
+
+// MachineSetExtension provides auxiliary methods for MachineSet resource.
+type MachineSetExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (MachineSetExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             MachineSetType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/machine_set_destroy_status.go b/client/pkg/omni/resources/omni/machine_set_destroy_status.go
new file mode 100644
index 000000000..695c9e8a1
--- /dev/null
+++ b/client/pkg/omni/resources/omni/machine_set_destroy_status.go
@@ -0,0 +1,53 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewMachineSetDestroyStatus creates new cluster destroy status.
+func NewMachineSetDestroyStatus(ns string, id resource.ID) *MachineSetDestroyStatus {
+	return typed.NewResource[MachineSetDestroyStatusSpec, MachineSetDestroyStatusExtension](
+		resource.NewMetadata(ns, MachineSetDestroyStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.DestroyStatusSpec{}),
+	)
+}
+
+const (
+	// MachineSetDestroyStatusType is the type of the MachineSetDestroyStatus resource.
+	// tsgen:MachineSetDestroyStatusType
+	MachineSetDestroyStatusType = resource.Type("MachineSetDestroyStatuses.omni.sidero.dev")
+)
+
+// MachineSetDestroyStatus contains the state of machine set destroy for machine tsse in TearingDown phase.
+type MachineSetDestroyStatus = typed.Resource[MachineSetDestroyStatusSpec, MachineSetDestroyStatusExtension]
+
+// MachineSetDestroyStatusSpec wraps specs.MachineSetDestroyStatusSpec.
+type MachineSetDestroyStatusSpec = protobuf.ResourceSpec[specs.DestroyStatusSpec, *specs.DestroyStatusSpec]
+
+// MachineSetDestroyStatusExtension provides auxiliary methods for MachineSetDestroyStatus resource.
+type MachineSetDestroyStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (MachineSetDestroyStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             MachineSetDestroyStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.EphemeralNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Phase",
+				JSONPath: "{.phase}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/machine_set_node.go b/client/pkg/omni/resources/omni/machine_set_node.go
new file mode 100644
index 000000000..4df5391de
--- /dev/null
+++ b/client/pkg/omni/resources/omni/machine_set_node.go
@@ -0,0 +1,68 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewMachineSetNode creates new MachineSetNode resource.
+func NewMachineSetNode(ns string, id resource.ID, owner resource.Resource) *MachineSetNode {
+	// this should never happen, simple sanity check
+	if owner.Metadata().Type() != MachineSetType {
+		panic("the owner of a machine set node must always be a machine set")
+	}
+
+	res := typed.NewResource[MachineSetNodeSpec, MachineSetNodeExtension](
+		resource.NewMetadata(ns, MachineSetNodeType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.MachineSetNodeSpec{}),
+	)
+
+	for _, label := range []string{
+		LabelCluster,
+		LabelControlPlaneRole,
+		LabelWorkerRole,
+	} {
+		val, ok := owner.Metadata().Labels().Get(label)
+		if ok {
+			res.Metadata().Labels().Set(label, val)
+		}
+	}
+
+	res.Metadata().Labels().Set(LabelMachineSet, owner.Metadata().ID())
+
+	return res
+}
+
+const (
+	// MachineSetNodeType is the type of the MachineSetNode resource.
+	// tsgen:MachineSetNodeType
+	MachineSetNodeType = resource.Type("MachineSetNodes.omni.sidero.dev")
+)
+
+// MachineSetNode describes machine set node resource.
+type MachineSetNode = typed.Resource[MachineSetNodeSpec, MachineSetNodeExtension]
+
+// MachineSetNodeSpec wraps specs.MachineSetNodeSpec.
+type MachineSetNodeSpec = protobuf.ResourceSpec[specs.MachineSetNodeSpec, *specs.MachineSetNodeSpec]
+
+// MachineSetNodeExtension provides auxiliary methods for MachineSetNode resource.
+type MachineSetNodeExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (MachineSetNodeExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             MachineSetNodeType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/machine_set_status.go b/client/pkg/omni/resources/omni/machine_set_status.go
new file mode 100644
index 000000000..ebc773717
--- /dev/null
+++ b/client/pkg/omni/resources/omni/machine_set_status.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewMachineSetStatus creates new MachineSetStatus resource.
+func NewMachineSetStatus(ns string, id resource.ID) *MachineSetStatus {
+	return typed.NewResource[MachineSetStatusSpec, MachineSetStatusExtension](
+		resource.NewMetadata(ns, MachineSetStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.MachineSetStatusSpec{}),
+	)
+}
+
+const (
+	// MachineSetStatusType is the type of the MachineSetStatus resource.
+	// tsgen:MachineSetStatusType
+	MachineSetStatusType = resource.Type("MachineSetStatuses.omni.sidero.dev")
+)
+
+// MachineSetStatus describes current machine set status.
+type MachineSetStatus = typed.Resource[MachineSetStatusSpec, MachineSetStatusExtension]
+
+// MachineSetStatusSpec wraps specs.MachineSetStatusSpec.
+type MachineSetStatusSpec = protobuf.ResourceSpec[specs.MachineSetStatusSpec, *specs.MachineSetStatusSpec]
+
+// MachineSetStatusExtension provides auxiliary methods for MachineSetStatus resource.
+type MachineSetStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (MachineSetStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             MachineSetStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/machine_status.go b/client/pkg/omni/resources/omni/machine_status.go
new file mode 100644
index 000000000..ca3d1ec9e
--- /dev/null
+++ b/client/pkg/omni/resources/omni/machine_status.go
@@ -0,0 +1,222 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewMachineStatus creates new MachineStatus state.
+func NewMachineStatus(ns, id string) *MachineStatus {
+	return typed.NewResource[MachineStatusSpec, MachineStatusExtension](
+		resource.NewMetadata(ns, MachineStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.MachineStatusSpec{}),
+	)
+}
+
+// MachineStatusType is the type of MachineStatus resource.
+//
+// tsgen:MachineStatusType
+const MachineStatusType = resource.Type("MachineStatuses.omni.sidero.dev")
+
+// MachineStatus resource contains current information about the Machine.
+//
+// MachineStatus contains node information like hostname,
+//
+// MachineStatus resource ID is a Machine UUID.
+type MachineStatus = typed.Resource[MachineStatusSpec, MachineStatusExtension]
+
+// MachineStatusSpec wraps specs.MachineStatusSpec.
+type MachineStatusSpec = protobuf.ResourceSpec[specs.MachineStatusSpec, *specs.MachineStatusSpec]
+
+// MachineStatusExtension providers auxiliary methods for MachineStatus resource.
+type MachineStatusExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (MachineStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             MachineStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
+
+// Make implements [typed.Maker] interface.
+func (MachineStatusExtension) Make(_ *resource.Metadata, spec *MachineStatusSpec) any {
+	return (*machineStatusAux)(spec)
+}
+
+type machineStatusAux MachineStatusSpec
+
+func (m *machineStatusAux) Match(searchFor string) bool {
+	val := m.Value
+
+	if strings.Contains(val.GetNetwork().GetHostname(), searchFor) ||
+		strings.Contains(val.GetPlatformMetadata().GetHostname(), searchFor) {
+		return true
+	}
+
+	for _, link := range val.GetNetwork().GetNetworkLinks() {
+		if strings.Contains(link.GetHardwareAddress(), searchFor) {
+			return true
+		}
+	}
+
+	return strings.Contains(val.GetCluster(), searchFor)
+}
+
+func (m *machineStatusAux) Field(fieldName string) (string, bool) {
+	val := m.Value
+
+	switch fieldName {
+	case LabelSuffixCluster:
+		return val.GetCluster(), true
+	case LabelSuffixHostname:
+		return val.GetNetwork().GetHostname(), true
+	case LabelSuffixPlatform:
+		return val.GetPlatformMetadata().GetPlatform(), true
+	case LabelSuffixArch:
+		return val.GetHardware().GetArch(), true
+	default:
+		return "", false
+	}
+}
+
+func setLabel(labels *resource.Labels, key string, valueFunc func() string) {
+	if value := valueFunc(); value != "" {
+		labels.Set(key, value)
+	} else {
+		labels.Delete(key)
+	}
+}
+
+// MachineStatusReconcileLabels builds a set of labels based on hardware/meta information.
+func MachineStatusReconcileLabels(machineStatus *MachineStatus) {
+	labels := machineStatus.Metadata().Labels()
+
+	setLabel(labels, MachineStatusLabelCores, func() string {
+		numCores := 0
+
+		for _, cpu := range machineStatus.TypedSpec().Value.GetHardware().GetProcessors() {
+			numCores += int(cpu.GetCoreCount())
+		}
+
+		if numCores > 0 {
+			return strconv.Itoa(numCores)
+		}
+
+		return ""
+	})
+
+	setLabel(labels, MachineStatusLabelCPU, func() string {
+		cpuManufacturer := ""
+
+		for _, cpu := range machineStatus.TypedSpec().Value.GetHardware().GetProcessors() {
+			if cpu.GetManufacturer() != "" {
+				cpuManufacturer = cpu.GetManufacturer()
+			}
+		}
+
+		cpuManufacturer = strings.ToLower(strings.TrimSpace(cpuManufacturer))
+
+		switch {
+		case strings.HasPrefix(cpuManufacturer, "intel"):
+			return "intel"
+		case strings.HasPrefix(cpuManufacturer, "amd"):
+			return "amd"
+		default:
+			return cpuManufacturer
+		}
+	})
+
+	setLabel(labels, MachineStatusLabelArch, func() string {
+		return strings.ToLower(machineStatus.TypedSpec().Value.GetHardware().GetArch())
+	})
+
+	setLabel(labels, MachineStatusLabelMem, func() string {
+		memMB := 0
+
+		for _, mem := range machineStatus.TypedSpec().Value.GetHardware().GetMemoryModules() {
+			memMB += int(mem.GetSizeMb())
+		}
+
+		if memMB >= 1024 {
+			return fmt.Sprintf("%dGiB", memMB/1024)
+		}
+
+		return ""
+	})
+
+	setLabel(labels, MachineStatusLabelStorage, func() string {
+		storageSize := uint64(0)
+
+		for _, blockDevice := range machineStatus.TypedSpec().Value.GetHardware().GetBlockdevices() {
+			storageSize += blockDevice.GetSize()
+		}
+
+		if storageSize >= 1000*1000*1000 {
+			return fmt.Sprintf("%dGB", storageSize/(1000*1000*1000))
+		}
+
+		return ""
+	})
+
+	setLabel(labels, MachineStatusLabelNet, func() string {
+		netMbps := uint64(0)
+
+		for _, net := range machineStatus.TypedSpec().Value.GetNetwork().GetNetworkLinks() {
+			if net.GetSpeedMbps() >= 10 && net.GetSpeedMbps() <= 100000 {
+				netMbps += uint64(net.GetSpeedMbps())
+			}
+		}
+
+		switch {
+		case netMbps >= 1000:
+			return fmt.Sprintf("%dGbps", netMbps/1000)
+		case netMbps > 0:
+			return fmt.Sprintf("%dMbps", netMbps)
+		default:
+			return ""
+		}
+	})
+
+	setLabel(labels, MachineStatusLabelPlatform, func() string {
+		return machineStatus.TypedSpec().Value.PlatformMetadata.GetPlatform()
+	})
+
+	setLabel(labels, MachineStatusLabelRegion, func() string {
+		return machineStatus.TypedSpec().Value.PlatformMetadata.GetRegion()
+	})
+
+	setLabel(labels, MachineStatusLabelZone, func() string {
+		return machineStatus.TypedSpec().Value.PlatformMetadata.GetZone()
+	})
+
+	setLabel(labels, MachineStatusLabelInstance, func() string {
+		return machineStatus.TypedSpec().Value.PlatformMetadata.GetInstanceType()
+	})
+}
+
+// GetMachineStatusSystemDisk looks up a system disk for the Talos machine.
+func GetMachineStatusSystemDisk(res *MachineStatus) string {
+	for _, disk := range res.TypedSpec().Value.Hardware.Blockdevices {
+		if disk.SystemDisk {
+			return disk.LinuxName
+		}
+	}
+
+	return ""
+}
diff --git a/client/pkg/omni/resources/omni/machine_status_link.go b/client/pkg/omni/resources/omni/machine_status_link.go
new file mode 100644
index 000000000..5752498f4
--- /dev/null
+++ b/client/pkg/omni/resources/omni/machine_status_link.go
@@ -0,0 +1,108 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewMachineStatusLink creates new MachineStatusLink resource.
+func NewMachineStatusLink(ns string, id resource.ID) *MachineStatusLink {
+	return typed.NewResource[MachineStatusLinkSpec, MachineStatusLinkExtension](
+		resource.NewMetadata(ns, MachineStatusLinkType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.MachineStatusLinkSpec{}),
+	)
+}
+
+// MachineStatusLink resource contains current information about the [MachineStatus] and [siderolink.LinkCounter] resources.
+type MachineStatusLink = typed.Resource[MachineStatusLinkSpec, MachineStatusLinkExtension]
+
+// MachineStatusLinkSpec wraps specs.MachineStatusLinkSpec.
+type MachineStatusLinkSpec = protobuf.ResourceSpec[specs.MachineStatusLinkSpec, *specs.MachineStatusLinkSpec]
+
+// MachineStatusLinkType is the type of MachineStatusLink resource.
+//
+// tsgen:MachineStatusLinkType
+const MachineStatusLinkType = resource.Type("MachineStatusLinks.omni.sidero.dev")
+
+// MachineStatusLinkExtension providers auxiliary methods for MachineStatusLink resource.
+type MachineStatusLinkExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (MachineStatusLinkExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             MachineStatusLinkType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.MetricsNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Bytes Received",
+				JSONPath: "{.siderolinkcounter.bytesreceived}",
+			},
+			{
+				Name:     "Bytes Sent",
+				JSONPath: "{.siderolinkcounter.bytessent}",
+			},
+			{
+				Name:     "Last Alive",
+				JSONPath: "{.siderolinkcounter.lastalive}",
+			},
+		},
+	}
+}
+
+// Make implements [typed.Maker] interface.
+func (MachineStatusLinkExtension) Make(_ *resource.Metadata, spec *MachineStatusLinkSpec) any {
+	return (*machineStatusLinkAux)(spec)
+}
+
+type machineStatusLinkAux MachineStatusLinkSpec
+
+func (m *machineStatusLinkAux) Match(searchFor string) bool {
+	val := m.Value
+
+	if strings.Contains(val.GetMessageStatus().GetNetwork().GetHostname(), searchFor) ||
+		strings.Contains(val.GetMessageStatus().GetPlatformMetadata().GetHostname(), searchFor) {
+		return true
+	}
+
+	for _, link := range val.GetMessageStatus().GetNetwork().GetNetworkLinks() {
+		if strings.Contains(link.GetHardwareAddress(), searchFor) {
+			return true
+		}
+	}
+
+	return strings.Contains(val.GetMessageStatus().GetCluster(), searchFor)
+}
+
+func (m *machineStatusLinkAux) Field(fieldName string) (string, bool) {
+	val := m.Value
+
+	switch fieldName {
+	case "cluster":
+		return val.GetMessageStatus().GetCluster(), true
+	case "hostname":
+		return val.GetMessageStatus().GetNetwork().GetHostname(), true
+	case "platform":
+		return val.GetMessageStatus().GetPlatformMetadata().GetPlatform(), true
+	case "arch":
+		return val.GetMessageStatus().GetHardware().GetArch(), true
+	case "last_alive":
+		return fmt.Sprintf("%020d", val.GetSiderolinkCounter().GetLastAlive().GetSeconds()), true
+	case "machine_created_at":
+		return fmt.Sprintf("%020d", val.GetMachineCreatedAt()), true
+	default:
+		return "", false
+	}
+}
diff --git a/client/pkg/omni/resources/omni/machine_status_snapshot.go b/client/pkg/omni/resources/omni/machine_status_snapshot.go
new file mode 100644
index 000000000..004733004
--- /dev/null
+++ b/client/pkg/omni/resources/omni/machine_status_snapshot.go
@@ -0,0 +1,49 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewMachineStatusSnapshot creates new MachineStatusSnapshot state.
+func NewMachineStatusSnapshot(ns, id string) *MachineStatusSnapshot {
+	return typed.NewResource[MachineStatusSnapshotSpec, MachineStatusSnapshotExtension](
+		resource.NewMetadata(ns, MachineStatusSnapshotType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.MachineStatusSnapshotSpec{}),
+	)
+}
+
+// MachineStatusSnapshotType is the type of MachineStatusSnapshot resource.
+//
+// tsgen:MachineStatusSnapshotType
+const MachineStatusSnapshotType = resource.Type("MachineStatusSnapshots.omni.sidero.dev")
+
+// MachineStatusSnapshot resource contains snapshot of Talos MachineStatus resource.
+//
+// MachineStatusSnapshot resource ID is a Machine UUID.
+type MachineStatusSnapshot = typed.Resource[MachineStatusSnapshotSpec, MachineStatusSnapshotExtension]
+
+// MachineStatusSnapshotSpec wraps specs.MachineStatusSnapshotSpec.
+type MachineStatusSnapshotSpec = protobuf.ResourceSpec[specs.MachineStatusSnapshotSpec, *specs.MachineStatusSnapshotSpec]
+
+// MachineStatusSnapshotExtension providers auxiliary methods for MachineStatusSnapshot resource.
+type MachineStatusSnapshotExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (MachineStatusSnapshotExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             MachineStatusSnapshotType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/machine_status_test.go b/client/pkg/omni/resources/omni/machine_status_test.go
new file mode 100644
index 000000000..ea23a73c8
--- /dev/null
+++ b/client/pkg/omni/resources/omni/machine_status_test.go
@@ -0,0 +1,169 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni_test
+
+import (
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/runtime"
+)
+
+func TestMachineStatusReconcileLabels(t *testing.T) {
+	t.Parallel()
+
+	for _, test := range []struct { //nolint:govet
+		name string
+		spec *specs.MachineStatusSpec
+		want map[string]string
+	}{
+		{
+			name: "empty",
+			spec: &specs.MachineStatusSpec{},
+		},
+		{
+			name: "full",
+			spec: &specs.MachineStatusSpec{
+				Hardware: &specs.MachineStatusSpec_HardwareStatus{
+					Arch: "amd64",
+					Processors: []*specs.MachineStatusSpec_HardwareStatus_Processor{
+						{
+							Manufacturer: "Intel",
+							CoreCount:    4,
+						},
+						{
+							CoreCount: 2,
+						},
+					},
+					MemoryModules: []*specs.MachineStatusSpec_HardwareStatus_MemoryModule{
+						{
+							SizeMb: 8192,
+						},
+						{
+							SizeMb: 8192,
+						},
+					},
+					Blockdevices: []*specs.MachineStatusSpec_HardwareStatus_BlockDevice{
+						{
+							Size: 1024 * 1024,
+						},
+						{
+							Size: 200 * 1000 * 1000 * 1000,
+						},
+						{
+							Size: 400 * 1000 * 1000 * 1000,
+						},
+					},
+				},
+				Network: &specs.MachineStatusSpec_NetworkStatus{
+					NetworkLinks: []*specs.MachineStatusSpec_NetworkStatus_NetworkLinkStatus{
+						{
+							SpeedMbps: 43333333,
+						},
+						{
+							SpeedMbps: 10 * 1024,
+						},
+						{
+							SpeedMbps: 20 * 1024,
+						},
+					},
+				},
+				PlatformMetadata: &specs.MachineStatusSpec_PlatformMetadata{
+					Platform:     "aws",
+					Region:       "us-east-1",
+					Zone:         "us-east-1a",
+					InstanceType: "c1.small",
+				},
+			},
+			want: map[string]string{
+				omni.MachineStatusLabelArch:     "amd64",
+				omni.MachineStatusLabelCPU:      "intel",
+				omni.MachineStatusLabelCores:    "6",
+				omni.MachineStatusLabelMem:      "16GiB",
+				omni.MachineStatusLabelStorage:  "600GB",
+				omni.MachineStatusLabelNet:      "30Gbps",
+				omni.MachineStatusLabelPlatform: "aws",
+				omni.MachineStatusLabelRegion:   "us-east-1",
+				omni.MachineStatusLabelZone:     "us-east-1a",
+				omni.MachineStatusLabelInstance: "c1.small",
+			},
+		},
+		{
+			name: "full",
+			spec: &specs.MachineStatusSpec{
+				Hardware: &specs.MachineStatusSpec_HardwareStatus{
+					Arch: "amd64",
+					Processors: []*specs.MachineStatusSpec_HardwareStatus_Processor{
+						{
+							Manufacturer: "Intel(R) Corporation",
+							CoreCount:    4,
+						},
+						{
+							Manufacturer: "Intel(R) Corporation",
+							CoreCount:    2,
+						},
+					},
+				},
+				Network: &specs.MachineStatusSpec_NetworkStatus{
+					NetworkLinks: []*specs.MachineStatusSpec_NetworkStatus_NetworkLinkStatus{
+						{
+							SpeedMbps: 1000,
+						},
+					},
+				},
+			},
+			want: map[string]string{
+				omni.MachineStatusLabelArch:  "amd64",
+				omni.MachineStatusLabelCores: "6",
+				omni.MachineStatusLabelCPU:   "intel",
+				omni.MachineStatusLabelNet:   "1Gbps",
+			},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			ms := omni.NewMachineStatus("", "")
+
+			ms.TypedSpec().Value = test.spec
+
+			omni.MachineStatusReconcileLabels(ms)
+
+			assert.Equal(t, test.want, ms.Metadata().Labels().Raw())
+		})
+	}
+}
+
+func TestLookup(t *testing.T) {
+	ms := omni.NewMachineStatus("", "")
+	ms.TypedSpec().Value = &specs.MachineStatusSpec{
+		Cluster: "random-cluster",
+		PlatformMetadata: &specs.MachineStatusSpec_PlatformMetadata{
+			Platform: "aws",
+			Hostname: "myhostname",
+			Region:   "us-west",
+		},
+		Network: &specs.MachineStatusSpec_NetworkStatus{
+			Hostname: "my-network-hostname",
+			NetworkLinks: []*specs.MachineStatusSpec_NetworkStatus_NetworkLinkStatus{
+				{
+					HardwareAddress: "f2:64:e7:e0:0b:12",
+				},
+			},
+		},
+	}
+
+	ext, ok := typed.LookupExtension[runtime.Matcher](ms)
+	assert.True(t, ok)
+	assert.True(t, ext.Match("random-cluster"))
+	assert.True(t, ext.Match("myhostname"))
+	assert.True(t, ext.Match("my-network-hostname"))
+	assert.True(t, ext.Match("f2:64:e7:e0:0b:12"))
+	assert.False(t, ext.Match("random-cluster-2"))
+}
diff --git a/client/pkg/omni/resources/omni/omni.go b/client/pkg/omni/resources/omni/omni.go
new file mode 100644
index 000000000..d1c97da67
--- /dev/null
+++ b/client/pkg/omni/resources/omni/omni.go
@@ -0,0 +1,70 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package omni provides resources describing the Machines, Clusters, etc.
+package omni
+
+import "github.com/siderolabs/omni/client/pkg/omni/resources/registry"
+
+func init() {
+	registry.MustRegisterResource(ClusterBootstrapStatusType, &ClusterBootstrapStatus{})
+	registry.MustRegisterResource(ClusterConfigVersionType, &ClusterConfigVersion{})
+	registry.MustRegisterResource(ClusterEndpointType, &ClusterEndpoint{})
+	registry.MustRegisterResource(ClusterDestroyStatusType, &ClusterDestroyStatus{})
+	registry.MustRegisterResource(ClusterType, &Cluster{})
+	registry.MustRegisterResource(ClusterUUIDType, &ClusterUUID{})
+	registry.MustRegisterResource(ClusterSecretsType, &ClusterSecrets{})
+	registry.MustRegisterResource(ClusterStatusType, &ClusterStatus{})
+	registry.MustRegisterResource(ClusterMachineType, &ClusterMachine{})
+	registry.MustRegisterResource(ClusterMachineEncryptionKeyType, &ClusterMachineEncryptionKey{})
+	registry.MustRegisterResource(ClusterMachineIdentityType, &ClusterMachineIdentity{})
+	registry.MustRegisterResource(ClusterMachineStatusType, &ClusterMachineStatus{})
+	registry.MustRegisterResource(ClusterMachineConfigType, &ClusterMachineConfig{})
+	registry.MustRegisterResource(ClusterMachineConfigPatchesType, &ClusterMachineConfigPatches{})
+	registry.MustRegisterResource(ClusterMachineConfigStatusType, &ClusterMachineConfigStatus{})
+	registry.MustRegisterResource(ClusterMachineTalosVersionType, &ClusterMachineTalosVersion{})
+	registry.MustRegisterResource(ClusterMachineTemplateType, &ClusterMachineTemplate{})
+	registry.MustRegisterResource(ConfigPatchType, &ConfigPatch{})
+	registry.MustRegisterResource(EtcdAuditResultType, &EtcdAuditResult{})
+	registry.MustRegisterResource(EtcdBackupType, &EtcdBackup{})
+	registry.MustRegisterResource(EtcdBackupS3ConfType, &EtcdBackupS3Conf{})
+	registry.MustRegisterResource(EtcdBackupEncryptionType, &EtcdBackupEncryption{})
+	registry.MustRegisterResource(EtcdBackupStatusType, &EtcdBackupStatus{})
+	registry.MustRegisterResource(EtcdBackupOverallStatusType, &EtcdBackupOverallStatus{})
+	registry.MustRegisterResource(EtcdBackupStoreStatusType, &EtcdBackupStoreStatus{})
+	registry.MustRegisterResource(BackupDataType, &BackupData{})
+	registry.MustRegisterResource(EtcdManualBackupType, &EtcdManualBackup{})
+	registry.MustRegisterResource(ExposedServiceType, &ExposedService{})
+	registry.MustRegisterResource(FeaturesConfigType, &FeaturesConfig{})
+	registry.MustRegisterResource(ImagePullRequestType, &ImagePullRequest{})
+	registry.MustRegisterResource(ImagePullStatusType, &ImagePullStatus{})
+	registry.MustRegisterResource(InstallationMediaType, &InstallationMedia{})
+	registry.MustRegisterResource(ControlPlaneStatusType, &ControlPlaneStatus{})
+	registry.MustRegisterResource(KubeconfigType, &Kubeconfig{})
+	registry.MustRegisterResource(KubernetesStatusType, &KubernetesStatus{})
+	registry.MustRegisterResource(KubernetesUpgradeManifestStatusType, &KubernetesUpgradeManifestStatus{})
+	registry.MustRegisterResource(KubernetesUpgradeStatusType, &KubernetesUpgradeStatus{})
+	registry.MustRegisterResource(KubernetesVersionType, &KubernetesVersion{})
+	registry.MustRegisterResource(MachineLabelsType, &MachineLabels{})
+	registry.MustRegisterResource(MachineType, &Machine{})
+	registry.MustRegisterResource(MachineClassType, &MachineClass{})
+	registry.MustRegisterResource(MachineConfigGenOptionsType, &MachineConfigGenOptions{})
+	registry.MustRegisterResource(MachineSetType, &MachineSet{})
+	registry.MustRegisterResource(MachineSetDestroyStatusType, &MachineSetDestroyStatus{})
+	registry.MustRegisterResource(MachineSetNodeType, &MachineSetNode{})
+	registry.MustRegisterResource(MachineSetStatusType, &MachineSetStatus{})
+	registry.MustRegisterResource(MachineStatusType, &MachineStatus{})
+	registry.MustRegisterResource(MachineStatusSnapshotType, &MachineStatusSnapshot{})
+	registry.MustRegisterResource(MachineStatusLinkType, &MachineStatusLink{})
+	registry.MustRegisterResource(LoadBalancerConfigType, &LoadBalancerConfig{})
+	registry.MustRegisterResource(LoadBalancerStatusType, &LoadBalancerStatus{})
+	registry.MustRegisterResource(OngoingTaskType, &OngoingTask{})
+	registry.MustRegisterResource(RedactedClusterMachineConfigType, &RedactedClusterMachineConfig{})
+	registry.MustRegisterResource(SchematicType, &Schematic{})
+	registry.MustRegisterResource(SchematicConfigurationType, &SchematicConfiguration{})
+	registry.MustRegisterResource(TalosConfigType, &TalosConfig{})
+	registry.MustRegisterResource(TalosExtensionsType, &TalosExtensions{})
+	registry.MustRegisterResource(TalosVersionType, &TalosVersion{})
+	registry.MustRegisterResource(TalosUpgradeStatusType, &TalosUpgradeStatus{})
+}
diff --git a/client/pkg/omni/resources/omni/ongoing_task.go b/client/pkg/omni/resources/omni/ongoing_task.go
new file mode 100644
index 000000000..b1b92775f
--- /dev/null
+++ b/client/pkg/omni/resources/omni/ongoing_task.go
@@ -0,0 +1,52 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewOngoingTask creates new OngoingTask state.
+func NewOngoingTask(ns, id string) *OngoingTask {
+	return typed.NewResource[OngoingTaskSpec, OngoingTaskExtension](
+		resource.NewMetadata(ns, OngoingTaskType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.OngoingTaskSpec{}),
+	)
+}
+
+// OngoingTaskType is the type of OngoingTask resource.
+//
+// tsgen:OngoingTaskType
+const OngoingTaskType = resource.Type("OngoingTasks.omni.sidero.dev")
+
+// OngoingTask resource describes an ongoing background task.
+type OngoingTask = typed.Resource[OngoingTaskSpec, OngoingTaskExtension]
+
+// OngoingTaskSpec wraps specs.OngoingTaskSpec.
+type OngoingTaskSpec = protobuf.ResourceSpec[specs.OngoingTaskSpec, *specs.OngoingTaskSpec]
+
+// OngoingTaskExtension providers auxiliary methods for OngoingTask resource.
+type OngoingTaskExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (OngoingTaskExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             OngoingTaskType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Title",
+				JSONPath: "{.title}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/redacted_cluster_machine_config.go b/client/pkg/omni/resources/omni/redacted_cluster_machine_config.go
new file mode 100644
index 000000000..45560cc41
--- /dev/null
+++ b/client/pkg/omni/resources/omni/redacted_cluster_machine_config.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewRedactedClusterMachineConfig creates new redacted cluster machine config resource.
+func NewRedactedClusterMachineConfig(ns string, id resource.ID) *RedactedClusterMachineConfig {
+	return typed.NewResource[RedactedClusterMachineConfigSpec, RedactedClusterMachineConfigExtension](
+		resource.NewMetadata(ns, RedactedClusterMachineConfigType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.RedactedClusterMachineConfigSpec{}),
+	)
+}
+
+const (
+	// RedactedClusterMachineConfigType is the type of the RedactedClusterMachineConfig resource.
+	// tsgen:RedactedClusterMachineConfigType
+	RedactedClusterMachineConfigType = resource.Type("RedactedClusterMachineConfigs.omni.sidero.dev")
+)
+
+// RedactedClusterMachineConfig is the redacted version of the final machine config.
+type RedactedClusterMachineConfig = typed.Resource[RedactedClusterMachineConfigSpec, RedactedClusterMachineConfigExtension]
+
+// RedactedClusterMachineConfigSpec wraps specs.RedactedClusterMachineConfigSpec.
+type RedactedClusterMachineConfigSpec = protobuf.ResourceSpec[specs.RedactedClusterMachineConfigSpec, *specs.RedactedClusterMachineConfigSpec]
+
+// RedactedClusterMachineConfigExtension provides auxiliary methods for RedactedClusterMachineConfig resource.
+type RedactedClusterMachineConfigExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (RedactedClusterMachineConfigExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             RedactedClusterMachineConfigType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/schematic.go b/client/pkg/omni/resources/omni/schematic.go
new file mode 100644
index 000000000..ba329e5f1
--- /dev/null
+++ b/client/pkg/omni/resources/omni/schematic.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewSchematic creates new schematic resource.
+func NewSchematic(ns string, id resource.ID) *Schematic {
+	return typed.NewResource[SchematicSpec, SchematicExtension](
+		resource.NewMetadata(ns, SchematicType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.SchematicSpec{}),
+	)
+}
+
+const (
+	// SchematicType is the type of the Schematic resource.
+	// tsgen:SchematicType
+	SchematicType = resource.Type("Schematics.omni.sidero.dev")
+)
+
+// Schematic describes previosly generated image factory schematic.
+type Schematic = typed.Resource[SchematicSpec, SchematicExtension]
+
+// SchematicSpec wraps specs.SchematicSpec.
+type SchematicSpec = protobuf.ResourceSpec[specs.SchematicSpec, *specs.SchematicSpec]
+
+// SchematicExtension provides auxiliary methods for Schematic resource.
+type SchematicExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (SchematicExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             SchematicType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/schematic_configuration.go b/client/pkg/omni/resources/omni/schematic_configuration.go
new file mode 100644
index 000000000..4a0bc8a95
--- /dev/null
+++ b/client/pkg/omni/resources/omni/schematic_configuration.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewSchematicConfiguration creates new schematic configuration resource.
+func NewSchematicConfiguration(ns string, id resource.ID) *SchematicConfiguration {
+	return typed.NewResource[SchematicConfigurationSpec, SchematicConfigurationExtension](
+		resource.NewMetadata(ns, SchematicConfigurationType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.SchematicConfigurationSpec{}),
+	)
+}
+
+const (
+	// SchematicConfigurationType is the type of the SchematicConfiguration resource.
+	// tsgen:SchematicConfigurationType
+	SchematicConfigurationType = resource.Type("SchematicConfigurations.omni.sidero.dev")
+)
+
+// SchematicConfiguration describes desired machine schematic for the particular machine, machine set or cluster.
+type SchematicConfiguration = typed.Resource[SchematicConfigurationSpec, SchematicConfigurationExtension]
+
+// SchematicConfigurationSpec wraps specs.SchematicConfigurationSpec.
+type SchematicConfigurationSpec = protobuf.ResourceSpec[specs.SchematicConfigurationSpec, *specs.SchematicConfigurationSpec]
+
+// SchematicConfigurationExtension provides auxiliary methods for SchematicConfiguration resource.
+type SchematicConfigurationExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (SchematicConfigurationExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             SchematicConfigurationType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/secrets.go b/client/pkg/omni/resources/omni/secrets.go
new file mode 100644
index 000000000..ba972d6c6
--- /dev/null
+++ b/client/pkg/omni/resources/omni/secrets.go
@@ -0,0 +1,67 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"encoding/json"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+	"github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterSecrets creates new ClusterSecrets state.
+func NewClusterSecrets(ns string, id resource.ID) *ClusterSecrets {
+	return typed.NewResource[ClusterSecretsSpec, ClusterSecretsExtension](
+		resource.NewMetadata(ns, ClusterSecretsType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterSecretsSpec{}),
+	)
+}
+
+// ClusterSecretsType is the type of ClusterSecrets resource.
+//
+// tsgen:ClusterSecretsType
+const ClusterSecretsType = resource.Type("ClusterSecrets.omni.sidero.dev")
+
+// ClusterSecrets resource describes cluster secrets.
+//
+// ClusterSecrets resource ID is a cluster ID.
+type ClusterSecrets = typed.Resource[ClusterSecretsSpec, ClusterSecretsExtension]
+
+// ClusterSecretsSpec wraps specs.ClusterSecretsSpec.
+type ClusterSecretsSpec = protobuf.ResourceSpec[specs.ClusterSecretsSpec, *specs.ClusterSecretsSpec]
+
+// ClusterSecretsExtension providers auxiliary methods for ClusterSecrets resource.
+type ClusterSecretsExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterSecretsExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterSecretsType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
+
+// ToSecretsBundle decodes the resource into generate.SecretsBundle resource.
+func ToSecretsBundle(clusterSecrets *ClusterSecrets) (*secrets.Bundle, error) {
+	secretBundle := &secrets.Bundle{}
+
+	err := json.Unmarshal(clusterSecrets.TypedSpec().Value.Data, secretBundle)
+	if err != nil {
+		return nil, err
+	}
+
+	secretBundle.Clock = secrets.NewFixedClock(time.Now())
+
+	return secretBundle, err
+}
diff --git a/client/pkg/omni/resources/omni/talos_extensions.go b/client/pkg/omni/resources/omni/talos_extensions.go
new file mode 100644
index 000000000..33c445923
--- /dev/null
+++ b/client/pkg/omni/resources/omni/talos_extensions.go
@@ -0,0 +1,47 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewTalosExtensions creates new Kubernetes component version/readiness state.
+func NewTalosExtensions(ns, id string) *TalosExtensions {
+	return typed.NewResource[TalosExtensionsSpec, TalosExtensionsExtension](
+		resource.NewMetadata(ns, TalosExtensionsType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.TalosExtensionsSpec{}),
+	)
+}
+
+// TalosExtensionsType is resource type that contains all available extensions for a Talos version.
+//
+// tsgen:TalosExtensionsType
+const TalosExtensionsType = resource.Type("TalosExtensions.omni.sidero.dev")
+
+// TalosExtensions is resource type that contains all available extensions for a Talos version.
+type TalosExtensions = typed.Resource[TalosExtensionsSpec, TalosExtensionsExtension]
+
+// TalosExtensionsSpec wraps specs.TalosExtensionsSpec.
+type TalosExtensionsSpec = protobuf.ResourceSpec[specs.TalosExtensionsSpec, *specs.TalosExtensionsSpec]
+
+// TalosExtensionsExtension providers auxiliary methods for TalosExtensions resource.
+type TalosExtensionsExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (TalosExtensionsExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             TalosExtensionsType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/talos_upgrade_status.go b/client/pkg/omni/resources/omni/talos_upgrade_status.go
new file mode 100644
index 000000000..cbdeb989f
--- /dev/null
+++ b/client/pkg/omni/resources/omni/talos_upgrade_status.go
@@ -0,0 +1,47 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewTalosUpgradeStatus creates new LoadBalancer state.
+func NewTalosUpgradeStatus(ns, id string) *TalosUpgradeStatus {
+	return typed.NewResource[TalosUpgradeStatusSpec, TalosUpgradeStatusExtension](
+		resource.NewMetadata(ns, TalosUpgradeStatusType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.TalosUpgradeStatusSpec{}),
+	)
+}
+
+// TalosUpgradeStatusType is a resource type that contains the current state of the machine set Talos upgrade.
+//
+// tsgen:TalosUpgradeStatusType
+const TalosUpgradeStatusType = resource.Type("TalosUpgradeStatuses.omni.sidero.dev")
+
+// TalosUpgradeStatus is a resource type that contains the configuration of a load balancer.
+type TalosUpgradeStatus = typed.Resource[TalosUpgradeStatusSpec, TalosUpgradeStatusExtension]
+
+// TalosUpgradeStatusSpec wraps specs.TalosUpgradeStatusSpec.
+type TalosUpgradeStatusSpec = protobuf.ResourceSpec[specs.TalosUpgradeStatusSpec, *specs.TalosUpgradeStatusSpec]
+
+// TalosUpgradeStatusExtension providers auxiliary methods for TalosUpgradeStatus resource.
+type TalosUpgradeStatusExtension struct{}
+
+// ResourceDefinition implements typed.ResourceDefinition interface.
+func (TalosUpgradeStatusExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             TalosUpgradeStatusType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/talos_version.go b/client/pkg/omni/resources/omni/talos_version.go
new file mode 100644
index 000000000..08246af3d
--- /dev/null
+++ b/client/pkg/omni/resources/omni/talos_version.go
@@ -0,0 +1,53 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewTalosVersion creates new cluster resource.
+func NewTalosVersion(ns string, id resource.ID) *TalosVersion {
+	return typed.NewResource[TalosVersionSpec, TalosVersionExtension](
+		resource.NewMetadata(ns, TalosVersionType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.TalosVersionSpec{}),
+	)
+}
+
+const (
+	// TalosVersionType is the type of the TalosVersion resource.
+	// tsgen:TalosVersionType
+	TalosVersionType = resource.Type("TalosVersions.omni.sidero.dev")
+)
+
+// TalosVersion describes available Talos version.
+type TalosVersion = typed.Resource[TalosVersionSpec, TalosVersionExtension]
+
+// TalosVersionSpec wraps specs.TalosVersionSpec.
+type TalosVersionSpec = protobuf.ResourceSpec[specs.TalosVersionSpec, *specs.TalosVersionSpec]
+
+// TalosVersionExtension provides auxiliary methods for TalosVersion resource.
+type TalosVersionExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (TalosVersionExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             TalosVersionType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Kubernetes Versions",
+				JSONPath: "{.compatiblekubernetesversions}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/omni/talosconfig.go b/client/pkg/omni/resources/omni/talosconfig.go
new file mode 100644
index 000000000..f2f791aa8
--- /dev/null
+++ b/client/pkg/omni/resources/omni/talosconfig.go
@@ -0,0 +1,67 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+	clientconfig "github.com/siderolabs/talos/pkg/machinery/client/config"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewTalosConfig creates new Talos config resource.
+func NewTalosConfig(ns resource.Namespace, id resource.ID) *TalosConfig {
+	return typed.NewResource[TalosConfigSpec, TalosConfigExtension](
+		resource.NewMetadata(ns, TalosConfigType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.TalosConfigSpec{}),
+	)
+}
+
+const (
+	// TalosConfigType is the type of the TalosConfig resource.
+	TalosConfigType = resource.Type("TalosConfigs.omni.sidero.dev")
+)
+
+// TalosConfig describes client config for Talos API.
+type TalosConfig = typed.Resource[TalosConfigSpec, TalosConfigExtension]
+
+// TalosConfigSpec wraps specs.TalosConfigSpec.
+type TalosConfigSpec = protobuf.ResourceSpec[specs.TalosConfigSpec, *specs.TalosConfigSpec]
+
+// TalosConfigExtension provides auxiliary methods for TalosConfig resource.
+type TalosConfigExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (TalosConfigExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             TalosConfigType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
+
+// NewTalosClientConfig creates talos config.Config from TalosConfig resource.
+func NewTalosClientConfig(in *TalosConfig, endpoints ...string) *clientconfig.Config {
+	spec := in.TypedSpec().Value
+
+	config := &clientconfig.Config{
+		Context: in.Metadata().ID(),
+		Contexts: map[string]*clientconfig.Context{
+			in.Metadata().ID(): {
+				Endpoints: endpoints,
+				CA:        spec.Ca,
+				Crt:       spec.Crt,
+				Key:       spec.Key,
+			},
+		},
+	}
+
+	return config
+}
diff --git a/client/pkg/omni/resources/registry/registry.go b/client/pkg/omni/resources/registry/registry.go
new file mode 100644
index 000000000..8fad61795
--- /dev/null
+++ b/client/pkg/omni/resources/registry/registry.go
@@ -0,0 +1,34 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package registry specifies the list of resources to be registered in the state.
+package registry
+
+import (
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller/generic"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+)
+
+// Resources defines all resources added to the resource definitions.
+var Resources []generic.ResourceWithRD
+
+// MustRegisterResource adds resource to the registry, registers it's protobuf decoders/encoders.
+func MustRegisterResource[T any, R interface {
+	protobuf.Res[T]
+	meta.ResourceDefinitionProvider
+}](
+	resourceType resource.Type,
+	r R,
+) {
+	Resources = append(Resources, r)
+
+	err := protobuf.RegisterResource(resourceType, r)
+	if err != nil {
+		panic(fmt.Errorf("failed to register resource %T: %w", r, err))
+	}
+}
diff --git a/client/pkg/omni/resources/resources.go b/client/pkg/omni/resources/resources.go
new file mode 100644
index 000000000..1e9beb1ec
--- /dev/null
+++ b/client/pkg/omni/resources/resources.go
@@ -0,0 +1,44 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package resources defines various internal Omni resources.
+package resources
+
+import "github.com/cosi-project/runtime/pkg/resource"
+
+// DefaultNamespace is the default namespace for all resources.
+//
+// DefaultNamespace has persistence enabled.
+//
+// tsgen:DefaultNamespace
+const DefaultNamespace resource.Namespace = "default"
+
+// EphemeralNamespace is the namespace for resources which are not persisted.
+//
+// EphemeralNamespace has no persistence.
+//
+// tsgen:EphemeralNamespace
+const EphemeralNamespace resource.Namespace = "ephemeral"
+
+// MetricsNamespace is the namespace for resources that store metrics, such as counters.
+// It is backed by the secondary storage which is optimized for frequently updated data and has relaxed consistency guarantees.
+//
+// tsgen:MetricsNamespace
+const MetricsNamespace resource.Namespace = "metrics"
+
+// VirtualNamespace is the namespace where resources are virtual (synthetic),
+// i.e. they behave like resources but not actual resources. For example, a resource whose contents change
+// based on the requester user's identity.
+//
+// VirtualNamespace has no persistence.
+//
+// tsgen:VirtualNamespace
+const VirtualNamespace resource.Namespace = "virtual"
+
+// ExternalNamespace is the namespace where resources are external
+//
+// ExternalNamespace has no persistence.
+//
+// tsgen:ExternalNamespace
+const ExternalNamespace resource.Namespace = "external"
diff --git a/client/pkg/omni/resources/siderolink/config.go b/client/pkg/omni/resources/siderolink/config.go
new file mode 100644
index 000000000..e04d27432
--- /dev/null
+++ b/client/pkg/omni/resources/siderolink/config.go
@@ -0,0 +1,55 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package siderolink
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+)
+
+const (
+	// ConfigType is the type of Config resource.
+	//
+	// tsgen:ConfigType
+	ConfigType = resource.Type("Configs.omni.sidero.dev")
+	// ConfigID is the config resource name.
+	//
+	// tsgen:ConfigID
+	ConfigID = resource.ID("siderolink-config")
+)
+
+// NewConfig creates new Config resource.
+func NewConfig(ns string) *Config {
+	return typed.NewResource[ConfigSpec, ConfigExtension](
+		resource.NewMetadata(ns, ConfigType, ConfigID, resource.VersionUndefined),
+		protobuf.NewResourceSpec(
+			&specs.SiderolinkConfigSpec{},
+		),
+	)
+}
+
+// Config resource keeps connected nodes state.
+type Config = typed.Resource[ConfigSpec, ConfigExtension]
+
+// ConfigSpec wraps specs.SiderolinkConfigSpec.
+type ConfigSpec = protobuf.ResourceSpec[specs.SiderolinkConfigSpec, *specs.SiderolinkConfigSpec]
+
+// ConfigExtension providers auxiliary methods for Config resource.
+type ConfigExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ConfigExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ConfigType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: Namespace,
+		PrintColumns:     []meta.PrintColumn{},
+		Sensitivity:      meta.Sensitive,
+	}
+}
diff --git a/client/pkg/omni/resources/siderolink/connection_params.go b/client/pkg/omni/resources/siderolink/connection_params.go
new file mode 100644
index 000000000..0b326a452
--- /dev/null
+++ b/client/pkg/omni/resources/siderolink/connection_params.go
@@ -0,0 +1,61 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package siderolink
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+)
+
+// NewConnectionParams creates new ConnectionParams state.
+func NewConnectionParams(ns, id string) *ConnectionParams {
+	return typed.NewResource[ConnectionParamsSpec, ConnectionParamsExtension](
+		resource.NewMetadata(ns, ConnectionParamsType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ConnectionParamsSpec{}),
+	)
+}
+
+// ConnectionParamsType is the type of ConnectionParams resource.
+//
+// tsgen:ConnectionParamsType
+const ConnectionParamsType = resource.Type("ConnectionParams.omni.sidero.dev")
+
+// ConnectionParams resource keeps generated kernel arguments as a resource.
+//
+// ConnectionParams resource ID is a machine UUID.
+type ConnectionParams = typed.Resource[ConnectionParamsSpec, ConnectionParamsExtension]
+
+// ConnectionParamsSpec wraps specs.ConnectionParamsSpec.
+type ConnectionParamsSpec = protobuf.ResourceSpec[specs.ConnectionParamsSpec, *specs.ConnectionParamsSpec]
+
+// ConnectionParamsExtension providers auxiliary methods for ConnectionParams resource.
+type ConnectionParamsExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ConnectionParamsExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ConnectionParamsType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: Namespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "JoinToken",
+				JSONPath: "{.jointoken}",
+			},
+			{
+				Name:     "API",
+				JSONPath: "{.apiendpoint}",
+			},
+			{
+				Name:     "Wireguard",
+				JSONPath: "{.wireguardendpoint}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/siderolink/link.go b/client/pkg/omni/resources/siderolink/link.go
new file mode 100644
index 000000000..e007812d6
--- /dev/null
+++ b/client/pkg/omni/resources/siderolink/link.go
@@ -0,0 +1,57 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package siderolink
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+)
+
+// NewLink creates new Link state.
+func NewLink(ns, id string, spec *specs.SiderolinkSpec) *Link {
+	return typed.NewResource[LinkSpec, LinkExtension](
+		resource.NewMetadata(ns, LinkType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(spec),
+	)
+}
+
+// LinkType is the type of Link resource.
+//
+// tsgen:SiderolinkResourceType
+const LinkType = resource.Type("Links.omni.sidero.dev")
+
+// Link resource keeps connected nodes state.
+//
+// Link resource ID is a machine UUID.
+type Link = typed.Resource[LinkSpec, LinkExtension]
+
+// LinkSpec wraps specs.SiderolinkSpec.
+type LinkSpec = protobuf.ResourceSpec[specs.SiderolinkSpec, *specs.SiderolinkSpec]
+
+// LinkExtension providers auxiliary methods for Link resource.
+type LinkExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (LinkExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             LinkType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: Namespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Connected",
+				JSONPath: "{.connected}",
+			},
+			{
+				Name:     "LastEndpoint",
+				JSONPath: "{.lastendpoint}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/siderolink/linkcounter.go b/client/pkg/omni/resources/siderolink/linkcounter.go
new file mode 100644
index 000000000..615f4334f
--- /dev/null
+++ b/client/pkg/omni/resources/siderolink/linkcounter.go
@@ -0,0 +1,55 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package siderolink
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+)
+
+// NOTE: This resources is not used anymore, but still used in the migration code.
+
+// NewDeprecatedLinkCounter creates new LinkCounter state.
+func NewDeprecatedLinkCounter(ns, id string) *DeprecatedLinkCounter {
+	return typed.NewResource[DeprecatedLinkCounterSpec, DeprecatedLinkCounterExtension](
+		resource.NewMetadata(ns, DeprecatedLinkCounterType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.SiderolinkCounterSpec{}),
+	)
+}
+
+// DeprecatedLinkCounterType is the type of LinkCounter resource.
+const DeprecatedLinkCounterType = resource.Type("LinkCounters.omni.sidero.dev")
+
+// DeprecatedLinkCounter resource was removed, but still used only in the migration code.
+type DeprecatedLinkCounter = typed.Resource[DeprecatedLinkCounterSpec, DeprecatedLinkCounterExtension]
+
+// DeprecatedLinkCounterSpec wraps specs.SiderolinkSpec.
+type DeprecatedLinkCounterSpec = protobuf.ResourceSpec[specs.SiderolinkCounterSpec, *specs.SiderolinkCounterSpec]
+
+// DeprecatedLinkCounterExtension providers auxiliary methods for LinkCounter resource.
+type DeprecatedLinkCounterExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (DeprecatedLinkCounterExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             DeprecatedLinkCounterType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: CounterNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "RX",
+				JSONPath: "{.bytesreceived}",
+			},
+			{
+				Name:     "TX",
+				JSONPath: "{.bytessent}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/siderolink/siderolink.go b/client/pkg/omni/resources/siderolink/siderolink.go
new file mode 100644
index 000000000..9e4552985
--- /dev/null
+++ b/client/pkg/omni/resources/siderolink/siderolink.go
@@ -0,0 +1,28 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package siderolink contains SideroLink controller resources.
+package siderolink
+
+import (
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/registry"
+)
+
+// Namespace is the default namespace for the SideroLink resources.
+const Namespace = resources.DefaultNamespace
+
+// CounterNamespace is the default namespace for the SideroLink counter resources.
+//
+// tsgen:SiderolinkCounterNamespace
+const CounterNamespace = resources.MetricsNamespace
+
+func init() {
+	registry.MustRegisterResource(ConnectionParamsType, &ConnectionParams{})
+	registry.MustRegisterResource(ConfigType, &Config{})
+	registry.MustRegisterResource(LinkType, &Link{})
+
+	// NOTE: this resource is not used anymore, but still used in the migration code.
+	registry.MustRegisterResource(DeprecatedLinkCounterType, &DeprecatedLinkCounter{})
+}
diff --git a/client/pkg/omni/resources/system/cert_refresh_tick.go b/client/pkg/omni/resources/system/cert_refresh_tick.go
new file mode 100644
index 000000000..19399706f
--- /dev/null
+++ b/client/pkg/omni/resources/system/cert_refresh_tick.go
@@ -0,0 +1,44 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package system
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewCertRefreshTick creates new CertRefreshTick state.
+func NewCertRefreshTick(ns, id string) *CertRefreshTick {
+	return typed.NewResource[CertRefreshTickSpec, CertRefreshTickExtension](
+		resource.NewMetadata(ns, CertRefreshTickType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.CertRefreshTickSpec{}),
+	)
+}
+
+// CertRefreshTickType is the type of CertRefreshTick resource.
+const CertRefreshTickType = resource.Type("CertRefreshTicks.system.sidero.dev")
+
+// CertRefreshTick resource is created when it's time to refresh the certificates.
+type CertRefreshTick = typed.Resource[CertRefreshTickSpec, CertRefreshTickExtension]
+
+// CertRefreshTickSpec wraps specs.CertRefreshTickSpec.
+type CertRefreshTickSpec = protobuf.ResourceSpec[specs.CertRefreshTickSpec, *specs.CertRefreshTickSpec]
+
+// CertRefreshTickExtension providers auxiliary methods for CertRefreshTick resource.
+type CertRefreshTickExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (CertRefreshTickExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             CertRefreshTickType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.EphemeralNamespace,
+	}
+}
diff --git a/client/pkg/omni/resources/system/dbversion.go b/client/pkg/omni/resources/system/dbversion.go
new file mode 100644
index 000000000..009673985
--- /dev/null
+++ b/client/pkg/omni/resources/system/dbversion.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package system
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewDBVersion creates new DBVersion state.
+func NewDBVersion(ns, id string) *DBVersion {
+	return typed.NewResource[DBVersionSpec, DBVersionExtension](
+		resource.NewMetadata(ns, DBVersionType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.DBVersionSpec{}),
+	)
+}
+
+const (
+	// DBVersionType is the type of DBVersion resource.
+	DBVersionType = resource.Type("DBVersions.system.sidero.dev")
+	// DBVersionID is the single resource id.
+	DBVersionID = resource.ID("current")
+)
+
+// DBVersion resource describes current DB version (migrations state).
+type DBVersion = typed.Resource[DBVersionSpec, DBVersionExtension]
+
+// DBVersionSpec wraps specs.DBVersionSpec.
+type DBVersionSpec = protobuf.ResourceSpec[specs.DBVersionSpec, *specs.DBVersionSpec]
+
+// DBVersionExtension providers auxiliary methods for DBVersion resource.
+type DBVersionExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (DBVersionExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             DBVersionType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.DefaultNamespace,
+	}
+}
diff --git a/client/pkg/omni/resources/system/system.go b/client/pkg/omni/resources/system/system.go
new file mode 100644
index 000000000..dd5934924
--- /dev/null
+++ b/client/pkg/omni/resources/system/system.go
@@ -0,0 +1,14 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package system provides resources related to the DB state itself.
+package system
+
+import "github.com/siderolabs/omni/client/pkg/omni/resources/registry"
+
+func init() {
+	registry.MustRegisterResource(CertRefreshTickType, &CertRefreshTick{})
+	registry.MustRegisterResource(DBVersionType, &DBVersion{})
+	registry.MustRegisterResource(SysVersionType, &SysVersion{})
+}
diff --git a/client/pkg/omni/resources/system/sysversion.go b/client/pkg/omni/resources/system/sysversion.go
new file mode 100644
index 000000000..f22101f8d
--- /dev/null
+++ b/client/pkg/omni/resources/system/sysversion.go
@@ -0,0 +1,52 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package system
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewSysVersion creates new SysVersion state.
+func NewSysVersion(ns, id string) *SysVersion {
+	return typed.NewResource[SysVersionSpec, SysVersionExtension](
+		resource.NewMetadata(ns, SysVersionType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.SysVersionSpec{}),
+	)
+}
+
+const (
+	// SysVersionType is the type of SysVersion resource.
+	//
+	// tsgen:SysVersionType
+	SysVersionType = resource.Type("SysVersions.system.sidero.dev")
+	// SysVersionID is the single resource id.
+	//
+	// tsgen:SysVersionID
+	SysVersionID = resource.ID("current")
+)
+
+// SysVersion resource describes current DB SysVersion (migrations state).
+type SysVersion = typed.Resource[SysVersionSpec, SysVersionExtension]
+
+// SysVersionSpec wraps specs.SysVersionSpec.
+type SysVersionSpec = protobuf.ResourceSpec[specs.SysVersionSpec, *specs.SysVersionSpec]
+
+// SysVersionExtension providers auxiliary methods for SysVersion resource.
+type SysVersionExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (SysVersionExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             SysVersionType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.EphemeralNamespace,
+	}
+}
diff --git a/client/pkg/omni/resources/virtual/cluster_permissions.go b/client/pkg/omni/resources/virtual/cluster_permissions.go
new file mode 100644
index 000000000..714198bd4
--- /dev/null
+++ b/client/pkg/omni/resources/virtual/cluster_permissions.go
@@ -0,0 +1,49 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package virtual
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewClusterPermissions creates a new ClusterPermissions resource.
+func NewClusterPermissions(id resource.ID) *ClusterPermissions {
+	return typed.NewResource[ClusterPermissionsSpec, ClusterPermissionsExtension](
+		resource.NewMetadata(resources.VirtualNamespace, ClusterPermissionsType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.ClusterPermissionsSpec{}),
+	)
+}
+
+const (
+	// ClusterPermissionsType is the type of ClusterPermissions resource.
+	//
+	// tsgen:ClusterPermissionsType
+	ClusterPermissionsType = resource.Type("ClusterPermissions.omni.sidero.dev")
+)
+
+// ClusterPermissions resource describes a user's set of permissions on a cluster.
+type ClusterPermissions = typed.Resource[ClusterPermissionsSpec, ClusterPermissionsExtension]
+
+// ClusterPermissionsSpec wraps specs.ClusterPermissionsSpec.
+type ClusterPermissionsSpec = protobuf.ResourceSpec[specs.ClusterPermissionsSpec, *specs.ClusterPermissionsSpec]
+
+// ClusterPermissionsExtension providers auxiliary methods for ClusterPermissions resource.
+type ClusterPermissionsExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (ClusterPermissionsExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             ClusterPermissionsType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.VirtualNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/virtual/current_user.go b/client/pkg/omni/resources/virtual/current_user.go
new file mode 100644
index 000000000..357bc1329
--- /dev/null
+++ b/client/pkg/omni/resources/virtual/current_user.go
@@ -0,0 +1,63 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package virtual
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// CurrentUserID is the default and the only allowed ID for CurrentUser resource.
+//
+// tsgen:CurrentUserID
+const CurrentUserID = "current"
+
+// NewCurrentUser creates a new CurrentUser resource.
+func NewCurrentUser() *CurrentUser {
+	return typed.NewResource[CurrentUserSpec, CurrentUserExtension](
+		resource.NewMetadata(resources.VirtualNamespace, CurrentUserType, CurrentUserID, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.CurrentUserSpec{}),
+	)
+}
+
+const (
+	// CurrentUserType is the type of CurrentUser resource.
+	//
+	// tsgen:CurrentUserType
+	CurrentUserType = resource.Type("CurrentUsers.omni.sidero.dev")
+)
+
+// CurrentUser resource describes a user current user.
+type CurrentUser = typed.Resource[CurrentUserSpec, CurrentUserExtension]
+
+// CurrentUserSpec wraps specs.CurrentUserSpec.
+type CurrentUserSpec = protobuf.ResourceSpec[specs.CurrentUserSpec, *specs.CurrentUserSpec]
+
+// CurrentUserExtension providers auxiliary methods for CurrentUser resource.
+type CurrentUserExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (CurrentUserExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             CurrentUserType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.VirtualNamespace,
+		PrintColumns: []meta.PrintColumn{
+			{
+				Name:     "Identity",
+				JSONPath: "{.identity}",
+			},
+			{
+				Name:     "Role",
+				JSONPath: "{.role}",
+			},
+		},
+	}
+}
diff --git a/client/pkg/omni/resources/virtual/kubernetes_usage.go b/client/pkg/omni/resources/virtual/kubernetes_usage.go
new file mode 100644
index 000000000..a48b559d3
--- /dev/null
+++ b/client/pkg/omni/resources/virtual/kubernetes_usage.go
@@ -0,0 +1,47 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package virtual
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+// NewKubernetesUsage creates new Kubernetes usage resource.
+func NewKubernetesUsage(ns, id string) *KubernetesUsage {
+	return typed.NewResource[KubernetesUsageSpec, KubernetesUsageExtension](
+		resource.NewMetadata(ns, KubernetesUsageType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.KubernetesUsageSpec{}),
+	)
+}
+
+// KubernetesUsageType is a resource type that contains kubernetes resource usage info.
+//
+// tsgen:KubernetesUsageType
+const KubernetesUsageType = resource.Type("KubernetesUsages.omni.sidero.dev")
+
+// KubernetesUsage is a resource type that contains the state of Kubernetes components in the cluster.
+type KubernetesUsage = typed.Resource[KubernetesUsageSpec, KubernetesUsageExtension]
+
+// KubernetesUsageSpec wraps specs.KubernetesUsageSpec.
+type KubernetesUsageSpec = protobuf.ResourceSpec[specs.KubernetesUsageSpec, *specs.KubernetesUsageSpec]
+
+// KubernetesUsageExtension providers auxiliary methods for KubernetesUsage resource.
+type KubernetesUsageExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (KubernetesUsageExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             KubernetesUsageType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.VirtualNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/virtual/permissions.go b/client/pkg/omni/resources/virtual/permissions.go
new file mode 100644
index 000000000..fb70eb3a8
--- /dev/null
+++ b/client/pkg/omni/resources/virtual/permissions.go
@@ -0,0 +1,56 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package virtual
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+)
+
+const (
+	// PermissionsID is the ID of Permissions resource.
+	//
+	// tsgen:PermissionsID
+	PermissionsID resource.ID = "permissions"
+)
+
+// NewPermissions creates a new Permissions resource.
+func NewPermissions() *Permissions {
+	return typed.NewResource[PermissionsSpec, PermissionsExtension](
+		resource.NewMetadata(resources.VirtualNamespace, PermissionsType, PermissionsID, resource.VersionUndefined),
+		protobuf.NewResourceSpec(&specs.PermissionsSpec{}),
+	)
+}
+
+const (
+	// PermissionsType is the type of Permissions resource.
+	//
+	// tsgen:PermissionsType
+	PermissionsType = resource.Type("Permissions.omni.sidero.dev")
+)
+
+// Permissions resource describes a user's global set of permissions.
+type Permissions = typed.Resource[PermissionsSpec, PermissionsExtension]
+
+// PermissionsSpec wraps specs.PermissionsSpec.
+type PermissionsSpec = protobuf.ResourceSpec[specs.PermissionsSpec, *specs.PermissionsSpec]
+
+// PermissionsExtension providers auxiliary methods for Permissions resource.
+type PermissionsExtension struct{}
+
+// ResourceDefinition implements [typed.Extension] interface.
+func (PermissionsExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             PermissionsType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: resources.VirtualNamespace,
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
diff --git a/client/pkg/omni/resources/virtual/virtual.go b/client/pkg/omni/resources/virtual/virtual.go
new file mode 100644
index 000000000..532df54a6
--- /dev/null
+++ b/client/pkg/omni/resources/virtual/virtual.go
@@ -0,0 +1,15 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package virtual contains virtual resources.
+package virtual
+
+import "github.com/siderolabs/omni/client/pkg/omni/resources/registry"
+
+func init() {
+	registry.MustRegisterResource(CurrentUserType, &CurrentUser{})
+	registry.MustRegisterResource(ClusterPermissionsType, &ClusterPermissions{})
+	registry.MustRegisterResource(KubernetesUsageType, &KubernetesUsage{})
+	registry.MustRegisterResource(PermissionsType, &Permissions{})
+}
diff --git a/client/pkg/omnictl/apply.go b/client/pkg/omnictl/apply.go
new file mode 100644
index 000000000..3c57bb6ba
--- /dev/null
+++ b/client/pkg/omnictl/apply.go
@@ -0,0 +1,176 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omnictl
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/sergi/go-diff/diffmatchpatch"
+	"github.com/siderolabs/gen/ensure"
+	"github.com/spf13/cobra"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+)
+
+var applyCmdFlags struct {
+	resFile string
+	options options
+}
+
+// applyCmd represents apply config command.
+var applyCmd = &cobra.Command{
+	Use:   "apply",
+	Short: "Create or update resource using YAML file as an input",
+	Args:  cobra.NoArgs,
+	RunE: func(*cobra.Command, []string) error {
+		yamlRaw, err := os.ReadFile(applyCmdFlags.resFile)
+		if err != nil {
+			return fmt.Errorf("failed to read resource yaml file %q: %w", applyCmdFlags.resFile, err)
+		}
+
+		if applyCmdFlags.options.dryRun {
+			applyCmdFlags.options.verbose = true
+		}
+
+		return access.WithClient(applyConfig(yamlRaw))
+	},
+}
+
+func applyConfig(yamlRaw []byte) func(ctx context.Context, client *client.Client) error {
+	return func(ctx context.Context, client *client.Client) error {
+		st := client.Omni().State()
+		dec := yaml.NewDecoder(bytes.NewReader(yamlRaw))
+
+		var resources []resource.Resource
+
+		for {
+			var res protobuf.YAMLResource
+
+			err := dec.Decode(&res)
+			if errors.Is(err, io.EOF) {
+				break
+			}
+
+			if err != nil {
+				return err
+			}
+
+			resources = append(resources, res.Resource())
+		}
+
+		for _, res := range resources {
+			got, err := st.Get(ctx, res.Metadata())
+			if err != nil && !state.IsNotFoundError(err) {
+				return fmt.Errorf("failed to get resource '%s' '%s': %w", res.Metadata().ID(), res.Metadata().Type(), err)
+			}
+
+			if state.IsNotFoundError(err) {
+				err = createResource(ctx, st, res, applyCmdFlags.options)
+				if err != nil {
+					return err
+				}
+
+				continue
+			}
+
+			err = updateResource(ctx, st, got, res, applyCmdFlags.options)
+			if err != nil {
+				return fmt.Errorf("failed to update resource '%s' '%s': %w", res.Metadata().ID(), res.Metadata().Type(), err)
+			}
+		}
+
+		return nil
+	}
+}
+
+type options struct {
+	dryRun  bool
+	verbose bool
+}
+
+func createResource(ctx context.Context, st state.State, res resource.Resource, opts options) error {
+	if opts.verbose {
+		out, err := marshalResource(res)
+		if err != nil {
+			return err
+		}
+
+		fmt.Printf("Creating resource '%s'\n\n%s\n\n", res.Metadata().ID(), out)
+	}
+
+	if opts.dryRun {
+		return nil
+	}
+
+	if err := st.Create(ctx, res); err != nil {
+		return fmt.Errorf("failed to create resource '%s' '%s': %w", res.Metadata().ID(), res.Metadata().Type(), err)
+	}
+
+	return nil
+}
+
+func updateResource(ctx context.Context, st state.State, got resource.Resource, res resource.Resource, opts options) error {
+	if opts.verbose {
+		outGot, err := marshalResource(got)
+		if err != nil {
+			return err
+		}
+
+		outRes, err := marshalResource(res)
+		if err != nil {
+			return err
+		}
+
+		dmp := diffmatchpatch.New()
+		diffs := dmp.DiffMain(outGot, outRes, false)
+
+		fmt.Printf("Updating resource '%s'\n\n%s\n\n", res.Metadata().ID(), dmp.DiffPrettyText(diffs))
+	}
+
+	if opts.dryRun {
+		return nil
+	}
+
+	res.Metadata().SetVersion(got.Metadata().Version())
+
+	if err := st.Update(ctx, res); err != nil {
+		return fmt.Errorf("failed to update resource '%s' '%s': %w", res.Metadata().ID(), res.Metadata().Type(), err)
+	}
+
+	return nil
+}
+
+func marshalResource(res resource.Resource) (string, error) {
+	yamlRes, err := resource.MarshalYAML(res)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal resource '%s' '%s': %w", res.Metadata().ID(), res.Metadata().Type(), err)
+	}
+
+	out, err := yaml.Marshal(yamlRes)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal resource '%s' '%s': %w", res.Metadata().ID(), res.Metadata().Type(), err)
+	}
+
+	return string(out), nil
+}
+
+func init() {
+	applyCmd.PersistentFlags().StringVarP(&applyCmdFlags.resFile, "file", "f", "", "Resource file to load and apply")
+	applyCmd.PersistentFlags().BoolVarP(&applyCmdFlags.options.verbose, "verbose", "v", false, "Verbose output")
+	applyCmd.PersistentFlags().BoolVarP(&applyCmdFlags.options.dryRun, "dry-run", "d", false, "Dry run, implies verbose")
+	ensure.NoError(applyCmd.MarkPersistentFlagRequired("file"))
+
+	RootCmd.AddCommand(applyCmd)
+}
diff --git a/client/pkg/omnictl/cluster.go b/client/pkg/omnictl/cluster.go
new file mode 100644
index 000000000..6e2a575cd
--- /dev/null
+++ b/client/pkg/omnictl/cluster.go
@@ -0,0 +1,11 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omnictl
+
+import "github.com/siderolabs/omni/client/pkg/omnictl/cluster"
+
+func init() {
+	RootCmd.AddCommand(cluster.RootCmd())
+}
diff --git a/client/pkg/omnictl/cluster/cluster.go b/client/pkg/omnictl/cluster/cluster.go
new file mode 100644
index 000000000..81aca4a54
--- /dev/null
+++ b/client/pkg/omnictl/cluster/cluster.go
@@ -0,0 +1,32 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package cluster contains commands related to cluster operations.
+package cluster
+
+import (
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/omnictl/cluster/kubernetes"
+	"github.com/siderolabs/omni/client/pkg/omnictl/cluster/template"
+)
+
+// clusterCmd represents the cluster sub-command.
+var clusterCmd = &cobra.Command{
+	Use:     "cluster",
+	Aliases: []string{"c"},
+	Short:   "Cluster-related subcommands.",
+	Long:    `Commands to destroy clusters and manage cluster templates.`,
+	Example: "",
+}
+
+// RootCmd exposes root cluster command.
+func RootCmd() *cobra.Command {
+	return clusterCmd
+}
+
+func init() {
+	clusterCmd.AddCommand(template.RootCmd())
+	clusterCmd.AddCommand(kubernetes.RootCmd())
+}
diff --git a/client/pkg/omnictl/cluster/delete.go b/client/pkg/omnictl/cluster/delete.go
new file mode 100644
index 000000000..53f358444
--- /dev/null
+++ b/client/pkg/omnictl/cluster/delete.go
@@ -0,0 +1,45 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package cluster
+
+import (
+	"context"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+	"github.com/siderolabs/omni/client/pkg/template/operations"
+)
+
+var deleteCmdFlags struct {
+	options operations.SyncOptions
+}
+
+// deleteCmd represents the cluster delete command.
+var deleteCmd = &cobra.Command{
+	Use:     "delete cluster-name",
+	Short:   "Delete all cluster resources.",
+	Long:    `Delete all resources related to the cluster. The command waits for the cluster to be fully destroyed.`,
+	Example: "",
+	Args:    cobra.ExactArgs(1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		return access.WithClient(deleteImpl(args[0]))
+	},
+}
+
+func deleteImpl(clusterName string) func(ctx context.Context, client *client.Client) error {
+	return func(ctx context.Context, client *client.Client) error {
+		return operations.DeleteCluster(ctx, clusterName, os.Stdout, client.Omni().State(), deleteCmdFlags.options)
+	}
+}
+
+func init() {
+	deleteCmd.PersistentFlags().BoolVarP(&deleteCmdFlags.options.Verbose, "verbose", "v", false, "verbose output (show diff for each resource)")
+	deleteCmd.PersistentFlags().BoolVarP(&deleteCmdFlags.options.DryRun, "dry-run", "d", false, "dry run")
+	deleteCmd.PersistentFlags().BoolVar(&deleteCmdFlags.options.DestroyMachines, "destroy-disconnected-machines", false, "removes all disconnected machines which are part of the cluster from Omni")
+	clusterCmd.AddCommand(deleteCmd)
+}
diff --git a/client/pkg/omnictl/cluster/kubernetes/kubernetes.go b/client/pkg/omnictl/cluster/kubernetes/kubernetes.go
new file mode 100644
index 000000000..fd561b431
--- /dev/null
+++ b/client/pkg/omnictl/cluster/kubernetes/kubernetes.go
@@ -0,0 +1,24 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package kubernetes contains commands related to cluster Kubernetes operations.
+package kubernetes
+
+import (
+	"github.com/spf13/cobra"
+)
+
+// kubernetesCmd represents the kubernetes sub-command.
+var kubernetesCmd = &cobra.Command{
+	Use:     "kubernetes",
+	Aliases: []string{"k"},
+	Short:   "Cluster Kubernetes management subcommands.",
+	Long:    `Commands to render, validate, manage cluster templates.`,
+	Example: "",
+}
+
+// RootCmd exports kubernetesCmd.
+func RootCmd() *cobra.Command {
+	return kubernetesCmd
+}
diff --git a/client/pkg/omnictl/cluster/kubernetes/manifest-sync.go b/client/pkg/omnictl/cluster/kubernetes/manifest-sync.go
new file mode 100644
index 000000000..d3155e7c1
--- /dev/null
+++ b/client/pkg/omnictl/cluster/kubernetes/manifest-sync.go
@@ -0,0 +1,68 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package kubernetes
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/api/omni/management"
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+)
+
+var manifestSyncCmdFlags struct {
+	dryRun bool
+}
+
+// manifestSyncCmd represents the cluster kubernetes manifest-sync command.
+var manifestSyncCmd = &cobra.Command{
+	Use:   "manifest-sync cluster-name",
+	Short: "Sync Kubernetes bootstrap manifests from Talos controlplane nodes to Kubernetes API.",
+	Long: `Sync Kubernetes bootstrap manifests from Talos controlplane nodes to Kubernetes API.
+Bootstrap manifests might be updated with Talos version update, Kubernetes upgrade, and config patching.
+Talos never updates or deletes Kubernetes manifests, so this command fills the gap to keep manifests up-to-date.`,
+	Example: "",
+	Args:    cobra.ExactArgs(1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		return access.WithClient(manifestSync(args[0]))
+	},
+}
+
+func manifestSync(clusterName string) func(ctx context.Context, client *client.Client) error {
+	return func(ctx context.Context, client *client.Client) error {
+		handler := func(resp *management.KubernetesSyncManifestResponse) error {
+			switch resp.ResponseType {
+			case management.KubernetesSyncManifestResponse_UNKNOWN:
+			case management.KubernetesSyncManifestResponse_MANIFEST:
+				fmt.Printf(" > processing manifest %s\n", resp.Path)
+
+				switch {
+				case resp.Skipped:
+					fmt.Println(" < no changes")
+				case manifestSyncCmdFlags.dryRun:
+					fmt.Println(resp.Diff)
+					fmt.Println(" < dry run, change skipped")
+				case !manifestSyncCmdFlags.dryRun:
+					fmt.Println(resp.Diff)
+					fmt.Println(" < applied successfully")
+				}
+			case management.KubernetesSyncManifestResponse_ROLLOUT:
+				fmt.Printf(" > waiting for %s\n", resp.Path)
+			}
+
+			return nil
+		}
+
+		return client.Management().WithCluster(clusterName).KubernetesSyncManifests(ctx, manifestSyncCmdFlags.dryRun, handler)
+	}
+}
+
+func init() {
+	manifestSyncCmd.Flags().BoolVar(&manifestSyncCmdFlags.dryRun, "dry-run", true, "don't actually sync manifests, just print what would be done")
+	kubernetesCmd.AddCommand(manifestSyncCmd)
+}
diff --git a/client/pkg/omnictl/cluster/kubernetes/upgrade-pre-checks.go b/client/pkg/omnictl/cluster/kubernetes/upgrade-pre-checks.go
new file mode 100644
index 000000000..868aae37f
--- /dev/null
+++ b/client/pkg/omnictl/cluster/kubernetes/upgrade-pre-checks.go
@@ -0,0 +1,43 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package kubernetes
+
+import (
+	"context"
+
+	"github.com/siderolabs/gen/ensure"
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+)
+
+var upgradePreChecksCmdFlags struct {
+	toVersion string
+}
+
+// upgradePreChecksCmd represents the cluster kubernetes upgrade-pre-checks command.
+var upgradePreChecksCmd = &cobra.Command{
+	Use:     "upgrade-pre-checks cluster-name",
+	Short:   "Run Kubernetes upgrade pre-checks for the cluster.",
+	Long:    `Verify that upgrading Kubernetes version is available for the cluster: version compatibility, deprecated APIs, etc.`,
+	Example: "",
+	Args:    cobra.ExactArgs(1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		return access.WithClient(upgradePreChecks(args[0]))
+	},
+}
+
+func upgradePreChecks(clusterName string) func(ctx context.Context, client *client.Client) error {
+	return func(ctx context.Context, client *client.Client) error {
+		return client.Management().WithCluster(clusterName).KubernetesUpgradePreChecks(ctx, upgradePreChecksCmdFlags.toVersion)
+	}
+}
+
+func init() {
+	upgradePreChecksCmd.Flags().StringVar(&upgradePreChecksCmdFlags.toVersion, "to", "", "target Kubernetes version for the planned upgrade")
+	ensure.NoError(upgradePreChecksCmd.MarkFlagRequired("to"))
+	kubernetesCmd.AddCommand(upgradePreChecksCmd)
+}
diff --git a/client/pkg/omnictl/cluster/machine.go b/client/pkg/omnictl/cluster/machine.go
new file mode 100644
index 000000000..afbc74069
--- /dev/null
+++ b/client/pkg/omnictl/cluster/machine.go
@@ -0,0 +1,79 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package cluster
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+)
+
+var lockCmd = &cobra.Command{
+	Use:   "lock machine-id",
+	Short: "Lock the machine",
+	Long:  `When locked, no config updates, upgrades and downgrades will be performed on the machine.`,
+	Args:  cobra.ExactArgs(1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		return access.WithClient(setLocked(args[0], true))
+	},
+}
+
+var unlockCmd = &cobra.Command{
+	Use:   "unlock machine-id",
+	Short: "Unlock the machine",
+	Long:  `Removes locked annotation from the machine.`,
+	Args:  cobra.ExactArgs(1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		return access.WithClient(setLocked(args[0], false))
+	},
+}
+
+func setLocked(machineID resource.ID, lock bool) func(context.Context, *client.Client) error {
+	return func(ctx context.Context, client *client.Client) error {
+		st := client.Omni().State()
+
+		machineSetNode, err := safe.StateGet[*omni.MachineSetNode](ctx, st, resource.NewMetadata(resources.DefaultNamespace, omni.MachineSetNodeType, machineID, resource.VersionUndefined))
+		if err != nil {
+			if state.IsNotFoundError(err) {
+				fmt.Printf("no machine set nodes with id %q found", machineID)
+			}
+		}
+
+		_, err = safe.StateUpdateWithConflicts(ctx, st, machineSetNode.Metadata(), func(res *omni.MachineSetNode) error {
+			if lock {
+				res.Metadata().Annotations().Set(omni.MachineLocked, "")
+			} else {
+				res.Metadata().Annotations().Delete(omni.MachineLocked)
+			}
+
+			return nil
+		})
+
+		return err
+	}
+}
+
+// machineCmd represents the cluster machine commands.
+var machineCmd = &cobra.Command{
+	Use:     "machine",
+	Short:   "Machine related commands.",
+	Long:    `Commands to manage cluster machines.`,
+	Example: "",
+}
+
+func init() {
+	machineCmd.AddCommand(lockCmd)
+	machineCmd.AddCommand(unlockCmd)
+	clusterCmd.AddCommand(machineCmd)
+}
diff --git a/client/pkg/omnictl/cluster/status.go b/client/pkg/omnictl/cluster/status.go
new file mode 100644
index 000000000..764d92da2
--- /dev/null
+++ b/client/pkg/omnictl/cluster/status.go
@@ -0,0 +1,57 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package cluster
+
+import (
+	"context"
+	"os"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+	"github.com/siderolabs/omni/client/pkg/template/operations"
+)
+
+var statusCmdFlags struct {
+	options operations.StatusOptions
+	wait    time.Duration
+}
+
+// statusCmd represents the cluster status command.
+var statusCmd = &cobra.Command{
+	Use:     "status cluster-name",
+	Short:   "Show cluster status, wait for the cluster to be ready.",
+	Long:    `Shows current cluster status, if the terminal supports it, watch the status as it updates. The command waits for the cluster to be ready by default.`,
+	Example: "",
+	Args:    cobra.ExactArgs(1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		return access.WithClient(status(args[0]))
+	},
+}
+
+func status(clusterName string) func(ctx context.Context, client *client.Client) error {
+	return func(ctx context.Context, client *client.Client) error {
+		if statusCmdFlags.wait > 0 {
+			var cancel context.CancelFunc
+
+			ctx, cancel = context.WithTimeout(ctx, statusCmdFlags.wait)
+			defer cancel()
+
+			statusCmdFlags.options.Wait = true
+		} else {
+			statusCmdFlags.options.Wait = false
+		}
+
+		return operations.StatusCluster(ctx, clusterName, os.Stdout, client.Omni().State(), statusCmdFlags.options)
+	}
+}
+
+func init() {
+	statusCmd.PersistentFlags().BoolVarP(&statusCmdFlags.options.Quiet, "quiet", "q", false, "suppress output")
+	statusCmd.PersistentFlags().DurationVarP(&statusCmdFlags.wait, "wait", "w", 5*time.Minute, "wait timeout, if zero, report current status and exit")
+	clusterCmd.AddCommand(statusCmd)
+}
diff --git a/client/pkg/omnictl/cluster/template/delete.go b/client/pkg/omnictl/cluster/template/delete.go
new file mode 100644
index 000000000..7725d2dbe
--- /dev/null
+++ b/client/pkg/omnictl/cluster/template/delete.go
@@ -0,0 +1,51 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package template
+
+import (
+	"context"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+	"github.com/siderolabs/omni/client/pkg/template/operations"
+)
+
+var deleteCmdFlags struct {
+	options operations.SyncOptions
+}
+
+// deleteCmd represents the template delete command.
+var deleteCmd = &cobra.Command{
+	Use:     "delete",
+	Short:   "Delete all cluster template resources from Omni.",
+	Long:    `Delete all resources related to the cluster template. This command requires API access.`,
+	Example: "",
+	Args:    cobra.NoArgs,
+	RunE: func(*cobra.Command, []string) error {
+		return access.WithClient(deleteImpl)
+	},
+}
+
+func deleteImpl(ctx context.Context, client *client.Client) error {
+	f, err := os.Open(cmdFlags.TemplatePath)
+	if err != nil {
+		return err
+	}
+
+	defer f.Close() //nolint:errcheck
+
+	return operations.DeleteTemplate(ctx, f, os.Stdout, client.Omni().State(), deleteCmdFlags.options)
+}
+
+func init() {
+	addRequiredFileFlag(deleteCmd)
+	deleteCmd.PersistentFlags().BoolVarP(&deleteCmdFlags.options.Verbose, "verbose", "v", false, "verbose output (show diff for each resource)")
+	deleteCmd.PersistentFlags().BoolVarP(&deleteCmdFlags.options.DryRun, "dry-run", "d", false, "dry run")
+	deleteCmd.PersistentFlags().BoolVar(&deleteCmdFlags.options.DestroyMachines, "destroy-disconnected-machines", false, "removes all disconnected machines which are part of the cluster from Omni")
+	templateCmd.AddCommand(deleteCmd)
+}
diff --git a/client/pkg/omnictl/cluster/template/diff.go b/client/pkg/omnictl/cluster/template/diff.go
new file mode 100644
index 000000000..58c6b5e4b
--- /dev/null
+++ b/client/pkg/omnictl/cluster/template/diff.go
@@ -0,0 +1,44 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package template
+
+import (
+	"context"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+	"github.com/siderolabs/omni/client/pkg/template/operations"
+)
+
+// diffCmd represents the template diff command.
+var diffCmd = &cobra.Command{
+	Use:     "diff",
+	Short:   "Show diff in resources if the template is synced.",
+	Long:    `Query existing resources for the cluster and compare them with the resources generated from the template. This command requires API access.`,
+	Example: "",
+	Args:    cobra.NoArgs,
+	RunE: func(*cobra.Command, []string) error {
+		return access.WithClient(diff)
+	},
+}
+
+func diff(ctx context.Context, client *client.Client) error {
+	f, err := os.Open(cmdFlags.TemplatePath)
+	if err != nil {
+		return err
+	}
+
+	defer f.Close() //nolint:errcheck
+
+	return operations.DiffTemplate(ctx, f, os.Stdout, client.Omni().State())
+}
+
+func init() {
+	addRequiredFileFlag(diffCmd)
+	templateCmd.AddCommand(diffCmd)
+}
diff --git a/client/pkg/omnictl/cluster/template/export.go b/client/pkg/omnictl/cluster/template/export.go
new file mode 100644
index 000000000..4b4f6072c
--- /dev/null
+++ b/client/pkg/omnictl/cluster/template/export.go
@@ -0,0 +1,70 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package template
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+
+	"github.com/siderolabs/gen/ensure"
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+	"github.com/siderolabs/omni/client/pkg/template/operations"
+)
+
+var exportCmdFlags struct {
+	cluster string
+	output  string
+	force   bool
+}
+
+// exportCmd represents the template export command.
+var exportCmd = &cobra.Command{
+	Use:   "export cluster-name",
+	Short: "Export a cluster template from an existing cluster on Omni.",
+	Long:  `Export a cluster template from an existing cluster on Omni. This command requires API access.`,
+	Args:  cobra.NoArgs,
+	RunE: func(*cobra.Command, []string) error {
+		return access.WithClient(export)
+	},
+}
+
+func export(ctx context.Context, client *client.Client) (err error) {
+	output := os.Stdout
+
+	if exportCmdFlags.output != "" {
+		var openErr error
+
+		flags := os.O_WRONLY | os.O_CREATE | os.O_EXCL
+		if exportCmdFlags.force {
+			flags = os.O_WRONLY | os.O_CREATE | os.O_TRUNC
+		}
+
+		output, openErr = os.OpenFile(exportCmdFlags.output, flags, 0o644)
+		if openErr != nil {
+			return fmt.Errorf("failed to open output file: %w", openErr)
+		}
+
+		defer func() { err = errors.Join(err, output.Close()) }()
+	}
+
+	_, err = operations.ExportTemplate(ctx, client.Omni().State(), exportCmdFlags.cluster, output)
+
+	return err
+}
+
+func init() {
+	exportCmd.Flags().StringVarP(&exportCmdFlags.cluster, "cluster", "c", "", "cluster name")
+	exportCmd.Flags().StringVarP(&exportCmdFlags.output, "output", "o", "", "output file (default: stdout)")
+	exportCmd.Flags().BoolVarP(&exportCmdFlags.force, "force", "f", false, "overwrite output file if it exists")
+
+	ensure.NoError(exportCmd.MarkFlagRequired("cluster"))
+
+	templateCmd.AddCommand(exportCmd)
+}
diff --git a/client/pkg/omnictl/cluster/template/render.go b/client/pkg/omnictl/cluster/template/render.go
new file mode 100644
index 000000000..5beef44a6
--- /dev/null
+++ b/client/pkg/omnictl/cluster/template/render.go
@@ -0,0 +1,41 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package template
+
+import (
+	"os"
+
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/template/operations"
+)
+
+// renderCmd represents the template render command.
+var renderCmd = &cobra.Command{
+	Use:     "render",
+	Short:   "Render a cluster template to a set of resources.",
+	Long:    `Validate template contents, convert to resources and output resources to stdout as YAML. This command is offline (doesn't access API).`,
+	Example: "",
+	Args:    cobra.NoArgs,
+	RunE: func(*cobra.Command, []string) error {
+		return render()
+	},
+}
+
+func render() error {
+	f, err := os.Open(cmdFlags.TemplatePath)
+	if err != nil {
+		return err
+	}
+
+	defer f.Close() //nolint:errcheck
+
+	return operations.RenderTemplate(f, os.Stdout)
+}
+
+func init() {
+	addRequiredFileFlag(renderCmd)
+	templateCmd.AddCommand(renderCmd)
+}
diff --git a/client/pkg/omnictl/cluster/template/status.go b/client/pkg/omnictl/cluster/template/status.go
new file mode 100644
index 000000000..f57daf345
--- /dev/null
+++ b/client/pkg/omnictl/cluster/template/status.go
@@ -0,0 +1,63 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package template
+
+import (
+	"context"
+	"os"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+	"github.com/siderolabs/omni/client/pkg/template/operations"
+)
+
+var statusCmdFlags struct {
+	options operations.StatusOptions
+	wait    time.Duration
+}
+
+// statusCmd represents the cluster status command.
+var statusCmd = &cobra.Command{
+	Use:     "status",
+	Short:   "Show template cluster status, wait for the cluster to be ready.",
+	Long:    `Shows current cluster status, if the terminal supports it, watch the status as it updates. The command waits for the cluster to be ready by default.`,
+	Example: "",
+	Args:    cobra.NoArgs,
+	RunE: func(*cobra.Command, []string) error {
+		return access.WithClient(status)
+	},
+}
+
+func status(ctx context.Context, client *client.Client) error {
+	f, err := os.Open(cmdFlags.TemplatePath)
+	if err != nil {
+		return err
+	}
+
+	defer f.Close() //nolint:errcheck
+
+	if statusCmdFlags.wait > 0 {
+		var cancel context.CancelFunc
+
+		ctx, cancel = context.WithTimeout(ctx, statusCmdFlags.wait)
+		defer cancel()
+
+		statusCmdFlags.options.Wait = true
+	} else {
+		statusCmdFlags.options.Wait = false
+	}
+
+	return operations.StatusTemplate(ctx, f, os.Stdout, client.Omni().State(), statusCmdFlags.options)
+}
+
+func init() {
+	addRequiredFileFlag(statusCmd)
+	statusCmd.PersistentFlags().BoolVarP(&statusCmdFlags.options.Quiet, "quiet", "q", false, "suppress output")
+	statusCmd.PersistentFlags().DurationVarP(&statusCmdFlags.wait, "wait", "w", 5*time.Minute, "wait timeout, if zero, report current status and exit")
+	templateCmd.AddCommand(statusCmd)
+}
diff --git a/client/pkg/omnictl/cluster/template/sync.go b/client/pkg/omnictl/cluster/template/sync.go
new file mode 100644
index 000000000..fbefefb88
--- /dev/null
+++ b/client/pkg/omnictl/cluster/template/sync.go
@@ -0,0 +1,50 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package template
+
+import (
+	"context"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+	"github.com/siderolabs/omni/client/pkg/template/operations"
+)
+
+var syncCmdFlags struct {
+	options operations.SyncOptions
+}
+
+// syncCmd represents the template sync command.
+var syncCmd = &cobra.Command{
+	Use:     "sync",
+	Short:   "Apply template to the Omni.",
+	Long:    `Query existing resources for the cluster and compare them with the resources generated from the template, create/update/delete resources as needed. This command requires API access.`,
+	Example: "",
+	Args:    cobra.NoArgs,
+	RunE: func(*cobra.Command, []string) error {
+		return access.WithClient(sync)
+	},
+}
+
+func sync(ctx context.Context, client *client.Client) error {
+	f, err := os.Open(cmdFlags.TemplatePath)
+	if err != nil {
+		return err
+	}
+
+	defer f.Close() //nolint:errcheck
+
+	return operations.SyncTemplate(ctx, f, os.Stdout, client.Omni().State(), syncCmdFlags.options)
+}
+
+func init() {
+	addRequiredFileFlag(syncCmd)
+	syncCmd.PersistentFlags().BoolVarP(&syncCmdFlags.options.Verbose, "verbose", "v", false, "verbose output (show diff for each resource)")
+	syncCmd.PersistentFlags().BoolVarP(&syncCmdFlags.options.DryRun, "dry-run", "d", false, "dry run")
+	templateCmd.AddCommand(syncCmd)
+}
diff --git a/client/pkg/omnictl/cluster/template/template.go b/client/pkg/omnictl/cluster/template/template.go
new file mode 100644
index 000000000..5783badab
--- /dev/null
+++ b/client/pkg/omnictl/cluster/template/template.go
@@ -0,0 +1,36 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package template contains commands related to cluster template operations.
+package template
+
+import (
+	"github.com/siderolabs/gen/ensure"
+	"github.com/spf13/cobra"
+)
+
+// cmdFlags contains shared cluster template flags.
+var cmdFlags struct {
+	// Path to the cluster template file.
+	TemplatePath string
+}
+
+// templateCmd represents the template sub-command.
+var templateCmd = &cobra.Command{
+	Use:     "template",
+	Aliases: []string{"t"},
+	Short:   "Cluster template management subcommands.",
+	Long:    `Commands to render, validate, manage cluster templates.`,
+	Example: "",
+}
+
+// RootCmd exports templateCmd.
+func RootCmd() *cobra.Command {
+	return templateCmd
+}
+
+func addRequiredFileFlag(cmd *cobra.Command) {
+	cmd.PersistentFlags().StringVarP(&cmdFlags.TemplatePath, "file", "f", "", "path to the cluster template file.")
+	ensure.NoError(cmd.MarkPersistentFlagRequired("file"))
+}
diff --git a/client/pkg/omnictl/cluster/template/validate.go b/client/pkg/omnictl/cluster/template/validate.go
new file mode 100644
index 000000000..5f22f6346
--- /dev/null
+++ b/client/pkg/omnictl/cluster/template/validate.go
@@ -0,0 +1,41 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package template
+
+import (
+	"os"
+
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/template/operations"
+)
+
+// validateCmd represents the template validate command.
+var validateCmd = &cobra.Command{
+	Use:     "validate",
+	Short:   "Validate a cluster template.",
+	Long:    `Validate that template contains valid structures, and there are no other warnings. This command is offline (doesn't access API).`,
+	Example: "",
+	Args:    cobra.NoArgs,
+	RunE: func(*cobra.Command, []string) error {
+		return validate()
+	},
+}
+
+func validate() error {
+	f, err := os.Open(cmdFlags.TemplatePath)
+	if err != nil {
+		return err
+	}
+
+	defer f.Close() //nolint:errcheck
+
+	return operations.ValidateTemplate(f)
+}
+
+func init() {
+	addRequiredFileFlag(validateCmd)
+	templateCmd.AddCommand(validateCmd)
+}
diff --git a/client/pkg/omnictl/common.go b/client/pkg/omnictl/common.go
new file mode 100644
index 000000000..78ec8b75b
--- /dev/null
+++ b/client/pkg/omnictl/common.go
@@ -0,0 +1,58 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package omnictl ...
+package omnictl
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+)
+
+func resolveResourceType(ctx context.Context, st state.State, resourceType string) (*meta.ResourceDefinition, error) {
+	rds, err := safe.StateListAll[*meta.ResourceDefinition](ctx, st)
+	if err != nil {
+		return nil, err
+	}
+
+	var matched []*meta.ResourceDefinition
+
+	for it := rds.Iterator(); it.Next(); {
+		if strings.EqualFold(it.Value().Metadata().ID(), resourceType) {
+			matched = append(matched, it.Value())
+
+			continue
+		}
+
+		spec := it.Value().TypedSpec()
+
+		for _, alias := range spec.AllAliases {
+			if strings.EqualFold(alias, resourceType) {
+				matched = append(matched, it.Value())
+
+				break
+			}
+		}
+	}
+
+	switch {
+	case len(matched) == 1:
+		return matched[0], nil
+	case len(matched) > 1:
+		matchedTypes := make([]string, 0, len(matched))
+
+		for _, rd := range matched {
+			matchedTypes = append(matchedTypes, rd.Metadata().ID())
+		}
+
+		return nil, fmt.Errorf("resource type %q is ambiguous: %v", resourceType, matchedTypes)
+	default:
+		return nil, fmt.Errorf("resource %q is not registered", resourceType)
+	}
+}
diff --git a/client/pkg/omnictl/config.go b/client/pkg/omnictl/config.go
new file mode 100644
index 000000000..08397f6f9
--- /dev/null
+++ b/client/pkg/omnictl/config.go
@@ -0,0 +1,318 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omnictl
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"slices"
+	"strings"
+	"text/tabwriter"
+	"text/template"
+
+	"github.com/siderolabs/gen/maps"
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/omnictl/config"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+)
+
+// configCmd represents the config command.
+var configCmd = &cobra.Command{
+	Use:   "config",
+	Short: "Manage the client configuration file (omniconfig)",
+	Long:  ``,
+}
+
+// configURLCmd represents the `config url` command.
+var configURLCmd = &cobra.Command{
+	Use:   "url <url>",
+	Short: "Set the URL for the current context",
+	Long:  ``,
+	Args:  cobra.ExactArgs(1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		conf, err := config.Init(access.CmdFlags.Omniconfig, false)
+		if err != nil {
+			return err
+		}
+
+		context, err := conf.GetContext(access.CmdFlags.Context)
+		if err != nil {
+			return err
+		}
+
+		context.URL = args[0]
+
+		return conf.Save()
+	},
+}
+
+// configIdentityCmd represents the `config identity` command.
+var configIdentityCmd = &cobra.Command{
+	Use:   "identity <identity>",
+	Short: "Set the auth identity for the current context",
+	Long:  ``,
+	Args:  cobra.ExactArgs(1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		conf, err := config.Init(access.CmdFlags.Omniconfig, false)
+		if err != nil {
+			return err
+		}
+
+		context, err := conf.GetContext(access.CmdFlags.Context)
+		if err != nil {
+			return err
+		}
+
+		context.Auth.SideroV1.Identity = args[0]
+
+		return conf.Save()
+	},
+}
+
+// configContextCmd represents the `config context` command.
+var configContextCmd = &cobra.Command{
+	Use:     "context <context>",
+	Short:   "Set the current context",
+	Aliases: []string{"use-context"},
+	Long:    ``,
+	Args:    cobra.ExactArgs(1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		conf, err := config.Init(access.CmdFlags.Omniconfig, false)
+		if err != nil {
+			return err
+		}
+
+		context := args[0]
+
+		conf.Context = context
+
+		return conf.Save()
+	},
+	ValidArgsFunction: CompleteConfigContext,
+}
+
+// configAddCmdFlags represents the `config add` command flags.
+var configAddCmdFlags struct {
+	url      string
+	httpURL  string
+	identity string
+}
+
+// configAddCmd represents the `config add` command.
+var configAddCmd = &cobra.Command{
+	Use:   "add <context>",
+	Short: "Add a new context",
+	Long:  ``,
+	Args:  cobra.ExactArgs(1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		conf, err := config.Init(access.CmdFlags.Omniconfig, true)
+		if err != nil {
+			return err
+		}
+
+		name := args[0]
+
+		_, alreadyExists := conf.Contexts[name]
+		if alreadyExists {
+			return fmt.Errorf("context %s already exists", name)
+		}
+
+		newContext := config.Context{
+			URL: configAddCmdFlags.url,
+			Auth: config.Auth{
+				SideroV1: config.SideroV1{
+					Identity: configAddCmdFlags.identity,
+				},
+			},
+		}
+
+		conf.Contexts[name] = &newContext
+
+		return conf.Save()
+	},
+}
+
+// configGetContextsCmd represents the `config contexts` command.
+var configGetContextsCmd = &cobra.Command{
+	Use:     "contexts",
+	Short:   "List defined contexts",
+	Aliases: []string{"get-contexts"},
+	Long:    ``,
+	RunE: func(*cobra.Command, []string) error {
+		conf, err := config.Init(access.CmdFlags.Omniconfig, false)
+		if err != nil {
+			return err
+		}
+
+		keys := maps.Keys(conf.Contexts)
+		slices.Sort(keys)
+
+		w := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
+		defer w.Flush() //nolint:errcheck
+
+		_, err = fmt.Fprintln(w, "CURRENT\tNAME\tURL")
+		if err != nil {
+			return err
+		}
+
+		for _, name := range keys {
+			context := conf.Contexts[name]
+
+			var current string
+
+			if name == conf.Context {
+				current = "*"
+			}
+
+			_, err = fmt.Fprintf(w, "%s\t%s\t%s\n", current, name, context.URL)
+			if err != nil {
+				return err
+			}
+		}
+
+		return nil
+	},
+}
+
+// configMergeCmd represents the `config merge` command.
+var configMergeCmd = &cobra.Command{
+	Use:   "merge <from>",
+	Short: "Merge additional contexts from another client configuration file",
+	Long:  "Contexts with the same name are renamed while merging configs.",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		conf, err := config.Init(access.CmdFlags.Omniconfig, true)
+		if err != nil {
+			return err
+		}
+
+		renames, err := conf.Merge(args[0])
+		if err != nil {
+			return err
+		}
+
+		for _, rename := range renames {
+			fmt.Printf("renamed omniconfig context %s\n", rename.String())
+		}
+
+		return conf.Save()
+	},
+}
+
+// configNewCmdFlags represents the `config new` command flags.
+var configNewCmdFlags struct {
+	url      string
+	httpURL  string
+	identity string
+}
+
+// configNewCmd represents the `config new` command.
+var configNewCmd = &cobra.Command{
+	Use:   "new [<path>]",
+	Short: "Generate a new client configuration file",
+	Args:  cobra.RangeArgs(0, 1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		path := ""
+		if len(args) > 0 {
+			path = args[0]
+		}
+
+		conf, err := config.Init(path, true)
+		if err != nil {
+			return err
+		}
+
+		context, err := conf.GetContext(access.CmdFlags.Context)
+		if err != nil {
+			return err
+		}
+
+		context.URL = configNewCmdFlags.url
+		context.Auth.SideroV1.Identity = configNewCmdFlags.identity
+
+		return conf.Save()
+	},
+}
+
+// configInfoCmdTemplate represents the `config info` command output template.
+var configInfoCmdTemplate = template.Must(template.New("configInfoCmdTemplate").
+	Option("missingkey=error").
+	Parse(strings.TrimSpace(`
+Current context: {{ .Context }}
+URL:             {{ .APIURL }}
+Identity:        {{ .Identity }}
+`)))
+
+// configInfoCmd represents the `config info` command.
+var configInfoCmd = &cobra.Command{
+	Use:   "info",
+	Short: "Show information about the current context",
+	Args:  cobra.NoArgs,
+	RunE: func(*cobra.Command, []string) error {
+		conf, err := config.Init(access.CmdFlags.Omniconfig, false)
+		if err != nil {
+			return err
+		}
+
+		var result string
+
+		context, err := conf.GetContext(access.CmdFlags.Context)
+		if err != nil {
+			return err
+		}
+
+		var buf bytes.Buffer
+		err = configInfoCmdTemplate.Execute(&buf, map[string]string{
+			"Context":  conf.Context,
+			"APIURL":   context.URL,
+			"Identity": context.Auth.SideroV1.Identity,
+		})
+		if err != nil {
+			return err
+		}
+
+		result = buf.String() + "\n"
+
+		fmt.Print(result)
+
+		return nil
+	},
+}
+
+// CompleteConfigContext represents tab completion for `--context` argument and `config context` command.
+func CompleteConfigContext(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
+	conf, err := config.Init(access.CmdFlags.Omniconfig, false)
+	if err != nil {
+		return nil, 0
+	}
+
+	contextNames := maps.Keys(conf.Contexts)
+	slices.Sort(contextNames)
+
+	return contextNames, cobra.ShellCompDirectiveNoFileComp
+}
+
+func init() {
+	configCmd.AddCommand(
+		configURLCmd,
+		configIdentityCmd,
+		configContextCmd,
+		configAddCmd,
+		configGetContextsCmd,
+		configMergeCmd,
+		configNewCmd,
+		configInfoCmd,
+	)
+
+	configAddCmd.Flags().StringVar(&configAddCmdFlags.url, "url", config.DefaultContext.URL, "URL of the server")
+	configAddCmd.Flags().StringVar(&configAddCmdFlags.identity, "identity", "", "identity to use for authentication")
+
+	configNewCmd.Flags().StringVar(&configNewCmdFlags.url, "url", config.DefaultContext.URL, "URL of the server")
+	configNewCmd.Flags().StringVar(&configNewCmdFlags.identity, "identity", "", "identity to use for authentication")
+
+	RootCmd.AddCommand(configCmd)
+}
diff --git a/client/pkg/omnictl/config/config.go b/client/pkg/omnictl/config/config.go
new file mode 100644
index 000000000..0c49d1222
--- /dev/null
+++ b/client/pkg/omnictl/config/config.go
@@ -0,0 +1,196 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package config implements the config file logic.
+package config
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/adrg/xdg"
+	"gopkg.in/yaml.v3"
+)
+
+const (
+	// OmniConfigEnvVar is the environment variable to override the default config path.
+	OmniConfigEnvVar = "OMNICONFIG"
+
+	relativePath       = "omni/config"
+	defaultContextName = "default"
+)
+
+var (
+	// DefaultContext is the context with the default values.
+	DefaultContext = Context{
+		URL: "grpc://127.0.0.1:8080",
+	}
+
+	defaultConfig = Config{
+		Context: defaultContextName,
+		Contexts: map[string]*Context{
+			defaultContextName: &DefaultContext,
+		},
+	}
+
+	current *Config
+)
+
+// Init initializes the Current config and returns it.
+func Init(path string, create bool) (*Config, error) {
+	conf, err := load(path)
+
+	if os.IsNotExist(err) {
+		if !create {
+			return nil, err
+		}
+
+		defaultConfig.Path = path
+
+		err := defaultConfig.Save()
+		if err != nil {
+			return nil, err
+		}
+
+		conf = &defaultConfig
+	}
+
+	current = conf
+
+	return current, nil
+}
+
+// load the config from the given explicit path or defaults to the known default config paths.
+func load(path string) (*Config, error) {
+	var err error
+
+	if path == "" {
+		path, err = defaultPath()
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	bytes, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+
+	var config Config
+
+	err = yaml.Unmarshal(bytes, &config)
+	if err != nil {
+		return nil, err
+	}
+
+	config.Path = path
+
+	return &config, nil
+}
+
+// Save saves the config to the path it is configured to, or defaults to the known default config paths.
+// It modifies the Path to point to the saved file.
+func (c *Config) Save() error {
+	var err error
+
+	path := c.Path
+	if path == "" {
+		path, err = defaultPath()
+		if err != nil {
+			return err
+		}
+	}
+
+	bytes, err := yaml.Marshal(c)
+	if err != nil {
+		return err
+	}
+
+	err = os.WriteFile(path, bytes, 0o600)
+	if err != nil {
+		return err
+	}
+
+	c.Path = path
+
+	return err
+}
+
+// Current returns the currently targeted config.
+func Current() (*Config, error) {
+	if current == nil {
+		return nil, fmt.Errorf("config not initialized")
+	}
+
+	return current, nil
+}
+
+// GetContext returns the context with the given name. If empty, it will return the selected context in the config file.
+func (c *Config) GetContext(name string) (*Context, error) {
+	if name == "" {
+		name = c.Context
+	}
+
+	context, ok := c.Contexts[name]
+	if !ok {
+		return nil, fmt.Errorf("context not found: %s", name)
+	}
+
+	return context, nil
+}
+
+// Merge in additional contexts from another Config.
+//
+// Current context is overridden from passed in config.
+func (c *Config) Merge(additionalConfigPath string) ([]Rename, error) {
+	if additionalConfigPath == "" {
+		return nil, fmt.Errorf("additional config path is empty")
+	}
+
+	cfg, err := load(additionalConfigPath)
+	if err != nil {
+		return nil, err
+	}
+
+	mappedContexts := map[string]string{}
+
+	var renames []Rename
+
+	for name, ctx := range cfg.Contexts {
+		mergedName := name
+
+		if _, exists := c.Contexts[mergedName]; exists {
+			for i := 1; ; i++ {
+				mergedName = fmt.Sprintf("%s-%d", name, i)
+
+				if _, ctxExists := c.Contexts[mergedName]; !ctxExists {
+					break
+				}
+			}
+		}
+
+		mappedContexts[name] = mergedName
+
+		if name != mergedName {
+			renames = append(renames, Rename{name, mergedName})
+		}
+
+		c.Contexts[mergedName] = ctx
+	}
+
+	if cfg.Context != "" {
+		c.Context = mappedContexts[cfg.Context]
+	}
+
+	return renames, nil
+}
+
+func defaultPath() (string, error) {
+	path := os.Getenv(OmniConfigEnvVar)
+	if path != "" {
+		return path, nil
+	}
+
+	return xdg.ConfigFile(relativePath)
+}
diff --git a/client/pkg/omnictl/config/rename.go b/client/pkg/omnictl/config/rename.go
new file mode 100644
index 000000000..f8d6c77f8
--- /dev/null
+++ b/client/pkg/omnictl/config/rename.go
@@ -0,0 +1,18 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package config
+
+import "fmt"
+
+// Rename describes context rename during merge.
+type Rename struct {
+	From string
+	To   string
+}
+
+// String converts to "from" -> "to".
+func (r *Rename) String() string {
+	return fmt.Sprintf("%s -> %s", r.From, r.To)
+}
diff --git a/client/pkg/omnictl/config/types.go b/client/pkg/omnictl/config/types.go
new file mode 100644
index 000000000..a899d1e63
--- /dev/null
+++ b/client/pkg/omnictl/config/types.go
@@ -0,0 +1,33 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package config
+
+// Config represents the omni configuration.
+type Config struct {
+	Contexts map[string]*Context `yaml:"contexts"`
+	Context  string              `yaml:"context"`
+	Path     string              `yaml:"-"`
+}
+
+// Context represents a context in the config.
+type Context struct {
+	URL  string `yaml:"url"`
+	Auth Auth   `yaml:"auth,omitempty"`
+}
+
+// Auth contains the authentication configuration for a context.
+type Auth struct {
+	// Deprecated: basic auth is not supported, and setting this field has no effect.
+	Basic    string   `yaml:"basic,omitempty"`
+	SideroV1 SideroV1 `yaml:"siderov1,omitempty"`
+}
+
+// SideroV1 is the auth configuration v1.
+type SideroV1 struct {
+	Identity string `yaml:"identity,omitempty"`
+}
+
+// PlaceholderURL is a placeholder url.
+const PlaceholderURL = "<placeholder_url>"
diff --git a/client/pkg/omnictl/delete.go b/client/pkg/omnictl/delete.go
new file mode 100644
index 000000000..954658035
--- /dev/null
+++ b/client/pkg/omnictl/delete.go
@@ -0,0 +1,162 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omnictl
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/cosi/labels"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+)
+
+var deleteCmdFlags struct {
+	namespace string
+	selector  string
+	all       bool
+}
+
+// deleteCmd represents the delete (resources) command.
+var deleteCmd = &cobra.Command{
+	Use:     "delete <type> [<id>]",
+	Aliases: []string{"d"},
+	Short:   "Delete a specific resource by ID or all resources of the type.",
+	Long:    `Similar to 'kubectl delete', 'omnictl delete' initiates resource deletion and waits for the operation to complete.`,
+	Example: "",
+	Args:    cobra.RangeArgs(1, 2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return access.WithClient(deleteResources(cmd, args))
+	},
+}
+
+//nolint:gocognit,gocyclo,cyclop
+func deleteResources(cmd *cobra.Command, args []string) func(ctx context.Context, client *client.Client) error {
+	return func(ctx context.Context, client *client.Client) error {
+		st := client.Omni().State()
+
+		resourceType := resource.Type(args[0]) //nolint:unconvert
+
+		rd, err := resolveResourceType(ctx, st, resourceType)
+		if err != nil {
+			return err
+		}
+
+		if !cmd.Flags().Lookup("namespace").Changed {
+			deleteCmdFlags.namespace = rd.TypedSpec().DefaultNamespace
+		}
+
+		var resourceIDs []resource.ID
+
+		if len(args) > 1 {
+			resourceIDs = []resource.ID{args[1]}
+		} else {
+			var listOpts []state.ListOption
+
+			if !deleteCmdFlags.all && deleteCmdFlags.selector == "" {
+				return fmt.Errorf("either resource ID or one of --all or --selector flags must be specified")
+			}
+
+			if deleteCmdFlags.selector != "" {
+				var query *resource.LabelQuery
+
+				query, err = labels.ParseQuery(deleteCmdFlags.selector)
+				if err != nil {
+					return err
+				}
+
+				listOpts = append(listOpts, state.WithLabelQuery(resource.RawLabelQuery(*query)))
+			}
+
+			var list resource.List
+
+			list, err = st.List(ctx, resource.NewMetadata(deleteCmdFlags.namespace, rd.TypedSpec().Type, "", resource.VersionUndefined), listOpts...)
+			if err != nil {
+				return err
+			}
+
+			resourceIDs = make([]resource.ID, 0, len(list.Items))
+
+			for _, item := range list.Items {
+				resourceIDs = append(resourceIDs, item.Metadata().ID())
+			}
+		}
+
+		// teardown all resources
+		for _, resourceID := range resourceIDs {
+			_, err = st.Teardown(ctx, resource.NewMetadata(deleteCmdFlags.namespace, rd.TypedSpec().Type, resourceID, resource.VersionUndefined))
+			if err != nil {
+				return err
+			}
+
+			fmt.Printf("torn down %s %s\n", rd.TypedSpec().Type, resourceID)
+		}
+
+		// set up a watch for all resources of kind
+		watchCh := make(chan state.Event)
+
+		for _, resourceID := range resourceIDs {
+			err = st.Watch(ctx, resource.NewMetadata(deleteCmdFlags.namespace, rd.TypedSpec().Type, resourceID, resource.VersionUndefined), watchCh)
+			if err != nil {
+				return err
+			}
+		}
+
+		resourceIDsLeft := map[resource.ID]struct{}{}
+
+		for _, resourceID := range resourceIDs {
+			resourceIDsLeft[resourceID] = struct{}{}
+		}
+
+		// until some resources are not deleted yet...
+		for len(resourceIDsLeft) > 0 {
+			var event state.Event
+
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			case event = <-watchCh:
+			}
+
+			switch event.Type {
+			case state.Destroyed:
+				delete(resourceIDsLeft, event.Resource.Metadata().ID())
+			case state.Created, state.Updated:
+				if _, ours := resourceIDsLeft[event.Resource.Metadata().ID()]; !ours {
+					continue
+				}
+
+				if event.Resource.Metadata().Phase() == resource.PhaseTearingDown && event.Resource.Metadata().Finalizers().Empty() {
+					if err = st.Destroy(ctx, event.Resource.Metadata()); err != nil && !state.IsNotFoundError(err) {
+						return err
+					}
+
+					fmt.Printf("destroyed %s %s\n", rd.TypedSpec().Type, event.Resource.Metadata().ID())
+				}
+			case state.Bootstrapped:
+				// ignore
+			case state.Errored:
+				return fmt.Errorf("error watching for resource deletion: %w", event.Error)
+			}
+		}
+
+		return nil
+	}
+}
+
+func init() {
+	deleteCmd.PersistentFlags().StringVarP(&deleteCmdFlags.namespace, "namespace", "n", resources.DefaultNamespace, "The resource namespace.")
+	deleteCmd.PersistentFlags().BoolVar(&deleteCmdFlags.all, "all", false, "Delete all resources of the type.")
+	deleteCmd.PersistentFlags().StringVarP(&deleteCmdFlags.selector, "selector", "l", "", "Selector (label query) to filter on, supports '=' and '==' (e.g. -l key1=value1,key2=value2)")
+
+	deleteCmd.MarkFlagsMutuallyExclusive("all", "selector")
+
+	RootCmd.AddCommand(deleteCmd)
+}
diff --git a/client/pkg/omnictl/docs.go b/client/pkg/omnictl/docs.go
new file mode 100644
index 000000000..2ccaab0ae
--- /dev/null
+++ b/client/pkg/omnictl/docs.go
@@ -0,0 +1,86 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omnictl
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/cobra/doc"
+)
+
+func frontmatter(title, description string) string {
+	frontmatter := "---\n"
+
+	frontmatter += "title: " + title + "\n"
+	frontmatter += "description: " + description + "\n"
+
+	frontmatter += "---\n\n"
+
+	return frontmatter + "<!-- markdownlint-disable -->\n\n"
+}
+
+func linkHandler(name string) string {
+	base := strings.TrimSuffix(name, path.Ext(name))
+
+	base = strings.ReplaceAll(base, "_", "-")
+
+	return "#" + strings.ToLower(base)
+}
+
+// docsCmd represents the docs command.
+var docsCmd = &cobra.Command{
+	Use:    "docs <output> [flags]",
+	Short:  "Generate documentation for the CLI",
+	Long:   ``,
+	Args:   cobra.ExactArgs(1),
+	Hidden: true,
+	RunE: func(_ *cobra.Command, args []string) error {
+		dir := args[0]
+
+		filename := filepath.Join(dir, "cli.md")
+		f, err := os.Create(filename)
+		if err != nil {
+			return err
+		}
+		//nolint:errcheck
+		defer f.Close()
+
+		if _, err = f.WriteString(frontmatter("omnictl CLI", "omnictl CLI tool reference.")); err != nil {
+			return err
+		}
+
+		if err = GenMarkdownReference(RootCmd, f, linkHandler); err != nil {
+			return fmt.Errorf("failed to generate docs: %w", err)
+		}
+
+		return nil
+	},
+}
+
+// GenMarkdownReference is the same as GenMarkdownTree, but
+// with custom filePrepender and linkHandler.
+func GenMarkdownReference(cmd *cobra.Command, w io.Writer, linkHandler func(string) string) error {
+	for _, c := range cmd.Commands() {
+		if !c.IsAvailableCommand() || c.IsAdditionalHelpTopicCommand() {
+			continue
+		}
+
+		if err := GenMarkdownReference(c, w, linkHandler); err != nil {
+			return err
+		}
+	}
+
+	return doc.GenMarkdownCustom(cmd, w, linkHandler)
+}
+
+func init() {
+	RootCmd.AddCommand(docsCmd)
+}
diff --git a/client/pkg/omnictl/download.go b/client/pkg/omnictl/download.go
new file mode 100644
index 000000000..6c6acdb9a
--- /dev/null
+++ b/client/pkg/omnictl/download.go
@@ -0,0 +1,585 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omnictl
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"mime"
+	"net/http"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/go-api-signature/pkg/message"
+	pgpclient "github.com/siderolabs/go-api-signature/pkg/pgp/client"
+	"github.com/siderolabs/go-api-signature/pkg/serviceaccount"
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/api/omni/management"
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/meta"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omnictl/config"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+)
+
+// downloadFlags represents the `download` command flags.
+type downloadFlags struct {
+	architecture string
+
+	output          string
+	talosVersion    string
+	labels          []string
+	extraKernelArgs []string
+	extensions      []string
+	pxe             bool
+	secureBoot      bool
+}
+
+var downloadCmdFlags downloadFlags
+
+func init() {
+	downloadCmd.Flags().BoolVar(&downloadCmdFlags.pxe, "pxe", false, "Print PXE URL and exit")
+	downloadCmd.Flags().BoolVar(&downloadCmdFlags.secureBoot, "secureboot", false, "Download SecureBoot enabled installation media")
+	downloadCmd.Flags().StringVar(&downloadCmdFlags.architecture, "arch", "amd64", "Image architecture to download (amd64, arm64)")
+	downloadCmd.Flags().StringVar(&downloadCmdFlags.output, "output", ".", "Output file or directory, defaults to current working directory")
+	downloadCmd.Flags().StringVar(&downloadCmdFlags.talosVersion, "talos-version", constants.DefaultTalosVersion, "Output file or directory, defaults to current working directory")
+	downloadCmd.Flags().StringArrayVar(&downloadCmdFlags.labels, "initial-labels", nil, "Bake initial labels into the generated installation media")
+	downloadCmd.Flags().StringArrayVar(&downloadCmdFlags.extraKernelArgs, "extra-kernel-args", nil, "Add extra kernel args to the generated installation media")
+	downloadCmd.Flags().StringArrayVar(&downloadCmdFlags.extensions, "extensions", nil, "Generate installation media with extensions pre-installed")
+
+	RootCmd.AddCommand(downloadCmd)
+}
+
+// downloadCmd represents the download command.
+var downloadCmd = &cobra.Command{
+	Use:   "download <image name>",
+	Short: "Download installer media",
+	Long: `This command downloads installer media from the server
+
+It accepts one argument, which is the name of the image to download. Name can be one of the following:
+
+     * iso - downloads the latest ISO image
+     * AWS AMI (amd64), Vultr (arm64), Raspberry Pi 4 Model B - full image name
+     * oracle, aws, vmware - platform name
+     * rpi_generic, rockpi_4c, rock64 - board name
+
+To get the full list of available images, look at the output of the following command:
+    omnictl get installationmedia -o yaml
+
+The download command tries to match the passed string in this order:
+
+    * name
+    * profile
+
+By default it will download amd64 image if there are multiple images available for the same name.
+
+For example, to download the latest ISO image for arm64, run:
+
+    omnictl download iso --arch amd64
+
+To download the latest Vultr image, run:
+
+    omnictl download "vultr"
+
+To download the latest Radxa ROCK PI 4 image, run:
+
+    omnictl download "rpi_generic"
+`,
+	Args: cobra.ExactArgs(1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		return access.WithClient(func(ctx context.Context, client *client.Client) error {
+			if args[0] == "" {
+				return fmt.Errorf("image name is required")
+			}
+
+			output, err := filepath.Abs(downloadCmdFlags.output)
+			if err != nil {
+				return err
+			}
+
+			err = makePath(output)
+			if err != nil {
+				return err
+			}
+
+			image, err := findImage(ctx, client, args[0], downloadCmdFlags.architecture)
+			if err != nil {
+				return err
+			}
+
+			return downloadImageTo(ctx, client, image, output)
+		})
+	},
+	ValidArgsFunction: downloadCompletion,
+}
+
+func findImage(ctx context.Context, client *client.Client, name, arch string) (*omni.InstallationMedia, error) {
+	result, err := filterMedia(ctx, client, func(val *omni.InstallationMedia) (*omni.InstallationMedia, bool) {
+		spec := val.TypedSpec().Value
+
+		if strings.EqualFold(name, "iso") {
+			return val, strings.Contains(strings.ToLower(spec.Name), strings.ToLower(name))
+		}
+
+		return val, strings.EqualFold(spec.Name, name) ||
+			strings.EqualFold(spec.Profile, name)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	if len(result) > 1 {
+		result = xslices.FilterInPlace(result, func(val *omni.InstallationMedia) bool {
+			return val.TypedSpec().Value.Architecture == arch
+		})
+	}
+
+	if len(result) == 0 {
+		return nil, fmt.Errorf("no image found for %q", name)
+	} else if len(result) > 1 {
+		names := xslices.Map(result, func(val *omni.InstallationMedia) string {
+			return val.Metadata().ID()
+		})
+
+		return nil, fmt.Errorf("multiple images found:\n  %s", strings.Join(names, "\n  "))
+	}
+
+	return result[0], nil
+}
+
+func createSchematic(ctx context.Context, client *client.Client) (*management.CreateSchematicResponse, error) {
+	metaValues := map[uint32]string{}
+
+	var extensions []string
+
+	if downloadCmdFlags.labels != nil {
+		labels, err := getMachineLabels()
+		if err != nil {
+			return nil, fmt.Errorf("failed to gen image labels: %w", err)
+		}
+
+		metaValues[meta.LabelsMeta] = string(labels)
+	}
+
+	var err error
+
+	if downloadCmdFlags.extensions != nil {
+		extensions, err = getExtensions(ctx, client)
+		if err != nil {
+			return nil, fmt.Errorf("failed to lookup extensions: %w", err)
+		}
+	}
+
+	resp, err := client.Management().CreateSchematic(ctx, &management.CreateSchematicRequest{
+		MetaValues:      metaValues,
+		ExtraKernelArgs: downloadCmdFlags.extraKernelArgs,
+		Extensions:      extensions,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to create schematic: %w", err)
+	}
+
+	return resp, nil
+}
+
+func downloadImageTo(ctx context.Context, client *client.Client, media *omni.InstallationMedia, output string) error {
+	schematicResp, err := createSchematic(ctx, client)
+	if err != nil {
+		return err
+	}
+
+	if media.TypedSpec().Value.NoSecureBoot && downloadCmdFlags.secureBoot {
+		return fmt.Errorf("%q doesn't support secure boot", media.TypedSpec().Value.Name)
+	}
+
+	if downloadCmdFlags.pxe {
+		var u *url.URL
+
+		u, err = url.Parse(schematicResp.PxeUrl)
+		if err != nil {
+			return err
+		}
+
+		url := u.JoinPath(downloadCmdFlags.talosVersion, media.TypedSpec().Value.SrcFilePrefix).String()
+
+		if downloadCmdFlags.secureBoot {
+			url += "-secureboot"
+		}
+
+		fmt.Println(url)
+
+		return nil
+	}
+
+	req, err := createRequest(ctx, client, schematicResp.SchematicId, media)
+	if err != nil {
+		return err
+	}
+
+	err = signRequest(req)
+	if err != nil {
+		return err
+	}
+
+	httpTransport := http.DefaultTransport
+
+	if access.CmdFlags.InsecureSkipTLSVerify {
+		defaultTransport, ok := http.DefaultTransport.(*http.Transport)
+		if !ok {
+			return fmt.Errorf("unexpected default transport type: %T", http.DefaultTransport)
+		}
+
+		defaultTransportClone := defaultTransport.Clone()
+		defaultTransportClone.TLSClientConfig.InsecureSkipVerify = true
+
+		httpTransport = defaultTransportClone
+	}
+
+	httpClient := &http.Client{
+		Transport: httpTransport,
+	}
+
+	fmt.Println("Generating the image...")
+
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return err
+	}
+
+	defer checkCloser(resp.Body)
+
+	if resp.StatusCode >= http.StatusBadRequest {
+		var message []byte
+
+		message, err = io.ReadAll(resp.Body)
+		if err != nil {
+			return err
+		}
+
+		return fmt.Errorf("failed to download the installation media, error code: %d, message: %s", resp.StatusCode, message)
+	}
+
+	dest := output
+
+	if filepath.Ext(output) == "" {
+		disposition := resp.Header.Get("Content-Disposition")
+
+		if disposition == "" {
+			return fmt.Errorf("no content disposition header in the server response")
+		}
+
+		var params map[string]string
+
+		_, params, err = mime.ParseMediaType(disposition)
+		if err != nil {
+			return fmt.Errorf("failed to parse content disposition header: %w", err)
+		}
+
+		filename, ok := params["filename"]
+		if !ok {
+			return fmt.Errorf("failed to auto-detect filename from the response headers, filename is not present in the content disposition header")
+		}
+
+		dest = filepath.Join(output, filename)
+	}
+
+	fmt.Printf("Downloading %s to %s\n", media.Metadata().ID(), dest)
+
+	err = downloadResponseTo(dest, resp)
+	if err != nil {
+		return err
+	}
+
+	fmt.Printf("Downloaded %s to %s\n", media.Metadata().ID(), dest)
+
+	return nil
+}
+
+func filterMedia[T any](ctx context.Context, client *client.Client, check func(value *omni.InstallationMedia) (T, bool)) ([]T, error) {
+	media, err := safe.StateListAll[*omni.InstallationMedia](
+		ctx,
+		client.Omni().State(),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	var result []T
+
+	for it := media.Iterator(); it.Next(); {
+		if val, ok := check(it.Value()); ok {
+			result = append(result, val)
+		}
+	}
+
+	return result, nil
+}
+
+func createRequest(ctx context.Context, client *client.Client, schematic string, image *omni.InstallationMedia) (*http.Request, error) {
+	u, err := url.Parse(client.Endpoint())
+	if err != nil {
+		return nil, err
+	}
+
+	u.Scheme = "https"
+
+	u.Path, err = url.JoinPath(u.Path, "image", schematic, downloadCmdFlags.talosVersion, image.Metadata().ID())
+	if err != nil {
+		return nil, err
+	}
+
+	if downloadCmdFlags.secureBoot {
+		query := u.Query()
+		query.Add(constants.SecureBoot, "true")
+
+		u.RawQuery = query.Encode()
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return req, err
+}
+
+func signRequest(req *http.Request) error {
+	identity, signer, err := getSigner()
+	if err != nil {
+		return err
+	}
+
+	msg, err := message.NewHTTP(req)
+	if err != nil {
+		return err
+	}
+
+	return msg.Sign(identity, signer)
+}
+
+// getSigner returns the identity and the signer to use for signing the request.
+//
+// It can be a service account or a user key.
+func getSigner() (identity string, signer message.Signer, err error) {
+	envKey, valueBase64 := serviceaccount.GetFromEnv()
+	if envKey != "" {
+		sa, saErr := serviceaccount.Decode(valueBase64)
+		if saErr != nil {
+			return "", nil, saErr
+		}
+
+		return sa.Name, sa.Key, nil
+	}
+
+	contextName, configCtx, err := currentConfigCtx()
+	if err != nil {
+		return "", nil, err
+	}
+
+	provider := pgpclient.NewKeyProvider("omni/keys")
+
+	key, keyErr := provider.ReadValidKey(contextName, configCtx.Auth.SideroV1.Identity)
+	if keyErr != nil {
+		return "", nil, fmt.Errorf("failed to read key: %w", err)
+	}
+
+	return configCtx.Auth.SideroV1.Identity, key, nil
+}
+
+func getMachineLabels() ([]byte, error) {
+	labels := map[string]string{}
+
+	for _, l := range downloadCmdFlags.labels {
+		parts := strings.Split(l, "=")
+		if len(parts) > 2 {
+			return nil, fmt.Errorf("malformed label %s", l)
+		}
+
+		value := ""
+
+		if len(parts) > 1 {
+			value = parts[1]
+		}
+
+		labels[parts[0]] = value
+	}
+
+	return json.Marshal(labels)
+}
+
+func getExtensions(ctx context.Context, client *client.Client) ([]string, error) {
+	extensions, err := safe.StateGet[*omni.TalosExtensions](
+		ctx,
+		client.Omni().State(),
+		omni.NewTalosExtensions(resources.DefaultNamespace, strings.TrimLeft(downloadCmdFlags.talosVersion, "v")).Metadata(),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get extensions for talos version %q: %w", downloadCmdFlags.talosVersion, err)
+	}
+
+	result := make([]string, 0, len(downloadCmdFlags.extensions))
+
+	for _, extension := range downloadCmdFlags.extensions {
+		items := xslices.Map(extensions.TypedSpec().Value.Items, func(e *specs.TalosExtensionsSpec_Info) string {
+			return e.Name
+		})
+
+		items = xslices.FilterInPlace(items, func(item string) bool {
+			if strings.Contains(item, extension) {
+				fmt.Printf("Install Extension: %s\n", item)
+
+				return true
+			}
+
+			return false
+		})
+
+		if len(items) == 0 {
+			return nil, fmt.Errorf("failed to find extension with name %q for talos version %q", extension, downloadCmdFlags.talosVersion)
+		}
+
+		result = append(result, items...)
+	}
+
+	return result, nil
+}
+
+func currentConfigCtx() (name string, ctx *config.Context, err error) {
+	conf, err := config.Current()
+	if err != nil {
+		return "", nil, err
+	}
+
+	contextName := conf.Context
+	if access.CmdFlags.Context != "" {
+		contextName = access.CmdFlags.Context
+	}
+
+	configCtx, err := conf.GetContext(contextName)
+	if err != nil {
+		return "", nil, err
+	}
+
+	return contextName, configCtx, nil
+}
+
+func downloadResponseTo(dest string, resp *http.Response) error {
+	f, err := os.Create(dest)
+	if err != nil {
+		return err
+	}
+
+	defer checkCloser(f)
+
+	_, err = io.Copy(f, resp.Body)
+
+	return err
+}
+
+func checkCloser(c io.Closer) {
+	if err := c.Close(); err != nil {
+		fmt.Printf("error closing: %v", err)
+	}
+}
+
+func downloadCompletion(_ *cobra.Command, _ []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	var results []string
+
+	err := access.WithClient(
+		func(ctx context.Context, client *client.Client) error {
+			res, err := filterMedia(ctx, client, func(value *omni.InstallationMedia) (string, bool) {
+				spec := value.TypedSpec().Value
+				if downloadCmdFlags.architecture != spec.Architecture {
+					return "", false
+				}
+
+				name := spec.Name
+				if toComplete == "" || strings.Contains(name, toComplete) {
+					return name, true
+				}
+
+				return "", false
+			})
+			if err != nil {
+				return err
+			}
+
+			results = res
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, cobra.ShellCompDirectiveError
+	}
+
+	return dedupInplace(results), cobra.ShellCompDirectiveNoFileComp
+}
+
+func dedupInplace(results []string) []string {
+	seen := make(map[string]struct{}, len(results))
+	j := 0
+
+	for _, r := range results {
+		if _, ok := seen[r]; !ok {
+			seen[r] = struct{}{}
+			results[j] = r
+			j++
+		}
+	}
+
+	return results[:j]
+}
+
+func makePath(path string) error {
+	if filepath.Ext(path) != "" {
+		ok, err := checkPath(path)
+		if err != nil {
+			return err
+		}
+
+		if ok {
+			return fmt.Errorf("destination %s already exists", path)
+		}
+
+		path = filepath.Dir(path)
+	}
+
+	ok, err := checkPath(path)
+	if err != nil {
+		return err
+	}
+
+	if !ok {
+		if dirErr := os.MkdirAll(path, 0o755); dirErr != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func checkPath(path string) (bool, error) {
+	_, err := os.Stat(path)
+
+	switch {
+	case os.IsNotExist(err):
+		return false, nil
+	case err != nil:
+		return false, err
+	default:
+		return true, nil
+	}
+}
diff --git a/client/pkg/omnictl/get.go b/client/pkg/omnictl/get.go
new file mode 100644
index 000000000..678e3c564
--- /dev/null
+++ b/client/pkg/omnictl/get.go
@@ -0,0 +1,237 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omnictl
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/cosi/labels"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+	"github.com/siderolabs/omni/client/pkg/omnictl/output"
+)
+
+var getCmdFlags struct {
+	namespace string
+	output    string
+	selector  string
+	idRegexp  string
+	watch     bool
+}
+
+// getCmd represents the get (resources) command.
+var getCmd = &cobra.Command{
+	Use:     "get <type> [<id>]",
+	Aliases: []string{"g"},
+	Short:   "Get a specific resource or list of resources.",
+	Long: `Similar to 'kubectl get', 'omnictl get' returns a set of resources from the OS.
+To get a list of all available resource definitions, issue 'omnictl get rd'`,
+	Example: "",
+	Args:    cobra.RangeArgs(1, 2),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return access.WithClient(getResources(cmd, args))
+	},
+}
+
+//nolint:gocognit,gocyclo,cyclop,maintidx
+func getResources(cmd *cobra.Command, args []string) func(ctx context.Context, client *client.Client) error {
+	return func(ctx context.Context, client *client.Client) error {
+		st := client.Omni().State()
+
+		var (
+			resourceType = resource.Type(args[0]) //nolint:unconvert
+			resourceID   resource.ID
+		)
+
+		if len(args) > 1 {
+			resourceID = args[1]
+		}
+
+		rd, err := resolveResourceType(ctx, st, resourceType)
+		if err != nil {
+			return err
+		}
+
+		if !cmd.Flags().Lookup("namespace").Changed {
+			getCmdFlags.namespace = rd.TypedSpec().DefaultNamespace
+		}
+
+		var labelQuery []resource.LabelQueryOption
+
+		if getCmdFlags.selector != "" {
+			if resourceID != "" {
+				return fmt.Errorf("cannot specify both resource ID and selector")
+			}
+
+			var query *resource.LabelQuery
+
+			query, err = labels.ParseQuery(getCmdFlags.selector)
+			if err != nil {
+				return err
+			}
+
+			labelQuery = append(labelQuery, resource.RawLabelQuery(*query))
+		}
+
+		var idQuery []resource.IDQueryOption
+
+		if getCmdFlags.idRegexp != "" {
+			if resourceID != "" {
+				return fmt.Errorf("cannot specify both resource ID and ID regexp")
+			}
+
+			var idRegexp *regexp.Regexp
+
+			idRegexp, err = regexp.Compile(getCmdFlags.idRegexp)
+			if err != nil {
+				return fmt.Errorf("invalid ID regexp: %w", err)
+			}
+
+			idQuery = append(idQuery, resource.IDRegexpMatch(idRegexp))
+		}
+
+		out, err := output.NewWriter(getCmdFlags.output)
+		if err != nil {
+			return err
+		}
+
+		defer out.Flush() //nolint:errcheck
+
+		if err = out.WriteHeader(rd, getCmdFlags.watch); err != nil {
+			return err
+		}
+
+		md := resource.NewMetadata(getCmdFlags.namespace, rd.TypedSpec().Type, resourceID, resource.VersionUndefined)
+
+		switch {
+		case resourceID == "" && !getCmdFlags.watch:
+			items, err := st.List(ctx, md,
+				state.WithLabelQuery(labelQuery...),
+				state.WithIDQuery(idQuery...),
+			)
+			if err != nil {
+				return err
+			}
+
+			for _, item := range items.Items {
+				if err = out.WriteResource(item, state.EventType(0)); err != nil {
+					return err
+				}
+			}
+		case resourceID == "" && getCmdFlags.watch:
+			watchCh := make(chan state.Event)
+
+			err := st.WatchKind(ctx, md, watchCh,
+				state.WithBootstrapContents(true),
+				state.WatchWithLabelQuery(labelQuery...),
+				state.WatchWithIDQuery(idQuery...),
+			)
+			if err != nil {
+				return err
+			}
+
+			bootstrapped := false
+
+		watchLoopKind:
+			for {
+				select {
+				case e := <-watchCh:
+					if e.Type == state.Errored {
+						return fmt.Errorf("watch error: %w", e.Error)
+					}
+
+					if e.Type == state.Bootstrapped {
+						bootstrapped = true
+
+						if err = out.Flush(); err != nil {
+							return err
+						}
+
+						continue
+					}
+
+					if e.Resource == nil {
+						continue
+					}
+
+					if err = out.WriteResource(e.Resource, e.Type); err != nil {
+						return err
+					}
+
+					if bootstrapped {
+						if err = out.Flush(); err != nil {
+							return err
+						}
+					}
+				case <-ctx.Done():
+					break watchLoopKind
+				}
+			}
+		case resourceID != "" && !getCmdFlags.watch:
+			res, err := st.Get(ctx, md)
+			if err != nil {
+				return err
+			}
+
+			if err = out.WriteResource(res, state.EventType(0)); err != nil {
+				return err
+			}
+		case resourceID != "" && getCmdFlags.watch:
+			watchCh := make(chan state.Event)
+
+			err := st.Watch(ctx, md, watchCh)
+			if err != nil {
+				return err
+			}
+
+		watchLoop:
+			for {
+				select {
+				case e := <-watchCh:
+					if e.Type == state.Errored {
+						return fmt.Errorf("watch error: %w", e.Error)
+					}
+
+					if e.Resource == nil {
+						continue
+					}
+
+					if err = out.WriteResource(e.Resource, e.Type); err != nil {
+						return err
+					}
+
+					if err = out.Flush(); err != nil {
+						return err
+					}
+				case <-ctx.Done():
+					break watchLoop
+				}
+			}
+		}
+
+		return nil
+	}
+}
+
+func init() {
+	getCmd.PersistentFlags().StringVarP(&getCmdFlags.namespace, "namespace", "n", resources.DefaultNamespace, "The resource namespace.")
+	getCmd.PersistentFlags().BoolVarP(&getCmdFlags.watch, "watch", "w", false, "Watch the resource state.")
+	getCmd.PersistentFlags().StringVarP(&getCmdFlags.output, "output", "o", "table", "Output format (json, table, yaml, jsonpath).")
+	getCmd.PersistentFlags().StringVarP(&getCmdFlags.selector, "selector", "l", "", "Selector (label query) to filter on, supports '=' and '==' (e.g. -l key1=value1,key2=value2)")
+	getCmd.PersistentFlags().StringVar(&getCmdFlags.idRegexp, "id-match-regexp", "", "Match resource ID against a regular expression.")
+
+	if err := getCmd.RegisterFlagCompletionFunc("output", output.CompleteOutputArg); err != nil {
+		panic(err)
+	}
+
+	RootCmd.AddCommand(getCmd)
+}
diff --git a/client/pkg/omnictl/internal/access/access.go b/client/pkg/omnictl/internal/access/access.go
new file mode 100644
index 000000000..00b5d4bd8
--- /dev/null
+++ b/client/pkg/omnictl/internal/access/access.go
@@ -0,0 +1,6 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package access contains commands related to API access for the CLI.
+package access
diff --git a/client/pkg/omnictl/internal/access/client.go b/client/pkg/omnictl/internal/access/client.go
new file mode 100644
index 000000000..bbdbe8fa4
--- /dev/null
+++ b/client/pkg/omnictl/internal/access/client.go
@@ -0,0 +1,139 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package access
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
+	"github.com/siderolabs/omni/client/pkg/omnictl/config"
+	"github.com/siderolabs/omni/client/pkg/version"
+)
+
+const (
+	// EndpointEnvVar is the name of the environment variable that contains the Omni endpoint.
+	EndpointEnvVar = "OMNI_ENDPOINT"
+)
+
+type clientOptions struct {
+	skipAuth bool
+}
+
+// ClientOption is a functional option for the client.
+type ClientOption func(*clientOptions)
+
+// WithSkipAuth configures the client to skip the authentication interception.
+func WithSkipAuth(skipAuth bool) ClientOption {
+	return func(o *clientOptions) {
+		o.skipAuth = skipAuth
+	}
+}
+
+// WithClient initializes the Omni API client.
+func WithClient(f func(ctx context.Context, client *client.Client) error, clientOpts ...ClientOption) error {
+	_, err := config.Init(CmdFlags.Omniconfig, true)
+	if err != nil {
+		return err
+	}
+
+	cliOpts := clientOptions{}
+
+	for _, opt := range clientOpts {
+		opt(&cliOpts)
+	}
+
+	return WithContext(func(ctx context.Context) error {
+		opts := []client.Option{
+			client.WithInsecureSkipTLSVerify(CmdFlags.InsecureSkipTLSVerify),
+		}
+
+		conf, err := config.Current()
+		if err != nil {
+			return err
+		}
+
+		contextName := conf.Context
+		if CmdFlags.Context != "" {
+			contextName = CmdFlags.Context
+		}
+
+		configCtx, err := conf.GetContext(CmdFlags.Context)
+		if err != nil {
+			return err
+		}
+
+		if configCtx.Auth.Basic != "" { //nolint:staticcheck
+			fmt.Fprintf(os.Stderr, "[WARN] basic auth is deprecated and has no effect\n")
+		}
+
+		opts = append(opts, client.WithUserAccount(contextName, configCtx.Auth.SideroV1.Identity))
+
+		if configCtx.URL == config.PlaceholderURL {
+			return fmt.Errorf("context %q has not been configured, you will need to set it manually", contextName)
+		}
+
+		url := configCtx.URL
+
+		endpointEnv := os.Getenv(EndpointEnvVar)
+		if endpointEnv != "" {
+			url = endpointEnv
+		}
+
+		client, err := client.New(ctx, url, opts...)
+		if err != nil {
+			return err
+		}
+
+		if !cliOpts.skipAuth {
+			// bootstrap the client, and perform auth/re-auth if needed via the unary call
+			// stream interceptor can't catch the auth error, as it comes async
+			_, err = client.Omni().State().Get(ctx, resource.NewMetadata(resources.EphemeralNamespace, system.SysVersionType, system.SysVersionID, resource.VersionUndefined))
+			if err != nil {
+				return err
+			}
+		}
+
+		if err = checkVersion(ctx, client.Omni().State()); err != nil {
+			return err
+		}
+
+		return f(ctx, client)
+	})
+}
+
+func checkVersion(ctx context.Context, state state.State) error {
+	if version.API == 0 && !version.SuppressVersionWarning {
+		fmt.Println(`[WARN] github.com/siderolabs/omni/client/pkg/version.API is not set, client-server version validation is disabled.
+If you want to enable the version validation and disable this warning, set github.com/siderolabs/omni/client/pkg/version.SuppressVersionWarning to true.`)
+
+		return nil
+	}
+
+	sysVersion, err := safe.StateGet[*system.SysVersion](ctx, state, system.NewSysVersion(resources.EphemeralNamespace, system.SysVersionID).Metadata())
+	if err != nil {
+		return err
+	}
+
+	if sysVersion.TypedSpec().Value.BackendApiVersion == 0 { // API versions are not supported (yet) on backend, i.e., the client is newer than the backend
+		return fmt.Errorf("server API does not support API versions, i.e., the server is older than the client, "+
+			"please upgrade the server to have the same API version as the client: client API version %v, "+
+			"client version %v, server version %v", version.API, version.Tag, sysVersion.TypedSpec().Value.BackendVersion)
+	}
+
+	// compare the API versions
+	if sysVersion.TypedSpec().Value.BackendApiVersion != version.API {
+		return fmt.Errorf("client API version mismatch: backend API version %v, client API version %v", sysVersion.TypedSpec().Value.BackendApiVersion, version.API)
+	}
+
+	return nil
+}
diff --git a/client/pkg/omnictl/internal/access/context.go b/client/pkg/omnictl/internal/access/context.go
new file mode 100644
index 000000000..ab3c77cdb
--- /dev/null
+++ b/client/pkg/omnictl/internal/access/context.go
@@ -0,0 +1,19 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package access
+
+import (
+	"context"
+	"os"
+	"os/signal"
+)
+
+// WithContext wraps with CLI context.
+func WithContext(f func(ctx context.Context) error) error {
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer stop()
+
+	return f(ctx)
+}
diff --git a/client/pkg/omnictl/internal/access/flags.go b/client/pkg/omnictl/internal/access/flags.go
new file mode 100644
index 000000000..e9b9d1c04
--- /dev/null
+++ b/client/pkg/omnictl/internal/access/flags.go
@@ -0,0 +1,12 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package access
+
+// CmdFlags contains the common CLI flags.
+var CmdFlags struct {
+	Omniconfig            string
+	Context               string
+	InsecureSkipTLSVerify bool
+}
diff --git a/client/pkg/omnictl/kubeconfig.go b/client/pkg/omnictl/kubeconfig.go
new file mode 100644
index 000000000..e42260534
--- /dev/null
+++ b/client/pkg/omnictl/kubeconfig.go
@@ -0,0 +1,216 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omnictl
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/mattn/go-isatty"
+	"github.com/siderolabs/go-kubeconfig"
+	"github.com/spf13/cobra"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"k8s.io/client-go/tools/clientcmd"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/client/management"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+)
+
+const (
+	serviceAccountFlag     = "service-account"
+	serviceAccountUserFlag = "user"
+)
+
+var kubeconfigCmdFlags struct {
+	cluster              string
+	forceContextName     string
+	serviceAccountUser   string
+	serviceAccountGroups []string
+	serviceAccountTTL    time.Duration
+	force                bool
+	merge                bool
+	serviceAccount       bool
+}
+
+// kubeconfigCmd represents the get (resources) command.
+var kubeconfigCmd = &cobra.Command{
+	Use:   "kubeconfig [local-path]",
+	Short: "Download the admin kubeconfig of a cluster",
+	Long: `Download the admin kubeconfig of a cluster.
+If merge flag is defined, config will be merged with ~/.kube/config or [local-path] if specified.
+Otherwise kubeconfig will be written to PWD or [local-path] if specified.`,
+	Args: cobra.MaximumNArgs(1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		return access.WithClient(getKubeconfig(args))
+	},
+}
+
+//nolint:gocognit
+func getKubeconfig(args []string) func(ctx context.Context, client *client.Client) error {
+	return func(ctx context.Context, client *client.Client) error {
+		var localPath string
+
+		if len(args) == 0 {
+			// no path given, use defaults
+			var err error
+
+			if kubeconfigCmdFlags.merge {
+				localPath, err = kubeconfig.SinglePath()
+				if err != nil {
+					return err
+				}
+			} else {
+				localPath, err = os.Getwd()
+				if err != nil {
+					return fmt.Errorf("error getting current working directory: %w", err)
+				}
+			}
+		} else {
+			localPath = args[0]
+		}
+
+		localPath = filepath.Clean(localPath)
+
+		st, err := os.Stat(localPath)
+		if err != nil {
+			if !os.IsNotExist(err) {
+				return fmt.Errorf("error checking path %q: %w", localPath, err)
+			}
+
+			err = os.MkdirAll(filepath.Dir(localPath), 0o755)
+			if err != nil {
+				return err
+			}
+		} else if st.IsDir() {
+			// only dir name was given, append `kubeconfig` by default
+			localPath = filepath.Join(localPath, "kubeconfig")
+		}
+
+		_, err = os.Stat(localPath)
+		if err == nil && !(kubeconfigCmdFlags.force || kubeconfigCmdFlags.merge) {
+			return fmt.Errorf("kubeconfig file already exists, use --force to overwrite: %q", localPath)
+		} else if err != nil {
+			if os.IsNotExist(err) {
+				// merge doesn't make sense if target path doesn't exist
+				kubeconfigCmdFlags.merge = false
+			} else {
+				return fmt.Errorf("error checking path %q: %w", localPath, err)
+			}
+		}
+
+		var opts []management.KubeconfigOption
+
+		if kubeconfigCmdFlags.serviceAccount {
+			if kubeconfigCmdFlags.serviceAccountUser == "" {
+				return fmt.Errorf("--%s flag is required when --%s is set to true", serviceAccountUserFlag, serviceAccountFlag)
+			}
+
+			opts = append(opts, management.WithServiceAccount(
+				kubeconfigCmdFlags.serviceAccountTTL,
+				kubeconfigCmdFlags.serviceAccountUser,
+				kubeconfigCmdFlags.serviceAccountGroups...,
+			))
+		}
+
+		data, err := client.Management().WithCluster(kubeconfigCmdFlags.cluster).Kubeconfig(ctx, opts...)
+		if err != nil {
+			if code, ok := status.FromError(err); ok && code.Code() == codes.NotFound {
+				return fmt.Errorf("cluster %s not found", kubeconfigCmdFlags.cluster)
+			}
+
+			return err
+		}
+
+		if kubeconfigCmdFlags.merge {
+			return extractAndMerge(data, localPath)
+		}
+
+		return os.WriteFile(localPath, data, 0o640)
+	}
+}
+
+func extractAndMerge(data []byte, localPath string) error {
+	config, err := clientcmd.Load(data)
+	if err != nil {
+		return err
+	}
+
+	merger, err := kubeconfig.Load(localPath)
+	if err != nil {
+		return err
+	}
+
+	interactive := isatty.IsTerminal(os.Stdout.Fd())
+
+	err = merger.Merge(config, kubeconfig.MergeOptions{
+		ActivateContext:  true,
+		ForceContextName: kubeconfigCmdFlags.forceContextName,
+		OutputWriter:     os.Stdout,
+		ConflictHandler: func(component kubeconfig.ConfigComponent, name string) (kubeconfig.ConflictDecision, error) {
+			if kubeconfigCmdFlags.force {
+				return kubeconfig.OverwriteDecision, nil
+			}
+
+			if !interactive {
+				return kubeconfig.RenameDecision, nil
+			}
+
+			return askOverwriteOrRename(fmt.Sprintf("%s %q already exists", component, name))
+		},
+	})
+	if err != nil {
+		return err
+	}
+
+	return merger.Write(localPath)
+}
+
+func askOverwriteOrRename(prompt string) (kubeconfig.ConflictDecision, error) {
+	reader := bufio.NewReader(os.Stdin)
+
+	for {
+		fmt.Printf("%s [(r)ename/(o)verwrite]: ", prompt)
+
+		response, err := reader.ReadString('\n')
+		if err != nil {
+			return "", err
+		}
+
+		switch strings.ToLower(strings.TrimSpace(response)) {
+		case "overwrite", "o":
+			return kubeconfig.OverwriteDecision, nil
+		case "rename", "r":
+			return kubeconfig.RenameDecision, nil
+		}
+	}
+}
+
+func init() {
+	kubeconfigCmd.Flags().StringVarP(&kubeconfigCmdFlags.cluster, "cluster", "c", "", "cluster to use")
+	kubeconfigCmd.Flags().BoolVarP(&kubeconfigCmdFlags.force, "force", "f", false, "force overwrite of kubeconfig if already present, force overwrite on kubeconfig merge")
+	kubeconfigCmd.Flags().StringVar(&kubeconfigCmdFlags.forceContextName, "force-context-name", "", "force context name for kubeconfig merge")
+	kubeconfigCmd.Flags().BoolVarP(&kubeconfigCmdFlags.merge, "merge", "m", true, "merge with existing kubeconfig")
+
+	kubeconfigCmd.Flags().BoolVar(&kubeconfigCmdFlags.serviceAccount, serviceAccountFlag, false,
+		"create a service account type kubeconfig instead of a OIDC-authenticated user type")
+	kubeconfigCmd.Flags().DurationVar(&kubeconfigCmdFlags.serviceAccountTTL, "ttl", 365*24*time.Hour,
+		fmt.Sprintf("ttl for the service account token. only used when --%s is set to true", serviceAccountFlag))
+	kubeconfigCmd.Flags().StringVar(&kubeconfigCmdFlags.serviceAccountUser, serviceAccountUserFlag, "",
+		fmt.Sprintf("user to be used in the service account token (sub). required when --%s is set to true", serviceAccountFlag))
+	kubeconfigCmd.Flags().StringSliceVar(&kubeconfigCmdFlags.serviceAccountGroups, "groups", []string{constants.DefaultAccessGroup},
+		fmt.Sprintf("group to be used in the service account token (groups). only used when --%s is set to true", serviceAccountFlag))
+
+	kubeconfigCmd.MarkFlagRequired("cluster") //nolint:errcheck
+
+	RootCmd.AddCommand(kubeconfigCmd)
+}
diff --git a/client/pkg/omnictl/logformat/dmesg.go b/client/pkg/omnictl/logformat/dmesg.go
new file mode 100644
index 000000000..eec63c8de
--- /dev/null
+++ b/client/pkg/omnictl/logformat/dmesg.go
@@ -0,0 +1,71 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package logformat
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+)
+
+// NewDmesgOutput returns a new DmesgOutput.
+func NewDmesgOutput(rdr io.Reader) *DmesgOutput {
+	return &DmesgOutput{
+		decoder: json.NewDecoder(rdr),
+	}
+}
+
+// DmesgOutput is used to print logs in dmesg format.
+type DmesgOutput struct {
+	decoder *json.Decoder
+}
+
+// Run parses logs from passed reader and prints them in dmesg format until the context is canceled
+// or the reader has returned an error.
+func (o DmesgOutput) Run(ctx context.Context) error {
+	var msg talosLogMessage
+
+	for {
+		if ctx.Err() != nil {
+			return nil //nolint:nilerr
+		}
+
+		err := o.decoder.Decode(&msg)
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				return nil
+			}
+
+			return err
+		}
+
+		secondsPart := msg.Clock / 1000000
+		microSecondsPart := msg.Clock % 1000000
+		message := trimNewLine(msg.Message)
+
+		if strings.IndexByte(message, '\n') == -1 {
+			fmt.Printf("[%5d.%06d] %s: %s\n", secondsPart, microSecondsPart, msg.Facility, message)
+		} else {
+			for i, line := range strings.Split(message, "\n") {
+				if i == 0 {
+					fmt.Printf("[%5d.%06d] %s: %s\n", secondsPart, microSecondsPart, msg.Facility, line)
+				} else {
+					fmt.Printf("[%5d.%06d] %s\n", secondsPart, microSecondsPart, line)
+				}
+			}
+		}
+	}
+}
+
+func trimNewLine(message string) string {
+	if len(message) > 0 && message[len(message)-1] == '\n' {
+		message = message[:len(message)-1]
+	}
+
+	return message
+}
diff --git a/client/pkg/omnictl/logformat/omni.go b/client/pkg/omnictl/logformat/omni.go
new file mode 100644
index 000000000..073479e7e
--- /dev/null
+++ b/client/pkg/omnictl/logformat/omni.go
@@ -0,0 +1,78 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package logformat contains different implementations of log formatting.
+package logformat
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"time"
+
+	"go.uber.org/zap"
+)
+
+// NewOmniOutput returns a new OmniOutput.
+func NewOmniOutput(rdr io.Reader) *OmniOutput {
+	decoder := json.NewDecoder(rdr)
+
+	return &OmniOutput{decoder: decoder}
+}
+
+// OmniOutput is a log output which parses logs from Talos machine and prints them in zap'like format.
+type OmniOutput struct {
+	decoder *json.Decoder
+}
+
+// Run prints logs from passed reader until the context is canceled or the reader has returned an error.
+func (o *OmniOutput) Run(ctx context.Context) error {
+	var msg talosLogMessage
+
+	var logger zap.Logger
+
+	logger.WithOptions(zap.AddStacktrace(zap.FatalLevel))
+
+	for {
+		if ctx.Err() != nil {
+			return nil //nolint:nilerr
+		}
+
+		err := o.decoder.Decode(&msg)
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				return nil
+			}
+
+			return err
+		}
+
+		level, err := zap.ParseAtomicLevel(msg.TalosLevel)
+		if err != nil {
+			level = zap.NewAtomicLevel()
+		}
+
+		logMsg := logger.Check(level.Level(), msg.Message)
+		if logMsg != nil {
+			logMsg.Write(
+				zap.Int("clock", msg.Clock),
+				zap.String("facility", msg.Facility),
+				zap.String("priority", msg.Priority),
+				zap.Int("seq", msg.Seq),
+				zap.Time("talos-time", msg.TalosTime),
+			)
+		}
+	}
+}
+
+type talosLogMessage struct {
+	TalosTime  time.Time `json:"talos-time"`
+	Facility   string    `json:"facility"`
+	Message    string    `json:"msg"`
+	Priority   string    `json:"priority"`
+	TalosLevel string    `json:"talos-level"`
+	Clock      int       `json:"clock"`
+	Seq        int       `json:"seq"`
+}
diff --git a/client/pkg/omnictl/logformat/raw.go b/client/pkg/omnictl/logformat/raw.go
new file mode 100644
index 000000000..e2445fd69
--- /dev/null
+++ b/client/pkg/omnictl/logformat/raw.go
@@ -0,0 +1,29 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package logformat
+
+import (
+	"io"
+	"os"
+)
+
+// NewRawOutput runs the raw log format.
+func NewRawOutput(rdr io.Reader) *RawOutput {
+	return &RawOutput{
+		rdr: rdr,
+	}
+}
+
+// RawOutput simply copies the input rdr to os.Stdout.
+type RawOutput struct {
+	rdr io.Reader
+}
+
+// Run copies the input rdr to os.Stdout the rdr has returned an error.
+func (o RawOutput) Run() error {
+	_, err := io.Copy(os.Stdout, o.rdr)
+
+	return err
+}
diff --git a/client/pkg/omnictl/machine-logs.go b/client/pkg/omnictl/machine-logs.go
new file mode 100644
index 000000000..2dca6499f
--- /dev/null
+++ b/client/pkg/omnictl/machine-logs.go
@@ -0,0 +1,69 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omnictl
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+	"github.com/siderolabs/omni/client/pkg/omnictl/logformat"
+)
+
+var logsCmdFlags struct {
+	logFormat string
+	follow    bool
+	tailLines int32
+}
+
+// getCmd represents the get logs command.
+var logsCmd = &cobra.Command{
+	Use:     "machine-logs machineID",
+	Aliases: []string{"l"},
+	Short:   "Get logs for a machine",
+	Long:    `Get logs for a provided machine id`,
+	Example: "",
+	Args:    cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		return access.WithClient(getLogs(cmd, args))
+	},
+	SilenceUsage: true,
+}
+
+func getLogs(_ *cobra.Command, args []string) func(ctx context.Context, client *client.Client) error {
+	return func(ctx context.Context, client *client.Client) error {
+		machineID := args[0]
+
+		logReader, err := client.Management().LogsReader(ctx, machineID, logsCmdFlags.follow, logsCmdFlags.tailLines)
+		if err != nil {
+			return fmt.Errorf("failed to get logs stream for '%s': %w", machineID, err)
+		}
+
+		switch logsCmdFlags.logFormat {
+		case "omni":
+			err = logformat.NewOmniOutput(logReader).Run(ctx)
+		case "dmesg":
+			err = logformat.NewDmesgOutput(logReader).Run(ctx)
+		default:
+			err = logformat.NewRawOutput(logReader).Run()
+		}
+
+		if err != nil {
+			return fmt.Errorf("failed to print logs for '%s': %w", machineID, err)
+		}
+
+		return nil
+	}
+}
+
+func init() {
+	logsCmd.Flags().BoolVarP(&logsCmdFlags.follow, "follow", "f", false, "specify if the logs should be streamed")
+	logsCmd.Flags().Int32Var(&logsCmdFlags.tailLines, "tail", -1, "lines of log file to display (default is to show from the beginning)")
+	logsCmd.Flags().StringVar(&logsCmdFlags.logFormat, "log-format", "raw", "log format (raw, omni, dmesg) to display (default is to display in raw format)")
+	RootCmd.AddCommand(logsCmd)
+}
diff --git a/client/pkg/omnictl/output/json.go b/client/pkg/omnictl/output/json.go
new file mode 100644
index 000000000..0adb971bd
--- /dev/null
+++ b/client/pkg/omnictl/output/json.go
@@ -0,0 +1,84 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package output
+
+import (
+	"encoding/json"
+	"io"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/state"
+	yaml "gopkg.in/yaml.v3"
+)
+
+// JSON outputs resources in JSON format.
+type JSON struct {
+	writer     io.Writer
+	withEvents bool
+}
+
+// NewJSON initializes JSON resource output.
+func NewJSON(writer io.Writer) *JSON {
+	return &JSON{
+		writer: writer,
+	}
+}
+
+// WriteHeader implements output.Writer interface.
+func (j *JSON) WriteHeader(_ *meta.ResourceDefinition, withEvents bool) error {
+	j.withEvents = withEvents
+
+	return nil
+}
+
+// prepareEncodableData prepares the data of a resource to be encoded as JSON and populates it with some extra information.
+func (j *JSON) prepareEncodableData(r resource.Resource, event state.EventType) (map[string]any, error) {
+	out, err := resource.MarshalYAML(r)
+	if err != nil {
+		return nil, err
+	}
+
+	yamlBytes, err := yaml.Marshal(out)
+	if err != nil {
+		return nil, err
+	}
+
+	var data map[string]any
+
+	err = yaml.Unmarshal(yamlBytes, &data)
+	if err != nil {
+		return nil, err
+	}
+
+	if j.withEvents {
+		data["event"] = strings.ToLower(event.String())
+	}
+
+	return data, nil
+}
+
+func writeAsIndentedJSON(wr io.Writer, data any) error {
+	enc := json.NewEncoder(wr)
+	enc.SetIndent("", "    ")
+
+	return enc.Encode(data)
+}
+
+// WriteResource implements output.Writer interface.
+func (j *JSON) WriteResource(r resource.Resource, event state.EventType) error {
+	data, err := j.prepareEncodableData(r, event)
+	if err != nil {
+		return err
+	}
+
+	return writeAsIndentedJSON(j.writer, data)
+}
+
+// Flush implements output.Writer interface.
+func (j *JSON) Flush() error {
+	return nil
+}
diff --git a/client/pkg/omnictl/output/jsonpath.go b/client/pkg/omnictl/output/jsonpath.go
new file mode 100644
index 000000000..f4575a9af
--- /dev/null
+++ b/client/pkg/omnictl/output/jsonpath.go
@@ -0,0 +1,124 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package output
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"reflect"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/state"
+	"k8s.io/client-go/third_party/forked/golang/template"
+	"k8s.io/client-go/util/jsonpath"
+)
+
+// JSONPath outputs resources in JSONPath format.
+type JSONPath struct {
+	jsonPath *jsonpath.JSONPath
+	json     *JSON
+	writer   io.Writer
+}
+
+// NewJSONPath initializes JSONPath resource output.
+func NewJSONPath(writer io.Writer, jsonPath *jsonpath.JSONPath) *JSONPath {
+	return &JSONPath{
+		jsonPath: jsonPath,
+		json:     NewJSON(writer),
+		writer:   writer,
+	}
+}
+
+// WriteHeader implements output.Writer interface.
+func (j *JSONPath) WriteHeader(definition *meta.ResourceDefinition, withEvents bool) error {
+	return j.json.WriteHeader(definition, withEvents)
+}
+
+// printResult prints a reflect.Value as JSON if it's a map, array, slice or struct.
+// But if it's just a 'scalar' type it prints it as a mere string.
+func printResult(wr io.Writer, result reflect.Value) error {
+	kind := result.Kind()
+	if kind == reflect.Interface {
+		kind = result.Elem().Kind()
+	}
+
+	outputJSON := kind == reflect.Map ||
+		kind == reflect.Array ||
+		kind == reflect.Slice ||
+		kind == reflect.Struct
+
+	var text []byte
+
+	var err error
+
+	if outputJSON {
+		text, err = json.MarshalIndent(result.Interface(), "", "    ")
+		if err != nil {
+			return err
+		}
+	} else {
+		text, err = valueToText(result)
+	}
+
+	if err != nil {
+		return err
+	}
+
+	text = append(text, '\n')
+
+	if _, err = wr.Write(text); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// valueToText translates reflect value to corresponding text.
+func valueToText(v reflect.Value) ([]byte, error) {
+	iface, ok := template.PrintableValue(v)
+	if !ok {
+		return nil, fmt.Errorf("can't translate type %s to text", v.Type())
+	}
+
+	var buffer bytes.Buffer
+
+	fmt.Fprint(&buffer, iface)
+
+	return buffer.Bytes(), nil
+}
+
+// WriteResource implements output.Writer interface.
+func (j *JSONPath) WriteResource(r resource.Resource, event state.EventType) error {
+	data, err := j.json.prepareEncodableData(r, event)
+	if err != nil {
+		return err
+	}
+
+	results, err := j.jsonPath.FindResults(data)
+	if err != nil {
+		return fmt.Errorf("error finding result for jsonpath: %w", err)
+	}
+
+	j.jsonPath.EnableJSONOutput(true)
+
+	for _, resultGroup := range results {
+		for _, result := range resultGroup {
+			err = printResult(j.writer, result)
+			if err != nil {
+				return fmt.Errorf("error generating jsonpath results: %w", err)
+			}
+		}
+	}
+
+	return nil
+}
+
+// Flush implements output.Writer interface.
+func (j *JSONPath) Flush() error {
+	return nil
+}
diff --git a/client/pkg/omnictl/output/output.go b/client/pkg/omnictl/output/output.go
new file mode 100644
index 000000000..7fd672a74
--- /dev/null
+++ b/client/pkg/omnictl/output/output.go
@@ -0,0 +1,54 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package output provides writers in different formats.
+package output
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/spf13/cobra"
+	"k8s.io/client-go/util/jsonpath"
+)
+
+// Writer interface.
+type Writer interface {
+	WriteHeader(definition *meta.ResourceDefinition, withEvents bool) error
+	WriteResource(r resource.Resource, event state.EventType) error
+	Flush() error
+}
+
+// NewWriter builds writer from type.
+func NewWriter(format string) (Writer, error) { //nolint:ireturn
+	switch {
+	case format == "table":
+		return NewTable(), nil
+	case format == "yaml":
+		return NewYAML(), nil
+	case format == "json":
+		return NewJSON(os.Stdout), nil
+	case strings.HasPrefix(format, "jsonpath="):
+		path := format[len("jsonpath="):]
+
+		jp := jsonpath.New("talos")
+
+		if err := jp.Parse(path); err != nil {
+			return nil, fmt.Errorf("error parsing jsonpath: %w", err)
+		}
+
+		return NewJSONPath(os.Stdout, jp), nil
+	default:
+		return nil, fmt.Errorf("output format %q is not supported", format)
+	}
+}
+
+// CompleteOutputArg represents tab completion for `--output` argument.
+func CompleteOutputArg(*cobra.Command, []string, string) ([]string, cobra.ShellCompDirective) {
+	return []string{"json", "table", "yaml"}, cobra.ShellCompDirectiveNoFileComp
+}
diff --git a/client/pkg/omnictl/output/table.go b/client/pkg/omnictl/output/table.go
new file mode 100644
index 000000000..c8e58771a
--- /dev/null
+++ b/client/pkg/omnictl/output/table.go
@@ -0,0 +1,133 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package output
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"strings"
+	"text/tabwriter"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/state"
+	"gopkg.in/yaml.v3"
+	"k8s.io/client-go/util/jsonpath"
+)
+
+// Table outputs resources in Table view.
+type Table struct {
+	dynamicColumns []dynamicColumn
+	displayType    string
+	w              tabwriter.Writer
+	withEvents     bool
+}
+
+type dynamicColumn func(value any) (string, error)
+
+// NewTable initializes table resource output.
+func NewTable() *Table {
+	output := &Table{}
+	output.w.Init(os.Stdout, 0, 0, 3, ' ', 0)
+
+	return output
+}
+
+// WriteHeader implements output.Writer interface.
+func (table *Table) WriteHeader(definition *meta.ResourceDefinition, withEvents bool) error {
+	table.withEvents = withEvents
+	fields := []string{"NAMESPACE", "TYPE", "ID", "VERSION"}
+
+	if withEvents {
+		fields = append([]string{"*"}, fields...)
+	}
+
+	table.displayType = definition.TypedSpec().DisplayType
+
+	for _, col := range definition.TypedSpec().PrintColumns {
+		fields = append(fields, strings.ToUpper(col.Name))
+
+		expr := jsonpath.New(col.Name)
+		if err := expr.Parse(col.JSONPath); err != nil {
+			return fmt.Errorf("error parsing column %q jsonpath: %w", col.Name, err)
+		}
+
+		expr = expr.AllowMissingKeys(true)
+
+		table.dynamicColumns = append(table.dynamicColumns, func(val any) (string, error) {
+			var buf bytes.Buffer
+
+			if e := expr.Execute(&buf, val); e != nil {
+				return "", e
+			}
+
+			return buf.String(), nil
+		})
+	}
+
+	_, err := fmt.Fprintln(&table.w, strings.Join(fields, "\t"))
+
+	return err
+}
+
+// WriteResource implements output.Writer interface.
+func (table *Table) WriteResource(r resource.Resource, event state.EventType) error {
+	values := []string{r.Metadata().Namespace(), table.displayType, r.Metadata().ID(), r.Metadata().Version().String()}
+
+	if table.withEvents {
+		var label string
+
+		switch event {
+		case state.Created:
+			label = "+"
+		case state.Destroyed:
+			label = "-"
+		case state.Updated:
+			label = " "
+		case state.Errored, state.Bootstrapped: // ignored
+		}
+
+		values = append([]string{label}, values...)
+	}
+
+	yamlR, err := resource.MarshalYAML(r)
+	if err != nil {
+		return err
+	}
+
+	marshaled, err := yaml.Marshal(yamlR)
+	if err != nil {
+		return err
+	}
+
+	var data struct {
+		Spec any `yaml:"spec"`
+	}
+
+	if err = yaml.Unmarshal(marshaled, &data); err != nil {
+		return err
+	}
+
+	for _, dynamicColumn := range table.dynamicColumns {
+		var value string
+
+		value, err = dynamicColumn(data.Spec)
+		if err != nil {
+			return err
+		}
+
+		values = append(values, value)
+	}
+
+	_, err = fmt.Fprintln(&table.w, strings.Join(values, "\t"))
+
+	return err
+}
+
+// Flush implements output.Writer interface.
+func (table *Table) Flush() error {
+	return table.w.Flush()
+}
diff --git a/client/pkg/omnictl/output/yaml.go b/client/pkg/omnictl/output/yaml.go
new file mode 100644
index 000000000..b174fbb95
--- /dev/null
+++ b/client/pkg/omnictl/output/yaml.go
@@ -0,0 +1,59 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package output
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/state"
+	yaml "gopkg.in/yaml.v3"
+)
+
+// YAML outputs resources in YAML format.
+type YAML struct {
+	needDashes bool
+	withEvents bool
+}
+
+// NewYAML initializes YAML resource output.
+func NewYAML() *YAML {
+	return &YAML{}
+}
+
+// WriteHeader implements output.Writer interface.
+func (y *YAML) WriteHeader(_ *meta.ResourceDefinition, withEvents bool) error {
+	y.withEvents = withEvents
+
+	return nil
+}
+
+// WriteResource implements output.Writer interface.
+func (y *YAML) WriteResource(r resource.Resource, event state.EventType) error {
+	out, err := resource.MarshalYAML(r)
+	if err != nil {
+		return err
+	}
+
+	if y.needDashes {
+		fmt.Fprintln(os.Stdout, "---")
+	}
+
+	y.needDashes = true
+
+	if y.withEvents {
+		fmt.Fprintf(os.Stdout, "event: %s\n", strings.ToLower(event.String()))
+	}
+
+	return yaml.NewEncoder(os.Stdout).Encode(out)
+}
+
+// Flush implements output.Writer interface.
+func (y *YAML) Flush() error {
+	return nil
+}
diff --git a/client/pkg/omnictl/root.go b/client/pkg/omnictl/root.go
new file mode 100644
index 000000000..7aadf22a3
--- /dev/null
+++ b/client/pkg/omnictl/root.go
@@ -0,0 +1,34 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omnictl
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/omnictl/config"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+)
+
+// RootCmd represents the base command when called without any subcommands.
+var RootCmd = &cobra.Command{
+	Use:               "omnictl",
+	Short:             "A CLI for accessing Omni API.",
+	Long:              ``,
+	SilenceUsage:      true,
+	DisableAutoGenTag: true,
+}
+
+func init() {
+	RootCmd.PersistentFlags().StringVar(&access.CmdFlags.Omniconfig, "omniconfig", "",
+		fmt.Sprintf("The path to the omni configuration file. Defaults to '%s' env variable if set, otherwise the config directory according to the XDG specification.",
+			config.OmniConfigEnvVar,
+		))
+	RootCmd.PersistentFlags().StringVar(&access.CmdFlags.Context, "context", "",
+		"The context to be used. Defaults to the selected context in the omniconfig file.")
+	RootCmd.PersistentFlags().BoolVar(&access.CmdFlags.InsecureSkipTLSVerify, "insecure-skip-tls-verify", false,
+		"Skip TLS verification for the Omni GRPC and HTTP API endpoints.")
+}
diff --git a/client/pkg/omnictl/serviceaccount.go b/client/pkg/omnictl/serviceaccount.go
new file mode 100644
index 000000000..dfc79493b
--- /dev/null
+++ b/client/pkg/omnictl/serviceaccount.go
@@ -0,0 +1,203 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omnictl
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"runtime"
+	"text/tabwriter"
+	"time"
+
+	"github.com/siderolabs/go-api-signature/pkg/pgp"
+	"github.com/siderolabs/go-api-signature/pkg/serviceaccount"
+	"github.com/spf13/cobra"
+
+	pkgaccess "github.com/siderolabs/omni/client/pkg/access"
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+)
+
+var (
+	serviceAccountCreateFlags struct {
+		role string
+
+		useUserRole bool
+		ttl         time.Duration
+	}
+
+	serviceAccountRenewFlags struct {
+		ttl time.Duration
+	}
+
+	// serviceAccountCmd represents the serviceaccount command.
+	serviceAccountCmd = &cobra.Command{
+		Use:     "serviceaccount",
+		Aliases: []string{"sa"},
+		Short:   "Manage service accounts",
+	}
+
+	serviceAccountCreateCmd = &cobra.Command{
+		Use:     "create <name>",
+		Aliases: []string{"c"},
+		Short:   "Create a service account",
+		Args:    cobra.ExactArgs(1),
+		RunE: func(_ *cobra.Command, args []string) error {
+			name := args[0]
+
+			return access.WithClient(func(ctx context.Context, client *client.Client) error {
+				key, err := generateServiceAccountPGPKey(name)
+				if err != nil {
+					return err
+				}
+
+				armoredPublicKey, err := key.ArmorPublic()
+				if err != nil {
+					return err
+				}
+
+				publicKeyID, err := client.Management().CreateServiceAccount(ctx, armoredPublicKey, serviceAccountCreateFlags.role, serviceAccountCreateFlags.useUserRole)
+				if err != nil {
+					return err
+				}
+
+				encodedKey, err := serviceaccount.Encode(name, key)
+				if err != nil {
+					return err
+				}
+
+				fmt.Printf("Created service account %q with public key ID %q\n", name, publicKeyID)
+				fmt.Printf("\n")
+				fmt.Printf("Set the following environment variables to use the service account:\n")
+				fmt.Printf("%s=%s\n", access.EndpointEnvVar, client.Endpoint())
+				fmt.Printf("%s=%s\n", serviceaccount.OmniServiceAccountKeyEnvVar, encodedKey)
+				fmt.Printf("\n")
+				fmt.Printf("Note: Store the service account key securely, it will not be displayed again\n")
+
+				return nil
+			})
+		},
+	}
+
+	serviceAccountRenewCmd = &cobra.Command{
+		Use:     "renew <name>",
+		Aliases: []string{"r"},
+		Short:   "Renew a service account by registering a new public key to it",
+		Args:    cobra.ExactArgs(1),
+		RunE: func(_ *cobra.Command, args []string) error {
+			name := args[0]
+
+			return access.WithClient(func(ctx context.Context, client *client.Client) error {
+				key, err := generateServiceAccountPGPKey(name)
+				if err != nil {
+					return err
+				}
+
+				armoredPublicKey, err := key.ArmorPublic()
+				if err != nil {
+					return err
+				}
+
+				publicKeyID, err := client.Management().RenewServiceAccount(ctx, name, armoredPublicKey)
+				if err != nil {
+					return err
+				}
+
+				encodedKey, err := serviceaccount.Encode(name, key)
+				if err != nil {
+					return err
+				}
+
+				fmt.Printf("Renewed service account %q by adding a public key with ID %q\n", name, publicKeyID)
+				fmt.Printf("\n")
+				fmt.Printf("Set the following environment variables to use the service account:\n")
+				fmt.Printf("%s=%s\n", access.EndpointEnvVar, client.Endpoint())
+				fmt.Printf("%s=%s\n", serviceaccount.OmniServiceAccountKeyEnvVar, encodedKey)
+				fmt.Printf("\n")
+				fmt.Printf("Note: Store the service account key securely, it will not be displayed again\n")
+
+				return nil
+			})
+		},
+	}
+
+	serviceAccountListCmd = &cobra.Command{
+		Use:     "list",
+		Aliases: []string{"l"},
+		Short:   "List service accounts",
+		Args:    cobra.NoArgs,
+		RunE: func(*cobra.Command, []string) error {
+			return access.WithClient(func(ctx context.Context, client *client.Client) error {
+				serviceAccounts, err := client.Management().ListServiceAccounts(ctx)
+				if err != nil {
+					return err
+				}
+
+				writer := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
+
+				fmt.Fprintf(writer, "NAME\tROLE\tPUBLIC KEY ID\tEXPIRATION\n")
+
+				for _, sa := range serviceAccounts {
+					for i, publicKey := range sa.PgpPublicKeys {
+						if i == 0 {
+							fmt.Fprintf(writer, "%s\t%q\t%s\t%s\n", sa.Name, sa.GetRole(), publicKey.Id, publicKey.Expiration.AsTime().String())
+						} else {
+							fmt.Fprintf(writer, "\t\t%s\t%s\n", publicKey.Id, publicKey.Expiration.AsTime().String())
+						}
+					}
+				}
+
+				return writer.Flush()
+			})
+		},
+	}
+
+	serviceAccountDestroyCmd = &cobra.Command{
+		Use:     "destroy <name>",
+		Aliases: []string{"d"},
+		Short:   "Destroy a service account",
+		Args:    cobra.ExactArgs(1),
+		RunE: func(_ *cobra.Command, args []string) error {
+			name := args[0]
+
+			return access.WithClient(func(ctx context.Context, client *client.Client) error {
+				err := client.Management().DestroyServiceAccount(ctx, name)
+				if err != nil {
+					return fmt.Errorf("failed to destroy service account: %w", err)
+				}
+
+				fmt.Printf("destroyed service account: %s\n", name)
+
+				return nil
+			})
+		},
+	}
+)
+
+func generateServiceAccountPGPKey(name string) (*pgp.Key, error) {
+	comment := fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)
+	serviceAccountEmail := name + pkgaccess.ServiceAccountNameSuffix
+
+	return pgp.GenerateKey(name, comment, serviceAccountEmail, serviceAccountCreateFlags.ttl)
+}
+
+func init() {
+	RootCmd.AddCommand(serviceAccountCmd)
+
+	serviceAccountCmd.AddCommand(serviceAccountCreateCmd)
+	serviceAccountCmd.AddCommand(serviceAccountListCmd)
+	serviceAccountCmd.AddCommand(serviceAccountDestroyCmd)
+	serviceAccountCmd.AddCommand(serviceAccountRenewCmd)
+
+	roleFlag := "role"
+	useUserRoleFlag := "use-user-role"
+
+	serviceAccountCreateCmd.Flags().DurationVarP(&serviceAccountCreateFlags.ttl, "ttl", "t", 365*24*time.Hour, "TTL for the service account key")
+	serviceAccountCreateCmd.Flags().StringVarP(&serviceAccountCreateFlags.role, roleFlag, "r", "", "role of the service account. only used when --"+useUserRoleFlag+"=false")
+	serviceAccountCreateCmd.Flags().BoolVarP(&serviceAccountCreateFlags.useUserRole, useUserRoleFlag, "u", true, "use the role of the creating user. if true, --"+roleFlag+" is ignored")
+
+	serviceAccountRenewCmd.Flags().DurationVarP(&serviceAccountRenewFlags.ttl, "ttl", "t", 365*24*time.Hour, "TTL for the service account key")
+}
diff --git a/client/pkg/omnictl/talosconfig.go b/client/pkg/omnictl/talosconfig.go
new file mode 100644
index 000000000..f0c790e08
--- /dev/null
+++ b/client/pkg/omnictl/talosconfig.go
@@ -0,0 +1,149 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package omnictl
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/siderolabs/talos/pkg/machinery/client/config"
+	"github.com/spf13/cobra"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/client/management"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omnictl/internal/access"
+)
+
+var talosconfigCmdFlags struct {
+	cluster          string
+	forceContextName string
+	force            bool
+	merge            bool
+	getAdminConfig   bool
+}
+
+// talosconfigCmd represents the get (resources) command.
+var talosconfigCmd = &cobra.Command{
+	Use:   "talosconfig [local-path]",
+	Short: "Download the admin talosconfig of a cluster",
+	Long: `Download the admin talosconfig of a cluster.
+If merge flag is defined, config will be merged with ~/.talos/config or [local-path] if specified.
+Otherwise talosconfig will be written to PWD or [local-path] if specified.`,
+	Args: cobra.MaximumNArgs(1),
+	RunE: func(_ *cobra.Command, args []string) error {
+		return access.WithClient(getTalosconfig(args))
+	},
+}
+
+//nolint:gocognit
+func getTalosconfig(args []string) func(ctx context.Context, client *client.Client) error {
+	return func(ctx context.Context, client *client.Client) error {
+		var localPath string
+
+		if len(args) == 0 {
+			// no path given, use defaults
+			var err error
+
+			if talosconfigCmdFlags.merge {
+				localPath, err = config.GetTalosDirectory()
+				if err != nil {
+					return err
+				}
+
+				// TODO: figure out a proper way to get the path to .talos/config
+				localPath = filepath.Join(localPath, "config")
+			} else {
+				localPath, err = os.Getwd()
+				if err != nil {
+					return fmt.Errorf("error getting current working directory: %w", err)
+				}
+			}
+		} else {
+			localPath = args[0]
+		}
+
+		localPath = filepath.Clean(localPath)
+
+		st, err := os.Stat(localPath)
+		if err != nil {
+			if !os.IsNotExist(err) {
+				return fmt.Errorf("error checking path %q: %w", localPath, err)
+			}
+
+			err = os.MkdirAll(filepath.Dir(localPath), 0o755)
+			if err != nil {
+				return err
+			}
+		} else if st.IsDir() {
+			// only dir name was given, append `talosconfig` by default
+			localPath = filepath.Join(localPath, "talosconfig")
+		}
+
+		_, err = os.Stat(localPath)
+		if err == nil && !(talosconfigCmdFlags.force || talosconfigCmdFlags.merge) {
+			return fmt.Errorf("talosconfig file already exists, use --force to overwrite: %q", localPath)
+		} else if err != nil {
+			if os.IsNotExist(err) {
+				// merge doesn't make sense if target path doesn't exist
+				talosconfigCmdFlags.merge = false
+			} else {
+				return fmt.Errorf("error checking path %q: %w", localPath, err)
+			}
+		}
+
+		opts := []management.TalosconfigOption{
+			management.WithAdminTalosconfig(talosconfigCmdFlags.getAdminConfig),
+		}
+
+		var data []byte
+
+		if talosconfigCmdFlags.cluster == "" {
+			data, err = client.Management().Talosconfig(ctx, opts...)
+		} else {
+			data, err = client.Management().WithCluster(talosconfigCmdFlags.cluster).Talosconfig(ctx, opts...)
+		}
+
+		if err != nil {
+			return err
+		}
+
+		if talosconfigCmdFlags.merge {
+			cfg, err := config.FromBytes(data)
+			if err != nil {
+				return err
+			}
+
+			existing, err := config.Open(localPath)
+			if err != nil {
+				return err
+			}
+
+			renames := existing.Merge(cfg)
+
+			for _, rename := range renames {
+				fmt.Printf("renamed talosconfig context %s\n", rename.String())
+			}
+
+			return existing.Save(localPath)
+		}
+
+		return os.WriteFile(localPath, data, 0o640)
+	}
+}
+
+func init() {
+	talosconfigCmd.Flags().StringVarP(&talosconfigCmdFlags.cluster, "cluster", "c", "", "cluster to use")
+	talosconfigCmd.Flags().BoolVarP(&talosconfigCmdFlags.force, "force", "f", false, "force overwrite of talosconfig if already present")
+	talosconfigCmd.Flags().BoolVarP(&talosconfigCmdFlags.merge, "merge", "m", true, "merge with existing talosconfig")
+
+	if constants.IsDebugBuild {
+		talosconfigCmd.Flags().BoolVar(&talosconfigCmdFlags.getAdminConfig, "admin", false, "get admin talosconfig (DEBUG-ONLY)")
+	}
+
+	RootCmd.AddCommand(talosconfigCmd)
+}
diff --git a/client/pkg/runtime/runtime.go b/client/pkg/runtime/runtime.go
new file mode 100644
index 000000000..09384e7c6
--- /dev/null
+++ b/client/pkg/runtime/runtime.go
@@ -0,0 +1,25 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package runtime contains public interfaces used in Omni frontend runtime.
+package runtime
+
+// Matcher is implemented by all types which can traverse themselves in search for specific string.
+type Matcher interface {
+	Match(string) bool
+}
+
+// Fielder is implemented by all types which can traverse themselves in search for specific field.
+type Fielder interface {
+	Field(string) (string, bool)
+}
+
+// ListItem is a wrapper for the list item.
+type ListItem interface {
+	Matcher
+	ID() string
+	Namespace() string
+	Unwrap() any
+	Field(name string) (string, bool)
+}
diff --git a/client/pkg/template/internal/models/cluster.go b/client/pkg/template/internal/models/cluster.go
new file mode 100644
index 000000000..b3753a8be
--- /dev/null
+++ b/client/pkg/template/internal/models/cluster.go
@@ -0,0 +1,193 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package models
+
+import (
+	"fmt"
+	"strings"
+	"time"
+	"unicode"
+
+	"github.com/blang/semver"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/hashicorp/go-multierror"
+	"github.com/siderolabs/gen/pair"
+	"google.golang.org/protobuf/types/known/durationpb"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// KindCluster is Cluster model kind.
+const KindCluster = "Cluster"
+
+// Cluster is a top-level template object.
+type Cluster struct { //nolint:govet
+	Meta `yaml:",inline"`
+
+	// Name is the name of the cluster.
+	Name string `yaml:"name"`
+
+	// Descriptors are the user descriptors to apply to the cluster.
+	Descriptors Descriptors `yaml:",inline"`
+
+	// Kubernetes settings.
+	Kubernetes KubernetesCluster `yaml:"kubernetes"`
+
+	// Talos settings.
+	Talos TalosCluster `yaml:"talos"`
+
+	// Features settings.
+	Features Features `yaml:"features,omitempty"`
+
+	// Cluster-wide patches.
+	Patches PatchList `yaml:"patches,omitempty"`
+}
+
+// Features defines cluster-wide features.
+type Features struct {
+	// DiskEncryption enables KMS encryption.
+	DiskEncryption bool `yaml:"diskEncryption,omitempty"`
+	// EnableWorkloadProxy enables workload proxy.
+	EnableWorkloadProxy bool `yaml:"enableWorkloadProxy,omitempty"`
+	// BackupConfiguration contains backup configuration settings.
+	BackupConfiguration BackupConfiguration `yaml:"backupConfiguration,omitempty"`
+}
+
+// BackupConfiguration contains backup configuration settings.
+type BackupConfiguration struct {
+	// Interval configures intervals between backups. If set to 0, etcd backups for this cluster are disabled.
+	Interval time.Duration `yaml:"interval,omitempty"`
+}
+
+// KubernetesCluster is a Kubernetes cluster settings.
+type KubernetesCluster struct {
+	// Version is the Kubernetes version.
+	Version string `yaml:"version"`
+}
+
+// TalosCluster is a Talos cluster settings.
+type TalosCluster struct {
+	// Version is the Talos version.
+	Version string `yaml:"version"`
+}
+
+// Validate the model.
+func (cluster *Cluster) Validate() error {
+	var multiErr error
+
+	if cluster.Name == "" {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("name is required"))
+	}
+
+	for _, c := range cluster.Name {
+		if !unicode.IsDigit(c) && !unicode.IsLetter(c) && c != '-' && c != '_' {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("name should only contain letters, digits, dashes and underscores"))
+
+			break
+		}
+	}
+
+	if err := cluster.Descriptors.Validate(); err != nil {
+		multiErr = multierror.Append(multiErr, err)
+	}
+
+	multiErr = joinErrors(multiErr, cluster.Kubernetes.Validate(), cluster.Talos.Validate(), cluster.Patches.Validate())
+
+	if multiErr != nil {
+		return fmt.Errorf("error validating cluster %q: %w", cluster.Name, multiErr)
+	}
+
+	return nil
+}
+
+// Validate the model.
+func (kubernetes *KubernetesCluster) Validate() error {
+	var multiErr error
+
+	if kubernetes.Version == "" {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("version is required"))
+	} else if _, err := semver.ParseTolerant(kubernetes.Version); err != nil {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("version should be in semver format: %w", err))
+	}
+
+	if multiErr != nil {
+		return fmt.Errorf("error validating Kubernetes version: %w", multiErr)
+	}
+
+	return nil
+}
+
+// Validate the model.
+func (talos *TalosCluster) Validate() error {
+	var multiErr error
+
+	if talos.Version == "" {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("version is required"))
+	} else {
+		if _, err := semver.ParseTolerant(talos.Version); err != nil {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("version should be in semver format: %w", err))
+		}
+
+		if !strings.HasPrefix(talos.Version, "v") {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("version should start with 'v'"))
+		}
+	}
+
+	if multiErr != nil {
+		return fmt.Errorf("error validating Talos version: %w", multiErr)
+	}
+
+	return nil
+}
+
+// Translate into Omni resources.
+func (cluster *Cluster) Translate(TranslateContext) ([]resource.Resource, error) {
+	clusterResource := omni.NewCluster(resources.DefaultNamespace, cluster.Name)
+
+	clusterResource.Metadata().Annotations().Set(omni.ResourceManagedByClusterTemplates, "")
+
+	cluster.Descriptors.Apply(clusterResource)
+
+	clusterResource.TypedSpec().Value.Features = &specs.ClusterSpec_Features{
+		EnableWorkloadProxy: cluster.Features.EnableWorkloadProxy,
+	}
+
+	clusterResource.TypedSpec().Value.KubernetesVersion = strings.TrimLeft(cluster.Kubernetes.Version, "v")
+	clusterResource.TypedSpec().Value.TalosVersion = strings.TrimLeft(cluster.Talos.Version, "v")
+
+	patches, err := cluster.Patches.Translate(fmt.Sprintf("cluster-%s", cluster.Name), constants.PatchBaseWeightCluster, pair.MakePair(omni.LabelCluster, cluster.Name))
+	if err != nil {
+		return nil, err
+	}
+
+	if clusterResource.TypedSpec().Value.Features == nil {
+		clusterResource.TypedSpec().Value.Features = &specs.ClusterSpec_Features{}
+	}
+
+	clusterResource.TypedSpec().Value.Features.DiskEncryption = cluster.Features.DiskEncryption
+
+	if interval := cluster.Features.BackupConfiguration.Interval; interval > 0 {
+		clusterResource.TypedSpec().Value.BackupConfiguration = &specs.EtcdBackupConf{Interval: durationpb.New(interval), Enabled: true}
+	}
+
+	return append([]resource.Resource{clusterResource}, patches...), nil
+}
+
+func init() {
+	register[Cluster](KindCluster)
+}
+
+func joinErrors(err error, errs ...error) error {
+	for _, e := range errs {
+		if e != nil {
+			err = multierror.Append(err, e)
+		}
+	}
+
+	return err
+}
diff --git a/client/pkg/template/internal/models/controlplane.go b/client/pkg/template/internal/models/controlplane.go
new file mode 100644
index 000000000..61bd46d94
--- /dev/null
+++ b/client/pkg/template/internal/models/controlplane.go
@@ -0,0 +1,66 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package models
+
+import (
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/hashicorp/go-multierror"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// KindControlPlane is ControlPlane model kind.
+const KindControlPlane = "ControlPlane"
+
+// ControlPlane describes Cluster controlplane nodes.
+type ControlPlane struct {
+	MachineSet `yaml:",inline"`
+}
+
+// Validate the model.
+func (controlplane *ControlPlane) Validate() error {
+	var multiErr error
+
+	if controlplane.Name != "" {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("custom name is not allowed in the controlplane"))
+	}
+
+	if controlplane.BootstrapSpec != nil {
+		if controlplane.BootstrapSpec.ClusterUUID == "" {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("clusterUUID is required in bootstrapSpec"))
+		}
+
+		if controlplane.BootstrapSpec.Snapshot == "" {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("snapshot is required in bootstrapSpec"))
+		}
+	}
+
+	if controlplane.UpdateStrategy != nil {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("updateStrategy is not allowed in the controlplane"))
+	}
+
+	if controlplane.DeleteStrategy != nil {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("deleteStrategy is not allowed in the controlplane"))
+	}
+
+	multiErr = joinErrors(multiErr, controlplane.MachineSet.Validate(), controlplane.Machines.Validate(), controlplane.Patches.Validate())
+
+	if multiErr != nil {
+		return fmt.Errorf("controlplane is invalid: %w", multiErr)
+	}
+
+	return nil
+}
+
+// Translate the model.
+func (controlplane *ControlPlane) Translate(ctx TranslateContext) ([]resource.Resource, error) {
+	return controlplane.translate(ctx, omni.ControlPlanesIDSuffix, omni.LabelControlPlaneRole)
+}
+
+func init() {
+	register[ControlPlane](KindControlPlane)
+}
diff --git a/client/pkg/template/internal/models/list.go b/client/pkg/template/internal/models/list.go
new file mode 100644
index 000000000..93ec2ea52
--- /dev/null
+++ b/client/pkg/template/internal/models/list.go
@@ -0,0 +1,196 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package models
+
+import (
+	"fmt"
+	"slices"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/hashicorp/go-multierror"
+	"github.com/siderolabs/gen/maps"
+	"github.com/siderolabs/gen/xslices"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// List implements a list of models, essentially it's a template.
+type List []Model
+
+// Validate the set of models as a complete template.
+//
+// Each model should be valid, but also the set of models should be complete.
+//
+//nolint:gocyclo,cyclop
+func (l List) Validate() error {
+	var multiErr error
+
+	for _, model := range l {
+		multiErr = joinErrors(multiErr, model.Validate())
+	}
+
+	// complete template should contain 1 cluster, 1 controlplane, 0-N workers
+	// and machines mentioned in the controlplane or worker models
+	var (
+		clusterCount         int
+		controlplaneCount    int
+		controlPlaneMachines MachineIDList
+
+		workerMachineSetNameToCount        = make(map[string]int)
+		workerMachineIDToWorkerMachineSets = make(map[MachineID][]string)
+	)
+
+	lockedMachines := make(map[MachineID]struct{})
+
+	for _, model := range l {
+		switch m := model.(type) {
+		case *Cluster:
+			clusterCount++
+		case *ControlPlane:
+			controlplaneCount++
+
+			controlPlaneMachines = append(controlPlaneMachines, m.Machines...)
+		case *Workers:
+			workerMachineSetNameToCount[m.Name]++
+
+			for _, machineID := range m.Machines {
+				workerMachineIDToWorkerMachineSets[machineID] = append(workerMachineIDToWorkerMachineSets[machineID], m.Name)
+			}
+		case *Machine:
+			if m.Locked {
+				lockedMachines[m.Name] = struct{}{}
+			}
+		}
+	}
+
+	if clusterCount != 1 {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("template should contain 1 cluster, got %d", clusterCount))
+	}
+
+	if controlplaneCount != 1 {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("template should contain 1 controlplane, got %d", controlplaneCount))
+	}
+
+	for name, count := range workerMachineSetNameToCount {
+		if count > 1 {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("duplicate workers with name %q", name))
+		}
+	}
+
+	for machineID, machineSets := range workerMachineIDToWorkerMachineSets {
+		if len(machineSets) > 1 {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("machine %q is used in multiple workers: %q", machineID, machineSets))
+		}
+	}
+
+	cpMachinesSet := xslices.ToSet(controlPlaneMachines)
+	workerMachines := maps.Keys(workerMachineIDToWorkerMachineSets)
+
+	intersection := xslices.Filter(workerMachines, func(id MachineID) bool {
+		_, ok := cpMachinesSet[id]
+
+		return ok
+	})
+
+	if len(intersection) != 0 {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("machines %v are used in both controlplane and workers", intersection))
+	}
+
+	allMachines := append(slices.Clone(controlPlaneMachines), workerMachines...)
+	allMachinesSet := xslices.ToSet(allMachines)
+
+	for _, model := range l {
+		if machine, ok := model.(*Machine); ok {
+			if _, ok := allMachinesSet[machine.Name]; !ok {
+				multiErr = multierror.Append(multiErr, fmt.Errorf("machine %q is not used in controlplane or workers", machine.Name))
+			}
+		}
+	}
+
+	for _, cpMachine := range controlPlaneMachines {
+		if _, ok := lockedMachines[cpMachine]; ok {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("machine %q is locked and used in controlplane", cpMachine))
+		}
+	}
+
+	return multiErr
+}
+
+// Translate a set of models (template) to a set of Omni resources.
+//
+// Translate assumes that the template is valid.
+func (l List) Translate() ([]resource.Resource, error) {
+	context := TranslateContext{
+		LockedMachines:     make(map[MachineID]struct{}),
+		MachineDescriptors: make(map[MachineID]Descriptors),
+	}
+
+	for _, model := range l {
+		switch m := model.(type) {
+		case *Cluster:
+			context.ClusterName = m.Name
+		case *Machine:
+			context.MachineDescriptors[m.Name] = m.Descriptors
+
+			if m.Locked {
+				context.LockedMachines[m.Name] = struct{}{}
+			}
+		}
+	}
+
+	var (
+		multiErr      error
+		resourcesList []resource.Resource
+	)
+
+	for _, model := range l {
+		resources, err := model.Translate(context)
+		if err != nil {
+			multiErr = multierror.Append(multiErr, err)
+
+			continue
+		}
+
+		resourcesList = append(resourcesList, resources...)
+	}
+
+	// perform additional validation:
+	// - all resources except for cluster itself should have a cluster label
+	// - all resources should have a unique ID
+	resourceIDs := map[resource.Type]map[resource.ID]struct{}{}
+
+	for _, r := range resourcesList {
+		if _, ok := resourceIDs[r.Metadata().Type()]; !ok {
+			resourceIDs[r.Metadata().Type()] = map[resource.ID]struct{}{}
+		}
+
+		if _, ok := resourceIDs[r.Metadata().Type()][r.Metadata().ID()]; ok {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("resource ID duplicate %s", resource.String(r)))
+		}
+
+		resourceIDs[r.Metadata().Type()][r.Metadata().ID()] = struct{}{}
+
+		if r.Metadata().Type() == omni.ClusterType {
+			continue
+		}
+
+		if l, _ := r.Metadata().Labels().Get(omni.LabelCluster); l != context.ClusterName {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("resource %q is missing cluster label", r.Metadata().ID()))
+		}
+	}
+
+	return resourcesList, multiErr
+}
+
+// ClusterName returns the name of the cluster in the template.
+func (l List) ClusterName() (string, error) {
+	for _, model := range l {
+		if cluster, ok := model.(*Cluster); ok {
+			return cluster.Name, nil
+		}
+	}
+
+	return "", fmt.Errorf("cluster model not found")
+}
diff --git a/client/pkg/template/internal/models/machine.go b/client/pkg/template/internal/models/machine.go
new file mode 100644
index 000000000..c928e7aa6
--- /dev/null
+++ b/client/pkg/template/internal/models/machine.go
@@ -0,0 +1,145 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package models
+
+import (
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/google/uuid"
+	"github.com/hashicorp/go-multierror"
+	"github.com/siderolabs/gen/pair"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// MachineIDList is a list of Machine UUIDs.
+type MachineIDList []MachineID
+
+// MachineID is a Machine UUID.
+type MachineID string
+
+// KindMachine is a Machine model kind.
+const KindMachine = "Machine"
+
+// Machine provides customization for a specific machine.
+type Machine struct { //nolint:govet
+	Meta `yaml:",inline"`
+
+	// Machine name (ID).
+	Name MachineID `yaml:"name"`
+
+	// Descriptors are the user descriptors to apply to the cluster.
+	Descriptors Descriptors `yaml:",inline"`
+
+	// Locked locks the machine, so no config updates, upgrades and downgrades will be performed on the machine.
+	Locked bool `yaml:"locked,omitempty"`
+
+	// Install specification.
+	Install MachineInstall `yaml:"install,omitempty"`
+
+	// ClusterMachine patches.
+	Patches PatchList `yaml:"patches,omitempty"`
+}
+
+// MachineInstall provides machine install configuration.
+type MachineInstall struct {
+	// Disk device name.
+	Disk string `yaml:"disk"`
+}
+
+// Validate the list of machines.
+func (l MachineIDList) Validate() error {
+	var multiErr error
+
+	for _, id := range l {
+		multiErr = joinErrors(multiErr, id.Validate())
+	}
+
+	return multiErr
+}
+
+// Validate the model.
+func (id MachineID) Validate() error {
+	if _, err := uuid.Parse(string(id)); err != nil {
+		return fmt.Errorf("invalid machine ID %q: %w", id, err)
+	}
+
+	return nil
+}
+
+// Validate the model.
+func (install *MachineInstall) Validate() error {
+	return nil
+}
+
+// Validate the model.
+func (machine *Machine) Validate() error {
+	var multiErr error
+
+	if machine.Name == "" {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("name is required for machine"))
+	}
+
+	if err := machine.Descriptors.Validate(); err != nil {
+		multiErr = multierror.Append(multiErr, err)
+	}
+
+	multiErr = joinErrors(multiErr, machine.Name.Validate(), machine.Install.Validate(), machine.Patches.Validate())
+
+	if multiErr != nil {
+		return fmt.Errorf("machine %q is invalid: %w", machine.Name, multiErr)
+	}
+
+	return nil
+}
+
+// Translate the model.
+func (machine *Machine) Translate(context TranslateContext) ([]resource.Resource, error) {
+	var resourceList []resource.Resource
+
+	if machine.Install.Disk != "" {
+		patch := Patch{
+			Name: "install-disk",
+			Inline: map[string]any{
+				"machine": map[string]any{
+					"install": map[string]any{
+						"disk": machine.Install.Disk,
+					},
+				},
+			},
+		}
+
+		patchResource, err := patch.Translate(
+			fmt.Sprintf("cm-%s", machine.Name),
+			constants.PatchWeightInstallDisk,
+			pair.MakePair(omni.LabelCluster, context.ClusterName),
+			pair.MakePair(omni.LabelClusterMachine, string(machine.Name)),
+			pair.MakePair(omni.LabelSystemPatch, ""),
+		)
+		if err != nil {
+			return nil, err
+		}
+
+		resourceList = append(resourceList, patchResource)
+	}
+
+	patches, err := machine.Patches.Translate(
+		fmt.Sprintf("cm-%s", machine.Name),
+		constants.PatchBaseWeightClusterMachine,
+		pair.MakePair(omni.LabelCluster, context.ClusterName),
+		pair.MakePair(omni.LabelClusterMachine, string(machine.Name)),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return append(resourceList, patches...), nil
+}
+
+func init() {
+	register[Machine](KindMachine)
+}
diff --git a/client/pkg/template/internal/models/machineset.go b/client/pkg/template/internal/models/machineset.go
new file mode 100644
index 000000000..8974328b8
--- /dev/null
+++ b/client/pkg/template/internal/models/machineset.go
@@ -0,0 +1,248 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package models
+
+import (
+	"fmt"
+	"strconv"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/hashicorp/go-multierror"
+	"github.com/siderolabs/gen/pair"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// MachineSet is a base model for controlplane and workers.
+type MachineSet struct {
+	Meta `yaml:",inline"`
+
+	// Name is the name of the machine set. When empty, the default name will be used.
+	Name string `yaml:"name,omitempty"`
+
+	// Descriptors are the user descriptors to apply to the cluster.
+	Descriptors Descriptors `yaml:",inline"`
+
+	BootstrapSpec *BootstrapSpec `yaml:"bootstrapSpec,omitempty"`
+
+	// MachineSet machines.
+	Machines MachineIDList `yaml:"machines,omitempty"`
+
+	MachineClass *MachineClassConfig `yaml:"machineClass,omitempty"`
+
+	// UpdateStrategy defines the update strategy for the machine set.
+	UpdateStrategy *UpdateStrategyConfig `yaml:"updateStrategy,omitempty"`
+
+	// DeleteStrategy defines the delete strategy for the machine set.
+	DeleteStrategy *UpdateStrategyConfig `yaml:"deleteStrategy,omitempty"`
+
+	// MachineSet patches.
+	Patches PatchList `yaml:"patches,omitempty"`
+}
+
+// BootstrapSpec defines the model for setting the bootstrap specification, i.e. restoring from a backup, in the machine set.
+// Only valid for the control plane machine set.
+type BootstrapSpec struct {
+	// ClusterUUID defines the UUID of the cluster to restore from.
+	ClusterUUID string `yaml:"clusterUUID"`
+
+	// Snapshot defines the snapshot file name to restore from.
+	Snapshot string `yaml:"snapshot"`
+}
+
+// MachineClassConfig defines the model for setting the machine class based machine selector in the machine set.
+type MachineClassConfig struct {
+	// Name defines used machine class name.
+	Name string `yaml:"name"`
+
+	// Size sets the number of machines to be pulled from the machine class.
+	Size Size `yaml:"size"`
+}
+
+// Size extends protobuf generated allocation type enum to parse string constants.
+type Size struct {
+	Value          uint32
+	AllocationType specs.MachineSetSpec_MachineClass_AllocationType
+}
+
+// UnmarshalYAML implements yaml.Unmarshaler.
+func (c *Size) UnmarshalYAML(unmarshal func(any) error) error {
+	var value string
+
+	if err := unmarshal(&value); err != nil {
+		return err
+	}
+
+	switch value {
+	case "unlimited", "∞", "infinity":
+		value = "Unlimited"
+	}
+
+	v, ok := specs.MachineSetSpec_MachineClass_AllocationType_value[value]
+
+	if !ok {
+		c.AllocationType = specs.MachineSetSpec_MachineClass_Static
+
+		count, err := strconv.ParseUint(value, 10, 32)
+		if err != nil {
+			return fmt.Errorf("invalid machine count %s: %w", value, err)
+		}
+
+		c.Value = uint32(count)
+	}
+
+	c.AllocationType = specs.MachineSetSpec_MachineClass_AllocationType(v)
+
+	return nil
+}
+
+// MarshalYAML implements yaml.Marshaler.
+func (c Size) MarshalYAML() (any, error) {
+	if c.AllocationType != specs.MachineSetSpec_MachineClass_Static {
+		return specs.MachineSetSpec_MachineClass_AllocationType_name[int32(c.AllocationType)], nil
+	}
+
+	return c.Value, nil
+}
+
+// UpdateStrategyType extends protobuf generated update strategy enum to parse string constants.
+type UpdateStrategyType uint32
+
+// UnmarshalYAML implements yaml.Unmarshaler.
+func (t *UpdateStrategyType) UnmarshalYAML(unmarshal func(any) error) error {
+	var value string
+
+	if err := unmarshal(&value); err != nil {
+		return err
+	}
+
+	v, ok := specs.MachineSetSpec_UpdateStrategy_value[value]
+
+	if !ok {
+		return fmt.Errorf("invalid update strategy type %s", value)
+	}
+
+	*t = UpdateStrategyType(v)
+
+	return nil
+}
+
+// MarshalYAML implements yaml.Marshaler.
+func (t UpdateStrategyType) MarshalYAML() (any, error) {
+	return specs.MachineSetSpec_UpdateStrategy_name[int32(t)], nil
+}
+
+// RollingUpdateStrategyConfig defines the model for setting the rolling update strategy in the machine set.
+type RollingUpdateStrategyConfig struct {
+	MaxParallelism uint32 `yaml:"maxParallelism,omitempty"`
+}
+
+// UpdateStrategyConfig defines the model for setting the update strategy in the machine set.
+type UpdateStrategyConfig struct {
+	Type    *UpdateStrategyType          `yaml:"type,omitempty"`
+	Rolling *RollingUpdateStrategyConfig `yaml:"rolling,omitempty"`
+}
+
+// Validate checks the machine set fields correctness.
+func (machineset *MachineSet) Validate() error {
+	var multiErr error
+
+	if err := machineset.Descriptors.Validate(); err != nil {
+		multiErr = multierror.Append(multiErr, err)
+	}
+
+	if len(machineset.Machines) > 0 && machineset.MachineClass != nil {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("machine set can not have both machines and machine class defined"))
+	}
+
+	return multiErr
+}
+
+// Translate the model.
+func (machineset *MachineSet) translate(ctx TranslateContext, nameSuffix, roleLabel string) ([]resource.Resource, error) {
+	id := omni.AdditionalWorkersResourceID(ctx.ClusterName, nameSuffix)
+
+	machineSet := omni.NewMachineSet(resources.DefaultNamespace, id)
+	machineSet.Metadata().Labels().Set(omni.LabelCluster, ctx.ClusterName)
+	machineSet.Metadata().Labels().Set(roleLabel, "")
+
+	machineset.Descriptors.Apply(machineSet)
+
+	machineSet.TypedSpec().Value.UpdateStrategy = specs.MachineSetSpec_Rolling // Update strategy is Rolling when not specified.
+
+	if machineset.UpdateStrategy != nil {
+		if machineset.UpdateStrategy.Type != nil {
+			machineSet.TypedSpec().Value.UpdateStrategy = specs.MachineSetSpec_UpdateStrategy(*machineset.UpdateStrategy.Type)
+		}
+
+		if machineset.UpdateStrategy.Rolling != nil {
+			machineSet.TypedSpec().Value.UpdateStrategyConfig = &specs.MachineSetSpec_UpdateStrategyConfig{
+				Rolling: &specs.MachineSetSpec_RollingUpdateStrategyConfig{
+					MaxParallelism: machineset.UpdateStrategy.Rolling.MaxParallelism,
+				},
+			}
+		}
+	}
+
+	if machineset.DeleteStrategy != nil {
+		if machineset.DeleteStrategy.Type != nil {
+			machineSet.TypedSpec().Value.DeleteStrategy = specs.MachineSetSpec_UpdateStrategy(*machineset.DeleteStrategy.Type)
+		}
+
+		if machineset.DeleteStrategy.Rolling != nil {
+			machineSet.TypedSpec().Value.DeleteStrategyConfig = &specs.MachineSetSpec_UpdateStrategyConfig{
+				Rolling: &specs.MachineSetSpec_RollingUpdateStrategyConfig{
+					MaxParallelism: machineset.DeleteStrategy.Rolling.MaxParallelism,
+				},
+			}
+		}
+	}
+
+	resourceList := []resource.Resource{machineSet}
+
+	if machineset.BootstrapSpec != nil {
+		machineSet.TypedSpec().Value.BootstrapSpec = &specs.MachineSetSpec_BootstrapSpec{
+			ClusterUuid: machineset.BootstrapSpec.ClusterUUID,
+			Snapshot:    machineset.BootstrapSpec.Snapshot,
+		}
+	}
+
+	if machineset.MachineClass != nil {
+		machineSet.TypedSpec().Value.MachineClass = &specs.MachineSetSpec_MachineClass{
+			Name:           machineset.MachineClass.Name,
+			MachineCount:   machineset.MachineClass.Size.Value,
+			AllocationType: machineset.MachineClass.Size.AllocationType,
+		}
+	} else {
+		for _, machineID := range machineset.Machines {
+			machineSetNode := omni.NewMachineSetNode(resources.DefaultNamespace, string(machineID), machineSet)
+			descriptors := ctx.MachineDescriptors[machineID]
+
+			descriptors.Apply(machineSetNode)
+
+			_, locked := ctx.LockedMachines[machineID]
+			if locked {
+				machineSetNode.Metadata().Annotations().Set(omni.MachineLocked, "")
+			}
+
+			resourceList = append(resourceList, machineSetNode)
+		}
+	}
+
+	patches, err := machineset.Patches.Translate(
+		id,
+		constants.PatchBaseWeightMachineSet,
+		pair.MakePair(omni.LabelCluster, ctx.ClusterName),
+		pair.MakePair(omni.LabelMachineSet, id),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return append(resourceList, patches...), nil
+}
diff --git a/client/pkg/template/internal/models/models.go b/client/pkg/template/internal/models/models.go
new file mode 100644
index 000000000..68dc7e2b6
--- /dev/null
+++ b/client/pkg/template/internal/models/models.go
@@ -0,0 +1,103 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package models provides cluster template models (for each sub-document of multi-doc YAML).
+package models
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/hashicorp/go-multierror"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// Meta is embedded into all template objects.
+type Meta struct {
+	Kind string `yaml:"kind"`
+}
+
+// TranslateContext is a context for translation.
+type TranslateContext struct {
+	LockedMachines map[MachineID]struct{}
+
+	MachineDescriptors map[MachineID]Descriptors
+
+	// ClusterName is the name of the cluster.
+	ClusterName string
+}
+
+// Descriptors are the user descriptors (i.e. Labels, Annotations) to apply to the resource.
+type Descriptors struct {
+	// Labels are the user labels to apply to the resource.
+	Labels map[string]string `yaml:"labels,omitempty"`
+
+	// Annotations are the user annotations to apply to the resource.
+	Annotations map[string]string `yaml:"annotations,omitempty"`
+}
+
+// Validate validates the descriptors.
+func (d *Descriptors) Validate() error {
+	var multiErr error
+
+	for labelKey := range d.Labels {
+		if strings.HasPrefix(labelKey, omni.SystemLabelPrefix) {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("label %q is invalid: prefix %q is reserved for internal use", labelKey, omni.SystemLabelPrefix))
+		}
+	}
+
+	for annotationKey := range d.Annotations {
+		if strings.HasPrefix(annotationKey, omni.SystemLabelPrefix) {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("annotation %q is invalid: prefix %q is reserved for internal use", annotationKey, omni.SystemLabelPrefix))
+		}
+	}
+
+	return multiErr
+}
+
+// Apply applies the descriptors to the given resource.
+func (d *Descriptors) Apply(res resource.Resource) {
+	for k, v := range d.Labels {
+		res.Metadata().Labels().Set(k, v)
+	}
+
+	for k, v := range d.Annotations {
+		res.Metadata().Annotations().Set(k, v)
+	}
+}
+
+// Model is a base interface for cluster templates.
+type Model interface {
+	Validate() error
+	Translate(TranslateContext) ([]resource.Resource, error)
+}
+
+var registeredModels = map[string]func() Model{}
+
+type model[T any] interface {
+	*T
+	Model
+}
+
+func register[T any, P model[T]](kind string) {
+	if _, ok := registeredModels[kind]; ok {
+		panic(fmt.Sprintf("model %s already registered", kind))
+	}
+
+	registeredModels[kind] = func() Model {
+		return P(new(T))
+	}
+}
+
+// New creates a model by kind.
+func New(kind string) (Model, error) {
+	f, ok := registeredModels[kind]
+	if !ok {
+		return nil, fmt.Errorf("unknown model kind %q", kind)
+	}
+
+	return f(), nil
+}
diff --git a/client/pkg/template/internal/models/patch.go b/client/pkg/template/internal/models/patch.go
new file mode 100644
index 000000000..67c2bdce9
--- /dev/null
+++ b/client/pkg/template/internal/models/patch.go
@@ -0,0 +1,163 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package models
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/hashicorp/go-multierror"
+	"github.com/siderolabs/gen/pair"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// PatchList is a list of patches.
+type PatchList []Patch
+
+// Patch is a Talos machine configuration patch.
+type Patch struct { //nolint:govet
+	// Name of the patch.
+	//
+	// Optional for 'path' patches, mandatory for 'inline' patches if idOverride is not set.
+	Name string `yaml:"name,omitempty"`
+
+	// IDOverride overrides the ID of the patch. When set, the ID will not be generated using the name and/or the file path.
+	IDOverride string `yaml:"idOverride,omitempty"`
+
+	// Descriptors are the user descriptors to apply to the resource.
+	Descriptors Descriptors `yaml:",inline"`
+
+	// File path to the file containing the patch.
+	//
+	// Mutually exclusive with `inline:`.
+	File string `yaml:"file,omitempty"`
+
+	// Inline patch content.
+	Inline map[string]any `yaml:"inline,omitempty"`
+}
+
+// Validate the model.
+func (l PatchList) Validate() error {
+	var multiErr error
+
+	for _, patch := range l {
+		multiErr = joinErrors(multiErr, patch.Validate())
+	}
+
+	return multiErr
+}
+
+// Translate the list of patches into a list of resources.
+func (l PatchList) Translate(prefix string, baseWeight int, labels ...pair.Pair[string, string]) ([]resource.Resource, error) {
+	resources := make([]resource.Resource, 0, len(l))
+
+	for i, patch := range l {
+		r, err := patch.Translate(prefix, baseWeight+i, labels...)
+		if err != nil {
+			return nil, err
+		}
+
+		resources = append(resources, r)
+	}
+
+	return resources, nil
+}
+
+// Validate the model.
+func (patch *Patch) Validate() error {
+	var multiErr error
+
+	name := patch.Name
+	if name == "" {
+		name = patch.File
+	}
+
+	if err := patch.Descriptors.Validate(); err != nil {
+		multiErr = multierror.Append(multiErr, err)
+	}
+
+	if patch.File != "" && patch.Inline != nil {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("path and inline are mutually exclusive"))
+	}
+
+	if patch.File == "" && patch.Inline == nil {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("path or inline is required"))
+	}
+
+	switch {
+	case patch.File != "":
+		raw, err := os.ReadFile(patch.File)
+		if err != nil {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("failed to access %q: %w", patch.File, err))
+		} else {
+			if err = omni.ValidateConfigPatch(string(raw)); err != nil {
+				multiErr = multierror.Append(multiErr, fmt.Errorf("failed to validate patch %q: %w", patch.File, err))
+			}
+		}
+	case patch.Inline != nil:
+		if patch.Name == "" && patch.IDOverride == "" {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("either name or idOverride is required for inline patches"))
+		}
+
+		raw, err := yaml.Marshal(patch.Inline)
+		if err != nil {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("failed to marshal inline patch %q: %w", name, err))
+		} else {
+			if err = omni.ValidateConfigPatch(string(raw)); err != nil {
+				multiErr = multierror.Append(multiErr, fmt.Errorf("failed to validate inline patch %q: %w", name, err))
+			}
+		}
+	}
+
+	if multiErr != nil {
+		return fmt.Errorf("patch %q is invalid: %w", name, multiErr)
+	}
+
+	return nil
+}
+
+// Translate the model into a resource.
+func (patch *Patch) Translate(prefix string, weight int, labels ...pair.Pair[string, string]) (*omni.ConfigPatch, error) {
+	name := patch.Name
+	if name == "" {
+		name = patch.File
+	}
+
+	id := patch.IDOverride
+	if id == "" {
+		id = fmt.Sprintf("%03d-%s-%s", weight, prefix, name)
+	}
+
+	var (
+		raw []byte
+		err error
+	)
+
+	switch {
+	case patch.File != "":
+		raw, err = os.ReadFile(patch.File)
+	case patch.Inline != nil:
+		raw, err = yaml.Marshal(patch.Inline)
+	default:
+		panic("missing patch contents?")
+	}
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to read patch %q: %w", name, err)
+	}
+
+	patchResource := omni.NewConfigPatch(resources.DefaultNamespace, id, labels...)
+	patchResource.Metadata().Annotations().Set("name", name)
+
+	patch.Descriptors.Apply(patchResource)
+
+	patchResource.TypedSpec().Value.Data = string(raw)
+
+	return patchResource, nil
+}
diff --git a/client/pkg/template/internal/models/workers.go b/client/pkg/template/internal/models/workers.go
new file mode 100644
index 000000000..b59c66f99
--- /dev/null
+++ b/client/pkg/template/internal/models/workers.go
@@ -0,0 +1,60 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package models
+
+import (
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/hashicorp/go-multierror"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// KindWorkers is Workers model kind.
+const KindWorkers = "Workers"
+
+// Workers describes Cluster worker nodes.
+type Workers struct {
+	MachineSet `yaml:",inline"`
+}
+
+// Validate the model.
+func (workers *Workers) Validate() error {
+	var multiErr error
+
+	if workers.Name == omni.ControlPlanesIDSuffix {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("name %q cannot be used in workers", omni.ControlPlanesIDSuffix))
+	}
+
+	if workers.BootstrapSpec != nil {
+		multiErr = multierror.Append(multiErr, fmt.Errorf("bootstrapSpec is not allowed in workers"))
+	}
+
+	multiErr = joinErrors(multiErr, workers.MachineSet.Validate(), workers.Machines.Validate(), workers.Patches.Validate())
+
+	if multiErr != nil {
+		return fmt.Errorf("workers is invalid: %w", multiErr)
+	}
+
+	return nil
+}
+
+// Translate the model.
+func (workers *Workers) Translate(ctx TranslateContext) ([]resource.Resource, error) {
+	var nameSuffix string
+
+	if workers.Name == "" {
+		nameSuffix = omni.DefaultWorkersIDSuffix
+	} else {
+		nameSuffix = workers.Name
+	}
+
+	return workers.translate(ctx, nameSuffix, omni.LabelWorkerRole)
+}
+
+func init() {
+	register[Workers](KindWorkers)
+}
diff --git a/client/pkg/template/operations/delete.go b/client/pkg/template/operations/delete.go
new file mode 100644
index 000000000..211014fd4
--- /dev/null
+++ b/client/pkg/template/operations/delete.go
@@ -0,0 +1,82 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package operations
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	"github.com/siderolabs/omni/client/pkg/template"
+)
+
+// DeleteTemplate removes all template resources from Omni.
+func DeleteTemplate(ctx context.Context, templateReader io.Reader, out io.Writer, st state.State, syncOptions SyncOptions) error {
+	tmpl, err := template.Load(templateReader)
+	if err != nil {
+		return fmt.Errorf("error loading template: %w", err)
+	}
+
+	if err = tmpl.Validate(); err != nil {
+		return err
+	}
+
+	return deleteTemplate(ctx, tmpl, out, st, syncOptions)
+}
+
+// DeleteCluster removes all cluster resources from Omni via template operations.
+func DeleteCluster(ctx context.Context, clusterName string, out io.Writer, st state.State, syncOptions SyncOptions) error {
+	tmpl := template.WithCluster(clusterName)
+
+	return deleteTemplate(ctx, tmpl, out, st, syncOptions)
+}
+
+func deleteTemplate(ctx context.Context, tmpl *template.Template, out io.Writer, st state.State, syncOptions SyncOptions) error {
+	syncResult, err := tmpl.Delete(ctx, st)
+	if err != nil {
+		return err
+	}
+
+	if syncOptions.DestroyMachines {
+		clusterName, err := tmpl.ClusterName()
+		if err != nil {
+			return err
+		}
+
+		machines, err := st.List(ctx, resource.NewMetadata(resources.DefaultNamespace, omni.MachineStatusType, "", resource.VersionUndefined),
+			state.WithLabelQuery(resource.LabelExists(omni.MachineStatusLabelDisconnected), resource.LabelEqual(omni.LabelCluster, clusterName)),
+		)
+		if err != nil {
+			return err
+		}
+
+		var allPatches []resource.Resource
+
+		links := make([]resource.Resource, 0, len(machines.Items))
+
+		for _, machine := range machines.Items {
+			patches, err := st.List(ctx, resource.NewMetadata(resources.DefaultNamespace, omni.ConfigPatchType, "", resource.VersionUndefined),
+				state.WithLabelQuery(resource.LabelEqual(omni.LabelMachine, machine.Metadata().ID())),
+			)
+			if err != nil {
+				return err
+			}
+
+			allPatches = append(allPatches, patches.Items...)
+			links = append(links, siderolink.NewLink(resources.DefaultNamespace, machine.Metadata().ID(), nil))
+		}
+
+		syncResult.Destroy = append([][]resource.Resource{links},
+			append([][]resource.Resource{allPatches}, syncResult.Destroy...)...)
+	}
+
+	return syncDelete(ctx, syncResult, out, st, syncOptions)
+}
diff --git a/client/pkg/template/operations/diff.go b/client/pkg/template/operations/diff.go
new file mode 100644
index 000000000..9ca75ce9c
--- /dev/null
+++ b/client/pkg/template/operations/diff.go
@@ -0,0 +1,55 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package operations
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/cosi-project/runtime/pkg/state"
+
+	"github.com/siderolabs/omni/client/pkg/template"
+	"github.com/siderolabs/omni/client/pkg/template/operations/internal/utils"
+)
+
+// DiffTemplate outputs the diff between template resources and existing resources.
+func DiffTemplate(ctx context.Context, templateReader io.Reader, output io.Writer, st state.State) error {
+	tmpl, err := template.Load(templateReader)
+	if err != nil {
+		return fmt.Errorf("error loading template: %w", err)
+	}
+
+	if err = tmpl.Validate(); err != nil {
+		return err
+	}
+
+	syncResult, err := tmpl.Sync(ctx, st)
+	if err != nil {
+		return fmt.Errorf("error syncing template: %w", err)
+	}
+
+	for _, p := range syncResult.Update {
+		if err = utils.RenderDiff(output, p.Old, p.New); err != nil {
+			return err
+		}
+	}
+
+	for _, r := range syncResult.Create {
+		if err = utils.RenderDiff(output, nil, r); err != nil {
+			return err
+		}
+	}
+
+	for _, phase := range syncResult.Destroy {
+		for _, r := range phase {
+			if err = utils.RenderDiff(output, r, nil); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/client/pkg/template/operations/export.go b/client/pkg/template/operations/export.go
new file mode 100644
index 000000000..c27cc972b
--- /dev/null
+++ b/client/pkg/template/operations/export.go
@@ -0,0 +1,523 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package operations
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/go-pointer"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/template/internal/models"
+)
+
+type clusterResources struct {
+	machineSetNodes             map[string][]*omni.MachineSetNode
+	machineSetConfigPatches     map[string][]*omni.ConfigPatch
+	clusterMachineConfigPatches map[string][]*omni.ConfigPatch
+	clusterMachineInstallDisks  map[string]string
+
+	cluster *omni.Cluster
+
+	machineSets          []*omni.MachineSet
+	clusterConfigPatches []*omni.ConfigPatch
+}
+
+// ExportTemplate exports the cluster configuration as a template.
+func ExportTemplate(ctx context.Context, st state.State, clusterID string, writer io.Writer) (models.List, error) {
+	resources, err := collectClusterResources(ctx, st, clusterID)
+	if err != nil {
+		return nil, err
+	}
+
+	clusterModel, err := transformClusterToModel(resources.cluster, resources.clusterConfigPatches)
+	if err != nil {
+		return nil, err
+	}
+
+	var controlPlaneMachineSetModel models.ControlPlane
+
+	workerMachineSetModels := make([]models.Workers, 0, len(resources.machineSets))
+
+	for _, machineSet := range resources.machineSets {
+		machineSetModel, transformErr := transformMachineSetToModel(machineSet,
+			resources.machineSetNodes[machineSet.Metadata().ID()],
+			resources.machineSetConfigPatches[machineSet.Metadata().ID()])
+		if transformErr != nil {
+			return nil, transformErr
+		}
+
+		if _, isControlPlane := machineSet.Metadata().Labels().Get(omni.LabelControlPlaneRole); isControlPlane {
+			controlPlaneMachineSetModel = models.ControlPlane{MachineSet: machineSetModel}
+
+			continue
+		}
+
+		workerMachineSetModels = append(workerMachineSetModels, models.Workers{MachineSet: machineSetModel})
+	}
+
+	machineModels := make([]models.Machine, 0, len(resources.machineSetNodes))
+
+	for _, machineSetNodes := range resources.machineSetNodes {
+		for _, machineSetNode := range machineSetNodes {
+			machineModel, transformErr := transformMachineSetNodeToModel(machineSetNode,
+				resources.clusterMachineConfigPatches[machineSetNode.Metadata().ID()],
+				resources.clusterMachineInstallDisks[machineSetNode.Metadata().ID()],
+			)
+			if transformErr != nil {
+				return nil, transformErr
+			}
+
+			machineModels = append(machineModels, machineModel)
+		}
+	}
+
+	modelList := buildModelList(clusterModel, controlPlaneMachineSetModel, workerMachineSetModels, machineModels)
+	if err = modelList.Validate(); err != nil {
+		return nil, fmt.Errorf("error validating models: %w", err)
+	}
+
+	return modelList, writeYAML(writer, modelList)
+}
+
+func buildModelList(clusterModel models.Cluster, controlPlaneMachineSetModel models.ControlPlane,
+	workerMachineSetModels []models.Workers, machineModels []models.Machine,
+) models.List {
+	modelList := models.List{
+		&clusterModel,
+		&controlPlaneMachineSetModel,
+	}
+
+	slices.SortFunc(workerMachineSetModels, func(a, b models.Workers) int {
+		return strings.Compare(a.Name, b.Name)
+	})
+
+	for _, workerMachineSetModel := range workerMachineSetModels {
+		workerMachineSetModel := workerMachineSetModel
+
+		modelList = append(modelList, &workerMachineSetModel)
+	}
+
+	slices.SortFunc(machineModels, func(a, b models.Machine) int {
+		return strings.Compare(string(a.Name), string(b.Name))
+	})
+
+	for _, machineModel := range machineModels {
+		machineModel := machineModel
+
+		modelList = append(modelList, &machineModel)
+	}
+
+	return modelList
+}
+
+func writeYAML(writer io.Writer, modelList models.List) (err error) {
+	encoder := yaml.NewEncoder(writer)
+
+	defer func() {
+		err = errors.Join(err, encoder.Close())
+	}()
+
+	encoder.SetIndent(2)
+
+	for _, model := range modelList {
+		if err = encoder.Encode(model); err != nil {
+			return fmt.Errorf("error encoding model: %w", err)
+		}
+	}
+
+	return nil
+}
+
+func transformConfigPatchToModel(configPatch *omni.ConfigPatch) (models.Patch, error) {
+	var data map[string]any
+
+	if err := yaml.Unmarshal([]byte(configPatch.TypedSpec().Value.GetData()), &data); err != nil {
+		return models.Patch{}, fmt.Errorf("failed to unmarshal patch %q: %w", configPatch.Metadata().ID(), err)
+	}
+
+	return models.Patch{
+		Descriptors: getUserDescriptors(configPatch),
+		IDOverride:  configPatch.Metadata().ID(),
+		Inline:      data,
+	}, nil
+}
+
+func transformConfigPatchesToModels(configPatches []*omni.ConfigPatch) (models.PatchList, error) {
+	patchModels := make(models.PatchList, 0, len(configPatches))
+
+	for _, configPatch := range configPatches {
+		patchModel, err := transformConfigPatchToModel(configPatch)
+		if err != nil {
+			return nil, err
+		}
+
+		patchModels = append(patchModels, patchModel)
+	}
+
+	slices.SortFunc(patchModels, func(a, b models.Patch) int {
+		return strings.Compare(a.IDOverride, b.IDOverride)
+	})
+
+	return patchModels, nil
+}
+
+func transformMachineSetNodeToModel(machineSetNode *omni.MachineSetNode, patches []*omni.ConfigPatch, installDisk string) (models.Machine, error) {
+	_, locked := machineSetNode.Metadata().Annotations().Get(omni.MachineLocked)
+
+	patchModels, err := transformConfigPatchesToModels(patches)
+	if err != nil {
+		return models.Machine{}, err
+	}
+
+	return models.Machine{
+		Meta: models.Meta{
+			Kind: models.KindMachine,
+		},
+		Name:        models.MachineID(machineSetNode.Metadata().ID()),
+		Descriptors: getUserDescriptors(machineSetNode),
+		Locked:      locked,
+		Install: models.MachineInstall{
+			Disk: installDisk,
+		},
+		Patches: patchModels,
+	}, nil
+}
+
+func transformMachineSetToModel(machineSet *omni.MachineSet, nodes []*omni.MachineSetNode, patches []*omni.ConfigPatch) (models.MachineSet, error) {
+	cluster, _ := machineSet.Metadata().Labels().Get(omni.LabelCluster)
+	_, isControlPlane := machineSet.Metadata().Labels().Get(omni.LabelControlPlaneRole)
+	_, isWorker := machineSet.Metadata().Labels().Get(omni.LabelWorkerRole)
+
+	if !isControlPlane && !isWorker {
+		return models.MachineSet{}, fmt.Errorf("machine set %q has no role label", machineSet.Metadata().ID())
+	}
+
+	spec := machineSet.TypedSpec().Value
+
+	var bootstrapSpec *models.BootstrapSpec
+
+	if spec.GetBootstrapSpec() != nil {
+		bootstrapSpec = &models.BootstrapSpec{
+			ClusterUUID: spec.GetBootstrapSpec().GetClusterUuid(),
+			Snapshot:    spec.GetBootstrapSpec().GetSnapshot(),
+		}
+	}
+
+	var (
+		machineIDs         models.MachineIDList
+		machineClassConfig *models.MachineClassConfig
+	)
+
+	if spec.GetMachineClass() != nil {
+		machineClassConfig = &models.MachineClassConfig{
+			Name: spec.GetMachineClass().GetName(),
+			Size: models.Size{
+				Value:          spec.GetMachineClass().GetMachineCount(),
+				AllocationType: spec.GetMachineClass().GetAllocationType(),
+			},
+		}
+	} else {
+		machineIDs = xslices.Map(nodes, func(node *omni.MachineSetNode) models.MachineID {
+			return models.MachineID(node.Metadata().ID())
+		})
+
+		slices.Sort(machineIDs)
+	}
+
+	var updateStrategyConfig *models.UpdateStrategyConfig
+
+	if spec.GetUpdateStrategyConfig() != nil {
+		updateStrategyConfig = &models.UpdateStrategyConfig{}
+
+		if spec.GetUpdateStrategy() != specs.MachineSetSpec_Rolling { // Rolling is the default for update, so set the strategy type only when it is not Rolling.
+			updateStrategyConfig.Type = pointer.To(models.UpdateStrategyType(spec.GetUpdateStrategy()))
+		}
+
+		if spec.GetUpdateStrategyConfig().GetRolling() != nil {
+			updateStrategyConfig.Rolling = &models.RollingUpdateStrategyConfig{
+				MaxParallelism: spec.GetUpdateStrategyConfig().GetRolling().GetMaxParallelism(),
+			}
+		}
+	}
+
+	var deleteStrategyConfig *models.UpdateStrategyConfig
+
+	if spec.GetDeleteStrategyConfig() != nil {
+		deleteStrategyConfig = &models.UpdateStrategyConfig{}
+
+		if spec.GetDeleteStrategy() != specs.MachineSetSpec_Unset { // Unset is the default for delete, so set the strategy type only when it is not Unset.
+			deleteStrategyConfig.Type = pointer.To(models.UpdateStrategyType(spec.GetDeleteStrategy()))
+		}
+
+		if spec.GetDeleteStrategyConfig().GetRolling() != nil {
+			deleteStrategyConfig.Rolling = &models.RollingUpdateStrategyConfig{
+				MaxParallelism: spec.GetDeleteStrategyConfig().GetRolling().GetMaxParallelism(),
+			}
+		}
+	}
+
+	kind := models.KindControlPlane
+	if isWorker {
+		kind = models.KindWorkers
+	}
+
+	name := ""
+	if isWorker && machineSet.Metadata().ID() != omni.WorkersResourceID(cluster) {
+		name = strings.TrimPrefix(machineSet.Metadata().ID(), cluster+"-")
+	}
+
+	patchModels, err := transformConfigPatchesToModels(patches)
+	if err != nil {
+		return models.MachineSet{}, err
+	}
+
+	return models.MachineSet{
+		Meta: models.Meta{
+			Kind: kind,
+		},
+		Name:           name,
+		Descriptors:    getUserDescriptors(machineSet),
+		BootstrapSpec:  bootstrapSpec,
+		Machines:       machineIDs,
+		MachineClass:   machineClassConfig,
+		Patches:        patchModels,
+		UpdateStrategy: updateStrategyConfig,
+		DeleteStrategy: deleteStrategyConfig,
+	}, nil
+}
+
+func transformClusterToModel(cluster *omni.Cluster, patches []*omni.ConfigPatch) (models.Cluster, error) {
+	spec := cluster.TypedSpec().Value
+	backupIntervalDuration := time.Duration(0)
+
+	if spec.GetBackupConfiguration().GetInterval() != nil {
+		backupIntervalDuration = spec.GetBackupConfiguration().GetInterval().AsDuration()
+	}
+
+	patchModels, err := transformConfigPatchesToModels(patches)
+	if err != nil {
+		return models.Cluster{}, err
+	}
+
+	return models.Cluster{
+		Meta: models.Meta{
+			Kind: models.KindCluster,
+		},
+		Name:        cluster.Metadata().ID(),
+		Descriptors: getUserDescriptors(cluster),
+		Kubernetes: models.KubernetesCluster{
+			Version: "v" + spec.GetKubernetesVersion(),
+		},
+		Talos: models.TalosCluster{
+			Version: "v" + spec.GetTalosVersion(),
+		},
+		Features: models.Features{
+			DiskEncryption:      spec.GetFeatures().GetDiskEncryption(),
+			EnableWorkloadProxy: spec.GetFeatures().GetEnableWorkloadProxy(),
+			BackupConfiguration: models.BackupConfiguration{
+				Interval: backupIntervalDuration,
+			},
+		},
+		Patches: patchModels,
+	}, nil
+}
+
+func getUserDescriptors(res resource.Resource) models.Descriptors {
+	rawLabels := res.Metadata().Labels().Raw()
+	labels := make(map[string]string, len(rawLabels))
+
+	for k, v := range res.Metadata().Labels().Raw() {
+		if !strings.HasPrefix(k, omni.SystemLabelPrefix) {
+			labels[k] = v
+		}
+	}
+
+	rawAnnotations := res.Metadata().Annotations().Raw()
+	annotations := make(map[string]string, len(rawAnnotations))
+
+	for k, v := range res.Metadata().Annotations().Raw() {
+		if !strings.HasPrefix(k, omni.SystemLabelPrefix) {
+			annotations[k] = v
+		}
+	}
+
+	return models.Descriptors{
+		Labels:      labels,
+		Annotations: annotations,
+	}
+}
+
+func collectClusterResources(ctx context.Context, st state.State, clusterID string) (clusterResources, error) {
+	cluster, err := safe.StateGetByID[*omni.Cluster](ctx, st, clusterID)
+	if err != nil {
+		return clusterResources{}, fmt.Errorf("error getting cluster %q: %w", clusterID, err)
+	}
+
+	machineSetList, err := safe.StateListAll[*omni.MachineSet](ctx, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterID)))
+	if err != nil {
+		return clusterResources{}, fmt.Errorf("error listing machine sets of cluster %q: %w", clusterID, err)
+	}
+
+	machineSetIDToMachineSet := listToMap(machineSetList, func(machineSet *omni.MachineSet) resource.ID {
+		return machineSet.Metadata().ID()
+	})
+
+	machineSetNodeList, err := safe.StateListAll[*omni.MachineSetNode](ctx, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterID)))
+	if err != nil {
+		return clusterResources{}, fmt.Errorf("error listing machine set nodes of cluster %q: %w", clusterID, err)
+	}
+
+	machineSetNodes := make(map[string][]*omni.MachineSetNode, machineSetNodeList.Len())
+
+	for iter := machineSetNodeList.Iterator(); iter.Next(); {
+		machineSetNode := iter.Value()
+
+		machineSetLabel, ok := machineSetNode.Metadata().Labels().Get(omni.LabelMachineSet)
+		if !ok {
+			return clusterResources{}, fmt.Errorf("machine set node %q has no machine set label", machineSetNode.Metadata().ID())
+		}
+
+		machineSet, ok := machineSetIDToMachineSet[machineSetLabel]
+		if !ok {
+			return clusterResources{}, fmt.Errorf("unexpected machine set label %q", machineSetLabel)
+		}
+
+		// skip the node if its machine set picks machines from a machine class
+		if machineSet.TypedSpec().Value.GetMachineClass() != nil {
+			continue
+		}
+
+		machineSetNodes[machineSetLabel] = append(machineSetNodes[machineSetLabel], machineSetNode)
+	}
+
+	configPatchList, err := safe.StateListAll[*omni.ConfigPatch](ctx, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterID)))
+	if err != nil {
+		return clusterResources{}, fmt.Errorf("error listing config patches of cluster %q: %w", clusterID, err)
+	}
+
+	clusterConfigPatches := make([]*omni.ConfigPatch, 0, configPatchList.Len())
+	machineSetConfigPatches := make(map[string][]*omni.ConfigPatch, configPatchList.Len())
+	clusterMachineConfigPatches := make(map[string][]*omni.ConfigPatch, configPatchList.Len())
+	clusterMachineInstallDisks := make(map[string]string, configPatchList.Len())
+
+	for iter := configPatchList.Iterator(); iter.Next(); {
+		configPatch := iter.Value()
+
+		// skip the patches with an owner, as they are not user-defined
+		if configPatch.Metadata().Owner() != "" {
+			continue
+		}
+
+		if clusterMachineLabel, ok := configPatch.Metadata().Labels().Get(omni.LabelClusterMachine); ok {
+			installDisk := getInstallDiskFromConfigPatch(configPatch)
+			if installDisk != "" {
+				clusterMachineInstallDisks[clusterMachineLabel] = installDisk
+
+				// this is an install disk patch, therefore it will be set as the machine's install disk on the Machine model,
+				// not in patches, so we skip adding it to the set of regular patches
+				continue
+			}
+
+			clusterMachineConfigPatches[clusterMachineLabel] = append(clusterMachineConfigPatches[clusterMachineLabel], configPatch)
+
+			continue
+		}
+
+		if machineSetLabel, ok := configPatch.Metadata().Labels().Get(omni.LabelMachineSet); ok {
+			machineSetConfigPatches[machineSetLabel] = append(machineSetConfigPatches[machineSetLabel], configPatch)
+
+			continue
+		}
+
+		if _, ok := configPatch.Metadata().Labels().Get(omni.LabelCluster); ok {
+			clusterConfigPatches = append(clusterConfigPatches, configPatch)
+		}
+	}
+
+	return clusterResources{
+		cluster:                     cluster,
+		machineSets:                 listToSlice(machineSetList),
+		machineSetNodes:             machineSetNodes,
+		clusterConfigPatches:        clusterConfigPatches,
+		machineSetConfigPatches:     machineSetConfigPatches,
+		clusterMachineConfigPatches: clusterMachineConfigPatches,
+		clusterMachineInstallDisks:  clusterMachineInstallDisks,
+	}, nil
+}
+
+func getInstallDiskFromConfigPatch(configPatch *omni.ConfigPatch) string {
+	clusterMachine, ok := configPatch.Metadata().Labels().Get(omni.LabelClusterMachine)
+	if !ok {
+		return ""
+	}
+
+	expectedID := fmt.Sprintf("%03d-cm-%s-install-disk", constants.PatchWeightInstallDisk, clusterMachine)
+	if configPatch.Metadata().ID() != expectedID {
+		return ""
+	}
+
+	var data map[string]any
+
+	if err := yaml.Unmarshal([]byte(configPatch.TypedSpec().Value.GetData()), &data); err != nil {
+		return "" // ignore the error, as it will be caught by the validation later
+	}
+
+	machine, ok := data["machine"].(map[string]any)
+	if !ok {
+		return ""
+	}
+
+	install, ok := machine["install"].(map[string]any)
+	if !ok {
+		return ""
+	}
+
+	if slices.ContainsFunc([]map[string]any{data, machine, install}, func(m map[string]any) bool { return len(m) != 1 }) {
+		return "" // there is some data in the patch other than the install disk, so it cannot be converted into install.disk block in the Machine model
+	}
+
+	disk, ok := install["disk"].(string)
+	if !ok {
+		return ""
+	}
+
+	return disk
+}
+
+func listToSlice[T resource.Resource](list safe.List[T]) []T {
+	result := make([]T, 0, list.Len())
+
+	for iter := list.Iterator(); iter.Next(); {
+		result = append(result, iter.Value())
+	}
+
+	return result
+}
+
+func listToMap[K comparable, T resource.Resource](list safe.List[T], keyFunc func(T) K) map[K]T {
+	result := make(map[K]T, list.Len())
+
+	for iter := list.Iterator(); iter.Next(); {
+		value := iter.Value()
+
+		result[keyFunc(value)] = value
+	}
+
+	return result
+}
diff --git a/client/pkg/template/operations/export_test.go b/client/pkg/template/operations/export_test.go
new file mode 100644
index 000000000..cb1c08fa3
--- /dev/null
+++ b/client/pkg/template/operations/export_test.go
@@ -0,0 +1,213 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package operations_test
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"errors"
+	"io"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/siderolabs/gen/maps"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/template/internal/models"
+	"github.com/siderolabs/omni/client/pkg/template/operations"
+)
+
+//go:embed testdata/export/cluster-template.yaml
+var clusterTemplate string
+
+//go:embed testdata/export/cluster-resources.yaml
+var clusterResources []byte
+
+type resources struct {
+	clusters        map[string]*omni.Cluster
+	machineSets     map[string]*omni.MachineSet
+	machineSetNodes map[string]*omni.MachineSetNode
+	configPatches   map[string]*omni.ConfigPatch
+}
+
+func TestExport(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	t.Cleanup(cancel)
+
+	st := buildState(ctx, t)
+
+	// export a template from resources created via the UI
+	exportedTemplate := assertTemplate(ctx, t, st)
+
+	// sync the exported template back into the state and assert that the state is unchanged
+	assertSync(ctx, t, st, exportedTemplate)
+
+	// export a template one more time and assert that it's still the same as the first exported template
+	assertTemplate(ctx, t, st)
+}
+
+// assertSync asserts that the state is unchanged after syncing back the exported template.
+func assertSync(ctx context.Context, t *testing.T, st state.State, exportedTemplate string) {
+	var sb strings.Builder
+
+	resourcesBeforeSync := readResources(ctx, t, st)
+
+	err := operations.SyncTemplate(ctx, strings.NewReader(exportedTemplate), &sb, st, operations.SyncOptions{})
+	require.NoError(t, err)
+
+	resourcesAfterSync := readResources(ctx, t, st)
+
+	assert.ElementsMatch(t, maps.Keys(resourcesBeforeSync.clusters), maps.Keys(resourcesAfterSync.clusters))
+	assert.ElementsMatch(t, maps.Keys(resourcesBeforeSync.machineSets), maps.Keys(resourcesAfterSync.machineSets))
+	assert.ElementsMatch(t, maps.Keys(resourcesBeforeSync.machineSetNodes), maps.Keys(resourcesAfterSync.machineSetNodes))
+	assert.ElementsMatch(t, maps.Keys(resourcesBeforeSync.configPatches), maps.Keys(resourcesAfterSync.configPatches))
+
+	// we expect everything other than config patches to be completely unchanged
+	assertVersionsUnchanged(t, resourcesBeforeSync.clusters, resourcesAfterSync.clusters)
+	assertVersionsUnchanged(t, resourcesBeforeSync.machineSets, resourcesAfterSync.machineSets)
+	assertVersionsUnchanged(t, resourcesBeforeSync.machineSetNodes, resourcesAfterSync.machineSetNodes)
+
+	// config patches might be updated due to discrepancies between how the cluster templates and the frontend generate them, e.g.:
+	// they might differ in the indentation/comments of the patch data, so we do a yaml-equality check on data instead of byte-equality.
+	assertConfigPatches(t, resourcesBeforeSync.configPatches, resourcesAfterSync.configPatches)
+}
+
+func assertVersionsUnchanged[T resource.Resource](t *testing.T, before map[resource.ID]T, after map[resource.ID]T) {
+	for _, beforeResource := range before {
+		afterResource := after[beforeResource.Metadata().ID()]
+
+		assert.Equal(t, beforeResource.Metadata().Version(), afterResource.Metadata().Version(), "resource version changed for resource: %q", beforeResource.Metadata())
+	}
+}
+
+func assertConfigPatches(t *testing.T, before map[string]*omni.ConfigPatch, after map[string]*omni.ConfigPatch) {
+	for _, beforeConfigPatch := range before {
+		afterConfigPatch := after[beforeConfigPatch.Metadata().ID()]
+
+		if beforeConfigPatch.Metadata().Version().Equal(afterConfigPatch.Metadata().Version()) {
+			continue
+		}
+
+		assert.Equal(t, beforeConfigPatch.Metadata().Labels(), afterConfigPatch.Metadata().Labels(), "labels changed for resource: %q", beforeConfigPatch.Metadata())
+		assert.Equal(t, beforeConfigPatch.Metadata().Annotations(), afterConfigPatch.Metadata().Annotations(), "annotations changed for resource: %q", beforeConfigPatch.Metadata())
+
+		assert.YAMLEq(t, beforeConfigPatch.TypedSpec().Value.GetData(), afterConfigPatch.TypedSpec().Value.GetData(),
+			"config patch data changed for resource: %q", beforeConfigPatch.Metadata())
+	}
+}
+
+func readResources(ctx context.Context, t *testing.T, st state.State) resources {
+	clusterList, err := safe.StateListAll[*omni.Cluster](ctx, st)
+	require.NoError(t, err)
+
+	machineSetList, err := safe.StateListAll[*omni.MachineSet](ctx, st)
+	require.NoError(t, err)
+
+	machineSetNodeList, err := safe.StateListAll[*omni.MachineSetNode](ctx, st)
+	require.NoError(t, err)
+
+	configPatchList, err := safe.StateListAll[*omni.ConfigPatch](ctx, st)
+	require.NoError(t, err)
+
+	return resources{
+		clusters:        listToMap(clusterList),
+		machineSets:     listToMap(machineSetList),
+		machineSetNodes: listToMap(machineSetNodeList),
+		configPatches:   listToMap(configPatchList),
+	}
+}
+
+func assertTemplate(ctx context.Context, t *testing.T, st state.State) string {
+	var sb strings.Builder
+
+	modelList, err := operations.ExportTemplate(ctx, st, "export-test", &sb)
+	require.NoError(t, err)
+
+	assertAllFieldsSet(t, modelList)
+
+	assert.Equal(t, clusterTemplate, sb.String())
+
+	return clusterTemplate
+}
+
+// assertAllFieldsSet asserts that all fields of the models are set at least once.
+// This is to ensure that the exporter is handling all fields of the models as new fields are added.
+func assertAllFieldsSet(t *testing.T, modelList models.List) {
+	machineSetTypeName := reflect.TypeOf(models.MachineSet{}).String()
+	modelFieldToIsZero := make(map[string]bool)
+
+	for _, model := range modelList {
+		modelValue := reflect.ValueOf(model).Elem()
+		modelType := modelValue.Type()
+		remainingMachineSetFieldCount := 0
+
+		for _, visibleField := range reflect.VisibleFields(modelType) {
+			modelField := modelType.String() + "." + visibleField.Name
+
+			// if the field belongs to the MachineSet struct, we do not want to check twice for ControlPlane and Workers types
+			if visibleField.Anonymous && visibleField.Type.String() == machineSetTypeName {
+				remainingMachineSetFieldCount = len(reflect.VisibleFields(visibleField.Type))
+			} else {
+				remainingMachineSetFieldCount--
+			}
+
+			if remainingMachineSetFieldCount >= 0 { // the field belongs to the MachineSet Anonymous field
+				modelField = machineSetTypeName + "." + visibleField.Name
+			}
+
+			if isZero, ok := modelFieldToIsZero[modelField]; !ok || isZero {
+				modelFieldToIsZero[modelField] = modelValue.FieldByName(visibleField.Name).IsZero()
+			}
+		}
+	}
+
+	for modelField, isZero := range modelFieldToIsZero {
+		assert.False(t, isZero, "field %q was never set, is the field handled by the exporter?", modelField)
+	}
+}
+
+func buildState(ctx context.Context, t *testing.T) state.State {
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+	dec := yaml.NewDecoder(bytes.NewReader(clusterResources))
+
+	for {
+		var res protobuf.YAMLResource
+
+		err := dec.Decode(&res)
+		if errors.Is(err, io.EOF) {
+			break
+		}
+
+		require.NoError(t, err)
+
+		require.NoError(t, st.Create(ctx, res.Resource(), state.WithCreateOwner(res.Resource().Metadata().Owner())))
+	}
+
+	return st
+}
+
+func listToMap[T resource.Resource](list safe.List[T]) map[resource.ID]T {
+	result := make(map[resource.ID]T, list.Len())
+
+	for iter := list.Iterator(); iter.Next(); {
+		value := iter.Value()
+
+		result[value.Metadata().ID()] = value
+	}
+
+	return result
+}
diff --git a/client/pkg/template/operations/internal/statustree/helpers.go b/client/pkg/template/operations/internal/statustree/helpers.go
new file mode 100644
index 000000000..990f72938
--- /dev/null
+++ b/client/pkg/template/operations/internal/statustree/helpers.go
@@ -0,0 +1,204 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package statustree
+
+import (
+	"fmt"
+
+	"github.com/fatih/color"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+func readyString(ready bool) string {
+	if ready {
+		return color.GreenString("Ready")
+	}
+
+	return color.RedString("Not Ready")
+}
+
+func clusterPhaseString(phase specs.ClusterStatusSpec_Phase) string {
+	phaseString := phase.String()
+
+	var c func(string, ...any) string
+
+	switch phase {
+	case specs.ClusterStatusSpec_UNKNOWN:
+		c = color.YellowString
+	case specs.ClusterStatusSpec_SCALING_UP,
+		specs.ClusterStatusSpec_SCALING_DOWN:
+		c = color.HiYellowString
+	case specs.ClusterStatusSpec_DESTROYING:
+		c = color.HiRedString
+	case specs.ClusterStatusSpec_RUNNING:
+		c = color.GreenString
+	default:
+		c = fmt.Sprintf
+	}
+
+	return c(phaseString)
+}
+
+func kubernetesUpgradePhaseString(phase specs.KubernetesUpgradeStatusSpec_Phase) string {
+	phaseString := phase.String()
+
+	var c func(string, ...any) string
+
+	switch phase {
+	case specs.KubernetesUpgradeStatusSpec_Done:
+		c = color.GreenString
+	case specs.KubernetesUpgradeStatusSpec_Upgrading, specs.KubernetesUpgradeStatusSpec_Reverting:
+		c = color.HiYellowString
+	case specs.KubernetesUpgradeStatusSpec_Failed:
+		c = color.HiRedString
+	case specs.KubernetesUpgradeStatusSpec_Unknown:
+		c = fmt.Sprintf
+	default:
+		c = fmt.Sprintf
+	}
+
+	return c(phaseString)
+}
+
+func talosUpgradePhaseString(phase specs.TalosUpgradeStatusSpec_Phase) string {
+	phaseString := phase.String()
+
+	var c func(string, ...any) string
+
+	switch phase {
+	case specs.TalosUpgradeStatusSpec_Done:
+		c = color.GreenString
+	case specs.TalosUpgradeStatusSpec_Upgrading, specs.TalosUpgradeStatusSpec_Reverting:
+		c = color.HiYellowString
+	case specs.TalosUpgradeStatusSpec_Failed:
+		c = color.HiRedString
+	case specs.TalosUpgradeStatusSpec_Unknown:
+		c = fmt.Sprintf
+	default:
+		c = fmt.Sprintf
+	}
+
+	return c(phaseString)
+}
+
+func machineSetPhaseString(phase specs.MachineSetPhase) string {
+	phaseString := phase.String()
+
+	var c func(string, ...any) string
+
+	switch phase {
+	case specs.MachineSetPhase_Unknown:
+		c = color.YellowString
+	case specs.MachineSetPhase_ScalingUp,
+		specs.MachineSetPhase_ScalingDown,
+		specs.MachineSetPhase_Reconfiguring:
+		c = color.HiYellowString
+	case specs.MachineSetPhase_Destroying, specs.MachineSetPhase_Failed:
+		c = color.HiRedString
+	case specs.MachineSetPhase_Running:
+		c = color.GreenString
+	default:
+		c = fmt.Sprintf
+	}
+
+	return c(phaseString)
+}
+
+func clusterMachineStageString(phase specs.ClusterMachineStatusSpec_Stage) string {
+	phaseString := phase.String()
+
+	var c func(string, ...any) string
+
+	switch phase {
+	case specs.ClusterMachineStatusSpec_UNKNOWN:
+		c = color.YellowString
+	case specs.ClusterMachineStatusSpec_CONFIGURING,
+		specs.ClusterMachineStatusSpec_INSTALLING,
+		specs.ClusterMachineStatusSpec_UPGRADING,
+		specs.ClusterMachineStatusSpec_REBOOTING,
+		specs.ClusterMachineStatusSpec_BOOTING:
+		c = color.HiYellowString
+	case specs.ClusterMachineStatusSpec_BEFORE_DESTROY,
+		specs.ClusterMachineStatusSpec_DESTROYING,
+		specs.ClusterMachineStatusSpec_SHUTTING_DOWN:
+		c = color.HiRedString
+	case specs.ClusterMachineStatusSpec_RUNNING:
+		c = color.GreenString
+	default:
+		c = fmt.Sprintf
+	}
+
+	return c(phaseString)
+}
+
+func clusterMachineConnected(clusterMachine *omni.ClusterMachineStatus) string {
+	_, connected := clusterMachine.Metadata().Labels().Get(omni.MachineStatusLabelConnected)
+	if connected {
+		return ""
+	}
+
+	return " " + color.RedString("Unreachable")
+}
+
+func clusterMachineConfigOutdated(outdated bool) string {
+	if !outdated {
+		return ""
+	}
+
+	return " " + color.YellowString("Config Outdated")
+}
+
+func clusterMachineConfigStatus(status specs.ConfigApplyStatus) string {
+	switch status {
+	case specs.ConfigApplyStatus_UNKNOWN,
+		specs.ConfigApplyStatus_PENDING,
+		specs.ConfigApplyStatus_APPLIED:
+		return ""
+	case specs.ConfigApplyStatus_FAILED:
+		return " " + color.RedString("Config Apply Failed")
+	default:
+		return ""
+	}
+}
+
+func clusterMachineReadyString(clusterMachine *omni.ClusterMachineStatus) string {
+	if clusterMachine.TypedSpec().Value.Stage != specs.ClusterMachineStatusSpec_RUNNING {
+		return ""
+	}
+
+	return " " + readyString(clusterMachine.TypedSpec().Value.Ready)
+}
+
+func controlPlaneStatusString(cpStatus *omni.ControlPlaneStatus) string {
+	var failedConditions []specs.ConditionType
+
+	for _, condition := range cpStatus.TypedSpec().Value.GetConditions() {
+		if condition.GetStatus() == specs.ControlPlaneStatusSpec_Condition_NotReady {
+			failedConditions = append(failedConditions, condition.GetType())
+		}
+	}
+
+	if len(failedConditions) == 0 {
+		return color.GreenString("OK")
+	}
+
+	return color.RedString("Failing: %s", failedConditions)
+}
+
+func machineSetName(machineSet *omni.MachineSetStatus) string {
+	if _, ok := machineSet.Metadata().Labels().Get(omni.LabelControlPlaneRole); ok {
+		return "Control Plane"
+	}
+
+	cluster, _ := machineSet.Metadata().Labels().Get(omni.LabelCluster)
+
+	if machineSet.Metadata().ID() == omni.WorkersResourceID(cluster) {
+		return "Workers"
+	}
+
+	return "Additional Workers"
+}
diff --git a/client/pkg/template/operations/internal/statustree/statustree.go b/client/pkg/template/operations/internal/statustree/statustree.go
new file mode 100644
index 000000000..6c7e3d2e9
--- /dev/null
+++ b/client/pkg/template/operations/internal/statustree/statustree.go
@@ -0,0 +1,175 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package statustree contains helpers to render cluster status to the terminal.
+package statustree
+
+import (
+	"cmp"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/fatih/color"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// NodeWrapper wraps cluster status resources for tree rendering.
+type NodeWrapper struct {
+	resource.Resource
+}
+
+func (t NodeWrapper) String() string {
+	switch node := t.Resource.(type) {
+	case *omni.ClusterStatus:
+		return fmt.Sprintf(
+			"%s %q %s %s (%d/%d) (healthy/total)",
+			color.YellowString("Cluster"),
+			node.Metadata().ID(),
+			clusterPhaseString(node.TypedSpec().Value.Phase),
+			readyString(node.TypedSpec().Value.Ready),
+			node.TypedSpec().Value.GetMachines().GetHealthy(),
+			node.TypedSpec().Value.GetMachines().GetTotal(),
+		)
+	case *omni.KubernetesUpgradeStatus:
+		return fmt.Sprintf(
+			"%s %s %s",
+			color.YellowString("Kubernetes Upgrade"),
+			kubernetesUpgradePhaseString(node.TypedSpec().Value.Phase),
+			node.TypedSpec().Value.Step,
+		)
+	case *omni.TalosUpgradeStatus:
+		return fmt.Sprintf(
+			"%s %s %s",
+			color.YellowString("Talos Upgrade"),
+			talosUpgradePhaseString(node.TypedSpec().Value.Phase),
+			node.TypedSpec().Value.Step,
+		)
+	case *omni.MachineSetStatus:
+		return fmt.Sprintf(
+			"%s %q %s %s (%d/%d)",
+			color.YellowString(machineSetName(node)),
+			node.Metadata().ID(),
+			machineSetPhaseString(node.TypedSpec().Value.Phase),
+			readyString(node.TypedSpec().Value.Ready),
+			node.TypedSpec().Value.GetMachines().GetHealthy(),
+			node.TypedSpec().Value.GetMachines().GetTotal(),
+		)
+	case *omni.ClusterMachineStatus:
+		return fmt.Sprintf(
+			"%s %q %s%s%s%s%s",
+			color.YellowString("Machine"),
+			node.Metadata().ID(),
+			clusterMachineStageString(node.TypedSpec().Value.Stage),
+			clusterMachineReadyString(node),
+			clusterMachineConnected(node),
+			clusterMachineConfigOutdated(!node.TypedSpec().Value.ConfigUpToDate),
+			clusterMachineConfigStatus(node.TypedSpec().Value.ConfigApplyStatus),
+		)
+	case *omni.ControlPlaneStatus:
+		return fmt.Sprintf(
+			"%s %s",
+			color.YellowString("Status Checks"),
+			controlPlaneStatusString(node),
+		)
+	case *omni.LoadBalancerStatus:
+		return fmt.Sprintf(
+			"%s %s",
+			color.YellowString("Load Balancer"),
+			readyString(node.TypedSpec().Value.Healthy),
+		)
+	default:
+		return resource.String(t.Resource)
+	}
+}
+
+// IsParentOf allows to find parent-child relationships between resources.
+func (t NodeWrapper) IsParentOf(r resource.Resource) bool {
+	switch node := t.Resource.(type) {
+	case *omni.ClusterStatus:
+		return r.Metadata().Type() == omni.MachineSetStatusType || r.Metadata().Type() == omni.KubernetesUpgradeStatusType || r.Metadata().Type() == omni.TalosUpgradeStatusType
+	case *omni.MachineSetStatus:
+		_, isControlPlane := node.Metadata().Labels().Get(omni.LabelControlPlaneRole)
+		if isControlPlane && r.Metadata().Type() == omni.ControlPlaneStatusType {
+			return true
+		}
+
+		if isControlPlane && r.Metadata().Type() == omni.LoadBalancerStatusType {
+			return true
+		}
+
+		return r.Metadata().Type() == omni.ClusterMachineStatusType && r.Metadata().Labels().Matches(
+			resource.LabelTerm{
+				Key:   omni.LabelMachineSet,
+				Op:    resource.LabelOpEqual,
+				Value: []string{node.Metadata().ID()},
+			})
+	default:
+		return false
+	}
+}
+
+// resourceTypeOrder maps resource types to their order (integer) in the tree.
+func resourceTypeOrder(resourceType resource.Type) int {
+	switch resourceType {
+	case omni.ClusterStatusType:
+		return 0
+	case omni.KubernetesUpgradeStatusType:
+		return 1
+	case omni.TalosUpgradeStatusType:
+		return 2
+	case omni.MachineSetStatusType:
+		return 3
+	case omni.LoadBalancerStatusType:
+		return 4
+	case omni.ControlPlaneStatusType:
+		return 5
+	case omni.ClusterMachineStatusType:
+		return 6
+	default:
+		panic("unknown resource type " + resourceType)
+	}
+}
+
+// Compare allows to sort resources in a tree on the same level.
+func (t NodeWrapper) Compare(other NodeWrapper) int {
+	l, r := t.Resource, other.Resource
+	lType, rType := l.Metadata().Type(), r.Metadata().Type()
+	lTypeOrder, rTypeOrder := resourceTypeOrder(lType), resourceTypeOrder(rType)
+
+	if lTypeOrder != rTypeOrder {
+		return lTypeOrder - rTypeOrder
+	}
+
+	// at this point lType == rType
+	if lType == omni.MachineSetStatusType {
+		// controlplane machine set goes first
+		_, lIsControlPlane := l.Metadata().Labels().Get(omni.LabelControlPlaneRole)
+		_, rIsControlPlane := r.Metadata().Labels().Get(omni.LabelControlPlaneRole)
+
+		if lIsControlPlane {
+			return -1
+		}
+
+		if rIsControlPlane {
+			return 1
+		}
+
+		// now, default workers go first
+		clusterName, _ := l.Metadata().Labels().Get(omni.LabelCluster)
+		lIsDefaultWorkers := l.Metadata().ID() == omni.WorkersResourceID(clusterName)
+		rIsDefaultWorkers := r.Metadata().ID() == omni.WorkersResourceID(clusterName)
+
+		if lIsDefaultWorkers {
+			return -1
+		}
+
+		if rIsDefaultWorkers {
+			return 1
+		}
+	}
+
+	// compare by name
+	return cmp.Compare(l.Metadata().ID(), r.Metadata().ID())
+}
diff --git a/client/pkg/template/operations/internal/utils/utils.go b/client/pkg/template/operations/internal/utils/utils.go
new file mode 100644
index 000000000..a85cc53a3
--- /dev/null
+++ b/client/pkg/template/operations/internal/utils/utils.go
@@ -0,0 +1,145 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package utils contains various utility functions for template operations.
+package utils
+
+import (
+	"bytes"
+	"fmt"
+	"io"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/fatih/color"
+	"github.com/hexops/gotextdiff"
+	"github.com/hexops/gotextdiff/myers"
+	"github.com/hexops/gotextdiff/span"
+	"gopkg.in/yaml.v3"
+)
+
+// MarshalResource to YAML format (bytes).
+func MarshalResource(r resource.Resource) ([]byte, error) {
+	var buf bytes.Buffer
+
+	enc := yaml.NewEncoder(&buf)
+	enc.SetIndent(2)
+
+	m, err := resource.MarshalYAML(r)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := enc.Encode(m); err != nil {
+		return nil, err
+	}
+
+	return buf.Bytes(), nil
+}
+
+// RenderDiff outputs colorized diff between two resources.
+//
+// One of the resources might be nil.
+func RenderDiff(w io.Writer, oldR, newR resource.Resource) error {
+	var (
+		oldYaml, newYaml []byte
+		oldPath, newPath string
+		err              error
+	)
+
+	if oldR != nil {
+		oldYaml, err = MarshalResource(oldR)
+		if err != nil {
+			return err
+		}
+
+		oldPath = resource.String(oldR)
+	} else {
+		oldPath = "/dev/null"
+	}
+
+	if newR != nil {
+		newYaml, err = MarshalResource(newR)
+		if err != nil {
+			return err
+		}
+
+		newPath = resource.String(newR)
+	} else {
+		newPath = "/dev/null"
+	}
+
+	edits := myers.ComputeEdits(span.URIFromPath(oldPath), string(oldYaml), string(newYaml))
+	diff := gotextdiff.ToUnified(oldPath, newPath, string(oldYaml), edits)
+
+	outputDiff(w, diff)
+
+	return nil
+}
+
+func outputDiff(w io.Writer, u gotextdiff.Unified) {
+	if len(u.Hunks) == 0 {
+		return
+	}
+
+	bold := color.New(color.Bold)
+	bold.Fprintf(w, "--- %s\n", u.From) //nolint:errcheck
+	bold.Fprintf(w, "+++ %s\n", u.To)   //nolint:errcheck
+
+	cyan := color.New(color.FgCyan)
+	red := color.New(color.FgRed)
+	green := color.New(color.FgGreen)
+
+	for _, hunk := range u.Hunks {
+		fromCount, toCount := 0, 0
+
+		for _, l := range hunk.Lines {
+			switch l.Kind { //nolint:exhaustive
+			case gotextdiff.Delete:
+				fromCount++
+			case gotextdiff.Insert:
+				toCount++
+			default:
+				fromCount++
+				toCount++
+			}
+		}
+
+		cyan.Fprintf(w, "@@") //nolint:errcheck
+
+		if fromCount > 1 {
+			cyan.Fprintf(w, " -%d,%d", hunk.FromLine, fromCount) //nolint:errcheck
+		} else {
+			cyan.Fprintf(w, " -%d", hunk.FromLine) //nolint:errcheck
+		}
+
+		if toCount > 1 {
+			cyan.Fprintf(w, " +%d,%d", hunk.ToLine, toCount) //nolint:errcheck
+		} else {
+			cyan.Fprintf(w, " +%d", hunk.ToLine) //nolint:errcheck
+		}
+
+		cyan.Printf(" @@\n") //nolint:errcheck
+
+		for _, l := range hunk.Lines {
+			switch l.Kind { //nolint:exhaustive
+			case gotextdiff.Delete:
+				red.Fprintf(w, "-%s", l.Content) //nolint:errcheck
+			case gotextdiff.Insert:
+				green.Fprintf(w, "+%s", l.Content) //nolint:errcheck
+			default:
+				fmt.Fprintf(w, " %s", l.Content)
+			}
+
+			if !strings.HasSuffix(l.Content, "\n") {
+				red.Fprintf(w, "\n\\ No newline at end of file\n") //nolint:errcheck
+			}
+		}
+	}
+}
+
+// Describe a resources in human readable format.
+func Describe(r resource.Resource) string {
+	return fmt.Sprintf("%s(%s)", r.Metadata().Type(), r.Metadata().ID())
+}
diff --git a/client/pkg/template/operations/operations.go b/client/pkg/template/operations/operations.go
new file mode 100644
index 000000000..9447676d3
--- /dev/null
+++ b/client/pkg/template/operations/operations.go
@@ -0,0 +1,6 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package operations provides higher level operations on cluster templates.
+package operations
diff --git a/client/pkg/template/operations/render.go b/client/pkg/template/operations/render.go
new file mode 100644
index 000000000..aafc9bab8
--- /dev/null
+++ b/client/pkg/template/operations/render.go
@@ -0,0 +1,48 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package operations
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/pkg/template"
+)
+
+// RenderTemplate outputs the rendered template to the given output.
+func RenderTemplate(templateReader io.Reader, output io.Writer) error {
+	tmpl, err := template.Load(templateReader)
+	if err != nil {
+		return fmt.Errorf("error loading template: %w", err)
+	}
+
+	if err = tmpl.Validate(); err != nil {
+		return err
+	}
+
+	resources, err := tmpl.Translate()
+	if err != nil {
+		return fmt.Errorf("error rendering template: %w", err)
+	}
+
+	enc := yaml.NewEncoder(output)
+	enc.SetIndent(2)
+
+	for _, r := range resources {
+		m, err := resource.MarshalYAML(r)
+		if err != nil {
+			return fmt.Errorf("error marshaling resource: %w", err)
+		}
+
+		if err = enc.Encode(m); err != nil {
+			return fmt.Errorf("error encoding resource: %w", err)
+		}
+	}
+
+	return nil
+}
diff --git a/client/pkg/template/operations/status.go b/client/pkg/template/operations/status.go
new file mode 100644
index 000000000..038876fd0
--- /dev/null
+++ b/client/pkg/template/operations/status.go
@@ -0,0 +1,259 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package operations
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"slices"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/xlab/treeprint"
+	"golang.org/x/term"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/template"
+	"github.com/siderolabs/omni/client/pkg/template/operations/internal/statustree"
+)
+
+// StatusOptions configures the status operation.
+type StatusOptions struct {
+	Wait  bool
+	Quiet bool
+}
+
+// StatusTemplate queries, renders and (optionally) waits for the cluster status (health).
+func StatusTemplate(ctx context.Context, templateReader io.Reader, out io.Writer, st state.State, options StatusOptions) error {
+	tmpl, err := template.Load(templateReader)
+	if err != nil {
+		return fmt.Errorf("error loading template: %w", err)
+	}
+
+	if err = tmpl.Validate(); err != nil {
+		return err
+	}
+
+	return statusTemplate(ctx, tmpl, out, st, options)
+}
+
+// StatusCluster queries, renders and (optionally) waits for the cluster status (health).
+func StatusCluster(ctx context.Context, clusterName string, out io.Writer, st state.State, options StatusOptions) error {
+	tmpl := template.WithCluster(clusterName)
+
+	return statusTemplate(ctx, tmpl, out, st, options)
+}
+
+//nolint:gocognit,gocyclo,cyclop
+func statusTemplate(ctx context.Context, tmpl *template.Template, out io.Writer, st state.State, options StatusOptions) error {
+	clusterName, err := tmpl.ClusterName()
+	if err != nil {
+		return err
+	}
+
+	// initiate a watch on all resources which are part of the cluster status
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	watchCh := make(chan state.Event)
+
+	if err = st.Watch(ctx, omni.NewClusterStatus(resources.DefaultNamespace, clusterName).Metadata(), watchCh); err != nil {
+		return err
+	}
+
+	resourceTypes := []resource.Type{
+		omni.MachineSetStatusType,
+		omni.ControlPlaneStatusType,
+		omni.LoadBalancerStatusType,
+		omni.KubernetesUpgradeStatusType,
+		omni.TalosUpgradeStatusType,
+		omni.ClusterMachineStatusType,
+	}
+
+	for _, resourceType := range resourceTypes {
+		if err = st.WatchKind(
+			ctx,
+			resource.NewMetadata(resources.DefaultNamespace, resourceType, "", resource.VersionUndefined),
+			watchCh,
+			state.WithBootstrapContents(true),
+			state.WatchWithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)),
+		); err != nil {
+			return err
+		}
+	}
+
+	resources := map[string]resource.Resource{}
+	pendingBootstraps := len(resourceTypes)
+
+	var (
+		clusterBootstrapped, startedRendering, hasUpdates bool
+		prevLines                                         []byte
+	)
+
+	renderTicker := time.NewTicker(time.Second)
+	defer renderTicker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-renderTicker.C:
+			if !hasUpdates {
+				continue
+			}
+
+			hasUpdates = false
+
+			if options.Quiet {
+				continue
+			}
+
+			newLines, healthy := render(resources)
+
+			if err = printStatus(out, prevLines, newLines); err != nil {
+				return err
+			}
+
+			prevLines = newLines
+
+			if healthy {
+				// done waiting
+				return nil
+			}
+		case event := <-watchCh:
+			hasUpdates = true
+
+			switch event.Type {
+			case state.Errored:
+				return fmt.Errorf("watch failed: %w", event.Error)
+			case state.Bootstrapped:
+				pendingBootstraps--
+			case state.Created, state.Updated:
+				if event.Resource.Metadata().Type() == omni.ClusterStatusType {
+					clusterBootstrapped = true
+				}
+
+				resources[resource.String(event.Resource)] = event.Resource
+			case state.Destroyed:
+				delete(resources, resource.String(event.Resource))
+			}
+
+			// render the initial state once fully bootstrapped
+			if !startedRendering && clusterBootstrapped && pendingBootstraps == 0 {
+				startedRendering = true
+			} else {
+				continue
+			}
+
+			newLines, healthy := render(resources)
+
+			if !options.Quiet {
+				if err = printStatus(out, prevLines, newLines); err != nil {
+					return err
+				}
+
+				prevLines = newLines
+			}
+
+			hasUpdates = false
+
+			if healthy {
+				return nil
+			}
+
+			if !options.Wait {
+				return fmt.Errorf("cluster is not healthy")
+			}
+		}
+	}
+}
+
+func expandTree(tree treeprint.Tree, item statustree.NodeWrapper, resources map[string]resource.Resource) {
+	var nextLevel []statustree.NodeWrapper
+
+	for _, r := range resources {
+		if item.IsParentOf(r) {
+			nextLevel = append(nextLevel, statustree.NodeWrapper{Resource: r})
+		}
+	}
+
+	slices.SortFunc(nextLevel, statustree.NodeWrapper.Compare)
+
+	for _, item := range nextLevel {
+		subtree := tree.AddBranch(item)
+		expandTree(subtree, item, resources)
+	}
+}
+
+// render builds a tree of resources and renders it to the buffer.
+func render(resources map[string]resource.Resource) ([]byte, bool) {
+	var clusterStatus *omni.ClusterStatus
+
+	healthy := true
+
+	for _, r := range resources {
+		switch item := r.(type) {
+		case *omni.ClusterStatus:
+			clusterStatus = item
+
+			healthy = healthy && item.TypedSpec().Value.Phase == specs.ClusterStatusSpec_RUNNING && item.TypedSpec().Value.Ready
+		case *omni.MachineSetStatus:
+			healthy = healthy && item.TypedSpec().Value.Phase == specs.MachineSetPhase_Running && item.TypedSpec().Value.Ready
+		case *omni.KubernetesUpgradeStatus:
+			healthy = healthy && item.TypedSpec().Value.Phase == specs.KubernetesUpgradeStatusSpec_Done
+		case *omni.TalosUpgradeStatus:
+			healthy = healthy && item.TypedSpec().Value.Phase == specs.TalosUpgradeStatusSpec_Done
+		}
+	}
+
+	if clusterStatus == nil {
+		return nil, false
+	}
+
+	root := statustree.NodeWrapper{Resource: clusterStatus}
+	tree := treeprint.NewWithRoot(root)
+
+	expandTree(tree, root, resources)
+
+	return tree.Bytes(), healthy
+}
+
+// printStatus prints the tree to the terminal.
+//
+// If terminal supports it, previous tree is erased.
+func printStatus(out io.Writer, prevLines, newLines []byte) error {
+	var (
+		w          int
+		isTerminal bool
+	)
+
+	if f, ok := out.(*os.File); ok {
+		w, _, _ = term.GetSize(int(f.Fd())) //nolint:errcheck
+		isTerminal = term.IsTerminal(int(f.Fd()))
+	}
+
+	if w <= 0 {
+		w = 80
+	}
+
+	if isTerminal {
+		for _, outputLine := range strings.Split(string(prevLines), "\n") {
+			for i := 0; i < (utf8.RuneCountInString(outputLine)+w-1)/w; i++ {
+				fmt.Fprint(out, "\033[A\033[K") // cursor up, clear line
+			}
+		}
+	}
+
+	_, err := out.Write(newLines)
+
+	return err
+}
diff --git a/client/pkg/template/operations/sync.go b/client/pkg/template/operations/sync.go
new file mode 100644
index 000000000..399361b22
--- /dev/null
+++ b/client/pkg/template/operations/sync.go
@@ -0,0 +1,198 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package operations
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/fatih/color"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/template"
+	"github.com/siderolabs/omni/client/pkg/template/operations/internal/utils"
+)
+
+// SyncOptions contains options for SyncTemplate.
+type SyncOptions struct {
+	// DryRun indicates that no changes should be made to the cluster.
+	DryRun bool
+
+	// Verbose indicates that diff for each resource should be printed.
+	Verbose bool
+
+	// DestroyMachines forcefully remove the disconnected nodes from Omni.
+	DestroyMachines bool
+}
+
+// SyncTemplate performs resource sync to Omni.
+func SyncTemplate(ctx context.Context, templateReader io.Reader, out io.Writer, st state.State, syncOptions SyncOptions) error {
+	tmpl, err := template.Load(templateReader)
+	if err != nil {
+		return fmt.Errorf("error loading template: %w", err)
+	}
+
+	if err = tmpl.Validate(); err != nil {
+		return err
+	}
+
+	syncResult, err := tmpl.Sync(ctx, st)
+	if err != nil {
+		return fmt.Errorf("error syncing template: %w", err)
+	}
+
+	// sync flow:
+	//  1. create missing resources
+	//  2. update resources
+	//  3. delete resources last
+	//
+	// this follows the idea of a scaling up first
+
+	yellow := color.New(color.FgYellow)
+	boldFunc := color.New(color.Bold).SprintfFunc()
+
+	dryRun := ""
+	if syncOptions.DryRun {
+		dryRun = " (dry run)"
+	}
+
+	for _, r := range syncResult.Create {
+		yellow.Fprintf(out, "* creating%s %s\n", dryRun, boldFunc(utils.Describe(r))) //nolint:errcheck
+
+		if syncOptions.Verbose {
+			if err = utils.RenderDiff(out, nil, r); err != nil {
+				return err
+			}
+		}
+
+		if syncOptions.DryRun {
+			continue
+		}
+
+		if err = st.Create(ctx, r); err != nil {
+			return err
+		}
+	}
+
+	for _, p := range syncResult.Update {
+		yellow.Fprintf(out, "* updating%s %s\n", dryRun, boldFunc(utils.Describe(p.New))) //nolint:errcheck
+
+		if syncOptions.Verbose {
+			if err = utils.RenderDiff(os.Stdout, p.Old, p.New); err != nil {
+				return err
+			}
+		}
+
+		if syncOptions.DryRun {
+			continue
+		}
+
+		if err = st.Update(ctx, p.New); err != nil {
+			return err
+		}
+	}
+
+	return syncDelete(ctx, syncResult, out, st, syncOptions)
+}
+
+func syncDelete(ctx context.Context, syncResult *template.SyncResult, out io.Writer, st state.State, syncOptions SyncOptions) error {
+	for _, phase := range syncResult.Destroy {
+		if err := syncDeleteResources(ctx, phase, out, st, syncOptions); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+//nolint:gocognit,gocyclo,cyclop
+func syncDeleteResources(ctx context.Context, toDelete []resource.Resource, out io.Writer, st state.State, syncOptions SyncOptions) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	yellow := color.New(color.FgYellow)
+	boldFunc := color.New(color.Bold).SprintfFunc()
+
+	dryRun := ""
+	if syncOptions.DryRun {
+		dryRun = " (dry run)"
+	}
+
+	teardownWatch := make(chan state.Event)
+	tearingDownResourceTypes := map[resource.Type]struct{}{}
+
+	for _, r := range toDelete {
+		tearingDownResourceTypes[r.Metadata().Type()] = struct{}{}
+	}
+
+	for resourceType := range tearingDownResourceTypes {
+		if err := st.WatchKind(ctx, resource.NewMetadata(resources.DefaultNamespace, resourceType, "", resource.VersionUndefined), teardownWatch, state.WithBootstrapContents(true)); err != nil {
+			return err
+		}
+	}
+
+	tearingDownResources := map[string]struct{}{}
+
+	for _, r := range toDelete {
+		yellow.Fprintf(out, "* tearing down%s %s\n", dryRun, boldFunc(utils.Describe(r))) //nolint:errcheck
+
+		if syncOptions.Verbose {
+			if err := utils.RenderDiff(os.Stdout, r, nil); err != nil {
+				return err
+			}
+		}
+
+		if syncOptions.DryRun {
+			continue
+		}
+
+		if _, err := st.Teardown(ctx, r.Metadata()); err != nil && !state.IsNotFoundError(err) {
+			return err
+		}
+
+		tearingDownResources[utils.Describe(r)] = struct{}{}
+	}
+
+	if syncOptions.DryRun {
+		return nil
+	}
+
+	for len(tearingDownResources) > 0 {
+		var event state.Event
+
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case event = <-teardownWatch:
+		}
+
+		switch event.Type {
+		case state.Updated, state.Created:
+			if _, ok := tearingDownResources[utils.Describe(event.Resource)]; ok {
+				if event.Resource.Metadata().Phase() == resource.PhaseTearingDown && event.Resource.Metadata().Finalizers().Empty() {
+					if err := st.Destroy(ctx, event.Resource.Metadata()); err != nil && !state.IsNotFoundError(err) {
+						return err
+					}
+				}
+			}
+		case state.Destroyed:
+			if _, ok := tearingDownResources[utils.Describe(event.Resource)]; ok {
+				delete(tearingDownResources, utils.Describe(event.Resource))
+
+				yellow.Fprintf(out, "* destroyed%s %s\n", dryRun, boldFunc(utils.Describe(event.Resource))) //nolint:errcheck
+			}
+		case state.Bootstrapped:
+			// ignore
+		case state.Errored:
+			return event.Error
+		}
+	}
+
+	return nil
+}
diff --git a/client/pkg/template/operations/testdata/export/cluster-resources.yaml b/client/pkg/template/operations/testdata/export/cluster-resources.yaml
new file mode 100644
index 000000000..d6e8d2ecd
--- /dev/null
+++ b/client/pkg/template/operations/testdata/export/cluster-resources.yaml
@@ -0,0 +1,548 @@
+################################ Cluster
+metadata:
+  namespace: default
+  type: Clusters.omni.sidero.dev
+  id: export-test
+  version: 11
+  owner:
+  phase: running
+  created: 2023-12-07T13:36:21Z
+  updated: 2023-12-08T15:43:10Z
+  labels:
+    cluster-label-1: val
+    cluster-label-2: val2
+  annotations:
+    omni.sidero.dev/managed-by-cluster-templates:
+  finalizers:
+    - KubernetesUpgradeStatusController
+    - TalosUpgradeStatusController
+    - ClusterController
+    - SecretsController
+spec:
+  installimage: ""
+  kubernetesversion: 1.28.2
+  talosversion: 1.5.5
+  features:
+    enableworkloadproxy: true
+    diskencryption: true
+  backupconfiguration:
+    interval:
+      seconds: 7200
+      nanos: 0
+    enabled: true
+---
+
+
+
+################################ Control Plane MachineSet - with bootstrapspec
+metadata:
+  namespace: default
+  type: MachineSets.omni.sidero.dev
+  id: export-test-control-planes
+  version: 5
+  owner:
+  phase: running
+  created: 2023-12-07T13:36:21Z
+  updated: 2023-12-07T13:39:44Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/role-controlplane:
+  finalizers:
+    - MachineSetController
+    - MachineSetStatusController
+spec:
+  updatestrategy: 1
+  machineclass: null
+  bootstrapspec:
+    clusteruuid: 98d00c6b-fae1-4bf2-afa3-0282ef443f84
+    snapshot: FFFFFFFF9AA169F0.snapshot
+---
+
+
+
+################################ Worker MachineSet - default
+metadata:
+  namespace: default
+  type: MachineSets.omni.sidero.dev
+  id: export-test-workers
+  version: 5
+  owner:
+  phase: running
+  created: 2023-12-07T13:36:21Z
+  updated: 2023-12-07T13:39:44Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/role-worker:
+  finalizers:
+    - MachineSetController
+    - MachineSetStatusController
+spec:
+  updatestrategy: 1
+  machineclass: null
+  bootstrapspec: null
+  deletestrategy: 1
+  updatestrategyconfig:
+    rolling:
+      maxparallelism: 3
+  deletestrategyconfig:
+    type: Rolling
+    rolling:
+      maxparallelism: 5
+---
+
+
+
+################################ Worker MachineSet - additional, using machine class, unlimited allocation
+metadata:
+  namespace: default
+  type: MachineSets.omni.sidero.dev
+  id: export-test-w07c5e8
+  version: 4
+  owner:
+  phase: running
+  created: 2023-12-07T13:38:09Z
+  updated: 2023-12-07T13:39:44Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/role-worker:
+  finalizers:
+    - MachineSetController
+    - MachineSetStatusController
+spec:
+  updatestrategy: 1
+  machineclass:
+    name: mc1
+    machinecount: 0
+    allocationtype: 1
+  bootstrapspec: null
+---
+
+
+
+################################ Worker MachineSet - additional, using machine class, static allocation
+metadata:
+  namespace: default
+  type: MachineSets.omni.sidero.dev
+  id: export-test-w3c03cf
+  version: 3
+  owner:
+  phase: running
+  created: 2023-12-07T13:39:44Z
+  updated: 2023-12-07T13:39:44Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/role-worker:
+  finalizers:
+    - MachineSetController
+    - MachineSetStatusController
+spec:
+  updatestrategy: 1
+  machineclass:
+    name: mc2
+    machinecount: 1
+    allocationtype: 0
+  bootstrapspec: null
+---
+
+
+
+################################ MachineSetNodes
+metadata:
+  namespace: default
+  type: MachineSetNodes.omni.sidero.dev
+  id: 024780fe-b0d6-43e0-a868-b142ba0a67a6
+  version: 1
+  owner:
+  phase: running
+  created: 2023-12-07T13:36:21Z
+  updated: 1970-01-01T00:00:00Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/machine-set: export-test-workers
+    omni.sidero.dev/role-worker:
+  annotations:
+    omni.sidero.dev/locked:
+spec: {}
+---
+metadata:
+  namespace: default
+  type: MachineSetNodes.omni.sidero.dev
+  id: 0313855d-e4ea-458b-8df9-8dbdc2e41e8c
+  version: 1
+  owner: MachineSetNodeController
+  phase: running
+  created: 2023-12-07T13:39:44Z
+  updated: 2023-12-07T13:39:44Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/machine-set: export-test-w3c03cf
+    omni.sidero.dev/role-worker:
+spec: {}
+---
+metadata:
+  namespace: default
+  type: MachineSetNodes.omni.sidero.dev
+  id: 3f8b33d2-52b1-42ed-8505-4025ddbc31f1
+  version: 1
+  owner:
+  phase: running
+  created: 2023-12-07T13:36:21Z
+  updated: 1970-01-01T00:00:00Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/machine-set: export-test-control-planes
+    omni.sidero.dev/role-controlplane:
+spec: {}
+---
+metadata:
+  namespace: default
+  type: MachineSetNodes.omni.sidero.dev
+  id: 7ee83506-4432-4499-9291-276e1319e8b4
+  version: 1
+  owner: MachineSetNodeController
+  phase: running
+  created: 2023-12-07T13:38:09Z
+  updated: 2023-12-07T13:38:09Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/machine-set: export-test-w07c5e8
+    omni.sidero.dev/role-worker:
+spec: {}
+---
+metadata:
+  namespace: default
+  type: MachineSetNodes.omni.sidero.dev
+  id: a3ef5705-6ee0-4344-9d4a-da447909e0d4
+  version: 1
+  owner: MachineSetNodeController
+  phase: running
+  created: 2023-12-07T13:38:09Z
+  updated: 2023-12-07T13:38:09Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/machine-set: export-test-w07c5e8
+    omni.sidero.dev/role-worker:
+spec: {}
+---
+
+
+
+################################ Config Patches - user defined
+metadata:
+  namespace: default
+  type: ConfigPatches.omni.sidero.dev
+  id: 499-2e4b9030-aade-47cf-8f7f-3031b7ae49bb
+  version: 2
+  owner:
+  phase: running
+  created: 2023-12-07T15:02:39Z
+  updated: 2023-12-08T15:43:10Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+  annotations:
+    name: User defined patch
+spec:
+  data: |
+    machine:
+        network:
+            kubespan:
+                enabled: false
+---
+metadata:
+  namespace: default
+  type: ConfigPatches.omni.sidero.dev
+  id: 500-1104d832-79fb-4121-a67f-752fa8f763e9
+  version: 2
+  owner:
+  phase: running
+  created: 2023-12-07T13:50:13Z
+  updated: 2023-12-08T15:43:10Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/cluster-machine: 024780fe-b0d6-43e0-a868-b142ba0a67a6
+  annotations:
+    description: Some Test Description ASD
+    name: User defined patch
+spec:
+  data: |
+    machine:
+        network:
+            kubespan:
+                enabled: false
+                mtu: 1166
+---
+metadata:
+  namespace: default
+  type: ConfigPatches.omni.sidero.dev
+  id: 500-2e2a2a64-5085-407a-a205-f75f4c64a060
+  version: 2
+  owner:
+  phase: running
+  created: 2023-12-07T13:48:50Z
+  updated: 2023-12-08T15:43:10Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/machine-set: export-test-control-planes
+  annotations:
+    description: Some Test Description 123
+    name: User defined patch
+spec:
+  data: |
+    machine:
+        network:
+            kubespan:
+                enabled: false
+                mtu: 1111
+---
+metadata:
+  namespace: default
+  type: ConfigPatches.omni.sidero.dev
+  id: 500-32fe29d6-221a-4e6e-a55e-6b1700cae09d
+  version: 2
+  owner:
+  phase: running
+  created: 2023-12-07T13:49:28Z
+  updated: 2023-12-08T15:43:10Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/machine-set: export-test-w07c5e8
+  annotations:
+    description: Some Test Description 987
+    name: User defined patch
+spec:
+  data: |
+    machine:
+        network:
+            kubespan:
+                enabled: false
+                mtu: 1217
+---
+metadata:
+  namespace: default
+  type: ConfigPatches.omni.sidero.dev
+  id: 500-3792b0d9-0fc2-46fb-becf-4d5439bbe5ba
+  version: 2
+  owner:
+  phase: running
+  created: 2023-12-07T13:49:10Z
+  updated: 2023-12-08T15:43:10Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/machine-set: export-test-workers
+  annotations:
+    description: Some Test Description ABC
+    name: User defined patch
+spec:
+  data: |
+    machine:
+        network:
+            kubespan:
+                enabled: false
+                mtu: 1447
+---
+metadata:
+  namespace: default
+  type: ConfigPatches.omni.sidero.dev
+  id: 500-ae981813-420d-464f-a246-fd7e861402f1
+  version: 2
+  owner:
+  phase: running
+  created: 2023-12-07T13:47:18Z
+  updated: 2023-12-08T15:43:10Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+  annotations:
+    description: Cluster Patch Description
+    name: User defined patch
+spec:
+  data: |
+    machine:
+        network:
+            kubespan:
+                enabled: false
+                mtu: 1410
+---
+metadata:
+  namespace: default
+  type: ConfigPatches.omni.sidero.dev
+  id: 600-3fb9b4d2-b13c-48a7-9929-3632e68ff5da
+  version: 2
+  owner:
+  phase: running
+  created: 2023-12-07T13:48:07Z
+  updated: 2023-12-08T15:43:10Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+  annotations:
+    description: Cluster Patch Description 2
+    name: User defined patch
+spec:
+  data: |
+    machine:
+        network:
+            kubespan:
+                enabled: false
+                mtu: 1234
+---
+metadata:
+  namespace: default
+  type: ConfigPatches.omni.sidero.dev
+  id: 666-4a5ca2e0-4f57-4761-bf61-c1e4cf583170
+  version: 2
+  owner:
+  phase: running
+  created: 2023-12-07T13:49:44Z
+  updated: 2023-12-08T15:43:10Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/machine-set: export-test-w3c03cf
+  annotations:
+    description: Some Test Description ZXC
+    name: User defined patch
+spec:
+  data: |
+    machine:
+        network:
+            kubespan:
+                enabled: false
+                mtu: 1298
+---
+
+
+
+################################ Feature Config Patches - workload proxying
+metadata:
+  namespace: default
+  type: ConfigPatches.omni.sidero.dev
+  id: 950-cluster-export-test-workload-proxying
+  version: 1
+  owner: ClusterWorkloadProxyController
+  phase: running
+  created: 2023-12-07T13:36:21Z
+  updated: 2023-12-07T13:36:21Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/system-patch:
+spec:
+  data: |
+    cluster:
+      inlineManifests:
+        - name: omni-kube-service-exposer
+          # adapted from: https://github.com/siderolabs/kube-service-exposer/blob/main/deploy/kube-service-exposer.yaml
+          contents: |-
+            apiVersion: rbac.authorization.k8s.io/v1
+            kind: ClusterRole
+            metadata:
+              name: omni-kube-service-exposer
+            rules:
+              - apiGroups: [""]
+                resources: ["services"]
+                verbs: ["get", "list", "watch"]
+            ---
+            apiVersion: v1
+            kind: ServiceAccount
+            metadata:
+              name: omni-kube-service-exposer
+              namespace: kube-system
+            ---
+            apiVersion: rbac.authorization.k8s.io/v1
+            kind: ClusterRoleBinding
+            metadata:
+              name: omni-kube-service-exposer
+            roleRef:
+              apiGroup: rbac.authorization.k8s.io
+              kind: ClusterRole
+              name: omni-kube-service-exposer
+            subjects:
+              - kind: ServiceAccount
+                name: omni-kube-service-exposer
+                namespace: kube-system
+            ---
+            apiVersion: apps/v1
+            kind: DaemonSet
+            metadata:
+              name: omni-kube-service-exposer
+              namespace: kube-system
+            spec:
+              selector:
+                matchLabels:
+                  app.kubernetes.io/name: omni-kube-service-exposer
+              template:
+                metadata:
+                  labels:
+                    app.kubernetes.io/name: omni-kube-service-exposer
+                spec:
+                  serviceAccountName: omni-kube-service-exposer
+                  hostNetwork: true
+                  dnsPolicy: ClusterFirstWithHostNet
+                  tolerations:
+                    - operator: Exists
+                  containers:
+                    - name: omni-kube-service-exposer
+                      image: ghcr.io/siderolabs/kube-service-exposer:v0.1.1
+                      args:
+                        - --debug=false
+                        - --annotation-key=omni-kube-service-exposer.sidero.dev/port
+                        # siderolink CIDR
+                        - --bind-cidrs="fdae:41e4:649b:9303::/64"
+---
+
+
+
+################################ Feature Config Patches - disk encryption
+metadata:
+  namespace: default
+  type: ConfigPatches.omni.sidero.dev
+  id: 950-export-test-encryption
+  version: 1
+  owner: ClusterMachineEncryptionController
+  phase: running
+  created: 2023-12-07T13:36:21Z
+  updated: 2023-12-07T13:36:21Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/system-patch:
+  annotations:
+    description: Makes machine encrypt disks using Omni as a KMS server
+    name: disk encryption config
+spec:
+  data: |-
+    machine:
+      systemDiskEncryption:
+        state:
+            provider: luks2
+            keys:
+              - kms:
+                  endpoint: grpc://192.168.178.167:8090
+                slot: 0
+        ephemeral:
+            provider: luks2
+            keys:
+              - kms:
+                  endpoint: grpc://192.168.178.167:8090
+                slot: 0
+---
+
+
+
+################################ Special Config Patches - install disk
+metadata:
+  namespace: default
+  type: ConfigPatches.omni.sidero.dev
+  id: 000-cm-3f8b33d2-52b1-42ed-8505-4025ddbc31f1-install-disk
+  version: 1
+  owner:
+  phase: running
+  created: 2023-12-07T23:14:47Z
+  updated: 1970-01-01T00:00:00Z
+  labels:
+    omni.sidero.dev/cluster: export-test
+    omni.sidero.dev/cluster-machine: 3f8b33d2-52b1-42ed-8505-4025ddbc31f1
+    omni.sidero.dev/system-patch:
+  annotations:
+    name: install-disk
+spec:
+  data: |
+    machine:
+      install:
+        disk: /dev/sdc
diff --git a/client/pkg/template/operations/testdata/export/cluster-template.yaml b/client/pkg/template/operations/testdata/export/cluster-template.yaml
new file mode 100644
index 000000000..3d042dac2
--- /dev/null
+++ b/client/pkg/template/operations/testdata/export/cluster-template.yaml
@@ -0,0 +1,137 @@
+kind: Cluster
+name: export-test
+labels:
+  cluster-label-1: val
+  cluster-label-2: val2
+kubernetes:
+  version: v1.28.2
+talos:
+  version: v1.5.5
+features:
+  diskEncryption: true
+  enableWorkloadProxy: true
+  backupConfiguration:
+    interval: 2h0m0s
+patches:
+  - idOverride: 499-2e4b9030-aade-47cf-8f7f-3031b7ae49bb
+    annotations:
+      name: User defined patch
+    inline:
+      machine:
+        network:
+          kubespan:
+            enabled: false
+  - idOverride: 500-ae981813-420d-464f-a246-fd7e861402f1
+    annotations:
+      description: Cluster Patch Description
+      name: User defined patch
+    inline:
+      machine:
+        network:
+          kubespan:
+            enabled: false
+            mtu: 1410
+  - idOverride: 600-3fb9b4d2-b13c-48a7-9929-3632e68ff5da
+    annotations:
+      description: Cluster Patch Description 2
+      name: User defined patch
+    inline:
+      machine:
+        network:
+          kubespan:
+            enabled: false
+            mtu: 1234
+---
+kind: ControlPlane
+bootstrapSpec:
+  clusterUUID: 98d00c6b-fae1-4bf2-afa3-0282ef443f84
+  snapshot: FFFFFFFF9AA169F0.snapshot
+machines:
+  - 3f8b33d2-52b1-42ed-8505-4025ddbc31f1
+patches:
+  - idOverride: 500-2e2a2a64-5085-407a-a205-f75f4c64a060
+    annotations:
+      description: Some Test Description 123
+      name: User defined patch
+    inline:
+      machine:
+        network:
+          kubespan:
+            enabled: false
+            mtu: 1111
+---
+kind: Workers
+machines:
+  - 024780fe-b0d6-43e0-a868-b142ba0a67a6
+updateStrategy:
+  rolling:
+    maxParallelism: 3
+deleteStrategy:
+  type: Rolling
+  rolling:
+    maxParallelism: 5
+patches:
+  - idOverride: 500-3792b0d9-0fc2-46fb-becf-4d5439bbe5ba
+    annotations:
+      description: Some Test Description ABC
+      name: User defined patch
+    inline:
+      machine:
+        network:
+          kubespan:
+            enabled: false
+            mtu: 1447
+---
+kind: Workers
+name: w07c5e8
+machineClass:
+  name: mc1
+  size: Unlimited
+patches:
+  - idOverride: 500-32fe29d6-221a-4e6e-a55e-6b1700cae09d
+    annotations:
+      description: Some Test Description 987
+      name: User defined patch
+    inline:
+      machine:
+        network:
+          kubespan:
+            enabled: false
+            mtu: 1217
+---
+kind: Workers
+name: w3c03cf
+machineClass:
+  name: mc2
+  size: 1
+patches:
+  - idOverride: 666-4a5ca2e0-4f57-4761-bf61-c1e4cf583170
+    annotations:
+      description: Some Test Description ZXC
+      name: User defined patch
+    inline:
+      machine:
+        network:
+          kubespan:
+            enabled: false
+            mtu: 1298
+---
+kind: Machine
+name: 024780fe-b0d6-43e0-a868-b142ba0a67a6
+locked: true
+patches:
+  - idOverride: 500-1104d832-79fb-4121-a67f-752fa8f763e9
+    annotations:
+      description: Some Test Description ASD
+      name: User defined patch
+    inline:
+      machine:
+        network:
+          kubespan:
+            enabled: false
+            mtu: 1166
+---
+kind: Machine
+name: 3f8b33d2-52b1-42ed-8505-4025ddbc31f1
+install:
+  disk: /dev/sdc
diff --git a/client/pkg/template/operations/validate.go b/client/pkg/template/operations/validate.go
new file mode 100644
index 000000000..0efda9a51
--- /dev/null
+++ b/client/pkg/template/operations/validate.go
@@ -0,0 +1,22 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package operations
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/siderolabs/omni/client/pkg/template"
+)
+
+// ValidateTemplate performs template validation.
+func ValidateTemplate(templateReader io.Reader) error {
+	tmpl, err := template.Load(templateReader)
+	if err != nil {
+		return fmt.Errorf("error loading template: %w", err)
+	}
+
+	return tmpl.Validate()
+}
diff --git a/client/pkg/template/order.go b/client/pkg/template/order.go
new file mode 100644
index 000000000..381e99f90
--- /dev/null
+++ b/client/pkg/template/order.go
@@ -0,0 +1,40 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package template
+
+import (
+	"cmp"
+	"fmt"
+	"slices"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// Canonical order of resources in the generated list.
+var canonicalResourceOrder = map[resource.Type]int{
+	omni.ClusterType:        1,
+	omni.ConfigPatchType:    2,
+	omni.MachineSetType:     3,
+	omni.MachineSetNodeType: 4,
+}
+
+func sortResources[T any](s []T, mapper func(T) resource.Metadata) {
+	slices.SortStableFunc(s, func(a, b T) int {
+		orderI := canonicalResourceOrder[mapper(a).Type()]
+		orderJ := canonicalResourceOrder[mapper(b).Type()]
+
+		if orderI == 0 {
+			panic(fmt.Sprintf("unknown resource type %q", mapper(a).Type()))
+		}
+
+		if orderJ == 0 {
+			panic(fmt.Sprintf("unknown resource type %q", mapper(b).Type()))
+		}
+
+		return cmp.Compare(orderI, orderJ)
+	})
+}
diff --git a/client/pkg/template/sync.go b/client/pkg/template/sync.go
new file mode 100644
index 000000000..55c044a3b
--- /dev/null
+++ b/client/pkg/template/sync.go
@@ -0,0 +1,23 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package template
+
+import "github.com/cosi-project/runtime/pkg/resource"
+
+// UpdateChange is a pair of old/new resources.
+type UpdateChange struct {
+	Old resource.Resource
+	New resource.Resource
+}
+
+// SyncResult describes the actions to perform to sync the template resources.
+type SyncResult struct {
+	// Resources to create.
+	Create []resource.Resource
+	// Resources to update.
+	Update []UpdateChange
+	// Resources to delete split by phases.
+	Destroy [][]resource.Resource
+}
diff --git a/client/pkg/template/template.go b/client/pkg/template/template.go
new file mode 100644
index 000000000..dd60e0262
--- /dev/null
+++ b/client/pkg/template/template.go
@@ -0,0 +1,325 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package template provides conversion of cluster templates to Omni resources.
+package template
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/xslices"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/template/internal/models"
+)
+
+// Template is a cluster template.
+type Template struct {
+	models models.List
+}
+
+// Load the template from input.
+func Load(input io.Reader) (*Template, error) {
+	dec := yaml.NewDecoder(input)
+
+	var template Template
+
+	for {
+		var docNode yaml.Node
+
+		if err := dec.Decode(&docNode); err != nil {
+			if errors.Is(err, io.EOF) {
+				return &template, nil
+			}
+
+			return nil, fmt.Errorf("error decoding template: %w", err)
+		}
+
+		if docNode.Kind != yaml.DocumentNode {
+			return nil, fmt.Errorf("unexpected node kind %q", docNode.Kind)
+		}
+
+		if len(docNode.Content) != 1 {
+			return nil, fmt.Errorf("unexpected number of nodes %d", len(docNode.Content))
+		}
+
+		kind, err := findKind(docNode.Content[0])
+		if err != nil {
+			return nil, fmt.Errorf("error in document at line %d:%d: %w", docNode.Line, docNode.Column, err)
+		}
+
+		model, err := models.New(kind)
+		if err != nil {
+			return nil, fmt.Errorf("error in document at line %d:%d: %w", docNode.Line, docNode.Column, err)
+		}
+
+		// YAML decoder doesn't allow to decode with KnownFields: true from a Node
+		// so we do a roundtrip to bytes and back :sigh:
+		raw, err := yaml.Marshal(docNode.Content[0])
+		if err != nil {
+			return nil, fmt.Errorf("error marshaling document at line %d:%d: %w", docNode.Line, docNode.Column, err)
+		}
+
+		documentDecoder := yaml.NewDecoder(bytes.NewReader(raw))
+		documentDecoder.KnownFields(true)
+
+		if err = documentDecoder.Decode(model); err != nil {
+			return nil, fmt.Errorf("error decoding document at line %d:%d: %w", docNode.Line, docNode.Column, err)
+		}
+
+		template.models = append(template.models, model)
+	}
+}
+
+func findKind(node *yaml.Node) (string, error) {
+	if node.Kind != yaml.MappingNode {
+		return "", fmt.Errorf("unexpected node kind %q, expecting mapping", node.Kind)
+	}
+
+	for i := 0; i < len(node.Content); i += 2 {
+		key := node.Content[i]
+		value := node.Content[i+1]
+
+		if key.Kind != yaml.ScalarNode {
+			return "", fmt.Errorf("unexpected node kind %q", key.Kind)
+		}
+
+		if key.Value != "kind" {
+			continue
+		}
+
+		if value.Kind != yaml.ScalarNode {
+			return "", fmt.Errorf("unexpected value type for kind field %q", value.Kind)
+		}
+
+		return value.Value, nil
+	}
+
+	return "", fmt.Errorf("kind field not found")
+}
+
+// WithCluster creates an empty template which contains only cluster model.
+//
+// Such template can be used for reading a cluster status, deleting a cluster, etc.
+func WithCluster(clusterName string) *Template {
+	return &Template{
+		models: models.List{
+			&models.Cluster{
+				Meta: models.Meta{
+					Kind: models.KindCluster,
+				},
+				Name: clusterName,
+			},
+		},
+	}
+}
+
+// Validate the template.
+func (t *Template) Validate() error {
+	return t.models.Validate()
+}
+
+// Translate the template into resources.
+func (t *Template) Translate() ([]resource.Resource, error) {
+	return t.models.Translate()
+}
+
+// ClusterName returns the name of the cluster associated with the template.
+func (t *Template) ClusterName() (string, error) {
+	return t.models.ClusterName()
+}
+
+// actualResources returns a list of resources in the state related to the cluster template.
+func (t *Template) actualResources(ctx context.Context, st state.State) ([]resource.Resource, error) {
+	clusterName, err := t.models.ClusterName()
+	if err != nil {
+		return nil, err
+	}
+
+	var actualResources []resource.Resource
+
+	clusterResource, err := st.Get(ctx, resource.NewMetadata(resources.DefaultNamespace, omni.ClusterType, clusterName, resource.VersionUndefined))
+	if err != nil {
+		if !state.IsNotFoundError(err) {
+			return nil, err
+		}
+	} else {
+		actualResources = append(actualResources, clusterResource)
+	}
+
+	for _, resourceType := range []resource.Type{
+		omni.MachineSetType,
+		omni.MachineSetNodeType,
+		omni.ConfigPatchType,
+	} {
+		items, err := st.List(
+			ctx,
+			resource.NewMetadata(resources.DefaultNamespace, resourceType, "", resource.VersionUndefined),
+			state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)),
+		)
+		if err != nil {
+			return nil, err
+		}
+
+		actualResources = append(actualResources,
+			xslices.Filter(items.Items,
+				func(r resource.Resource) bool {
+					return r.Metadata().Owner() == ""
+				},
+			)...)
+	}
+
+	return actualResources, nil
+}
+
+func splitResourcesToDelete(toDelete []resource.Resource) [][]resource.Resource {
+	phases := make([][]resource.Resource, 2)
+
+	for _, r := range deduplicateDeletion(toDelete) {
+		switch r.Metadata().Type() {
+		case omni.MachineSetNodeType, omni.MachineSetType:
+			phases[0] = append(phases[0], r)
+		default:
+			phases[1] = append(phases[1], r)
+		}
+	}
+
+	for i := range phases {
+		sortResources(phases[i], func(r resource.Resource) resource.Metadata { return *r.Metadata() })
+	}
+
+	return phases
+}
+
+// Delete returns a sync result which lists what needs to be deleted from state to remove template from the cluster.
+func (t *Template) Delete(ctx context.Context, st state.State) (*SyncResult, error) {
+	actualResources, err := t.actualResources(ctx, st)
+	if err != nil {
+		return nil, err
+	}
+
+	syncResult := SyncResult{
+		Destroy: splitResourcesToDelete(actualResources),
+	}
+
+	return &syncResult, nil
+}
+
+func metadataKey(md resource.Metadata) string {
+	return fmt.Sprintf("%s/%s/%s", md.Namespace(), md.Type(), md.ID())
+}
+
+// Sync the template against the resource state.
+func (t *Template) Sync(ctx context.Context, st state.State) (*SyncResult, error) {
+	clusterName, err := t.models.ClusterName()
+	if err != nil {
+		return nil, err
+	}
+
+	expectedResources, err := t.Translate()
+	if err != nil {
+		return nil, err
+	}
+
+	actualResources, err := t.actualResources(ctx, st)
+	if err != nil {
+		return nil, err
+	}
+
+	expectedResourceMap := xslices.ToMap(expectedResources, func(r resource.Resource) (string, resource.Resource) {
+		return metadataKey(*r.Metadata()), r
+	})
+
+	var (
+		syncResult SyncResult
+		toDelete   []resource.Resource
+	)
+
+	for _, actualResource := range actualResources {
+		if expectedResource, ok := expectedResourceMap[metadataKey(*actualResource.Metadata())]; ok {
+			// copy some metadata to minimize the diff
+			expectedResource.Metadata().SetVersion(actualResource.Metadata().Version())
+			expectedResource.Metadata().SetUpdated(actualResource.Metadata().Updated())
+			expectedResource.Metadata().SetCreated(actualResource.Metadata().Created())
+			expectedResource.Metadata().Finalizers().Set(*actualResource.Metadata().Finalizers())
+
+			if !resource.Equal(actualResource, expectedResource) {
+				syncResult.Update = append(syncResult.Update, UpdateChange{Old: actualResource, New: expectedResource})
+			}
+		} else {
+			// check that actual resource belongs to the cluster to avoid removing resources from other clusters
+			if actualResource.Metadata().Type() != omni.ClusterType {
+				if clusterLabel, _ := actualResource.Metadata().Labels().Get(omni.LabelCluster); clusterLabel != clusterName {
+					return nil, fmt.Errorf("resource %s belongs to cluster %q, but template is for cluster %q", resource.String(actualResource), clusterLabel, clusterName)
+				}
+			}
+
+			toDelete = append(toDelete, actualResource)
+		}
+
+		delete(expectedResourceMap, metadataKey(*actualResource.Metadata()))
+	}
+
+	for _, expectedResource := range expectedResourceMap {
+		if _, ok := expectedResourceMap[metadataKey(*expectedResource.Metadata())]; ok {
+			// check that no such resource exists (for a different cluster)
+			if actualResource, err := st.Get(ctx, *expectedResource.Metadata()); err == nil {
+				clusterLabel, _ := actualResource.Metadata().Labels().Get(omni.LabelCluster)
+
+				return nil, fmt.Errorf("resource %s already exists from cluster %q, but template is for cluster %q", resource.String(actualResource), clusterLabel, clusterName)
+			}
+
+			syncResult.Create = append(syncResult.Create, expectedResource)
+		}
+	}
+
+	sortResources(syncResult.Create, func(r resource.Resource) resource.Metadata { return *r.Metadata() })
+	sortResources(syncResult.Update, func(u UpdateChange) resource.Metadata { return *u.New.Metadata() })
+	syncResult.Destroy = splitResourcesToDelete(toDelete)
+
+	return &syncResult, nil
+}
+
+func deduplicateDeletion(toDelete []resource.Resource) []resource.Resource {
+	toDeleteMap := xslices.ToMap(toDelete, func(r resource.Resource) (string, resource.Resource) {
+		return metadataKey(*r.Metadata()), r
+	})
+
+	r := xslices.Filter(toDelete, func(r resource.Resource) bool {
+		switch r.Metadata().Type() {
+		case omni.ClusterType:
+			return true
+		case omni.MachineSetNodeType:
+			machineSetName, ok := r.Metadata().Labels().Get(omni.LabelMachineSet)
+			if !ok {
+				return true
+			}
+
+			if _, ok := toDeleteMap[metadataKey(resource.NewMetadata(resources.DefaultNamespace, omni.MachineSetType, machineSetName, resource.VersionUndefined))]; ok {
+				return false
+			}
+		default:
+			clusterName, ok := r.Metadata().Labels().Get(omni.LabelCluster)
+			if !ok {
+				return true
+			}
+
+			if _, ok := toDeleteMap[metadataKey(resource.NewMetadata(resources.DefaultNamespace, omni.ClusterType, clusterName, resource.VersionUndefined))]; ok {
+				return false
+			}
+		}
+
+		return true
+	})
+
+	return r
+}
diff --git a/client/pkg/template/template_test.go b/client/pkg/template/template_test.go
new file mode 100644
index 000000000..9f6ce4864
--- /dev/null
+++ b/client/pkg/template/template_test.go
@@ -0,0 +1,441 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+package template_test
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/pkg/template"
+)
+
+//go:embed testdata/cluster1.yaml
+var cluster1 []byte
+
+//go:embed testdata/cluster2.yaml
+var cluster2 []byte
+
+//go:embed testdata/cluster3.yaml
+var cluster3 []byte
+
+//go:embed testdata/cluster-valid-bootstrapspec.yaml
+var clusterValidBootstrapSpec []byte
+
+//go:embed testdata/cluster-bad-yaml1.yaml
+var clusterBadYAML1 []byte
+
+//go:embed testdata/cluster-bad-yaml2.yaml
+var clusterBadYAML2 []byte
+
+//go:embed testdata/cluster-bad-yaml3.yaml
+var clusterBadYAML3 []byte
+
+//go:embed testdata/cluster-invalid1.yaml
+var clusterInvalid1 []byte
+
+//go:embed testdata/cluster-invalid2.yaml
+var clusterInvalid2 []byte
+
+//go:embed testdata/cluster-invalid3.yaml
+var clusterInvalid3 []byte
+
+//go:embed testdata/cluster-invalid4.yaml
+var clusterInvalid4 []byte
+
+//go:embed testdata/cluster-invalid-bootstrapspec.yaml
+var clusterInvalidBootstrapSpec []byte
+
+//go:embed testdata/cluster1-resources.yaml
+var cluster1Resources []byte
+
+//go:embed testdata/cluster2-resources.yaml
+var cluster2Resources []byte
+
+//go:embed testdata/cluster3-resources.yaml
+var cluster3Resources []byte
+
+//go:embed testdata/cluster-valid-bootstrapspec-resources.yaml
+var clusterValidBootstrapSpecResources []byte
+
+func TestLoad(t *testing.T) {
+	for _, tt := range []struct { //nolint:govet
+		name          string
+		data          []byte
+		expectedError string
+	}{
+		{
+			name: "cluster1",
+			data: cluster1,
+		},
+		{
+			name: "cluster2",
+			data: cluster2,
+		},
+		{
+			name:          "clusterBadYAML1",
+			data:          clusterBadYAML1,
+			expectedError: "error decoding document at line 1:1: yaml: unmarshal errors:\n  line 7: field containerd not found in type models.Cluster",
+		},
+		{
+			name:          "clusterBadYAML2",
+			data:          clusterBadYAML2,
+			expectedError: "error in document at line 1:1: unknown model kind \"FunnyCluster\"",
+		},
+		{
+			name:          "clusterBadYAML3",
+			data:          clusterBadYAML3,
+			expectedError: "error in document at line 1:1: kind field not found",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := template.Load(bytes.NewReader(tt.data))
+			if tt.expectedError == "" {
+				require.NoError(t, err)
+			} else {
+				require.EqualError(t, err, tt.expectedError)
+			}
+		})
+	}
+}
+
+func TestValidate(t *testing.T) {
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+
+	require.NoError(t, os.Chdir("testdata"))
+	t.Cleanup(func() {
+		os.Chdir(cwd) //nolint:errcheck
+	})
+
+	for _, tt := range []struct { //nolint:govet
+		name          string
+		data          []byte
+		expectedError string
+	}{
+		{
+			name: "cluster1",
+			data: cluster1,
+		},
+		{
+			name: "cluster2",
+			data: cluster2,
+		},
+		{
+			name: "cluster3",
+			data: cluster3,
+		},
+		{
+			name: "clusterInvalid1",
+			data: clusterInvalid1,
+			expectedError: `5 errors occurred:
+	* error validating cluster "my first cluster": 5 errors occurred:
+	* name should only contain letters, digits, dashes and underscores
+	* error validating Kubernetes version: 1 error occurred:
+	* version should be in semver format: Invalid character(s) found in major number "N"
+
+
+	* error validating Talos version: 1 error occurred:
+	* version should be in semver format: Invalid character(s) found in patch number "0gamma.0"
+
+
+	* patch "does-not-exist.yaml" is invalid: 1 error occurred:
+	* failed to access "does-not-exist.yaml": open does-not-exist.yaml: no such file or directory
+
+
+	* patch "" is invalid: 1 error occurred:
+	* either name or idOverride is required for inline patches
+
+
+
+
+	* controlplane is invalid: 4 errors occurred:
+	* updateStrategy is not allowed in the controlplane
+	* deleteStrategy is not allowed in the controlplane
+	* patch "patches/invalid.yaml" is invalid: 1 error occurred:
+	* failed to validate patch "patches/invalid.yaml": missing kind
+
+
+	* patch "kubespan-enabled" is invalid: 1 error occurred:
+	* failed to validate inline patch "kubespan-enabled": unknown keys found during decoding:
+machine:
+    network:
+        kubespan:
+            running: true
+
+
+
+
+
+	* machines [4aed1106-6f44-4be9-9796-d4b5b0b5b0b0] are used in both controlplane and workers
+	* machine "630d882a-51a8-48b3-ae00-90c5b0b5b0b0" is not used in controlplane or workers
+	* machine "430d882a-51a8-48b3-ae00-90c5b0b5b0b0" is locked and used in controlplane
+
+`,
+		},
+		{
+			name: "clusterInvalid2",
+			data: clusterInvalid2,
+			expectedError: `3 errors occurred:
+	* error validating cluster "": 4 errors occurred:
+	* name is required
+	* error validating Kubernetes version: 1 error occurred:
+	* version is required
+
+
+	* error validating Talos version: 1 error occurred:
+	* version is required
+
+
+	* patch "" is invalid: 1 error occurred:
+	* path or inline is required
+
+
+
+
+	* controlplane is invalid: 1 error occurred:
+	* patch "patches/prohibited.yaml" is invalid: 1 error occurred:
+	* failed to validate patch "patches/prohibited.yaml": 1 error occurred:
+	* overriding "machine.token" is not allowed in the config patch
+
+
+
+
+
+
+	* template should contain 1 controlplane, got 2
+
+`,
+		},
+		{
+			name: "clusterInvalid3",
+			data: clusterInvalid3,
+			expectedError: `3 errors occurred:
+	* controlplane is invalid: 1 error occurred:
+	* custom name is not allowed in the controlplane
+
+
+	* duplicate workers with name "additional-1"
+	* machine "b1ed45d8-4e79-4a07-a29a-b1b075843d41" is used in multiple workers: ["additional-1" "additional-2"]
+
+`,
+		},
+		{
+			name: "clusterInvalid4",
+			data: clusterInvalid4,
+			expectedError: `1 error occurred:
+	* workers is invalid: 1 error occurred:
+	* machine set can not have both machines and machine class defined`,
+		},
+		{
+			name: "clusterInvalidBootstrapSpec",
+			data: clusterInvalidBootstrapSpec,
+			expectedError: `2 errors occurred:
+	* controlplane is invalid: 2 errors occurred:
+	* clusterUUID is required in bootstrapSpec
+	* snapshot is required in bootstrapSpec
+
+
+	* workers is invalid: 1 error occurred:
+	* bootstrapSpec is not allowed in workers`,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			templ, err := template.Load(bytes.NewReader(tt.data))
+			require.NoError(t, err)
+
+			err = templ.Validate()
+			if tt.expectedError == "" {
+				require.NoError(t, err)
+
+				return
+			}
+
+			printMode := false
+			if printMode {
+				fmt.Printf("ACTUAL ERROR:\n%s\n", err.Error())
+
+				return
+			}
+
+			require.Equal(t, strings.TrimSpace(tt.expectedError), strings.TrimSpace(err.Error()), err.Error())
+		})
+	}
+}
+
+func TestTranslate(t *testing.T) {
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+
+	require.NoError(t, os.Chdir("testdata"))
+	t.Cleanup(func() {
+		os.Chdir(cwd) //nolint:errcheck
+	})
+
+	for _, tt := range []struct {
+		name     string
+		template []byte
+		expected []byte
+	}{
+		{
+			name:     "cluster1",
+			template: cluster1,
+			expected: cluster1Resources,
+		},
+		{
+			name:     "cluster2",
+			template: cluster2,
+			expected: cluster2Resources,
+		},
+		{
+			name:     "cluster3",
+			template: cluster3,
+			expected: cluster3Resources,
+		},
+		{
+			name:     "clusterValidBootstrapSpec",
+			template: clusterValidBootstrapSpec,
+			expected: clusterValidBootstrapSpecResources,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			templ, err := template.Load(bytes.NewReader(tt.template))
+			require.NoError(t, err)
+
+			require.NoError(t, templ.Validate())
+
+			resources, err := templ.Translate()
+			require.NoError(t, err)
+
+			var actual bytes.Buffer
+
+			enc := yaml.NewEncoder(&actual)
+
+			for _, r := range resources {
+				// zero timestamps for reproducibility
+				r.Metadata().SetCreated(time.Time{})
+				r.Metadata().SetUpdated(time.Time{})
+
+				m, err := resource.MarshalYAML(r)
+				require.NoError(t, err)
+
+				require.NoError(t, enc.Encode(m))
+			}
+
+			printMode := false
+			if printMode {
+				fmt.Printf("ACTUAL:\n%s\n", actual.String())
+
+				return
+			}
+
+			require.Equal(t, string(tt.expected), actual.String())
+		})
+	}
+}
+
+func TestSync(t *testing.T) {
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+
+	require.NoError(t, os.Chdir("testdata"))
+	t.Cleanup(func() {
+		os.Chdir(cwd) //nolint:errcheck
+	})
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	ctx := context.Background()
+
+	templ1, err := template.Load(bytes.NewReader(cluster1))
+	require.NoError(t, err)
+
+	sync1, err := templ1.Sync(ctx, st)
+	require.NoError(t, err)
+
+	assert.Equal(t, [][]resource.Resource{nil, nil}, sync1.Destroy)
+	assert.Empty(t, sync1.Update)
+	assert.Len(t, sync1.Create, 12)
+
+	for _, r := range sync1.Create {
+		require.NoError(t, st.Create(ctx, r))
+	}
+
+	templ2, err := template.Load(bytes.NewReader(cluster2))
+	require.NoError(t, err)
+
+	sync2, err := templ2.Sync(ctx, st)
+	require.NoError(t, err)
+
+	assert.Equal(t, [][]string{
+		{
+			"MachineSetNodes.omni.sidero.dev(default/4aed1106-6f44-4be9-9796-d4b5b0b5b0b0)",
+		},
+		{
+			"ConfigPatches.omni.sidero.dev(default/400-my-first-cluster-control-planes-patches/my-cp-patch.yaml)",
+			"ConfigPatches.omni.sidero.dev(default/401-my-first-cluster-control-planes-kubespan-enabled)",
+		},
+	}, xslices.Map(sync2.Destroy, func(x []resource.Resource) []string { return xslices.Map(x, resource.String) }))
+
+	assert.Equal(t, []string{
+		"Clusters.omni.sidero.dev(default/my-first-cluster)",
+		"ConfigPatches.omni.sidero.dev(default/000-cm-430d882a-51a8-48b3-ae00-90c5b0b5b0b0-install-disk)",
+		"MachineSetNodes.omni.sidero.dev(default/430d882a-51a8-48b3-ab00-d4b5b0b5b0b0)",
+	}, xslices.Map(sync2.Update, func(u template.UpdateChange) string { return resource.String(u.New) }))
+
+	assert.Equal(t, []string{
+		"ConfigPatches.omni.sidero.dev(default/400-my-first-cluster-control-planes-kubespan-enabled)",
+	}, xslices.Map(sync2.Create, resource.String))
+}
+
+func TestDelete(t *testing.T) {
+	cwd, err := os.Getwd()
+	require.NoError(t, err)
+
+	require.NoError(t, os.Chdir("testdata"))
+	t.Cleanup(func() {
+		os.Chdir(cwd) //nolint:errcheck
+	})
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	ctx := context.Background()
+
+	templ1, err := template.Load(bytes.NewReader(cluster1))
+	require.NoError(t, err)
+
+	sync1, err := templ1.Sync(ctx, st)
+	require.NoError(t, err)
+
+	for _, r := range sync1.Create {
+		require.NoError(t, st.Create(ctx, r))
+	}
+
+	templ2, err := template.Load(bytes.NewReader(cluster2))
+	require.NoError(t, err)
+
+	syncDelete, err := templ2.Delete(ctx, st)
+	require.NoError(t, err)
+
+	assert.Empty(t, syncDelete.Create)
+	assert.Empty(t, syncDelete.Update)
+	assert.Len(t, syncDelete.Destroy, 2)
+	assert.Len(t, syncDelete.Destroy[0], 0)
+	assert.Len(t, syncDelete.Destroy[1], 1)
+}
diff --git a/client/pkg/template/testdata/cluster-bad-yaml1.yaml b/client/pkg/template/testdata/cluster-bad-yaml1.yaml
new file mode 100644
index 000000000..3262f3e59
--- /dev/null
+++ b/client/pkg/template/testdata/cluster-bad-yaml1.yaml
@@ -0,0 +1,8 @@
+kind: Cluster
+name: my-first-cluster
+kubernetes:
+  version: v1.18.2
+talos:
+  version: v1.3.0
+containerd:
+  version: 1.6.12
diff --git a/client/pkg/template/testdata/cluster-bad-yaml2.yaml b/client/pkg/template/testdata/cluster-bad-yaml2.yaml
new file mode 100644
index 000000000..45b521d6a
--- /dev/null
+++ b/client/pkg/template/testdata/cluster-bad-yaml2.yaml
@@ -0,0 +1,6 @@
+kind: FunnyCluster
+name: my-first-cluster
+kubernetes:
+  version: v1.18.2
+talos:
+  version: v1.3.0
diff --git a/client/pkg/template/testdata/cluster-bad-yaml3.yaml b/client/pkg/template/testdata/cluster-bad-yaml3.yaml
new file mode 100644
index 000000000..64d1face7
--- /dev/null
+++ b/client/pkg/template/testdata/cluster-bad-yaml3.yaml
@@ -0,0 +1,5 @@
+name: my-first-cluster
+kubernetes:
+  version: v1.18.2
+talos:
+  version: v1.3.0
diff --git a/client/pkg/template/testdata/cluster-invalid-bootstrapspec.yaml b/client/pkg/template/testdata/cluster-invalid-bootstrapspec.yaml
new file mode 100644
index 000000000..e199a1d45
--- /dev/null
+++ b/client/pkg/template/testdata/cluster-invalid-bootstrapspec.yaml
@@ -0,0 +1,20 @@
+kind: Cluster
+name: my-first-cluster
+kubernetes:
+  version: v1.18.2
+talos:
+  version: v1.3.0
+---
+kind: ControlPlane
+machines:
+  - 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+bootstrapSpec:
+  clusterUUID: ""
+  snapshot: ""
+---
+kind: Workers
+machines:
+  - 18308f52-b833-4376-a7c8-1cb9de2feafd
+bootstrapSpec:
+  clusterUUID: test-cluster-uuid
+  snapshot: TEST.snapshot
diff --git a/client/pkg/template/testdata/cluster-invalid1.yaml b/client/pkg/template/testdata/cluster-invalid1.yaml
new file mode 100644
index 000000000..061e99329
--- /dev/null
+++ b/client/pkg/template/testdata/cluster-invalid1.yaml
@@ -0,0 +1,41 @@
+kind: Cluster
+name: my first cluster # invalid: contains spaces
+kubernetes:
+  version: vN.2 # invalid version
+talos:
+  version: v1.3.0gamma.0 # invalid version
+patches:
+  - file: does-not-exist.yaml # doesn't exist
+  - inline: # no name
+      machine:
+        network:
+---
+kind: ControlPlane
+machines:
+  - 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+  - 4aed1106-6f44-4be9-9796-d4b5b0b5b0b0
+updateStrategy:
+  rolling:
+    maxParallelism: 2
+deleteStrategy:
+  type: Rolling
+patches:
+  - file: patches/invalid.yaml  # invalid content
+  - name: kubespan-enabled  # invalid content
+    inline:
+      machine:
+        network:
+          kubespan:
+            running: true
+---
+kind: Workers
+machines:
+  - 430d882a-51a8-48b3-ab00-d4b5b0b5b0b0
+  - 4aed1106-6f44-4be9-9796-d4b5b0b5b0b0 # duplicate across controlplanes and workers
+---
+kind: Machine
+name: 630d882a-51a8-48b3-ae00-90c5b0b5b0b0 # machine is not part of controlplane/workers
+---
+kind: Machine
+name: 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+locked: true
diff --git a/client/pkg/template/testdata/cluster-invalid2.yaml b/client/pkg/template/testdata/cluster-invalid2.yaml
new file mode 100644
index 000000000..6b9340981
--- /dev/null
+++ b/client/pkg/template/testdata/cluster-invalid2.yaml
@@ -0,0 +1,15 @@
+kind: Cluster
+name:
+patches:
+  - {}
+---
+kind: ControlPlane
+machines:
+  - 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+  - 4aed1106-6f44-4be9-9796-d4b5b0b5b0b0
+---
+kind: ControlPlane
+machines:
+  - 430d882a-51a8-48b3-ab00-d4b5b0b5b0b0
+patches:
+  - file: patches/prohibited.yaml
diff --git a/client/pkg/template/testdata/cluster-invalid3.yaml b/client/pkg/template/testdata/cluster-invalid3.yaml
new file mode 100644
index 000000000..17c7e8e63
--- /dev/null
+++ b/client/pkg/template/testdata/cluster-invalid3.yaml
@@ -0,0 +1,53 @@
+kind: Cluster
+name: my-first-cluster
+kubernetes:
+  version: v1.18.2
+talos:
+  version: v1.3.1
+
+# control plane
+---
+kind: Machine
+name: 4b9797ae-55d7-4717-a19e-b322a2d83d39
+---
+kind: ControlPlane
+name: dodo
+machines:
+  - 4b9797ae-55d7-4717-a19e-b322a2d83d39
+
+# default workers
+---
+kind: Machine
+name: 947f7a99-0f46-4a9e-ab02-205f4e1b7009
+---
+kind: Workers
+machines:
+  - 947f7a99-0f46-4a9e-ab02-205f4e1b7009
+
+# additional workers 1
+---
+kind: Machine
+name: b1ed45d8-4e79-4a07-a29a-b1b075843d41
+---
+kind: Workers
+name: additional-1
+machines:
+  - b1ed45d8-4e79-4a07-a29a-b1b075843d41
+
+# duplicate additional workers
+---
+kind: Machine
+name: 919b1d5b-daf8-4b82-bc0d-48929f05a405
+---
+kind: Workers
+name: additional-1
+machines:
+  - 919b1d5b-daf8-4b82-bc0d-48929f05a405
+
+# additional workers 2 with machines from additional-1
+---
+kind: Workers
+name: additional-2
+machines:
+  - b1ed45d8-4e79-4a07-a29a-b1b075843d41
+
diff --git a/client/pkg/template/testdata/cluster-invalid4.yaml b/client/pkg/template/testdata/cluster-invalid4.yaml
new file mode 100644
index 000000000..a16a4c656
--- /dev/null
+++ b/client/pkg/template/testdata/cluster-invalid4.yaml
@@ -0,0 +1,31 @@
+kind: Cluster
+name: my-first-cluster
+kubernetes:
+  version: v1.18.2
+talos:
+  version: v1.3.0
+features:
+  diskEncryption: true
+patches:
+  - file: patches/my-cluster-patch.yaml
+  - file: ../testdata/patches/my-registry-mirrors.yaml
+---
+kind: ControlPlane
+machineClass:
+  name: test
+  size: 1
+patches:
+  - file: patches/my-cp-patch.yaml  # name is derived from the filename
+  - name: kubespan-enabled  # weight is implied (000-999)
+    inline:
+      machine:
+        network:
+          kubespan:
+            enabled: true
+---
+kind: Workers
+machines:
+  - 430d882a-51a8-48b3-ab00-d4b5b0b5b0b0
+machineClass:
+  name: test
+  size: 1
diff --git a/client/pkg/template/testdata/cluster-valid-bootstrapspec-resources.yaml b/client/pkg/template/testdata/cluster-valid-bootstrapspec-resources.yaml
new file mode 100644
index 000000000..201fdc0ee
--- /dev/null
+++ b/client/pkg/template/testdata/cluster-valid-bootstrapspec-resources.yaml
@@ -0,0 +1,91 @@
+metadata:
+    namespace: default
+    type: Clusters.omni.sidero.dev
+    id: my-cluster-with-bootstrapspec
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    annotations:
+        omni.sidero.dev/managed-by-cluster-templates:
+spec:
+    installimage: ""
+    kubernetesversion: 1.18.2
+    talosversion: 1.3.0
+    features:
+        enableworkloadproxy: false
+        diskencryption: false
+    backupconfiguration: null
+---
+metadata:
+    namespace: default
+    type: MachineSets.omni.sidero.dev
+    id: my-cluster-with-bootstrapspec-control-planes
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-cluster-with-bootstrapspec
+        omni.sidero.dev/role-controlplane:
+spec:
+    updatestrategy: 1
+    machineclass: null
+    bootstrapspec:
+        clusteruuid: test-cluster-uuid
+        snapshot: TEST.snapshot
+    deletestrategy: 0
+    updatestrategyconfig: null
+    deletestrategyconfig: null
+---
+metadata:
+    namespace: default
+    type: MachineSetNodes.omni.sidero.dev
+    id: 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-cluster-with-bootstrapspec
+        omni.sidero.dev/machine-set: my-cluster-with-bootstrapspec-control-planes
+        omni.sidero.dev/role-controlplane:
+spec: {}
+---
+metadata:
+    namespace: default
+    type: MachineSets.omni.sidero.dev
+    id: my-cluster-with-bootstrapspec-workers
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-cluster-with-bootstrapspec
+        omni.sidero.dev/role-worker:
+spec:
+    updatestrategy: 1
+    machineclass: null
+    bootstrapspec: null
+    deletestrategy: 0
+    updatestrategyconfig: null
+    deletestrategyconfig: null
+---
+metadata:
+    namespace: default
+    type: MachineSetNodes.omni.sidero.dev
+    id: 18308f52-b833-4376-a7c8-1cb9de2feafd
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-cluster-with-bootstrapspec
+        omni.sidero.dev/machine-set: my-cluster-with-bootstrapspec-workers
+        omni.sidero.dev/role-worker:
+spec: {}
diff --git a/client/pkg/template/testdata/cluster-valid-bootstrapspec.yaml b/client/pkg/template/testdata/cluster-valid-bootstrapspec.yaml
new file mode 100644
index 000000000..c6ae8c61f
--- /dev/null
+++ b/client/pkg/template/testdata/cluster-valid-bootstrapspec.yaml
@@ -0,0 +1,17 @@
+kind: Cluster
+name: my-cluster-with-bootstrapspec
+kubernetes:
+  version: v1.18.2
+talos:
+  version: v1.3.0
+---
+kind: ControlPlane
+machines:
+  - 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+bootstrapSpec:
+  clusterUUID: test-cluster-uuid
+  snapshot: TEST.snapshot
+---
+kind: Workers
+machines:
+  - 18308f52-b833-4376-a7c8-1cb9de2feafd
diff --git a/client/pkg/template/testdata/cluster1-resources.yaml b/client/pkg/template/testdata/cluster1-resources.yaml
new file mode 100644
index 000000000..b98f526d8
--- /dev/null
+++ b/client/pkg/template/testdata/cluster1-resources.yaml
@@ -0,0 +1,238 @@
+metadata:
+    namespace: default
+    type: Clusters.omni.sidero.dev
+    id: my-first-cluster
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    annotations:
+        omni.sidero.dev/managed-by-cluster-templates:
+spec:
+    installimage: ""
+    kubernetesversion: 1.18.2
+    talosversion: 1.3.0
+    features:
+        enableworkloadproxy: false
+        diskencryption: true
+    backupconfiguration: null
+---
+metadata:
+    namespace: default
+    type: ConfigPatches.omni.sidero.dev
+    id: 200-cluster-my-first-cluster-patches/my-cluster-patch.yaml
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+    annotations:
+        name: patches/my-cluster-patch.yaml
+spec:
+    data: |
+        machine:
+          network:
+            kubespan:
+              enabled: true
+---
+metadata:
+    namespace: default
+    type: ConfigPatches.omni.sidero.dev
+    id: 201-cluster-my-first-cluster-../testdata/patches/my-registry-mirrors.yaml
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+    annotations:
+        name: ../testdata/patches/my-registry-mirrors.yaml
+spec:
+    data: |
+        machine:
+          registries:
+            mirrors:
+              ghcr.io:
+                endpoints:
+                  - https://ghcr.io
+                  - https://ghcr.mirror.com
+---
+metadata:
+    namespace: default
+    type: MachineSets.omni.sidero.dev
+    id: my-first-cluster-control-planes
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/role-controlplane:
+spec:
+    updatestrategy: 1
+    machineclass: null
+    bootstrapspec: null
+    deletestrategy: 0
+    updatestrategyconfig: null
+    deletestrategyconfig: null
+---
+metadata:
+    namespace: default
+    type: MachineSetNodes.omni.sidero.dev
+    id: 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/machine-set: my-first-cluster-control-planes
+        omni.sidero.dev/role-controlplane:
+spec: {}
+---
+metadata:
+    namespace: default
+    type: MachineSetNodes.omni.sidero.dev
+    id: 4aed1106-6f44-4be9-9796-d4b5b0b5b0b0
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/machine-set: my-first-cluster-control-planes
+        omni.sidero.dev/role-controlplane:
+spec: {}
+---
+metadata:
+    namespace: default
+    type: ConfigPatches.omni.sidero.dev
+    id: 400-my-first-cluster-control-planes-patches/my-cp-patch.yaml
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/machine-set: my-first-cluster-control-planes
+    annotations:
+        name: patches/my-cp-patch.yaml
+spec:
+    data: |
+        cluster:
+          apiServer:
+            extraArgs:
+              cloud-provider: external
+              cloud-config: /etc/kubernetes/cloud-config.yaml
+---
+metadata:
+    namespace: default
+    type: ConfigPatches.omni.sidero.dev
+    id: 401-my-first-cluster-control-planes-kubespan-enabled
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/machine-set: my-first-cluster-control-planes
+    annotations:
+        name: kubespan-enabled
+spec:
+    data: |
+        machine:
+            network:
+                kubespan:
+                    enabled: true
+---
+metadata:
+    namespace: default
+    type: MachineSets.omni.sidero.dev
+    id: my-first-cluster-workers
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/role-worker:
+spec:
+    updatestrategy: 1
+    machineclass: null
+    bootstrapspec: null
+    deletestrategy: 0
+    updatestrategyconfig: null
+    deletestrategyconfig: null
+---
+metadata:
+    namespace: default
+    type: MachineSetNodes.omni.sidero.dev
+    id: 430d882a-51a8-48b3-ab00-d4b5b0b5b0b0
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/machine-set: my-first-cluster-workers
+        omni.sidero.dev/role-worker:
+    annotations:
+        omni.sidero.dev/locked:
+spec: {}
+---
+metadata:
+    namespace: default
+    type: ConfigPatches.omni.sidero.dev
+    id: 000-cm-430d882a-51a8-48b3-ae00-90c5b0b5b0b0-install-disk
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/cluster-machine: 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+        omni.sidero.dev/system-patch:
+    annotations:
+        name: install-disk
+spec:
+    data: |
+        machine:
+            install:
+                disk: /dev/vda
+---
+metadata:
+    namespace: default
+    type: ConfigPatches.omni.sidero.dev
+    id: 400-cm-430d882a-51a8-48b3-ae00-90c5b0b5b0b0-my-address
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/cluster-machine: 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+    annotations:
+        name: my-address
+spec:
+    data: |
+        machine:
+            network:
+                interfaces:
+                    - addresses:
+                        - 192.168.0.2/24
+                      interface: eth0
+                      routes:
+                        - gateway: 192.168.0.1
diff --git a/client/pkg/template/testdata/cluster1.yaml b/client/pkg/template/testdata/cluster1.yaml
new file mode 100644
index 000000000..475cd1c5e
--- /dev/null
+++ b/client/pkg/template/testdata/cluster1.yaml
@@ -0,0 +1,47 @@
+kind: Cluster
+name: my-first-cluster
+kubernetes:
+  version: v1.18.2
+talos:
+  version: v1.3.0
+features:
+  diskEncryption: true
+patches:
+  - file: patches/my-cluster-patch.yaml
+  - file: ../testdata/patches/my-registry-mirrors.yaml
+---
+kind: ControlPlane
+machines:
+  - 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+  - 4aed1106-6f44-4be9-9796-d4b5b0b5b0b0
+patches:
+  - file: patches/my-cp-patch.yaml  # name is derived from the filename
+  - name: kubespan-enabled  # weight is implied (000-999)
+    inline:
+      machine:
+        network:
+          kubespan:
+            enabled: true
+---
+kind: Workers
+machines:
+  - 430d882a-51a8-48b3-ab00-d4b5b0b5b0b0
+---
+kind: Machine
+name: 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+install:
+  disk: /dev/vda
+patches: # ClusterMachine ConfigPatch
+  - name: my-address
+    inline:
+      machine:
+        network:
+          interfaces:
+           - interface: eth0
+             addresses: [192.168.0.2/24]
+             routes:
+               - gateway: "192.168.0.1"
+---
+kind: Machine
+name: 430d882a-51a8-48b3-ab00-d4b5b0b5b0b0
+locked: true
diff --git a/client/pkg/template/testdata/cluster2-resources.yaml b/client/pkg/template/testdata/cluster2-resources.yaml
new file mode 100644
index 000000000..1ac501767
--- /dev/null
+++ b/client/pkg/template/testdata/cluster2-resources.yaml
@@ -0,0 +1,199 @@
+metadata:
+    namespace: default
+    type: Clusters.omni.sidero.dev
+    id: my-first-cluster
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    annotations:
+        omni.sidero.dev/managed-by-cluster-templates:
+spec:
+    installimage: ""
+    kubernetesversion: 1.18.2
+    talosversion: 1.3.1
+    features:
+        enableworkloadproxy: true
+        diskencryption: false
+    backupconfiguration: null
+---
+metadata:
+    namespace: default
+    type: ConfigPatches.omni.sidero.dev
+    id: 200-cluster-my-first-cluster-patches/my-cluster-patch.yaml
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+    annotations:
+        name: patches/my-cluster-patch.yaml
+spec:
+    data: |
+        machine:
+          network:
+            kubespan:
+              enabled: true
+---
+metadata:
+    namespace: default
+    type: ConfigPatches.omni.sidero.dev
+    id: 201-cluster-my-first-cluster-../testdata/patches/my-registry-mirrors.yaml
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+    annotations:
+        name: ../testdata/patches/my-registry-mirrors.yaml
+spec:
+    data: |
+        machine:
+          registries:
+            mirrors:
+              ghcr.io:
+                endpoints:
+                  - https://ghcr.io
+                  - https://ghcr.mirror.com
+---
+metadata:
+    namespace: default
+    type: MachineSets.omni.sidero.dev
+    id: my-first-cluster-control-planes
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/role-controlplane:
+spec:
+    updatestrategy: 1
+    machineclass: null
+    bootstrapspec: null
+    deletestrategy: 0
+    updatestrategyconfig: null
+    deletestrategyconfig: null
+---
+metadata:
+    namespace: default
+    type: MachineSetNodes.omni.sidero.dev
+    id: 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/machine-set: my-first-cluster-control-planes
+        omni.sidero.dev/role-controlplane:
+spec: {}
+---
+metadata:
+    namespace: default
+    type: ConfigPatches.omni.sidero.dev
+    id: 400-my-first-cluster-control-planes-kubespan-enabled
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/machine-set: my-first-cluster-control-planes
+    annotations:
+        name: kubespan-enabled
+spec:
+    data: |
+        machine:
+            network:
+                kubespan:
+                    enabled: false
+---
+metadata:
+    namespace: default
+    type: MachineSets.omni.sidero.dev
+    id: my-first-cluster-workers
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/role-worker:
+spec:
+    updatestrategy: 1
+    machineclass: null
+    bootstrapspec: null
+    deletestrategy: 0
+    updatestrategyconfig: null
+    deletestrategyconfig: null
+---
+metadata:
+    namespace: default
+    type: MachineSetNodes.omni.sidero.dev
+    id: 430d882a-51a8-48b3-ab00-d4b5b0b5b0b0
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/machine-set: my-first-cluster-workers
+        omni.sidero.dev/role-worker:
+spec: {}
+---
+metadata:
+    namespace: default
+    type: ConfigPatches.omni.sidero.dev
+    id: 000-cm-430d882a-51a8-48b3-ae00-90c5b0b5b0b0-install-disk
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/cluster-machine: 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+        omni.sidero.dev/system-patch:
+    annotations:
+        name: install-disk
+spec:
+    data: |
+        machine:
+            install:
+                disk: /dev/vdb
+---
+metadata:
+    namespace: default
+    type: ConfigPatches.omni.sidero.dev
+    id: 400-cm-430d882a-51a8-48b3-ae00-90c5b0b5b0b0-my-address
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/cluster-machine: 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+    annotations:
+        name: my-address
+spec:
+    data: |
+        machine:
+            network:
+                interfaces:
+                    - addresses:
+                        - 192.168.0.2/24
+                      interface: eth0
+                      routes:
+                        - gateway: 192.168.0.1
diff --git a/client/pkg/template/testdata/cluster2.yaml b/client/pkg/template/testdata/cluster2.yaml
new file mode 100644
index 000000000..1d935a287
--- /dev/null
+++ b/client/pkg/template/testdata/cluster2.yaml
@@ -0,0 +1,41 @@
+kind: Cluster
+name: my-first-cluster
+kubernetes:
+  version: v1.18.2
+talos:
+  version: v1.3.1
+features:
+  enableWorkloadProxy: true
+patches:
+  - file: patches/my-cluster-patch.yaml
+  - file: ../testdata/patches/my-registry-mirrors.yaml
+---
+kind: ControlPlane
+machines:
+  - 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+patches:
+  - name: kubespan-enabled  # weight is implied (000-999)
+    inline:
+      machine:
+        network:
+          kubespan:
+            enabled: false
+---
+kind: Workers
+machines:
+  - 430d882a-51a8-48b3-ab00-d4b5b0b5b0b0
+---
+kind: Machine
+name: 430d882a-51a8-48b3-ae00-90c5b0b5b0b0
+install:
+  disk: /dev/vdb
+patches: # ClusterMachine ConfigPatch
+  - name: my-address
+    inline:
+      machine:
+        network:
+          interfaces:
+           - interface: eth0
+             addresses: [192.168.0.2/24]
+             routes:
+               - gateway: "192.168.0.1"
diff --git a/client/pkg/template/testdata/cluster3-resources.yaml b/client/pkg/template/testdata/cluster3-resources.yaml
new file mode 100644
index 000000000..102e57ebc
--- /dev/null
+++ b/client/pkg/template/testdata/cluster3-resources.yaml
@@ -0,0 +1,249 @@
+metadata:
+    namespace: default
+    type: Clusters.omni.sidero.dev
+    id: my-first-cluster
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    annotations:
+        omni.sidero.dev/managed-by-cluster-templates:
+spec:
+    installimage: ""
+    kubernetesversion: 1.18.2
+    talosversion: 1.3.1
+    features:
+        enableworkloadproxy: false
+        diskencryption: false
+    backupconfiguration: null
+---
+metadata:
+    namespace: default
+    type: MachineSets.omni.sidero.dev
+    id: my-first-cluster-control-planes
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/role-controlplane:
+spec:
+    updatestrategy: 1
+    machineclass: null
+    bootstrapspec: null
+    deletestrategy: 0
+    updatestrategyconfig: null
+    deletestrategyconfig: null
+---
+metadata:
+    namespace: default
+    type: MachineSetNodes.omni.sidero.dev
+    id: 4b9797ae-55d7-4717-a19e-b322a2d83d39
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/machine-set: my-first-cluster-control-planes
+        omni.sidero.dev/role-controlplane:
+spec: {}
+---
+metadata:
+    namespace: default
+    type: MachineSets.omni.sidero.dev
+    id: my-first-cluster-workers
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/role-worker:
+spec:
+    updatestrategy: 1
+    machineclass: null
+    bootstrapspec: null
+    deletestrategy: 0
+    updatestrategyconfig: null
+    deletestrategyconfig: null
+---
+metadata:
+    namespace: default
+    type: MachineSetNodes.omni.sidero.dev
+    id: 947f7a99-0f46-4a9e-ab02-205f4e1b7009
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/machine-set: my-first-cluster-workers
+        omni.sidero.dev/role-worker:
+spec: {}
+---
+metadata:
+    namespace: default
+    type: MachineSets.omni.sidero.dev
+    id: my-first-cluster-additional-1
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/role-worker:
+spec:
+    updatestrategy: 1
+    machineclass: null
+    bootstrapspec: null
+    deletestrategy: 1
+    updatestrategyconfig:
+        rolling:
+            maxparallelism: 3
+    deletestrategyconfig:
+        rolling:
+            maxparallelism: 5
+---
+metadata:
+    namespace: default
+    type: MachineSetNodes.omni.sidero.dev
+    id: b1ed45d8-4e79-4a07-a29a-b1b075843d41
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/machine-set: my-first-cluster-additional-1
+        omni.sidero.dev/role-worker:
+spec: {}
+---
+metadata:
+    namespace: default
+    type: MachineSetNodes.omni.sidero.dev
+    id: 7d75e61c-ebc8-4faa-a763-6e2b14714720
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/machine-set: my-first-cluster-additional-1
+        omni.sidero.dev/role-worker:
+spec: {}
+---
+metadata:
+    namespace: default
+    type: ConfigPatches.omni.sidero.dev
+    id: 400-my-first-cluster-additional-1-my-address
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/machine-set: my-first-cluster-additional-1
+    annotations:
+        name: my-address
+spec:
+    data: |
+        machine:
+            network:
+                interfaces:
+                    - addresses:
+                        - 192.168.0.2/24
+                      interface: eth0
+                      routes:
+                        - gateway: 192.168.0.1
+---
+metadata:
+    namespace: default
+    type: MachineSets.omni.sidero.dev
+    id: my-first-cluster-additional-2
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/role-worker:
+spec:
+    updatestrategy: 0
+    machineclass: null
+    bootstrapspec: null
+    deletestrategy: 0
+    updatestrategyconfig: null
+    deletestrategyconfig: null
+---
+metadata:
+    namespace: default
+    type: MachineSetNodes.omni.sidero.dev
+    id: 919b1d5b-daf8-4b82-bc0d-48929f05a405
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/machine-set: my-first-cluster-additional-2
+        omni.sidero.dev/role-worker:
+spec: {}
+---
+metadata:
+    namespace: default
+    type: MachineSets.omni.sidero.dev
+    id: my-first-cluster-additional-3
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/role-worker:
+spec:
+    updatestrategy: 1
+    machineclass:
+        name: test
+        machinecount: 1
+        allocationtype: 0
+    bootstrapspec: null
+    deletestrategy: 0
+    updatestrategyconfig: null
+    deletestrategyconfig: null
+---
+metadata:
+    namespace: default
+    type: MachineSets.omni.sidero.dev
+    id: my-first-cluster-additional-4
+    version: undefined
+    owner:
+    phase: running
+    created: 0001-01-01T00:00:00Z
+    updated: 0001-01-01T00:00:00Z
+    labels:
+        omni.sidero.dev/cluster: my-first-cluster
+        omni.sidero.dev/role-worker:
+spec:
+    updatestrategy: 1
+    machineclass:
+        name: test
+        machinecount: 0
+        allocationtype: 1
+    bootstrapspec: null
+    deletestrategy: 0
+    updatestrategyconfig: null
+    deletestrategyconfig: null
diff --git a/client/pkg/template/testdata/cluster3.yaml b/client/pkg/template/testdata/cluster3.yaml
new file mode 100644
index 000000000..8278be40a
--- /dev/null
+++ b/client/pkg/template/testdata/cluster3.yaml
@@ -0,0 +1,79 @@
+kind: Cluster
+name: my-first-cluster
+kubernetes:
+  version: v1.18.2
+talos:
+  version: v1.3.1
+
+# control plane
+---
+kind: Machine
+name: 4b9797ae-55d7-4717-a19e-b322a2d83d39
+---
+kind: ControlPlane
+machines:
+  - 4b9797ae-55d7-4717-a19e-b322a2d83d39
+
+# default workers
+---
+kind: Machine
+name: 947f7a99-0f46-4a9e-ab02-205f4e1b7009
+---
+kind: Workers
+machines:
+  - 947f7a99-0f46-4a9e-ab02-205f4e1b7009
+
+# additional workers 1
+---
+kind: Machine
+name: b1ed45d8-4e79-4a07-a29a-b1b075843d41
+---
+kind: Machine
+name: 7d75e61c-ebc8-4faa-a763-6e2b14714720
+---
+kind: Workers
+name: additional-1
+machines:
+  - b1ed45d8-4e79-4a07-a29a-b1b075843d41
+  - 7d75e61c-ebc8-4faa-a763-6e2b14714720
+updateStrategy:
+  rolling:
+    maxParallelism: 3
+deleteStrategy:
+  type: Rolling
+  rolling:
+    maxParallelism: 5
+patches: # ClusterMachine ConfigPatch
+  - name: my-address
+    inline:
+      machine:
+        network:
+          interfaces:
+            - interface: eth0
+              addresses: [192.168.0.2/24]
+              routes:
+                - gateway: "192.168.0.1"
+
+# additional workers 2
+---
+kind: Machine
+name: 919b1d5b-daf8-4b82-bc0d-48929f05a405
+---
+kind: Workers
+name: additional-2
+updateStrategy:
+  type: Unset
+machines:
+  - 919b1d5b-daf8-4b82-bc0d-48929f05a405
+---
+kind: Workers
+name: additional-3
+machineClass:
+  name: test
+  size: 1
+---
+kind: Workers
+name: additional-4
+machineClass:
+  name: test
+  size: unlimited
diff --git a/client/pkg/template/testdata/patches/invalid.yaml b/client/pkg/template/testdata/patches/invalid.yaml
new file mode 100644
index 000000000..ba23b4d7c
--- /dev/null
+++ b/client/pkg/template/testdata/patches/invalid.yaml
@@ -0,0 +1,2 @@
+spaceship:
+  deployed: true
diff --git a/client/pkg/template/testdata/patches/my-cluster-patch.yaml b/client/pkg/template/testdata/patches/my-cluster-patch.yaml
new file mode 100644
index 000000000..a86dd4013
--- /dev/null
+++ b/client/pkg/template/testdata/patches/my-cluster-patch.yaml
@@ -0,0 +1,4 @@
+machine:
+  network:
+    kubespan:
+      enabled: true
diff --git a/client/pkg/template/testdata/patches/my-cp-patch.yaml b/client/pkg/template/testdata/patches/my-cp-patch.yaml
new file mode 100644
index 000000000..9ad8a85b1
--- /dev/null
+++ b/client/pkg/template/testdata/patches/my-cp-patch.yaml
@@ -0,0 +1,5 @@
+cluster:
+  apiServer:
+    extraArgs:
+      cloud-provider: external
+      cloud-config: /etc/kubernetes/cloud-config.yaml
diff --git a/client/pkg/template/testdata/patches/my-registry-mirrors.yaml b/client/pkg/template/testdata/patches/my-registry-mirrors.yaml
new file mode 100644
index 000000000..deff5dc97
--- /dev/null
+++ b/client/pkg/template/testdata/patches/my-registry-mirrors.yaml
@@ -0,0 +1,7 @@
+machine:
+  registries:
+    mirrors:
+      ghcr.io:
+        endpoints:
+          - https://ghcr.io
+          - https://ghcr.mirror.com
diff --git a/client/pkg/template/testdata/patches/prohibited.yaml b/client/pkg/template/testdata/patches/prohibited.yaml
new file mode 100644
index 000000000..779884932
--- /dev/null
+++ b/client/pkg/template/testdata/patches/prohibited.yaml
@@ -0,0 +1,2 @@
+machine:
+  token: haha
diff --git a/client/pkg/version/version.go b/client/pkg/version/version.go
new file mode 100644
index 000000000..11d6db704
--- /dev/null
+++ b/client/pkg/version/version.go
@@ -0,0 +1,32 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// Package version provides version information.
+package version
+
+import (
+	"fmt"
+)
+
+var (
+	// Upstream omnictl build copies these values from the parent project.
+
+	// Name is set at build time.
+	Name string
+	// Tag is set at build time.
+	Tag string
+	// SHA should be set to the build hash.
+	SHA string
+
+	// API is the supported backend API version.
+	API uint32
+
+	// SuppressVersionWarning disable logs that warn library users that the pkg is built without version set.
+	SuppressVersionWarning bool
+)
+
+// String returns the textual representation of the version.
+func String() string {
+	return fmt.Sprintf("%s (API Version: %d)", Tag, API)
+}
diff --git a/cmd/omni-integration-test/main.go b/cmd/omni-integration-test/main.go
new file mode 100644
index 000000000..d5d7d00e9
--- /dev/null
+++ b/cmd/omni-integration-test/main.go
@@ -0,0 +1,15 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package main provides the entrypoint for the omni-integration-test binary.
+package main
+
+import "os"
+
+func main() {
+	if err := rootCmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}
diff --git a/cmd/omni-integration-test/pkg/clientconfig/clientconfig.go b/cmd/omni-integration-test/pkg/clientconfig/clientconfig.go
new file mode 100644
index 000000000..b8bd4a103
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/clientconfig/clientconfig.go
@@ -0,0 +1,199 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package clientconfig holds the configuration for the test client for Omni API.
+package clientconfig
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/adrg/xdg"
+	"github.com/hashicorp/go-multierror"
+	"github.com/siderolabs/gen/containers"
+	authpb "github.com/siderolabs/go-api-signature/api/auth"
+	authcli "github.com/siderolabs/go-api-signature/pkg/client/auth"
+	"github.com/siderolabs/go-api-signature/pkg/client/interceptor"
+	"github.com/siderolabs/go-api-signature/pkg/message"
+	"github.com/siderolabs/go-api-signature/pkg/pgp"
+	"google.golang.org/grpc"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+)
+
+const (
+	defaultEmail = "test-user@siderolabs.com"
+)
+
+type clientCacheKey struct {
+	role         string
+	email        string
+	skipUserRole bool
+}
+
+type clientOrError struct {
+	client *client.Client
+	err    error
+}
+
+var clientCache = containers.ConcurrentMap[clientCacheKey, clientOrError]{}
+
+// ClientConfig is a test client.
+type ClientConfig struct {
+	endpoint string
+}
+
+// New creates a new test client config.
+func New(endpoint string) *ClientConfig {
+	return &ClientConfig{
+		endpoint: endpoint,
+	}
+}
+
+// GetClient returns a test client for the default test email.
+//
+// Clients are cached by their configuration, so if a client with the
+// given configuration was created before, the cached one will be returned.
+func (t *ClientConfig) GetClient(ctx context.Context, publicKeyOpts ...authcli.RegisterPGPPublicKeyOption) (*client.Client, error) {
+	return t.GetClientForEmail(ctx, defaultEmail, publicKeyOpts...)
+}
+
+// GetClientForEmail returns a test client for the given email.
+//
+// Clients are cached by their configuration, so if a client with the
+// given configuration was created before, the cached one will be returned.
+func (t *ClientConfig) GetClientForEmail(ctx context.Context, email string, publicKeyOpts ...authcli.RegisterPGPPublicKeyOption) (*client.Client, error) {
+	cacheKey := t.buildCacheKey(email, publicKeyOpts)
+
+	cliOrErr, _ := clientCache.GetOrCall(cacheKey, func() clientOrError {
+		signatureInterceptor := buildSignatureInterceptor(email, publicKeyOpts...)
+
+		cli, err := client.New(ctx, t.endpoint,
+			client.WithGrpcOpts(
+				grpc.WithUnaryInterceptor(signatureInterceptor.Unary()),
+				grpc.WithStreamInterceptor(signatureInterceptor.Stream()),
+			),
+		)
+
+		return clientOrError{
+			client: cli,
+			err:    err,
+		}
+	})
+
+	return cliOrErr.client, cliOrErr.err
+}
+
+// Close closes all the clients created by this config.
+func (t *ClientConfig) Close() error {
+	var multiErr error
+
+	clientCache.ForEach(func(_ clientCacheKey, cliOrErr clientOrError) {
+		if cliOrErr.client != nil {
+			if err := cliOrErr.client.Close(); err != nil {
+				multiErr = multierror.Append(multiErr, err)
+			}
+		}
+	})
+
+	return multiErr
+}
+
+func (t *ClientConfig) buildCacheKey(email string, publicKeyOpts []authcli.RegisterPGPPublicKeyOption) clientCacheKey {
+	var req authpb.RegisterPublicKeyRequest
+
+	for _, o := range publicKeyOpts {
+		o(&req)
+	}
+
+	return clientCacheKey{
+		role:         req.Role,
+		email:        email,
+		skipUserRole: req.SkipUserRole,
+	}
+}
+
+// SignHTTPRequest signs the regular HTTP request using the default test email.
+func SignHTTPRequest(ctx context.Context, client *client.Client, req *http.Request) error {
+	return SignHTTPRequestWithEmail(ctx, client, req, defaultEmail)
+}
+
+// SignHTTPRequestWithEmail signs the regular HTTP request using the given email.
+func SignHTTPRequestWithEmail(ctx context.Context, client *client.Client, req *http.Request, email string) error {
+	newKey, err := pgp.GenerateKey("", "", email, 4*time.Hour)
+	if err != nil {
+		return err
+	}
+
+	err = registerKey(ctx, client.Auth(), newKey, email)
+	if err != nil {
+		return err
+	}
+
+	msg, err := message.NewHTTP(req)
+	if err != nil {
+		return err
+	}
+
+	return msg.Sign(email, newKey)
+}
+
+// TalosAPIKeyPrepare prepares a public key to be used with tests interacting via Talos API client using the default test email.
+func TalosAPIKeyPrepare(ctx context.Context, client *client.Client, contextName string) error {
+	return TalosAPIKeyPrepareWithEmail(ctx, client, contextName, defaultEmail)
+}
+
+// TalosAPIKeyPrepareWithEmail prepares a public key to be used with tests interacting via Talos API client using the given email.
+func TalosAPIKeyPrepareWithEmail(ctx context.Context, client *client.Client, contextName, email string) error {
+	newKey, err := pgp.GenerateKey("", "", email, 4*time.Hour)
+	if err != nil {
+		return err
+	}
+
+	err = registerKey(ctx, client.Auth(), newKey, email)
+	if err != nil {
+		return err
+	}
+
+	path, err := xdg.DataFile(filepath.Join("talos", "keys", fmt.Sprintf("%s-%s.pgp", contextName, email)))
+	if err != nil {
+		return err
+	}
+
+	keyArmored, err := newKey.Armor()
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(path, []byte(keyArmored), 0o600)
+}
+
+func buildSignatureInterceptor(email string, publicKeyOpts ...authcli.RegisterPGPPublicKeyOption) *interceptor.Interceptor {
+	userKeyFunc := func(ctx context.Context, cc *grpc.ClientConn, _ *interceptor.Options) (message.Signer, error) {
+		newKey, err := pgp.GenerateKey("", "", email, 4*time.Hour)
+		if err != nil {
+			return nil, err
+		}
+
+		authCli := authcli.NewClient(cc)
+
+		err = registerKey(ctx, authCli, newKey, email, publicKeyOpts...)
+		if err != nil {
+			return nil, err
+		}
+
+		return newKey, nil
+	}
+
+	return interceptor.New(interceptor.Options{
+		GetUserKeyFunc:   userKeyFunc,
+		RenewUserKeyFunc: userKeyFunc,
+		Identity:         email,
+	})
+}
diff --git a/cmd/omni-integration-test/pkg/clientconfig/register_key_debug.go b/cmd/omni-integration-test/pkg/clientconfig/register_key_debug.go
new file mode 100644
index 000000000..d13e66c89
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/clientconfig/register_key_debug.go
@@ -0,0 +1,43 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//go:build sidero.debug
+
+package clientconfig
+
+import (
+	"context"
+	"time"
+
+	"github.com/siderolabs/go-api-signature/pkg/client/auth"
+	"github.com/siderolabs/go-api-signature/pkg/pgp"
+	"google.golang.org/grpc/metadata"
+
+	grpcomni "github.com/siderolabs/omni/internal/backend/grpc"
+)
+
+func registerKey(ctx context.Context, cli *auth.Client, key *pgp.Key, email string, opts ...auth.RegisterPGPPublicKeyOption) error {
+	armoredPublicKey, err := key.ArmorPublic()
+	if err != nil {
+		return err
+	}
+
+	_, err = cli.RegisterPGPPublicKey(ctx, email, []byte(armoredPublicKey), opts...)
+	if err != nil {
+		return err
+	}
+
+	debugCtx := metadata.AppendToOutgoingContext(ctx, grpcomni.DebugVerifiedEmailHeaderKey, email)
+
+	err = cli.ConfirmPublicKey(debugCtx, key.Fingerprint())
+	if err != nil {
+		return err
+	}
+
+	timeoutCtx, timeoutCtxCancel := context.WithTimeout(ctx, 10*time.Second)
+	defer timeoutCtxCancel()
+
+	return cli.AwaitPublicKeyConfirmation(timeoutCtx, key.Fingerprint())
+}
diff --git a/cmd/omni-integration-test/pkg/clientconfig/register_key_no_debug.go b/cmd/omni-integration-test/pkg/clientconfig/register_key_no_debug.go
new file mode 100644
index 000000000..ed73a0522
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/clientconfig/register_key_no_debug.go
@@ -0,0 +1,20 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//go:build !sidero.debug
+
+package clientconfig
+
+import (
+	"context"
+	"errors"
+
+	"github.com/siderolabs/go-api-signature/pkg/client/auth"
+	"github.com/siderolabs/go-api-signature/pkg/pgp"
+)
+
+func registerKey(context.Context, *auth.Client, *pgp.Key, string, ...auth.RegisterPGPPublicKeyOption) error {
+	return errors.New("registerKey is not implemented in non-debug builds")
+}
diff --git a/cmd/omni-integration-test/pkg/tests/auth.go b/cmd/omni-integration-test/pkg/tests/auth.go
new file mode 100644
index 000000000..b3979701c
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/auth.go
@@ -0,0 +1,1244 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"runtime"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	pgpcrypto "github.com/ProtonMail/gopenpgp/v2/crypto"
+	"github.com/cosi-project/runtime/pkg/controller/generic"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/google/uuid"
+	"github.com/siderolabs/gen/maps"
+	"github.com/siderolabs/gen/xslices"
+	authcli "github.com/siderolabs/go-api-signature/pkg/client/auth"
+	"github.com/siderolabs/go-api-signature/pkg/client/interceptor"
+	"github.com/siderolabs/go-api-signature/pkg/pgp"
+	"github.com/siderolabs/go-api-signature/pkg/serviceaccount"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap/zapcore"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
+
+	"github.com/siderolabs/omni/client/api/omni/management"
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	pkgaccess "github.com/siderolabs/omni/client/pkg/access"
+	"github.com/siderolabs/omni/client/pkg/client"
+	managementcli "github.com/siderolabs/omni/client/pkg/client/management"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	authres "github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/k8s"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/oidc"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/registry"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/virtual"
+	"github.com/siderolabs/omni/cmd/omni-integration-test/pkg/clientconfig"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/validated"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/grpcutil"
+)
+
+// AssertAnonymousAuthenication tests the authentication without any credentials.
+func AssertAnonymousAuthenication(testCtx context.Context, client *client.Client) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 300*time.Second)
+		defer cancel()
+
+		ctx = context.WithValue(ctx, interceptor.SkipInterceptorContextKey{}, struct{}{})
+
+		_, err := client.Omni().State().List(ctx, resource.NewMetadata(resources.DefaultNamespace, omni.ClusterType, "", resource.VersionUndefined))
+		assert.Error(t, err)
+
+		assert.Equal(t, codes.Unauthenticated, status.Code(err))
+	}
+}
+
+// AssertAPIInvalidSignature tests the authentication with invalid credentials.
+func AssertAPIInvalidSignature(testCtx context.Context, client *client.Client) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 300*time.Second)
+		defer cancel()
+
+		ctx = context.WithValue(ctx, interceptor.SkipInterceptorContextKey{}, struct{}{})
+
+		ctx = metadata.AppendToOutgoingContext(ctx, "x-sidero-signature", "invalid")
+
+		_, err := client.Omni().State().List(ctx, resource.NewMetadata(resources.DefaultNamespace, omni.ClusterType, "", resource.VersionUndefined))
+		assert.Error(t, err)
+
+		assert.Equal(t, codes.Unauthenticated, status.Code(err))
+	}
+}
+
+// AssertPublicKeyWithoutLifetimeNotRegistered tests the registration of a public key without a lifetime.
+func AssertPublicKeyWithoutLifetimeNotRegistered(testCtx context.Context, cli *client.Client) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 10*time.Second)
+		defer cancel()
+
+		ctx = context.WithValue(ctx, interceptor.SkipInterceptorContextKey{}, struct{}{})
+
+		email := "test-user-invalid@siderolabs.com"
+
+		key, err := pgpcrypto.GenerateKey("", email, "x25519", 0)
+		require.NoError(t, err)
+
+		armored, err := key.GetArmoredPublicKey()
+		require.NoError(t, err)
+
+		_, err = cli.Auth().RegisterPGPPublicKey(ctx, email, []byte(armored))
+		assert.ErrorContains(t, err, "key does not contain a valid key lifetime")
+	}
+}
+
+// AssertPublicKeyWithLongLifetimeNotRegistered tests the registration of a public key
+// with a longer than maximum allowed lifetime.
+func AssertPublicKeyWithLongLifetimeNotRegistered(testCtx context.Context, cli *client.Client) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 10*time.Second)
+		defer cancel()
+
+		ctx = context.WithValue(ctx, interceptor.SkipInterceptorContextKey{}, struct{}{})
+
+		email := "test-user-invalid@siderolabs.com"
+
+		key, err := pgp.GenerateKey("", "", email, 9*time.Hour)
+		require.NoError(t, err)
+
+		armored, err := key.ArmorPublic()
+		require.NoError(t, err)
+
+		_, err = cli.Auth().RegisterPGPPublicKey(ctx, email, []byte(armored))
+		assert.ErrorContains(t, err, "key lifetime is too long")
+	}
+}
+
+// AssertRegisterPublicKeyWithUnknownEmail tests the registration of a public key with an unknown email.
+// It should not fail explicitly to avoid leaking information about registered emails.
+func AssertRegisterPublicKeyWithUnknownEmail(testCtx context.Context, cli *client.Client) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 10*time.Second)
+		defer cancel()
+
+		ctx = context.WithValue(ctx, interceptor.SkipInterceptorContextKey{}, struct{}{})
+
+		email := "test-user-unknown@siderolabs.com"
+
+		key, err := pgp.GenerateKey("", "", email, 4*time.Hour)
+		require.NoError(t, err)
+
+		armored, err := key.ArmorPublic()
+		require.NoError(t, err)
+
+		_, err = cli.Auth().RegisterPGPPublicKey(ctx, email, []byte(armored))
+
+		// an explicit error must not be returned to avoid leaking information
+		assert.NoError(t, err)
+	}
+}
+
+// AssertServiceAccountAPIFlow tests the service account lifecycle and API calls using it.
+func AssertServiceAccountAPIFlow(testCtx context.Context, cli *client.Client) TestFunc {
+	return func(t *testing.T) {
+		name := fmt.Sprintf("test-%d", time.Now().UnixMilli())
+
+		saCli, armoredPublicKey, err := newServiceAccountClient(testCtx, cli, name)
+		require.NoError(t, err)
+
+		defer saCli.Close() //nolint:errcheck
+
+		// create service account with the generated key
+		_, err = cli.Management().CreateServiceAccount(testCtx, armoredPublicKey, string(role.None), true)
+		assert.NoError(t, err)
+
+		// make an API call using the registered service account
+		_, err = saCli.Omni().State().List(testCtx, resource.NewMetadata(resources.DefaultNamespace, omni.ClusterType, "", resource.VersionUndefined))
+		assert.NoError(t, err)
+
+		// renew service account
+		renewedSACli, renewedArmoredPublicKey, err := newServiceAccountClient(testCtx, cli, name)
+		require.NoError(t, err)
+
+		defer renewedSACli.Close() //nolint:errcheck
+
+		_, err = cli.Management().RenewServiceAccount(testCtx, name, renewedArmoredPublicKey)
+		assert.NoError(t, err)
+
+		// make an API call using the renewed service account
+		_, err = renewedSACli.Omni().State().List(testCtx, resource.NewMetadata(resources.DefaultNamespace, omni.ClusterType, "", resource.VersionUndefined))
+		assert.NoError(t, err)
+
+		// list service accounts and ensure that the created service account is present
+		saList, err := cli.Management().ListServiceAccounts(testCtx)
+		assert.NoError(t, err)
+
+		filtered := xslices.Filter(saList, func(sa *management.ListServiceAccountsResponse_ServiceAccount) bool {
+			return sa.Name == name
+		})
+
+		assert.Len(t, filtered, 1, "service account not found")
+
+		// assert service account properties
+		foundSA := filtered[0]
+
+		// expect 2 keys: 1 from the creation and 1 from renewal
+		require.Len(t, foundSA.PgpPublicKeys, 2, "unexpected number of PGP public keys")
+
+		assertTime := func(t *testing.T, expected, actual time.Time, allowedSkew time.Duration) bool {
+			return assert.True(t, actual.After(expected.Add(-allowedSkew)) && actual.Before(expected.Add(allowedSkew)))
+		}
+
+		for _, pgpPublicKey := range foundSA.PgpPublicKeys {
+			assertTime(t, pgpPublicKey.Expiration.AsTime(), time.Now().Add(auth.ServiceAccountMaxAllowedLifetime), 1*time.Minute)
+		}
+
+		assert.Equal(t, string(role.Admin), foundSA.Role)
+
+		// destroy service account
+		err = cli.Management().DestroyServiceAccount(testCtx, name)
+		assert.NoError(t, err)
+
+		// list service accounts and ensure that the deleted service account is no more present
+		saList, err = cli.Management().ListServiceAccounts(testCtx)
+		assert.NoError(t, err)
+
+		assert.False(t, slices.ContainsFunc(saList, func(sa *management.ListServiceAccountsResponse_ServiceAccount) bool {
+			return sa.Name == name
+		}))
+	}
+}
+
+func newServiceAccountClient(testCtx context.Context, cli *client.Client, name string) (*client.Client, string, error) {
+	// generate a new PGP key with long lifetime
+	comment := fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)
+
+	serviceAccountEmail := name + pkgaccess.ServiceAccountNameSuffix
+
+	key, err := pgp.GenerateKey(name, comment, serviceAccountEmail, auth.ServiceAccountMaxAllowedLifetime)
+	if err != nil {
+		return nil, "", err
+	}
+
+	armoredPublicKey, err := key.ArmorPublic()
+	if err != nil {
+		return nil, "", err
+	}
+
+	encodedServiceAccount, err := serviceaccount.Encode(name, key)
+	if err != nil {
+		return nil, "", err
+	}
+
+	interceptors := interceptor.New(interceptor.Options{
+		ClientName:           "omni-test",
+		ServiceAccountBase64: encodedServiceAccount,
+	})
+
+	// create a new API client with the service account PGP signing interceptors
+	saCli, err := client.New(
+		testCtx,
+		cli.Endpoint(),
+		client.WithGrpcOpts(
+			grpc.WithUnaryInterceptor(interceptors.Unary()),
+			grpc.WithStreamInterceptor(interceptors.Stream()),
+		),
+	)
+	if err != nil {
+		return nil, "", err
+	}
+
+	return saCli, armoredPublicKey, nil
+}
+
+type apiAuthzTestCase struct {
+	namePrefix    string
+	fn            func(context.Context, *client.Client) error
+	assertSuccess func(*testing.T, error)
+	assertFailure func(*testing.T, error)
+	requiredRole  role.Role
+	isPublic      bool
+}
+
+// AssertAPIAuthz tests the authorization checks of the API endpoints.
+//
+//nolint:gocognit,gocyclo,cyclop,maintidx
+func AssertAPIAuthz(rootCtx context.Context, rootCli *client.Client, clientConfig *clientconfig.ClientConfig, clusterName string) TestFunc {
+	rootCtx = metadata.NewOutgoingContext(rootCtx, metadata.Pairs(grpcutil.LogLevelOverrideMetadataKey, zapcore.PanicLevel.String()))
+
+	assertSuccess := func(t *testing.T, err error) {
+		expectedConditions := err == nil ||
+			state.IsNotFoundError(err) ||
+			state.IsConflictError(err) ||
+			validated.IsValidationError(err)
+
+		assert.Truef(t, expectedConditions, "unexpected error: %v", err)
+	}
+
+	assertMissingRoleFailure := func(t *testing.T, err error) {
+		correctErrorType := status.Code(err) == codes.PermissionDenied || state.IsOwnerConflictError(err)
+
+		assert.Truef(t, correctErrorType, "unexpected error: %v", err)
+		assert.ErrorContainsf(t, err, "insufficient role", "unexpected error: %v", err)
+	}
+
+	return func(t *testing.T) {
+		testCases := []apiAuthzTestCase{
+			// Management API tests - global
+			{
+				namePrefix:    "mgmt-talosconfig",
+				requiredRole:  role.Reader,
+				assertSuccess: assertSuccess,
+				assertFailure: assertMissingRoleFailure,
+				fn: func(ctx context.Context, cli *client.Client) error {
+					_, err := cli.Management().Talosconfig(ctx)
+
+					return err
+				},
+			},
+			{
+				namePrefix:    "mgmt-create-service-account",
+				requiredRole:  role.Admin,
+				assertSuccess: assertSuccess,
+				assertFailure: assertMissingRoleFailure,
+				fn: func(ctx context.Context, cli *client.Client) error {
+					_, err := cli.Management().CreateServiceAccount(ctx, "doesntmatter", string(role.None), true)
+
+					// ignore the armored pgp key parse error
+					if err != nil && strings.Contains(err.Error(), "no armored data found") {
+						return nil
+					}
+
+					return err
+				},
+			},
+			{
+				namePrefix:    "mgmt-renew-service-account",
+				requiredRole:  role.Admin,
+				assertSuccess: assertSuccess,
+				assertFailure: assertMissingRoleFailure,
+				fn: func(ctx context.Context, cli *client.Client) error {
+					_, err := cli.Management().RenewServiceAccount(ctx, "doesntmatter", "doesntmatter")
+
+					// ignore "identity not found" error
+					if err != nil && strings.Contains(err.Error(), "doesn't exist") {
+						return nil
+					}
+
+					return err
+				},
+			},
+			{
+				namePrefix:    "mgmt-list-service-accounts",
+				requiredRole:  role.Admin,
+				assertSuccess: assertSuccess,
+				assertFailure: assertMissingRoleFailure,
+				fn: func(ctx context.Context, cli *client.Client) error {
+					_, err := cli.Management().ListServiceAccounts(ctx)
+
+					return err
+				},
+			},
+			{
+				namePrefix:    "mgmt-destroy-service-account",
+				requiredRole:  role.Admin,
+				assertSuccess: assertSuccess,
+				assertFailure: assertMissingRoleFailure,
+				fn: func(ctx context.Context, cli *client.Client) error {
+					err := cli.Management().DestroyServiceAccount(ctx, "doesntmatter")
+
+					// ignore "service account not found" error
+					if status.Code(err) == codes.NotFound {
+						return nil
+					}
+
+					return err
+				},
+			},
+			{
+				namePrefix:    "mgmt-logs",
+				requiredRole:  role.Reader,
+				assertSuccess: assertSuccess,
+				assertFailure: assertMissingRoleFailure,
+				fn: func(ctx context.Context, cli *client.Client) error {
+					machineIDs := rtestutils.ResourceIDs[*omni.Machine](rootCtx, t, rootCli.Omni().State())
+
+					require.NotEmpty(t, machineIDs)
+
+					randomMachineID := machineIDs[0]
+
+					reader, err := cli.Management().LogsReader(ctx, randomMachineID, false, 0)
+					if err != nil {
+						return err
+					}
+
+					buffer := make([]byte, 1)
+					_, err = reader.Read(buffer)
+
+					if status.Code(err) != codes.NotFound && !errors.Is(err, io.EOF) {
+						return err
+					}
+
+					return nil
+				},
+			},
+			// Management API tests - cluster-specific
+			{
+				namePrefix:    "mgmt-cluster-kubeconfig-user",
+				requiredRole:  role.Reader,
+				assertSuccess: assertSuccess,
+				assertFailure: assertMissingRoleFailure,
+				fn: func(ctx context.Context, cli *client.Client) error {
+					_, err := cli.Management().WithCluster(clusterName).Kubeconfig(ctx)
+
+					return err
+				},
+			},
+			{
+				namePrefix:    "mgmt-cluster-kubeconfig-service-account",
+				requiredRole:  role.Operator,
+				assertSuccess: assertSuccess,
+				assertFailure: assertMissingRoleFailure,
+				fn: func(ctx context.Context, cli *client.Client) error {
+					_, err := cli.Management().WithCluster(clusterName).Kubeconfig(
+						ctx,
+						managementcli.WithServiceAccount(24*time.Hour, "authz-integration-test", constants.DefaultAccessGroup),
+					)
+
+					return err
+				},
+			},
+			{
+				namePrefix:    "mgmt-cluster-talosconfig",
+				requiredRole:  role.Reader,
+				assertSuccess: assertSuccess,
+				assertFailure: assertMissingRoleFailure,
+				fn: func(ctx context.Context, cli *client.Client) error {
+					_, err := cli.Management().WithCluster(clusterName).Talosconfig(ctx)
+
+					return err
+				},
+			},
+			{
+				namePrefix:    "talos-version",
+				requiredRole:  role.Reader,
+				assertSuccess: assertSuccess,
+				assertFailure: assertMissingRoleFailure,
+				fn: func(ctx context.Context, cli *client.Client) error {
+					_, err := cli.Talos().WithCluster(clusterName).Version(ctx, &emptypb.Empty{})
+
+					return err
+				},
+			},
+			{
+				namePrefix:    "talos-etcd-status",
+				requiredRole:  role.Operator,
+				assertSuccess: assertSuccess,
+				assertFailure: func(t *testing.T, err error) {
+					assert.Truef(t, status.Code(err) == codes.PermissionDenied, "unexpected error: %v", err)
+				},
+				fn: func(ctx context.Context, cli *client.Client) error {
+					_, err := cli.Talos().WithCluster(clusterName).EtcdStatus(ctx, &emptypb.Empty{})
+
+					return err
+				},
+			},
+			// OIDC API tests
+			{
+				namePrefix:    "oidc-authenticate",
+				requiredRole:  role.None,
+				assertSuccess: assertSuccess,
+				fn: func(ctx context.Context, cli *client.Client) error {
+					_, err := cli.OIDC().Authenticate(ctx, "test-token")
+
+					// silence the error on 'token not found'
+					if errStatus, ok := status.FromError(err); ok {
+						if errStatus.Code() == codes.PermissionDenied && errStatus.Message() == "failed to authenticate request: request not found" {
+							return nil
+						}
+					}
+
+					return err
+				},
+			},
+		}
+
+		for _, tc := range testCases {
+			// test each test case without signature
+			t.Run(fmt.Sprintf("%s-no-signature", tc.namePrefix), func(t *testing.T) {
+				scopedClient, testErr := clientConfig.GetClient(rootCtx)
+				require.NoError(t, testErr)
+
+				// skip signing the request
+				ctx := context.WithValue(rootCtx, interceptor.SkipInterceptorContextKey{}, struct{}{})
+
+				testErr = tc.fn(ctx, scopedClient)
+
+				// public resources will either succeed or fail with a permission denied if they are read-only resources
+				if tc.isPublic {
+					expectedCondition := testErr == nil || strings.Contains(testErr.Error(), "only read access is permitted")
+
+					assert.Truef(t, expectedCondition, "error did not meet condition: %v", testErr)
+
+					return
+				}
+
+				// protected resources must always fail with unauthenticated
+
+				expectedCondition := testErr != nil && strings.Contains(testErr.Error(), "Unauthenticated")
+
+				assert.Truef(t, expectedCondition, "error did not meet condition: %v", testErr)
+			})
+
+			// public resources are not subject to role restrictions
+			if tc.isPublic {
+				continue
+			}
+
+			// test with the role which should succeed
+			t.Run(fmt.Sprintf("%s-success", tc.namePrefix), func(t *testing.T) {
+				scopedClient, testErr := clientConfig.GetClient(
+					rootCtx,
+					authcli.WithRole(string(tc.requiredRole)),
+					authcli.WithSkipUserRole(true),
+				)
+				require.NoError(t, testErr)
+
+				assertCurrentUserRole(rootCtx, t, scopedClient.Omni().State(), tc.requiredRole)
+
+				testErr = tc.fn(rootCtx, scopedClient)
+
+				tc.assertSuccess(t, testErr)
+			})
+
+			if tc.assertFailure == nil || tc.requiredRole == role.None {
+				continue
+			}
+
+			// test with the role which should fail
+
+			var err error
+
+			// one less than the required role
+			failureRole, err := tc.requiredRole.Previous()
+			require.NoError(t, err)
+
+			t.Run(fmt.Sprintf("%s-failure", tc.namePrefix), func(t *testing.T) {
+				scopedClient, testErr := clientConfig.GetClient(
+					rootCtx,
+					authcli.WithRole(string(failureRole)),
+					authcli.WithSkipUserRole(true))
+				require.NoError(t, testErr)
+
+				assertCurrentUserRole(rootCtx, t, scopedClient.Omni().State(), failureRole)
+
+				testErr = tc.fn(rootCtx, scopedClient)
+
+				tc.assertFailure(t, testErr)
+			})
+		}
+	}
+}
+
+type resourceAuthzTestCase struct {
+	resource              resource.Resource
+	allowedVerbSet        map[state.Verb]struct{}
+	isAdminOnly           bool
+	isSignatureSufficient bool
+	isPublic              bool
+}
+
+// AssertResourceAuthz tests the authorization checks of the resources (state).
+//
+//nolint:gocognit,gocyclo,cyclop,maintidx
+func AssertResourceAuthz(rootCtx context.Context, rootCli *client.Client, clientConfig *clientconfig.ClientConfig) TestFunc {
+	return func(t *testing.T) {
+		rootCtx = metadata.NewOutgoingContext(rootCtx, metadata.Pairs(grpcutil.LogLevelOverrideMetadataKey, zapcore.PanicLevel.String()))
+
+		allRoles := []role.Role{role.None, role.Reader, role.Operator, role.Admin}
+		allVerbs := []state.Verb{state.Get, state.List, state.Create, state.Update, state.Destroy}
+
+		allVerbsSet := xslices.ToSet(allVerbs)
+		readOnlyVerbSet := xslices.ToSet([]state.Verb{state.Get, state.List})
+
+		// fully client-managed resources
+
+		identity := authres.NewIdentity(resources.DefaultNamespace, uuid.New().String())
+		accessPolicy := authres.NewAccessPolicy()
+		samlLabelRule := authres.NewSAMLLabelRule(resources.DefaultNamespace, uuid.New().String())
+		cluster := omni.NewCluster(resources.DefaultNamespace, uuid.New().String())
+		cluster.TypedSpec().Value.TalosVersion = "1.2.2"
+		configPatch := omni.NewConfigPatch(resources.DefaultNamespace, uuid.New().String())
+		machineLabels := omni.NewMachineLabels(resources.DefaultNamespace, uuid.New().String())
+		machineSet := omni.NewMachineSet(resources.DefaultNamespace, uuid.New().String())
+		machineSet.Metadata().Labels().Set(omni.LabelCluster, cluster.Metadata().ID())
+		machineSetNode := omni.NewMachineSetNode(resources.DefaultNamespace, uuid.New().String(), machineSet)
+		machineClass := omni.NewMachineClass(resources.DefaultNamespace, uuid.New().String())
+		schematicConfiguration := omni.NewSchematicConfiguration(resources.DefaultNamespace, uuid.New().String())
+		schematicConfiguration.TypedSpec().Value.Target = specs.SchematicConfigurationSpec_ClusterMachine
+
+		testCases := []resourceAuthzTestCase{
+			{
+				resource:       identity,
+				allowedVerbSet: allVerbsSet,
+				isAdminOnly:    true,
+			},
+			{
+				resource:       authres.NewUser(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: allVerbsSet,
+				isAdminOnly:    true,
+			},
+			{
+				resource:       accessPolicy,
+				allowedVerbSet: allVerbsSet,
+				isAdminOnly:    true,
+			},
+			{
+				resource:       samlLabelRule,
+				allowedVerbSet: allVerbsSet,
+				isAdminOnly:    true,
+			},
+			{
+				resource:       cluster,
+				allowedVerbSet: allVerbsSet,
+			},
+			{
+				resource:       configPatch,
+				allowedVerbSet: allVerbsSet,
+			},
+			{
+				resource:       machineLabels,
+				allowedVerbSet: allVerbsSet,
+			},
+			{
+				resource:       machineSet,
+				allowedVerbSet: allVerbsSet,
+			},
+			{
+				resource:       machineSetNode,
+				allowedVerbSet: allVerbsSet,
+			},
+			{
+				resource:       machineClass,
+				allowedVerbSet: allVerbsSet,
+			},
+			{
+				resource:       omni.NewEtcdManualBackup(uuid.New().String()),
+				allowedVerbSet: allVerbsSet,
+			},
+			{
+				resource:       omni.NewEtcdBackupS3Conf(),
+				allowedVerbSet: allVerbsSet,
+				isAdminOnly:    true,
+			},
+			{
+				resource:       schematicConfiguration,
+				allowedVerbSet: allVerbsSet,
+			},
+		}
+
+		// read-only resources
+
+		resourceDefinition, err := meta.NewResourceDefinition(meta.ResourceDefinitionSpec{
+			Type: "Tests.cosi.dev",
+		})
+		require.NoError(t, err)
+
+		testCases = append(testCases, []resourceAuthzTestCase{
+			{
+				resource:              resourceDefinition,
+				allowedVerbSet:        readOnlyVerbSet,
+				isSignatureSufficient: true,
+			},
+			{
+				resource:              meta.NewNamespace("test", meta.NamespaceSpec{}),
+				allowedVerbSet:        readOnlyVerbSet,
+				isSignatureSufficient: true,
+			},
+			{
+				resource:       omni.NewClusterBootstrapStatus(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewClusterDestroyStatus(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewClusterEndpoint(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewClusterMachineIdentity(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewClusterMachineStatus(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewClusterMachine(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewClusterMachineTemplate(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewClusterStatus(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewClusterUUID(uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewEtcdBackup(uuid.New().String(), time.Now()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewControlPlaneStatus(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewExposedService(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:              omni.NewFeaturesConfig(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet:        readOnlyVerbSet,
+				isSignatureSufficient: true,
+			},
+			{
+				resource:       omni.NewKubernetesStatus(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       virtual.NewKubernetesUsage(resources.MetricsNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewKubernetesUpgradeManifestStatus(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewKubernetesUpgradeStatus(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewLoadBalancerConfig(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewLoadBalancerStatus(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewMachine(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewMachineSetStatus(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewMachineStatus(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewMachineStatusLink(resources.MetricsNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewMachineStatusSnapshot(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewMachineConfigGenOptions(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:              omni.NewOngoingTask(resources.DefaultNamespace, "res"),
+				allowedVerbSet:        readOnlyVerbSet,
+				isSignatureSufficient: true,
+			},
+			{
+				resource:              omni.NewKubernetesVersion(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet:        readOnlyVerbSet,
+				isSignatureSufficient: true,
+			},
+			{
+				resource:              omni.NewTalosVersion(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet:        readOnlyVerbSet,
+				isSignatureSufficient: true,
+			},
+			{
+				resource:       omni.NewTalosUpgradeStatus(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:              omni.NewInstallationMedia(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet:        readOnlyVerbSet,
+				isSignatureSufficient: true,
+			},
+			{
+				resource:       omni.NewRedactedClusterMachineConfig(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewImagePullRequest(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewImagePullStatus(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       authres.NewAuthConfig(),
+				allowedVerbSet: readOnlyVerbSet,
+				isPublic:       true,
+			},
+			{
+				resource:       siderolink.NewConnectionParams(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:              system.NewSysVersion(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet:        readOnlyVerbSet,
+				isSignatureSufficient: true,
+			},
+			{
+				resource:              virtual.NewCurrentUser(),
+				allowedVerbSet:        readOnlyVerbSet,
+				isSignatureSufficient: true,
+			},
+			{
+				resource:              virtual.NewClusterPermissions(uuid.New().String()),
+				allowedVerbSet:        readOnlyVerbSet,
+				isSignatureSufficient: true,
+			},
+			{
+				resource:              virtual.NewPermissions(),
+				allowedVerbSet:        readOnlyVerbSet,
+				isSignatureSufficient: true,
+			},
+			{
+				resource:       omni.NewEtcdBackupStatus(uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewEtcdBackupOverallStatus(),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewMachineSetDestroyStatus(resources.EphemeralNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewEtcdBackupStoreStatus(),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:       omni.NewSchematic(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet: readOnlyVerbSet,
+			},
+			{
+				resource:              omni.NewTalosExtensions(resources.DefaultNamespace, uuid.New().String()),
+				allowedVerbSet:        readOnlyVerbSet,
+				isSignatureSufficient: true,
+			},
+		}...)
+
+		// no access resources
+		testCases = append(testCases, []resourceAuthzTestCase{
+			{
+				resource: omni.NewClusterConfigVersion(resources.DefaultNamespace, uuid.New().String()),
+			},
+			{
+				resource: oidc.NewJWTPublicKey(resources.DefaultNamespace, uuid.New().String()),
+			},
+			{
+				resource: system.NewDBVersion(resources.DefaultNamespace, uuid.New().String()),
+			},
+			{
+				resource: system.NewCertRefreshTick(resources.DefaultNamespace, uuid.New().String()),
+			},
+			{
+				resource: authres.NewPublicKey(resources.DefaultNamespace, uuid.New().String()),
+			},
+			{
+				resource: omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, uuid.New().String()),
+			},
+			{
+				resource: omni.NewEtcdAuditResult(resources.DefaultNamespace, uuid.New().String()),
+			},
+			{
+				resource: omni.NewKubeconfig(resources.DefaultNamespace, uuid.New().String()),
+			},
+			{
+				resource: omni.NewTalosConfig(resources.DefaultNamespace, uuid.New().String()),
+			},
+			{
+				resource: siderolink.NewConfig(resources.DefaultNamespace),
+			},
+			{
+				resource: omni.NewClusterMachineConfig(resources.DefaultNamespace, uuid.New().String()),
+			},
+			{
+				resource: omni.NewClusterSecrets(resources.DefaultNamespace, uuid.New().String()),
+			},
+			{
+				resource: authres.NewSAMLAssertion(resources.DefaultNamespace, uuid.New().String()),
+			},
+			{
+				resource: omni.NewClusterMachineEncryptionKey(resources.DefaultNamespace, uuid.New().String()),
+			},
+			{
+				resource: omni.NewEtcdBackupEncryption(resources.DefaultNamespace, uuid.New().String()),
+			},
+			{
+				resource: omni.NewBackupData(uuid.New().String()),
+			},
+		}...)
+
+		// custom resources
+
+		testCases = append(testCases, []resourceAuthzTestCase{
+			{
+				resource:       siderolink.NewLink(resources.DefaultNamespace, uuid.New().String(), &specs.SiderolinkSpec{}),
+				allowedVerbSet: xslices.ToSet([]state.Verb{state.Get, state.List, state.Update, state.Destroy}),
+			},
+		}...)
+
+		untestedResourceTypes := xslices.ToSetFunc(registry.Resources, func(rd generic.ResourceWithRD) resource.Type {
+			return rd.ResourceDefinition().Type
+		})
+
+		// delete excluded resources from the untested set
+		delete(untestedResourceTypes, k8s.KubernetesResourceType)
+		delete(untestedResourceTypes, siderolink.DeprecatedLinkCounterType)
+
+		for _, tc := range testCases {
+			for _, testVerb := range allVerbs {
+				for _, testRole := range allRoles {
+					name := fmt.Sprintf("resource-authz-%s-%s-%s", testRole, tc.resource.Metadata().Type(), verbToString(testVerb))
+
+					// delete the resource type from the untested set
+					delete(untestedResourceTypes, tc.resource.Metadata().Type())
+
+					t.Run(name, func(t *testing.T) {
+						scopedCli, testErr := clientConfig.GetClient(
+							rootCtx,
+							authcli.WithRole(string(testRole)),
+							authcli.WithSkipUserRole(true),
+						)
+						require.NoError(t, testErr)
+
+						// ensure that scopedCli is operating with the correct role
+						assertCurrentUserRole(rootCtx, t, scopedCli.Omni().State(), testRole)
+
+						noSignatureCtx := context.WithValue(rootCtx, interceptor.SkipInterceptorContextKey{}, struct{}{})
+
+						accessErr := accessResource(noSignatureCtx, t, rootCli, scopedCli, tc.resource, testVerb)
+
+						if len(tc.allowedVerbSet) == 0 {
+							assert.ErrorContains(t, accessErr, "no access is permitted")
+
+							return
+						}
+
+						if !tc.isPublic {
+							assert.ErrorContains(t, accessErr, "missing valid signature")
+
+							// refresh the error but with a signature this time
+							accessErr = accessResource(rootCtx, t, rootCli, scopedCli, tc.resource, testVerb)
+						}
+
+						isVerbError := accessErr != nil && strings.Contains(accessErr.Error(), "only") && strings.Contains(accessErr.Error(), "access is permitted")
+						isRoleError := accessErr != nil && strings.Contains(accessErr.Error(), "insufficient role:")
+
+						// assert the error
+
+						isReader := testRole.Check(role.Reader) == nil
+						isOperator := testRole.Check(role.Operator) == nil
+						isAdmin := testRole.Check(role.Admin) == nil
+						_, verbAllowed := tc.allowedVerbSet[testVerb]
+						sufficientRole := true
+
+						if tc.isAdminOnly {
+							if !isAdmin {
+								sufficientRole = false
+							}
+						} else {
+							if testVerb.Readonly() {
+								if !isReader {
+									sufficientRole = false
+								}
+							} else {
+								if !isOperator {
+									sufficientRole = false
+								}
+							}
+						}
+
+						if tc.isSignatureSufficient || tc.isPublic {
+							sufficientRole = true
+						}
+
+						switch {
+						case !verbAllowed && !sufficientRole:
+							// we check for either of these errors because their order is not guaranteed
+							assert.Truef(t, isVerbError || isRoleError, "expected verb not allowed or insufficient role error, got: %v", accessErr)
+						case !verbAllowed:
+							assert.Truef(t, isVerbError, "expected verb not allowed error, got: %v", accessErr)
+						case !sufficientRole:
+							assert.Truef(t, isRoleError, "expected insufficient role error, got: %v", accessErr)
+						default:
+							if accessErr != nil {
+								toleratedErrors := map[string]string{
+									"NotFoundError":                 "doesn't exist",
+									"ValidationError":               "failed to validate",
+									"UnsupportedError":              "unsupported resource type",
+									"AlreadyExists(AccessPolicy)":   "resource AccessPolicies.omni.sidero.dev(default/access-policy@undefined) already exists",
+									"VersionConflict(AccessPolicy)": "failed to update: resource AccessPolicies.omni.sidero.dev(default/access-policy@1) update conflict: expected version",
+								}
+
+								isExpectedError := false
+
+								for _, toleratedErrorSubstring := range toleratedErrors {
+									if strings.Contains(accessErr.Error(), toleratedErrorSubstring) {
+										isExpectedError = true
+
+										break
+									}
+								}
+
+								assert.Truef(t, isExpectedError, "expected one of: %q, got: %v", maps.Keys(toleratedErrors), accessErr)
+							}
+						}
+					})
+				}
+			}
+		}
+
+		// ensure that all resources are tested
+		for untestedResourceType := range untestedResourceTypes {
+			assert.Failf(t, "resource-authz", "resource type %s is not tested", untestedResourceType)
+		}
+	}
+}
+
+// AssertResourceAuthzWithACL tests the authorization checks of with ACLs.
+func AssertResourceAuthzWithACL(ctx context.Context, rootCli *client.Client, clientConfig *clientconfig.ClientConfig) TestFunc {
+	return func(t *testing.T) {
+		ctx = metadata.NewOutgoingContext(ctx, metadata.Pairs(grpcutil.LogLevelOverrideMetadataKey, zapcore.PanicLevel.String()))
+
+		rootState := rootCli.Omni().State()
+
+		testID := "acl-test-" + uuid.NewString()
+
+		user := authres.NewUser(resources.DefaultNamespace, testID)
+
+		user.TypedSpec().Value.Role = string(role.Reader)
+
+		require.NoError(t, rootState.Create(ctx, user))
+
+		t.Cleanup(func() { destroy(ctx, t, rootCli, user.Metadata()) })
+
+		identity := authres.NewIdentity(resources.DefaultNamespace, fmt.Sprintf("user-%s@siderolabs.com", testID))
+
+		identity.TypedSpec().Value.UserId = user.Metadata().ID()
+
+		require.NoError(t, rootState.Create(ctx, identity))
+
+		t.Cleanup(func() { destroy(ctx, t, rootCli, identity.Metadata()) })
+
+		accessPolicy := authres.NewAccessPolicy()
+
+		err := rootState.Destroy(ctx, accessPolicy.Metadata())
+		require.Truef(t, err == nil || state.IsNotFoundError(err), "unexpected error: %v", err)
+
+		clusterAuthorizedID := "authorized-" + testID
+
+		accessPolicy.TypedSpec().Value.Rules = []*specs.AccessPolicyRule{
+			{
+				Users:    []string{identity.Metadata().ID()},
+				Clusters: []string{clusterAuthorizedID},
+				Role:     string(role.Operator),
+			},
+		}
+
+		err = rootState.Create(ctx, accessPolicy)
+		require.NoError(t, err)
+
+		t.Cleanup(func() { destroy(ctx, t, rootCli, accessPolicy.Metadata()) })
+
+		userCli, err := clientConfig.GetClientForEmail(ctx, identity.Metadata().ID())
+		require.NoError(t, err)
+
+		t.Cleanup(func() { userCli.Close() }) //nolint:errcheck
+
+		clusterUnauthorized := omni.NewCluster(resources.DefaultNamespace, "unauthorized-"+testID)
+		clusterUnauthorized.TypedSpec().Value.TalosVersion = constants.DefaultTalosVersion
+		clusterUnauthorized.TypedSpec().Value.KubernetesVersion = "1.27.3"
+
+		userState := userCli.Omni().State()
+
+		// try to create an unauthorized cluster using the user client
+		err = userState.Create(ctx, clusterUnauthorized)
+		assert.ErrorContains(t, err, "insufficient role")
+
+		// create it using the admin client
+		require.NoError(t, rootState.Create(ctx, clusterUnauthorized))
+
+		t.Cleanup(func() { destroy(ctx, t, rootCli, clusterUnauthorized.Metadata()) })
+
+		// create a cluster that is authorized to the user by the ACL
+		clusterAuthorized := omni.NewCluster(resources.DefaultNamespace, clusterAuthorizedID)
+		clusterAuthorized.TypedSpec().Value.TalosVersion = constants.DefaultTalosVersion
+		clusterAuthorized.TypedSpec().Value.KubernetesVersion = "1.27.3"
+
+		err = userState.Create(ctx, clusterAuthorized)
+		assert.NoError(t, err)
+
+		t.Cleanup(func() { destroy(ctx, t, rootCli, clusterAuthorized.Metadata()) })
+
+		// try to get the unauthorized cluster using the user client - should work, as the user has the Reader role
+		_, err = userState.Get(ctx, clusterUnauthorized.Metadata())
+		assert.NoError(t, err)
+
+		//  try to modify the unauthorized cluster using the user client
+		clusterUnauthorized.TypedSpec().Value.TalosVersion = "1.4.5"
+
+		err = userState.Update(ctx, clusterUnauthorized)
+		assert.ErrorContains(t, err, "insufficient role")
+
+		// try to get the authorized cluster using the user client
+		_, err = userState.Get(ctx, clusterAuthorized.Metadata())
+		assert.NoError(t, err)
+
+		// test the logic for a config patch without any cluster association
+		configPatchUnauthorized := omni.NewConfigPatch(resources.DefaultNamespace, "unauthorized-"+testID)
+
+		err = userState.Create(ctx, configPatchUnauthorized)
+		assert.ErrorContains(t, err, "insufficient role")
+
+		// test the logic for a config patch with an authorized cluster association
+		configPatchAuthorized := omni.NewConfigPatch(resources.DefaultNamespace, "authorized"+testID)
+		configPatchAuthorized.Metadata().Labels().Set(omni.LabelCluster, clusterAuthorized.Metadata().ID())
+
+		configPatchAuthorized.TypedSpec().Value.Data = "debug: true"
+
+		err = userState.Create(ctx, configPatchAuthorized)
+		assert.NoError(t, err)
+
+		t.Cleanup(func() { destroy(ctx, t, rootCli, configPatchAuthorized.Metadata()) })
+	}
+}
+
+func accessResource(ctx context.Context, t *testing.T, rootCli *client.Client, cli *client.Client, res resource.Resource, verb state.Verb) error {
+	var err error
+
+	md := res.Metadata()
+
+	switch verb { //nolint:exhaustive
+	case state.List:
+		_, err = cli.Omni().State().List(ctx, md)
+	case state.Get:
+		_, err = cli.Omni().State().Get(ctx, md)
+	case state.Destroy:
+		err = cli.Omni().State().Destroy(ctx, md)
+	case state.Create:
+		err = cli.Omni().State().Create(ctx, res)
+		if err == nil {
+			defer destroy(ctx, t, rootCli, md)
+		}
+	case state.Update:
+		err = cli.Omni().State().Update(ctx, res)
+	default:
+		assert.Fail(t, "unsupported test verb: %s", verbToString(verb))
+	}
+
+	return err
+}
+
+func assertCurrentUserRole(ctx context.Context, t *testing.T, st state.State, expected role.Role) {
+	currentUser, currentUserErr := safe.StateGet[*virtual.CurrentUser](ctx, st, virtual.NewCurrentUser().Metadata())
+	require.NoError(t, currentUserErr)
+
+	assert.Equal(t, string(expected), currentUser.TypedSpec().Value.GetRole(), "invalid role on current user virtual resource: %v", currentUser.TypedSpec().Value.GetRole())
+}
+
+func destroy(ctx context.Context, t *testing.T, rootClient *client.Client, md *resource.Metadata) {
+	t.Logf("destroying created resource %s", md.String())
+
+	_, err := rootClient.Omni().State().Teardown(ctx, md)
+	if state.IsNotFoundError(err) {
+		return
+	}
+
+	require.NoError(t, err)
+
+	err = retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).RetryWithContext(ctx, func(ctx context.Context) error {
+		err = rootClient.Omni().State().Destroy(ctx, md)
+		if err != nil {
+			if state.IsNotFoundError(err) {
+				return nil
+			}
+
+			return retry.ExpectedError(err)
+		}
+
+		return nil
+	})
+	require.NoError(t, err)
+}
+
+func verbToString(verb state.Verb) string {
+	switch verb {
+	case state.List:
+		return "list"
+	case state.Get:
+		return "get"
+	case state.Create:
+		return "create"
+	case state.Update:
+		return "update"
+	case state.Destroy:
+		return "destroy"
+	case state.Watch:
+		return "watch"
+	default:
+		return "unknown"
+	}
+}
diff --git a/cmd/omni-integration-test/pkg/tests/backup.go b/cmd/omni-integration-test/pkg/tests/backup.go
new file mode 100644
index 000000000..9c27b44d3
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/backup.go
@@ -0,0 +1,269 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// AssertEtcdManualBackupIsCreated creates a manual etcd backup and asserts the status.
+func AssertEtcdManualBackupIsCreated(testCtx context.Context, st state.State, clusterName string) func(t *testing.T) {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 120*time.Second)
+		defer cancel()
+
+		// drop the previous EtcdManualBackup resource if it exists
+		rtestutils.Destroy[*omni.EtcdManualBackup](ctx, t, st, []string{clusterName})
+
+		// Take existing backups into account when asserting the length after creating a new backup.
+		existingBackups, err := safe.StateListAll[*omni.EtcdBackup](ctx, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)))
+		require.NoError(t, err)
+
+		backup := omni.NewEtcdManualBackup(clusterName)
+		backup.TypedSpec().Value.BackupAt = timestamppb.New(time.Now())
+
+		start := time.Now()
+
+		require.NoError(t, st.Create(ctx, backup))
+
+		assertLength[*omni.EtcdBackup](
+			ctx,
+			t,
+			st,
+			existingBackups.Len()+1,
+			state.WatchWithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)),
+		)
+
+		var backupTime time.Time
+
+		rtestutils.AssertResources(
+			ctx,
+			t,
+			st,
+			[]resource.ID{clusterName},
+			func(es *omni.EtcdBackupStatus, assertion *assert.Assertions) {
+				l := es.TypedSpec().Value.GetLastBackupTime().AsTime()
+
+				assertion.Equal(clusterName, es.Metadata().ID())
+				assertion.Equal(specs.EtcdBackupStatusSpec_Ok, es.TypedSpec().Value.Status)
+				assertion.Zero(es.TypedSpec().Value.Error)
+				assertion.Truef(l.After(start), "last backup time %q is not after start time %q", l, start)
+				assertion.WithinDuration(time.Now(), l, 300*time.Second)
+
+				backupTime = l
+			},
+		)
+
+		rtestutils.AssertResources(
+			ctx,
+			t,
+			st,
+			[]resource.ID{omni.EtcdBackupOverallStatusID},
+			func(res *omni.EtcdBackupOverallStatus, assertion *assert.Assertions) {
+				assertion.Zero(res.TypedSpec().Value.GetConfigurationError())
+				assertion.Zero(res.TypedSpec().Value.GetLastBackupStatus().GetError())
+				assertion.EqualValues(1, res.TypedSpec().Value.GetLastBackupStatus().GetStatus())
+				assertion.Equal(backupTime, res.TypedSpec().Value.GetLastBackupStatus().GetLastBackupAttempt().AsTime())
+				assertion.Equal(backupTime, res.TypedSpec().Value.GetLastBackupStatus().GetLastBackupTime().AsTime())
+			},
+		)
+	}
+}
+
+// AssertEtcdAutomaticBackupIsCreated asserts that automatic etcd backups are created.
+func AssertEtcdAutomaticBackupIsCreated(testCtx context.Context, st state.State, clusterName string) func(t *testing.T) {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 120*time.Second)
+		defer cancel()
+
+		// drop the previous EtcdBackupS3Conf resource if it exists
+		rtestutils.Destroy[*omni.EtcdBackupS3Conf](ctx, t, st, []string{omni.EtcdBackupS3ConfID})
+
+		conf := createS3Conf()
+		start := time.Now()
+
+		require.NoError(t, st.Create(ctx, conf))
+
+		t.Logf("waiting for backup for cluster %q to be created", clusterName)
+
+		assertLength[*omni.EtcdBackup](
+			ctx,
+			t,
+			st,
+			1,
+			state.WatchWithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)),
+		)
+
+		var backupTime time.Time
+
+		rtestutils.AssertResources(
+			testCtx,
+			t,
+			st,
+			[]resource.ID{clusterName},
+			func(es *omni.EtcdBackupStatus, assertion *assert.Assertions) {
+				l := es.TypedSpec().Value.GetLastBackupTime().AsTime()
+
+				assertion.Equal(specs.EtcdBackupStatusSpec_Ok, es.TypedSpec().Value.Status)
+				assertion.Zero(es.TypedSpec().Value.Error)
+				assertion.Truef(l.After(start), "last backup time %q is not after start time %q", l, start)
+				assertion.WithinDuration(time.Now(), l, 120*time.Second)
+
+				backupTime = l
+			},
+		)
+
+		rtestutils.AssertResources(
+			ctx,
+			t,
+			st,
+			[]resource.ID{omni.EtcdBackupOverallStatusID},
+			func(res *omni.EtcdBackupOverallStatus, assertion *assert.Assertions) {
+				assertion.Zero(res.TypedSpec().Value.GetConfigurationError())
+				assertion.Zero(res.TypedSpec().Value.GetLastBackupStatus().GetError())
+				assertion.EqualValues(1, res.TypedSpec().Value.GetLastBackupStatus().GetStatus())
+				assertion.Equal(backupTime, res.TypedSpec().Value.GetLastBackupStatus().GetLastBackupAttempt().AsTime())
+				assertion.Equal(backupTime, res.TypedSpec().Value.GetLastBackupStatus().GetLastBackupTime().AsTime())
+			},
+		)
+	}
+}
+
+// AssertControlPlaneCanBeRestoredFromBackup asserts that the control plane
+// is recreated with the bootstrap spec pointing to the most recent etcd backup.
+// It does not add any machines to the newly created control plane.
+func AssertControlPlaneCanBeRestoredFromBackup(testCtx context.Context, st state.State, clusterName string) func(t *testing.T) {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 120*time.Second)
+		defer cancel()
+
+		clusterUUID, err := safe.StateGetByID[*omni.ClusterUUID](ctx, st, clusterName)
+		require.NoError(t, err)
+
+		backupList, err := safe.StateListAll[*omni.EtcdBackup](ctx, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)))
+		require.NoError(t, err)
+
+		require.NotEmpty(t, backupList.Len())
+
+		snapshotName := backupList.Get(0).TypedSpec().Value.GetSnapshot() // the first backup is the most recent one
+		cpMachineSet := omni.NewMachineSet(resources.DefaultNamespace, omni.ControlPlanesResourceID(clusterName))
+
+		cpMachineSet.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+		cpMachineSet.Metadata().Labels().Set(omni.LabelControlPlaneRole, "")
+
+		t.Logf("snapshot name: %q", snapshotName)
+
+		cpMachineSet.TypedSpec().Value.UpdateStrategy = specs.MachineSetSpec_Rolling
+		cpMachineSet.TypedSpec().Value.BootstrapSpec = &specs.MachineSetSpec_BootstrapSpec{
+			ClusterUuid: clusterUUID.TypedSpec().Value.GetUuid(),
+			Snapshot:    snapshotName,
+		}
+
+		require.NoError(t, st.Create(ctx, cpMachineSet))
+	}
+}
+
+// assertLength asserts on the length of a resource list. It's a specialized version of [rtestutils.AssertLength] which
+// restarts WatchKind on each ticker tick. It here because [rtestutils.AssertLength] does not support [state.WatchKindOption]
+// and because WatchKind on external resource does not send new events.
+func assertLength[R meta.ResourceWithRD](ctx context.Context, t *testing.T, st state.State, expectedLength int, watchOpts ...state.WatchKindOption) {
+	var r R
+
+	rds := r.ResourceDefinition()
+
+	watchOpts = append(
+		watchOpts[:len(watchOpts):len(watchOpts)],
+		state.WithBootstrapContents(true),
+	)
+
+	reportTicker := time.NewTicker(5 * time.Second)
+	defer reportTicker.Stop()
+
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	for {
+		req := require.New(t)
+
+		innerCtx, cancel := context.WithCancel(ctx)
+
+		watchCh := make(chan state.Event)
+
+		req.NoError(st.WatchKind(
+			innerCtx,
+			resource.NewMetadata(rds.DefaultNamespace, rds.Type, "", resource.VersionUndefined),
+			watchCh,
+			watchOpts...))
+
+		length := 0
+		bootstrapped := false
+
+		for {
+			shouldBreak := false
+
+			select {
+			case event := <-watchCh:
+				switch event.Type { //nolint:exhaustive
+				case state.Created:
+					length++
+				case state.Destroyed:
+					length--
+				case state.Bootstrapped:
+					bootstrapped = true
+				case state.Errored:
+					req.NoError(event.Error)
+				}
+
+				if bootstrapped && length == expectedLength {
+					cancel()
+
+					return
+				}
+			case <-reportTicker.C:
+				t.Logf("length: expected %d, actual %d", expectedLength, length)
+
+				shouldBreak = true
+			case <-innerCtx.Done():
+				t.Fatalf("timeout: expected %d, actual %d", expectedLength, length)
+			}
+
+			if shouldBreak {
+				cancel()
+
+				break
+			}
+		}
+	}
+}
+
+func createS3Conf() *omni.EtcdBackupS3Conf {
+	conf := omni.NewEtcdBackupS3Conf()
+
+	conf.TypedSpec().Value = &specs.EtcdBackupS3ConfSpec{
+		Bucket:          "mybucket",
+		Region:          "us-east-1",
+		Endpoint:        "http://127.0.0.1:9000",
+		AccessKeyId:     "access",
+		SecretAccessKey: "secret123",
+	}
+
+	return conf
+}
diff --git a/cmd/omni-integration-test/pkg/tests/blocks.go b/cmd/omni-integration-test/pkg/tests/blocks.go
new file mode 100644
index 000000000..de1802746
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/blocks.go
@@ -0,0 +1,260 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/client/management"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// TestBlockClusterShouldBeReady is a reusable block of assertions that can be used to verify that a cluster is fully ready.
+func TestBlockClusterShouldBeReady(ctx context.Context, rootClient *client.Client, clusterName, expectedTalosVersion string, talosAPIKeyPrepare TalosAPIKeyPrepareFunc) subTestList { //nolint:revive
+	return subTestList{
+		{
+			"ClusterMachinesShouldBeRunning",
+			AssertClusterMachinesStage(ctx, rootClient.Omni().State(), clusterName, specs.ClusterMachineStatusSpec_RUNNING),
+		},
+		{
+			"ClusterMachinesShouldBeReady",
+			AssertClusterMachinesReady(ctx, rootClient.Omni().State(), clusterName),
+		},
+		{
+			"MachinesStatusShouldBeNotAvailable",
+			AssertMachineStatus(ctx, rootClient.Omni().State(), false, clusterName, map[string]string{
+				omni.MachineStatusLabelConnected:       "",
+				omni.MachineStatusLabelReportingEvents: "",
+			},
+				[]string{omni.MachineStatusLabelAvailable},
+			),
+		},
+		{
+			"ClusterShouldHaveStatusReady",
+			AssertClusterStatusReady(ctx, rootClient.Omni().State(), clusterName),
+		},
+		{
+			"ClusterLoadBalancerShouldBeReady",
+			AssertClusterLoadBalancerReady(ctx, rootClient.Omni().State(), clusterName),
+		},
+		{
+			"EtcdMembersShouldMatchOmniResources",
+			AssertEtcdMembershipMatchesOmniResources(ctx, rootClient, clusterName, talosAPIKeyPrepare),
+		},
+		{
+			"TalosMembersShouldMatchOmniResources",
+			AssertTalosMembersMatchOmni(ctx, rootClient, clusterName, talosAPIKeyPrepare),
+		},
+		{
+			"TalosVersionShouldMatchExpected",
+			AssertTalosVersion(ctx, rootClient, clusterName, expectedTalosVersion, talosAPIKeyPrepare),
+		},
+	}
+}
+
+// TestBlockProxyAPIAccessShouldWork is a reusable block of assertions that can be used to verify that Omni API proxies work.
+func TestBlockProxyAPIAccessShouldWork(ctx context.Context, rootClient *client.Client, clusterName string, talosAPIKeyPrepare TalosAPIKeyPrepareFunc) []subTest { //nolint:revive
+	return []subTest{
+		{
+			"ClusterKubernetesAPIShouldBeAccessibleViaOmni",
+			AssertKubernetesAPIAccessViaOmni(ctx, rootClient, clusterName, true, 30*time.Second),
+		},
+		{
+			"ClusterTalosAPIShouldBeAccessibleViaOmni",
+			AssertTalosAPIAccessViaOmni(ctx, rootClient, clusterName, talosAPIKeyPrepare),
+		},
+	}
+}
+
+// TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady is a reusable block of assertions that can be used to verify
+// that a cluster is fully ready and that Omni API proxies work, and Kubernetes version is correct, and Kubernetes usage
+// metrics were collected.
+//
+// This block is a bit slower than TestBlockClusterShouldBeReady, because it also verifies Kubernetes version.
+func TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+	ctx context.Context, rootClient *client.Client,
+	clusterName, expectedTalosVersion, expectedKubernetesVersion string,
+	talosAPIKeyPrepare TalosAPIKeyPrepareFunc,
+) []subTest { //nolint:revive
+	return TestBlockClusterShouldBeReady(ctx, rootClient, clusterName, expectedTalosVersion, talosAPIKeyPrepare).
+		Append(TestBlockProxyAPIAccessShouldWork(ctx, rootClient, clusterName, talosAPIKeyPrepare)...).
+		Append(
+			subTest{
+				"ClusterKubernetesVersionShouldBeCorrect",
+				AssertClusterKubernetesVersion(ctx, rootClient.Omni().State(), clusterName, expectedKubernetesVersion),
+			},
+			subTest{
+				"ClusterBootstrapManifestsShouldBeInSync",
+				AssertClusterBootstrapManifestStatus(ctx, rootClient.Omni().State(), clusterName),
+			},
+		).
+		Append(
+			subTest{
+				"ClusterKubernetesUsageShouldBeCorrect",
+				AssertClusterKubernetesUsage(ctx, rootClient.Omni().State(), clusterName),
+			},
+		)
+}
+
+// TestBlockRestoreEtcdFromLatestBackup is a reusable block of assertions that can be used to verify that a
+// cluster's control plane can be broken, destroyed and then restored from an etcd backup.
+func TestBlockRestoreEtcdFromLatestBackup(ctx context.Context, rootClient *client.Client, talosAPIKeyPrepare TalosAPIKeyPrepareFunc,
+	options Options, controlPlaneNodeCount int, clusterName, assertDeploymentNS, assertDeploymentName string,
+) subTestList { //nolint:revive
+	return subTestList{
+		subTest{
+			"ControlPlaneShouldBeBrokenThenDestroyed",
+			AssertBreakAndDestroyControlPlane(ctx, rootClient.Omni().State(), clusterName, options),
+		},
+		subTest{
+			"ControlPlaneShouldBeRestoredFromBackup",
+			AssertControlPlaneCanBeRestoredFromBackup(ctx, rootClient.Omni().State(), clusterName),
+		},
+		subTest{
+			"ControlPlaneShouldBeScaledUp",
+			ScaleClusterUp(ctx, rootClient.Omni().State(), ClusterOptions{
+				Name:           clusterName,
+				ControlPlanes:  controlPlaneNodeCount,
+				MachineOptions: options.MachineOptions,
+			}),
+		},
+	}.Append(
+		subTest{
+			"ClusterShouldHaveStatusReady",
+			AssertClusterStatusReady(ctx, rootClient.Omni().State(), clusterName),
+		},
+		subTest{
+			"ClusterLoadBalancerShouldBeReady",
+			AssertClusterLoadBalancerReady(ctx, rootClient.Omni().State(), clusterName),
+		},
+		subTest{
+			"EtcdMembersShouldMatchOmniResources",
+			AssertEtcdMembershipMatchesOmniResources(ctx, rootClient, clusterName, talosAPIKeyPrepare),
+		},
+	).Append(
+		subTest{
+			"KubernetesAPIShouldBeAccessible",
+			AssertKubernetesAPIAccessViaOmni(ctx, rootClient, clusterName, false, 300*time.Second),
+		},
+		subTest{
+			"ClusterNodesShouldBeInDesiredState",
+			AssertKubernetesNodesState(ctx, rootClient, clusterName),
+		},
+		subTest{
+			"KubeletShouldBeRestartedOnWorkers",
+			AssertTalosServiceIsRestarted(ctx, rootClient, clusterName, talosAPIKeyPrepare, "kubelet", resource.LabelExists(omni.LabelWorkerRole)),
+		},
+		subTest{
+			"KubernetesDeploymentShouldHaveRunningPods",
+			AssertKubernetesDeploymentHasRunningPods(ctx, rootClient.Management(), clusterName, assertDeploymentNS, assertDeploymentName),
+		},
+	).Append(
+		TestBlockKubernetesDeploymentCreateAndRunning(ctx, rootClient.Management(), clusterName, assertDeploymentNS, assertDeploymentName+"-after-restore")...,
+	)
+}
+
+// TestBlockCreateClusterFromEtcdBackup is a reusable block of assertions that can be used to verify that a
+// new cluster can be created from another cluster's etcd backup.
+func TestBlockCreateClusterFromEtcdBackup(ctx context.Context, rootClient *client.Client, talosAPIKeyPrepare TalosAPIKeyPrepareFunc, options Options,
+	sourceClusterName, newClusterName, assertDeploymentNS, assertDeploymentName string,
+) subTestList { //nolint:revive
+	return subTestList{
+		subTest{
+			"ClusterShouldBeCreatedFromEtcdBackup",
+			CreateCluster(ctx, rootClient, ClusterOptions{
+				Name:          newClusterName,
+				ControlPlanes: 1,
+				Workers:       1,
+
+				RestoreFromEtcdBackupClusterID: sourceClusterName,
+
+				MachineOptions: options.MachineOptions,
+			}),
+		},
+	}.Append(
+		subTest{
+			"ClusterShouldHaveStatusReady",
+			AssertClusterStatusReady(ctx, rootClient.Omni().State(), newClusterName),
+		},
+		subTest{
+			"ClusterLoadBalancerShouldBeReady",
+			AssertClusterLoadBalancerReady(ctx, rootClient.Omni().State(), newClusterName),
+		},
+		subTest{
+			"EtcdMembersShouldMatchOmniResources",
+			AssertEtcdMembershipMatchesOmniResources(ctx, rootClient, newClusterName, talosAPIKeyPrepare),
+		},
+	).Append(
+		subTest{
+			"KubernetesAPIShouldBeAccessible",
+			AssertKubernetesAPIAccessViaOmni(ctx, rootClient, newClusterName, false, 300*time.Second),
+		},
+		subTest{
+			"ClusterNodesShouldBeInDesiredState",
+			AssertKubernetesNodesState(ctx, rootClient, newClusterName),
+		},
+		subTest{
+			"KubernetesDeploymentShouldHaveRunningPods",
+			AssertKubernetesDeploymentHasRunningPods(ctx, rootClient.Management(), newClusterName, assertDeploymentNS, assertDeploymentName),
+		},
+	).Append(
+		TestBlockKubernetesDeploymentCreateAndRunning(ctx, rootClient.Management(), newClusterName, assertDeploymentNS, assertDeploymentName+"-after-restore")...,
+	)
+}
+
+// TestBlockKubernetesDeploymentCreateAndRunning is a reusable block of assertions that can be used to verify that a
+// Kubernetes deployment is created and has running pods.
+func TestBlockKubernetesDeploymentCreateAndRunning(ctx context.Context, managementClient *management.Client, clusterName, ns, name string) []subTest { //nolint:revive
+	return []subTest{
+		{
+			"KubernetesDeploymentShouldBeCreated",
+			AssertKubernetesDeploymentIsCreated(ctx, managementClient, clusterName, ns, name),
+		},
+		{
+			"KubernetesDeploymentShouldHaveRunningPods",
+			AssertKubernetesDeploymentHasRunningPods(ctx, managementClient, clusterName, ns, name),
+		},
+	}
+}
+
+// TestGroupClusterCreateAndReady is a reusable group of tests that can be used to verify that a cluster is created and ready.
+func TestGroupClusterCreateAndReady(
+	ctx context.Context,
+	rootClient *client.Client,
+	talosAPIKeyPrepare TalosAPIKeyPrepareFunc,
+	name, description string,
+	options ClusterOptions,
+) testGroup { //nolint:revive
+	clusterName := "integration-" + name
+	options.Name = clusterName
+
+	return testGroup{
+		Name:         strings.ToUpper(name[0:1]) + name[1:] + "Cluster",
+		Description:  description,
+		Parallel:     true,
+		MachineClaim: options.ControlPlanes + options.Workers,
+		Subtests: subTests(
+			subTest{
+				"ClusterShouldBeCreated",
+				CreateCluster(ctx, rootClient, options),
+			},
+		).Append(
+			TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(ctx, rootClient, clusterName, options.MachineOptions.TalosVersion, options.MachineOptions.KubernetesVersion, talosAPIKeyPrepare)...,
+		).Append(
+			subTest{
+				"ClusterShouldBeDestroyed",
+				AssertDestroyCluster(ctx, rootClient.Omni().State(), clusterName),
+			},
+		),
+		Finalizer: DestroyCluster(ctx, rootClient.Omni().State(), clusterName),
+	}
+}
diff --git a/cmd/omni-integration-test/pkg/tests/cleanup.go b/cmd/omni-integration-test/pkg/tests/cleanup.go
new file mode 100644
index 000000000..dbbd3f904
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/cleanup.go
@@ -0,0 +1,33 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/state"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// DestroyAllClusterRelatedResources cleans up the state from the previous runs.
+func DestroyAllClusterRelatedResources(testCtx context.Context, st state.State) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 300*time.Second)
+		defer cancel()
+
+		rtestutils.Teardown[*omni.MachineSet](ctx, t, st, rtestutils.ResourceIDs[*omni.MachineSet](ctx, t, st))
+		rtestutils.DestroyAll[*omni.MachineSetNode](ctx, t, st)
+		rtestutils.DestroyAll[*omni.ConfigPatch](ctx, t, st)
+		rtestutils.DestroyAll[*omni.MachineSet](ctx, t, st)
+		rtestutils.DestroyAll[*omni.Cluster](ctx, t, st)
+		rtestutils.Destroy[*omni.EtcdBackupS3Conf](ctx, t, st, []resource.ID{omni.EtcdBackupS3ConfID})
+	}
+}
diff --git a/cmd/omni-integration-test/pkg/tests/cluster.go b/cmd/omni-integration-test/pkg/tests/cluster.go
new file mode 100644
index 000000000..6ff31f896
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/cluster.go
@@ -0,0 +1,839 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"context"
+	"fmt"
+	"math/rand"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/pair"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/cosi/labels"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/virtual"
+)
+
+// ClusterOptions are the options for cluster creation.
+//
+//nolint:govet
+type ClusterOptions struct {
+	Name string
+
+	// RestoreFromEtcdBackupClusterID is the cluster ID of the cluster to restore from.
+	// When specified, the cluster will be created with the etcd from the latest etcd backup of the specified cluster.
+	RestoreFromEtcdBackupClusterID string
+
+	ControlPlanes, Workers int
+	Features               *specs.ClusterSpec_Features
+	EtcdBackup             *specs.EtcdBackupConf
+
+	MachineOptions MachineOptions
+}
+
+// MachineOptions are the options for machine creation.
+type MachineOptions struct {
+	TalosVersion      string
+	KubernetesVersion string
+}
+
+// CreateCluster verifies cluster creation.
+func CreateCluster(testCtx context.Context, cli *client.Client, options ClusterOptions) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 150*time.Second)
+		defer cancel()
+
+		st := cli.Omni().State()
+		require := require.New(t)
+
+		pickUnallocatedMachines(ctx, t, st, options.ControlPlanes+options.Workers, func(machineIDs []resource.ID) {
+			checkExtensionWithRetries(ctx, t, cli, HelloWorldServiceExtensionName, machineIDs...)
+
+			cluster := omni.NewCluster(resources.DefaultNamespace, options.Name)
+			cluster.TypedSpec().Value.TalosVersion = options.MachineOptions.TalosVersion
+			cluster.TypedSpec().Value.KubernetesVersion = options.MachineOptions.KubernetesVersion
+			cluster.TypedSpec().Value.Features = options.Features
+			cluster.TypedSpec().Value.BackupConfiguration = options.EtcdBackup
+
+			require.NoError(st.Create(ctx, cluster))
+
+			for i := 0; i < options.ControlPlanes; i++ {
+				t.Logf("Adding machine '%s' to control plane (cluster %q)", machineIDs[i], options.Name)
+				bindMachine(ctx, t, st, bindMachineOptions{
+					clusterName:                    options.Name,
+					role:                           omni.LabelControlPlaneRole,
+					machineID:                      machineIDs[i],
+					restoreFromEtcdBackupClusterID: options.RestoreFromEtcdBackupClusterID,
+				})
+			}
+
+			for i := options.ControlPlanes; i < options.ControlPlanes+options.Workers; i++ {
+				t.Logf("Adding machine '%s' to workers (cluster %q)", machineIDs[i], options.Name)
+				bindMachine(ctx, t, st, bindMachineOptions{
+					clusterName: options.Name,
+					role:        omni.LabelWorkerRole,
+					machineID:   machineIDs[i],
+				})
+			}
+
+			// assert that machines got allocated (label available is removed)
+			rtestutils.AssertResources(ctx, t, st, machineIDs, func(machineStatus *omni.MachineStatus, assert *assert.Assertions) {
+				assert.True(machineStatus.Metadata().Labels().Matches(
+					resource.LabelTerm{
+						Key:    omni.MachineStatusLabelAvailable,
+						Op:     resource.LabelOpExists,
+						Invert: true,
+					},
+				), resourceDetails(machineStatus))
+			})
+		})
+	}
+}
+
+// CreateClusterWithMachineClass verifies cluster creation.
+func CreateClusterWithMachineClass(testCtx context.Context, st state.State, options ClusterOptions) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 150*time.Second)
+		defer cancel()
+
+		require := require.New(t)
+
+		cluster := omni.NewCluster(resources.DefaultNamespace, options.Name)
+		cluster.TypedSpec().Value.TalosVersion = options.MachineOptions.TalosVersion
+		cluster.TypedSpec().Value.KubernetesVersion = options.MachineOptions.KubernetesVersion
+		cluster.TypedSpec().Value.Features = options.Features
+		cluster.TypedSpec().Value.BackupConfiguration = options.EtcdBackup
+
+		kubespanEnabler := omni.NewConfigPatch(resources.DefaultNamespace, fmt.Sprintf("%s-kubespan-enabler", options.Name))
+		kubespanEnabler.Metadata().Labels().Set(omni.LabelCluster, options.Name)
+
+		kubespanEnabler.TypedSpec().Value.Data = `machine:
+  network:
+    kubespan:
+      enabled: true
+`
+
+		require.NoError(st.Create(ctx, cluster))
+		require.NoError(st.Create(ctx, kubespanEnabler))
+
+		machineClass := omni.NewMachineClass(resources.DefaultNamespace, options.Name)
+
+		createOrUpdate(ctx, t, st, machineClass, func(r *omni.MachineClass) error {
+			r.TypedSpec().Value.MatchLabels = []string{omni.MachineStatusLabelConnected}
+
+			return nil
+		})
+
+		query, err := labels.ParseSelectors(machineClass.TypedSpec().Value.MatchLabels)
+
+		require.NoError(err)
+
+		opts := xslices.Map(query, func(q resource.LabelQuery) state.ListOption {
+			return state.WithLabelQuery(resource.RawLabelQuery(q))
+		})
+
+		ids := rtestutils.ResourceIDs[*omni.MachineStatus](ctx, t, st, opts...)
+
+		// populate uuid patches for each machine matching the machine class
+		for _, machineID := range ids {
+			configPatch := omni.NewConfigPatch(
+				resources.DefaultNamespace,
+				fmt.Sprintf("000-%s-uuid-patch", machineID),
+				pair.MakePair(omni.LabelCluster, options.Name),
+				pair.MakePair(omni.LabelClusterMachine, machineID),
+			)
+
+			createOrUpdate(ctx, t, st, configPatch, func(cps *omni.ConfigPatch) error {
+				cps.Metadata().Labels().Set(omni.LabelCluster, options.Name)
+				cps.Metadata().Labels().Set(omni.LabelClusterMachine, machineID)
+
+				cps.TypedSpec().Value.Data = fmt.Sprintf(`machine:
+  kubelet:
+    extraArgs:
+      node-labels: %s=%s`, nodeLabel, machineID)
+
+				return nil
+			})
+		}
+
+		updateMachineClassMachineSets(ctx, t, st, options, machineClass)
+	}
+}
+
+// ScaleClusterMachineSets scales the cluster with machine sets which are using machine classes.
+func ScaleClusterMachineSets(testCtx context.Context, st state.State, options ClusterOptions) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 30*time.Second)
+		defer cancel()
+
+		updateMachineClassMachineSets(ctx, t, st, options, nil)
+	}
+}
+
+// ScaleClusterUp scales up the cluster.
+func ScaleClusterUp(testCtx context.Context, st state.State, options ClusterOptions) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 30*time.Second)
+		defer cancel()
+
+		pickUnallocatedMachines(ctx, t, st, options.ControlPlanes+options.Workers, func(machineIDs []resource.ID) {
+			for i := 0; i < options.ControlPlanes; i++ {
+				t.Logf("Adding machine '%s' to control plane (cluster %q)", machineIDs[i], options.Name)
+
+				bindMachine(ctx, t, st, bindMachineOptions{
+					clusterName: options.Name,
+					role:        omni.LabelControlPlaneRole,
+					machineID:   machineIDs[i],
+				})
+			}
+
+			for i := options.ControlPlanes; i < options.ControlPlanes+options.Workers; i++ {
+				t.Logf("Adding machine '%s' to workers (cluster %q)", machineIDs[i], options.Name)
+
+				bindMachine(ctx, t, st, bindMachineOptions{
+					clusterName: options.Name,
+					role:        omni.LabelWorkerRole,
+					machineID:   machineIDs[i],
+				})
+			}
+
+			// assert that machines got allocated (label available is removed)
+			rtestutils.AssertResources(ctx, t, st, machineIDs, func(machineStatus *omni.MachineStatus, assert *assert.Assertions) {
+				assert.True(machineStatus.Metadata().Labels().Matches(
+					resource.LabelTerm{
+						Key:    omni.MachineStatusLabelAvailable,
+						Op:     resource.LabelOpExists,
+						Invert: true,
+					},
+				), resourceDetails(machineStatus))
+			})
+
+			// assert that ClusterMachines got created
+			rtestutils.AssertResources(ctx, t, st, machineIDs, func(*omni.ClusterMachine, *assert.Assertions) {})
+		})
+	}
+}
+
+// ScaleClusterDown scales cluster down.
+//
+// Pass < 0 to scale down machine set.
+// Pass 0 to leave machine set as is.
+func ScaleClusterDown(testCtx context.Context, st state.State, options ClusterOptions) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 10*time.Second)
+		defer cancel()
+
+		controlPlanes := rtestutils.ResourceIDs[*omni.MachineSetNode](ctx, t, st,
+			state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, options.Name), resource.LabelExists(omni.LabelControlPlaneRole)))
+
+		workers := rtestutils.ResourceIDs[*omni.MachineSetNode](ctx, t, st,
+			state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, options.Name), resource.LabelExists(omni.LabelWorkerRole)))
+
+		if options.ControlPlanes < 0 {
+			finalCount := len(controlPlanes) + options.ControlPlanes
+
+			require.Greaterf(t, finalCount, 0, "can't scale down")
+			controlPlanes = controlPlanes[finalCount:]
+
+			t.Logf("Removing machines '%s' from control planes (cluster %q)", controlPlanes, options.Name)
+
+			rtestutils.Destroy[*omni.MachineSetNode](ctx, t, st, controlPlanes)
+		}
+
+		if options.Workers < 0 {
+			finalCount := len(workers) + options.Workers
+
+			require.GreaterOrEqualf(t, finalCount, 0, "can't scale down")
+			workers = workers[finalCount:]
+
+			t.Logf("Removing machines '%s' from workers (cluster %q)", workers, options.Name)
+
+			rtestutils.Destroy[*omni.MachineSetNode](ctx, t, st, workers)
+		}
+	}
+}
+
+// ReplaceControlPlanes replaces controlplane nodes.
+func ReplaceControlPlanes(testCtx context.Context, st state.State, options ClusterOptions) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 30*time.Second)
+		defer cancel()
+
+		existingControlPlanes := rtestutils.ResourceIDs[*omni.MachineSetNode](ctx, t, st,
+			state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, options.Name), resource.LabelExists(omni.LabelControlPlaneRole)),
+		)
+
+		pickUnallocatedMachines(ctx, t, st, len(existingControlPlanes), func(machineIDs []resource.ID) {
+			for _, machineID := range machineIDs {
+				t.Logf("Adding machine '%s' to control plane (cluster %q)", machineID, options.Name)
+
+				bindMachine(ctx, t, st, bindMachineOptions{
+					clusterName: options.Name,
+					role:        omni.LabelControlPlaneRole,
+					machineID:   machineID,
+				})
+			}
+
+			t.Logf("Removing machines '%s' from control planes (cluster %q)", existingControlPlanes, options.Name)
+
+			rtestutils.Destroy[*omni.MachineSetNode](ctx, t, st, existingControlPlanes)
+
+			// assert that machines got allocated (label available is removed)
+			rtestutils.AssertResources(ctx, t, st, machineIDs, func(machineStatus *omni.MachineStatus, assert *assert.Assertions) {
+				assert.True(machineStatus.Metadata().Labels().Matches(
+					resource.LabelTerm{
+						Key:    omni.MachineStatusLabelAvailable,
+						Op:     resource.LabelOpExists,
+						Invert: true,
+					},
+				), resourceDetails(machineStatus))
+			})
+
+			// assert that ClusterMachines got created
+			rtestutils.AssertResources(ctx, t, st, machineIDs, func(*omni.ClusterMachine, *assert.Assertions) {})
+		})
+	}
+}
+
+// AssertClusterMachinesStage verifies that cluster machines reach a specified phase.
+func AssertClusterMachinesStage(testCtx context.Context, st state.State, clusterName string, stage specs.ClusterMachineStatusSpec_Stage) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 6*time.Minute)
+		defer cancel()
+
+		require := require.New(t)
+
+		machineIDs := getMachineSetNodes(ctx, t, st, clusterName)
+		require.NotEmpty(machineIDs, "no machine set nodes found for cluster %q", clusterName)
+
+		// assert that all machinesetnodes are present as cluster machines
+		rtestutils.AssertResources(ctx, t, st, machineIDs, func(*omni.ClusterMachine, *assert.Assertions) {})
+
+		// assert that there are not clustermachines which are not machinesetnodes
+		cmIDs := rtestutils.ResourceIDs[*omni.ClusterMachine](ctx, t, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)))
+
+		machineIDMap := xslices.ToSet(machineIDs)
+
+		for _, cmID := range cmIDs {
+			if _, ok := machineIDMap[cmID]; ok {
+				// cluster machine matches expected machine set node
+				continue
+			}
+
+			// wait for the cluster machine to be cleaned up
+			rtestutils.AssertNoResource[*omni.ClusterMachine](ctx, t, st, cmID)
+		}
+
+		rtestutils.AssertResources(ctx, t, st, machineIDs, func(status *omni.ClusterMachineStatus, assert *assert.Assertions) {
+			spec := status.TypedSpec().Value
+
+			assert.Equal(stage, spec.Stage, "%s != %s, %s", stage.String(), spec.Stage.String(), resourceDetails(status))
+		})
+	}
+}
+
+// AssertClusterMachinesReady verifies that cluster machines reach ready state.
+func AssertClusterMachinesReady(testCtx context.Context, st state.State, clusterName string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 4*time.Minute)
+		defer cancel()
+
+		require := require.New(t)
+
+		machineIDs := getMachineSetNodes(ctx, t, st, clusterName)
+		require.NotEmpty(machineIDs)
+
+		rtestutils.AssertResources(ctx, t, st, machineIDs, func(*omni.ClusterMachine, *assert.Assertions) {})
+
+		rtestutils.AssertResources(ctx, t, st, machineIDs, func(status *omni.ClusterMachineStatus, assert *assert.Assertions) {
+			spec := status.TypedSpec().Value
+
+			assert.Truef(spec.Ready, "cluster machine status not ready: %s", resourceDetails(status))
+		})
+
+		rtestutils.AssertResources(ctx, t, st, machineIDs, func(status *omni.ClusterMachineIdentity, assert *assert.Assertions) {
+			spec := status.TypedSpec().Value
+
+			assert.NotEmptyf(spec.NodeIdentity, "no node identity: %s", resourceDetails(status))
+		})
+	}
+}
+
+// AssertClusterStatusReady verifies that cluster status reaches ready state.
+func AssertClusterStatusReady(testCtx context.Context, st state.State, clusterName string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, time.Minute*5)
+		defer cancel()
+
+		require := require.New(t)
+
+		machineIDs := getMachineSetNodes(ctx, t, st, clusterName)
+		require.NotEmpty(machineIDs)
+
+		rtestutils.AssertResources(ctx, t, st, []string{clusterName}, func(status *omni.ClusterStatus, assert *assert.Assertions) {
+			spec := status.TypedSpec().Value
+
+			assert.Truef(spec.Available, "not available: %s", resourceDetails(status))
+			assert.Equalf(specs.ClusterStatusSpec_RUNNING, spec.Phase, "cluster is not in phase running: %s", resourceDetails(status))
+			assert.Equalf(spec.GetMachines().Total, spec.GetMachines().Healthy, "not all machines are healthy: %s", resourceDetails(status))
+			assert.Truef(spec.Ready, "cluster is not ready: %s", resourceDetails(status))
+			assert.Truef(spec.ControlplaneReady, "cluster controlplane is not ready: %s", resourceDetails(status))
+			assert.Truef(spec.KubernetesAPIReady, "cluster kubernetes API is not ready: %s", resourceDetails(status))
+			assert.EqualValuesf(len(machineIDs), spec.GetMachines().Total, "total machines is not the same as in the machine sets: %s", resourceDetails(status))
+		})
+	}
+}
+
+// AssertClusterLoadBalancerReady verifies that cluster load balancer reaches ready state.
+func AssertClusterLoadBalancerReady(testCtx context.Context, st state.State, clusterName string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 30*time.Second)
+		defer cancel()
+
+		rtestutils.AssertResources(ctx, t, st, []string{clusterName}, func(status *omni.LoadBalancerStatus, assert *assert.Assertions) {
+			spec := status.TypedSpec().Value
+
+			assert.Truef(spec.Healthy, "lb not healthy: %s", resourceDetails(status))
+		})
+	}
+}
+
+// AssertClusterKubernetesVersion verifies that Kubernetes version matches expectations.
+func AssertClusterKubernetesVersion(testCtx context.Context, st state.State, clusterName, expectedKubernetesVersion string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 180*time.Second)
+		defer cancel()
+
+		rtestutils.AssertResources(ctx, t, st, []string{clusterName}, func(status *omni.KubernetesUpgradeStatus, assert *assert.Assertions) {
+			spec := status.TypedSpec().Value
+
+			assert.Equal(expectedKubernetesVersion, spec.LastUpgradeVersion, resourceDetails(status))
+			assert.Equal(specs.KubernetesUpgradeStatusSpec_Done, spec.Phase, resourceDetails(status))
+		})
+	}
+}
+
+// AssertClusterBootstrapManifestStatus verifies that Kubernetes boostrap manifests are in sync.
+func AssertClusterBootstrapManifestStatus(testCtx context.Context, st state.State, clusterName string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 60*time.Second)
+		defer cancel()
+
+		rtestutils.AssertResources(ctx, t, st, []string{clusterName}, func(status *omni.KubernetesUpgradeManifestStatus, assert *assert.Assertions) {
+			spec := status.TypedSpec().Value
+
+			assert.EqualValues(0, spec.OutOfSync, resourceDetails(status))
+		})
+	}
+}
+
+// AssertClusterKubernetesUsage verifies that Kubernetes usage matches expectations.
+func AssertClusterKubernetesUsage(testCtx context.Context, st state.State, clusterName string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 180*time.Second)
+		defer cancel()
+
+		rtestutils.AssertResource(ctx, t, st, clusterName, func(status *virtual.KubernetesUsage, assert *assert.Assertions) {
+			spec := status.TypedSpec().Value
+
+			assert.NotNil(spec.Cpu, resourceDetails(status))
+			assert.NotNil(spec.Mem, resourceDetails(status))
+			assert.NotNil(spec.Storage, resourceDetails(status))
+			assert.NotNil(spec.Pods, resourceDetails(status))
+
+			assert.Greater(spec.Cpu.Requests, float64(0), resourceDetails(status))
+			assert.Greater(spec.Cpu.Capacity, float64(0), resourceDetails(status))
+
+			assert.Greater(spec.Mem.Requests, float64(0), resourceDetails(status))
+			assert.Greater(spec.Mem.Capacity, float64(0), resourceDetails(status))
+
+			assert.Greater(spec.Storage.Capacity, float64(0), resourceDetails(status))
+
+			assert.Greater(spec.Pods.Count, int32(0), resourceDetails(status))
+			assert.Greater(spec.Pods.Capacity, int32(0), resourceDetails(status))
+		}, rtestutils.WithNamespace(resources.VirtualNamespace))
+	}
+}
+
+// DestroyCluster destroys a cluster and waits for it to be destroyed.
+//
+// It is used as a finalizer when the test group fails.
+func DestroyCluster(testCtx context.Context, st state.State, clusterName string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 300*time.Second)
+		defer cancel()
+
+		clusterMachineIDs := rtestutils.ResourceIDs[*omni.ClusterMachine](ctx, t, st, state.WithLabelQuery(
+			resource.LabelEqual(omni.LabelCluster, clusterName),
+		))
+
+		t.Log("destroying cluster", clusterName)
+
+		rtestutils.Teardown[*omni.Cluster](ctx, t, st, []resource.ID{clusterName})
+
+		rtestutils.AssertNoResource[*omni.Cluster](ctx, t, st, clusterName)
+
+		// wait for all machines to returned to the pool as 'available' or be part of a different cluster
+		rtestutils.AssertResources(ctx, t, st, clusterMachineIDs, func(machine *omni.MachineStatus, asrt *assert.Assertions) {
+			_, isAvailable := machine.Metadata().Labels().Get(omni.MachineStatusLabelAvailable)
+			machineCluster, machineBound := machine.Metadata().Labels().Get(omni.LabelCluster)
+
+			asrt.True(isAvailable || (machineBound && machineCluster != clusterName),
+				"machine %q: available %v, bound %v, cluster %q", machine.Metadata().ID(), isAvailable, machineBound, machineCluster,
+			)
+		})
+
+		_, err := st.Get(ctx, omni.NewMachineClass(resources.DefaultNamespace, clusterName).Metadata())
+		if state.IsNotFoundError(err) {
+			return
+		}
+
+		require.NoError(t, err)
+
+		t.Log("destroying related machine class", clusterName)
+
+		rtestutils.Destroy[*omni.MachineClass](ctx, t, st, []string{clusterName})
+	}
+}
+
+// AssertDestroyCluster destroys a cluster and verifies that all dependent resources are gone.
+func AssertDestroyCluster(testCtx context.Context, st state.State, clusterName string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 300*time.Second)
+		defer cancel()
+
+		patches := rtestutils.ResourceIDs[*omni.ConfigPatch](ctx, t, st, state.WithLabelQuery(
+			resource.LabelEqual(omni.LabelCluster, clusterName),
+		))
+
+		machineSets := rtestutils.ResourceIDs[*omni.MachineSet](ctx, t, st, state.WithLabelQuery(
+			resource.LabelEqual(omni.LabelCluster, clusterName),
+		))
+
+		clusterMachineIDs := rtestutils.ResourceIDs[*omni.ClusterMachine](ctx, t, st, state.WithLabelQuery(
+			resource.LabelEqual(omni.LabelCluster, clusterName),
+		))
+
+		t.Log("destroying cluster", clusterName)
+
+		_, err := st.Teardown(ctx, resource.NewMetadata(resources.DefaultNamespace, omni.ClusterType, clusterName, resource.VersionUndefined))
+
+		require.NoError(t, err)
+
+		rtestutils.AssertNoResource[*omni.Cluster](ctx, t, st, clusterName)
+
+		for _, id := range patches {
+			rtestutils.AssertNoResource[*omni.ConfigPatch](ctx, t, st, id)
+		}
+
+		for _, id := range machineSets {
+			rtestutils.AssertNoResource[*omni.MachineSet](ctx, t, st, id)
+		}
+
+		// wait for all machines to returned to the pool as 'available' or be part of a different cluster
+		rtestutils.AssertResources(ctx, t, st, clusterMachineIDs, func(machine *omni.MachineStatus, asrt *assert.Assertions) {
+			_, isAvailable := machine.Metadata().Labels().Get(omni.MachineStatusLabelAvailable)
+			machineCluster, machineBound := machine.Metadata().Labels().Get(omni.LabelCluster)
+			asrt.True(isAvailable || (machineBound && machineCluster != clusterName),
+				"machine %q: available %v, bound %v, cluster %q", machine.Metadata().ID(), isAvailable, machineBound, machineCluster,
+			)
+		})
+	}
+}
+
+// AssertBreakAndDestroyControlPlane breaks the control plane of the given cluster
+// by freezing all control plane machines, then destroys its control plane.
+func AssertBreakAndDestroyControlPlane(testCtx context.Context, st state.State, clusterName string, options Options) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 300*time.Second)
+		defer cancel()
+
+		rtestutils.AssertResource[*omni.ClusterBootstrapStatus](ctx, t, st, clusterName, func(status *omni.ClusterBootstrapStatus, assert *assert.Assertions) {
+			assert.True(status.TypedSpec().Value.GetBootstrapped())
+		})
+
+		// break the control plane
+		frozenMachineIDs := freezeMachinesOfType(ctx, t, st, clusterName, options.FreezeAMachineFunc, omni.LabelControlPlaneRole)
+
+		// remove the broken machines
+		rtestutils.Teardown[*siderolink.Link](ctx, t, st, frozenMachineIDs)
+
+		// destroy the control plane
+		rtestutils.Destroy[*omni.MachineSet](ctx, t, st, []string{omni.ControlPlanesResourceID(clusterName)})
+		rtestutils.Destroy[*siderolink.Link](ctx, t, st, frozenMachineIDs)
+
+		// assert that the bootstrapped flag is set to false
+		rtestutils.AssertResource[*omni.ClusterBootstrapStatus](ctx, t, st, clusterName, func(status *omni.ClusterBootstrapStatus, assert *assert.Assertions) {
+			assert.False(status.TypedSpec().Value.GetBootstrapped())
+		})
+
+		// wipe the frozen machines to bring them back to the pool
+		for _, machineID := range frozenMachineIDs {
+			wipeMachine(ctx, t, st, machineID, options.WipeAMachineFunc)
+		}
+	}
+}
+
+const nodeLabel = "omni-uuid"
+
+type bindMachineOptions struct {
+	clusterName, role, machineID, restoreFromEtcdBackupClusterID string
+}
+
+func bindMachine(ctx context.Context, t *testing.T, st state.State, bindOpts bindMachineOptions) {
+	configPatch := omni.NewConfigPatch(
+		resources.DefaultNamespace,
+		fmt.Sprintf("000-%s-%s-install-disk", bindOpts.clusterName, bindOpts.machineID),
+		pair.MakePair(omni.LabelCluster, bindOpts.clusterName),
+		pair.MakePair(omni.LabelClusterMachine, bindOpts.machineID),
+	)
+
+	createOrUpdate(ctx, t, st, configPatch, func(cps *omni.ConfigPatch) error {
+		cps.Metadata().Labels().Set(omni.LabelCluster, bindOpts.clusterName)
+		cps.Metadata().Labels().Set(omni.LabelClusterMachine, bindOpts.machineID)
+
+		var shortRole string
+
+		switch bindOpts.role {
+		case omni.LabelControlPlaneRole:
+			shortRole = "cp"
+		case omni.LabelWorkerRole:
+			shortRole = "w"
+		}
+
+		hostname := fmt.Sprintf("%s-%s-%s", bindOpts.clusterName, shortRole, bindOpts.machineID)
+
+		if len(hostname) > 63 {
+			// trim left, to keep the UUID intact
+			hostname = hostname[len(hostname)-63:]
+		}
+
+		patch := map[string]any{
+			"machine": map[string]any{
+				"install": map[string]any{
+					"disk": "/dev/vda",
+				},
+				"network": map[string]any{
+					"hostname": hostname,
+				},
+				"kubelet": map[string]any{
+					"extraArgs": map[string]any{
+						"node-labels": fmt.Sprintf("%s=%s", nodeLabel, bindOpts.machineID),
+					},
+				},
+			},
+		}
+
+		patchBytes, err := yaml.Marshal(patch)
+		if err != nil {
+			return err
+		}
+
+		cps.TypedSpec().Value.Data = string(patchBytes)
+
+		return nil
+	})
+
+	id := omni.WorkersResourceID(bindOpts.clusterName)
+	if bindOpts.role == omni.LabelControlPlaneRole {
+		id = omni.ControlPlanesResourceID(bindOpts.clusterName)
+	}
+
+	ms := omni.NewMachineSet(resources.DefaultNamespace, id)
+	ms.Metadata().Labels().Set(omni.LabelCluster, bindOpts.clusterName)
+	ms.Metadata().Labels().Set(bindOpts.role, "")
+
+	var bootstrapSpec *specs.MachineSetSpec_BootstrapSpec
+
+	if bindOpts.restoreFromEtcdBackupClusterID != "" && bindOpts.role == omni.LabelControlPlaneRole { // not a fresh cluster - restore from the etcd backup of another cluster
+		backupList, err := safe.StateListAll[*omni.EtcdBackup](ctx, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, bindOpts.restoreFromEtcdBackupClusterID)))
+		require.NoError(t, err)
+
+		require.NotEmpty(t, backupList.Len(), "no etcd backup found for cluster %q", bindOpts.restoreFromEtcdBackupClusterID)
+
+		clusterUUID, err := safe.StateGetByID[*omni.ClusterUUID](ctx, st, bindOpts.restoreFromEtcdBackupClusterID)
+		require.NoError(t, err)
+
+		backup := backupList.Get(0)
+
+		bootstrapSpec = &specs.MachineSetSpec_BootstrapSpec{
+			ClusterUuid: clusterUUID.TypedSpec().Value.GetUuid(),
+			Snapshot:    backup.TypedSpec().Value.GetSnapshot(),
+		}
+	}
+
+	createOrUpdate(ctx, t, st, ms, func(ms *omni.MachineSet) error {
+		ms.Metadata().Labels().Set(omni.LabelCluster, bindOpts.clusterName)
+		ms.Metadata().Labels().Set(bindOpts.role, "")
+
+		ms.TypedSpec().Value.UpdateStrategy = specs.MachineSetSpec_Rolling
+
+		if bootstrapSpec != nil {
+			ms.TypedSpec().Value.BootstrapSpec = bootstrapSpec
+		}
+
+		return nil
+	})
+
+	machineSetNode := omni.NewMachineSetNode(resources.DefaultNamespace, bindOpts.machineID, ms)
+
+	_, ok := machineSetNode.Metadata().Labels().Get(omni.LabelCluster)
+	require.Truef(t, ok, "the machine label cluster is not set on the machine set node")
+
+	createOrUpdate(ctx, t, st, machineSetNode, func(*omni.MachineSetNode) error {
+		return nil
+	})
+}
+
+func getMachineSetNodes(ctx context.Context, t *testing.T, st state.State, clusterName string) []string {
+	require := require.New(t)
+
+	machineIDs := rtestutils.ResourceIDs[*omni.MachineSetNode](ctx, t, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)))
+	require.NotEmpty(machineIDs)
+
+	return machineIDs
+}
+
+// machineAllocationLock makes sure that only one test allocates machines at a time.
+var machineAllocationLock sync.Mutex
+
+func pickUnallocatedMachines(ctx context.Context, t *testing.T, st state.State, count int, f func([]resource.ID)) {
+	machineAllocationLock.Lock()
+	defer machineAllocationLock.Unlock()
+
+	result := make([]resource.ID, 0, count)
+
+	err := retry.Constant(time.Minute).RetryWithContext(ctx, func(ctx context.Context) error {
+		machineIDs := rtestutils.ResourceIDs[*omni.MachineStatus](ctx, t, st, state.WithLabelQuery(resource.LabelExists(omni.MachineStatusLabelAvailable)))
+
+		if len(machineIDs) < count {
+			return retry.ExpectedErrorf("not enough machines: available %d, requested %d", len(machineIDs), count)
+		}
+
+		for _, j := range rand.Perm(len(machineIDs))[:count] {
+			result = append(result, machineIDs[j])
+		}
+
+		return nil
+	})
+
+	require.NoError(t, err)
+
+	f(result)
+}
+
+func createOrUpdate[T resource.Resource](ctx context.Context, t *testing.T, s state.State, res T, update func(T) error, createOpts ...state.CreateOption) {
+	require := require.New(t)
+
+	cb := func(r T) error {
+		for key, value := range res.Metadata().Labels().Raw() {
+			r.Metadata().Labels().Set(key, value)
+		}
+
+		return update(r)
+	}
+
+	// try getting the resource first, and if it exists, skip attempting to create,
+	// as relying on create to fail with conflict might not give the expected result due to validation errors
+	_, err := s.Get(ctx, res.Metadata())
+	notFound := state.IsNotFoundError(err)
+
+	if err != nil && !notFound {
+		require.NoError(err)
+	}
+
+	if notFound {
+		toCreate := res.DeepCopy().(T) //nolint:forcetypeassert,errcheck
+
+		require.NoError(cb(toCreate))
+
+		err = s.Create(ctx, toCreate, createOpts...)
+		if err == nil {
+			return
+		}
+
+		if !state.IsConflictError(err) {
+			require.NoError(err)
+		}
+	}
+
+	if _, err = safe.StateUpdateWithConflicts(ctx, s, res.Metadata(), cb); err != nil {
+		require.NoError(err)
+	}
+}
+
+func waitMachineSetNodesSync(ctx context.Context, t *testing.T, st state.State, options ClusterOptions) {
+	machineSets := []resource.ID{
+		omni.ControlPlanesResourceID(options.Name),
+		omni.WorkersResourceID(options.Name),
+	}
+
+	rtestutils.AssertResources(ctx, t, st, machineSets, func(status *omni.MachineSetStatus, assert *assert.Assertions) {
+		spec := status.TypedSpec().Value
+
+		ids := rtestutils.ResourceIDs[*omni.MachineSetNode](ctx, t, st, state.WithLabelQuery(
+			resource.LabelEqual(omni.LabelMachineSet, status.Metadata().ID()),
+		))
+
+		assert.Equal(int(spec.Machines.Requested), len(ids), resourceDetails(status))
+	})
+}
+
+func updateMachineClassMachineSets(ctx context.Context, t *testing.T, st state.State, options ClusterOptions, machineClass *omni.MachineClass) {
+	machineAllocationLock.Lock()
+	defer machineAllocationLock.Unlock()
+
+	for _, role := range []string{omni.LabelControlPlaneRole, omni.LabelWorkerRole} {
+		id := omni.WorkersResourceID(options.Name)
+		machineCount := options.Workers
+
+		if role == omni.LabelControlPlaneRole {
+			id = omni.ControlPlanesResourceID(options.Name)
+			machineCount = options.ControlPlanes
+		}
+
+		ms := omni.NewMachineSet(resources.DefaultNamespace, id)
+
+		createOrUpdate(ctx, t, st, ms, func(r *omni.MachineSet) error {
+			r.Metadata().Labels().Set(omni.LabelCluster, options.Name)
+			r.Metadata().Labels().Set(role, "")
+
+			switch {
+			case machineClass != nil:
+				r.TypedSpec().Value.MachineClass = &specs.MachineSetSpec_MachineClass{
+					MachineCount: uint32(machineCount),
+					Name:         machineClass.Metadata().ID(),
+				}
+			case r.TypedSpec().Value.MachineClass != nil:
+				r.TypedSpec().Value.MachineClass.MachineCount += uint32(machineCount)
+			}
+
+			require.NotNilf(t, r.TypedSpec().Value.MachineClass, "the machine set doesn't have machine class set")
+
+			r.TypedSpec().Value.UpdateStrategy = specs.MachineSetSpec_Rolling
+
+			return nil
+		})
+	}
+
+	waitMachineSetNodesSync(ctx, t, st, options)
+}
diff --git a/cmd/omni-integration-test/pkg/tests/common.go b/cmd/omni-integration-test/pkg/tests/common.go
new file mode 100644
index 000000000..cb0825de2
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/common.go
@@ -0,0 +1,183 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	talosclient "github.com/siderolabs/talos/pkg/machinery/client"
+	clientconfig "github.com/siderolabs/talos/pkg/machinery/client/config"
+	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+)
+
+func resourceDetails(res resource.Resource) string {
+	parts := []string{
+		fmt.Sprintf("metadata: %s", res.Metadata().String()),
+	}
+
+	hostname, ok := res.Metadata().Labels().Get(omni.LabelHostname)
+	if !ok {
+		parts = append(parts, fmt.Sprintf("hostname: %s", hostname))
+	}
+
+	if res.Metadata().Type() == omni.MachineStatusType {
+		network := res.Spec().(*omni.MachineStatusSpec).Value.Network //nolint:forcetypeassert
+		if network != nil {
+			parts = append(parts, fmt.Sprintf("hostname: %s", network.Hostname))
+		}
+	}
+
+	return strings.Join(parts, ", ")
+}
+
+type node struct {
+	machine              *omni.Machine
+	machineStatus        *omni.MachineStatus
+	clusterMachine       *omni.ClusterMachine
+	clusterMachineStatus *omni.ClusterMachineStatus
+	talosIP              string
+}
+
+func nodes(ctx context.Context, cli *client.Client, clusterName string, labels ...resource.LabelQueryOption) ([]node, error) {
+	talosCli, err := talosClient(ctx, cli, clusterName)
+	if err != nil {
+		return nil, err
+	}
+
+	st := cli.Omni().State()
+
+	nodeIPs, err := talosNodeIPs(ctx, talosCli.COSI)
+	if err != nil {
+		return nil, err
+	}
+
+	labelQueryOptions := make([]resource.LabelQueryOption, 0, len(labels)+1)
+	labelQueryOptions = append(labelQueryOptions, labels...)
+	labelQueryOptions = append(labelQueryOptions, resource.LabelEqual(omni.LabelCluster, clusterName))
+
+	clusterMachineList, err := safe.StateListAll[*omni.ClusterMachine](
+		ctx,
+		st,
+		state.WithLabelQuery(labelQueryOptions...),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	nodeList := make([]node, 0, clusterMachineList.Len())
+
+	for iter := clusterMachineList.Iterator(); iter.Next(); {
+		clusterMachine := iter.Value()
+
+		machine, err := safe.StateGet[*omni.Machine](ctx, st, omni.NewMachine(resources.DefaultNamespace, clusterMachine.Metadata().ID()).Metadata())
+		if err != nil && !state.IsNotFoundError(err) {
+			return nil, err
+		}
+
+		machineStatus, err := safe.StateGet[*omni.MachineStatus](ctx, st, omni.NewMachineStatus(resources.DefaultNamespace, clusterMachine.Metadata().ID()).Metadata())
+		if err != nil && !state.IsNotFoundError(err) {
+			return nil, err
+		}
+
+		clusterMachineStatus, err := safe.StateGet[*omni.ClusterMachineStatus](ctx, st, omni.NewClusterMachineStatus(resources.DefaultNamespace, clusterMachine.Metadata().ID()).Metadata())
+		if err != nil && !state.IsNotFoundError(err) {
+			return nil, err
+		}
+
+		var talosIP string
+
+		for _, address := range machineStatus.TypedSpec().Value.GetNetwork().GetAddresses() {
+			for _, nodeIP := range nodeIPs {
+				ip, _, err := net.ParseCIDR(address)
+				if err != nil {
+					continue
+				}
+
+				if ip.String() == nodeIP {
+					talosIP = nodeIP
+
+					break
+				}
+			}
+		}
+
+		nodeList = append(nodeList, node{
+			machine:              machine,
+			machineStatus:        machineStatus,
+			clusterMachine:       clusterMachine,
+			clusterMachineStatus: clusterMachineStatus,
+			talosIP:              talosIP,
+		})
+	}
+
+	return nodeList, nil
+}
+
+func talosClient(ctx context.Context, cli *client.Client, clusterName string) (*talosclient.Client, error) {
+	data, err := cli.Management().Talosconfig(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(data) == 0 {
+		return nil, errors.New("empty talosconfig")
+	}
+
+	config, err := clientconfig.FromBytes(data)
+	if err != nil {
+		return nil, err
+	}
+
+	return talosclient.New(
+		ctx,
+		talosclient.WithConfig(config),
+		talosclient.WithCluster(clusterName),
+	)
+}
+
+func talosClientMaintenance(ctx context.Context, endpoint string) (*talosclient.Client, error) {
+	opts := talos.GetSocketOptions(endpoint)
+
+	opts = append(opts, talosclient.WithTLSConfig(&tls.Config{
+		InsecureSkipVerify: true,
+	}), talosclient.WithEndpoints(endpoint))
+
+	return talosclient.New(ctx, opts...)
+}
+
+func talosNodeIPs(ctx context.Context, talosState state.State) ([]string, error) {
+	list, err := safe.StateListAll[*cluster.Member](ctx, talosState)
+	if err != nil {
+		return nil, err
+	}
+
+	nodeIPs := make([]string, 0, list.Len())
+
+	for iter := list.Iterator(); iter.Next(); {
+		member := iter.Value()
+
+		if len(member.TypedSpec().Addresses) == 0 {
+			return nil, fmt.Errorf("no addresses for member %q", member.Metadata().ID())
+		}
+
+		nodeIPs = append(nodeIPs, member.TypedSpec().Addresses[0].String())
+	}
+
+	return nodeIPs, nil
+}
diff --git a/cmd/omni-integration-test/pkg/tests/config_patch.go b/cmd/omni-integration-test/pkg/tests/config_patch.go
new file mode 100644
index 000000000..13bfb54b3
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/config_patch.go
@@ -0,0 +1,437 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/dustin/go-humanize"
+	"github.com/siderolabs/gen/pair"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	talosclient "github.com/siderolabs/talos/pkg/machinery/client"
+	"github.com/siderolabs/talos/pkg/machinery/resources/network"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+const (
+	dummyIfacePatchTemplate = `machine:
+  network:
+    interfaces:
+      - interface: %s
+        dummy: true`
+)
+
+// AssertLargeImmediateConfigApplied tests that config patch that be applied immediately (without reboot) gets applied to all the nodes.
+//
+// Config patch is generated to be large to test the edge case.
+// The patch is removed on finalize.
+func AssertLargeImmediateConfigApplied(testCtx context.Context, cli *client.Client, clusterName string, talosAPIKeyPrepare TalosAPIKeyPrepareFunc) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 3*time.Minute)
+		defer cancel()
+
+		require.NoError(t, talosAPIKeyPrepare(ctx, "default"))
+
+		talosCli, err := talosClient(ctx, cli, clusterName)
+		require.NoError(t, err)
+
+		nodeIPs, err := talosNodeIPs(ctx, talosCli.COSI)
+		require.NoError(t, err)
+
+		st := cli.Omni().State()
+
+		epochSeconds := time.Now().Unix()
+		id := fmt.Sprintf("000-config-patch-test-dummy-iface-%d", epochSeconds)
+		iface := fmt.Sprintf("dummy%d", epochSeconds)
+		configPatchYAML := fmt.Sprintf(dummyIfacePatchTemplate, iface)
+
+		var sb strings.Builder
+
+		for i := 0; i < 40_000; i++ {
+			sb.WriteString("################################################################################\n")
+		}
+
+		sb.WriteString(configPatchYAML)
+		sb.WriteString("\n")
+
+		sizeHumanReadable := humanize.Bytes(uint64(sb.Len()))
+
+		require.LessOrEqual(t, sb.Len(), 4*1024*1024, "generated config patch is too large (%v), abort", sizeHumanReadable)
+
+		t.Logf("creating large config patch with size: %v", sizeHumanReadable)
+
+		configPatch := omni.NewConfigPatch(resources.DefaultNamespace, id, pair.MakePair(omni.LabelCluster, clusterName))
+
+		// apply large config patch that creates a dummy interface
+		createOrUpdate(ctx, t, st, configPatch, func(p *omni.ConfigPatch) error {
+			p.TypedSpec().Value.Data = sb.String()
+
+			return nil
+		})
+
+		t.Logf("created large config patch with dummy interface: %q", iface)
+
+		// assert that the patch is propagated to all clustermachines
+		cmIDs := rtestutils.ResourceIDs[*omni.ClusterMachineConfigPatches](ctx, t, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)))
+
+		rtestutils.AssertResources(ctx, t, st, cmIDs, func(cm *omni.ClusterMachineConfigPatches, assertion *assert.Assertions) {
+			assertion.True(clusterMachinePatchesContainsString(cm, iface), "cluster machine %q patches don't contain string %q", cm.Metadata().ID(), iface)
+		})
+
+		linkStatus := network.NewLinkStatus(network.NamespaceName, "")
+
+		containsDummyIface := func(node string) (bool, error) {
+			links, linksErr := talosCli.COSI.List(talosclient.WithNode(ctx, node), linkStatus.Metadata())
+			if linksErr != nil {
+				return false, linksErr
+			}
+
+			for _, res := range links.Items {
+				if res.Metadata().ID() == iface {
+					return true, nil
+				}
+			}
+
+			return false, nil
+		}
+
+		for _, node := range nodeIPs {
+			err = retry.Constant(3*time.Minute, retry.WithUnits(1*time.Second)).RetryWithContext(ctx, func(context.Context) error {
+				contains, containsErr := containsDummyIface(node)
+				if containsErr != nil {
+					return containsErr
+				}
+
+				if !contains {
+					return retry.ExpectedError(fmt.Errorf("%q: dummy interface %q not found", node, iface))
+				}
+
+				return nil
+			})
+
+			assert.NoError(t, err)
+		}
+
+		rtestutils.Destroy[*omni.ConfigPatch](ctx, t, st, []string{configPatch.Metadata().ID()})
+
+		t.Logf("destroyed config patch with dummy interface: %q", iface)
+
+		// assert that the patch deletion is propagated to all clustermachines
+		rtestutils.AssertResources(ctx, t, st, cmIDs, func(cm *omni.ClusterMachineConfigPatches, assertion *assert.Assertions) {
+			assertion.False(clusterMachinePatchesContainsString(cm, iface), "cluster machine %q patches contain string %q", cm.Metadata().ID(), iface)
+		})
+	}
+}
+
+// AssertConfigPatchWithReboot tests that config patch that requires reboot gets applied to a single node, the node reboots and gets back.
+//
+// The patch is NOT removed.
+func AssertConfigPatchWithReboot(testCtx context.Context, cli *client.Client, clusterName string, talosAPIKeyPrepare TalosAPIKeyPrepareFunc) TestFunc {
+	return func(t *testing.T) {
+		// just a single machine with a reboot, so it should take no more than 3 minutes
+		ctx, cancel := context.WithTimeout(testCtx, 3*time.Minute)
+		defer cancel()
+
+		require.NoError(t, talosAPIKeyPrepare(ctx, "default"))
+
+		talosCli, err := talosClient(ctx, cli, clusterName)
+		require.NoError(t, err)
+
+		st := cli.Omni().State()
+
+		nodeList, err := nodes(ctx, cli, clusterName, resource.LabelExists(omni.LabelWorkerRole))
+		require.NoError(t, err)
+		require.Greater(t, len(nodeList), 0)
+
+		node := nodeList[0]
+
+		nodeID := node.machine.Metadata().ID()
+
+		epochSeconds := time.Now().Unix()
+		id := fmt.Sprintf("000-config-patch-test-file-%d", epochSeconds)
+		file := fmt.Sprintf("/var/config-patch-test-file-%d.txt", epochSeconds)
+		configPatchYAML := fmt.Sprintf(`machine:
+  files:
+    - content: test
+      permissions: 0o666
+      path: %s
+      op: create`, file)
+		configPatch := omni.NewConfigPatch(resources.DefaultNamespace, id,
+			pair.MakePair(omni.LabelCluster, clusterName),
+			pair.MakePair(omni.LabelClusterMachine, nodeID))
+
+		// apply config patch that creates a file
+		createOrUpdate(ctx, t, st, configPatch, func(p *omni.ConfigPatch) error {
+			p.TypedSpec().Value.Data = configPatchYAML
+
+			return nil
+		})
+
+		t.Logf("created config patch with file: %q", file)
+
+		// skip cleanup to avoid waiting for an additional reboot
+
+		// assert that the patch is propagated to all clustermachines
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{nodeID}, func(cm *omni.ClusterMachineConfigPatches, assertion *assert.Assertions) {
+			assertion.True(clusterMachinePatchesContainsString(cm, file), "cluster machine %q patches don't contain string %q", file, cm.Metadata().ID())
+		})
+
+		// assert that machine set enters into reconfiguring phase
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{omni.WorkersResourceID(clusterName)}, func(mss *omni.MachineSetStatus, assert *assert.Assertions) {
+			assert.Equal(specs.MachineSetPhase_Reconfiguring, mss.TypedSpec().Value.GetPhase())
+		})
+
+		// assert that the file is created on the node
+		err = retry.Constant(3*time.Minute, retry.WithUnits(1*time.Second)).RetryWithContext(ctx, func(ctx context.Context) error {
+			exists, existsErr := talosFileExists(ctx, talosCli, node.talosIP, file)
+			if existsErr != nil {
+				if strings.Contains(existsErr.Error(), "not reachable") || status.Code(existsErr) == codes.Unavailable {
+					return retry.ExpectedError(existsErr)
+				}
+
+				return existsErr
+			}
+
+			if !exists {
+				return retry.ExpectedError(fmt.Errorf("%q: file %q is not found", node.talosIP, file))
+			}
+
+			t.Logf("file %q is found on node %q", file, node.talosIP)
+
+			return nil
+		})
+
+		assert.NoError(t, err)
+
+		// wait cluster machine status to be running
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{nodeID}, func(cms *omni.ClusterMachineStatus, assertion *assert.Assertions) {
+			assertion.Equal(specs.ClusterMachineStatusSpec_RUNNING, cms.TypedSpec().Value.GetStage())
+		})
+	}
+}
+
+// AssertConfigPatchWithInvalidConfig tests that a machine is able to recover from a patch with broken config when the broken patch is deleted.
+func AssertConfigPatchWithInvalidConfig(testCtx context.Context, cli *client.Client, clusterName string, talosAPIKeyPrepare TalosAPIKeyPrepareFunc) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 8*time.Minute)
+		defer cancel()
+
+		require.NoError(t, talosAPIKeyPrepare(ctx, "default"))
+
+		st := cli.Omni().State()
+
+		cmIDs := rtestutils.ResourceIDs[*omni.ClusterMachine](ctx, t, st,
+			state.WithLabelQuery(
+				resource.LabelEqual(omni.LabelCluster, clusterName),
+				resource.LabelExists(omni.LabelControlPlaneRole),
+			),
+		)
+		require.NotEmpty(t, cmIDs)
+
+		cmID := cmIDs[0]
+
+		epochSeconds := time.Now().Unix()
+		id := fmt.Sprintf("000-config-patch-test-file-broken-%d", epochSeconds)
+		file := fmt.Sprintf("/tmp/config-patch-test-file-broken-%d.txt", epochSeconds)
+		configPatchYAML := fmt.Sprintf(`machine:
+  files:
+    - content: test
+      permissions: 0o666
+      path: %s
+      op: create`, file)
+		configPatch := omni.NewConfigPatch(resources.DefaultNamespace, id,
+			pair.MakePair(omni.LabelCluster, clusterName),
+			pair.MakePair(omni.LabelClusterMachine, cmID))
+
+		// apply broken config patch
+		createOrUpdate(ctx, t, st, configPatch, func(p *omni.ConfigPatch) error {
+			p.TypedSpec().Value.Data = configPatchYAML
+
+			return nil
+		})
+
+		t.Logf("created config patch with file: %q", file)
+
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{cmID}, func(cms *omni.ClusterMachineStatus, assertion *assert.Assertions) {
+			assertion.Equal(specs.ClusterMachineStatusSpec_BOOTING, cms.TypedSpec().Value.GetStage())
+			assertion.False(cms.TypedSpec().Value.GetReady())
+		})
+
+		// TODO: wait for a Talos error about invalid config in the logs
+
+		t.Logf("destroyed config patch with file: %q", file)
+
+		// remove broken config patch
+		rtestutils.Destroy[*omni.ConfigPatch](ctx, t, st, []string{configPatch.Metadata().ID()})
+
+		// wait until k8s nodes come back
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{cmID}, func(cms *omni.ClusterMachineStatus, assertion *assert.Assertions) {
+			assertion.Equal(specs.ClusterMachineStatusSpec_RUNNING, cms.TypedSpec().Value.GetStage())
+			assertion.True(cms.TypedSpec().Value.GetReady())
+		})
+	}
+}
+
+// AssertConfigPatchMachineSet applies config patch on a single machine set.
+//
+// The patch is removed at the end.
+func AssertConfigPatchMachineSet(testCtx context.Context, cli *client.Client, clusterName string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 30*time.Second)
+		defer cancel()
+
+		st := cli.Omni().State()
+
+		workerMachineSetName := omni.WorkersResourceID(clusterName)
+		controlPlaneMachineSetName := omni.ControlPlanesResourceID(clusterName)
+
+		epochSeconds := time.Now().Unix()
+		id := fmt.Sprintf("000-config-patch-test-dummy-iface-%d", epochSeconds)
+		iface := fmt.Sprintf("dummy%d", epochSeconds)
+		configPatchYAML := fmt.Sprintf(dummyIfacePatchTemplate, iface)
+
+		configPatch := omni.NewConfigPatch(
+			resources.DefaultNamespace,
+			id,
+			pair.MakePair(omni.LabelCluster, clusterName),
+			pair.MakePair(omni.LabelMachineSet, workerMachineSetName),
+		)
+
+		// apply config patch that creates a dummy interface
+		createOrUpdate(ctx, t, st, configPatch, func(p *omni.ConfigPatch) error {
+			p.TypedSpec().Value.Data = configPatchYAML
+
+			return nil
+		})
+
+		// assert that the patch is propagated to all worker machine set ClusterMachines
+		workerIDs := rtestutils.ResourceIDs[*omni.ClusterMachineConfigPatches](ctx, t, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelMachineSet, workerMachineSetName)))
+
+		rtestutils.AssertResources(ctx, t, st, workerIDs, func(cm *omni.ClusterMachineConfigPatches, assertion *assert.Assertions) {
+			assertion.True(clusterMachinePatchesContainsString(cm, iface), "cluster machine %q patches don't contain string %q", cm.Metadata().ID(), iface)
+		})
+
+		// assert that the patch is *NOT* propagated to all controlplane machine set ClusterMachines
+		controlPlaneIDs := rtestutils.ResourceIDs[*omni.ClusterMachineConfigPatches](ctx, t, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelMachineSet, controlPlaneMachineSetName)))
+
+		rtestutils.AssertResources(ctx, t, st, controlPlaneIDs, func(cm *omni.ClusterMachineConfigPatches, assertion *assert.Assertions) {
+			assertion.False(clusterMachinePatchesContainsString(cm, iface), "cluster machine %q patches contain string %q", cm.Metadata().ID(), iface)
+		})
+
+		// cleanup
+		rtestutils.Destroy[*omni.ConfigPatch](ctx, t, st, []string{configPatch.Metadata().ID()})
+	}
+}
+
+// AssertConfigPatchSingleClusterMachine applies a config patch on a single cluster machine.
+//
+// The patch is removed at the end.
+func AssertConfigPatchSingleClusterMachine(testCtx context.Context, cli *client.Client, clusterName string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 30*time.Second)
+		defer cancel()
+
+		st := cli.Omni().State()
+
+		// get a single clustermachine
+		cmIDs := rtestutils.ResourceIDs[*omni.ClusterMachine](ctx, t, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)))
+		require.NotEmpty(t, cmIDs)
+
+		cmID := cmIDs[0]
+
+		epochSeconds := time.Now().Unix()
+		id := fmt.Sprintf("000-config-patch-test-dummy-iface-%d", epochSeconds)
+		iface := fmt.Sprintf("dummy%d", epochSeconds)
+		configPatchYAML := fmt.Sprintf(dummyIfacePatchTemplate, iface)
+
+		configPatch := omni.NewConfigPatch(resources.DefaultNamespace, id,
+			pair.MakePair(omni.LabelCluster, clusterName),
+			pair.MakePair(omni.LabelClusterMachine, cmID))
+
+		// apply config patch
+		createOrUpdate(ctx, t, st, configPatch, func(p *omni.ConfigPatch) error {
+			p.TypedSpec().Value.Data = configPatchYAML
+
+			return nil
+		})
+
+		// assert that the patch is propagated to the clustermachine
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{cmID}, func(r *omni.ClusterMachineConfigPatches, assertion *assert.Assertions) {
+			assertion.True(clusterMachinePatchesContainsString(r, iface), "cluster machine %q patches don't contain string %q", r.Metadata().ID(), iface)
+		})
+
+		// assert that the patch is *NOT* propagated to other clustermachines of the cluster
+		otherCMIDs := cmIDs[1:]
+
+		rtestutils.AssertResources(ctx, t, st, otherCMIDs, func(r *omni.ClusterMachineConfigPatches, assertion *assert.Assertions) {
+			assertion.False(clusterMachinePatchesContainsString(r, iface), "cluster machine %q patches contain string %q", r.Metadata().ID(), iface)
+		})
+
+		// cleanup
+		rtestutils.Destroy[*omni.ConfigPatch](ctx, t, st, []string{configPatch.Metadata().ID()})
+	}
+}
+
+func clusterMachinePatchesContainsString(clusterMachineConfigPatches *omni.ClusterMachineConfigPatches, str string) bool {
+	for _, patch := range clusterMachineConfigPatches.TypedSpec().Value.GetPatches() {
+		if strings.Contains(patch, str) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func talosFileExists(ctx context.Context, talosClient *talosclient.Client, node, filePath string) (bool, error) {
+	resp, err := talosClient.MachineClient.List(talosclient.WithNode(ctx, node), &machine.ListRequest{Root: filePath})
+	if err != nil {
+		return false, err
+	}
+
+	for {
+		var fileInfo *machine.FileInfo
+
+		fileInfo, err = resp.Recv()
+		if errors.Is(err, io.EOF) {
+			return false, nil
+		}
+
+		if err != nil {
+			if strings.Contains(err.Error(), "no such file or directory") {
+				return false, nil
+			}
+
+			return false, err
+		}
+
+		if fileInfo.GetError() != "" {
+			return false, errors.New(fileInfo.GetError())
+		}
+
+		if fileInfo.Name == filepath.Clean(filePath) {
+			return true, nil
+		}
+	}
+}
diff --git a/cmd/omni-integration-test/pkg/tests/extensions.go b/cmd/omni-integration-test/pkg/tests/extensions.go
new file mode 100644
index 000000000..22ed39d6b
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/extensions.go
@@ -0,0 +1,109 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/go-retry/retry"
+	talosclient "github.com/siderolabs/talos/pkg/machinery/client"
+	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// HelloWorldServiceExtensionName is the name of the sample hello world extension used for testing.
+const HelloWorldServiceExtensionName = "hello-world-service"
+
+// QemuGuestAgentExtensionName is the name of the qemu guest agent extension used for testing.
+const QemuGuestAgentExtensionName = "qemu-guest-agent"
+
+// AssertExtensionIsPresent asserts that the extension "hello-world-service" is present on all machines in the cluster.
+func AssertExtensionIsPresent(ctx context.Context, cli *client.Client, cluster, extension string) TestFunc {
+	return func(t *testing.T) {
+		clusterMachineList, err := safe.StateListAll[*omni.ClusterMachine](ctx, cli.Omni().State(), state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, cluster)))
+		require.NoError(t, err)
+
+		machineIDs := make([]resource.ID, 0, clusterMachineList.Len())
+
+		clusterMachineList.ForEach(func(clusterMachine *omni.ClusterMachine) {
+			machineIDs = append(machineIDs, clusterMachine.Metadata().ID())
+		})
+
+		checkExtensionWithRetries(ctx, t, cli, extension, machineIDs...)
+	}
+}
+
+func checkExtensionWithRetries(ctx context.Context, t *testing.T, cli *client.Client, extension string, machineIDs ...resource.ID) {
+	for _, machineID := range machineIDs {
+		numErrs := 0
+
+		err := retry.Constant(3*time.Minute, retry.WithUnits(time.Second), retry.WithAttemptTimeout(3*time.Second)).RetryWithContext(ctx, func(ctx context.Context) error {
+			if err := checkExtension(ctx, cli, machineID, extension); err != nil {
+				numErrs++
+
+				if numErrs%10 == 0 {
+					t.Logf("failed to check extension %q on machine %q: %v", extension, machineID, err)
+				}
+
+				return retry.ExpectedError(err)
+			}
+
+			t.Logf("found extension %q on machine %q", extension, machineID)
+
+			return nil
+		})
+		require.NoError(t, err)
+	}
+}
+
+func checkExtension(ctx context.Context, cli *client.Client, machineID resource.ID, extension string) error {
+	machineStatus, err := safe.StateGet[*omni.MachineStatus](ctx, cli.Omni().State(), omni.NewMachineStatus(resources.DefaultNamespace, machineID).Metadata())
+	if err != nil {
+		return err
+	}
+
+	var talosCli *talosclient.Client
+
+	if machineStatus.TypedSpec().Value.GetMaintenance() {
+		if talosCli, err = talosClientMaintenance(ctx, machineStatus.TypedSpec().Value.GetManagementAddress()); err != nil {
+			return err
+		}
+	} else {
+		cluster, ok := machineStatus.Metadata().Labels().Get(omni.LabelCluster)
+		if !ok {
+			return fmt.Errorf("machine %q is not in maintenance mode but does not have a cluster label", machineStatus.Metadata().ID())
+		}
+
+		if talosCli, err = talosClient(ctx, cli, cluster); err != nil {
+			return err
+		}
+	}
+
+	extensionStatusList, err := safe.StateListAll[*runtime.ExtensionStatus](ctx, talosCli.COSI)
+	if err != nil {
+		return err
+	}
+
+	for iter := extensionStatusList.Iterator(); iter.Next(); {
+		extensionStatus := iter.Value()
+
+		if extensionStatus.TypedSpec().Metadata.Name == extension {
+			return nil
+		}
+	}
+
+	return fmt.Errorf("extension %q is not found on machine %q", extension, machineStatus.Metadata().ID())
+}
diff --git a/cmd/omni-integration-test/pkg/tests/image.go b/cmd/omni-integration-test/pkg/tests/image.go
new file mode 100644
index 000000000..54e351ca6
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/image.go
@@ -0,0 +1,88 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/siderolabs/talos/pkg/machinery/constants"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/api/omni/management"
+	"github.com/siderolabs/omni/client/pkg/client"
+	clientconsts "github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// AssertSomeImagesAreDownloadable verifies generated image download.
+func AssertSomeImagesAreDownloadable(testCtx context.Context, client *client.Client, signer HTTPRequestSignerFunc, httpEndpoint string) TestFunc {
+	st := client.Omni().State()
+
+	return func(t *testing.T) {
+		t.Parallel()
+
+		media, err := safe.StateListAll[*omni.InstallationMedia](testCtx, st)
+		require.NoError(t, err)
+
+		var images []*omni.InstallationMedia
+
+		for it := media.Iterator(); it.Next(); {
+			spec := it.Value().TypedSpec().Value
+
+			switch {
+			case spec.Profile == constants.BoardRPiGeneric:
+				fallthrough
+			case spec.Profile == "aws":
+				fallthrough
+			case spec.Profile == "iso":
+				images = append(images, it.Value())
+			}
+		}
+
+		require.Greater(t, len(images), 2)
+
+		for _, image := range images {
+			t.Run(image.Metadata().ID(), func(t *testing.T) {
+				t.Parallel()
+
+				ctx, cancel := context.WithTimeout(testCtx, time.Minute*5)
+				defer cancel()
+
+				u, err := url.Parse(httpEndpoint)
+				require.NoError(t, err)
+
+				schematic, err := client.Management().CreateSchematic(ctx, &management.CreateSchematicRequest{})
+				require.NoError(t, err)
+
+				u.Path, err = url.JoinPath(u.Path, "image", schematic.SchematicId, clientconsts.DefaultTalosVersion, image.Metadata().ID())
+				require.NoError(t, err)
+
+				req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
+				require.NoError(t, err)
+
+				require.NoError(t, signer(ctx, req))
+
+				resp, err := http.DefaultClient.Do(req)
+				require.NoError(t, err)
+
+				require.Equal(t, http.StatusOK, resp.StatusCode)
+
+				n, err := io.Copy(io.Discard, resp.Body)
+				require.NoError(t, err)
+
+				require.Greater(t, n, int64(1024*1024))
+
+				require.NoError(t, resp.Body.Close())
+			})
+		}
+	}
+}
diff --git a/cmd/omni-integration-test/pkg/tests/kubernetes.go b/cmd/omni-integration-test/pkg/tests/kubernetes.go
new file mode 100644
index 000000000..b5ef9ca35
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/kubernetes.go
@@ -0,0 +1,520 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/go-pointer"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	kubeerrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/clientcmd"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+
+	managementpb "github.com/siderolabs/omni/client/api/omni/management"
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/client/management"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// AssertKubernetesAPIAccessViaOmni verifies that cluster kubeconfig works.
+func AssertKubernetesAPIAccessViaOmni(testCtx context.Context, rootClient *client.Client, clusterName string, assertAllNodesReady bool, timeout time.Duration) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, timeout)
+		defer cancel()
+
+		require := require.New(t)
+		assert := assert.New(t)
+
+		client := getKubernetesClient(ctx, t, rootClient.Management(), clusterName)
+
+		nodes, err := client.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
+		require.NoError(err)
+
+		if assertAllNodesReady {
+			numMachines := len(rtestutils.ResourceIDs[*omni.ClusterMachine](ctx, t, rootClient.Omni().State(), state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName))))
+			assert.Equal(numMachines, len(nodes.Items))
+		}
+
+		isNodeReady := func(node corev1.Node) bool {
+			for _, condition := range node.Status.Conditions {
+				if condition.Type == corev1.NodeReady {
+					return true
+				}
+			}
+
+			return false
+		}
+
+		for _, node := range nodes.Items {
+			ready := isNodeReady(node)
+
+			if assertAllNodesReady {
+				assert.True(ready, "node %q is not ready", node.Name)
+			}
+
+			if ready {
+				var (
+					label string
+					ok    bool
+				)
+
+				assert.NoError(retry.Constant(time.Second*30).RetryWithContext(ctx, func(ctx context.Context) error {
+					label, ok = node.Labels[nodeLabel]
+					if !ok {
+						var n *corev1.Node
+
+						n, err = client.CoreV1().Nodes().Get(ctx, node.Name, metav1.GetOptions{})
+						if err != nil {
+							return err
+						}
+
+						node = *n
+
+						return retry.ExpectedErrorf("the label %s is not set", nodeLabel)
+					}
+
+					return nil
+				}))
+
+				assert.True(ok)
+				assert.NotEmpty(label)
+			}
+		}
+	}
+}
+
+// AssertKubernetesUpgradeFlow verifies Kubernetes upgrade flow.
+//
+// TODO: machine set locking should be in a separate test.
+func AssertKubernetesUpgradeFlow(testCtx context.Context, st state.State, managementClient *management.Client, clusterName string, kubernetesVersion string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 15*time.Minute)
+		defer cancel()
+
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{clusterName}, func(r *omni.KubernetesUpgradeStatus, assert *assert.Assertions) {
+			// there is an upgrade path
+			assert.Contains(r.TypedSpec().Value.UpgradeVersions, kubernetesVersion, resourceDetails(r))
+		})
+
+		t.Logf("running pre-checks for upgrade of %q to %q", clusterName, kubernetesVersion)
+
+		require.NoError(t, managementClient.WithCluster(clusterName).KubernetesUpgradePreChecks(ctx, kubernetesVersion))
+
+		t.Logf("upgrading cluster %q to %q", clusterName, kubernetesVersion)
+
+		machineSetNodes, err := safe.StateListAll[*omni.MachineSetNode](ctx, st, state.WithLabelQuery(
+			resource.LabelEqual(omni.LabelMachineSet, omni.WorkersResourceID(clusterName)),
+		))
+		require.NoError(t, err)
+		require.True(t, machineSetNodes.Len() > 0)
+
+		// lock a machine in the machine set
+		_, err = safe.StateUpdateWithConflicts(ctx, st, machineSetNodes.Get(0).Metadata(), func(res *omni.MachineSetNode) error {
+			res.Metadata().Annotations().Set(omni.MachineLocked, "")
+
+			return nil
+		})
+		require.NoError(t, err)
+
+		// trigger an upgrade
+		_, err = safe.StateUpdateWithConflicts(ctx, st, omni.NewCluster(resources.DefaultNamespace, clusterName).Metadata(), func(cluster *omni.Cluster) error {
+			cluster.TypedSpec().Value.KubernetesVersion = kubernetesVersion
+
+			return nil
+		})
+		require.NoError(t, err)
+
+		// upgrade should start
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{clusterName}, func(r *omni.KubernetesUpgradeStatus, assert *assert.Assertions) {
+			assert.Equal(specs.KubernetesUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Phase, resourceDetails(r))
+			assert.NotEmpty(specs.KubernetesUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Step, resourceDetails(r))
+			assert.NotEmpty(specs.KubernetesUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Status, resourceDetails(r))
+		})
+
+		t.Log("waiting until upgrade reaches the locked machine")
+
+		// upgrade should start
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{clusterName}, func(r *omni.KubernetesUpgradeStatus, assert *assert.Assertions) {
+			assert.Equal(specs.KubernetesUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Phase, resourceDetails(r))
+			assert.NotEmpty(specs.KubernetesUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Step, resourceDetails(r))
+			assert.Contains(r.TypedSpec().Value.Status, "locked", resourceDetails(r))
+		})
+
+		// lock a machine in the machine set
+		_, err = safe.StateUpdateWithConflicts(ctx, st, machineSetNodes.Get(0).Metadata(), func(res *omni.MachineSetNode) error {
+			res.Metadata().Annotations().Delete(omni.MachineLocked)
+
+			return nil
+		})
+		require.NoError(t, err)
+
+		t.Log("upgrade is going")
+
+		// upgrade should finish successfully
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{clusterName}, func(r *omni.KubernetesUpgradeStatus, assert *assert.Assertions) {
+			assert.Equal(specs.KubernetesUpgradeStatusSpec_Done, r.TypedSpec().Value.Phase, resourceDetails(r))
+			assert.Equal(kubernetesVersion, r.TypedSpec().Value.LastUpgradeVersion, resourceDetails(r))
+			assert.Empty(r.TypedSpec().Value.Step, resourceDetails(r))
+		})
+
+		// validate that all components are on the expected version
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{clusterName}, func(r *omni.KubernetesStatus, assert *assert.Assertions) {
+			for _, node := range r.TypedSpec().Value.Nodes {
+				assert.Equal(kubernetesVersion, node.KubeletVersion, resourceDetails(r))
+				assert.True(node.Ready, resourceDetails(r))
+			}
+
+			for _, nodePods := range r.TypedSpec().Value.StaticPods {
+				for _, pod := range nodePods.StaticPods {
+					assert.Equal(kubernetesVersion, pod.Version, resourceDetails(r))
+					assert.True(pod.Ready, resourceDetails(r))
+				}
+			}
+		})
+
+		KubernetesBootstrapManifestSync(ctx, managementClient, clusterName)(t)
+	}
+}
+
+// KubernetesBootstrapManifestSync syncs kubernetes bootstrap manifests.
+func KubernetesBootstrapManifestSync(testCtx context.Context, managementClient *management.Client, clusterName string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 15*time.Minute)
+		defer cancel()
+
+		t.Logf("running bootstrap manifest sync for %q", clusterName)
+
+		syncHandler := func(result *managementpb.KubernetesSyncManifestResponse) error {
+			switch result.ResponseType { //nolint:exhaustive
+			case managementpb.KubernetesSyncManifestResponse_MANIFEST:
+				if result.Skipped {
+					return nil
+				}
+
+				t.Logf("syncing manifest %q:\n%s\n", result.Path, result.Diff)
+			case managementpb.KubernetesSyncManifestResponse_ROLLOUT:
+				t.Logf("waiting for rolling out of %q", result.Path)
+			}
+
+			return nil
+		}
+
+		require.NoError(t, managementClient.WithCluster(clusterName).KubernetesSyncManifests(ctx, false, syncHandler))
+	}
+}
+
+// AssertKubernetesUpgradeIsRevertible verifies reverting a failed Kubernetes upgrade.
+func AssertKubernetesUpgradeIsRevertible(testCtx context.Context, st state.State, clusterName string, currentKubernetesVersion string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 5*time.Minute)
+		defer cancel()
+
+		badKubernetesVersion := currentKubernetesVersion + "-bad"
+
+		t.Logf("attempting an upgrade of cluster %q to %q", clusterName, badKubernetesVersion)
+
+		// trigger an upgrade to a bad version
+		_, err := safe.StateUpdateWithConflicts(ctx, st, omni.NewCluster(resources.DefaultNamespace, clusterName).Metadata(), func(cluster *omni.Cluster) error {
+			cluster.Metadata().Annotations().Set(constants.DisableValidation, "")
+
+			cluster.TypedSpec().Value.KubernetesVersion = badKubernetesVersion
+
+			return nil
+		})
+		require.NoError(t, err)
+
+		// upgrade should start
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{clusterName}, func(r *omni.KubernetesUpgradeStatus, assert *assert.Assertions) {
+			assert.Equal(specs.KubernetesUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Phase, resourceDetails(r))
+			assert.NotEmpty(specs.KubernetesUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Step, resourceDetails(r))
+			assert.NotEmpty(specs.KubernetesUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Status, resourceDetails(r))
+			assert.Equal(currentKubernetesVersion, r.TypedSpec().Value.LastUpgradeVersion, resourceDetails(r))
+		})
+
+		// verify that the upgrade took one API server down
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{clusterName}, func(r *omni.KubernetesStatus, assert *assert.Assertions) {
+			var notReadyAPIServers int
+
+			for _, nodePods := range r.TypedSpec().Value.StaticPods {
+				for _, pod := range nodePods.StaticPods {
+					if pod.App == "kube-apiserver" && !pod.Ready {
+						notReadyAPIServers++
+					}
+				}
+			}
+
+			assert.Equal(1, notReadyAPIServers)
+		})
+
+		t.Log("revert an upgrade")
+
+		_, err = safe.StateUpdateWithConflicts(ctx, st, omni.NewCluster(resources.DefaultNamespace, clusterName).Metadata(), func(cluster *omni.Cluster) error {
+			cluster.TypedSpec().Value.KubernetesVersion = currentKubernetesVersion
+
+			return nil
+		})
+		require.NoError(t, err)
+
+		// upgrade should be reverted
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{clusterName}, func(r *omni.KubernetesUpgradeStatus, assert *assert.Assertions) {
+			assert.Equal(specs.KubernetesUpgradeStatusSpec_Done, r.TypedSpec().Value.Phase, resourceDetails(r))
+			assert.Equal(currentKubernetesVersion, r.TypedSpec().Value.LastUpgradeVersion, resourceDetails(r))
+			assert.Empty(r.TypedSpec().Value.Step, resourceDetails(r))
+		})
+
+		// validate that all components are on the expected version
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{clusterName}, func(r *omni.KubernetesStatus, assert *assert.Assertions) {
+			for _, node := range r.TypedSpec().Value.Nodes {
+				assert.Equal(currentKubernetesVersion, node.KubeletVersion, resourceDetails(r))
+				assert.True(node.Ready, resourceDetails(r))
+			}
+
+			for _, nodePods := range r.TypedSpec().Value.StaticPods {
+				for _, pod := range nodePods.StaticPods {
+					assert.Equal(currentKubernetesVersion, pod.Version, resourceDetails(r))
+					assert.True(pod.Ready, resourceDetails(r))
+				}
+			}
+		})
+	}
+}
+
+// AssertKubernetesDeploymentIsCreated verifies that a test deployment either already exists or otherwise gets created.
+func AssertKubernetesDeploymentIsCreated(testCtx context.Context, managementClient *management.Client, clusterName, ns, name string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 120*time.Second)
+		defer cancel()
+
+		kubeClient := getKubernetesClient(ctx, t, managementClient, clusterName)
+
+		deployment := appsv1.Deployment{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: name,
+			},
+			Spec: appsv1.DeploymentSpec{
+				Replicas: pointer.To(int32(1)),
+				Selector: &metav1.LabelSelector{
+					MatchLabels: map[string]string{
+						"app": name,
+					},
+				},
+				Template: corev1.PodTemplateSpec{
+					ObjectMeta: metav1.ObjectMeta{
+						Labels: map[string]string{
+							"app": name,
+						},
+					},
+					Spec: corev1.PodSpec{
+						TerminationGracePeriodSeconds: pointer.To(int64(0)),
+						Containers: []corev1.Container{{
+							Name:  name,
+							Image: "busybox:1",
+							// sleep forever
+							Command: []string{
+								"sh",
+								"-c",
+								"while true; do echo 'hello'; sleep 1; done",
+							},
+						}},
+					},
+				},
+			},
+		}
+
+		_, err := kubeClient.AppsV1().Deployments(ns).Create(ctx, &deployment, metav1.CreateOptions{})
+		if !kubeerrors.IsAlreadyExists(err) {
+			require.NoError(t, err)
+		}
+	}
+}
+
+// AssertKubernetesSecretIsCreated verifies that a test secret either already exists or otherwise gets created.
+func AssertKubernetesSecretIsCreated(testCtx context.Context, managementClient *management.Client, clusterName, ns, name, testValue string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 120*time.Second)
+		defer cancel()
+
+		kubeClient := getKubernetesClient(ctx, t, managementClient, clusterName)
+
+		valBase64 := base64.StdEncoding.EncodeToString([]byte(testValue))
+
+		secret := corev1.Secret{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: name,
+			},
+			Data: map[string][]byte{
+				"test-key": []byte(valBase64),
+			},
+		}
+
+		_, err := kubeClient.CoreV1().Secrets(ns).Create(ctx, &secret, metav1.CreateOptions{})
+		require.NoError(t, err, "failed to create secret")
+	}
+}
+
+// AssertKubernetesSecretHasValue verifies that a test secret has a specific value.
+func AssertKubernetesSecretHasValue(testCtx context.Context, managementClient *management.Client, clusterName, ns, name, expectedValue string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 120*time.Second)
+		defer cancel()
+
+		kubeClient := getKubernetesClient(ctx, t, managementClient, clusterName)
+
+		secret, err := kubeClient.CoreV1().Secrets(ns).Get(ctx, name, metav1.GetOptions{})
+		require.NoError(t, err, "failed to get secret")
+
+		actualValBase64, ok := secret.Data["test-key"]
+		require.True(t, ok, "secret does not have test-key")
+
+		expectedValBase64 := base64.StdEncoding.EncodeToString([]byte(expectedValue))
+
+		assert.Equal(t, expectedValBase64, string(actualValBase64))
+	}
+}
+
+// AssertKubernetesNodesState asserts two things for the given new cluster name:
+// 1. Omni cluster machines match exactly the Kubernetes nodes that are in Ready state
+// 2. All the extra (stale) Kubernetes nodes are in NotReady state
+//
+// This assertion is useful to assert the expected nodes state when a cluster is created from an etcd backup.
+func AssertKubernetesNodesState(ctx context.Context, rootClient *client.Client, newClusterName string) func(t *testing.T) {
+	return func(t *testing.T) {
+		identityList, err := safe.StateListAll[*omni.ClusterMachineIdentity](ctx, rootClient.Omni().State(), state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, newClusterName)))
+		require.NoError(t, err)
+
+		expectedReadyNodeNames, err := safe.Map(identityList, func(cm *omni.ClusterMachineIdentity) (string, error) {
+			return cm.TypedSpec().Value.GetNodename(), nil
+		})
+		require.NoError(t, err)
+
+		expectedReadyNodeNameSet := xslices.ToSet(expectedReadyNodeNames)
+
+		nodeIsReady := func(node corev1.Node) bool {
+			for _, condition := range node.Status.Conditions {
+				if condition.Type == corev1.NodeReady && condition.Status == corev1.ConditionTrue {
+					return true
+				}
+			}
+
+			return false
+		}
+
+		kubeClient := getKubernetesClient(ctx, t, rootClient.Management(), newClusterName)
+
+		require.EventuallyWithT(t, func(collect *assert.CollectT) {
+			kubernetesNodes, listErr := kubeClient.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
+			require.NoError(collect, listErr)
+
+			validNotReadyNodes := make([]string, 0, len(expectedReadyNodeNames))
+			extraReadyNodes := make([]string, 0, len(expectedReadyNodeNames))
+
+			for _, kubernetesNode := range kubernetesNodes.Items {
+				ready := nodeIsReady(kubernetesNode)
+				_, valid := expectedReadyNodeNameSet[kubernetesNode.Name]
+
+				if !valid && ready {
+					extraReadyNodes = append(extraReadyNodes, kubernetesNode.Name)
+				} else if valid && !ready {
+					validNotReadyNodes = append(validNotReadyNodes, kubernetesNode.Name)
+				}
+			}
+
+			if !assert.Empty(collect, extraReadyNodes, "Kubernetes has extra Ready nodes") {
+				t.Logf("extra ready nodes: %q", extraReadyNodes)
+			}
+
+			if !assert.Empty(collect, validNotReadyNodes, "Kubernetes has valid NotReady nodes") {
+				t.Logf("valid but not ready nodes: %q", validNotReadyNodes)
+			}
+		}, 2*time.Minute, 1*time.Second, "Kubernetes nodes should be in desired state")
+	}
+}
+
+// AssertKubernetesDeploymentHasRunningPods verifies that a deployment has running pods.
+func AssertKubernetesDeploymentHasRunningPods(ctx context.Context, managementClient *management.Client, clusterName, ns, name string) TestFunc {
+	return func(t *testing.T) {
+		deps := getKubernetesClient(ctx, t, managementClient, clusterName).AppsV1().Deployments(ns)
+
+		// restart the deployment, in case the pod is scheduled on a NotReady node (a node that is no longer valid, which was restored from an etcd backup)
+		require.EventuallyWithT(t, func(collect *assert.CollectT) {
+			deployment, err := deps.Get(ctx, name, metav1.GetOptions{})
+			if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+				require.NoError(collect, err)
+			}
+
+			if !assert.NoError(collect, err) {
+				t.Logf("failed to get deployment %q/%q: %q", ns, name, err)
+
+				return
+			}
+
+			if deployment.Spec.Template.ObjectMeta.Annotations == nil {
+				deployment.Spec.Template.ObjectMeta.Annotations = map[string]string{}
+			}
+
+			deployment.Spec.Template.ObjectMeta.Annotations["kubectl.kubernetes.io/restartedAt"] = time.Now().Format(time.RFC3339)
+
+			if _, err = deps.Update(ctx, deployment, metav1.UpdateOptions{}); !assert.NoError(collect, err) {
+				t.Logf("failed to update deployment %q/%q: %q", ns, name, err)
+			}
+		}, 2*time.Minute, 1*time.Second)
+
+		// assert that deployment has a running (Ready) pod
+		require.EventuallyWithT(t, func(collect *assert.CollectT) {
+			deployment, err := deps.Get(ctx, name, metav1.GetOptions{})
+			if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+				require.NoError(collect, err)
+			}
+
+			if !assert.NoError(collect, err) {
+				t.Logf("failed to get deployment %q/%q: %q", ns, name, err)
+
+				return
+			}
+
+			if !assert.Greater(collect, deployment.Status.ReadyReplicas, int32(0)) {
+				t.Logf("deployment %q/%q has no ready replicas", ns, name)
+			}
+		}, 2*time.Minute, 1*time.Second)
+	}
+}
+
+func getKubernetesClient(ctx context.Context, t *testing.T, managementClient *management.Client, clusterName string) *kubernetes.Clientset {
+	// use service account kubeconfig to bypass oidc flow
+	kubeconfigBytes, err := managementClient.WithCluster(clusterName).Kubeconfig(ctx,
+		management.WithServiceAccount(24*time.Hour, "integration-test", constants.DefaultAccessGroup),
+	)
+	require.NoError(t, err)
+
+	kubeconfig, err := clientcmd.BuildConfigFromKubeconfigGetter("", func() (*clientcmdapi.Config, error) {
+		return clientcmd.Load(kubeconfigBytes)
+	})
+	require.NoError(t, err)
+
+	cli, err := kubernetes.NewForConfig(kubeconfig)
+	require.NoError(t, err)
+
+	return cli
+}
diff --git a/cmd/omni-integration-test/pkg/tests/machines.go b/cmd/omni-integration-test/pkg/tests/machines.go
new file mode 100644
index 000000000..3d9c46b3e
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/machines.go
@@ -0,0 +1,270 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/siderolabs/omni/client/pkg/client/management"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+)
+
+// AssertMachineStatus verifies that all machines have their MachineStatus populated.
+func AssertMachineStatus(testCtx context.Context, st state.State, shouldMaintenance bool, clusterName string, expectedLabels map[string]string, deniedLabels []string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 120*time.Second)
+		defer cancel()
+
+		var (
+			opts []state.ListOption
+			ids  = rtestutils.ResourceIDs[*omni.Machine](ctx, t, st)
+		)
+
+		if clusterName != "" {
+			opts = append(opts, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)))
+			ids = rtestutils.ResourceIDs[*omni.MachineSetNode](ctx, t, st, opts...)
+		}
+
+		rtestutils.AssertResources(ctx, t, st,
+			ids,
+			func(machineStatus *omni.MachineStatus, assert *assert.Assertions) {
+				spec := machineStatus.TypedSpec().Value
+
+				assert.NotEmpty(spec.ManagementAddress, resourceDetails(machineStatus))
+				assert.True(spec.Connected, resourceDetails(machineStatus))
+				assert.Equal(shouldMaintenance, spec.Maintenance, resourceDetails(machineStatus))
+				assert.Empty(spec.LastError, resourceDetails(machineStatus))
+
+				assert.NotEmpty(spec.TalosVersion, resourceDetails(machineStatus))
+
+				assert.NotEmpty(spec.GetNetwork().GetHostname(), resourceDetails(machineStatus))
+				assert.NotEmpty(spec.GetNetwork().GetAddresses(), resourceDetails(machineStatus))
+				assert.NotEmpty(spec.GetNetwork().GetDefaultGateways(), resourceDetails(machineStatus))
+				assert.NotEmpty(spec.GetNetwork().GetNetworkLinks(), resourceDetails(machineStatus))
+
+				assert.NotEmpty(spec.GetHardware().GetBlockdevices(), resourceDetails(machineStatus))
+				assert.NotEmpty(spec.GetHardware().GetMemoryModules(), resourceDetails(machineStatus))
+				assert.NotEmpty(spec.GetHardware().GetProcessors(), resourceDetails(machineStatus))
+
+				for k, v := range expectedLabels {
+					lv, ok := machineStatus.Metadata().Labels().Get(k)
+					assert.True(ok, "label %q is not set: %s", k, resourceDetails(machineStatus))
+					assert.Equal(v, lv, "label %q has unexpected value: %q != %q: %s", k, v, lv, resourceDetails(machineStatus))
+				}
+
+				for _, k := range deniedLabels {
+					_, ok := machineStatus.Metadata().Labels().Get(k)
+					assert.False(ok, "label %q is set: %s", k, resourceDetails(machineStatus))
+				}
+			}, rtestutils.WithReportInterval(time.Second*5))
+	}
+}
+
+// AssertMachinesHaveLogs verifies that all machines have their kernel logs coming.
+func AssertMachinesHaveLogs(testCtx context.Context, st state.State, managementClient *management.Client) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 20*time.Second)
+		defer cancel()
+
+		machineIDs := rtestutils.ResourceIDs[*omni.Machine](ctx, t, st)
+
+		eg, ctx := errgroup.WithContext(ctx)
+
+		for _, machineID := range machineIDs {
+			eg.Go(func() error {
+				return retry.Constant(time.Second*20, retry.WithUnits(time.Second)).RetryWithContext(ctx, func(ctx context.Context) error {
+					logR, err := managementClient.LogsReader(ctx, machineID, true, -1)
+					if err != nil {
+						return retry.ExpectedError(err)
+					}
+
+					bufR := bufio.NewReader(logR)
+
+					line, err := bufR.ReadBytes('\n')
+					if err != nil {
+						return retry.ExpectedError(err)
+					}
+
+					line = bytes.TrimSpace(line)
+
+					if len(line) == 0 {
+						return retry.ExpectedErrorf("empty log line")
+					}
+
+					var msg map[string]any
+
+					return json.Unmarshal(line, &msg)
+				})
+			})
+		}
+
+		assert.NoError(t, eg.Wait())
+	}
+}
+
+// AssertUnallocatedMachineDestroyFlow destroys a siderolink.Link resource and verifies that unallocated Machine is removed.
+//
+// Once the Machine is removed, it reboots the VM and asserts that machine re-registers itself.
+func AssertUnallocatedMachineDestroyFlow(testCtx context.Context, st state.State, restartAMachineFunc RestartAMachineFunc) TestFunc {
+	return func(t *testing.T) {
+		if restartAMachineFunc == nil {
+			t.Skip("restartAMachineFunc is nil")
+		}
+
+		ctx, cancel := context.WithTimeout(testCtx, 90*time.Second)
+		defer cancel()
+
+		require := require.New(t)
+
+		pickUnallocatedMachines(ctx, t, st, 1, func(machineIDs []string) {
+			rtestutils.Destroy[*siderolink.Link](ctx, t, st, machineIDs)
+
+			rtestutils.AssertNoResource[*omni.Machine](ctx, t, st, machineIDs[0])
+			rtestutils.AssertNoResource[*omni.MachineStatus](ctx, t, st, machineIDs[0])
+
+			// reboot a machine
+			require.NoError(restartAMachineFunc(ctx, machineIDs[0]))
+
+			// machine should re-register and become available
+			rtestutils.AssertResources(ctx, t, st, machineIDs, func(machine *omni.MachineStatus, assert *assert.Assertions) {
+				_, ok := machine.Metadata().Labels().Get(omni.MachineStatusLabelAvailable)
+				assert.True(ok)
+			})
+		})
+	}
+}
+
+// AssertForceRemoveWorkerNode destroys a Link for the worker node and verifies that allocated Machine is removed as part of a cluster.
+//
+// The VM is wiped & rebooted to bring it back as an available machine.
+func AssertForceRemoveWorkerNode(testCtx context.Context, st state.State, clusterName string, freezeAMachineFunc FreezeAMachineFunc, wipeAMachineFunc WipeAMachineFunc) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 90*time.Second)
+		defer cancel()
+
+		if wipeAMachineFunc == nil {
+			t.Skip("wipeAMachineFunc is nil")
+		}
+
+		if freezeAMachineFunc == nil {
+			t.Skip("freezeAMachineFunc is nil")
+		}
+
+		id := freezeMachine(ctx, t, st, clusterName, freezeAMachineFunc, omni.LabelWorkerRole)
+
+		wipeMachine(ctx, t, st, id, wipeAMachineFunc)
+	}
+}
+
+// AssertControlPlaneForceReplaceMachine freezes a control plane machine, scales controlplane by one, destroys and wipes frozen machine.
+//
+// If the controlplane had 3 machines, and one is frozen, the fourth machine can't be added until a etcd member
+// is removed.
+// The VM is wiped & rebooted to bring it back as an available machine.
+func AssertControlPlaneForceReplaceMachine(testCtx context.Context, st state.State, clusterName string, options Options) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 90*time.Second)
+		defer cancel()
+
+		if options.WipeAMachineFunc == nil {
+			t.Skip("wipeAMachineFunc is nil")
+		}
+
+		if options.FreezeAMachineFunc == nil {
+			t.Skip("freezeAMachineFunc is nil")
+		}
+
+		id := freezeMachine(ctx, t, st, clusterName, options.FreezeAMachineFunc, omni.LabelControlPlaneRole)
+
+		pickUnallocatedMachines(ctx, t, st, 1, func(machineIDs []resource.ID) {
+			t.Logf("Adding machine '%s' to control plane", machineIDs[0])
+
+			bindMachine(ctx, t, st, bindMachineOptions{
+				clusterName: clusterName,
+				role:        omni.LabelControlPlaneRole,
+				machineID:   machineIDs[0],
+			})
+
+			// assert that machines got allocated (label available is removed)
+			rtestutils.AssertResources(ctx, t, st, machineIDs, func(machineStatus *omni.MachineStatus, assert *assert.Assertions) {
+				assert.True(machineStatus.Metadata().Labels().Matches(
+					resource.LabelTerm{
+						Key:    omni.MachineStatusLabelAvailable,
+						Op:     resource.LabelOpExists,
+						Invert: true,
+					},
+				), resourceDetails(machineStatus))
+			})
+		})
+
+		wipeMachine(ctx, t, st, id, options.WipeAMachineFunc)
+	}
+}
+
+// freezeMachinesOfType freezes all machines of a given type.
+func freezeMachinesOfType(ctx context.Context, t *testing.T, st state.State, clusterName string, freezeAMachineFunc FreezeAMachineFunc, machineType string) []string {
+	machineIDSet := rtestutils.ResourceIDs[*omni.MachineSetNode](ctx, t, st, state.WithLabelQuery(
+		resource.LabelEqual(omni.LabelCluster, clusterName),
+		resource.LabelExists(machineType),
+	))
+	require.NotEmpty(t, machineIDSet)
+
+	for _, machineID := range machineIDSet {
+		require.NoError(t, freezeAMachineFunc(ctx, machineID))
+	}
+
+	return machineIDSet
+}
+
+// freezeMachine freezes the VM CPU, which simulates a hardware failure.
+func freezeMachine(ctx context.Context, t *testing.T, st state.State, clusterName string, freezeAMachineFunc FreezeAMachineFunc, machineType string) string {
+	require := require.New(t)
+
+	machineIDs := rtestutils.ResourceIDs[*omni.MachineSetNode](ctx, t, st, state.WithLabelQuery(
+		resource.LabelEqual(omni.LabelCluster, clusterName),
+		resource.LabelExists(machineType),
+	))
+
+	require.NotEmpty(machineIDs)
+
+	// freeze a machine to simulate hardware failure
+	require.NoError(freezeAMachineFunc(ctx, machineIDs[0]))
+
+	return machineIDs[0]
+}
+
+func wipeMachine(ctx context.Context, t *testing.T, st state.State, id string, wipeAMachineFunc WipeAMachineFunc) {
+	// force delete a machine
+	rtestutils.Teardown[*siderolink.Link](ctx, t, st, []string{id})
+	rtestutils.Destroy[*omni.MachineSetNode](ctx, t, st, []string{id})
+	rtestutils.Destroy[*siderolink.Link](ctx, t, st, []string{id})
+
+	// now machine should be removed
+	rtestutils.AssertNoResource[*omni.Machine](ctx, t, st, id)
+	rtestutils.AssertNoResource[*omni.ClusterMachine](ctx, t, st, id)
+
+	// wipe and reboot a machine
+	require.NoError(t, wipeAMachineFunc(ctx, id))
+
+	// machine should re-register
+	rtestutils.AssertResources(ctx, t, st, []string{id}, func(*omni.Machine, *assert.Assertions) {})
+
+	t.Logf("Wiped the machine '%s'", id)
+}
diff --git a/cmd/omni-integration-test/pkg/tests/omniconfig.go b/cmd/omni-integration-test/pkg/tests/omniconfig.go
new file mode 100644
index 000000000..9f62f1e2f
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/omniconfig.go
@@ -0,0 +1,30 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/pkg/client"
+)
+
+// AssertOmniconfigDownload verifies getting Omni client configuration (omniconfig).
+func AssertOmniconfigDownload(testCtx context.Context, client *client.Client) TestFunc {
+	return func(t *testing.T) {
+		req := require.New(t)
+
+		ctx, cancel := context.WithTimeout(testCtx, 10*time.Second)
+		defer cancel()
+
+		data, err := client.Management().Omniconfig(ctx)
+		req.NoError(err)
+		req.NotEmpty(data)
+	}
+}
diff --git a/cmd/omni-integration-test/pkg/tests/rolling_update.go b/cmd/omni-integration-test/pkg/tests/rolling_update.go
new file mode 100644
index 000000000..3bb31aab7
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/rolling_update.go
@@ -0,0 +1,193 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/pair"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// AssertWorkerNodesRollingConfigUpdate tests that config patch rollout parallelism is respected.
+// Example: if there are five workers and the rollout parallelism is 2, then at most two workers should be rebooting at the same time,
+// and it should be rolled out to all the workers.
+func AssertWorkerNodesRollingConfigUpdate(testCtx context.Context, cli *client.Client, clusterName string, maxParallelism int) TestFunc {
+	return func(t *testing.T) {
+		require.GreaterOrEqual(t, maxParallelism, 2, "maxParallelism should be greater or equal to 2 for the test to be meaningful")
+
+		st := cli.Omni().State()
+		workersResourceID := omni.WorkersResourceID(clusterName)
+
+		clusterMachineList, err := safe.StateListAll[*omni.ClusterMachine](testCtx, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelMachineSet, workersResourceID)))
+		require.NoError(t, err)
+
+		require.Greater(t, clusterMachineList.Len(), maxParallelism, "number of machine in the worker machine set must to be greater than maxParallelism")
+
+		timeoutDuration := time.Duration(clusterMachineList.Len()) * time.Minute
+
+		ctx, cancel := context.WithTimeout(testCtx, timeoutDuration+1*time.Minute)
+		t.Cleanup(cancel)
+
+		// update worker machine set to have rolling update with specified max parallelism
+		_, err = safe.StateUpdateWithConflicts[*omni.MachineSet](ctx, st, omni.NewMachineSet(resources.DefaultNamespace, workersResourceID).Metadata(), func(ms *omni.MachineSet) error {
+			ms.TypedSpec().Value.UpdateStrategy = specs.MachineSetSpec_Rolling
+			ms.TypedSpec().Value.UpdateStrategyConfig = &specs.MachineSetSpec_UpdateStrategyConfig{
+				Rolling: &specs.MachineSetSpec_RollingUpdateStrategyConfig{
+					MaxParallelism: uint32(maxParallelism),
+				},
+			}
+
+			return nil
+		})
+		require.NoError(t, err)
+
+		// create reboot-requiring config patch for the machine set
+		epochSeconds := time.Now().Unix()
+		machineSetPatch := omni.NewConfigPatch(resources.DefaultNamespace,
+			fmt.Sprintf("000-test-update-parallelism-%d", epochSeconds),
+			pair.MakePair(omni.LabelCluster, clusterName),
+			pair.MakePair(omni.LabelMachineSet, workersResourceID))
+
+		machineSetPatch.TypedSpec().Value.Data = fmt.Sprintf(`{"machine":{"env":{"%d":"test-val"}}}`, epochSeconds)
+
+		require.NoError(t, st.Create(ctx, machineSetPatch))
+
+		// expect the machine set to go into the reconfiguring phase
+		rtestutils.AssertResource(ctx, t, st, omni.WorkersResourceID(clusterName), func(ms *omni.MachineSetStatus, assertion *assert.Assertions) {
+			assertion.Equal(specs.MachineSetPhase_Reconfiguring, ms.TypedSpec().Value.GetPhase())
+		})
+
+		maxRebootingAtOnce := 0
+		rebootedIDs := make(map[string]struct{})
+
+		require.EventuallyWithT(t, func(collect *assert.CollectT) {
+			machineStatusList, err := safe.StateListAll[*omni.ClusterMachineStatus](ctx, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelMachineSet, workersResourceID)))
+			require.NoError(t, err)
+
+			numRebooting := 0
+
+			machineStatusList.ForEach(func(machineStatus *omni.ClusterMachineStatus) {
+				stage := machineStatus.TypedSpec().Value.GetStage()
+
+				assert.Equal(collect, specs.ClusterMachineStatusSpec_RUNNING, stage)
+				assert.Equal(collect, specs.ConfigApplyStatus_APPLIED, machineStatus.TypedSpec().Value.GetConfigApplyStatus())
+
+				if stage == specs.ClusterMachineStatusSpec_REBOOTING {
+					rebootedIDs[machineStatus.Metadata().ID()] = struct{}{}
+					numRebooting++
+				}
+			})
+
+			if numRebooting > maxRebootingAtOnce {
+				maxRebootingAtOnce = numRebooting
+			}
+		}, timeoutDuration, 1*time.Second)
+
+		assert.Len(t, rebootedIDs, clusterMachineList.Len(), "expected all the machines to be rebooted")
+		assert.Equal(t, maxParallelism, maxRebootingAtOnce, "expected a maximum of %d machines to be rebooting at the same time", maxParallelism)
+
+		// wait for the machine set to go back into the running phase
+		rtestutils.AssertResource(ctx, t, st, omni.WorkersResourceID(clusterName), func(ms *omni.MachineSetStatus, assertion *assert.Assertions) {
+			assertion.Equal(specs.MachineSetPhase_Running, ms.TypedSpec().Value.GetPhase())
+		})
+	}
+}
+
+// AssertWorkerNodesRollingScaleDown tests that config patch rollout parallelism is respected.
+// Example: if there are five workers and the rollout parallelism is 2, then at most two workers should be rebooting at the same time,
+// and it should be rolled out to all the workers.
+func AssertWorkerNodesRollingScaleDown(testCtx context.Context, cli *client.Client, clusterName string, maxParallelism int) TestFunc {
+	return func(t *testing.T) {
+		st := cli.Omni().State()
+		workersResourceID := omni.WorkersResourceID(clusterName)
+
+		machineSetNodeList, err := safe.StateListAll[*omni.MachineSetNode](testCtx, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelMachineSet, workersResourceID)))
+		require.NoError(t, err)
+
+		require.Greater(t, machineSetNodeList.Len(), maxParallelism, "number of machines in the worker machine set must to be greater than maxParallelism")
+
+		timeoutDuration := time.Duration(machineSetNodeList.Len()) * time.Minute
+
+		ctx, cancel := context.WithTimeout(testCtx, timeoutDuration+1*time.Minute)
+		t.Cleanup(cancel)
+
+		// update worker machine set to have rolling update max parallelism of 2
+		_, err = safe.StateUpdateWithConflicts[*omni.MachineSet](ctx, st, omni.NewMachineSet(resources.DefaultNamespace, workersResourceID).Metadata(), func(ms *omni.MachineSet) error {
+			ms.TypedSpec().Value.DeleteStrategy = specs.MachineSetSpec_Rolling
+			ms.TypedSpec().Value.DeleteStrategyConfig = &specs.MachineSetSpec_UpdateStrategyConfig{
+				Rolling: &specs.MachineSetSpec_RollingUpdateStrategyConfig{
+					MaxParallelism: uint32(maxParallelism),
+				},
+			}
+
+			return nil
+		})
+		require.NoError(t, err)
+
+		// remove all workers without blocking
+		var wg sync.WaitGroup
+
+		t.Cleanup(wg.Wait)
+
+		machineSetNodeList.ForEach(func(node *omni.MachineSetNode) {
+			wg.Add(1)
+
+			go func() {
+				defer wg.Done()
+
+				rtestutils.Destroy[*omni.MachineSetNode](ctx, t, st, []string{node.Metadata().ID()})
+			}()
+		})
+
+		// expect the machine set to go into the ScalingDown phase
+		rtestutils.AssertResource(ctx, t, st, omni.WorkersResourceID(clusterName), func(ms *omni.MachineSetStatus, assertion *assert.Assertions) {
+			assertion.Equal(specs.MachineSetPhase_ScalingDown, ms.TypedSpec().Value.GetPhase())
+		})
+
+		maxDestroyingAtOnce := 0
+		destroyedIDs := make(map[string]struct{})
+
+		require.EventuallyWithT(t, func(collect *assert.CollectT) {
+			machineStatusList, err := safe.StateListAll[*omni.ClusterMachineStatus](ctx, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelMachineSet, workersResourceID)))
+			require.NoError(t, err)
+
+			numDeleting := 0
+
+			machineStatusList.ForEach(func(machineStatus *omni.ClusterMachineStatus) {
+				stage := machineStatus.TypedSpec().Value.GetStage()
+
+				assert.Equal(collect, specs.ClusterMachineStatusSpec_DESTROYING, stage)
+
+				if stage == specs.ClusterMachineStatusSpec_DESTROYING {
+					destroyedIDs[machineStatus.Metadata().ID()] = struct{}{}
+					numDeleting++
+				}
+			})
+
+			if numDeleting > maxDestroyingAtOnce {
+				maxDestroyingAtOnce = numDeleting
+			}
+		}, timeoutDuration, 1*time.Second)
+
+		assert.Len(t, destroyedIDs, machineSetNodeList.Len(), "expected all the machines to be destroyed")
+		assert.Equal(t, maxParallelism, maxDestroyingAtOnce, "expected a maximum of %d machines to be destroyed at the same time", maxParallelism)
+	}
+}
diff --git a/cmd/omni-integration-test/pkg/tests/siderolink.go b/cmd/omni-integration-test/pkg/tests/siderolink.go
new file mode 100644
index 000000000..ec01f334b
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/siderolink.go
@@ -0,0 +1,111 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+)
+
+// AssertNumberOfLinks verifies that machines are discovered by the SideroLink.
+func AssertNumberOfLinks(testCtx context.Context, st state.State, expectedLinks int) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 90*time.Second)
+		defer cancel()
+
+		eventCh := make(chan safe.WrappedStateEvent[*siderolink.Link])
+
+		require.NoError(t,
+			safe.StateWatchKind(
+				ctx,
+				st,
+				resource.NewMetadata(resources.DefaultNamespace, siderolink.LinkType, "", resource.VersionUndefined),
+				eventCh,
+				state.WithBootstrapContents(true),
+			))
+
+		linksFound := 0
+
+		for linksFound < expectedLinks {
+			select {
+			case event := <-eventCh:
+				switch event.Type() { //nolint:exhaustive
+				case state.Created:
+					linksFound++
+				case state.Destroyed:
+					linksFound--
+				case state.Errored:
+					require.NoError(t, event.Error())
+				}
+
+			case <-ctx.Done():
+				t.Fatal("timeout")
+			}
+
+			t.Logf("links discovered: %d", linksFound)
+		}
+	}
+}
+
+// AssertLinksConnected verifies that all SideroLink connections are operational.
+func AssertLinksConnected(testCtx context.Context, st state.State) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 320*time.Second)
+		defer cancel()
+
+		rtestutils.AssertAll(ctx, t, st,
+			func(link *siderolink.Link, assert *assert.Assertions) {
+				spec := link.TypedSpec().Value
+
+				assert.True(spec.Connected)
+
+				// the link counter for this link must be created
+				msl, err := safe.StateGet[*omni.MachineStatusLink](ctx, st,
+					omni.NewMachineStatusLink(resources.MetricsNamespace, link.Metadata().ID()).Metadata(),
+				)
+				assert.NoError(err)
+
+				if msl != nil {
+					// the link counter must have some bytes sent and received
+					assert.Greater(msl.TypedSpec().Value.GetSiderolinkCounter().GetBytesSent(), int64(0), resourceDetails(link))
+					assert.Greater(msl.TypedSpec().Value.GetSiderolinkCounter().GetBytesReceived(), int64(0), resourceDetails(link))
+				}
+			})
+	}
+}
+
+// AssertMachinesMatchLinks verifies that all SideroLink connections are discovered as Machines.
+func AssertMachinesMatchLinks(testCtx context.Context, st state.State) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 10*time.Second)
+		defer cancel()
+
+		rtestutils.AssertResources(ctx, t, st,
+			rtestutils.ResourceIDs[*siderolink.Link](ctx, t, st),
+			func(machine *omni.Machine, assert *assert.Assertions) {
+				spec := machine.TypedSpec().Value
+
+				assert.NotEmpty(spec.ManagementAddress, resourceDetails(machine))
+				assert.True(spec.Connected, resourceDetails(machine))
+
+				addressLabel, ok := machine.Metadata().Labels().Get(omni.MachineAddressLabel)
+				assert.True(ok, resourceDetails(machine))
+				assert.Equal(spec.ManagementAddress, addressLabel, resourceDetails(machine))
+			})
+	}
+}
diff --git a/cmd/omni-integration-test/pkg/tests/talos.go b/cmd/omni-integration-test/pkg/tests/talos.go
new file mode 100644
index 000000000..0cec79ab6
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/talos.go
@@ -0,0 +1,715 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/maps"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	talosclient "github.com/siderolabs/talos/pkg/machinery/client"
+	clientconfig "github.com/siderolabs/talos/pkg/machinery/client/config"
+	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
+	"github.com/siderolabs/talos/pkg/machinery/resources/etcd"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/backoff"
+	"google.golang.org/protobuf/types/known/emptypb"
+
+	"github.com/siderolabs/omni/client/api/omni/management"
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/client"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// clearConnectionRefused clears cached gRPC 'connection refused' error from Talos controlplane apid instances.
+//
+// When some node is unavailable, gRPC "caches" the error for backoff.DefaultConfig.MaxDelay.
+func clearConnectionRefused(ctx context.Context, t *testing.T, c *talosclient.Client, numControlplanes int, nodes ...string) {
+	ctx, cancel := context.WithTimeout(ctx, backoff.DefaultConfig.MaxDelay)
+	defer cancel()
+
+	require.NoError(t, retry.Constant(backoff.DefaultConfig.MaxDelay, retry.WithUnits(time.Second)).Retry(func() error {
+		for i := 0; i < numControlplanes; i++ {
+			_, err := c.Version(talosclient.WithNodes(ctx, nodes...))
+			if err == nil {
+				continue
+			}
+
+			if strings.Contains(err.Error(), "connection refused") {
+				return retry.ExpectedError(err)
+			}
+
+			return err
+		}
+
+		return nil
+	}))
+}
+
+// AssertTalosAPIAccessViaOmni verifies that both instance-wide and cluster-wide `talosconfig`s work with Omni Talos API proxy.
+func AssertTalosAPIAccessViaOmni(testCtx context.Context, omniClient *client.Client, cluster string, talosAPIKeyPrepare TalosAPIKeyPrepareFunc) TestFunc {
+	return func(t *testing.T) {
+		ms, err := safe.ReaderListAll[*omni.MachineStatus](
+			testCtx,
+			omniClient.Omni().State(),
+			state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, cluster)),
+		)
+		require.NoError(t, err)
+
+		cms, err := safe.StateListAll[*omni.ClusterMachineIdentity](
+			testCtx,
+			omniClient.Omni().State(),
+			state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, cluster)),
+		)
+		require.NoError(t, err)
+
+		cpms, err := safe.StateListAll[*omni.ClusterMachine](
+			testCtx,
+			omniClient.Omni().State(),
+			state.WithLabelQuery(
+				resource.LabelEqual(omni.LabelCluster, cluster),
+				resource.LabelExists(omni.LabelControlPlaneRole),
+			),
+		)
+		require.NoError(t, err)
+
+		machineNames, err := safe.Map(ms, func(m *omni.MachineStatus) (string, error) {
+			return m.TypedSpec().Value.Network.Hostname, nil
+		})
+		require.NoError(t, err)
+
+		machineIPs, err := safe.Map(cms, func(m *omni.ClusterMachineIdentity) (string, error) {
+			return m.TypedSpec().Value.GetNodeIps()[0], nil
+		})
+		require.NoError(t, err)
+
+		assert.Equal(t, len(machineNames), len(machineIPs))
+
+		numControlPlanes := cpms.Len()
+
+		assertTalosAPI := func(ctx context.Context, t *testing.T, c *talosclient.Client) {
+			clearConnectionRefused(ctx, t, c, numControlPlanes, machineIPs...)
+
+			// WithNodes - using IPs
+			version, err := c.Version(talosclient.WithNodes(ctx, machineIPs...))
+			assert.NoError(t, err)
+			assert.Len(t, version.Messages, len(machineNames))
+
+			assert.Equal(t,
+				xslices.ToSet(machineIPs),
+				xslices.ToSet(xslices.Map(version.Messages, func(m *machine.Version) string {
+					return m.GetMetadata().GetHostname()
+				})),
+			)
+
+			// WithNodes - using node names
+			version, err = c.Version(talosclient.WithNodes(ctx, machineNames...))
+			assert.NoError(t, err)
+			assert.Len(t, version.Messages, len(machineNames))
+
+			assert.Equal(t,
+				xslices.ToSet(machineIPs),
+				xslices.ToSet(xslices.Map(version.Messages, func(m *machine.Version) string {
+					return m.GetMetadata().GetHostname()
+				})),
+			)
+
+			// WithNode - using IP
+			hostname, err := c.MachineClient.Hostname(talosclient.WithNode(ctx, machineIPs[0]), &emptypb.Empty{})
+			assert.NoError(t, err)
+			assert.Equal(t, machineNames[0], hostname.Messages[0].Hostname)
+			assert.Empty(t, hostname.Messages[0].GetMetadata().GetHostname())
+
+			// WithNode - using node name
+			hostname, err = c.MachineClient.Hostname(talosclient.WithNode(ctx, machineNames[0]), &emptypb.Empty{})
+			assert.NoError(t, err)
+			assert.Equal(t, machineNames[0], hostname.Messages[0].Hostname)
+			assert.Empty(t, hostname.Messages[0].GetMetadata().GetHostname())
+		}
+
+		t.Run("InstanceWideTalosconfig", func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(testCtx, backoff.DefaultConfig.MaxDelay+10*time.Second)
+			t.Cleanup(cancel)
+
+			data, err := omniClient.Management().Talosconfig(ctx)
+			require.NoError(t, err)
+			assert.NotEmpty(t, data)
+
+			config, err := clientconfig.FromBytes(data)
+			require.NoError(t, err)
+
+			require.NoError(t, talosAPIKeyPrepare(ctx, "default"))
+
+			c, err := talosclient.New(ctx, talosclient.WithConfig(config), talosclient.WithCluster(cluster))
+			require.NoError(t, err)
+
+			t.Cleanup(func() {
+				require.NoError(t, c.Close())
+			})
+
+			assertTalosAPI(ctx, t, c)
+		})
+
+		t.Run("ClusterWideTalosconfig", func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(testCtx, backoff.DefaultConfig.MaxDelay+10*time.Second)
+			t.Cleanup(cancel)
+
+			data, err := omniClient.Management().WithCluster(cluster).Talosconfig(ctx)
+			require.NoError(t, err)
+			assert.NotEmpty(t, data)
+
+			config, err := clientconfig.FromBytes(data)
+			require.NoError(t, err)
+
+			require.NoError(t, talosAPIKeyPrepare(ctx, fmt.Sprintf("%s-%s", "default", cluster)))
+
+			c, err := talosclient.New(ctx, talosclient.WithConfig(config))
+			require.NoError(t, err)
+
+			t.Cleanup(func() {
+				require.NoError(t, c.Close())
+			})
+
+			assertTalosAPI(ctx, t, c)
+		})
+	}
+}
+
+// AssertEtcdMembershipMatchesOmniResources checks that etcd members are in sync with the Omni MachineStatus information.
+func AssertEtcdMembershipMatchesOmniResources(testCtx context.Context, client *client.Client, cluster string, talosAPIKeyPrepare TalosAPIKeyPrepareFunc) TestFunc {
+	return func(t *testing.T) {
+		require := require.New(t)
+		assert := assert.New(t)
+
+		ctx, cancel := context.WithTimeout(testCtx, 90*time.Second)
+		defer cancel()
+
+		require.NoError(talosAPIKeyPrepare(ctx, "default"))
+
+		data, err := client.Management().Talosconfig(ctx)
+		require.NoError(err)
+		assert.NotEmpty(data)
+
+		config, err := clientconfig.FromBytes(data)
+		require.NoError(err)
+
+		c, err := talosclient.New(ctx, talosclient.WithConfig(config), talosclient.WithCluster(cluster))
+		require.NoError(err)
+
+		t.Cleanup(func() {
+			require.NoError(c.Close())
+		})
+
+		machineIDs := rtestutils.ResourceIDs[*omni.ClusterMachine](ctx, t, client.Omni().State(),
+			state.WithLabelQuery(
+				resource.LabelEqual(omni.LabelCluster, cluster),
+				resource.LabelExists(omni.LabelControlPlaneRole),
+			),
+		)
+
+		clearConnectionRefused(ctx, t, c, len(machineIDs), machineIDs...)
+
+		resp, err := c.EtcdMemberList(ctx, &machine.EtcdMemberListRequest{})
+		require.NoError(err)
+
+		err = retry.Constant(time.Minute*2, retry.WithUnits(time.Second)).Retry(func() error {
+			clusterMachines := map[string]any{}
+
+			for _, machineID := range machineIDs {
+				var machineStatus *omni.MachineStatus
+
+				machineStatus, err = safe.StateGet[*omni.MachineStatus](ctx, client.Omni().State(), omni.NewMachineStatus(resources.DefaultNamespace, machineID).Metadata())
+				if err != nil {
+					return retry.ExpectedError(err)
+				}
+
+				clusterMachines[machineStatus.TypedSpec().Value.Network.Hostname] = struct{}{}
+			}
+
+			for _, m := range resp.Messages {
+				if len(clusterMachines) != len(m.Members) {
+					memberIDs := xslices.Map(m.Members, func(m *machine.EtcdMember) string { return etcd.FormatMemberID(m.Id) })
+
+					return retry.ExpectedErrorf("the count of members doesn't match the count of machines, expected %d, got: %d, members list: %s", len(clusterMachines), len(m.Members), memberIDs)
+				}
+
+				for _, member := range m.Members {
+					_, ok := clusterMachines[member.Hostname]
+
+					if !ok {
+						return retry.ExpectedErrorf("found etcd member which doesn't have associated machine status")
+					}
+				}
+			}
+
+			return nil
+		})
+
+		require.NoError(err)
+	}
+}
+
+// AssertTalosMembersMatchOmni checks that Talos discovery service members are in sync with the machines attached to the cluster.
+func AssertTalosMembersMatchOmni(testCtx context.Context, client *client.Client, clusterName string, talosAPIKeyPrepare TalosAPIKeyPrepareFunc) TestFunc {
+	return func(t *testing.T) {
+		require := require.New(t)
+
+		ctx, cancel := context.WithTimeout(testCtx, backoff.DefaultConfig.BaseDelay+120*time.Second)
+		defer cancel()
+
+		require.NoError(talosAPIKeyPrepare(ctx, "default"))
+
+		data, err := client.Management().Talosconfig(ctx)
+		require.NoError(err)
+
+		config, err := clientconfig.FromBytes(data)
+		require.NoError(err)
+
+		c, err := talosclient.New(ctx, talosclient.WithConfig(config), talosclient.WithCluster(clusterName))
+		require.NoError(err)
+
+		t.Cleanup(func() {
+			require.NoError(c.Close())
+		})
+
+		machineIDs := rtestutils.ResourceIDs[*omni.ClusterMachine](ctx, t, client.Omni().State(),
+			state.WithLabelQuery(
+				resource.LabelEqual(omni.LabelCluster, clusterName),
+			),
+		)
+
+		// map of Nodenames to Node Identities
+		clusterMachines := map[string]string{}
+
+		for _, machineID := range machineIDs {
+			var clusterMachineIdentity *omni.ClusterMachineIdentity
+
+			clusterMachineIdentity, err = safe.StateGet[*omni.ClusterMachineIdentity](ctx, client.Omni().State(),
+				omni.NewClusterMachineIdentity(resources.DefaultNamespace, machineID).Metadata(),
+			)
+
+			require.NoError(err)
+
+			machineStatus := clusterMachineIdentity.TypedSpec().Value
+
+			clusterMachines[machineStatus.Nodename] = machineStatus.NodeIdentity
+		}
+
+		// check that every Omni machine is in Talos as a member
+		rtestutils.AssertResources(ctx, t, c.COSI, maps.Keys(clusterMachines), func(member *cluster.Member, asrt *assert.Assertions) {
+			asrt.Equal(clusterMachines[member.Metadata().ID()], member.TypedSpec().NodeID, resourceDetails(member))
+		})
+
+		// check that length of resources matches expectations (i.e. there are no extra members)
+		rtestutils.AssertLength[*cluster.Member](ctx, t, c.COSI, len(clusterMachines))
+	}
+}
+
+// AssertTalosVersion verifies Talos version on the nodes.
+func AssertTalosVersion(testCtx context.Context, client *client.Client, clusterName, expectedVersion string, talosAPIKeyPrepare TalosAPIKeyPrepareFunc) TestFunc {
+	return func(t *testing.T) {
+		require := require.New(t)
+
+		ctx, cancel := context.WithTimeout(testCtx, backoff.DefaultConfig.BaseDelay+90*time.Second)
+		defer cancel()
+
+		machineIDs := rtestutils.ResourceIDs[*omni.ClusterMachine](ctx, t, client.Omni().State(), state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)))
+
+		cms, err := safe.StateListAll[*omni.ClusterMachineIdentity](
+			testCtx,
+			client.Omni().State(),
+			state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)),
+		)
+		require.NoError(err)
+
+		machineIPs, err := safe.Map(cms, func(m *omni.ClusterMachineIdentity) (string, error) {
+			return m.TypedSpec().Value.GetNodeIps()[0], nil
+		})
+		require.NoError(err)
+
+		// assert using Omni MachineStatus resource
+		rtestutils.AssertResources(ctx, t, client.Omni().State(), machineIDs, func(r *omni.MachineStatus, asrt *assert.Assertions) {
+			asrt.Equal(expectedVersion, strings.TrimLeft(r.TypedSpec().Value.TalosVersion, "v"), resourceDetails(r))
+		})
+
+		// assert issuing Talos API query to each machine
+		require.NoError(talosAPIKeyPrepare(ctx, fmt.Sprintf("%s-%s", "default", clusterName)))
+
+		data, err := client.Management().Talosconfig(ctx)
+		require.NoError(err)
+		require.NotEmpty(data)
+
+		data, err = client.Management().WithCluster(clusterName).Talosconfig(ctx)
+		require.NoError(err)
+		require.NotEmpty(data)
+
+		config, err := clientconfig.FromBytes(data)
+		require.NoError(err)
+
+		c, err := talosclient.New(ctx, talosclient.WithConfig(config), talosclient.WithCluster(clusterName))
+		require.NoError(err)
+
+		t.Cleanup(func() {
+			require.NoError(c.Close())
+		})
+
+		clearConnectionRefused(ctx, t, c, len(machineIPs), machineIPs...)
+
+		resp, err := c.Version(talosclient.WithNodes(ctx, machineIPs...))
+		require.NoError(err)
+
+		for _, m := range resp.Messages {
+			require.Equal("v"+expectedVersion, m.Version.Tag)
+		}
+
+		// assert using Talos upgrade controller status
+		rtestutils.AssertResources(ctx, t, client.Omni().State(), []resource.ID{clusterName}, func(r *omni.TalosUpgradeStatus, asrt *assert.Assertions) {
+			asrt.Equal(specs.TalosUpgradeStatusSpec_Done, r.TypedSpec().Value.Phase, resourceDetails(r))
+			asrt.Equal(expectedVersion, r.TypedSpec().Value.LastUpgradeVersion, resourceDetails(r))
+		})
+	}
+}
+
+// AssertTalosUpgradeFlow verifies Talos upgrade flow to the new Talos version.
+func AssertTalosUpgradeFlow(testCtx context.Context, st state.State, clusterName, newTalosVersion string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 15*time.Minute)
+		defer cancel()
+
+		// assert next version is in the list of upgrade candidate version
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{clusterName}, func(r *omni.TalosUpgradeStatus, asrt *assert.Assertions) {
+			asrt.Contains(r.TypedSpec().Value.UpgradeVersions, newTalosVersion, resourceDetails(r))
+		})
+
+		t.Logf("upgrading cluster %q to %q", clusterName, newTalosVersion)
+
+		// trigger an upgrade
+		_, err := safe.StateUpdateWithConflicts(ctx, st, omni.NewCluster(resources.DefaultNamespace, clusterName).Metadata(), func(cluster *omni.Cluster) error {
+			cluster.TypedSpec().Value.TalosVersion = newTalosVersion
+
+			return nil
+		})
+		require.NoError(t, err)
+
+		// upgrade should start
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{clusterName}, func(r *omni.TalosUpgradeStatus, assert *assert.Assertions) {
+			assert.Equal(specs.TalosUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Phase, resourceDetails(r))
+			assert.NotEmpty(specs.TalosUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Step, resourceDetails(r))
+			assert.NotEmpty(specs.TalosUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Status, resourceDetails(r))
+		})
+
+		t.Log("upgrade is going")
+
+		// upgrade should finish successfully
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{clusterName}, func(r *omni.TalosUpgradeStatus, assert *assert.Assertions) {
+			assert.Equal(specs.TalosUpgradeStatusSpec_Done, r.TypedSpec().Value.Phase, resourceDetails(r))
+			assert.Equal(newTalosVersion, r.TypedSpec().Value.LastUpgradeVersion, resourceDetails(r))
+			assert.Empty(r.TypedSpec().Value.Step, resourceDetails(r))
+		})
+	}
+}
+
+// AssertTalosSchematicUpdateFlow verifies Talos schematic update flow.
+func AssertTalosSchematicUpdateFlow(testCtx context.Context, client *client.Client, clusterName string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 15*time.Minute)
+		defer cancel()
+
+		resp, err := client.Management().CreateSchematic(ctx, &management.CreateSchematicRequest{
+			Extensions: []string{
+				"siderolabs/hello-world-service",
+				"siderolabs/qemu-guest-agent",
+			},
+		})
+
+		require.NoError(t, err)
+
+		t.Logf("upgrading cluster schematic %q to %q", clusterName, resp.SchematicId)
+		res := omni.NewSchematicConfiguration(resources.DefaultNamespace, clusterName)
+		res.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+
+		// trigger an update by creating the SchematicConfiguration resource
+		res.TypedSpec().Value.SchematicId = resp.SchematicId
+		res.TypedSpec().Value.Target = specs.SchematicConfigurationSpec_Cluster
+
+		err = client.Omni().State().Create(ctx, res)
+		require.NoError(t, err)
+
+		// upgrade should start
+		rtestutils.AssertResources(ctx, t, client.Omni().State(), []resource.ID{clusterName}, func(r *omni.TalosUpgradeStatus, assert *assert.Assertions) {
+			assert.Equal(specs.TalosUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Phase, resourceDetails(r))
+			assert.NotEmpty(specs.TalosUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Step, resourceDetails(r))
+			assert.NotEmpty(specs.TalosUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Status, resourceDetails(r))
+		})
+
+		t.Log("upgrade is going")
+
+		// upgrade should finish successfully
+		rtestutils.AssertResources(ctx, t, client.Omni().State(), []resource.ID{clusterName}, func(r *omni.TalosUpgradeStatus, assert *assert.Assertions) {
+			assert.Equal(specs.TalosUpgradeStatusSpec_Done, r.TypedSpec().Value.Phase, resourceDetails(r))
+			assert.Empty(r.TypedSpec().Value.Step, resourceDetails(r))
+		})
+	}
+}
+
+// AssertTalosUpgradeIsRevertible tries to upgrade to invalid Talos version, and verifies that upgrade starts, fails, and can be reverted.
+func AssertTalosUpgradeIsRevertible(testCtx context.Context, st state.State, clusterName, currentTalosVersion string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 15*time.Minute)
+		defer cancel()
+
+		badTalosVersion := currentTalosVersion + "-bad"
+
+		t.Logf("attempting an upgrade of cluster %q to %q", clusterName, badTalosVersion)
+
+		// trigger an upgrade to a bad version
+		_, err := safe.StateUpdateWithConflicts(ctx, st, omni.NewCluster(resources.DefaultNamespace, clusterName).Metadata(), func(cluster *omni.Cluster) error {
+			cluster.Metadata().Annotations().Set(constants.DisableValidation, "")
+
+			cluster.TypedSpec().Value.TalosVersion = badTalosVersion
+
+			return nil
+		})
+		require.NoError(t, err)
+
+		// upgrade should start
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{clusterName}, func(r *omni.TalosUpgradeStatus, assert *assert.Assertions) {
+			assert.Equal(specs.TalosUpgradeStatusSpec_Upgrading, r.TypedSpec().Value.Phase, resourceDetails(r))
+			assert.NotEmpty(r.TypedSpec().Value.Step, resourceDetails(r))
+			assert.NotEmpty(r.TypedSpec().Value.Status, resourceDetails(r))
+			assert.Equal(currentTalosVersion, r.TypedSpec().Value.LastUpgradeVersion, resourceDetails(r))
+		})
+
+		t.Log("revert an upgrade")
+
+		_, err = safe.StateUpdateWithConflicts(ctx, st, omni.NewCluster(resources.DefaultNamespace, clusterName).Metadata(), func(cluster *omni.Cluster) error {
+			cluster.TypedSpec().Value.TalosVersion = currentTalosVersion
+
+			return nil
+		})
+		require.NoError(t, err)
+
+		// upgrade should be reverted
+		rtestutils.AssertResources(ctx, t, st, []resource.ID{clusterName}, func(r *omni.TalosUpgradeStatus, assert *assert.Assertions) {
+			assert.Equal(specs.TalosUpgradeStatusSpec_Done, r.TypedSpec().Value.Phase, resourceDetails(r))
+			assert.Equal(currentTalosVersion, r.TypedSpec().Value.LastUpgradeVersion, resourceDetails(r))
+			assert.Empty(r.TypedSpec().Value.Step, resourceDetails(r))
+		})
+	}
+}
+
+// AssertTalosUpgradeIsCancelable tries to upgrade Talos version, and verifies that upgrade starts on one of the nodes and immediately reverts it back.
+func AssertTalosUpgradeIsCancelable(testCtx context.Context, st state.State, clusterName, currentTalosVersion, newTalosVersion string) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 15*time.Minute)
+		defer cancel()
+
+		t.Logf("apply upgrade to %s", newTalosVersion)
+
+		_, err := safe.StateUpdateWithConflicts(ctx, st, omni.NewCluster(resources.DefaultNamespace, clusterName).Metadata(), func(cluster *omni.Cluster) error {
+			cluster.TypedSpec().Value.TalosVersion = newTalosVersion
+
+			return nil
+		})
+		require.NoError(t, err)
+
+		events := make(chan state.Event)
+
+		require.NoError(t, st.WatchKind(ctx, omni.NewClusterMachineStatus(resources.DefaultNamespace, "").Metadata(), events),
+			state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)),
+		)
+
+		ids := []string{}
+
+		// wait until any of the machines' state changes to not running
+	outer:
+		for {
+			select {
+			case <-ctx.Done():
+				require.NoError(t, ctx.Err())
+			case ev := <-events:
+				//nolint:exhaustive
+				switch ev.Type {
+				case state.Errored:
+					require.NoError(t, ev.Error)
+				case state.Updated,
+					state.Created:
+					res := ev.Resource.(*omni.ClusterMachineStatus) //nolint:forcetypeassert,errcheck
+
+					if res.TypedSpec().Value.Stage != specs.ClusterMachineStatusSpec_RUNNING {
+						var cmtv *omni.ClusterMachineTalosVersion
+
+						cmtv, err = safe.ReaderGet[*omni.ClusterMachineTalosVersion](ctx, st, omni.NewClusterMachineTalosVersion(
+							resources.DefaultNamespace,
+							res.Metadata().ID(),
+						).Metadata())
+
+						// no information about the Talos version for the machine, continue looking
+						if state.IsNotFoundError(err) {
+							continue
+						}
+
+						require.NoError(t, err)
+
+						// this machine is not running, but it wasn't updated, continue looking
+						if cmtv.TypedSpec().Value.TalosVersion != newTalosVersion {
+							continue
+						}
+
+						ids = append(ids, res.Metadata().ID())
+
+						break outer
+					}
+				}
+			}
+		}
+
+		// revert the update
+		_, err = safe.StateUpdateWithConflicts(ctx, st, omni.NewCluster(resources.DefaultNamespace, clusterName).Metadata(), func(cluster *omni.Cluster) error {
+			cluster.TypedSpec().Value.TalosVersion = currentTalosVersion
+
+			return nil
+		})
+		require.NoError(t, err)
+
+		// wait until the upgraded machine reports the new version
+		rtestutils.AssertResources(ctx, t, st, ids, func(r *omni.MachineStatus, assert *assert.Assertions) {
+			assert.Equal(newTalosVersion, strings.TrimLeft(r.TypedSpec().Value.TalosVersion, "v"), resourceDetails(r))
+		})
+
+		rtestutils.AssertResources(ctx, t, st, ids, func(r *omni.ClusterMachineStatus, assert *assert.Assertions) {
+			assert.Equal(specs.ClusterMachineStatusSpec_RUNNING, r.TypedSpec().Value.Stage, resourceDetails(r))
+		})
+
+		// the upgraded machine version should be reverted back
+		rtestutils.AssertResources(ctx, t, st, ids, func(r *omni.MachineStatus, assert *assert.Assertions) {
+			assert.Equal(currentTalosVersion, strings.TrimLeft(r.TypedSpec().Value.TalosVersion, "v"), resourceDetails(r))
+		})
+	}
+}
+
+// AssertMachineShouldBeUpgradedInMaintenanceMode verifies machine upgrade in maintenance mode.
+func AssertMachineShouldBeUpgradedInMaintenanceMode(
+	testCtx context.Context,
+	rootClient *client.Client,
+	clusterName, kubernetesVersion, talosVersion1, talosVersion2 string,
+	talosAPIKeyPrepare TalosAPIKeyPrepareFunc,
+) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 900*time.Second)
+		defer cancel()
+
+		require := require.New(t)
+
+		st := rootClient.Omni().State()
+
+		var allocatedMachineIDs []resource.ID
+
+		t.Logf("creating a cluster on version %s", talosVersion1)
+
+		pickUnallocatedMachines(ctx, t, st, 1, func(machineIDs []resource.ID) {
+			allocatedMachineIDs = machineIDs
+
+			cluster := omni.NewCluster(resources.DefaultNamespace, clusterName)
+			cluster.TypedSpec().Value.TalosVersion = talosVersion1
+			cluster.TypedSpec().Value.KubernetesVersion = kubernetesVersion
+
+			require.NoError(st.Create(ctx, cluster))
+
+			t.Logf("Adding machine '%s' to control plane (cluster %q, version %s)", machineIDs[0], clusterName, talosVersion2)
+			bindMachine(ctx, t, st, bindMachineOptions{
+				clusterName: clusterName,
+				role:        omni.LabelControlPlaneRole,
+				machineID:   machineIDs[0],
+			})
+
+			// assert that machines got allocated (label available is removed)
+			rtestutils.AssertResources(ctx, t, st, machineIDs, func(machineStatus *omni.MachineStatus, assert *assert.Assertions) {
+				assert.True(machineStatus.Metadata().Labels().Matches(
+					resource.LabelTerm{
+						Key:    omni.MachineStatusLabelAvailable,
+						Op:     resource.LabelOpExists,
+						Invert: true,
+					},
+				), resourceDetails(machineStatus))
+			})
+		})
+
+		// wait for initial cluster on talosVersion1 to be ready
+		AssertClusterStatusReady(testCtx, st, clusterName)(t)
+		AssertTalosVersion(testCtx, rootClient, clusterName, talosVersion2, talosAPIKeyPrepare)
+
+		// destroy the cluster
+		AssertDestroyCluster(testCtx, st, clusterName)(t)
+
+		t.Logf("creating a cluster on version %s using same machines", talosVersion2)
+
+		// re-create the cluster on talosVersion2
+		cluster := omni.NewCluster(resources.DefaultNamespace, clusterName)
+		cluster.TypedSpec().Value.TalosVersion = talosVersion2
+		cluster.TypedSpec().Value.KubernetesVersion = kubernetesVersion
+
+		require.NoError(st.Create(ctx, cluster))
+
+		t.Logf("Adding machine '%s' to control plane (cluster %q, version %s)", allocatedMachineIDs[0], clusterName, talosVersion2)
+		bindMachine(ctx, t, st, bindMachineOptions{
+			clusterName: clusterName,
+			role:        omni.LabelControlPlaneRole,
+			machineID:   allocatedMachineIDs[0],
+		})
+
+		// wait for cluster on talosVersion2 to be ready
+		AssertClusterStatusReady(testCtx, st, clusterName)(t)
+		AssertTalosVersion(testCtx, rootClient, clusterName, talosVersion2, talosAPIKeyPrepare)
+
+		AssertDestroyCluster(testCtx, st, clusterName)(t)
+	}
+}
+
+// AssertTalosServiceIsRestarted verifies that Talos service is restarted on the nodes that match given cluster machine label query options.
+func AssertTalosServiceIsRestarted(testCtx context.Context, cli *client.Client, clusterName string,
+	talosAPIKeyPrepare TalosAPIKeyPrepareFunc, service string, labelQueryOpts ...resource.LabelQueryOption,
+) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 1*time.Minute)
+		defer cancel()
+
+		require.NoError(t, talosAPIKeyPrepare(ctx, "default"))
+
+		talosCli, err := talosClient(ctx, cli, clusterName)
+		require.NoError(t, err)
+
+		labelQueryOpts = append(labelQueryOpts, resource.LabelEqual(omni.LabelCluster, clusterName))
+
+		clusterMachineList, err := safe.StateListAll[*omni.ClusterMachine](ctx, cli.Omni().State(), state.WithLabelQuery(labelQueryOpts...))
+		require.NoError(t, err)
+
+		for it := clusterMachineList.Iterator(); it.Next(); {
+			clusterMachine := it.Value()
+			nodeID := clusterMachine.Metadata().ID()
+
+			t.Logf("Restarting service %q on node %q", service, nodeID)
+
+			_, err = talosCli.MachineClient.ServiceRestart(talosclient.WithNode(ctx, nodeID), &machine.ServiceRestartRequest{
+				Id: service,
+			})
+			require.NoError(t, err)
+		}
+	}
+}
diff --git a/cmd/omni-integration-test/pkg/tests/template.go b/cmd/omni-integration-test/pkg/tests/template.go
new file mode 100644
index 000000000..c984818ba
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/template.go
@@ -0,0 +1,188 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"os"
+	"testing"
+	"text/template"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	clientconsts "github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/template/operations"
+	"github.com/siderolabs/omni/internal/pkg/constants"
+)
+
+//go:embed testdata/cluster-1.tmpl.yaml
+var cluster1Tmpl []byte
+
+//go:embed testdata/cluster-2.tmpl.yaml
+var cluster2Tmpl []byte
+
+type tmplOptions struct {
+	KubernetesVersion string
+	TalosVersion      string
+
+	CP []string
+	W  []string
+}
+
+func renderTemplate(t *testing.T, tmpl []byte, opts tmplOptions) []byte {
+	var b bytes.Buffer
+
+	require.NoError(t, template.Must(template.New("cluster").Parse(string(tmpl))).Execute(&b, opts))
+
+	return b.Bytes()
+}
+
+// AssertClusterTemplateFlow verifies cluster template operations.
+func AssertClusterTemplateFlow(testCtx context.Context, st state.State) TestFunc {
+	return func(t *testing.T) {
+		ctx, cancel := context.WithTimeout(testCtx, 20*time.Minute)
+		defer cancel()
+
+		const (
+			clusterName           = "tmpl-cluster"
+			additionalWorkersName = "additional-workers"
+		)
+
+		require := require.New(t)
+
+		var (
+			machineIDs []resource.ID
+			opts       tmplOptions
+			tmpl1      []byte
+		)
+
+		pickUnallocatedMachines(ctx, t, st, 5, func(mIDs []resource.ID) {
+			machineIDs = mIDs
+
+			opts = tmplOptions{
+				KubernetesVersion: "v" + constants.DefaultKubernetesVersion,
+				TalosVersion:      "v" + clientconsts.DefaultTalosVersion,
+
+				CP: machineIDs[:3],
+				W:  machineIDs[3:],
+			}
+
+			tmpl1 = renderTemplate(t, cluster1Tmpl, opts)
+
+			require.NoError(operations.ValidateTemplate(bytes.NewReader(tmpl1)))
+
+			t.Log("creating template cluster")
+
+			require.NoError(operations.SyncTemplate(ctx, bytes.NewReader(tmpl1), os.Stderr, st, operations.SyncOptions{
+				Verbose: true,
+			}))
+
+			// assert that machines got allocated (label available is removed)
+			rtestutils.AssertResources(ctx, t, st, machineIDs, func(machineStatus *omni.MachineStatus, assert *assert.Assertions) {
+				assert.True(machineStatus.Metadata().Labels().Matches(
+					resource.LabelTerm{
+						Key:    omni.MachineStatusLabelAvailable,
+						Op:     resource.LabelOpExists,
+						Invert: true,
+					},
+				), resourceDetails(machineStatus))
+			})
+		})
+
+		t.Log("wait for cluster to be ready")
+
+		// wait using the status command
+		require.NoError(operations.StatusTemplate(ctx, bytes.NewReader(tmpl1), os.Stderr, st, operations.StatusOptions{
+			Wait: true,
+		}))
+
+		// re-check with short timeout to make sure the cluster is ready
+		checkCtx, checkCancel := context.WithTimeout(ctx, 10*time.Second)
+		defer checkCancel()
+
+		rtestutils.AssertResources(checkCtx, t, st, []string{clusterName}, func(status *omni.ClusterStatus, assert *assert.Assertions) {
+			spec := status.TypedSpec().Value
+
+			assert.Truef(spec.Available, "not available: %s", resourceDetails(status))
+			assert.Equalf(specs.ClusterStatusSpec_RUNNING, spec.Phase, "cluster is not in phase running: %s", resourceDetails(status))
+			assert.Equalf(spec.GetMachines().Total, spec.GetMachines().Healthy, "not all machines are healthy: %s", resourceDetails(status))
+			assert.Truef(spec.Ready, "cluster is not ready: %s", resourceDetails(status))
+			assert.Truef(spec.ControlplaneReady, "cluster controlplane is not ready: %s", resourceDetails(status))
+			assert.Truef(spec.KubernetesAPIReady, "cluster kubernetes API is not ready: %s", resourceDetails(status))
+			assert.EqualValuesf(len(opts.CP)+len(opts.W), spec.GetMachines().Total, "total machines is not the same as in the machine sets: %s", resourceDetails(status))
+		})
+
+		rtestutils.AssertResources(checkCtx, t, st, []string{
+			omni.ControlPlanesResourceID(clusterName),
+			omni.WorkersResourceID(clusterName),
+			omni.AdditionalWorkersResourceID(clusterName, additionalWorkersName),
+		}, func(*omni.MachineSet, *assert.Assertions) {})
+
+		t.Log("updating template cluster")
+
+		opts.CP = opts.CP[:1]
+
+		tmpl2 := renderTemplate(t, cluster2Tmpl, opts)
+
+		require.NoError(operations.SyncTemplate(ctx, bytes.NewReader(tmpl2), os.Stderr, st, operations.SyncOptions{
+			Verbose: true,
+		}))
+
+		t.Log("waiting for cluster operations to apply")
+
+		time.Sleep(10 * time.Second)
+
+		t.Log("wait for cluster to be ready")
+
+		// wait using the status command
+		require.NoError(operations.StatusTemplate(ctx, bytes.NewReader(tmpl2), os.Stderr, st, operations.StatusOptions{
+			Wait: true,
+		}))
+
+		// re-check with short timeout to make sure the cluster is ready
+		checkCtx, checkCancel = context.WithTimeout(ctx, 10*time.Second)
+		defer checkCancel()
+
+		rtestutils.AssertResources(checkCtx, t, st, []string{clusterName}, func(status *omni.ClusterStatus, assert *assert.Assertions) {
+			spec := status.TypedSpec().Value
+
+			assert.Truef(spec.Available, "not available: %s", resourceDetails(status))
+			assert.Equalf(specs.ClusterStatusSpec_RUNNING, spec.Phase, "cluster is not in phase running: %s", resourceDetails(status))
+			assert.Equalf(spec.GetMachines().Total, spec.GetMachines().Healthy, "not all machines are healthy: %s", resourceDetails(status))
+			assert.Truef(spec.Ready, "cluster is not ready: %s", resourceDetails(status))
+			assert.Truef(spec.ControlplaneReady, "cluster controlplane is not ready: %s", resourceDetails(status))
+			assert.Truef(spec.KubernetesAPIReady, "cluster kubernetes API is not ready: %s", resourceDetails(status))
+			assert.EqualValuesf(len(opts.CP)+len(opts.W), spec.GetMachines().Total, "total machines is not the same as in the machine sets: %s", resourceDetails(status))
+		})
+
+		require.NoError(operations.ValidateTemplate(bytes.NewReader(tmpl1)))
+
+		t.Log("deleting template cluster")
+
+		require.NoError(operations.DeleteTemplate(ctx, bytes.NewReader(tmpl1), os.Stderr, st, operations.SyncOptions{
+			Verbose: true,
+		}))
+
+		rtestutils.AssertNoResource[*omni.Cluster](ctx, t, st, clusterName)
+
+		// make sure machines are returned to the pool
+		rtestutils.AssertResources(ctx, t, st, machineIDs, func(machineStatus *omni.MachineStatus, assert *assert.Assertions) {
+			assert.True(machineStatus.Metadata().Labels().Matches(resource.LabelTerm{
+				Key: omni.MachineStatusLabelAvailable,
+				Op:  resource.LabelOpExists,
+			}), resourceDetails(machineStatus))
+		})
+	}
+}
diff --git a/cmd/omni-integration-test/pkg/tests/testdata/cluster-1.tmpl.yaml b/cmd/omni-integration-test/pkg/tests/testdata/cluster-1.tmpl.yaml
new file mode 100644
index 000000000..a8763e746
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/testdata/cluster-1.tmpl.yaml
@@ -0,0 +1,29 @@
+kind: Cluster
+name: tmpl-cluster
+kubernetes:
+  version: {{ .KubernetesVersion }}
+talos:
+  version: {{ .TalosVersion }}
+patches:
+  - name: kubespan-enabled
+    inline:
+      machine:
+        network:
+          kubespan:
+            enabled: true
+            allowDownPeerBypass: true
+---
+kind: ControlPlane
+machines:
+  - {{ index .CP 0 }}
+  - {{ index .CP 1 }}
+  - {{ index .CP 2 }}
+---
+kind: Workers
+machines:
+  - {{ index .W 0 }}
+---
+kind: Workers
+name: additional-workers
+machines:
+  - {{ index .W 1 }}
diff --git a/cmd/omni-integration-test/pkg/tests/testdata/cluster-2.tmpl.yaml b/cmd/omni-integration-test/pkg/tests/testdata/cluster-2.tmpl.yaml
new file mode 100644
index 000000000..90cc210c2
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/testdata/cluster-2.tmpl.yaml
@@ -0,0 +1,37 @@
+kind: Cluster
+name: tmpl-cluster
+kubernetes:
+  version: {{ .KubernetesVersion }}
+talos:
+  version: {{ .TalosVersion }}
+patches:
+  - name: kubespan-enabled
+    inline:
+      machine:
+        network:
+          kubespan:
+            enabled: false
+---
+kind: ControlPlane
+machines:
+  - {{ index .CP 0 }}
+---
+kind: Workers
+machines:
+  - {{ index .W 0 }}
+---
+kind: Workers
+name: additional-workers
+machines:
+  - {{ index .W 1 }}
+---
+kind: Machine
+name: {{ index .W 0 }}
+patches:
+  - name: dummy-if
+    inline:
+      machine:
+        network:
+          interfaces:
+            - interface: dummy-if
+              dummy: true
diff --git a/cmd/omni-integration-test/pkg/tests/tests.go b/cmd/omni-integration-test/pkg/tests/tests.go
new file mode 100644
index 000000000..a987724f6
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/tests.go
@@ -0,0 +1,1170 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package tests provides the Omni tests.
+package tests
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"net/http"
+	"regexp"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/siderolabs/gen/xslices"
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/sync/semaphore"
+	"google.golang.org/protobuf/types/known/durationpb"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/cmd/omni-integration-test/pkg/clientconfig"
+)
+
+// TestFunc is a testing function prototype.
+type TestFunc func(t *testing.T)
+
+// RestartAMachineFunc is a function to restart a machine by UUID.
+type RestartAMachineFunc func(ctx context.Context, uuid string) error
+
+// WipeAMachineFunc is a function to wipe a machine by UUID.
+type WipeAMachineFunc func(ctx context.Context, uuid string) error
+
+// FreezeAMachineFunc is a function to freeze a machine by UUID.
+type FreezeAMachineFunc func(ctx context.Context, uuid string) error
+
+// HTTPRequestSignerFunc is function to sign the HTTP request.
+type HTTPRequestSignerFunc func(ctx context.Context, req *http.Request) error
+
+// TalosAPIKeyPrepareFunc is a function to prepare a public key for Talos API auth.
+type TalosAPIKeyPrepareFunc func(ctx context.Context, contextName string) error
+
+// Options for the test runner.
+//
+//nolint:govet
+type Options struct {
+	RunTestPattern string
+
+	ExpectedMachines int
+
+	RestartAMachineFunc RestartAMachineFunc
+	WipeAMachineFunc    WipeAMachineFunc
+	FreezeAMachineFunc  FreezeAMachineFunc
+
+	MachineOptions MachineOptions
+
+	HTTPEndpoint             string
+	AnotherTalosVersion      string
+	AnotherKubernetesVersion string
+}
+
+// Run the integration tests.
+//
+//nolint:maintidx
+func Run(ctx context.Context, clientConfig *clientconfig.ClientConfig, options Options) error {
+	rootClient, err := clientConfig.GetClient(ctx)
+	if err != nil {
+		return err
+	}
+
+	talosAPIKeyPrepare := func(ctx context.Context, contextName string) error {
+		return clientconfig.TalosAPIKeyPrepare(ctx, rootClient, contextName)
+	}
+
+	testList := []testGroup{
+		{
+			Name: "CleanState",
+			Description: `
+Bring the state of Omni to a clean state by removing all clusters, config patches, etc. which might have been left from previous runs.
+Wait for all expected machines to join and be in maintenance mode.`,
+			Parallel: false, // these tests should run first without other tests interfering
+			Subtests: []subTest{
+				{
+					"DestroyAllClusterRelatedResources",
+					DestroyAllClusterRelatedResources(ctx, rootClient.Omni().State()),
+				},
+				// machine discovery, all machines should be in maintenance mode
+				{
+					"LinkCountShouldMatchExpectedMachines",
+					AssertNumberOfLinks(ctx, rootClient.Omni().State(), options.ExpectedMachines),
+				},
+				{
+					"LinksShouldBeConnected",
+					AssertLinksConnected(ctx, rootClient.Omni().State()),
+				},
+				{
+					"LinksShouldMatchMachines",
+					AssertMachinesMatchLinks(ctx, rootClient.Omni().State()),
+				},
+				{
+					"MachinesShouldHaveLogs",
+					AssertMachinesHaveLogs(ctx, rootClient.Omni().State(), rootClient.Management()),
+				},
+				{
+					"MachinesShouldBeInMaintenanceMode",
+					AssertMachineStatus(ctx, rootClient.Omni().State(), true, "", map[string]string{
+						omni.MachineStatusLabelConnected:       "",
+						omni.MachineStatusLabelReportingEvents: "",
+						omni.MachineStatusLabelAvailable:       "",
+						// QEMU-specific labels which should always match, others are specific to the settings (number of cores, etc.)
+						omni.MachineStatusLabelCPU:      "qemu",
+						omni.MachineStatusLabelArch:     "amd64",
+						omni.MachineStatusLabelPlatform: "metal",
+					}, nil),
+				},
+			},
+		},
+		{
+			Name: "TalosImageGeneration",
+			Description: `
+Generate various Talos images with Omni and try to download them.`,
+			Parallel: true,
+			Subtests: []subTest{
+				{
+					"TalosImagesShouldBeDownloadable",
+					AssertSomeImagesAreDownloadable(ctx, rootClient, func(ctx context.Context, req *http.Request) error {
+						return clientconfig.SignHTTPRequest(ctx, rootClient, req)
+					}, options.HTTPEndpoint),
+				},
+			},
+		},
+		{
+			Name: "ForcedMachineRemoval",
+			Description: `
+Tests different scenarios for forced Machine removal (vs. graceful removing from a cluster):
+
+- force remove a Machine which is not allocated (not part of any cluster)
+- force remove a worker Machine which is part of the cluster
+- force remove a control plane Machine which is part of the cluster, and replace with a new Machine.
+
+These tests simulate a hardware failure of a Machine which requires a forced removal from Omni.
+
+In the tests, we wipe and reboot the VMs to bring them back as available for the next test.`,
+			Parallel:     true,
+			MachineClaim: 4,
+			Subtests: subTests(
+				// this test will force-remove a machine, but it will bring it back, so pool of available will be still 4 machines
+				subTest{
+					"UnallocatedMachinesShouldBeDestroyable",
+					AssertUnallocatedMachineDestroyFlow(ctx, rootClient.Omni().State(), options.RestartAMachineFunc),
+				},
+				// this test consumes all 4 available machines and creates a cluster
+				subTest{
+					"ClusterShouldBeCreated",
+					CreateCluster(ctx, rootClient, ClusterOptions{
+						Name:          "integration-forced-removal",
+						ControlPlanes: 3,
+						Workers:       1,
+
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterShouldBeReady(ctx, rootClient, "integration-forced-removal", options.MachineOptions.TalosVersion, talosAPIKeyPrepare)...,
+			).Append(
+				// this test will force-remove a worker, so the cluster will be 3+0, and 1 available machine
+				subTest{
+					"WorkerNodesShouldBeForceRemovable",
+					AssertForceRemoveWorkerNode(ctx, rootClient.Omni().State(), "integration-forced-removal", options.FreezeAMachineFunc, options.WipeAMachineFunc),
+				},
+			).Append(
+				TestBlockClusterShouldBeReady(ctx, rootClient, "integration-forced-removal", options.MachineOptions.TalosVersion, talosAPIKeyPrepare)...,
+			).Append(
+				// this test will add an available machine as a fourth control plane node, but then remove a frozen one, so the cluster is 3+0, and 1 available machine
+				subTest{
+					"ControlPlaneNodeShouldBeForceReplaceable",
+					AssertControlPlaneForceReplaceMachine(ctx, rootClient.Omni().State(), "integration-forced-removal", options),
+				},
+			).Append(
+				TestBlockClusterShouldBeReady(ctx, rootClient, "integration-forced-removal", options.MachineOptions.TalosVersion, talosAPIKeyPrepare)...,
+			).Append(
+				subTest{
+					"ClusterShouldBeDestroyed",
+					AssertDestroyCluster(ctx, rootClient.Omni().State(), "integration-forced-removal"),
+				},
+			),
+			Finalizer: DestroyCluster(ctx, rootClient.Omni().State(), "integration-forced-removal"),
+		},
+		{
+			Name: "ImmediateClusterDestruction",
+			Description: `
+Regression test: create a cluster and destroy it without waiting for the cluster to reach any state.`,
+			Parallel:     true,
+			MachineClaim: 3,
+			Subtests: subTests(
+				subTest{
+					"ClusterShouldBeCreated",
+					CreateCluster(ctx, rootClient, ClusterOptions{
+						Name:          "integration-immediate",
+						ControlPlanes: 1,
+						Workers:       2,
+
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+				subTest{
+					"ClusterShouldBeDestroyedImmediately",
+					AssertDestroyCluster(ctx, rootClient.Omni().State(), "integration-immediate"),
+				},
+			),
+			Finalizer: DestroyCluster(ctx, rootClient.Omni().State(), "integration-immediate"),
+		},
+		TestGroupClusterCreateAndReady(
+			ctx,
+			rootClient,
+			talosAPIKeyPrepare,
+			"default",
+			`
+Create a regular 3 + 2 cluster with HA controlplane, assert that the cluster is ready and accessible.
+Don't do any changes to the cluster.`,
+			ClusterOptions{
+				ControlPlanes: 3,
+				Workers:       2,
+
+				MachineOptions: options.MachineOptions,
+			},
+		),
+		TestGroupClusterCreateAndReady(
+			ctx,
+			rootClient,
+			talosAPIKeyPrepare,
+			"encrypted",
+			`
+Create a 1 + 1 cluster and enable disk encryption via Omni as a KMS.
+Don't do any changes to the cluster.`,
+			ClusterOptions{
+				ControlPlanes: 1,
+				Workers:       1,
+
+				MachineOptions: options.MachineOptions,
+				Features: &specs.ClusterSpec_Features{
+					DiskEncryption: true,
+				},
+			},
+		),
+		TestGroupClusterCreateAndReady(
+			ctx,
+			rootClient,
+			talosAPIKeyPrepare,
+			"singlenode",
+			`
+Create a single node cluster.
+Don't do any changes to the cluster.`,
+			ClusterOptions{
+				ControlPlanes: 1,
+				Workers:       0,
+
+				MachineOptions: options.MachineOptions,
+			},
+		),
+		{
+			Name: "ScaleUpAndDown",
+			Description: `
+Tests scaling up and down a cluster:
+
+- create a 1+0 cluster
+- scale up to 1+1
+- scale up to 3+1
+- scale down to 3+0
+- scale down to 1+0
+
+In between the scaling operations, assert that the cluster is ready and accessible.`,
+			Parallel:     true,
+			MachineClaim: 4,
+			Subtests: subTests(
+				subTest{
+					"ClusterShouldBeCreated",
+					CreateCluster(ctx, rootClient, ClusterOptions{
+						Name:          "integration-scaling",
+						ControlPlanes: 1,
+						Workers:       0,
+
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-scaling",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"OneWorkerShouldBeAdded",
+					ScaleClusterUp(ctx, rootClient.Omni().State(), ClusterOptions{
+						Name:           "integration-scaling",
+						ControlPlanes:  0,
+						Workers:        1,
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-scaling",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"TwoControlPlanesShouldBeAdded",
+					ScaleClusterUp(ctx, rootClient.Omni().State(), ClusterOptions{
+						Name:           "integration-scaling",
+						ControlPlanes:  2,
+						Workers:        0,
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-scaling",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"OneWorkerShouldBeRemoved",
+					ScaleClusterDown(ctx, rootClient.Omni().State(), ClusterOptions{
+						Name:           "integration-scaling",
+						ControlPlanes:  0,
+						Workers:        -1,
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-scaling",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"TwoControlPlanesShouldBeRemoved",
+					ScaleClusterDown(ctx, rootClient.Omni().State(), ClusterOptions{
+						Name:           "integration-scaling",
+						ControlPlanes:  -2,
+						Workers:        0,
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-scaling",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"ClusterShouldBeDestroyed",
+					AssertDestroyCluster(ctx, rootClient.Omni().State(), "integration-scaling"),
+				},
+			),
+			Finalizer: DestroyCluster(ctx, rootClient.Omni().State(), "integration-scaling"),
+		},
+		{
+			Name: "ScaleUpAndDownMachineClassBasedMachineSets",
+			Description: `
+Tests scaling up and down a cluster using machine classes:
+
+- create a 1+0 cluster
+- scale up to 1+1
+- scale up to 3+1
+- scale down to 3+0
+- scale down to 1+0
+
+In between the scaling operations, assert that the cluster is ready and accessible.`,
+			Parallel:     true,
+			MachineClaim: 4,
+			Subtests: subTests(
+				subTest{
+					"ClusterShouldBeCreated",
+					CreateClusterWithMachineClass(ctx, rootClient.Omni().State(), ClusterOptions{
+						Name:          "integration-scaling-machine-class-based-machine-sets",
+						ControlPlanes: 1,
+						Workers:       0,
+
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-scaling-machine-class-based-machine-sets",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"OneWorkerShouldBeAdded",
+					ScaleClusterMachineSets(ctx, rootClient.Omni().State(), ClusterOptions{
+						Name:           "integration-scaling-machine-class-based-machine-sets",
+						ControlPlanes:  0,
+						Workers:        1,
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-scaling-machine-class-based-machine-sets",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"TwoControlPlanesShouldBeAdded",
+					ScaleClusterMachineSets(ctx, rootClient.Omni().State(), ClusterOptions{
+						Name:           "integration-scaling-machine-class-based-machine-sets",
+						ControlPlanes:  2,
+						Workers:        0,
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-scaling-machine-class-based-machine-sets",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"OneWorkerShouldBeRemoved",
+					ScaleClusterMachineSets(ctx, rootClient.Omni().State(), ClusterOptions{
+						Name:           "integration-scaling-machine-class-based-machine-sets",
+						ControlPlanes:  0,
+						Workers:        -1,
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-scaling-machine-class-based-machine-sets",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"TwoControlPlanesShouldBeRemoved",
+					ScaleClusterMachineSets(ctx, rootClient.Omni().State(), ClusterOptions{
+						Name:           "integration-scaling-machine-class-based-machine-sets",
+						ControlPlanes:  -2,
+						Workers:        0,
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-scaling-machine-class-based-machine-sets",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"ClusterShouldBeDestroyed",
+					AssertDestroyCluster(ctx, rootClient.Omni().State(), "integration-scaling-machine-class-based-machine-sets"),
+				},
+			),
+			Finalizer: DestroyCluster(ctx, rootClient.Omni().State(), "integration-scaling"),
+		},
+		{
+			Name: "RollingUpdateParallelism",
+			Description: `
+Tests rolling update & scale down strategies for concurrency control for worker machine sets.
+
+- create a 1+3 cluster
+- update the worker configs with rolling strategy using maxParallelism of 2
+- scale down the workers to 0 with rolling strategy using maxParallelism of 2
+- assert that the maxParallelism of 2 was respected and used in both operations,`,
+			Parallel:     true,
+			MachineClaim: 4,
+			Subtests: subTests(
+				subTest{
+					"ClusterShouldBeCreated",
+					CreateCluster(ctx, rootClient, ClusterOptions{
+						Name:          "integration-rolling-update-parallelism",
+						ControlPlanes: 1,
+						Workers:       3,
+
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-rolling-update-parallelism",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"WorkersUpdateShouldBeRolledOutWithMaxParallelism",
+					AssertWorkerNodesRollingConfigUpdate(ctx, rootClient, "integration-rolling-update-parallelism", 2),
+				},
+				subTest{
+					"WorkersShouldScaleDownWithMaxParallelism",
+					AssertWorkerNodesRollingScaleDown(ctx, rootClient, "integration-rolling-update-parallelism", 2),
+				},
+			).Append(
+				subTest{
+					"ClusterShouldBeDestroyed",
+					AssertDestroyCluster(ctx, rootClient.Omni().State(), "integration-rolling-update-parallelism"),
+				},
+			),
+			Finalizer: DestroyCluster(ctx, rootClient.Omni().State(), "integration-rolling-update-parallelism"),
+		},
+		{
+			Name: "ReplaceControlPlanes",
+			Description: `
+Tests replacing control plane nodes:
+
+- create a 1+0 cluster
+- scale up to 2+0, and immediately remove the first control plane node
+
+In between the scaling operations, assert that the cluster is ready and accessible.`,
+			Parallel:     true,
+			MachineClaim: 2,
+			Subtests: subTests(
+				subTest{
+					"ClusterShouldBeCreated",
+					CreateCluster(ctx, rootClient, ClusterOptions{
+						Name:          "integration-replace-cp",
+						ControlPlanes: 1,
+						Workers:       0,
+
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-replace-cp",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"ControlPlanesShouldBeReplaced",
+					ReplaceControlPlanes(ctx, rootClient.Omni().State(), ClusterOptions{
+						Name: "integration-replace-cp",
+
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-replace-cp",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"ClusterShouldBeDestroyed",
+					AssertDestroyCluster(ctx, rootClient.Omni().State(), "integration-replace-cp"),
+				},
+			),
+			Finalizer: DestroyCluster(ctx, rootClient.Omni().State(), "integration-replace-cp"),
+		},
+		{
+			Name: "ConfigPatching",
+			Description: `
+Tests applying various config patching, including "broken" config patches which should not apply.`,
+			Parallel:     true,
+			MachineClaim: 4,
+			Subtests: subTests(
+				subTest{
+					"ClusterShouldBeCreated",
+					CreateCluster(ctx, rootClient, ClusterOptions{
+						Name:          "integration-config-patching",
+						ControlPlanes: 3,
+						Workers:       1,
+
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-config-patching",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"LargeImmediateConfigPatchShouldBeAppliedAndRemoved",
+					AssertLargeImmediateConfigApplied(ctx, rootClient, "integration-config-patching", talosAPIKeyPrepare),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-config-patching",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"MachineSetConfigPatchShouldBeAppliedAndRemoved",
+					AssertConfigPatchMachineSet(ctx, rootClient, "integration-config-patching"),
+				},
+				subTest{
+					"SingleClusterMachineConfigPatchShouldBeAppliedAndRemoved",
+					AssertConfigPatchSingleClusterMachine(ctx, rootClient, "integration-config-patching"),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-config-patching",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"ConfigPatchWithRebootShouldBeApplied",
+					AssertConfigPatchWithReboot(ctx, rootClient, "integration-config-patching", talosAPIKeyPrepare),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-config-patching",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"InvalidConfigPatchShouldNotBeApplied",
+					AssertConfigPatchWithInvalidConfig(ctx, rootClient, "integration-config-patching", talosAPIKeyPrepare),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-config-patching",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"ClusterShouldBeDestroyed",
+					AssertDestroyCluster(ctx, rootClient.Omni().State(), "integration-config-patching"),
+				},
+			),
+			Finalizer: DestroyCluster(ctx, rootClient.Omni().State(), "integration-config-patching"),
+		},
+		{
+			Name: "TalosUpgrades",
+			Description: `
+Tests upgrading Talos version, including reverting a failed upgrade.`,
+			Parallel:     true,
+			MachineClaim: 4,
+			Subtests: subTests(
+				subTest{
+					"ClusterShouldBeCreated",
+					CreateCluster(ctx, rootClient, ClusterOptions{
+						Name:          "integration-talos-upgrade",
+						ControlPlanes: 3,
+						Workers:       1,
+
+						MachineOptions: MachineOptions{
+							TalosVersion:      options.AnotherTalosVersion,
+							KubernetesVersion: options.AnotherKubernetesVersion, // use older Kubernetes compatible with AnotherTalosVersion
+						},
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-talos-upgrade",
+					options.AnotherTalosVersion,
+					options.AnotherKubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"HelloWorldServiceExtensionShouldBePresent",
+					AssertExtensionIsPresent(ctx, rootClient, "integration-talos-upgrade", HelloWorldServiceExtensionName),
+				},
+				subTest{
+					"TalosSchematicUpdateShouldSucceed",
+					AssertTalosSchematicUpdateFlow(ctx, rootClient, "integration-talos-upgrade"),
+				},
+				subTest{
+					"QemuGuestAgentExtensionShouldBePresent",
+					AssertExtensionIsPresent(ctx, rootClient, "integration-talos-upgrade", QemuGuestAgentExtensionName),
+				},
+				subTest{
+					"ClusterBootstrapManifestSyncShouldBeSuccessful",
+					KubernetesBootstrapManifestSync(ctx, rootClient.Management(), "integration-talos-upgrade"),
+				},
+			).Append(
+				subTest{
+					"TalosUpgradeShouldSucceed",
+					AssertTalosUpgradeFlow(ctx, rootClient.Omni().State(), "integration-talos-upgrade", options.MachineOptions.TalosVersion),
+				},
+				subTest{
+					"ClusterBootstrapManifestSyncShouldBeSuccessful",
+					KubernetesBootstrapManifestSync(ctx, rootClient.Management(), "integration-talos-upgrade"),
+				},
+				subTest{
+					"HelloWorldServiceExtensionShouldBePresent",
+					AssertExtensionIsPresent(ctx, rootClient, "integration-talos-upgrade", HelloWorldServiceExtensionName),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-talos-upgrade",
+					options.MachineOptions.TalosVersion,
+					options.AnotherKubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"FailedTalosUpgradeShouldBeRevertible",
+					AssertTalosUpgradeIsRevertible(ctx, rootClient.Omni().State(), "integration-talos-upgrade", options.MachineOptions.TalosVersion),
+				},
+			).Append(
+				subTest{
+					"RunningTalosUpgradeShouldBeCancelable",
+					AssertTalosUpgradeIsCancelable(ctx, rootClient.Omni().State(), "integration-talos-upgrade", options.MachineOptions.TalosVersion, options.AnotherTalosVersion),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-talos-upgrade",
+					options.MachineOptions.TalosVersion,
+					options.AnotherKubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"ClusterShouldBeDestroyed",
+					AssertDestroyCluster(ctx, rootClient.Omni().State(), "integration-talos-upgrade"),
+				},
+			),
+			Finalizer: DestroyCluster(ctx, rootClient.Omni().State(), "integration-talos-upgrade"),
+		},
+		{
+			Name: "KubernetesUpgrades",
+			Description: `
+Tests upgrading Kubernetes version, including reverting a failed upgrade.`,
+			Parallel:     true,
+			MachineClaim: 4,
+			Subtests: subTests(
+				subTest{
+					"ClusterShouldBeCreated",
+					CreateCluster(ctx, rootClient, ClusterOptions{
+						Name:          "integration-k8s-upgrade",
+						ControlPlanes: 3,
+						Workers:       1,
+
+						MachineOptions: MachineOptions{
+							TalosVersion:      options.MachineOptions.TalosVersion,
+							KubernetesVersion: options.AnotherKubernetesVersion,
+						},
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-k8s-upgrade",
+					options.MachineOptions.TalosVersion,
+					options.AnotherKubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"KubernetesUpgradeShouldSucceed",
+					AssertKubernetesUpgradeFlow(
+						ctx, rootClient.Omni().State(), rootClient.Management(),
+						"integration-k8s-upgrade",
+						options.MachineOptions.KubernetesVersion,
+					),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-k8s-upgrade",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"FailedKubernetesUpgradeShouldBeRevertible",
+					AssertKubernetesUpgradeIsRevertible(ctx, rootClient.Omni().State(), "integration-k8s-upgrade", options.MachineOptions.KubernetesVersion),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-k8s-upgrade",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"ClusterShouldBeDestroyed",
+					AssertDestroyCluster(ctx, rootClient.Omni().State(), "integration-k8s-upgrade"),
+				},
+			),
+			Finalizer: DestroyCluster(ctx, rootClient.Omni().State(), "integration-k8s-upgrade"),
+		},
+		{
+			Name: "EtcdBackupAndRestore",
+			Description: `
+Tests automatic & manual backup & restore for workload etcd.
+
+Automatic backups are enabled, done, and then a manual backup is created.
+Afterwards, a cluster's control plane is destroyed then recovered from the backup.
+
+Finally, a completely new cluster is created using the same backup to test the "point-in-time recovery".`,
+			Parallel:     true,
+			MachineClaim: 6,
+			Subtests: subTests(
+				subTest{
+					"ClusterShouldBeCreated",
+					CreateCluster(ctx, rootClient, ClusterOptions{
+						Name:          "integration-etcd-backup",
+						ControlPlanes: 3,
+						Workers:       1,
+
+						EtcdBackup: &specs.EtcdBackupConf{
+							Interval: durationpb.New(2 * time.Hour),
+							Enabled:  true,
+						},
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-etcd-backup",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				TestBlockKubernetesDeploymentCreateAndRunning(ctx, rootClient.Management(), "integration-etcd-backup",
+					"default",
+					"test",
+				)...,
+			).Append(
+				subTest{
+					"KubernetesSecretShouldBeCreated",
+					AssertKubernetesSecretIsCreated(ctx, rootClient.Management(), "integration-etcd-backup", "default", "test", "backup-test-secret-val"),
+				},
+				subTest{
+					"EtcdAutomaticBackupShouldBeCreated",
+					AssertEtcdAutomaticBackupIsCreated(ctx, rootClient.Omni().State(), "integration-etcd-backup"),
+				},
+				subTest{
+					"EtcdManualBackupShouldBeCreated",
+					AssertEtcdManualBackupIsCreated(ctx, rootClient.Omni().State(), "integration-etcd-backup"),
+				},
+			).Append(
+				TestBlockCreateClusterFromEtcdBackup(ctx, rootClient, talosAPIKeyPrepare, options,
+					"integration-etcd-backup",
+					"integration-etcd-backup-new-cluster",
+					"default",
+					"test",
+				)...,
+			).Append(
+				subTest{
+					"EtcdSecretShouldBeSameAfterCreateFromBackup",
+					AssertKubernetesSecretHasValue(ctx, rootClient.Management(), "integration-etcd-backup-new-cluster", "default", "test", "backup-test-secret-val"),
+				},
+				subTest{
+					"NewClusterShouldBeDestroyed",
+					AssertDestroyCluster(ctx, rootClient.Omni().State(), "integration-etcd-backup-new-cluster"),
+				},
+			).Append(
+				TestBlockRestoreEtcdFromLatestBackup(ctx, rootClient, talosAPIKeyPrepare, options, 3,
+					"integration-etcd-backup",
+					"default",
+					"test",
+				)...,
+			).Append(
+				subTest{
+					"RestoredClusterShouldBeDestroyed",
+					AssertDestroyCluster(ctx, rootClient.Omni().State(), "integration-etcd-backup"),
+				},
+			),
+			Finalizer: func(t *testing.T) {
+				DestroyCluster(ctx, rootClient.Omni().State(), "integration-etcd-backup")(t)
+				DestroyCluster(ctx, rootClient.Omni().State(), "integration-etcd-backup-new-cluster")(t)
+			},
+		},
+		{
+			Name: "MaintenanceUpgrade",
+			Description: `
+		Test upgrading (downgrading) a machine in maintenance mode.
+
+		Create a cluster out of a single machine on version1, remove cluster (the machine will stay on version1, Talos is installed).
+		Create a cluster out of the same machine on version2, Omni should upgrade the machine to version2 while in maintenance.
+		`,
+			Parallel:     true,
+			MachineClaim: 1,
+			Subtests: subTests(
+				subTest{
+					"MachineShouldBeUpgradedInMaintenanceMode",
+					AssertMachineShouldBeUpgradedInMaintenanceMode(
+						ctx, rootClient,
+						"integration-maintenance-upgrade",
+						options.AnotherKubernetesVersion,
+						options.MachineOptions.TalosVersion,
+						options.AnotherTalosVersion,
+						talosAPIKeyPrepare,
+					),
+				},
+			),
+			Finalizer: DestroyCluster(ctx, rootClient.Omni().State(), "integration-maintenance-upgrade"),
+		},
+		{
+			Name: "Auth",
+			Description: `
+Test authorization on accessing Omni API, some tests run without a cluster, some only run with a context of a cluster.`,
+			MachineClaim: 1,
+			Parallel:     true,
+			Subtests: subTests(
+				subTest{
+					"AnonymousRequestShouldBeDenied",
+					AssertAnonymousAuthenication(ctx, rootClient),
+				},
+				subTest{
+					"InvalidSignatureShouldBeDenied",
+					AssertAPIInvalidSignature(ctx, rootClient),
+				},
+				subTest{
+					"PublicKeyWithoutLifetimeShouldNotBeRegistered",
+					AssertPublicKeyWithoutLifetimeNotRegistered(ctx, rootClient),
+				},
+				subTest{
+					"PublicKeyWithLongLifetimeShouldNotBeRegistered",
+					AssertPublicKeyWithLongLifetimeNotRegistered(ctx, rootClient),
+				},
+				subTest{
+					"OmniconfigShouldBeDownloadable",
+					AssertOmniconfigDownload(ctx, rootClient),
+				},
+				subTest{
+					"PublicKeyWithUnknownEmailShouldNotBeRegistered",
+					AssertRegisterPublicKeyWithUnknownEmail(ctx, rootClient),
+				},
+				subTest{
+					"ServiceAccountAPIShouldWork",
+					AssertServiceAccountAPIFlow(ctx, rootClient),
+				},
+				subTest{
+					"ResourceAuthzShouldWork",
+					AssertResourceAuthz(ctx, rootClient, clientConfig),
+				},
+				subTest{
+					"ResourceAuthzWithACLShouldWork",
+					AssertResourceAuthzWithACL(ctx, rootClient, clientConfig),
+				},
+			).Append(
+				subTest{
+					"ClusterShouldBeCreated",
+					CreateCluster(ctx, rootClient, ClusterOptions{
+						Name:          "integration-auth",
+						ControlPlanes: 1,
+						Workers:       0,
+
+						MachineOptions: options.MachineOptions,
+					}),
+				},
+			).Append(
+				TestBlockClusterAndTalosAPIAndKubernetesShouldBeReady(
+					ctx, rootClient,
+					"integration-auth",
+					options.MachineOptions.TalosVersion,
+					options.MachineOptions.KubernetesVersion,
+					talosAPIKeyPrepare,
+				)...,
+			).Append(
+				subTest{
+					"APIAuthorizationShouldBeTested",
+					AssertAPIAuthz(ctx, rootClient, clientConfig, "integration-auth"),
+				},
+			).Append(
+				subTest{
+					"ClusterShouldBeDestroyed",
+					AssertDestroyCluster(ctx, rootClient.Omni().State(), "integration-auth"),
+				},
+			),
+			Finalizer: DestroyCluster(ctx, rootClient.Omni().State(), "integration-auth"),
+		},
+		{
+			Name: "ClusterTemplate",
+			Description: `
+Test flow of cluster creation and scaling using cluster templates.`,
+			Parallel:     true,
+			MachineClaim: 5,
+			Subtests: []subTest{
+				{
+					"TestClusterTemplateFlow",
+					AssertClusterTemplateFlow(ctx, rootClient.Omni().State()),
+				},
+			},
+			Finalizer: DestroyCluster(ctx, rootClient.Omni().State(), "tmpl-cluster"),
+		},
+	}
+
+	var re *regexp.Regexp
+
+	if options.RunTestPattern != "" {
+		var err error
+
+		if re, err = regexp.Compile(options.RunTestPattern); err != nil {
+			log.Printf("run test pattern parse error: %s", err)
+
+			return err
+		}
+	}
+
+	var testsToRun []testGroup
+
+	for _, group := range testList {
+		if re == nil || re.MatchString(group.Name) {
+			testsToRun = append(testsToRun, group)
+
+			continue
+		}
+
+		matchedGroup := group
+		matchedGroup.Subtests = xslices.Filter(matchedGroup.Subtests, func(test subTest) bool {
+			fullName := fmt.Sprintf("%s/%s", group.Name, test.Name)
+
+			return re.MatchString(fullName)
+		})
+
+		if len(matchedGroup.Subtests) > 0 {
+			testsToRun = append(testsToRun, matchedGroup)
+		}
+	}
+
+	for _, group := range testsToRun {
+		if group.MachineClaim > options.ExpectedMachines {
+			return fmt.Errorf("test group %q requires %d machines, but only %d are expected", group.Name, group.MachineClaim, options.ExpectedMachines)
+		}
+	}
+
+	machineSemaphore := semaphore.NewWeighted(int64(options.ExpectedMachines))
+
+	exitCode := testing.MainStart(
+		matchStringOnly(func(string, string) (bool, error) { return true, nil }),
+		makeTests(ctx, testsToRun, machineSemaphore),
+		nil,
+		nil,
+		nil,
+	).Run()
+
+	if exitCode != 0 {
+		return errors.New("test failed")
+	}
+
+	return nil
+}
+
+func makeTests(ctx context.Context, testsToRun []testGroup, machineSemaphore *semaphore.Weighted) []testing.InternalTest {
+	return xslices.Map(testsToRun, func(group testGroup) testing.InternalTest {
+		return testing.InternalTest{
+			Name: group.Name,
+			F: func(t *testing.T) {
+				if group.Parallel {
+					t.Parallel()
+				}
+
+				assert.NotEmpty(t, group.Name)
+
+				t.Logf("[%s]:\n%s", group.Name, strings.TrimSpace(group.Description))
+
+				if group.MachineClaim > 0 {
+					t.Logf("attempting to acquire semaphore for %d machines", group.MachineClaim)
+
+					if err := machineSemaphore.Acquire(ctx, int64(group.MachineClaim)); err != nil {
+						t.Fatalf("failed to acquire machine semaphore: %s", err)
+					}
+
+					t.Logf("acquired semaphore for %d machines", group.MachineClaim)
+
+					t.Cleanup(func() {
+						t.Logf("releasing semaphore for %d machines", group.MachineClaim)
+
+						machineSemaphore.Release(int64(group.MachineClaim))
+					})
+				}
+
+				var testGroupFailed bool
+
+				for _, elem := range group.Subtests {
+					testGroupFailed = !t.Run(elem.Name, elem.F)
+					if testGroupFailed {
+						break
+					}
+				}
+
+				if testGroupFailed && group.Finalizer != nil {
+					t.Logf("running finalizer, as the test group failed")
+
+					group.Finalizer(t)
+				}
+			},
+		}
+	})
+}
+
+//nolint:govet
+type testGroup struct {
+	Name         string
+	Description  string
+	Parallel     bool
+	MachineClaim int
+	Subtests     []subTest
+	Finalizer    func(t *testing.T)
+}
+
+//nolint:govet
+type subTest struct {
+	Name string
+	F    func(t *testing.T)
+}
+
+type subTestList []subTest
+
+func subTests(items ...subTest) subTestList {
+	return items
+}
+
+func (l subTestList) Append(items ...subTest) subTestList {
+	return append(l, items...)
+}
diff --git a/cmd/omni-integration-test/pkg/tests/utils.go b/cmd/omni-integration-test/pkg/tests/utils.go
new file mode 100644
index 000000000..b488d1a1c
--- /dev/null
+++ b/cmd/omni-integration-test/pkg/tests/utils.go
@@ -0,0 +1,57 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package tests
+
+import (
+	"errors"
+	"io"
+	"reflect"
+	"time"
+)
+
+type corpusEntry = struct {
+	Parent     string
+	Path       string
+	Data       []byte
+	Values     []any
+	Generation int
+	IsSeed     bool
+}
+
+var errMain = errors.New("testing: unexpected use of func Main")
+
+type matchStringOnly func(pat, str string) (bool, error)
+
+func (f matchStringOnly) MatchString(pat, str string) (bool, error) { return f(pat, str) }
+
+func (f matchStringOnly) StartCPUProfile(io.Writer) error { return errMain }
+
+func (f matchStringOnly) StopCPUProfile() {}
+
+func (f matchStringOnly) WriteProfileTo(string, io.Writer, int) error { return errMain }
+
+func (f matchStringOnly) ImportPath() string { return "" }
+
+func (f matchStringOnly) StartTestLog(io.Writer) {}
+
+func (f matchStringOnly) StopTestLog() error { return errMain }
+
+func (f matchStringOnly) SetPanicOnExit0(bool) {}
+
+func (f matchStringOnly) CoordinateFuzzing(time.Duration, int64, time.Duration, int64, int, []corpusEntry, []reflect.Type, string, string) error {
+	return nil
+}
+
+func (f matchStringOnly) RunFuzzWorker(func(corpusEntry) error) error { return nil }
+
+func (f matchStringOnly) ReadCorpus(string, []reflect.Type) ([]corpusEntry, error) {
+	return nil, nil
+}
+
+func (f matchStringOnly) CheckCorpus([]any, []reflect.Type) error { return nil }
+
+func (f matchStringOnly) ResetCoverage()    {}
+func (f matchStringOnly) SnapshotCoverage() {}
diff --git a/cmd/omni-integration-test/root.go b/cmd/omni-integration-test/root.go
new file mode 100644
index 000000000..53a0eb7af
--- /dev/null
+++ b/cmd/omni-integration-test/root.go
@@ -0,0 +1,149 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/url"
+	"os"
+	"os/exec"
+	"os/signal"
+
+	"github.com/mattn/go-shellwords"
+	"github.com/spf13/cobra"
+
+	clientconsts "github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/cmd/omni-integration-test/pkg/clientconfig"
+	"github.com/siderolabs/omni/cmd/omni-integration-test/pkg/tests"
+	"github.com/siderolabs/omni/internal/pkg/constants"
+)
+
+// rootCmd represents the base command when called without any subcommands.
+var rootCmd = &cobra.Command{
+	Use:   "omni-integration-test",
+	Short: "Omni integration test runner.",
+	Long:  ``,
+	RunE: func(*cobra.Command, []string) error {
+		return withContext(func(ctx context.Context) error {
+			// hacky hack
+			os.Args = append(os.Args[0:1], "-test.v")
+
+			testOptions := tests.Options{
+				RunTestPattern: rootCmdFlags.runTestPattern,
+
+				ExpectedMachines: rootCmdFlags.expectedMachines,
+
+				MachineOptions:           rootCmdFlags.machineOptions,
+				AnotherTalosVersion:      rootCmdFlags.anotherTalosVersion,
+				AnotherKubernetesVersion: rootCmdFlags.anotherKubernetesVersion,
+			}
+
+			if rootCmdFlags.restartAMachineScript != "" {
+				parsedScript, err := shellwords.Parse(rootCmdFlags.restartAMachineScript)
+				if err != nil {
+					return fmt.Errorf("error parsing restart a machine script: %w", err)
+				}
+
+				testOptions.RestartAMachineFunc = func(ctx context.Context, uuid string) error {
+					return execCmd(ctx, parsedScript, uuid)
+				}
+			}
+
+			if rootCmdFlags.wipeAMachineScript != "" {
+				parsedScript, err := shellwords.Parse(rootCmdFlags.wipeAMachineScript)
+				if err != nil {
+					return fmt.Errorf("error parsing wipe a machine script: %w", err)
+				}
+
+				testOptions.WipeAMachineFunc = func(ctx context.Context, uuid string) error {
+					return execCmd(ctx, parsedScript, uuid)
+				}
+			}
+
+			if rootCmdFlags.freezeAMachineScript != "" {
+				parsedScript, err := shellwords.Parse(rootCmdFlags.freezeAMachineScript)
+				if err != nil {
+					return fmt.Errorf("error parsing freeze a machine script: %w", err)
+				}
+
+				testOptions.FreezeAMachineFunc = func(ctx context.Context, uuid string) error {
+					return execCmd(ctx, parsedScript, uuid)
+				}
+			}
+
+			u, err := url.Parse(rootCmdFlags.endpoint)
+			if err != nil {
+				return errors.New("error parsing endpoint")
+			}
+
+			if u.Scheme == "grpc" {
+				u.Scheme = "http"
+			}
+
+			testOptions.HTTPEndpoint = u.String()
+
+			clientConfig := clientconfig.New(rootCmdFlags.endpoint)
+			defer clientConfig.Close() //nolint:errcheck
+
+			return tests.Run(ctx, clientConfig, testOptions)
+		})
+	},
+}
+
+func execCmd(ctx context.Context, parsedScript []string, args ...string) error {
+	cmd := exec.CommandContext(ctx, parsedScript[0], append(parsedScript[1:], args...)...)
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+
+	return cmd.Run()
+}
+
+//nolint:govet
+var rootCmdFlags struct {
+	endpoint       string
+	runTestPattern string
+
+	expectedMachines int
+
+	restartAMachineScript    string
+	wipeAMachineScript       string
+	freezeAMachineScript     string
+	anotherTalosVersion      string
+	anotherKubernetesVersion string
+
+	machineOptions tests.MachineOptions
+}
+
+func init() {
+	rootCmd.PersistentFlags().StringVar(&rootCmdFlags.endpoint, "endpoint", "grpc://127.0.0.1:8080", "The endpoint of the Omni API.")
+	rootCmd.Flags().StringVar(&rootCmdFlags.runTestPattern, "test.run", "", "tests to run (regular expression)")
+	rootCmd.Flags().IntVar(&rootCmdFlags.expectedMachines, "expected-machines", 4, "minimum number of machines expected")
+	rootCmd.Flags().StringVar(&rootCmdFlags.restartAMachineScript, "restart-a-machine-script", "hack/test/restart-a-vm.sh", "a script to run to restart a machine by UUID (optional)")
+	rootCmd.Flags().StringVar(&rootCmdFlags.wipeAMachineScript, "wipe-a-machine-script", "hack/test/wipe-a-vm.sh", "a script to run to wipe a machine by UUID (optional)")
+	rootCmd.Flags().StringVar(&rootCmdFlags.freezeAMachineScript, "freeze-a-machine-script", "hack/test/freeze-a-vm.sh", "a script to run to freeze a machine by UUID (optional)")
+	rootCmd.Flags().StringVar(&rootCmdFlags.anotherTalosVersion, "another-talos-version",
+		constants.AnotherTalosVersion,
+		"Talos version for upgrade test",
+	)
+	rootCmd.Flags().StringVar(
+		&rootCmdFlags.machineOptions.TalosVersion,
+		"talos-version",
+		clientconsts.DefaultTalosVersion,
+		"installer version for workload clusters",
+	)
+	rootCmd.Flags().StringVar(&rootCmdFlags.machineOptions.KubernetesVersion, "kubernetes-version", constants.DefaultKubernetesVersion, "Kubernetes version for workload clusters")
+	rootCmd.Flags().StringVar(&rootCmdFlags.anotherKubernetesVersion, "another-kubernetes-version", constants.AnotherKubernetesVersion, "Kubernetes version for upgrade tests")
+}
+
+// withContext wraps with CLI context.
+func withContext(f func(ctx context.Context) error) error {
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer stop()
+
+	return f(ctx)
+}
diff --git a/cmd/omni/main.go b/cmd/omni/main.go
new file mode 100644
index 000000000..1075d34e6
--- /dev/null
+++ b/cmd/omni/main.go
@@ -0,0 +1,424 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package main ...
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/go-logr/zapr"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/siderolabs/gen/ensure"
+	"github.com/siderolabs/go-debug"
+	"github.com/siderolabs/talos/pkg/machinery/config/generate"
+	"github.com/spf13/cobra"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
+	"k8s.io/klog/v2"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	authres "github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/internal/backend"
+	"github.com/siderolabs/omni/internal/backend/dns"
+	"github.com/siderolabs/omni/internal/backend/logging"
+	"github.com/siderolabs/omni/internal/backend/resourcelogger"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/virtual"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+	"github.com/siderolabs/omni/internal/backend/workloadproxy"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/auth/user"
+	"github.com/siderolabs/omni/internal/pkg/config"
+	"github.com/siderolabs/omni/internal/pkg/features"
+	"github.com/siderolabs/omni/internal/pkg/siderolink"
+	"github.com/siderolabs/omni/internal/version"
+)
+
+func runDebugServer(ctx context.Context, logger *zap.Logger) {
+	const debugAddr = ":9980"
+
+	debugLogFunc := func(msg string) {
+		logger.Info(msg)
+	}
+
+	if err := debug.ListenAndServe(ctx, debugAddr, debugLogFunc); err != nil {
+		logger.Panic("failed to start debug server", zap.Error(err))
+	}
+}
+
+// rootCmd represents the base command when called without any subcommands.
+var rootCmd = &cobra.Command{
+	Use:          "omni",
+	Short:        "Talos and Sidero frontend",
+	Long:         ``,
+	SilenceUsage: true,
+	Version:      version.Tag,
+	RunE: func(*cobra.Command, []string) error {
+		if config.Config.Auth.SAML.URL != "" && config.Config.Auth.SAML.Metadata != "" {
+			return errors.New("flags --auth-saml-url and --auth-saml-metadata are mutually exclusive")
+		}
+
+		var loggerConfig zap.Config
+
+		if constants.IsDebugBuild {
+			loggerConfig = zap.NewDevelopmentConfig()
+			loggerConfig.EncoderConfig.EncodeLevel = zapcore.CapitalColorLevelEncoder
+		} else {
+			loggerConfig = zap.NewProductionConfig()
+		}
+
+		if !rootCmdArgs.debug {
+			loggerConfig.Level.SetLevel(zap.InfoLevel)
+		} else {
+			loggerConfig.Level.SetLevel(zap.DebugLevel)
+		}
+
+		logger, err := loggerConfig.Build(
+			zap.AddStacktrace(zapcore.FatalLevel), // only print stack traces for fatal errors
+		)
+		if err != nil {
+			return fmt.Errorf("failed to set up logging: %w", err)
+		}
+
+		// set kubernetes logger to use warn log level and use zap
+		klog.SetLogger(zapr.NewLogger(logger.WithOptions(zap.IncreaseLevel(zapcore.WarnLevel)).With(logging.Component("kubernetes"))))
+
+		if constants.IsDebugBuild {
+			logger.Warn("running debug build")
+		}
+
+		for _, registryMirror := range rootCmdArgs.registryMirrors {
+			hostname, endpoint, ok := strings.Cut(registryMirror, "=")
+			if !ok {
+				return fmt.Errorf("invalid registry mirror spec: %q", registryMirror)
+			}
+
+			config.Config.DefaultConfigGenOptions = append(config.Config.DefaultConfigGenOptions, generate.WithRegistryMirror(hostname, endpoint))
+		}
+
+		logger.Info("starting Omni", zap.String("version", version.Tag))
+
+		logger.Debug("using config", zap.Any("config", config.Config))
+
+		signals := make(chan os.Signal, 1)
+
+		signal.Notify(signals, syscall.SIGINT, syscall.SIGTERM)
+
+		ctx, stop := context.WithCancel(context.Background())
+		defer stop()
+
+		// do not use signal.NotifyContext as it doesn't support any ways to log the received signal
+		go func() {
+			s := <-signals
+
+			logger.Warn("signal received, stopping Omni", zap.String("signal", s.String()))
+
+			stop()
+		}()
+
+		go runDebugServer(ctx, logger)
+
+		// this global context propagates into all controllers and any other background activities
+		ctx = actor.MarkContextAsInternalActor(ctx)
+
+		err = omni.NewState(ctx, config.Config, logger, prometheus.DefaultRegisterer, runWithState(logger))
+		if err != nil {
+			return fmt.Errorf("failed to run Omni: %w", err)
+		}
+
+		return nil
+	},
+}
+
+func runWithState(logger *zap.Logger) func(context.Context, state.State, *virtual.State) error {
+	return func(ctx context.Context, resourceState state.State, virtualState *virtual.State) error {
+		talosClientFactory := talos.NewClientFactory(resourceState, logger)
+		prometheus.MustRegister(talosClientFactory)
+
+		dnsService := dns.NewService(resourceState, logger)
+
+		workloadProxyServiceRegistry, err := workloadproxy.NewServiceRegistry(resourceState, logger)
+		if err != nil {
+			return fmt.Errorf("failed to set up workload proxy service registry: %w", err)
+		}
+
+		var resourceLogger *resourcelogger.Logger
+
+		if len(config.Config.LogResourceUpdatesTypes) > 0 {
+			resourceLogger, err = resourcelogger.New(ctx, resourceState, logger.With(logging.Component("resourcelogger")),
+				config.Config.LogResourceUpdatesLogLevel, config.Config.LogResourceUpdatesTypes...)
+			if err != nil {
+				return fmt.Errorf("failed to set up resource logger: %w", err)
+			}
+		}
+
+		linkCounterDeltaCh := make(chan siderolink.LinkCounterDeltas)
+
+		omniRuntime, err := omni.New(talosClientFactory, dnsService, workloadProxyServiceRegistry, resourceLogger,
+			linkCounterDeltaCh, resourceState, virtualState, prometheus.DefaultRegisterer, logger.With(logging.Component("omni_runtime")))
+		if err != nil {
+			return fmt.Errorf("failed to set up the controller runtime: %w", err)
+		}
+
+		machineMap := siderolink.NewMachineMap(siderolink.NewStateStorage(omniRuntime.State()))
+		logHandler := siderolink.NewLogHandler(
+			machineMap,
+			resourceState,
+			&config.Config.LogStorage,
+			logger.With(logging.Component("siderolink_log_handler")),
+		)
+
+		talosRuntime := talos.New(talosClientFactory, logger)
+
+		err = user.EnsureInitialResources(ctx, omniRuntime.State(), logger, config.Config.InitialUsers)
+		if err != nil {
+			return fmt.Errorf("failed to write initial user resources to state: %w", err)
+		}
+
+		authConfig, err := auth.EnsureAuthConfigResource(ctx, omniRuntime.State(), logger, config.Config.Auth)
+		if err != nil {
+			return fmt.Errorf("failed to write Auth0 parameters to state: %w", err)
+		}
+
+		if err = features.UpdateResources(ctx, omniRuntime.State(), logger); err != nil {
+			return fmt.Errorf("failed to update features config resources: %w", err)
+		}
+
+		ctx = context.WithValue(ctx, auth.EnabledAuthContextKey{}, authres.Enabled(authConfig))
+
+		handler, err := backend.NewFrontendHandler(rootCmdArgs.frontendDst, logger)
+		if err != nil {
+			return fmt.Errorf("failed to set up frontend handler: %w", err)
+		}
+
+		server, err := backend.NewServer(
+			rootCmdArgs.bindAddress,
+			rootCmdArgs.metricsBindAddress,
+			rootCmdArgs.k8sProxyBindAddress,
+			rootCmdArgs.pprofBindAddress,
+			dnsService,
+			workloadProxyServiceRegistry,
+			linkCounterDeltaCh,
+			omniRuntime,
+			talosRuntime,
+			logHandler,
+			authConfig,
+			rootCmdArgs.keyFile,
+			rootCmdArgs.certFile,
+			backend.NewProxyServer(rootCmdArgs.frontendBind, handler, rootCmdArgs.keyFile, rootCmdArgs.certFile),
+			logger,
+		)
+		if err != nil {
+			return fmt.Errorf("failed to create server: %w", err)
+		}
+
+		if err := server.Run(ctx); err != nil {
+			return fmt.Errorf("failed to run server: %w", err)
+		}
+
+		return nil
+	}
+}
+
+var rootCmdArgs struct {
+	bindAddress         string
+	frontendBind        string
+	frontendDst         string
+	k8sProxyBindAddress string
+	metricsBindAddress  string
+	pprofBindAddress    string
+	keyFile             string
+	certFile            string
+	registryMirrors     []string
+
+	debug bool
+}
+
+func main() {
+	if err := rootCmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}
+
+func init() {
+	rootCmd.Flags().BoolVar(&rootCmdArgs.debug, "debug", false, "enable debug logs.")
+	rootCmd.Flags().StringVar(&rootCmdArgs.bindAddress, "bind-addr", "0.0.0.0:8080", "start HTTP server on the defined address.")
+	rootCmd.Flags().StringVar(&rootCmdArgs.frontendDst, "frontend-dst", "", "destination address non API requests from proxy server.")
+	rootCmd.Flags().StringVar(&rootCmdArgs.frontendBind, "frontend-bind", "", "proxy server which will redirect all non API requests to the definied frontend server.")
+	rootCmd.Flags().StringVar(&rootCmdArgs.metricsBindAddress, "metrics-bind-addr", "0.0.0.0:2122", "start Prometheus HTTP server on the defined address.")
+	rootCmd.Flags().StringVar(&rootCmdArgs.pprofBindAddress, "pprof-bind-addr", "", "start pprof HTTP server on the defined address (\"\" if disabled).")
+	rootCmd.Flags().StringVar(&rootCmdArgs.k8sProxyBindAddress, "k8s-proxy-bind-addr", "0.0.0.0:8095", "start Kubernetes workload proxy on the defined address.")
+	rootCmd.Flags().StringSliceVar(&rootCmdArgs.registryMirrors, "registry-mirror", []string{}, "list of registry mirrors to use in format: <registry host>=<mirror URL>")
+
+	rootCmd.Flags().StringVar(&config.Config.AccountID, "account-id", config.Config.AccountID, "instance account ID, should never be changed.")
+	rootCmd.Flags().StringVar(&config.Config.Name, "name", config.Config.Name, "instance user-facing name.")
+	rootCmd.Flags().StringVar(&config.Config.APIURL, "advertised-api-url", config.Config.APIURL, "advertised API frontend URL.")
+	rootCmd.Flags().StringVar(&config.Config.KubernetesProxyURL, "advertised-kubernetes-proxy-url", config.Config.KubernetesProxyURL, "advertised Kubernetes proxy URL.")
+	rootCmd.Flags().BoolVar(&config.Config.SiderolinkDisableLastEndpoint, "siderolink-disable-last-endpoint", false, "do not populate last known peer endpoint for the wireguard peers")
+	rootCmd.Flags().StringVar(
+		&config.Config.SiderolinkWireguardAdvertisedAddress,
+		"siderolink-wireguard-advertised-addr",
+		config.Config.SiderolinkWireguardAdvertisedAddress,
+		"advertised wireguard address which is passed down to the nodes.")
+	rootCmd.Flags().StringVar(&config.Config.SiderolinkWireguardBindAddress, "siderolink-wireguard-bind-addr", config.Config.SiderolinkWireguardBindAddress, "Siderolink wireguard bind address.")
+
+	rootCmd.Flags().StringVar(&config.Config.MachineAPIBindAddress, "siderolink-api-bind-addr", config.Config.MachineAPIBindAddress, "SideroLink provision bind address.")
+	rootCmd.Flags().StringVar(&config.Config.MachineAPICertFile, "siderolink-api-cert", config.Config.MachineAPICertFile, "SideroLink TLS cert file path.")
+	rootCmd.Flags().StringVar(&config.Config.MachineAPIKeyFile, "siderolink-api-key", config.Config.MachineAPIKeyFile, "SideroLink TLS key file path.")
+
+	rootCmd.Flags().MarkDeprecated("siderolink-api-bind-addr", "--deprecated, use --machine-api-bind-addr") //nolint:errcheck
+	rootCmd.Flags().MarkDeprecated("siderolink-api-cert", "deprecated, use --machine-api-cert")             //nolint:errcheck
+	rootCmd.Flags().MarkDeprecated("siderolink-api-key", "deprecated, use --machine-api-key")               //nolint:errcheck
+
+	rootCmd.Flags().StringVar(&config.Config.MachineAPIBindAddress, "machine-api-bind-addr", config.Config.MachineAPIBindAddress, "machine API bind address.")
+	rootCmd.Flags().StringVar(&config.Config.MachineAPICertFile, "machine-api-cert", config.Config.MachineAPICertFile, "machine API TLS cert file path.")
+	rootCmd.Flags().StringVar(&config.Config.MachineAPIKeyFile, "machine-api-key", config.Config.MachineAPIKeyFile, "machine API TLS key file path.")
+
+	rootCmd.Flags().IntVar(&config.Config.EventSinkPort, "event-sink-port", config.Config.EventSinkPort, "event sink bind port.")
+	rootCmd.Flags().StringVar(&config.Config.SideroLinkAPIURL, "siderolink-api-advertised-url", config.Config.SideroLinkAPIURL, "SideroLink advertised API URL.")
+	rootCmd.Flags().IntVar(&config.Config.LoadBalancer.MinPort, "lb-min-port", config.Config.LoadBalancer.MinPort, "cluster load balancer port range min value.")
+	rootCmd.Flags().IntVar(&config.Config.LoadBalancer.MaxPort, "lb-max-port", config.Config.LoadBalancer.MaxPort, "cluster load balancer port range max value.")
+	rootCmd.Flags().IntVar(&config.Config.LogServerPort, "log-server-port", config.Config.LogServerPort, "port for TCP log server")
+
+	rootCmd.Flags().BoolVar(&config.Config.LogStorage.Enabled, "log-storage-enabled", config.Config.LogStorage.Enabled, "enable log storage")
+	rootCmd.Flags().StringVar(&config.Config.LogStorage.Path, "log-storage-path", config.Config.LogStorage.Path, "path of the directory for storing logs")
+	rootCmd.Flags().DurationVar(&config.Config.LogStorage.FlushPeriod, "log-storage-flush-period", config.Config.LogStorage.FlushPeriod, "period for flushing logs to disk")
+
+	rootCmd.Flags().BoolVar(&config.Config.Auth.Auth0.Enabled, "auth-auth0-enabled", config.Config.Auth.Auth0.Enabled,
+		"enable Auth0 authentication. Once set to true, it cannot be set back to false.")
+	rootCmd.Flags().StringVar(&config.Config.Auth.Auth0.ClientID, "auth-auth0-client-id", config.Config.Auth.Auth0.ClientID, "Auth0 application client ID.")
+	rootCmd.Flags().StringVar(&config.Config.Auth.Auth0.Domain, "auth-auth0-domain", config.Config.Auth.Auth0.Domain, "Auth0 application domain.")
+
+	rootCmd.Flags().BoolVar(&config.Config.Auth.WebAuthn.Enabled, "auth-webauthn-enabled", config.Config.Auth.WebAuthn.Enabled,
+		"enable WebAuthn authentication. Once set to true, it cannot be set back to false.")
+	rootCmd.Flags().BoolVar(&config.Config.Auth.WebAuthn.Required, "auth-webauthn-required", config.Config.Auth.WebAuthn.Required,
+		"require WebAuthn authentication. Once set to true, it cannot be set back to false.")
+
+	rootCmd.Flags().BoolVar(&config.Config.Auth.SAML.Enabled, "auth-saml-enabled", config.Config.Auth.SAML.Enabled,
+		"enabled SAML authentication.",
+	)
+	rootCmd.Flags().StringVar(&config.Config.Auth.SAML.URL, "auth-saml-url", config.Config.Auth.SAML.URL, "SAML identity provider metadata URL (mutually exclusive with --auth-saml-metadata")
+	rootCmd.Flags().StringVar(&config.Config.Auth.SAML.Metadata, "auth-saml-metadata", config.Config.Auth.SAML.Metadata,
+		"SAML identity provider metadata file path (mutually exclusive with --auth-saml-url).",
+	)
+	rootCmd.Flags().Var(&config.Config.Auth.SAML.LabelRules, "auth-saml-label-rules", "defines mapping of SAML assertion attributes into Omni identity labels")
+
+	rootCmd.Flags().StringSliceVar(&config.Config.InitialUsers, "initial-users", config.Config.InitialUsers, "initial set of user emails. these users will be created on startup.")
+
+	rootCmd.Flags().StringVar(&config.Config.Storage.Kind, "storage-kind", config.Config.Storage.Kind, "storage type: etcd|boltdb.")
+	rootCmd.Flags().BoolVar(&config.Config.Storage.Etcd.Embedded, "etcd-embedded", config.Config.Storage.Etcd.Embedded, "use embedded etcd server.")
+	rootCmd.Flags().BoolVar(&config.Config.Storage.Etcd.EmbeddedUnsafeFsync, "etcd-embedded-unsafe-fsync", config.Config.Storage.Etcd.EmbeddedUnsafeFsync,
+		"disable fsync in the embedded etcd server (dangerous).")
+	rootCmd.Flags().StringSliceVar(&config.Config.Storage.Etcd.Endpoints, "etcd-endpoints", config.Config.Storage.Etcd.Endpoints, "external etcd endpoints.")
+	rootCmd.Flags().StringVar(&config.Config.Storage.Etcd.CAPath, "etcd-ca-path", config.Config.Storage.Etcd.CAPath, "external etcd CA path.")
+	rootCmd.Flags().StringVar(&config.Config.Storage.Etcd.CertPath, "etcd-client-cert-path", config.Config.Storage.Etcd.CertPath, "external etcd client cert path.")
+	rootCmd.Flags().StringVar(&config.Config.Storage.Etcd.KeyPath, "etcd-client-key-path", config.Config.Storage.Etcd.KeyPath, "external etcd client key path.")
+
+	rootCmd.Flags().StringVar(&config.Config.SecondaryStorage.Path, "secondary-storage-path", config.Config.SecondaryStorage.Path,
+		"path of the file for boltdb-backed secondary storage for frequently updated data.")
+
+	rootCmd.Flags().StringVar(&config.Config.TalosRegistry, "talos-installer-registry", config.Config.TalosRegistry, "Talos installer image registry.")
+	rootCmd.Flags().StringVar(&config.Config.KubernetesRegistry, "kubernetes-registry", config.Config.KubernetesRegistry, "Kubernetes container registry.")
+	rootCmd.Flags().StringVar(&config.Config.ImageFactoryBaseURL, "image-factory-address", config.Config.ImageFactoryBaseURL, "Image factory base URL to use.")
+	rootCmd.Flags().StringVar(&config.Config.ImageFactoryPXEBaseURL, "image-factory-pxe-address", config.Config.ImageFactoryPXEBaseURL, "Image factory pxe base URL to use.")
+
+	rootCmd.Flags().StringVar(
+		&config.Config.Storage.Etcd.PrivateKeySource,
+		"private-key-source",
+		config.Config.Storage.Etcd.PrivateKeySource,
+		"file containing private key to use for decrypting master key slot.",
+	)
+	rootCmd.Flags().StringSliceVar(
+		&config.Config.Storage.Etcd.PublicKeyFiles,
+		"public-key-files",
+		config.Config.Storage.Etcd.PublicKeyFiles,
+		"list of paths to files containing public keys to use for encrypting keys slots.",
+	)
+
+	rootCmd.Flags().DurationVar(
+		&config.Config.KeyPruner.Interval,
+		"public-key-pruning-interval",
+		config.Config.KeyPruner.Interval,
+		"interval between public key pruning runs.",
+	)
+
+	rootCmd.Flags().BoolVar(&config.Config.Auth.Suspended, "suspended", config.Config.Auth.Suspended, "start omni in suspended (read-only) mode.")
+
+	rootCmd.Flags().BoolVar(&config.Config.EnableTalosPreReleaseVersions, "enable-talos-pre-release-versions", config.Config.EnableTalosPreReleaseVersions,
+		"make Omni version discovery controler include Talos pre-release versions.")
+
+	rootCmd.Flags().BoolVar(&config.Config.WorkloadProxying.Enabled, "workload-proxying-enabled", config.Config.WorkloadProxying.Enabled, "enable workload proxying feature.")
+
+	rootCmd.Flags().IntVar(&config.Config.LocalResourceServerPort, "local-resource-server-port", config.Config.LocalResourceServerPort, "port for local read-only public resource server.")
+
+	ensure.NoError(rootCmd.MarkFlagRequired("private-key-source"))
+	ensure.NoError(rootCmd.Flags().MarkHidden("etcd-embedded-unsafe-fsync"))
+
+	rootCmd.Flags().StringVar(&rootCmdArgs.keyFile, "key", "", "TLS key file")
+	rootCmd.Flags().StringVar(&rootCmdArgs.certFile, "cert", "", "TLS cert file")
+
+	rootCmd.Flags().BoolVar(
+		&config.Config.EtcdBackup.S3Enabled,
+		"etcd-backup-s3",
+		config.Config.EtcdBackup.S3Enabled,
+		"S3 will be used for cluster etcd backups",
+	)
+
+	rootCmd.Flags().StringVar(
+		&config.Config.EtcdBackup.LocalPath,
+		"etcd-backup-local-path",
+		config.Config.EtcdBackup.LocalPath,
+		"path to local directory for cluster etcd backups",
+	)
+
+	rootCmd.MarkFlagsMutuallyExclusive("etcd-backup-s3", "etcd-backup-local-path")
+
+	rootCmd.Flags().DurationVar(
+		&config.Config.EtcdBackup.TickInterval,
+		"etcd-backup-tick-interval",
+		config.Config.EtcdBackup.TickInterval,
+		"interval between etcd backups ticks (controller events to check if any cluster needs to be backed up)",
+	)
+
+	rootCmd.Flags().DurationVar(
+		&config.Config.EtcdBackup.MinInterval,
+		"etcd-backup-min-interval",
+		config.Config.EtcdBackup.MinInterval,
+		"minimal interval between etcd backups",
+	)
+
+	rootCmd.Flags().DurationVar(
+		&config.Config.EtcdBackup.MaxInterval,
+		"etcd-backup-max-interval",
+		config.Config.EtcdBackup.MaxInterval,
+		"maximal interval between etcd backups",
+	)
+
+	rootCmd.Flags().StringSliceVar(&config.Config.LogResourceUpdatesTypes,
+		"log-resource-updates-types",
+		config.Config.LogResourceUpdatesTypes,
+		"list of resource types whose updates should be logged",
+	)
+	rootCmd.Flags().StringVar(&config.Config.LogResourceUpdatesLogLevel,
+		"log-resource-updates-log-level",
+		config.Config.LogResourceUpdatesLogLevel,
+		"log level for resource updates",
+	)
+
+	rootCmd.Flags().BoolVar(&config.Config.DisableControllerRuntimeCache,
+		"disable-controller-runtime-cache",
+		config.Config.DisableControllerRuntimeCache,
+		"disable watch-based cache for controller-runtime (affects performance)",
+	)
+}
diff --git a/cmd/omnictl/main.go b/cmd/omnictl/main.go
new file mode 100644
index 000000000..fb8827dd5
--- /dev/null
+++ b/cmd/omnictl/main.go
@@ -0,0 +1,28 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package main initializes omnictl CLI.
+package main
+
+import (
+	"os"
+
+	"github.com/siderolabs/omni/client/pkg/omnictl"
+	"github.com/siderolabs/omni/client/pkg/version"
+	internalversion "github.com/siderolabs/omni/internal/version"
+)
+
+func main() {
+	version.Name = internalversion.Name
+	version.SHA = internalversion.SHA
+	version.Tag = internalversion.Tag
+	version.API = internalversion.API
+
+	omnictl.RootCmd.Version = version.String()
+
+	if err := omnictl.RootCmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}
diff --git a/docs/context.md b/docs/context.md
new file mode 100644
index 000000000..3ddd9af8c
--- /dev/null
+++ b/docs/context.md
@@ -0,0 +1,105 @@
+# Using the Context on the Client
+
+The UI backend allows communication with 3 different systems:
+
+- `kubernetes` - is using Kubernetes Go client underneath and talks to the
+Kubernetes resource API.
+- `talos` - talks directly to Talos node API.
+COSI Resource API has almost the same request parameters and responses as Kubernetes resource API.
+Also provides a way to call any machine APIs.
+- `omni` - consists of COSI resource API describing the UI internal state.
+
+The context plays an important role while doing resource APIs of any kinds and
+doing Talos API requests.
+
+Depending on the system kind context can contain different options.
+
+Context can contain the following fields:
+
+- `name` - kubeconfig context name.
+- `cluster.uid` - CAPI cluster uid (from `metadata.uid`).
+- `cluster.namespace` - CAPI cluster namespace (from `metadata.namespace`).
+- `cluster.name` - CAPI cluster name (from `metadata.name`)
+- `nodes` - Talos nodes IP.
+
+## Kubernetes Context Kinds
+
+Talking to the cluster from the Kubeconfig:
+
+```typescript
+context = {
+  name: 'admin@talos-default'
+}
+```
+
+Talking to the cluster which is managed by the cluster from the Kubeconfig:
+
+```typescript
+context = {
+  name: 'admin@talos-default',
+  cluster: {
+    namespace: 'default',
+    name: 'cluster-1',
+    uid: '66be7aba-7c93-4766-b4ec-c5313fb831a2'
+  }
+}
+```
+
+## Talos Context Kinds
+
+Talking to a node in the cluster from the Kubeconfig:
+
+```typescript
+context = {
+  name: 'admin@talos-default',
+  nodes: ['10.5.0.2']
+}
+```
+
+Doing multiple nodes requests is also supported:
+
+```typescript
+context = {
+  name: 'admin@talos-default',
+  nodes: ['10.5.0.2', '10.5.0.3']
+}
+```
+
+Talking to the nodes in the cluster managed by the cluster from the Kubeconfig:
+
+```typescript
+context = {
+  name: 'admin@talos-default',
+  cluster: {
+    namespace: 'default',
+    name: 'cluster-1',
+    uid: '66be7aba-7c93-4766-b4ec-c5313fb831a2'
+  },
+  nodes: ['172.24.0.2']
+}
+```
+
+### Omni Context Kinds
+
+Omni context doesn't need any parameters as it doesn't proxy requests anywhere in that case.
+
+## Context helpers methods
+
+### `getContext` from `@/context`
+
+Extracts context options from the URL query parameters.
+Query should be in the following format:
+
+```bash
+/?name=<context name>&cluster=<cluster name>&namespace=<cluster namespace>&uid=<cluster uid>&node=<node ip>
+```
+
+> Note: it doesn't support multiple nodes
+
+### `contextName` from `@/context`
+
+Gets current Kubernetes context name defined in the local storage.
+
+### `changeContext` from `@/context`
+
+Changes current Kubernetes context.
diff --git a/docs/examples/template/cluster1.yaml b/docs/examples/template/cluster1.yaml
new file mode 100644
index 000000000..d457b0e76
--- /dev/null
+++ b/docs/examples/template/cluster1.yaml
@@ -0,0 +1,43 @@
+kind: Cluster
+name: my-cluster
+kubernetes:
+  version: v1.26.0
+talos:
+  version: v1.3.2
+patches:
+  - name: kubespan-enabled
+    inline:
+      machine:
+        network:
+          kubespan:
+            enabled: true
+---
+kind: ControlPlane
+machines:
+  - 27c16241-96bf-4f17-9579-ea3a6c4a3ca8
+  - 4bd92fba-998d-4ef3-ab43-638b806dd3fe
+  - 8fdb574a-a252-4d7d-94f0-5cdea73e140a
+---
+kind: Workers
+machines:
+  - b885f565-b64f-4c7a-a1ac-d2c8c2781373
+---
+kind: Machine
+name: 27c16241-96bf-4f17-9579-ea3a6c4a3ca8
+install:
+  disk: /dev/vda
+---
+kind: Machine
+name: 4bd92fba-998d-4ef3-ab43-638b806dd3fe
+install:
+  disk: /dev/vda
+---
+kind: Machine
+name: 8fdb574a-a252-4d7d-94f0-5cdea73e140a
+install:
+  disk: /dev/vda
+---
+kind: Machine
+name: b885f565-b64f-4c7a-a1ac-d2c8c2781373
+install:
+  disk: /dev/vda
diff --git a/frontend/.eslintrc.yaml b/frontend/.eslintrc.yaml
new file mode 100644
index 000000000..cf7c683b4
--- /dev/null
+++ b/frontend/.eslintrc.yaml
@@ -0,0 +1,20 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2022-06-30T21:22:58Z by kres latest.
+
+---
+root: true
+env:
+  node: true
+ignorePatterns:
+  - "**/*.pb.ts"
+extends:
+  - "plugin:vue/vue3-essential"
+  - "eslint:recommended"
+  - "@vue/typescript"
+rules: {
+  "no-console": off,
+  "no-unused-vars": off,
+  "vue/multi-word-component-names": off,
+  "@typescript-eslint/no-unused-vars": error
+}
diff --git a/frontend/.gitignore b/frontend/.gitignore
new file mode 100644
index 000000000..7a396c703
--- /dev/null
+++ b/frontend/.gitignore
@@ -0,0 +1,4 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2021-03-25T18:30:52Z by kres 9833490-dirty.
+
diff --git a/frontend/LICENSE b/frontend/LICENSE
new file mode 100644
index 000000000..a612ad981
--- /dev/null
+++ b/frontend/LICENSE
@@ -0,0 +1,373 @@
+Mozilla Public License Version 2.0
+==================================
+
+1. Definitions
+--------------
+
+1.1. "Contributor"
+    means each individual or legal entity that creates, contributes to
+    the creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+    means the combination of the Contributions of others (if any) used
+    by a Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+    means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+    means Source Code Form to which the initial Contributor has attached
+    the notice in Exhibit A, the Executable Form of such Source Code
+    Form, and Modifications of such Source Code Form, in each case
+    including portions thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+    means
+
+    (a) that the initial Contributor has attached the notice described
+        in Exhibit B to the Covered Software; or
+
+    (b) that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the
+        terms of a Secondary License.
+
+1.6. "Executable Form"
+    means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+    means a work that combines Covered Software with other material, in
+    a separate file or files, that is not Covered Software.
+
+1.8. "License"
+    means this document.
+
+1.9. "Licensable"
+    means having the right to grant, to the maximum extent possible,
+    whether at the time of the initial grant or subsequently, any and
+    all of the rights conveyed by this License.
+
+1.10. "Modifications"
+    means any of the following:
+
+    (a) any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered
+        Software; or
+
+    (b) any new file in Source Code Form that contains any Covered
+        Software.
+
+1.11. "Patent Claims" of a Contributor
+    means any patent claim(s), including without limitation, method,
+    process, and apparatus claims, in any patent Licensable by such
+    Contributor that would be infringed, but for the grant of the
+    License, by the making, using, selling, offering for sale, having
+    made, import, or transfer of either its Contributions or its
+    Contributor Version.
+
+1.12. "Secondary License"
+    means either the GNU General Public License, Version 2.0, the GNU
+    Lesser General Public License, Version 2.1, the GNU Affero General
+    Public License, Version 3.0, or any later versions of those
+    licenses.
+
+1.13. "Source Code Form"
+    means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+    means an individual or a legal entity exercising rights under this
+    License. For legal entities, "You" includes any entity that
+    controls, is controlled by, or is under common control with You. For
+    purposes of this definition, "control" means (a) the power, direct
+    or indirect, to cause the direction or management of such entity,
+    whether by contract or otherwise, or (b) ownership of more than
+    fifty percent (50%) of the outstanding shares or beneficial
+    ownership of such entity.
+
+2. License Grants and Conditions
+--------------------------------
+
+2.1. Grants
+
+Each Contributor hereby grants You a world-wide, royalty-free,
+non-exclusive license:
+
+(a) under intellectual property rights (other than patent or trademark)
+    Licensable by such Contributor to use, reproduce, make available,
+    modify, display, perform, distribute, and otherwise exploit its
+    Contributions, either on an unmodified basis, with Modifications, or
+    as part of a Larger Work; and
+
+(b) under Patent Claims of such Contributor to make, use, sell, offer
+    for sale, have made, import, and otherwise transfer either its
+    Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+The licenses granted in Section 2.1 with respect to any Contribution
+become effective for each Contribution on the date the Contributor first
+distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
+
+(a) for any code that a Contributor has removed from Covered Software;
+    or
+
+(b) for infringements caused by: (i) Your and any other third party's
+    modifications of Covered Software, or (ii) the combination of its
+    Contributions with other software (except as part of its Contributor
+    Version); or
+
+(c) under Patent Claims infringed by Covered Software in the absence of
+    its Contributions.
+
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+No Contributor makes additional grants as a result of Your choice to
+distribute the Covered Software under a subsequent version of this
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+Each Contributor represents that the Contributor believes its
+Contributions are its original creation(s) or it has sufficient rights
+to grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+This License is not intended to limit any rights You have under
+applicable copyright doctrines of fair use, fair dealing, or other
+equivalents.
+
+2.7. Conditions
+
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
+
+3. Responsibilities
+-------------------
+
+3.1. Distribution of Source Form
+
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under
+the terms of this License. You must inform recipients that the Source
+Code Form of the Covered Software is governed by the terms of this
+License, and how they can obtain a copy of this License. You may not
+attempt to alter or restrict the recipients' rights in the Source Code
+Form.
+
+3.2. Distribution of Executable Form
+
+If You distribute Covered Software in Executable Form then:
+
+(a) such Covered Software must also be made available in Source Code
+    Form, as described in Section 3.1, and You must inform recipients of
+    the Executable Form how they can obtain a copy of such Source Code
+    Form by reasonable means in a timely manner, at a charge no more
+    than the cost of distribution to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this
+    License, or sublicense it under different terms, provided that the
+    license for the Executable Form does not attempt to limit or alter
+    the recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for
+the Covered Software. If the Larger Work is a combination of Covered
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
+License permits You to additionally distribute such Covered Software
+under the terms of such Secondary License(s), so that the recipient of
+the Larger Work may, at their option, further distribute the Covered
+Software under the terms of either this License or such Secondary
+License(s).
+
+3.4. Notices
+
+You may not remove or alter the substance of any license notices
+(including copyright notices, patent notices, disclaimers of warranty,
+or limitations of liability) contained within the Source Code Form of
+the Covered Software, except that You may alter any license notices to
+the extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+You may choose to offer, and to charge a fee for, warranty, support,
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+---------------------------------------------------
+
+If it is impossible for You to comply with any of the terms of this
+License with respect to some or all of the Covered Software due to
+statute, judicial order, or regulation then You must: (a) comply with
+the terms of this License to the maximum extent possible; and (b)
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+--------------
+
+5.1. The rights granted under this License will terminate automatically
+if You fail to comply with any of its terms. However, if You become
+compliant, then the rights granted under this License from a particular
+Contributor are reinstated (a) provisionally, unless and until such
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
+non-compliance by some reasonable means prior to 60 days after You have
+come back into compliance. Moreover, Your grants from a particular
+Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
+
+************************************************************************
+*                                                                      *
+*  6. Disclaimer of Warranty                                           *
+*  -------------------------                                           *
+*                                                                      *
+*  Covered Software is provided under this License on an "as is"       *
+*  basis, without warranty of any kind, either expressed, implied, or  *
+*  statutory, including, without limitation, warranties that the       *
+*  Covered Software is free of defects, merchantable, fit for a        *
+*  particular purpose or non-infringing. The entire risk as to the     *
+*  quality and performance of the Covered Software is with You.        *
+*  Should any Covered Software prove defective in any respect, You     *
+*  (not any Contributor) assume the cost of any necessary servicing,   *
+*  repair, or correction. This disclaimer of warranty constitutes an   *
+*  essential part of this License. No use of any Covered Software is   *
+*  authorized under this License except under this disclaimer.         *
+*                                                                      *
+************************************************************************
+
+************************************************************************
+*                                                                      *
+*  7. Limitation of Liability                                          *
+*  --------------------------                                          *
+*                                                                      *
+*  Under no circumstances and under no legal theory, whether tort      *
+*  (including negligence), contract, or otherwise, shall any           *
+*  Contributor, or anyone who distributes Covered Software as          *
+*  permitted above, be liable to You for any direct, indirect,         *
+*  special, incidental, or consequential damages of any character      *
+*  including, without limitation, damages for lost profits, loss of    *
+*  goodwill, work stoppage, computer failure or malfunction, or any    *
+*  and all other commercial damages or losses, even if such party      *
+*  shall have been informed of the possibility of such damages. This   *
+*  limitation of liability shall not apply to liability for death or   *
+*  personal injury resulting from such party's negligence to the       *
+*  extent applicable law prohibits such limitation. Some               *
+*  jurisdictions do not allow the exclusion or limitation of           *
+*  incidental or consequential damages, so this exclusion and          *
+*  limitation may not apply to You.                                    *
+*                                                                      *
+************************************************************************
+
+8. Litigation
+-------------
+
+Any litigation relating to this License may be brought only in the
+courts of a jurisdiction where the defendant maintains its principal
+place of business and such litigation shall be governed by laws of that
+jurisdiction, without reference to its conflict-of-law provisions.
+Nothing in this Section shall prevent a party's ability to bring
+cross-claims or counter-claims.
+
+9. Miscellaneous
+----------------
+
+This License represents the complete agreement concerning the subject
+matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable. Any law or regulation which provides
+that the language of a contract shall be construed against the drafter
+shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+---------------------------
+
+10.1. New Versions
+
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
+
+10.2. Effect of New Versions
+
+You may distribute the Covered Software under the terms of the version
+of the License under which You originally received the Covered Software,
+or under the terms of any subsequent version published by the license
+steward.
+
+10.3. Modified Versions
+
+If you create software not governed by this License, and you want to
+create a new license for such software, you may create and use a
+modified version of this License if you rename the license and remove
+any references to the name of the license steward (except to note that
+such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses
+
+If You choose to distribute Source Code Form that is Incompatible With
+Secondary Licenses under the terms of this version of the License, the
+notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+-------------------------------------------
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+---------------------------------------------------------
+
+  This Source Code Form is "Incompatible With Secondary Licenses", as
+  defined by the Mozilla Public License, v. 2.0.
diff --git a/frontend/babel.config.js b/frontend/babel.config.js
new file mode 100644
index 000000000..9a594cf82
--- /dev/null
+++ b/frontend/babel.config.js
@@ -0,0 +1,9 @@
+// THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+//
+// Generated on 2021-12-13T13:49:17Z by kres 3dbe8c4-dirty.
+
+module.exports = {
+  presets: [
+    '@vue/cli-plugin-babel/preset'
+  ]
+}
diff --git a/frontend/jest.config.js b/frontend/jest.config.js
new file mode 100644
index 000000000..c76e04b03
--- /dev/null
+++ b/frontend/jest.config.js
@@ -0,0 +1,8 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+module.exports = {
+  preset: '@vue/cli-plugin-unit-jest/presets/typescript-and-babel/'
+}
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
new file mode 100644
index 000000000..5c1585019
--- /dev/null
+++ b/frontend/package-lock.json
@@ -0,0 +1,33598 @@
+{
+  "name": "omni-web",
+  "version": "0.0.1",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "omni-web",
+      "version": "0.0.1",
+      "dependencies": {
+        "@auth0/auth0-vue": "^1.0.2",
+        "@headlessui/vue": "^1.6.5",
+        "@heroicons/vue": "^2.0.0",
+        "@stardazed/streams-polyfill": "^2.4.0",
+        "apexcharts": "^3.35.3",
+        "buffer": "^6.0.3",
+        "click-outside-vue3": "^4.0.1",
+        "core-js": "^3.23.3",
+        "fetch-intercept": "^2.4.0",
+        "js-yaml": "^4.1.0",
+        "long": "^5.2.0",
+        "luxon": "^2.4.0",
+        "monaco-editor-vue3": "^0.1.10",
+        "monaco-yaml": "^4.0.4",
+        "pluralize": "^8.0.0",
+        "protobufjs": "^6.11.3",
+        "rxjs": "^7.5.5",
+        "semver-parser": "^4.0.1",
+        "slugify": "^1.6.5",
+        "uuid": "^8.3.2",
+        "vue": "^3.2.37",
+        "vue-router": "^4.0.16",
+        "vue-virtual-scroller": "^2.0.0-beta.3",
+        "vue-word-highlighter": "^1.0.4",
+        "vue3-apexcharts": "^1.4.1",
+        "vue3-clipboard": "^1.0.0",
+        "vue3-popper": "^1.5.0",
+        "whatwg-fetch": "^3.6.2"
+      },
+      "devDependencies": {
+        "@rushstack/eslint-patch": "^1.1.4",
+        "@types/luxon": "^2.4.0",
+        "@types/pluralize": "^0.0.29",
+        "@types/uuid": "^9.0.0",
+        "@typescript-eslint/eslint-plugin": "^5.30.0",
+        "@typescript-eslint/parser": "^5.30.0",
+        "@volar-plugins/vetur": "latest",
+        "@vue/cli-plugin-babel": "^5.0.6",
+        "@vue/cli-plugin-eslint": "^5.0.6",
+        "@vue/cli-plugin-typescript": "^5.0.6",
+        "@vue/cli-plugin-unit-jest": "^5.0.6",
+        "@vue/cli-service": "^5.0.6",
+        "@vue/compiler-sfc": "^3.2.37",
+        "@vue/eslint-config-typescript": "^11.0.0",
+        "@vue/test-utils": "^2.0.0",
+        "autoprefixer": "^10.4.7",
+        "babel-eslint": "^10.1.0",
+        "eslint": "^8.18.0",
+        "eslint-plugin-vue": "^9.1.1",
+        "jest": "^27.5.1",
+        "kubernetes-types": "^1.26.0",
+        "lodash": "^4.17.21",
+        "openpgp": "^5.5.0",
+        "postcss": "^8.4.14",
+        "tailwindcss": "^3.1.4",
+        "ts-jest": "^27.1.5",
+        "ts-loader": "^9.3.1",
+        "typescript": "^4.7.4",
+        "vue-cli-plugin-tailwind": "^3.0.0"
+      }
+    },
+    "node_modules/@achrinza/node-ipc": {
+      "version": "9.2.5",
+      "resolved": "https://registry.npmjs.org/@achrinza/node-ipc/-/node-ipc-9.2.5.tgz",
+      "integrity": "sha512-kBX7Ay911iXZ3VZ1pYltj3Rfu7Ow9H7sK4H4RSfWIfWR2JKNB40K808wppoRIEzE2j2hXLU+r6TJgCAliCGhyQ==",
+      "dev": true,
+      "dependencies": {
+        "@node-ipc/js-queue": "2.0.3",
+        "event-pubsub": "4.3.0",
+        "js-message": "1.0.7"
+      },
+      "engines": {
+        "node": "8 || 9 || 10 || 11 || 12 || 13 || 14 || 15 || 16 || 17 || 18"
+      }
+    },
+    "node_modules/@ampproject/remapping": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.2.0.tgz",
+      "integrity": "sha512-qRmjj8nj9qmLTQXXmaR1cck3UXSRMPrbsLJAasZpF+t3riI71BXed5ebIOYwQntykeZuhjsdweEc9BxH5Jc26w==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.1.0",
+        "@jridgewell/trace-mapping": "^0.3.9"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@auth0/auth0-spa-js": {
+      "version": "1.22.4",
+      "resolved": "https://registry.npmjs.org/@auth0/auth0-spa-js/-/auth0-spa-js-1.22.4.tgz",
+      "integrity": "sha512-iOboSV+aUsExV1onKvGKEqi626sjJt+61c3EvA4mkn9RM7RV9RMjPI+cInNFHWjwAd2Sdi3LqBj6/MfcHh69dg==",
+      "dependencies": {
+        "abortcontroller-polyfill": "^1.7.3",
+        "browser-tabs-lock": "^1.2.15",
+        "core-js": "^3.24.0",
+        "es-cookie": "~1.3.2",
+        "fast-text-encoding": "^1.0.4",
+        "promise-polyfill": "^8.2.3",
+        "unfetch": "^4.2.0"
+      }
+    },
+    "node_modules/@auth0/auth0-vue": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@auth0/auth0-vue/-/auth0-vue-1.0.2.tgz",
+      "integrity": "sha512-Oj64AV9ti3AwyKBpEnLvhj16xL2erXFRJrqVI/kvLxYjLnn5GWui/7/iJghvCEHjyxIaJRUtgh3+ZiQgMkDvzQ==",
+      "dependencies": {
+        "@auth0/auth0-spa-js": "^1.22.1",
+        "vue": "^3.2.35"
+      },
+      "peerDependencies": {
+        "vue-router": "^4.0.12"
+      },
+      "peerDependenciesMeta": {
+        "vue-router": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@babel/code-frame": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.18.6.tgz",
+      "integrity": "sha512-TDCmlK5eOvH+eH7cdAFlNXeVJqWIQ7gW9tY1GJIpUtFb6CmjVyq2VM3u71bOyR8CRihcCgMUYoDNyLXao3+70Q==",
+      "dev": true,
+      "dependencies": {
+        "@babel/highlight": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/compat-data": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.18.6.tgz",
+      "integrity": "sha512-tzulrgDT0QD6U7BJ4TKVk2SDDg7wlP39P9yAx1RfLy7vP/7rsDRlWVfbWxElslu56+r7QOhB2NSDsabYYruoZQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/core": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.18.6.tgz",
+      "integrity": "sha512-cQbWBpxcbbs/IUredIPkHiAGULLV8iwgNRMFzvbhEXISp4f3rUUXE5+TIw6KwUWUR3DwyI6gmBRnmAtYaWehwQ==",
+      "dev": true,
+      "dependencies": {
+        "@ampproject/remapping": "^2.1.0",
+        "@babel/code-frame": "^7.18.6",
+        "@babel/generator": "^7.18.6",
+        "@babel/helper-compilation-targets": "^7.18.6",
+        "@babel/helper-module-transforms": "^7.18.6",
+        "@babel/helpers": "^7.18.6",
+        "@babel/parser": "^7.18.6",
+        "@babel/template": "^7.18.6",
+        "@babel/traverse": "^7.18.6",
+        "@babel/types": "^7.18.6",
+        "convert-source-map": "^1.7.0",
+        "debug": "^4.1.0",
+        "gensync": "^1.0.0-beta.2",
+        "json5": "^2.2.1",
+        "semver": "^6.3.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/babel"
+      }
+    },
+    "node_modules/@babel/generator": {
+      "version": "7.18.7",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.18.7.tgz",
+      "integrity": "sha512-shck+7VLlY72a2w9c3zYWuE1pwOKEiQHV7GTUbSnhyl5eu3i04t30tBY82ZRWrDfo3gkakCFtevExnxbkf2a3A==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.18.7",
+        "@jridgewell/gen-mapping": "^0.3.2",
+        "jsesc": "^2.5.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/generator/node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.2.tgz",
+      "integrity": "sha512-mh65xKQAzI6iBcFzwv28KVWSmCkdRBWoOh+bYQGW3+6OZvbbN3TqMGo5hqYxQniRcH9F2VZIoJCm4pa3BPDK/A==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/set-array": "^1.0.1",
+        "@jridgewell/sourcemap-codec": "^1.4.10",
+        "@jridgewell/trace-mapping": "^0.3.9"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@babel/helper-annotate-as-pure": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.18.6.tgz",
+      "integrity": "sha512-duORpUiYrEpzKIop6iNbjnwKLAKnJ47csTyRACyEmWj0QdUrm5aqNJGHSSEQSUAvNW0ojX0dOmK9dZduvkfeXA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-builder-binary-assignment-operator-visitor": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-builder-binary-assignment-operator-visitor/-/helper-builder-binary-assignment-operator-visitor-7.18.6.tgz",
+      "integrity": "sha512-KT10c1oWEpmrIRYnthbzHgoOf6B+Xd6a5yhdbNtdhtG7aO1or5HViuf1TQR36xY/QprXA5nvxO6nAjhJ4y38jw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-explode-assignable-expression": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-compilation-targets": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.18.6.tgz",
+      "integrity": "sha512-vFjbfhNCzqdeAtZflUFrG5YIFqGTqsctrtkZ1D/NB0mDW9TwW3GmmUepYY4G9wCET5rY5ugz4OGTcLd614IzQg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/compat-data": "^7.18.6",
+        "@babel/helper-validator-option": "^7.18.6",
+        "browserslist": "^4.20.2",
+        "semver": "^6.3.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-create-class-features-plugin": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.18.6.tgz",
+      "integrity": "sha512-YfDzdnoxHGV8CzqHGyCbFvXg5QESPFkXlHtvdCkesLjjVMT2Adxe4FGUR5ChIb3DxSaXO12iIOCWoXdsUVwnqw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-annotate-as-pure": "^7.18.6",
+        "@babel/helper-environment-visitor": "^7.18.6",
+        "@babel/helper-function-name": "^7.18.6",
+        "@babel/helper-member-expression-to-functions": "^7.18.6",
+        "@babel/helper-optimise-call-expression": "^7.18.6",
+        "@babel/helper-replace-supers": "^7.18.6",
+        "@babel/helper-split-export-declaration": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-create-regexp-features-plugin": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.18.6.tgz",
+      "integrity": "sha512-7LcpH1wnQLGrI+4v+nPp+zUvIkF9x0ddv1Hkdue10tg3gmRnLy97DXh4STiOf1qeIInyD69Qv5kKSZzKD8B/7A==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-annotate-as-pure": "^7.18.6",
+        "regexpu-core": "^5.1.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-define-polyfill-provider": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.3.1.tgz",
+      "integrity": "sha512-J9hGMpJQmtWmj46B3kBHmL38UhJGhYX7eqkcq+2gsstyYt341HmPeWspihX43yVRA0mS+8GGk2Gckc7bY/HCmA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-compilation-targets": "^7.13.0",
+        "@babel/helper-module-imports": "^7.12.13",
+        "@babel/helper-plugin-utils": "^7.13.0",
+        "@babel/traverse": "^7.13.0",
+        "debug": "^4.1.1",
+        "lodash.debounce": "^4.0.8",
+        "resolve": "^1.14.2",
+        "semver": "^6.1.2"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.4.0-0"
+      }
+    },
+    "node_modules/@babel/helper-environment-visitor": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.18.6.tgz",
+      "integrity": "sha512-8n6gSfn2baOY+qlp+VSzsosjCVGFqWKmDF0cCWOybh52Dw3SEyoWR1KrhMJASjLwIEkkAufZ0xvr+SxLHSpy2Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-explode-assignable-expression": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-explode-assignable-expression/-/helper-explode-assignable-expression-7.18.6.tgz",
+      "integrity": "sha512-eyAYAsQmB80jNfg4baAtLeWAQHfHFiR483rzFK+BhETlGZaQC9bsfrugfXDCbRHLQbIA7U5NxhhOxN7p/dWIcg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-function-name": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.18.6.tgz",
+      "integrity": "sha512-0mWMxV1aC97dhjCah5U5Ua7668r5ZmSC2DLfH2EZnf9c3/dHZKiFa5pRLMH5tjSl471tY6496ZWk/kjNONBxhw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/template": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-hoist-variables": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.18.6.tgz",
+      "integrity": "sha512-UlJQPkFqFULIcyW5sbzgbkxn2FKRgwWiRexcuaR8RNJRy8+LLveqPjwZV/bwrLZCN0eUHD/x8D0heK1ozuoo6Q==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-member-expression-to-functions": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.18.6.tgz",
+      "integrity": "sha512-CeHxqwwipekotzPDUuJOfIMtcIHBuc7WAzLmTYWctVigqS5RktNMQ5bEwQSuGewzYnCtTWa3BARXeiLxDTv+Ng==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-imports": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.18.6.tgz",
+      "integrity": "sha512-0NFvs3VkuSYbFi1x2Vd6tKrywq+z/cLeYC/RJNFrIX/30Bf5aiGYbtvGXolEktzJH8o5E5KJ3tT+nkxuuZFVlA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-transforms": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.18.6.tgz",
+      "integrity": "sha512-L//phhB4al5uucwzlimruukHB3jRd5JGClwRMD/ROrVjXfLqovYnvQrK/JK36WYyVwGGO7OD3kMyVTjx+WVPhw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-environment-visitor": "^7.18.6",
+        "@babel/helper-module-imports": "^7.18.6",
+        "@babel/helper-simple-access": "^7.18.6",
+        "@babel/helper-split-export-declaration": "^7.18.6",
+        "@babel/helper-validator-identifier": "^7.18.6",
+        "@babel/template": "^7.18.6",
+        "@babel/traverse": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-optimise-call-expression": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.18.6.tgz",
+      "integrity": "sha512-HP59oD9/fEHQkdcbgFCnbmgH5vIQTJbxh2yf+CdM89/glUNnuzr87Q8GIjGEnOktTROemO0Pe0iPAYbqZuOUiA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-plugin-utils": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.18.6.tgz",
+      "integrity": "sha512-gvZnm1YAAxh13eJdkb9EWHBnF3eAub3XTLCZEehHT2kWxiKVRL64+ae5Y6Ivne0mVHmMYKT+xWgZO+gQhuLUBg==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-remap-async-to-generator": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.18.6.tgz",
+      "integrity": "sha512-z5wbmV55TveUPZlCLZvxWHtrjuJd+8inFhk7DG0WW87/oJuGDcjDiu7HIvGcpf5464L6xKCg3vNkmlVVz9hwyQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-annotate-as-pure": "^7.18.6",
+        "@babel/helper-environment-visitor": "^7.18.6",
+        "@babel/helper-wrap-function": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-replace-supers": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.18.6.tgz",
+      "integrity": "sha512-fTf7zoXnUGl9gF25fXCWE26t7Tvtyn6H4hkLSYhATwJvw2uYxd3aoXplMSe0g9XbwK7bmxNes7+FGO0rB/xC0g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-environment-visitor": "^7.18.6",
+        "@babel/helper-member-expression-to-functions": "^7.18.6",
+        "@babel/helper-optimise-call-expression": "^7.18.6",
+        "@babel/traverse": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-simple-access": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.18.6.tgz",
+      "integrity": "sha512-iNpIgTgyAvDQpDj76POqg+YEt8fPxx3yaNBg3S30dxNKm2SWfYhD0TGrK/Eu9wHpUW63VQU894TsTg+GLbUa1g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-skip-transparent-expression-wrappers": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.18.6.tgz",
+      "integrity": "sha512-4KoLhwGS9vGethZpAhYnMejWkX64wsnHPDwvOsKWU6Fg4+AlK2Jz3TyjQLMEPvz+1zemi/WBdkYxCD0bAfIkiw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-split-export-declaration": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.18.6.tgz",
+      "integrity": "sha512-bde1etTx6ZyTmobl9LLMMQsaizFVZrquTEHOqKeQESMKo4PlObf+8+JA25ZsIpZhT/WEd39+vOdLXAFG/nELpA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-identifier": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.18.6.tgz",
+      "integrity": "sha512-MmetCkz9ej86nJQV+sFCxoGGrUbU3q02kgLciwkrt9QqEB7cP39oKEY0PakknEO0Gu20SskMRi+AYZ3b1TpN9g==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-option": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.18.6.tgz",
+      "integrity": "sha512-XO7gESt5ouv/LRJdrVjkShckw6STTaB7l9BrpBaAHDeF5YZT+01PCwmR0SJHnkW6i8OwW/EVWRShfi4j2x+KQw==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-wrap-function": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-wrap-function/-/helper-wrap-function-7.18.6.tgz",
+      "integrity": "sha512-I5/LZfozwMNbwr/b1vhhuYD+J/mU+gfGAj5td7l5Rv9WYmH6i3Om69WGKNmlIpsVW/mF6O5bvTKbvDQZVgjqOw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-function-name": "^7.18.6",
+        "@babel/template": "^7.18.6",
+        "@babel/traverse": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helpers": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.18.6.tgz",
+      "integrity": "sha512-vzSiiqbQOghPngUYt/zWGvK3LAsPhz55vc9XNN0xAl2gV4ieShI2OQli5duxWHD+72PZPTKAcfcZDE1Cwc5zsQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/template": "^7.18.6",
+        "@babel/traverse": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/highlight": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.18.6.tgz",
+      "integrity": "sha512-u7stbOuYjaPezCuLj29hNW1v64M2Md2qupEKP1fHc7WdOA3DgLh37suiSrZYY7haUB7iBeQZ9P1uiRF359do3g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-validator-identifier": "^7.18.6",
+        "chalk": "^2.0.0",
+        "js-tokens": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/parser": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.18.6.tgz",
+      "integrity": "sha512-uQVSa9jJUe/G/304lXspfWVpKpK4euFLgGiMQFOCpM/bgcAdeoHwi/OQz23O9GK2osz26ZiXRRV9aV+Yl1O8tw==",
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.18.6.tgz",
+      "integrity": "sha512-Dgxsyg54Fx1d4Nge8UnvTrED63vrwOdPmyvPzlNN/boaliRP54pm3pGzZD1SJUwrBA+Cs/xdG8kXX6Mn/RfISQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.18.6.tgz",
+      "integrity": "sha512-Udgu8ZRgrBrttVz6A0EVL0SJ1z+RLbIeqsu632SA1hf0awEppD6TvdznoH+orIF8wtFFAV/Enmw9Y+9oV8TQcw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.18.6",
+        "@babel/plugin-proposal-optional-chaining": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.13.0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-async-generator-functions": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-async-generator-functions/-/plugin-proposal-async-generator-functions-7.18.6.tgz",
+      "integrity": "sha512-WAz4R9bvozx4qwf74M+sfqPMKfSqwM0phxPTR6iJIi8robgzXwkEgmeJG1gEKhm6sDqT/U9aV3lfcqybIpev8w==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-environment-visitor": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-remap-async-to-generator": "^7.18.6",
+        "@babel/plugin-syntax-async-generators": "^7.8.4"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-class-properties": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-properties/-/plugin-proposal-class-properties-7.18.6.tgz",
+      "integrity": "sha512-cumfXOF0+nzZrrN8Rf0t7M+tF6sZc7vhQwYQck9q1/5w2OExlD+b4v4RpMJFaV1Z7WcDRgO6FqvxqxGlwo+RHQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-create-class-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-class-static-block": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-static-block/-/plugin-proposal-class-static-block-7.18.6.tgz",
+      "integrity": "sha512-+I3oIiNxrCpup3Gi8n5IGMwj0gOCAjcJUSQEcotNnCCPMEnixawOQ+KeJPlgfjzx+FKQ1QSyZOWe7wmoJp7vhw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-create-class-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-class-static-block": "^7.14.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.12.0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-decorators": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-decorators/-/plugin-proposal-decorators-7.18.6.tgz",
+      "integrity": "sha512-gAdhsjaYmiZVxx5vTMiRfj31nB7LhwBJFMSLzeDxc7X4tKLixup0+k9ughn0RcpBrv9E3PBaXJW7jF5TCihAOg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-create-class-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-replace-supers": "^7.18.6",
+        "@babel/helper-split-export-declaration": "^7.18.6",
+        "@babel/plugin-syntax-decorators": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-dynamic-import": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-dynamic-import/-/plugin-proposal-dynamic-import-7.18.6.tgz",
+      "integrity": "sha512-1auuwmK+Rz13SJj36R+jqFPMJWyKEDd7lLSdOj4oJK0UTgGueSAtkrCvz9ewmgyU/P941Rv2fQwZJN8s6QruXw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-dynamic-import": "^7.8.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-export-namespace-from": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-export-namespace-from/-/plugin-proposal-export-namespace-from-7.18.6.tgz",
+      "integrity": "sha512-zr/QcUlUo7GPo6+X1wC98NJADqmy5QTFWWhqeQWiki4XHafJtLl/YMGkmRB2szDD2IYJCCdBTd4ElwhId9T7Xw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-export-namespace-from": "^7.8.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-json-strings": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-json-strings/-/plugin-proposal-json-strings-7.18.6.tgz",
+      "integrity": "sha512-lr1peyn9kOdbYc0xr0OdHTZ5FMqS6Di+H0Fz2I/JwMzGmzJETNeOFq2pBySw6X/KFL5EWDjlJuMsUGRFb8fQgQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-json-strings": "^7.8.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-logical-assignment-operators": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-logical-assignment-operators/-/plugin-proposal-logical-assignment-operators-7.18.6.tgz",
+      "integrity": "sha512-zMo66azZth/0tVd7gmkxOkOjs2rpHyhpcFo565PUP37hSp6hSd9uUKIfTDFMz58BwqgQKhJ9YxtM5XddjXVn+Q==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-nullish-coalescing-operator": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-nullish-coalescing-operator/-/plugin-proposal-nullish-coalescing-operator-7.18.6.tgz",
+      "integrity": "sha512-wQxQzxYeJqHcfppzBDnm1yAY0jSRkUXR2z8RePZYrKwMKgMlE8+Z6LUno+bd6LvbGh8Gltvy74+9pIYkr+XkKA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-numeric-separator": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-numeric-separator/-/plugin-proposal-numeric-separator-7.18.6.tgz",
+      "integrity": "sha512-ozlZFogPqoLm8WBr5Z8UckIoE4YQ5KESVcNudyXOR8uqIkliTEgJ3RoketfG6pmzLdeZF0H/wjE9/cCEitBl7Q==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-numeric-separator": "^7.10.4"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-object-rest-spread": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-object-rest-spread/-/plugin-proposal-object-rest-spread-7.18.6.tgz",
+      "integrity": "sha512-9yuM6wr4rIsKa1wlUAbZEazkCrgw2sMPEXCr4Rnwetu7cEW1NydkCWytLuYletbf8vFxdJxFhwEZqMpOx2eZyw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/compat-data": "^7.18.6",
+        "@babel/helper-compilation-targets": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+        "@babel/plugin-transform-parameters": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-optional-catch-binding": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-catch-binding/-/plugin-proposal-optional-catch-binding-7.18.6.tgz",
+      "integrity": "sha512-Q40HEhs9DJQyaZfUjjn6vE8Cv4GmMHCYuMGIWUnlxH6400VGxOuwWsPt4FxXxJkC/5eOzgn0z21M9gMT4MOhbw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-optional-catch-binding": "^7.8.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-optional-chaining": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-chaining/-/plugin-proposal-optional-chaining-7.18.6.tgz",
+      "integrity": "sha512-PatI6elL5eMzoypFAiYDpYQyMtXTn+iMhuxxQt5mAXD4fEmKorpSI3PHd+i3JXBJN3xyA6MvJv7at23HffFHwA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.18.6",
+        "@babel/plugin-syntax-optional-chaining": "^7.8.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-private-methods": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-methods/-/plugin-proposal-private-methods-7.18.6.tgz",
+      "integrity": "sha512-nutsvktDItsNn4rpGItSNV2sz1XwS+nfU0Rg8aCx3W3NOKVzdMjJRu0O5OkgDp3ZGICSTbgRpxZoWsxoKRvbeA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-create-class-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-private-property-in-object": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.18.6.tgz",
+      "integrity": "sha512-9Rysx7FOctvT5ouj5JODjAFAkgGoudQuLPamZb0v1TGLpapdNaftzifU8NTWQm0IRjqoYypdrSmyWgkocDQ8Dw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-annotate-as-pure": "^7.18.6",
+        "@babel/helper-create-class-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-private-property-in-object": "^7.14.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-proposal-unicode-property-regex": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-unicode-property-regex/-/plugin-proposal-unicode-property-regex-7.18.6.tgz",
+      "integrity": "sha512-2BShG/d5yoZyXZfVePH91urL5wTG6ASZU9M4o03lKK8u8UW1y08OMttBSOADTcJrnPMpvDXRG3G8fyLh4ovs8w==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=4"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-async-generators": {
+      "version": "7.8.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz",
+      "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-bigint": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-bigint/-/plugin-syntax-bigint-7.8.3.tgz",
+      "integrity": "sha512-wnTnFlG+YxQm3vDxpGE57Pj0srRU4sHE/mDkt1qv2YJJSeUAec2ma4WLUnUPeKjyrfntVwe/N6dCXpU+zL3Npg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-class-properties": {
+      "version": "7.12.13",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz",
+      "integrity": "sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.12.13"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-class-static-block": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-static-block/-/plugin-syntax-class-static-block-7.14.5.tgz",
+      "integrity": "sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-decorators": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-decorators/-/plugin-syntax-decorators-7.18.6.tgz",
+      "integrity": "sha512-fqyLgjcxf/1yhyZ6A+yo1u9gJ7eleFQod2lkaUsF9DQ7sbbY3Ligym3L0+I2c0WmqNKDpoD9UTb1AKP3qRMOAQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-dynamic-import": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-dynamic-import/-/plugin-syntax-dynamic-import-7.8.3.tgz",
+      "integrity": "sha512-5gdGbFon+PszYzqs83S3E5mpi7/y/8M9eC90MRTZfduQOYW76ig6SOSPNe41IG5LoP3FGBn2N0RjVDSQiS94kQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-export-namespace-from": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-export-namespace-from/-/plugin-syntax-export-namespace-from-7.8.3.tgz",
+      "integrity": "sha512-MXf5laXo6c1IbEbegDmzGPwGNTsHZmEy6QGznu5Sh2UCWvueywb2ee+CCE4zQiZstxU9BMoQO9i6zUFSY0Kj0Q==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.3"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-import-assertions": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-assertions/-/plugin-syntax-import-assertions-7.18.6.tgz",
+      "integrity": "sha512-/DU3RXad9+bZwrgWJQKbr39gYbJpLJHezqEzRzi/BHRlJ9zsQb4CK2CA/5apllXNomwA1qHwzvHl+AdEmC5krQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-import-meta": {
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-meta/-/plugin-syntax-import-meta-7.10.4.tgz",
+      "integrity": "sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.10.4"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-json-strings": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz",
+      "integrity": "sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-jsx": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.18.6.tgz",
+      "integrity": "sha512-6mmljtAedFGTWu2p/8WIORGwy+61PLgOMPOdazc7YoJ9ZCWUyFy3A6CpPkRKLKD1ToAesxX8KGEViAiLo9N+7Q==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-logical-assignment-operators": {
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.10.4.tgz",
+      "integrity": "sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.10.4"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-nullish-coalescing-operator": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz",
+      "integrity": "sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-numeric-separator": {
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.10.4.tgz",
+      "integrity": "sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.10.4"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-object-rest-spread": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz",
+      "integrity": "sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-optional-catch-binding": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz",
+      "integrity": "sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-optional-chaining": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz",
+      "integrity": "sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-private-property-in-object": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-private-property-in-object/-/plugin-syntax-private-property-in-object-7.14.5.tgz",
+      "integrity": "sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-top-level-await": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz",
+      "integrity": "sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-syntax-typescript": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.18.6.tgz",
+      "integrity": "sha512-mAWAuq4rvOepWCBid55JuRNvpTNf2UGVgoz4JV0fXEKolsVZDzsa4NqCef758WZJj/GDu0gVGItjKFiClTAmZA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-arrow-functions": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.18.6.tgz",
+      "integrity": "sha512-9S9X9RUefzrsHZmKMbDXxweEH+YlE8JJEuat9FdvW9Qh1cw7W64jELCtWNkPBPX5En45uy28KGvA/AySqUh8CQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-async-to-generator": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.18.6.tgz",
+      "integrity": "sha512-ARE5wZLKnTgPW7/1ftQmSi1CmkqqHo2DNmtztFhvgtOWSDfq0Cq9/9L+KnZNYSNrydBekhW3rwShduf59RoXag==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-module-imports": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-remap-async-to-generator": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-block-scoped-functions": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.18.6.tgz",
+      "integrity": "sha512-ExUcOqpPWnliRcPqves5HJcJOvHvIIWfuS4sroBUenPuMdmW+SMHDakmtS7qOo13sVppmUijqeTv7qqGsvURpQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-block-scoping": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoping/-/plugin-transform-block-scoping-7.18.6.tgz",
+      "integrity": "sha512-pRqwb91C42vs1ahSAWJkxOxU1RHWDn16XAa6ggQ72wjLlWyYeAcLvTtE0aM8ph3KNydy9CQF2nLYcjq1WysgxQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-classes": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-classes/-/plugin-transform-classes-7.18.6.tgz",
+      "integrity": "sha512-XTg8XW/mKpzAF3actL554Jl/dOYoJtv3l8fxaEczpgz84IeeVf+T1u2CSvPHuZbt0w3JkIx4rdn/MRQI7mo0HQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-annotate-as-pure": "^7.18.6",
+        "@babel/helper-environment-visitor": "^7.18.6",
+        "@babel/helper-function-name": "^7.18.6",
+        "@babel/helper-optimise-call-expression": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-replace-supers": "^7.18.6",
+        "@babel/helper-split-export-declaration": "^7.18.6",
+        "globals": "^11.1.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-computed-properties": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.18.6.tgz",
+      "integrity": "sha512-9repI4BhNrR0KenoR9vm3/cIc1tSBIo+u1WVjKCAynahj25O8zfbiE6JtAtHPGQSs4yZ+bA8mRasRP+qc+2R5A==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-destructuring": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.18.6.tgz",
+      "integrity": "sha512-tgy3u6lRp17ilY8r1kP4i2+HDUwxlVqq3RTc943eAWSzGgpU1qhiKpqZ5CMyHReIYPHdo3Kg8v8edKtDqSVEyQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-dotall-regex": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.18.6.tgz",
+      "integrity": "sha512-6S3jpun1eEbAxq7TdjLotAsl4WpQI9DxfkycRcKrjhQYzU87qpXdknpBg/e+TdcMehqGnLFi7tnFUBR02Vq6wg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-duplicate-keys": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.18.6.tgz",
+      "integrity": "sha512-NJU26U/208+sxYszf82nmGYqVF9QN8py2HFTblPT9hbawi8+1C5a9JubODLTGFuT0qlkqVinmkwOD13s0sZktg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-exponentiation-operator": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.18.6.tgz",
+      "integrity": "sha512-wzEtc0+2c88FVR34aQmiz56dxEkxr2g8DQb/KfaFa1JYXOFVsbhvAonFN6PwVWj++fKmku8NP80plJ5Et4wqHw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-builder-binary-assignment-operator-visitor": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-for-of": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.18.6.tgz",
+      "integrity": "sha512-WAjoMf4wIiSsy88KmG7tgj2nFdEK7E46tArVtcgED7Bkj6Fg/tG5SbvNIOKxbFS2VFgNh6+iaPswBeQZm4ox8w==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-function-name": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.18.6.tgz",
+      "integrity": "sha512-kJha/Gbs5RjzIu0CxZwf5e3aTTSlhZnHMT8zPWnJMjNpLOUgqevg+PN5oMH68nMCXnfiMo4Bhgxqj59KHTlAnA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-compilation-targets": "^7.18.6",
+        "@babel/helper-function-name": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-literals": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-literals/-/plugin-transform-literals-7.18.6.tgz",
+      "integrity": "sha512-x3HEw0cJZVDoENXOp20HlypIHfl0zMIhMVZEBVTfmqbObIpsMxMbmU5nOEO8R7LYT+z5RORKPlTI5Hj4OsO9/Q==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-member-expression-literals": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.18.6.tgz",
+      "integrity": "sha512-qSF1ihLGO3q+/g48k85tUjD033C29TNTVB2paCwZPVmOsjn9pClvYYrM2VeJpBY2bcNkuny0YUyTNRyRxJ54KA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-modules-amd": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.18.6.tgz",
+      "integrity": "sha512-Pra5aXsmTsOnjM3IajS8rTaLCy++nGM4v3YR4esk5PCsyg9z8NA5oQLwxzMUtDBd8F+UmVza3VxoAaWCbzH1rg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-module-transforms": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "babel-plugin-dynamic-import-node": "^2.3.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-modules-commonjs": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.18.6.tgz",
+      "integrity": "sha512-Qfv2ZOWikpvmedXQJDSbxNqy7Xr/j2Y8/KfijM0iJyKkBTmWuvCA1yeH1yDM7NJhBW/2aXxeucLj6i80/LAJ/Q==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-module-transforms": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-simple-access": "^7.18.6",
+        "babel-plugin-dynamic-import-node": "^2.3.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-modules-systemjs": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.18.6.tgz",
+      "integrity": "sha512-UbPYpXxLjTw6w6yXX2BYNxF3p6QY225wcTkfQCy3OMnSlS/C3xGtwUjEzGkldb/sy6PWLiCQ3NbYfjWUTI3t4g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-hoist-variables": "^7.18.6",
+        "@babel/helper-module-transforms": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-validator-identifier": "^7.18.6",
+        "babel-plugin-dynamic-import-node": "^2.3.3"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-modules-umd": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.18.6.tgz",
+      "integrity": "sha512-dcegErExVeXcRqNtkRU/z8WlBLnvD4MRnHgNs3MytRO1Mn1sHRyhbcpYbVMGclAqOjdW+9cfkdZno9dFdfKLfQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-module-transforms": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-named-capturing-groups-regex": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.18.6.tgz",
+      "integrity": "sha512-UmEOGF8XgaIqD74bC8g7iV3RYj8lMf0Bw7NJzvnS9qQhM4mg+1WHKotUIdjxgD2RGrgFLZZPCFPFj3P/kVDYhg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-new-target": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.18.6.tgz",
+      "integrity": "sha512-DjwFA/9Iu3Z+vrAn+8pBUGcjhxKguSMlsFqeCKbhb9BAV756v0krzVK04CRDi/4aqmk8BsHb4a/gFcaA5joXRw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-object-super": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.18.6.tgz",
+      "integrity": "sha512-uvGz6zk+pZoS1aTZrOvrbj6Pp/kK2mp45t2B+bTDre2UgsZZ8EZLSJtUg7m/no0zOJUWgFONpB7Zv9W2tSaFlA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-replace-supers": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-parameters": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.18.6.tgz",
+      "integrity": "sha512-FjdqgMv37yVl/gwvzkcB+wfjRI8HQmc5EgOG9iGNvUY1ok+TjsoaMP7IqCDZBhkFcM5f3OPVMs6Dmp03C5k4/A==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-property-literals": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.18.6.tgz",
+      "integrity": "sha512-cYcs6qlgafTud3PAzrrRNbQtfpQ8+y/+M5tKmksS9+M1ckbH6kzY8MrexEM9mcA6JDsukE19iIRvAyYl463sMg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-regenerator": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.18.6.tgz",
+      "integrity": "sha512-poqRI2+qiSdeldcz4wTSTXBRryoq3Gc70ye7m7UD5Ww0nE29IXqMl6r7Nd15WBgRd74vloEMlShtH6CKxVzfmQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "regenerator-transform": "^0.15.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-reserved-words": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.18.6.tgz",
+      "integrity": "sha512-oX/4MyMoypzHjFrT1CdivfKZ+XvIPMFXwwxHp/r0Ddy2Vuomt4HDFGmft1TAY2yiTKiNSsh3kjBAzcM8kSdsjA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-runtime": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-runtime/-/plugin-transform-runtime-7.18.6.tgz",
+      "integrity": "sha512-8uRHk9ZmRSnWqUgyae249EJZ94b0yAGLBIqzZzl+0iEdbno55Pmlt/32JZsHwXD9k/uZj18Aqqk35wBX4CBTXA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-module-imports": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "babel-plugin-polyfill-corejs2": "^0.3.1",
+        "babel-plugin-polyfill-corejs3": "^0.5.2",
+        "babel-plugin-polyfill-regenerator": "^0.3.1",
+        "semver": "^6.3.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-shorthand-properties": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.18.6.tgz",
+      "integrity": "sha512-eCLXXJqv8okzg86ywZJbRn19YJHU4XUa55oz2wbHhaQVn/MM+XhukiT7SYqp/7o00dg52Rj51Ny+Ecw4oyoygw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-spread": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-spread/-/plugin-transform-spread-7.18.6.tgz",
+      "integrity": "sha512-ayT53rT/ENF8WWexIRg9AiV9h0aIteyWn5ptfZTZQrjk/+f3WdrJGCY4c9wcgl2+MKkKPhzbYp97FTsquZpDCw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-sticky-regex": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.18.6.tgz",
+      "integrity": "sha512-kfiDrDQ+PBsQDO85yj1icueWMfGfJFKN1KCkndygtu/C9+XUfydLC8Iv5UYJqRwy4zk8EcplRxEOeLyjq1gm6Q==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-template-literals": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.18.6.tgz",
+      "integrity": "sha512-UuqlRrQmT2SWRvahW46cGSany0uTlcj8NYOS5sRGYi8FxPYPoLd5DDmMd32ZXEj2Jq+06uGVQKHxa/hJx2EzKw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-typeof-symbol": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.18.6.tgz",
+      "integrity": "sha512-7m71iS/QhsPk85xSjFPovHPcH3H9qeyzsujhTc+vcdnsXavoWYJ74zx0lP5RhpC5+iDnVLO+PPMHzC11qels1g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-unicode-escapes": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.18.6.tgz",
+      "integrity": "sha512-XNRwQUXYMP7VLuy54cr/KS/WeL3AZeORhrmeZ7iewgu+X2eBqmpaLI/hzqr9ZxCeUoq0ASK4GUzSM0BDhZkLFw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-unicode-regex": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.18.6.tgz",
+      "integrity": "sha512-gE7A6Lt7YLnNOL3Pb9BNeZvi+d8l7tcRrG4+pwJjK9hD2xX4mEvjlQW60G9EEmfXVYRPv9VRQcyegIVHCql/AA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/preset-env": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.18.6.tgz",
+      "integrity": "sha512-WrthhuIIYKrEFAwttYzgRNQ5hULGmwTj+D6l7Zdfsv5M7IWV/OZbUfbeL++Qrzx1nVJwWROIFhCHRYQV4xbPNw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/compat-data": "^7.18.6",
+        "@babel/helper-compilation-targets": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-validator-option": "^7.18.6",
+        "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": "^7.18.6",
+        "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.18.6",
+        "@babel/plugin-proposal-async-generator-functions": "^7.18.6",
+        "@babel/plugin-proposal-class-properties": "^7.18.6",
+        "@babel/plugin-proposal-class-static-block": "^7.18.6",
+        "@babel/plugin-proposal-dynamic-import": "^7.18.6",
+        "@babel/plugin-proposal-export-namespace-from": "^7.18.6",
+        "@babel/plugin-proposal-json-strings": "^7.18.6",
+        "@babel/plugin-proposal-logical-assignment-operators": "^7.18.6",
+        "@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6",
+        "@babel/plugin-proposal-numeric-separator": "^7.18.6",
+        "@babel/plugin-proposal-object-rest-spread": "^7.18.6",
+        "@babel/plugin-proposal-optional-catch-binding": "^7.18.6",
+        "@babel/plugin-proposal-optional-chaining": "^7.18.6",
+        "@babel/plugin-proposal-private-methods": "^7.18.6",
+        "@babel/plugin-proposal-private-property-in-object": "^7.18.6",
+        "@babel/plugin-proposal-unicode-property-regex": "^7.18.6",
+        "@babel/plugin-syntax-async-generators": "^7.8.4",
+        "@babel/plugin-syntax-class-properties": "^7.12.13",
+        "@babel/plugin-syntax-class-static-block": "^7.14.5",
+        "@babel/plugin-syntax-dynamic-import": "^7.8.3",
+        "@babel/plugin-syntax-export-namespace-from": "^7.8.3",
+        "@babel/plugin-syntax-import-assertions": "^7.18.6",
+        "@babel/plugin-syntax-json-strings": "^7.8.3",
+        "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4",
+        "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3",
+        "@babel/plugin-syntax-numeric-separator": "^7.10.4",
+        "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+        "@babel/plugin-syntax-optional-catch-binding": "^7.8.3",
+        "@babel/plugin-syntax-optional-chaining": "^7.8.3",
+        "@babel/plugin-syntax-private-property-in-object": "^7.14.5",
+        "@babel/plugin-syntax-top-level-await": "^7.14.5",
+        "@babel/plugin-transform-arrow-functions": "^7.18.6",
+        "@babel/plugin-transform-async-to-generator": "^7.18.6",
+        "@babel/plugin-transform-block-scoped-functions": "^7.18.6",
+        "@babel/plugin-transform-block-scoping": "^7.18.6",
+        "@babel/plugin-transform-classes": "^7.18.6",
+        "@babel/plugin-transform-computed-properties": "^7.18.6",
+        "@babel/plugin-transform-destructuring": "^7.18.6",
+        "@babel/plugin-transform-dotall-regex": "^7.18.6",
+        "@babel/plugin-transform-duplicate-keys": "^7.18.6",
+        "@babel/plugin-transform-exponentiation-operator": "^7.18.6",
+        "@babel/plugin-transform-for-of": "^7.18.6",
+        "@babel/plugin-transform-function-name": "^7.18.6",
+        "@babel/plugin-transform-literals": "^7.18.6",
+        "@babel/plugin-transform-member-expression-literals": "^7.18.6",
+        "@babel/plugin-transform-modules-amd": "^7.18.6",
+        "@babel/plugin-transform-modules-commonjs": "^7.18.6",
+        "@babel/plugin-transform-modules-systemjs": "^7.18.6",
+        "@babel/plugin-transform-modules-umd": "^7.18.6",
+        "@babel/plugin-transform-named-capturing-groups-regex": "^7.18.6",
+        "@babel/plugin-transform-new-target": "^7.18.6",
+        "@babel/plugin-transform-object-super": "^7.18.6",
+        "@babel/plugin-transform-parameters": "^7.18.6",
+        "@babel/plugin-transform-property-literals": "^7.18.6",
+        "@babel/plugin-transform-regenerator": "^7.18.6",
+        "@babel/plugin-transform-reserved-words": "^7.18.6",
+        "@babel/plugin-transform-shorthand-properties": "^7.18.6",
+        "@babel/plugin-transform-spread": "^7.18.6",
+        "@babel/plugin-transform-sticky-regex": "^7.18.6",
+        "@babel/plugin-transform-template-literals": "^7.18.6",
+        "@babel/plugin-transform-typeof-symbol": "^7.18.6",
+        "@babel/plugin-transform-unicode-escapes": "^7.18.6",
+        "@babel/plugin-transform-unicode-regex": "^7.18.6",
+        "@babel/preset-modules": "^0.1.5",
+        "@babel/types": "^7.18.6",
+        "babel-plugin-polyfill-corejs2": "^0.3.1",
+        "babel-plugin-polyfill-corejs3": "^0.5.2",
+        "babel-plugin-polyfill-regenerator": "^0.3.1",
+        "core-js-compat": "^3.22.1",
+        "semver": "^6.3.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/preset-modules": {
+      "version": "0.1.5",
+      "resolved": "https://registry.npmjs.org/@babel/preset-modules/-/preset-modules-0.1.5.tgz",
+      "integrity": "sha512-A57th6YRG7oR3cq/yt/Y84MvGgE0eJG2F1JLhKuyG+jFxEgrd/HAMJatiFtmOiZurz+0DkrvbheCLaV5f2JfjA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.0.0",
+        "@babel/plugin-proposal-unicode-property-regex": "^7.4.4",
+        "@babel/plugin-transform-dotall-regex": "^7.4.4",
+        "@babel/types": "^7.4.4",
+        "esutils": "^2.0.2"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/runtime": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.18.6.tgz",
+      "integrity": "sha512-t9wi7/AW6XtKahAe20Yw0/mMljKq0B1r2fPdvaAdV/KPDZewFXdaaa6K7lxmZBZ8FBNpCiAT6iHPmd6QO9bKfQ==",
+      "dev": true,
+      "dependencies": {
+        "regenerator-runtime": "^0.13.4"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/template": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.18.6.tgz",
+      "integrity": "sha512-JoDWzPe+wgBsTTgdnIma3iHNFC7YVJoPssVBDjiHfNlyt4YcunDtcDOUmfVDfCK5MfdsaIoX9PkijPhjH3nYUw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.18.6",
+        "@babel/parser": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/traverse": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.18.6.tgz",
+      "integrity": "sha512-zS/OKyqmD7lslOtFqbscH6gMLFYOfG1YPqCKfAW5KrTeolKqvB8UelR49Fpr6y93kYkW2Ik00mT1LOGiAGvizw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.18.6",
+        "@babel/generator": "^7.18.6",
+        "@babel/helper-environment-visitor": "^7.18.6",
+        "@babel/helper-function-name": "^7.18.6",
+        "@babel/helper-hoist-variables": "^7.18.6",
+        "@babel/helper-split-export-declaration": "^7.18.6",
+        "@babel/parser": "^7.18.6",
+        "@babel/types": "^7.18.6",
+        "debug": "^4.1.0",
+        "globals": "^11.1.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/types": {
+      "version": "7.18.7",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.18.7.tgz",
+      "integrity": "sha512-QG3yxTcTIBoAcQmkCs+wAPYZhu7Dk9rXKacINfNbdJDNERTbLQbHGyVG8q/YGMPeCJRIhSY0+fTc5+xuh6WPSQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-validator-identifier": "^7.18.6",
+        "to-fast-properties": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@bcoe/v8-coverage": {
+      "version": "0.2.3",
+      "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz",
+      "integrity": "sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==",
+      "dev": true
+    },
+    "node_modules/@eslint/eslintrc": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-1.3.0.tgz",
+      "integrity": "sha512-UWW0TMTmk2d7hLcWD1/e2g5HDM/HQ3csaLSqXCfqwh4uNDuNqlaKWXmEsL4Cs41Z0KnILNvwbHAah3C2yt06kw==",
+      "dev": true,
+      "dependencies": {
+        "ajv": "^6.12.4",
+        "debug": "^4.3.2",
+        "espree": "^9.3.2",
+        "globals": "^13.15.0",
+        "ignore": "^5.2.0",
+        "import-fresh": "^3.2.1",
+        "js-yaml": "^4.1.0",
+        "minimatch": "^3.1.2",
+        "strip-json-comments": "^3.1.1"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
+    "node_modules/@eslint/eslintrc/node_modules/globals": {
+      "version": "13.15.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-13.15.0.tgz",
+      "integrity": "sha512-bpzcOlgDhMG070Av0Vy5Owklpv1I6+j96GhUI7Rh7IzDCKLzboflLrrfqMu8NquDbiR4EOQk7XzJwqVJxicxog==",
+      "dev": true,
+      "dependencies": {
+        "type-fest": "^0.20.2"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@eslint/eslintrc/node_modules/type-fest": {
+      "version": "0.20.2",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
+      "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@hapi/hoek": {
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/@hapi/hoek/-/hoek-9.3.0.tgz",
+      "integrity": "sha512-/c6rf4UJlmHlC9b5BaNvzAcFv7HZ2QHaV0D4/HNlBdvFnvQq8RI4kYdhyPCl7Xj+oWvTWQ8ujhqS53LIgAe6KQ==",
+      "dev": true
+    },
+    "node_modules/@hapi/topo": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@hapi/topo/-/topo-5.1.0.tgz",
+      "integrity": "sha512-foQZKJig7Ob0BMAYBfcJk8d77QtOe7Wo4ox7ff1lQYoNNAb6jwcY1ncdoy2e9wQZzvNy7ODZCYJkK8kzmcAnAg==",
+      "dev": true,
+      "dependencies": {
+        "@hapi/hoek": "^9.0.0"
+      }
+    },
+    "node_modules/@headlessui/vue": {
+      "version": "1.6.5",
+      "resolved": "https://registry.npmjs.org/@headlessui/vue/-/vue-1.6.5.tgz",
+      "integrity": "sha512-C/BeTVuowTDLkGgUd6UfiPZVDLdR7OTnd8o4wF37Ub9Js1uhQ3XSTfitdZvlJALUqeQ30j+5Hk3KyjVDLQ3GYQ==",
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "vue": "^3.2.0"
+      }
+    },
+    "node_modules/@heroicons/vue": {
+      "version": "2.0.13",
+      "resolved": "https://registry.npmjs.org/@heroicons/vue/-/vue-2.0.13.tgz",
+      "integrity": "sha512-vVCVF02+rNKXEmanVNnmktJlxCbOn0qVFP1gfZPn4bcBIwPX3h9AVHGCkwly+IWDEME8w5oooG0KRd2hhSe/HQ==",
+      "peerDependencies": {
+        "vue": ">= 3"
+      }
+    },
+    "node_modules/@humanwhocodes/config-array": {
+      "version": "0.9.5",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.9.5.tgz",
+      "integrity": "sha512-ObyMyWxZiCu/yTisA7uzx81s40xR2fD5Cg/2Kq7G02ajkNubJf6BopgDTmDyc3U7sXpNKM8cYOw7s7Tyr+DnCw==",
+      "dev": true,
+      "dependencies": {
+        "@humanwhocodes/object-schema": "^1.2.1",
+        "debug": "^4.1.1",
+        "minimatch": "^3.0.4"
+      },
+      "engines": {
+        "node": ">=10.10.0"
+      }
+    },
+    "node_modules/@humanwhocodes/object-schema": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-1.2.1.tgz",
+      "integrity": "sha512-ZnQMnLV4e7hDlUvw8H+U8ASL02SS2Gn6+9Ac3wGGLIe7+je2AeAOxPY+izIPJDfFDb7eDjev0Us8MO1iFRN8hA==",
+      "dev": true
+    },
+    "node_modules/@istanbuljs/load-nyc-config": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz",
+      "integrity": "sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==",
+      "dev": true,
+      "dependencies": {
+        "camelcase": "^5.3.1",
+        "find-up": "^4.1.0",
+        "get-package-type": "^0.1.0",
+        "js-yaml": "^3.13.1",
+        "resolve-from": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@istanbuljs/load-nyc-config/node_modules/argparse": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
+      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+      "dev": true,
+      "dependencies": {
+        "sprintf-js": "~1.0.2"
+      }
+    },
+    "node_modules/@istanbuljs/load-nyc-config/node_modules/camelcase": {
+      "version": "5.3.1",
+      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
+      "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
+      "version": "3.14.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
+      "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
+      "dev": true,
+      "dependencies": {
+        "argparse": "^1.0.7",
+        "esprima": "^4.0.0"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/@istanbuljs/load-nyc-config/node_modules/resolve-from": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
+      "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@istanbuljs/schema": {
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.3.tgz",
+      "integrity": "sha512-ZXRY4jNvVgSVQ8DL3LTcakaAtXwTVUxE81hslsyD2AtoXW/wVob10HkOJ1X/pAlcI7D+2YoZKg5do8G/w6RYgA==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/console": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/@jest/console/-/console-28.1.1.tgz",
+      "integrity": "sha512-0RiUocPVFEm3WRMOStIHbRWllG6iW6E3/gUPnf4lkrVFyXIIDeCe+vlKeYyFOMhB2EPE6FLFCNADSOOQMaqvyA==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^28.1.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "jest-message-util": "^28.1.1",
+        "jest-util": "^28.1.1",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
+      }
+    },
+    "node_modules/@jest/console/node_modules/@jest/types": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-28.1.1.tgz",
+      "integrity": "sha512-vRXVqSg1VhDnB8bWcmvLzmg0Bt9CRKVgHPXqYwvWMX3TvAjeO+nRuK6+VdTKCtWOvYlmkF/HqNAL/z+N3B53Kw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/schemas": "^28.0.2",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "@types/istanbul-reports": "^3.0.0",
+        "@types/node": "*",
+        "@types/yargs": "^17.0.8",
+        "chalk": "^4.0.0"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
+      }
+    },
+    "node_modules/@jest/console/node_modules/@types/yargs": {
+      "version": "17.0.10",
+      "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.10.tgz",
+      "integrity": "sha512-gmEaFwpj/7f/ROdtIlci1R1VYU1J4j95m8T+Tj3iBgiBFKg1foE/PSl93bBd5T9LDXNPo8UlNN6W0qwD8O5OaA==",
+      "dev": true,
+      "dependencies": {
+        "@types/yargs-parser": "*"
+      }
+    },
+    "node_modules/@jest/console/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/@jest/console/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/@jest/console/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/@jest/console/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/@jest/console/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/console/node_modules/jest-util": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-28.1.1.tgz",
+      "integrity": "sha512-FktOu7ca1DZSyhPAxgxB6hfh2+9zMoJ7aEQA759Z6p45NuO8mWcqujH+UdHlCm/V6JTWwDztM2ITCzU1ijJAfw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^28.1.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "ci-info": "^3.2.0",
+        "graceful-fs": "^4.2.9",
+        "picomatch": "^2.2.3"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
+      }
+    },
+    "node_modules/@jest/console/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/core": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/core/-/core-27.5.1.tgz",
+      "integrity": "sha512-AK6/UTrvQD0Cd24NSqmIA6rKsu0tKIxfiCducZvqxYdmMisOYAsdItspT+fQDQYARPf8XgjAFZi0ogW2agH5nQ==",
+      "dev": true,
+      "dependencies": {
+        "@jest/console": "^27.5.1",
+        "@jest/reporters": "^27.5.1",
+        "@jest/test-result": "^27.5.1",
+        "@jest/transform": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "ansi-escapes": "^4.2.1",
+        "chalk": "^4.0.0",
+        "emittery": "^0.8.1",
+        "exit": "^0.1.2",
+        "graceful-fs": "^4.2.9",
+        "jest-changed-files": "^27.5.1",
+        "jest-config": "^27.5.1",
+        "jest-haste-map": "^27.5.1",
+        "jest-message-util": "^27.5.1",
+        "jest-regex-util": "^27.5.1",
+        "jest-resolve": "^27.5.1",
+        "jest-resolve-dependencies": "^27.5.1",
+        "jest-runner": "^27.5.1",
+        "jest-runtime": "^27.5.1",
+        "jest-snapshot": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "jest-validate": "^27.5.1",
+        "jest-watcher": "^27.5.1",
+        "micromatch": "^4.0.4",
+        "rimraf": "^3.0.0",
+        "slash": "^3.0.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      },
+      "peerDependencies": {
+        "node-notifier": "^8.0.1 || ^9.0.0 || ^10.0.0"
+      },
+      "peerDependenciesMeta": {
+        "node-notifier": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@jest/core/node_modules/@jest/console": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+      "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "jest-message-util": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/core/node_modules/@jest/test-result": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+      "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+      "dev": true,
+      "dependencies": {
+        "@jest/console": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "collect-v8-coverage": "^1.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/core/node_modules/ansi-escapes": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
+      "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
+      "dev": true,
+      "dependencies": {
+        "type-fest": "^0.21.3"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@jest/core/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/@jest/core/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/@jest/core/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/@jest/core/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/@jest/core/node_modules/emittery": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/emittery/-/emittery-0.8.1.tgz",
+      "integrity": "sha512-uDfvUjVrfGJJhymx/kz6prltenw1u7WrCg1oa94zYY8xxVpLLUu045LAT0dhDZdXG58/EpPL/5kA180fQ/qudg==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/emittery?sponsor=1"
+      }
+    },
+    "node_modules/@jest/core/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/core/node_modules/jest-message-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+      "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.12.13",
+        "@jest/types": "^27.5.1",
+        "@types/stack-utils": "^2.0.0",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "micromatch": "^4.0.4",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/core/node_modules/jest-watcher": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-27.5.1.tgz",
+      "integrity": "sha512-z676SuD6Z8o8qbmEGhoEUFOM1+jfEiL3DXHK/xgEiG2EyNYfFG60jluWcupY6dATjfEsKQuibReS1djInQnoVw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/test-result": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "ansi-escapes": "^4.2.1",
+        "chalk": "^4.0.0",
+        "jest-util": "^27.5.1",
+        "string-length": "^4.0.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/core/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/core/node_modules/type-fest": {
+      "version": "0.21.3",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
+      "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/@jest/environment": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-27.5.1.tgz",
+      "integrity": "sha512-/WQjhPJe3/ghaol/4Bq480JKXV/Rfw8nQdN7f41fM8VDHLcxKXou6QyXAh3EFr9/bVG3x74z1NWDkP87EiY8gA==",
+      "dev": true,
+      "dependencies": {
+        "@jest/fake-timers": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "jest-mock": "^27.5.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/fake-timers": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-27.5.1.tgz",
+      "integrity": "sha512-/aPowoolwa07k7/oM3aASneNeBGCmGQsc3ugN4u6s4C/+s5M64MFo/+djTdiwcbQlRfFElGuDXWzaWj6QgKObQ==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "@sinonjs/fake-timers": "^8.0.1",
+        "@types/node": "*",
+        "jest-message-util": "^27.5.1",
+        "jest-mock": "^27.5.1",
+        "jest-util": "^27.5.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/fake-timers/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/@jest/fake-timers/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/@jest/fake-timers/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/@jest/fake-timers/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/@jest/fake-timers/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/fake-timers/node_modules/jest-message-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+      "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.12.13",
+        "@jest/types": "^27.5.1",
+        "@types/stack-utils": "^2.0.0",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "micromatch": "^4.0.4",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/fake-timers/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/globals": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-27.5.1.tgz",
+      "integrity": "sha512-ZEJNB41OBQQgGzgyInAv0UUfDDj3upmHydjieSxFvTRuZElrx7tXg/uVQ5hYVEwiXs3+aMsAeEc9X7xiSKCm4Q==",
+      "dev": true,
+      "dependencies": {
+        "@jest/environment": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "expect": "^27.5.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/reporters": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-27.5.1.tgz",
+      "integrity": "sha512-cPXh9hWIlVJMQkVk84aIvXuBB4uQQmFqZiacloFuGiP3ah1sbCxCosidXFDfqG8+6fO1oR2dTJTlsOy4VFmUfw==",
+      "dev": true,
+      "dependencies": {
+        "@bcoe/v8-coverage": "^0.2.3",
+        "@jest/console": "^27.5.1",
+        "@jest/test-result": "^27.5.1",
+        "@jest/transform": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "collect-v8-coverage": "^1.0.0",
+        "exit": "^0.1.2",
+        "glob": "^7.1.2",
+        "graceful-fs": "^4.2.9",
+        "istanbul-lib-coverage": "^3.0.0",
+        "istanbul-lib-instrument": "^5.1.0",
+        "istanbul-lib-report": "^3.0.0",
+        "istanbul-lib-source-maps": "^4.0.0",
+        "istanbul-reports": "^3.1.3",
+        "jest-haste-map": "^27.5.1",
+        "jest-resolve": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "jest-worker": "^27.5.1",
+        "slash": "^3.0.0",
+        "source-map": "^0.6.0",
+        "string-length": "^4.0.1",
+        "terminal-link": "^2.0.0",
+        "v8-to-istanbul": "^8.1.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      },
+      "peerDependencies": {
+        "node-notifier": "^8.0.1 || ^9.0.0 || ^10.0.0"
+      },
+      "peerDependenciesMeta": {
+        "node-notifier": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/@jest/console": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+      "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "jest-message-util": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/@jest/test-result": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+      "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+      "dev": true,
+      "dependencies": {
+        "@jest/console": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "collect-v8-coverage": "^1.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/@jest/reporters/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/jest-message-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+      "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.12.13",
+        "@jest/types": "^27.5.1",
+        "@types/stack-utils": "^2.0.0",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "micromatch": "^4.0.4",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/schemas": {
+      "version": "28.0.2",
+      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-28.0.2.tgz",
+      "integrity": "sha512-YVDJZjd4izeTDkij00vHHAymNXQ6WWsdChFRK86qck6Jpr3DCL5W3Is3vslviRlP+bLuMYRLbdp98amMvqudhA==",
+      "dev": true,
+      "dependencies": {
+        "@sinclair/typebox": "^0.23.3"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
+      }
+    },
+    "node_modules/@jest/source-map": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-27.5.1.tgz",
+      "integrity": "sha512-y9NIHUYF3PJRlHk98NdC/N1gl88BL08aQQgu4k4ZopQkCw9t9cV8mtl3TV8b/YCB8XaVTFrmUTAJvjsntDireg==",
+      "dev": true,
+      "dependencies": {
+        "callsites": "^3.0.0",
+        "graceful-fs": "^4.2.9",
+        "source-map": "^0.6.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/test-result": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-28.1.1.tgz",
+      "integrity": "sha512-hPmkugBktqL6rRzwWAtp1JtYT4VHwv8OQ+9lE5Gymj6dHzubI/oJHMUpPOt8NrdVWSrz9S7bHjJUmv2ggFoUNQ==",
+      "dev": true,
+      "dependencies": {
+        "@jest/console": "^28.1.1",
+        "@jest/types": "^28.1.1",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "collect-v8-coverage": "^1.0.0"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
+      }
+    },
+    "node_modules/@jest/test-result/node_modules/@jest/types": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-28.1.1.tgz",
+      "integrity": "sha512-vRXVqSg1VhDnB8bWcmvLzmg0Bt9CRKVgHPXqYwvWMX3TvAjeO+nRuK6+VdTKCtWOvYlmkF/HqNAL/z+N3B53Kw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/schemas": "^28.0.2",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "@types/istanbul-reports": "^3.0.0",
+        "@types/node": "*",
+        "@types/yargs": "^17.0.8",
+        "chalk": "^4.0.0"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
+      }
+    },
+    "node_modules/@jest/test-result/node_modules/@types/yargs": {
+      "version": "17.0.10",
+      "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.10.tgz",
+      "integrity": "sha512-gmEaFwpj/7f/ROdtIlci1R1VYU1J4j95m8T+Tj3iBgiBFKg1foE/PSl93bBd5T9LDXNPo8UlNN6W0qwD8O5OaA==",
+      "dev": true,
+      "dependencies": {
+        "@types/yargs-parser": "*"
+      }
+    },
+    "node_modules/@jest/test-result/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/@jest/test-result/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/@jest/test-result/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/@jest/test-result/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/@jest/test-result/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/test-result/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/test-sequencer": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-27.5.1.tgz",
+      "integrity": "sha512-LCheJF7WB2+9JuCS7VB/EmGIdQuhtqjRNI9A43idHv3E4KltCTsPsLxvdaubFHSYwY/fNjMWjl6vNRhDiN7vpQ==",
+      "dev": true,
+      "dependencies": {
+        "@jest/test-result": "^27.5.1",
+        "graceful-fs": "^4.2.9",
+        "jest-haste-map": "^27.5.1",
+        "jest-runtime": "^27.5.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/test-sequencer/node_modules/@jest/console": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+      "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "jest-message-util": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/test-sequencer/node_modules/@jest/test-result": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+      "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+      "dev": true,
+      "dependencies": {
+        "@jest/console": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "collect-v8-coverage": "^1.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/test-sequencer/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/@jest/test-sequencer/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/@jest/test-sequencer/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/@jest/test-sequencer/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/@jest/test-sequencer/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/test-sequencer/node_modules/jest-message-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+      "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.12.13",
+        "@jest/types": "^27.5.1",
+        "@types/stack-utils": "^2.0.0",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "micromatch": "^4.0.4",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/test-sequencer/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/transform": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-27.5.1.tgz",
+      "integrity": "sha512-ipON6WtYgl/1329g5AIJVbUuEh0wZVbdpGwC99Jw4LwuoBNS95MVphU6zOeD9pDkon+LLbFL7lOQRapbB8SCHw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/core": "^7.1.0",
+        "@jest/types": "^27.5.1",
+        "babel-plugin-istanbul": "^6.1.1",
+        "chalk": "^4.0.0",
+        "convert-source-map": "^1.4.0",
+        "fast-json-stable-stringify": "^2.0.0",
+        "graceful-fs": "^4.2.9",
+        "jest-haste-map": "^27.5.1",
+        "jest-regex-util": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "micromatch": "^4.0.4",
+        "pirates": "^4.0.4",
+        "slash": "^3.0.0",
+        "source-map": "^0.6.1",
+        "write-file-atomic": "^3.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/transform/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/@jest/transform/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/@jest/transform/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/@jest/transform/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/@jest/transform/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/transform/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/types": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-27.5.1.tgz",
+      "integrity": "sha512-Cx46iJ9QpwQTjIdq5VJu2QTMMs3QlEjI0x1QbBP5W1+nMzyc2XmimiRR/CbX9TO0cPTeUlxWMOu8mslYsJ8DEw==",
+      "dev": true,
+      "dependencies": {
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "@types/istanbul-reports": "^3.0.0",
+        "@types/node": "*",
+        "@types/yargs": "^16.0.0",
+        "chalk": "^4.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/@jest/types/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/@jest/types/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/@jest/types/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/@jest/types/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/@jest/types/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jest/types/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.1.1.tgz",
+      "integrity": "sha512-sQXCasFk+U8lWYEe66WxRDOE9PjVz4vSM51fTu3Hw+ClTpUSQb718772vH3pyS5pShp6lvQM7SxgIDXXXmOX7w==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/set-array": "^1.0.0",
+        "@jridgewell/sourcemap-codec": "^1.4.10"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.0.tgz",
+      "integrity": "sha512-F2msla3tad+Mfht5cJq7LSXcdudKTWCVYUgw6pLFOOHSTtZlj6SWNYAp+AhuqLmWdBO2X5hPrLcu8cVP8fy28w==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/set-array": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.1.2.tgz",
+      "integrity": "sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/source-map": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.2.tgz",
+      "integrity": "sha512-m7O9o2uR8k2ObDysZYzdfhb08VuEml5oWGiosa1VdaPZ/A6QyPkAJuwN0Q1lhULOf6B7MtQmHENS743hWtCrgw==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.0",
+        "@jridgewell/trace-mapping": "^0.3.9"
+      }
+    },
+    "node_modules/@jridgewell/source-map/node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.2.tgz",
+      "integrity": "sha512-mh65xKQAzI6iBcFzwv28KVWSmCkdRBWoOh+bYQGW3+6OZvbbN3TqMGo5hqYxQniRcH9F2VZIoJCm4pa3BPDK/A==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/set-array": "^1.0.1",
+        "@jridgewell/sourcemap-codec": "^1.4.10",
+        "@jridgewell/trace-mapping": "^0.3.9"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.4.14",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.14.tgz",
+      "integrity": "sha512-XPSJHWmi394fuUuzDnGz1wiKqWfo1yXecHQMRf2l6hztTO+nPru658AyDngaBe7isIxEkRsPR3FZh+s7iVa4Uw==",
+      "dev": true
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.18",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.18.tgz",
+      "integrity": "sha512-w+niJYzMHdd7USdiH2U6869nqhD2nbfZXND5Yp93qIbEmnDNk7PD48o+YchRVpzMU7M6jVCbenTR7PA1FLQ9pA==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/resolve-uri": "3.1.0",
+        "@jridgewell/sourcemap-codec": "1.4.14"
+      }
+    },
+    "node_modules/@leichtgewicht/ip-codec": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@leichtgewicht/ip-codec/-/ip-codec-2.0.4.tgz",
+      "integrity": "sha512-Hcv+nVC0kZnQ3tD9GVu5xSMR4VVYOteQIr/hwFPVEvPdlXqgGEuRjiheChHgdM+JyqdgNcmzZOX/tnl0JOiI7A==",
+      "dev": true
+    },
+    "node_modules/@node-ipc/js-queue": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@node-ipc/js-queue/-/js-queue-2.0.3.tgz",
+      "integrity": "sha512-fL1wpr8hhD5gT2dA1qifeVaoDFlQR5es8tFuKqjHX+kdOtdNHnxkVZbtIrR2rxnMFvehkjaZRNV2H/gPXlb0hw==",
+      "dev": true,
+      "dependencies": {
+        "easy-stack": "1.0.1"
+      },
+      "engines": {
+        "node": ">=1.0.0"
+      }
+    },
+    "node_modules/@nodelib/fs.scandir": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
+      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+      "dev": true,
+      "dependencies": {
+        "@nodelib/fs.stat": "2.0.5",
+        "run-parallel": "^1.1.9"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.stat": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
+      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
+      "dev": true,
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.walk": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+      "dev": true,
+      "dependencies": {
+        "@nodelib/fs.scandir": "2.1.5",
+        "fastq": "^1.6.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@polka/url": {
+      "version": "1.0.0-next.21",
+      "resolved": "https://registry.npmjs.org/@polka/url/-/url-1.0.0-next.21.tgz",
+      "integrity": "sha512-a5Sab1C4/icpTZVzZc5Ghpz88yQtGOyNqYXcZgOssB2uuAr+wF/MvN6bgtW32q7HHrvBki+BsZ0OuNv6EV3K9g==",
+      "dev": true
+    },
+    "node_modules/@popperjs/core": {
+      "version": "2.11.5",
+      "resolved": "https://registry.npmjs.org/@popperjs/core/-/core-2.11.5.tgz",
+      "integrity": "sha512-9X2obfABZuDVLCgPK9aX0a/x4jaOEweTTWE2+9sr0Qqqevj2Uv5XorvusThmc9XGYpS9yI+fhh8RTafBtGposw==",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/popperjs"
+      }
+    },
+    "node_modules/@protobufjs/aspromise": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
+      "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ=="
+    },
+    "node_modules/@protobufjs/base64": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
+      "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg=="
+    },
+    "node_modules/@protobufjs/codegen": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.4.tgz",
+      "integrity": "sha512-YyFaikqM5sH0ziFZCN3xDC7zeGaB/d0IUb9CATugHWbd1FRFwWwt4ld4OYMPWu5a3Xe01mGAULCdqhMlPl29Jg=="
+    },
+    "node_modules/@protobufjs/eventemitter": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.0.tgz",
+      "integrity": "sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q=="
+    },
+    "node_modules/@protobufjs/fetch": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.0.tgz",
+      "integrity": "sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ==",
+      "dependencies": {
+        "@protobufjs/aspromise": "^1.1.1",
+        "@protobufjs/inquire": "^1.1.0"
+      }
+    },
+    "node_modules/@protobufjs/float": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
+      "integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ=="
+    },
+    "node_modules/@protobufjs/inquire": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.0.tgz",
+      "integrity": "sha512-kdSefcPdruJiFMVSbn801t4vFK7KB/5gd2fYvrxhuJYg8ILrmn9SKSX2tZdV6V+ksulWqS7aXjBcRXl3wHoD9Q=="
+    },
+    "node_modules/@protobufjs/path": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
+      "integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA=="
+    },
+    "node_modules/@protobufjs/pool": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
+      "integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw=="
+    },
+    "node_modules/@protobufjs/utf8": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.0.tgz",
+      "integrity": "sha512-Vvn3zZrhQZkkBE8LSuW3em98c0FwgO4nxzv6OdSxPKJIEKY2bGbHn+mhGIPerzI4twdxaP8/0+06HBpwf345Lw=="
+    },
+    "node_modules/@rushstack/eslint-patch": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rushstack/eslint-patch/-/eslint-patch-1.1.4.tgz",
+      "integrity": "sha512-LwzQKA4vzIct1zNZzBmRKI9QuNpLgTQMEjsQLf3BXuGYb3QPTP4Yjf6mkdX+X1mYttZ808QpOwAzZjv28kq7DA==",
+      "dev": true
+    },
+    "node_modules/@sideway/address": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@sideway/address/-/address-4.1.4.tgz",
+      "integrity": "sha512-7vwq+rOHVWjyXxVlR76Agnvhy8I9rpzjosTESvmhNeXOXdZZB15Fl+TI9x1SiHZH5Jv2wTGduSxFDIaq0m3DUw==",
+      "dev": true,
+      "dependencies": {
+        "@hapi/hoek": "^9.0.0"
+      }
+    },
+    "node_modules/@sideway/formula": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@sideway/formula/-/formula-3.0.1.tgz",
+      "integrity": "sha512-/poHZJJVjx3L+zVD6g9KgHfYnb443oi7wLu/XKojDviHy6HOEOA6z1Trk5aR1dGcmPenJEgb2sK2I80LeS3MIg==",
+      "dev": true
+    },
+    "node_modules/@sideway/pinpoint": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@sideway/pinpoint/-/pinpoint-2.0.0.tgz",
+      "integrity": "sha512-RNiOoTPkptFtSVzQevY/yWtZwf/RxyVnPy/OcA9HBM3MlGDnBEYL5B41H0MTn0Uec8Hi+2qUtTfG2WWZBmMejQ==",
+      "dev": true
+    },
+    "node_modules/@sinclair/typebox": {
+      "version": "0.23.5",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.23.5.tgz",
+      "integrity": "sha512-AFBVi/iT4g20DHoujvMH1aEDn8fGJh4xsRGCP6d8RpLPMqsNPvW01Jcn0QysXTsg++/xj25NmJsGyH9xug/wKg==",
+      "dev": true
+    },
+    "node_modules/@sinonjs/commons": {
+      "version": "1.8.3",
+      "resolved": "https://registry.npmjs.org/@sinonjs/commons/-/commons-1.8.3.tgz",
+      "integrity": "sha512-xkNcLAn/wZaX14RPlwizcKicDk9G3F8m2nU3L7Ukm5zBgTwiT0wsoFAHx9Jq56fJA1z/7uKGtCRu16sOUCLIHQ==",
+      "dev": true,
+      "dependencies": {
+        "type-detect": "4.0.8"
+      }
+    },
+    "node_modules/@sinonjs/fake-timers": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-8.1.0.tgz",
+      "integrity": "sha512-OAPJUAtgeINhh/TAlUID4QTs53Njm7xzddaVlEs/SXwgtiD1tW22zAB/W1wdqfrpmikgaWQ9Fw6Ws+hsiRm5Vg==",
+      "dev": true,
+      "dependencies": {
+        "@sinonjs/commons": "^1.7.0"
+      }
+    },
+    "node_modules/@soda/friendly-errors-webpack-plugin": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/@soda/friendly-errors-webpack-plugin/-/friendly-errors-webpack-plugin-1.8.1.tgz",
+      "integrity": "sha512-h2ooWqP8XuFqTXT+NyAFbrArzfQA7R6HTezADrvD9Re8fxMLTPPniLdqVTdDaO0eIoLaAwKT+d6w+5GeTk7Vbg==",
+      "dev": true,
+      "dependencies": {
+        "chalk": "^3.0.0",
+        "error-stack-parser": "^2.0.6",
+        "string-width": "^4.2.3",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      },
+      "peerDependencies": {
+        "webpack": "^4.0.0 || ^5.0.0"
+      }
+    },
+    "node_modules/@soda/friendly-errors-webpack-plugin/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/@soda/friendly-errors-webpack-plugin/node_modules/chalk": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-3.0.0.tgz",
+      "integrity": "sha512-4D3B6Wf41KOYRFdszmDqMCGq5VV/uMAB273JILmO+3jAlh8X4qDtdtgCR3fxtbLEMzSx22QdhnDcJvu2u1fVwg==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@soda/friendly-errors-webpack-plugin/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/@soda/friendly-errors-webpack-plugin/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/@soda/friendly-errors-webpack-plugin/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@soda/friendly-errors-webpack-plugin/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@soda/get-current-script": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@soda/get-current-script/-/get-current-script-1.0.2.tgz",
+      "integrity": "sha512-T7VNNlYVM1SgQ+VsMYhnDkcGmWhQdL0bDyGm5TlQ3GBXnJscEClUUOKduWTmm2zCnvNLC1hc3JpuXjs/nFOc5w==",
+      "dev": true
+    },
+    "node_modules/@stardazed/streams-polyfill": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@stardazed/streams-polyfill/-/streams-polyfill-2.4.0.tgz",
+      "integrity": "sha512-W6Yg9cA8YT1b9qCQsz/2+kmKt7i/Za2Nj4QOLqdiANzpTiGy5mOyCQNyh0CVpbvXkjCBo2QxrwPvbDlP9u9k+Q=="
+    },
+    "node_modules/@tootallnate/once": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-1.1.2.tgz",
+      "integrity": "sha512-RbzJvlNzmRq5c3O09UipeuXno4tA1FE6ikOjxZK0tuxVv3412l64l5t1W5pj4+rJq9vpkm/kwiR07aZXnsKPxw==",
+      "dev": true,
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/@trysound/sax": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/@trysound/sax/-/sax-0.2.0.tgz",
+      "integrity": "sha512-L7z9BgrNEcYyUYtF+HaEfiS5ebkh9jXqbszz7pC0hRBPaatV0XjSD3+eHrpqFemQfgwiFF0QPIarnIihIDn7OA==",
+      "dev": true,
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/@types/babel__core": {
+      "version": "7.1.19",
+      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.1.19.tgz",
+      "integrity": "sha512-WEOTgRsbYkvA/KCsDwVEGkd7WAr1e3g31VHQ8zy5gul/V1qKullU/BU5I68X5v7V3GnB9eotmom4v5a5gjxorw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/parser": "^7.1.0",
+        "@babel/types": "^7.0.0",
+        "@types/babel__generator": "*",
+        "@types/babel__template": "*",
+        "@types/babel__traverse": "*"
+      }
+    },
+    "node_modules/@types/babel__generator": {
+      "version": "7.6.4",
+      "resolved": "https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.6.4.tgz",
+      "integrity": "sha512-tFkciB9j2K755yrTALxD44McOrk+gfpIpvC3sxHjRawj6PfnQxrse4Clq5y/Rq+G3mrBurMax/lG8Qn2t9mSsg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.0.0"
+      }
+    },
+    "node_modules/@types/babel__template": {
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/@types/babel__template/-/babel__template-7.4.1.tgz",
+      "integrity": "sha512-azBFKemX6kMg5Io+/rdGT0dkGreboUVR0Cdm3fz9QJWpaQGJRQXl7C+6hOTCZcMll7KFyEQpgbYI2lHdsS4U7g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/parser": "^7.1.0",
+        "@babel/types": "^7.0.0"
+      }
+    },
+    "node_modules/@types/babel__traverse": {
+      "version": "7.17.1",
+      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.17.1.tgz",
+      "integrity": "sha512-kVzjari1s2YVi77D3w1yuvohV2idweYXMCDzqBiVNN63TcDWrIlTVOYpqVrvbbyOE/IyzBoTKF0fdnLPEORFxA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.3.0"
+      }
+    },
+    "node_modules/@types/body-parser": {
+      "version": "1.19.2",
+      "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.2.tgz",
+      "integrity": "sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==",
+      "dev": true,
+      "dependencies": {
+        "@types/connect": "*",
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/bonjour": {
+      "version": "3.5.10",
+      "resolved": "https://registry.npmjs.org/@types/bonjour/-/bonjour-3.5.10.tgz",
+      "integrity": "sha512-p7ienRMiS41Nu2/igbJxxLDWrSZ0WxM8UQgCeO9KhoVF7cOVFkrKsiDr1EsJIla8vV3oEEjGcz11jc5yimhzZw==",
+      "dev": true,
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/connect": {
+      "version": "3.4.35",
+      "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.35.tgz",
+      "integrity": "sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==",
+      "dev": true,
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/connect-history-api-fallback": {
+      "version": "1.3.5",
+      "resolved": "https://registry.npmjs.org/@types/connect-history-api-fallback/-/connect-history-api-fallback-1.3.5.tgz",
+      "integrity": "sha512-h8QJa8xSb1WD4fpKBDcATDNGXghFj6/3GRWG6dhmRcu0RX1Ubasur2Uvx5aeEwlf0MwblEC2bMzzMQntxnw/Cw==",
+      "dev": true,
+      "dependencies": {
+        "@types/express-serve-static-core": "*",
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/eslint": {
+      "version": "8.4.3",
+      "resolved": "https://registry.npmjs.org/@types/eslint/-/eslint-8.4.3.tgz",
+      "integrity": "sha512-YP1S7YJRMPs+7KZKDb9G63n8YejIwW9BALq7a5j2+H4yl6iOv9CB29edho+cuFRrvmJbbaH2yiVChKLJVysDGw==",
+      "dev": true,
+      "dependencies": {
+        "@types/estree": "*",
+        "@types/json-schema": "*"
+      }
+    },
+    "node_modules/@types/eslint-scope": {
+      "version": "3.7.3",
+      "resolved": "https://registry.npmjs.org/@types/eslint-scope/-/eslint-scope-3.7.3.tgz",
+      "integrity": "sha512-PB3ldyrcnAicT35TWPs5IcwKD8S333HMaa2VVv4+wdvebJkjWuW/xESoB8IwRcog8HYVYamb1g/R31Qv5Bx03g==",
+      "dev": true,
+      "dependencies": {
+        "@types/eslint": "*",
+        "@types/estree": "*"
+      }
+    },
+    "node_modules/@types/estree": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.1.tgz",
+      "integrity": "sha512-LG4opVs2ANWZ1TJoKc937iMmNstM/d0ae1vNbnBvBhqCSezgVUOzcLCqbI5elV8Vy6WKwKjaqR+zO9VKirBBCA==",
+      "dev": true
+    },
+    "node_modules/@types/express": {
+      "version": "4.17.13",
+      "resolved": "https://registry.npmjs.org/@types/express/-/express-4.17.13.tgz",
+      "integrity": "sha512-6bSZTPaTIACxn48l50SR+axgrqm6qXFIxrdAKaG6PaJk3+zuUr35hBlgT7vOmJcum+OEaIBLtHV/qloEAFITeA==",
+      "dev": true,
+      "dependencies": {
+        "@types/body-parser": "*",
+        "@types/express-serve-static-core": "^4.17.18",
+        "@types/qs": "*",
+        "@types/serve-static": "*"
+      }
+    },
+    "node_modules/@types/express-serve-static-core": {
+      "version": "4.17.29",
+      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.17.29.tgz",
+      "integrity": "sha512-uMd++6dMKS32EOuw1Uli3e3BPgdLIXmezcfHv7N4c1s3gkhikBplORPpMq3fuWkxncZN1reb16d5n8yhQ80x7Q==",
+      "dev": true,
+      "dependencies": {
+        "@types/node": "*",
+        "@types/qs": "*",
+        "@types/range-parser": "*"
+      }
+    },
+    "node_modules/@types/graceful-fs": {
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/@types/graceful-fs/-/graceful-fs-4.1.5.tgz",
+      "integrity": "sha512-anKkLmZZ+xm4p8JWBf4hElkM4XR+EZeA2M9BAkkTldmcyDY4mbdIJnRghDJH3Ov5ooY7/UAoENtmdMSkaAd7Cw==",
+      "dev": true,
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/html-minifier-terser": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/@types/html-minifier-terser/-/html-minifier-terser-6.1.0.tgz",
+      "integrity": "sha512-oh/6byDPnL1zeNXFrDXFLyZjkr1MsBG667IM792caf1L2UPOOMf65NFzjUH/ltyfwjAGfs1rsX1eftK0jC/KIg==",
+      "dev": true
+    },
+    "node_modules/@types/http-proxy": {
+      "version": "1.17.9",
+      "resolved": "https://registry.npmjs.org/@types/http-proxy/-/http-proxy-1.17.9.tgz",
+      "integrity": "sha512-QsbSjA/fSk7xB+UXlCT3wHBy5ai9wOcNDWwZAtud+jXhwOM3l+EYZh8Lng4+/6n8uar0J7xILzqftJdJ/Wdfkw==",
+      "dev": true,
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/istanbul-lib-coverage": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.4.tgz",
+      "integrity": "sha512-z/QT1XN4K4KYuslS23k62yDIDLwLFkzxOuMplDtObz0+y7VqJCaO2o+SPwHCvLFZh7xazvvoor2tA/hPz9ee7g==",
+      "dev": true
+    },
+    "node_modules/@types/istanbul-lib-report": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-report/-/istanbul-lib-report-3.0.0.tgz",
+      "integrity": "sha512-plGgXAPfVKFoYfa9NpYDAkseG+g6Jr294RqeqcqDixSbU34MZVJRi/P+7Y8GDpzkEwLaGZZOpKIEmeVZNtKsrg==",
+      "dev": true,
+      "dependencies": {
+        "@types/istanbul-lib-coverage": "*"
+      }
+    },
+    "node_modules/@types/istanbul-reports": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@types/istanbul-reports/-/istanbul-reports-3.0.1.tgz",
+      "integrity": "sha512-c3mAZEuK0lvBp8tmuL74XRKn1+y2dcwOUpH7x4WrF6gk1GIgiluDRgMYQtw2OFcBvAJWlt6ASU3tSqxp0Uu0Aw==",
+      "dev": true,
+      "dependencies": {
+        "@types/istanbul-lib-report": "*"
+      }
+    },
+    "node_modules/@types/jest": {
+      "version": "27.5.2",
+      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-27.5.2.tgz",
+      "integrity": "sha512-mpT8LJJ4CMeeahobofYWIjFo0xonRS/HfxnVEPMPFSQdGUt1uHCnoPT7Zhb+sjDU2wz0oKV0OLUR0WzrHNgfeA==",
+      "dev": true,
+      "dependencies": {
+        "jest-matcher-utils": "^27.0.0",
+        "pretty-format": "^27.0.0"
+      }
+    },
+    "node_modules/@types/json-schema": {
+      "version": "7.0.11",
+      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.11.tgz",
+      "integrity": "sha512-wOuvG1SN4Us4rez+tylwwwCV1psiNVOkJeM3AUWUNWg/jDQY2+HE/444y5gc+jBmRqASOm2Oeh5c1axHobwRKQ=="
+    },
+    "node_modules/@types/long": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/long/-/long-4.0.2.tgz",
+      "integrity": "sha512-MqTGEo5bj5t157U6fA/BiDynNkn0YknVdh48CMPkTSpFTVmvao5UQmm7uEF6xBEo7qIMAlY/JSleYaE6VOdpaA=="
+    },
+    "node_modules/@types/luxon": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@types/luxon/-/luxon-2.4.0.tgz",
+      "integrity": "sha512-oCavjEjRXuR6URJEtQm0eBdfsBiEcGBZbq21of8iGkeKxU1+1xgKuFPClaBZl2KB8ZZBSWlgk61tH6Mf+nvZVw==",
+      "dev": true
+    },
+    "node_modules/@types/mime": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.2.tgz",
+      "integrity": "sha512-YATxVxgRqNH6nHEIsvg6k2Boc1JHI9ZbH5iWFFv/MTkchz3b1ieGDa5T0a9RznNdI0KhVbdbWSN+KWWrQZRxTw==",
+      "dev": true
+    },
+    "node_modules/@types/minimist": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@types/minimist/-/minimist-1.2.2.tgz",
+      "integrity": "sha512-jhuKLIRrhvCPLqwPcx6INqmKeiA5EWrsCOPhrlFSrbrmU4ZMPjj5Ul/oLCMDO98XRUIwVm78xICz4EPCektzeQ==",
+      "dev": true
+    },
+    "node_modules/@types/node": {
+      "version": "18.0.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.0.0.tgz",
+      "integrity": "sha512-cHlGmko4gWLVI27cGJntjs/Sj8th9aYwplmZFwmmgYQQvL5NUsgVJG7OddLvNfLqYS31KFN0s3qlaD9qCaxACA=="
+    },
+    "node_modules/@types/normalize-package-data": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/@types/normalize-package-data/-/normalize-package-data-2.4.1.tgz",
+      "integrity": "sha512-Gj7cI7z+98M282Tqmp2K5EIsoouUEzbBJhQQzDE3jSIRk6r9gsz0oUokqIUR4u1R3dMHo0pDHM7sNOHyhulypw==",
+      "dev": true
+    },
+    "node_modules/@types/parse-json": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@types/parse-json/-/parse-json-4.0.0.tgz",
+      "integrity": "sha512-//oorEZjL6sbPcKUaCdIGlIUeH26mgzimjBB77G6XRgnDl/L5wOnpyBGRe/Mmf5CVW3PwEBE1NjiMZ/ssFh4wA==",
+      "dev": true
+    },
+    "node_modules/@types/pluralize": {
+      "version": "0.0.29",
+      "resolved": "https://registry.npmjs.org/@types/pluralize/-/pluralize-0.0.29.tgz",
+      "integrity": "sha512-BYOID+l2Aco2nBik+iYS4SZX0Lf20KPILP5RGmM1IgzdwNdTs0eebiFriOPcej1sX9mLnSoiNte5zcFxssgpGA==",
+      "dev": true
+    },
+    "node_modules/@types/prettier": {
+      "version": "2.6.3",
+      "resolved": "https://registry.npmjs.org/@types/prettier/-/prettier-2.6.3.tgz",
+      "integrity": "sha512-ymZk3LEC/fsut+/Q5qejp6R9O1rMxz3XaRHDV6kX8MrGAhOSPqVARbDi+EZvInBpw+BnCX3TD240byVkOfQsHg==",
+      "dev": true
+    },
+    "node_modules/@types/qs": {
+      "version": "6.9.7",
+      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.9.7.tgz",
+      "integrity": "sha512-FGa1F62FT09qcrueBA6qYTrJPVDzah9a+493+o2PCXsesWHIn27G98TsSMs3WPNbZIEj4+VJf6saSFpvD+3Zsw==",
+      "dev": true
+    },
+    "node_modules/@types/range-parser": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.4.tgz",
+      "integrity": "sha512-EEhsLsD6UsDM1yFhAvy0Cjr6VwmpMWqFBCb9w07wVugF7w9nfajxLuVmngTIpgS6svCnm6Vaw+MZhoDCKnOfsw==",
+      "dev": true
+    },
+    "node_modules/@types/retry": {
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@types/retry/-/retry-0.12.0.tgz",
+      "integrity": "sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA==",
+      "dev": true
+    },
+    "node_modules/@types/serve-index": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/@types/serve-index/-/serve-index-1.9.1.tgz",
+      "integrity": "sha512-d/Hs3nWDxNL2xAczmOVZNj92YZCS6RGxfBPjKzuu/XirCgXdpKEb88dYNbrYGint6IVWLNP+yonwVAuRC0T2Dg==",
+      "dev": true,
+      "dependencies": {
+        "@types/express": "*"
+      }
+    },
+    "node_modules/@types/serve-static": {
+      "version": "1.13.10",
+      "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-1.13.10.tgz",
+      "integrity": "sha512-nCkHGI4w7ZgAdNkrEu0bv+4xNV/XDqW+DydknebMOQwkpDGx8G+HTlj7R7ABI8i8nKxVw0wtKPi1D+lPOkh4YQ==",
+      "dev": true,
+      "dependencies": {
+        "@types/mime": "^1",
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/sockjs": {
+      "version": "0.3.33",
+      "resolved": "https://registry.npmjs.org/@types/sockjs/-/sockjs-0.3.33.tgz",
+      "integrity": "sha512-f0KEEe05NvUnat+boPTZ0dgaLZ4SfSouXUgv5noUiefG2ajgKjmETo9ZJyuqsl7dfl2aHlLJUiki6B4ZYldiiw==",
+      "dev": true,
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/stack-utils": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/@types/stack-utils/-/stack-utils-2.0.1.tgz",
+      "integrity": "sha512-Hl219/BT5fLAaz6NDkSuhzasy49dwQS/DSdu4MdggFB8zcXv7vflBI3xp7FEmkmdDkBUI2bPUNeMttp2knYdxw==",
+      "dev": true
+    },
+    "node_modules/@types/strip-bom": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@types/strip-bom/-/strip-bom-3.0.0.tgz",
+      "integrity": "sha512-xevGOReSYGM7g/kUBZzPqCrR/KYAo+F0yiPc85WFTJa0MSLtyFTVTU6cJu/aV4mid7IffDIWqo69THF2o4JiEQ==",
+      "dev": true,
+      "optional": true,
+      "peer": true
+    },
+    "node_modules/@types/strip-json-comments": {
+      "version": "0.0.30",
+      "resolved": "https://registry.npmjs.org/@types/strip-json-comments/-/strip-json-comments-0.0.30.tgz",
+      "integrity": "sha512-7NQmHra/JILCd1QqpSzl8+mJRc8ZHz3uDm8YV1Ks9IhK0epEiTw8aIErbvH9PI+6XbqhyIQy3462nEsn7UVzjQ==",
+      "dev": true,
+      "optional": true,
+      "peer": true
+    },
+    "node_modules/@types/uuid": {
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-9.0.0.tgz",
+      "integrity": "sha512-kr90f+ERiQtKWMz5rP32ltJ/BtULDI5RVO0uavn1HQUOwjx0R1h0rnDYNL0CepF1zL5bSY6FISAfd9tOdDhU5Q==",
+      "dev": true
+    },
+    "node_modules/@types/webpack-env": {
+      "version": "1.17.0",
+      "resolved": "https://registry.npmjs.org/@types/webpack-env/-/webpack-env-1.17.0.tgz",
+      "integrity": "sha512-eHSaNYEyxRA5IAG0Ym/yCyf86niZUIF/TpWKofQI/CVfh5HsMEUyfE2kwFxha4ow0s5g0LfISQxpDKjbRDrizw==",
+      "dev": true
+    },
+    "node_modules/@types/ws": {
+      "version": "8.5.3",
+      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.5.3.tgz",
+      "integrity": "sha512-6YOoWjruKj1uLf3INHH7D3qTXwFfEsg1kf3c0uDdSBJwfa/llkwIjrAGV7j7mVgGNbzTQ3HiHKKDXl6bJPD97w==",
+      "dev": true,
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/yargs": {
+      "version": "16.0.4",
+      "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-16.0.4.tgz",
+      "integrity": "sha512-T8Yc9wt/5LbJyCaLiHPReJa0kApcIgJ7Bn735GjItUfh08Z1pJvu8QZqb9s+mMvKV6WUQRV7K2R46YbjMXTTJw==",
+      "dev": true,
+      "dependencies": {
+        "@types/yargs-parser": "*"
+      }
+    },
+    "node_modules/@types/yargs-parser": {
+      "version": "21.0.0",
+      "resolved": "https://registry.npmjs.org/@types/yargs-parser/-/yargs-parser-21.0.0.tgz",
+      "integrity": "sha512-iO9ZQHkZxHn4mSakYV0vFHAVDyEOIJQrV2uZ06HxEPcx+mt8swXoZHIbaaJ2crJYFfErySgktuTZ3BeLz+XmFA==",
+      "dev": true
+    },
+    "node_modules/@typescript-eslint/eslint-plugin": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-5.30.0.tgz",
+      "integrity": "sha512-lvhRJ2pGe2V9MEU46ELTdiHgiAFZPKtLhiU5wlnaYpMc2+c1R8fh8i80ZAa665drvjHKUJyRRGg3gEm1If54ow==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/scope-manager": "5.30.0",
+        "@typescript-eslint/type-utils": "5.30.0",
+        "@typescript-eslint/utils": "5.30.0",
+        "debug": "^4.3.4",
+        "functional-red-black-tree": "^1.0.1",
+        "ignore": "^5.2.0",
+        "regexpp": "^3.2.0",
+        "semver": "^7.3.7",
+        "tsutils": "^3.21.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "@typescript-eslint/parser": "^5.0.0",
+        "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/eslint-plugin/node_modules/semver": {
+      "version": "7.5.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@typescript-eslint/parser": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-5.30.0.tgz",
+      "integrity": "sha512-2oYYUws5o2liX6SrFQ5RB88+PuRymaM2EU02/9Ppoyu70vllPnHVO7ioxDdq/ypXHA277R04SVjxvwI8HmZpzA==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/scope-manager": "5.30.0",
+        "@typescript-eslint/types": "5.30.0",
+        "@typescript-eslint/typescript-estree": "5.30.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/scope-manager": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-5.30.0.tgz",
+      "integrity": "sha512-3TZxvlQcK5fhTBw5solQucWSJvonXf5yua5nx8OqK94hxdrT7/6W3/CS42MLd/f1BmlmmbGEgQcTHHCktUX5bQ==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "5.30.0",
+        "@typescript-eslint/visitor-keys": "5.30.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/type-utils": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-5.30.0.tgz",
+      "integrity": "sha512-GF8JZbZqSS+azehzlv/lmQQ3EU3VfWYzCczdZjJRxSEeXDQkqFhCBgFhallLDbPwQOEQ4MHpiPfkjKk7zlmeNg==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/utils": "5.30.0",
+        "debug": "^4.3.4",
+        "tsutils": "^3.21.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "*"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/types": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-5.30.0.tgz",
+      "integrity": "sha512-vfqcBrsRNWw/LBXyncMF/KrUTYYzzygCSsVqlZ1qGu1QtGs6vMkt3US0VNSQ05grXi5Yadp3qv5XZdYLjpp8ag==",
+      "dev": true,
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/typescript-estree": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-5.30.0.tgz",
+      "integrity": "sha512-hDEawogreZB4n1zoqcrrtg/wPyyiCxmhPLpZ6kmWfKF5M5G0clRLaEexpuWr31fZ42F96SlD/5xCt1bT5Qm4Nw==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "5.30.0",
+        "@typescript-eslint/visitor-keys": "5.30.0",
+        "debug": "^4.3.4",
+        "globby": "^11.1.0",
+        "is-glob": "^4.0.3",
+        "semver": "^7.3.7",
+        "tsutils": "^3.21.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/typescript-estree/node_modules/semver": {
+      "version": "7.5.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@typescript-eslint/utils": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-5.30.0.tgz",
+      "integrity": "sha512-0bIgOgZflLKIcZsWvfklsaQTM3ZUbmtH0rJ1hKyV3raoUYyeZwcjQ8ZUJTzS7KnhNcsVT1Rxs7zeeMHEhGlltw==",
+      "dev": true,
+      "dependencies": {
+        "@types/json-schema": "^7.0.9",
+        "@typescript-eslint/scope-manager": "5.30.0",
+        "@typescript-eslint/types": "5.30.0",
+        "@typescript-eslint/typescript-estree": "5.30.0",
+        "eslint-scope": "^5.1.1",
+        "eslint-utils": "^3.0.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      }
+    },
+    "node_modules/@typescript-eslint/visitor-keys": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-5.30.0.tgz",
+      "integrity": "sha512-6WcIeRk2DQ3pHKxU1Ni0qMXJkjO/zLjBymlYBy/53qxe7yjEFSvzKLDToJjURUhSl2Fzhkl4SMXQoETauF74cw==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "5.30.0",
+        "eslint-visitor-keys": "^3.3.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@volar-plugins/vetur": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/@volar-plugins/vetur/-/vetur-0.1.0.tgz",
+      "integrity": "sha512-Qaws7TI8d/kkjihSQrW/3YGqiLeLZ1dMjfxDBe4vJKhzXw82sN4+Wr8NwGf2s15KyVDPQTjkPHv6ukn4vFD9Og==",
+      "dev": true,
+      "dependencies": {
+        "@volar/vue-language-service-types": "^0.34.0",
+        "vls": "^0.8.0",
+        "vscode-html-languageservice": "^5.0.0",
+        "vscode-uri": "^3.0.3"
+      }
+    },
+    "node_modules/@volar/vue-language-service-types": {
+      "version": "0.34.17",
+      "resolved": "https://registry.npmjs.org/@volar/vue-language-service-types/-/vue-language-service-types-0.34.17.tgz",
+      "integrity": "sha512-skDO8ZS6Vs0M+zbnYeoBWk7JX8WbCeCohOwnkstqYxXtcqEU4HTeTShhVxrfyWGS0FLHVE79VAhicxjul2EnHw==",
+      "dev": true,
+      "dependencies": {
+        "vscode-languageserver-protocol": "^3.17.1",
+        "vscode-languageserver-textdocument": "^1.0.4"
+      }
+    },
+    "node_modules/@vscode/l10n": {
+      "version": "0.0.11",
+      "resolved": "https://registry.npmjs.org/@vscode/l10n/-/l10n-0.0.11.tgz",
+      "integrity": "sha512-ukOMWnCg1tCvT7WnDfsUKQOFDQGsyR5tNgRpwmqi+5/vzU3ghdDXzvIM4IOPdSb3OeSsBNvmSL8nxIVOqi2WXA==",
+      "dev": true
+    },
+    "node_modules/@vue/babel-helper-vue-jsx-merge-props": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@vue/babel-helper-vue-jsx-merge-props/-/babel-helper-vue-jsx-merge-props-1.2.1.tgz",
+      "integrity": "sha512-QOi5OW45e2R20VygMSNhyQHvpdUwQZqGPc748JLGCYEy+yp8fNFNdbNIGAgZmi9e+2JHPd6i6idRuqivyicIkA==",
+      "dev": true
+    },
+    "node_modules/@vue/babel-helper-vue-transform-on": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@vue/babel-helper-vue-transform-on/-/babel-helper-vue-transform-on-1.0.2.tgz",
+      "integrity": "sha512-hz4R8tS5jMn8lDq6iD+yWL6XNB699pGIVLk7WSJnn1dbpjaazsjZQkieJoRX6gW5zpYSCFqQ7jUquPNY65tQYA==",
+      "dev": true
+    },
+    "node_modules/@vue/babel-plugin-jsx": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@vue/babel-plugin-jsx/-/babel-plugin-jsx-1.1.1.tgz",
+      "integrity": "sha512-j2uVfZjnB5+zkcbc/zsOc0fSNGCMMjaEXP52wdwdIfn0qjFfEYpYZBFKFg+HHnQeJCVrjOeO0YxgaL7DMrym9w==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-module-imports": "^7.0.0",
+        "@babel/plugin-syntax-jsx": "^7.0.0",
+        "@babel/template": "^7.0.0",
+        "@babel/traverse": "^7.0.0",
+        "@babel/types": "^7.0.0",
+        "@vue/babel-helper-vue-transform-on": "^1.0.2",
+        "camelcase": "^6.0.0",
+        "html-tags": "^3.1.0",
+        "svg-tags": "^1.0.0"
+      }
+    },
+    "node_modules/@vue/babel-plugin-transform-vue-jsx": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@vue/babel-plugin-transform-vue-jsx/-/babel-plugin-transform-vue-jsx-1.2.1.tgz",
+      "integrity": "sha512-HJuqwACYehQwh1fNT8f4kyzqlNMpBuUK4rSiSES5D4QsYncv5fxFsLyrxFPG2ksO7t5WP+Vgix6tt6yKClwPzA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-module-imports": "^7.0.0",
+        "@babel/plugin-syntax-jsx": "^7.2.0",
+        "@vue/babel-helper-vue-jsx-merge-props": "^1.2.1",
+        "html-tags": "^2.0.0",
+        "lodash.kebabcase": "^4.1.1",
+        "svg-tags": "^1.0.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@vue/babel-plugin-transform-vue-jsx/node_modules/html-tags": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/html-tags/-/html-tags-2.0.0.tgz",
+      "integrity": "sha512-+Il6N8cCo2wB/Vd3gqy/8TZhTD3QvcVeQLCnZiGkGCH3JP28IgGAY41giccp2W4R3jfyJPAP318FQTa1yU7K7g==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/@vue/babel-preset-app": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/babel-preset-app/-/babel-preset-app-5.0.6.tgz",
+      "integrity": "sha512-hoVr5M5RIvAL8F6MX8ZG0RvjA7MB7eDOkykK+M+qThkkrsAvlianzygnE86xN1N7JVSq7kGOyZk0Te+L20KqeQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/core": "^7.12.16",
+        "@babel/helper-compilation-targets": "^7.12.16",
+        "@babel/helper-module-imports": "^7.12.13",
+        "@babel/plugin-proposal-class-properties": "^7.12.13",
+        "@babel/plugin-proposal-decorators": "^7.12.13",
+        "@babel/plugin-syntax-dynamic-import": "^7.8.3",
+        "@babel/plugin-syntax-jsx": "^7.12.13",
+        "@babel/plugin-transform-runtime": "^7.12.15",
+        "@babel/preset-env": "^7.12.16",
+        "@babel/runtime": "^7.12.13",
+        "@vue/babel-plugin-jsx": "^1.0.3",
+        "@vue/babel-preset-jsx": "^1.1.2",
+        "babel-plugin-dynamic-import-node": "^2.3.3",
+        "core-js": "^3.8.3",
+        "core-js-compat": "^3.8.3",
+        "semver": "^7.3.4"
+      },
+      "peerDependencies": {
+        "@babel/core": "*",
+        "core-js": "^3",
+        "vue": "^2 || ^3.2.13"
+      },
+      "peerDependenciesMeta": {
+        "core-js": {
+          "optional": true
+        },
+        "vue": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vue/babel-preset-app/node_modules/semver": {
+      "version": "7.5.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@vue/babel-preset-jsx": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@vue/babel-preset-jsx/-/babel-preset-jsx-1.2.4.tgz",
+      "integrity": "sha512-oRVnmN2a77bYDJzeGSt92AuHXbkIxbf/XXSE3klINnh9AXBmVS1DGa1f0d+dDYpLfsAKElMnqKTQfKn7obcL4w==",
+      "dev": true,
+      "dependencies": {
+        "@vue/babel-helper-vue-jsx-merge-props": "^1.2.1",
+        "@vue/babel-plugin-transform-vue-jsx": "^1.2.1",
+        "@vue/babel-sugar-composition-api-inject-h": "^1.2.1",
+        "@vue/babel-sugar-composition-api-render-instance": "^1.2.4",
+        "@vue/babel-sugar-functional-vue": "^1.2.2",
+        "@vue/babel-sugar-inject-h": "^1.2.2",
+        "@vue/babel-sugar-v-model": "^1.2.3",
+        "@vue/babel-sugar-v-on": "^1.2.3"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@vue/babel-sugar-composition-api-inject-h": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@vue/babel-sugar-composition-api-inject-h/-/babel-sugar-composition-api-inject-h-1.2.1.tgz",
+      "integrity": "sha512-4B3L5Z2G+7s+9Bwbf+zPIifkFNcKth7fQwekVbnOA3cr3Pq71q71goWr97sk4/yyzH8phfe5ODVzEjX7HU7ItQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/plugin-syntax-jsx": "^7.2.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@vue/babel-sugar-composition-api-render-instance": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@vue/babel-sugar-composition-api-render-instance/-/babel-sugar-composition-api-render-instance-1.2.4.tgz",
+      "integrity": "sha512-joha4PZznQMsxQYXtR3MnTgCASC9u3zt9KfBxIeuI5g2gscpTsSKRDzWQt4aqNIpx6cv8On7/m6zmmovlNsG7Q==",
+      "dev": true,
+      "dependencies": {
+        "@babel/plugin-syntax-jsx": "^7.2.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@vue/babel-sugar-functional-vue": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@vue/babel-sugar-functional-vue/-/babel-sugar-functional-vue-1.2.2.tgz",
+      "integrity": "sha512-JvbgGn1bjCLByIAU1VOoepHQ1vFsroSA/QkzdiSs657V79q6OwEWLCQtQnEXD/rLTA8rRit4rMOhFpbjRFm82w==",
+      "dev": true,
+      "dependencies": {
+        "@babel/plugin-syntax-jsx": "^7.2.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@vue/babel-sugar-inject-h": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@vue/babel-sugar-inject-h/-/babel-sugar-inject-h-1.2.2.tgz",
+      "integrity": "sha512-y8vTo00oRkzQTgufeotjCLPAvlhnpSkcHFEp60+LJUwygGcd5Chrpn5480AQp/thrxVm8m2ifAk0LyFel9oCnw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/plugin-syntax-jsx": "^7.2.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@vue/babel-sugar-v-model": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@vue/babel-sugar-v-model/-/babel-sugar-v-model-1.2.3.tgz",
+      "integrity": "sha512-A2jxx87mySr/ulAsSSyYE8un6SIH0NWHiLaCWpodPCVOlQVODCaSpiR4+IMsmBr73haG+oeCuSvMOM+ttWUqRQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/plugin-syntax-jsx": "^7.2.0",
+        "@vue/babel-helper-vue-jsx-merge-props": "^1.2.1",
+        "@vue/babel-plugin-transform-vue-jsx": "^1.2.1",
+        "camelcase": "^5.0.0",
+        "html-tags": "^2.0.0",
+        "svg-tags": "^1.0.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@vue/babel-sugar-v-model/node_modules/camelcase": {
+      "version": "5.3.1",
+      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
+      "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/@vue/babel-sugar-v-model/node_modules/html-tags": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/html-tags/-/html-tags-2.0.0.tgz",
+      "integrity": "sha512-+Il6N8cCo2wB/Vd3gqy/8TZhTD3QvcVeQLCnZiGkGCH3JP28IgGAY41giccp2W4R3jfyJPAP318FQTa1yU7K7g==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/@vue/babel-sugar-v-on": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@vue/babel-sugar-v-on/-/babel-sugar-v-on-1.2.3.tgz",
+      "integrity": "sha512-kt12VJdz/37D3N3eglBywV8GStKNUhNrsxChXIV+o0MwVXORYuhDTHJRKPgLJRb/EY3vM2aRFQdxJBp9CLikjw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/plugin-syntax-jsx": "^7.2.0",
+        "@vue/babel-plugin-transform-vue-jsx": "^1.2.1",
+        "camelcase": "^5.0.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@vue/babel-sugar-v-on/node_modules/camelcase": {
+      "version": "5.3.1",
+      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
+      "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/@vue/cli-overlay": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-overlay/-/cli-overlay-5.0.6.tgz",
+      "integrity": "sha512-rghCRMPVQ4FIKmQy8ipn8fKztdaQSQTktAKob2SGuEL/iBWfclSMAQCXfj908nyzOBymo+q/Sn/oiLhi07oHlA==",
+      "dev": true
+    },
+    "node_modules/@vue/cli-plugin-babel": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-babel/-/cli-plugin-babel-5.0.6.tgz",
+      "integrity": "sha512-ruQhfhj2WM6Fe/VDQneQc/kqNp/p138SjQMfz7q/rxMTMG1kpV5B0jYWschXHXLQ6aDsFnqmBmIK+XjU3XTF3g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/core": "^7.12.16",
+        "@vue/babel-preset-app": "^5.0.6",
+        "@vue/cli-shared-utils": "^5.0.6",
+        "babel-loader": "^8.2.2",
+        "thread-loader": "^3.0.0",
+        "webpack": "^5.54.0"
+      },
+      "peerDependencies": {
+        "@vue/cli-service": "^3.0.0 || ^4.0.0 || ^5.0.0-0"
+      }
+    },
+    "node_modules/@vue/cli-plugin-eslint": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-eslint/-/cli-plugin-eslint-5.0.6.tgz",
+      "integrity": "sha512-fuc8w2IujzoenA/cdr/QYYMq2yaI1fYr0Fqom/M55B+DmW19GIuIRxYQvh0CEeCbFB2hAl3Flrazfx96/nAaQA==",
+      "dev": true,
+      "dependencies": {
+        "@vue/cli-shared-utils": "^5.0.6",
+        "eslint-webpack-plugin": "^3.1.0",
+        "globby": "^11.0.2",
+        "webpack": "^5.54.0",
+        "yorkie": "^2.0.0"
+      },
+      "peerDependencies": {
+        "@vue/cli-service": "^3.0.0 || ^4.0.0 || ^5.0.0-0",
+        "eslint": ">=7.5.0"
+      }
+    },
+    "node_modules/@vue/cli-plugin-router": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-router/-/cli-plugin-router-5.0.6.tgz",
+      "integrity": "sha512-5ikUdfsSoKqpBhB5GhGYijH6mJnU+ZGqDv3QBf0brDeeh7PhClntxNAOLkB73c+LNxjBrlNCTkItuByF+AD29w==",
+      "dev": true,
+      "dependencies": {
+        "@vue/cli-shared-utils": "^5.0.6"
+      },
+      "peerDependencies": {
+        "@vue/cli-service": "^3.0.0 || ^4.0.0 || ^5.0.0-0"
+      }
+    },
+    "node_modules/@vue/cli-plugin-typescript": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-typescript/-/cli-plugin-typescript-5.0.6.tgz",
+      "integrity": "sha512-DKw3SZEWs+9v6oUMTJAGcmJY4XCIdLhwXU1MsXDmhea/VqoGTcY9yl1mb/QfZ3AttdRtC7n4Vk01tGa0pnewsA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/core": "^7.12.16",
+        "@types/webpack-env": "^1.15.2",
+        "@vue/cli-shared-utils": "^5.0.6",
+        "babel-loader": "^8.2.2",
+        "fork-ts-checker-webpack-plugin": "^6.4.0",
+        "globby": "^11.0.2",
+        "thread-loader": "^3.0.0",
+        "ts-loader": "^9.2.5",
+        "webpack": "^5.54.0"
+      },
+      "peerDependencies": {
+        "@vue/cli-service": "^3.0.0 || ^4.0.0 || ^5.0.0-0",
+        "cache-loader": "^4.1.0",
+        "typescript": ">=2",
+        "vue": "^2 || ^3.2.13",
+        "vue-template-compiler": "^2.0.0"
+      },
+      "peerDependenciesMeta": {
+        "cache-loader": {
+          "optional": true
+        },
+        "vue-template-compiler": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vue/cli-plugin-unit-jest": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-unit-jest/-/cli-plugin-unit-jest-5.0.6.tgz",
+      "integrity": "sha512-PZ2/q4bo7UWKI2CXNomGrutJTPD+LHZWlz4QQ5uTTLSvrvWxZaULuMItIrTIZPUfDTnl98LpyTLRzNAhZBr63A==",
+      "dev": true,
+      "dependencies": {
+        "@babel/core": "^7.12.16",
+        "@babel/plugin-transform-modules-commonjs": "^7.15.0",
+        "@types/jest": "^27.0.1",
+        "@vue/cli-shared-utils": "^5.0.6",
+        "babel-jest": "^27.1.0",
+        "deepmerge": "^4.2.2",
+        "jest": "^27.1.0",
+        "jest-serializer-vue": "^2.0.2",
+        "jest-transform-stub": "^2.0.0",
+        "jest-watch-typeahead": "^1.0.0"
+      },
+      "peerDependencies": {
+        "@vue/cli-service": "^3.0.0 || ^4.0.0 || ^5.0.0-0",
+        "@vue/vue2-jest": "^27.0.0-alpha.3",
+        "@vue/vue3-jest": "^27.0.0-alpha.3",
+        "jest": "^27.1.0",
+        "ts-jest": "^27.0.4"
+      },
+      "peerDependenciesMeta": {
+        "@vue/vue2-jest": {
+          "optional": true
+        },
+        "@vue/vue3-jest": {
+          "optional": true
+        },
+        "ts-jest": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vue/cli-plugin-unit-jest/node_modules/deepmerge": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.2.2.tgz",
+      "integrity": "sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/@vue/cli-plugin-vuex": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-vuex/-/cli-plugin-vuex-5.0.6.tgz",
+      "integrity": "sha512-9bwkaLxGqqrD5FPN7iNsIe5x60P0nScioMQvHf2ZIIoFAiM5yuTgOQkdSKGBhn0YG4IjYd1tnlVY4Q/P4ZHaTA==",
+      "dev": true,
+      "peerDependencies": {
+        "@vue/cli-service": "^3.0.0 || ^4.0.0 || ^5.0.0-0"
+      }
+    },
+    "node_modules/@vue/cli-service": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-service/-/cli-service-5.0.6.tgz",
+      "integrity": "sha512-XSiTCjUMk8adjvQIJXBxk3ltEBLyBme8rpqdhJrpgCgSj+8pcPPyYKs1M0petkhwLMv3mEXVPNQmXKFzpdWVrw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-compilation-targets": "^7.12.16",
+        "@soda/friendly-errors-webpack-plugin": "^1.8.0",
+        "@soda/get-current-script": "^1.0.2",
+        "@types/minimist": "^1.2.0",
+        "@vue/cli-overlay": "^5.0.6",
+        "@vue/cli-plugin-router": "^5.0.6",
+        "@vue/cli-plugin-vuex": "^5.0.6",
+        "@vue/cli-shared-utils": "^5.0.6",
+        "@vue/component-compiler-utils": "^3.3.0",
+        "@vue/vue-loader-v15": "npm:vue-loader@^15.9.7",
+        "@vue/web-component-wrapper": "^1.3.0",
+        "acorn": "^8.0.5",
+        "acorn-walk": "^8.0.2",
+        "address": "^1.1.2",
+        "autoprefixer": "^10.2.4",
+        "browserslist": "^4.16.3",
+        "case-sensitive-paths-webpack-plugin": "^2.3.0",
+        "cli-highlight": "^2.1.10",
+        "clipboardy": "^2.3.0",
+        "cliui": "^7.0.4",
+        "copy-webpack-plugin": "^9.0.1",
+        "css-loader": "^6.5.0",
+        "css-minimizer-webpack-plugin": "^3.0.2",
+        "cssnano": "^5.0.0",
+        "debug": "^4.1.1",
+        "default-gateway": "^6.0.3",
+        "dotenv": "^10.0.0",
+        "dotenv-expand": "^5.1.0",
+        "fs-extra": "^9.1.0",
+        "globby": "^11.0.2",
+        "hash-sum": "^2.0.0",
+        "html-webpack-plugin": "^5.1.0",
+        "is-file-esm": "^1.0.0",
+        "launch-editor-middleware": "^2.2.1",
+        "lodash.defaultsdeep": "^4.6.1",
+        "lodash.mapvalues": "^4.6.0",
+        "mini-css-extract-plugin": "^2.5.3",
+        "minimist": "^1.2.5",
+        "module-alias": "^2.2.2",
+        "portfinder": "^1.0.26",
+        "postcss": "^8.2.6",
+        "postcss-loader": "^6.1.1",
+        "progress-webpack-plugin": "^1.0.12",
+        "ssri": "^8.0.1",
+        "terser-webpack-plugin": "^5.1.1",
+        "thread-loader": "^3.0.0",
+        "vue-loader": "^17.0.0",
+        "vue-style-loader": "^4.1.3",
+        "webpack": "^5.54.0",
+        "webpack-bundle-analyzer": "^4.4.0",
+        "webpack-chain": "^6.5.1",
+        "webpack-dev-server": "^4.7.3",
+        "webpack-merge": "^5.7.3",
+        "webpack-virtual-modules": "^0.4.2",
+        "whatwg-fetch": "^3.6.2"
+      },
+      "bin": {
+        "vue-cli-service": "bin/vue-cli-service.js"
+      },
+      "engines": {
+        "node": "^12.0.0 || >= 14.0.0"
+      },
+      "peerDependencies": {
+        "vue-template-compiler": "^2.0.0",
+        "webpack-sources": "*"
+      },
+      "peerDependenciesMeta": {
+        "cache-loader": {
+          "optional": true
+        },
+        "less-loader": {
+          "optional": true
+        },
+        "pug-plain-loader": {
+          "optional": true
+        },
+        "raw-loader": {
+          "optional": true
+        },
+        "sass-loader": {
+          "optional": true
+        },
+        "stylus-loader": {
+          "optional": true
+        },
+        "vue-template-compiler": {
+          "optional": true
+        },
+        "webpack-sources": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vue/cli-shared-utils": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-shared-utils/-/cli-shared-utils-5.0.6.tgz",
+      "integrity": "sha512-5HmlRtMByOCFO0P3mMUx8dVruTRhZ3pqQ0f1cCH9TmAoDjetmD/Ib7yx/5KxTHV8QY3xZJxYvgAmOU5C49K5xA==",
+      "dev": true,
+      "dependencies": {
+        "@achrinza/node-ipc": "^9.2.5",
+        "chalk": "^4.1.2",
+        "execa": "^1.0.0",
+        "joi": "^17.4.0",
+        "launch-editor": "^2.2.1",
+        "lru-cache": "^6.0.0",
+        "node-fetch": "^2.6.7",
+        "open": "^8.0.2",
+        "ora": "^5.3.0",
+        "read-pkg": "^5.1.1",
+        "semver": "^7.3.4",
+        "strip-ansi": "^6.0.0"
+      }
+    },
+    "node_modules/@vue/cli-shared-utils/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/@vue/cli-shared-utils/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/@vue/cli-shared-utils/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/@vue/cli-shared-utils/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/@vue/cli-shared-utils/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@vue/cli-shared-utils/node_modules/semver": {
+      "version": "7.5.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/@vue/cli-shared-utils/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/@vue/compiler-core": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.2.37.tgz",
+      "integrity": "sha512-81KhEjo7YAOh0vQJoSmAD68wLfYqJvoiD4ulyedzF+OEk/bk6/hx3fTNVfuzugIIaTrOx4PGx6pAiBRe5e9Zmg==",
+      "dependencies": {
+        "@babel/parser": "^7.16.4",
+        "@vue/shared": "3.2.37",
+        "estree-walker": "^2.0.2",
+        "source-map": "^0.6.1"
+      }
+    },
+    "node_modules/@vue/compiler-dom": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.2.37.tgz",
+      "integrity": "sha512-yxJLH167fucHKxaqXpYk7x8z7mMEnXOw3G2q62FTkmsvNxu4FQSu5+3UMb+L7fjKa26DEzhrmCxAgFLLIzVfqQ==",
+      "dependencies": {
+        "@vue/compiler-core": "3.2.37",
+        "@vue/shared": "3.2.37"
+      }
+    },
+    "node_modules/@vue/compiler-sfc": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.2.37.tgz",
+      "integrity": "sha512-+7i/2+9LYlpqDv+KTtWhOZH+pa8/HnX/905MdVmAcI/mPQOBwkHHIzrsEsucyOIZQYMkXUiTkmZq5am/NyXKkg==",
+      "dependencies": {
+        "@babel/parser": "^7.16.4",
+        "@vue/compiler-core": "3.2.37",
+        "@vue/compiler-dom": "3.2.37",
+        "@vue/compiler-ssr": "3.2.37",
+        "@vue/reactivity-transform": "3.2.37",
+        "@vue/shared": "3.2.37",
+        "estree-walker": "^2.0.2",
+        "magic-string": "^0.25.7",
+        "postcss": "^8.1.10",
+        "source-map": "^0.6.1"
+      }
+    },
+    "node_modules/@vue/compiler-ssr": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.2.37.tgz",
+      "integrity": "sha512-7mQJD7HdXxQjktmsWp/J67lThEIcxLemz1Vb5I6rYJHR5vI+lON3nPGOH3ubmbvYGt8xEUaAr1j7/tIFWiEOqw==",
+      "dependencies": {
+        "@vue/compiler-dom": "3.2.37",
+        "@vue/shared": "3.2.37"
+      }
+    },
+    "node_modules/@vue/component-compiler-utils": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@vue/component-compiler-utils/-/component-compiler-utils-3.3.0.tgz",
+      "integrity": "sha512-97sfH2mYNU+2PzGrmK2haqffDpVASuib9/w2/noxiFi31Z54hW+q3izKQXXQZSNhtiUpAI36uSuYepeBe4wpHQ==",
+      "dev": true,
+      "dependencies": {
+        "consolidate": "^0.15.1",
+        "hash-sum": "^1.0.2",
+        "lru-cache": "^4.1.2",
+        "merge-source-map": "^1.1.0",
+        "postcss": "^7.0.36",
+        "postcss-selector-parser": "^6.0.2",
+        "source-map": "~0.6.1",
+        "vue-template-es2015-compiler": "^1.9.0"
+      },
+      "optionalDependencies": {
+        "prettier": "^1.18.2 || ^2.0.0"
+      }
+    },
+    "node_modules/@vue/component-compiler-utils/node_modules/hash-sum": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/hash-sum/-/hash-sum-1.0.2.tgz",
+      "integrity": "sha512-fUs4B4L+mlt8/XAtSOGMUO1TXmAelItBPtJG7CyHJfYTdDjwisntGO2JQz7oUsatOY9o68+57eziUVNw/mRHmA==",
+      "dev": true
+    },
+    "node_modules/@vue/component-compiler-utils/node_modules/lru-cache": {
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-4.1.5.tgz",
+      "integrity": "sha512-sWZlbEP2OsHNkXrMl5GYk/jKk70MBng6UU4YI/qGDYbgf6YbP4EvmqISbXCoJiRKs+1bSpFHVgQxvJ17F2li5g==",
+      "dev": true,
+      "dependencies": {
+        "pseudomap": "^1.0.2",
+        "yallist": "^2.1.2"
+      }
+    },
+    "node_modules/@vue/component-compiler-utils/node_modules/picocolors": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-0.2.1.tgz",
+      "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==",
+      "dev": true
+    },
+    "node_modules/@vue/component-compiler-utils/node_modules/postcss": {
+      "version": "7.0.39",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.39.tgz",
+      "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
+      "dev": true,
+      "dependencies": {
+        "picocolors": "^0.2.1",
+        "source-map": "^0.6.1"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/postcss/"
+      }
+    },
+    "node_modules/@vue/component-compiler-utils/node_modules/yallist": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-2.1.2.tgz",
+      "integrity": "sha512-ncTzHV7NvsQZkYe1DW7cbDLm0YpzHmZF5r/iyP3ZnQtMiJ+pjzisCiMNI+Sj+xQF5pXhSHxSB3uDbsBTzY/c2A==",
+      "dev": true
+    },
+    "node_modules/@vue/devtools-api": {
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/@vue/devtools-api/-/devtools-api-6.1.4.tgz",
+      "integrity": "sha512-IiA0SvDrJEgXvVxjNkHPFfDx6SXw0b/TUkqMcDZWNg9fnCAHbTpoo59YfJ9QLFkwa3raau5vSlRVzMSLDnfdtQ=="
+    },
+    "node_modules/@vue/eslint-config-typescript": {
+      "version": "11.0.0",
+      "resolved": "https://registry.npmjs.org/@vue/eslint-config-typescript/-/eslint-config-typescript-11.0.0.tgz",
+      "integrity": "sha512-txuRzxnQVmtUvvy9UyWUy9sHWXNeRPGmSPqP53hRtaiUeCTAondI9Ho9GQYI/8/eWljYOST7iA4Aa8sANBkWaA==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/eslint-plugin": "^5.0.0",
+        "@typescript-eslint/parser": "^5.0.0",
+        "vue-eslint-parser": "^9.0.0"
+      },
+      "engines": {
+        "node": "^14.17.0 || >=16.0.0"
+      },
+      "peerDependencies": {
+        "eslint": "^6.2.0 || ^7.0.0 || ^8.0.0",
+        "eslint-plugin-vue": "^9.0.0",
+        "typescript": "*"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vue/reactivity": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.2.37.tgz",
+      "integrity": "sha512-/7WRafBOshOc6m3F7plwzPeCu/RCVv9uMpOwa/5PiY1Zz+WLVRWiy0MYKwmg19KBdGtFWsmZ4cD+LOdVPcs52A==",
+      "dependencies": {
+        "@vue/shared": "3.2.37"
+      }
+    },
+    "node_modules/@vue/reactivity-transform": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/reactivity-transform/-/reactivity-transform-3.2.37.tgz",
+      "integrity": "sha512-IWopkKEb+8qpu/1eMKVeXrK0NLw9HicGviJzhJDEyfxTR9e1WtpnnbYkJWurX6WwoFP0sz10xQg8yL8lgskAZg==",
+      "dependencies": {
+        "@babel/parser": "^7.16.4",
+        "@vue/compiler-core": "3.2.37",
+        "@vue/shared": "3.2.37",
+        "estree-walker": "^2.0.2",
+        "magic-string": "^0.25.7"
+      }
+    },
+    "node_modules/@vue/runtime-core": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.2.37.tgz",
+      "integrity": "sha512-JPcd9kFyEdXLl/i0ClS7lwgcs0QpUAWj+SKX2ZC3ANKi1U4DOtiEr6cRqFXsPwY5u1L9fAjkinIdB8Rz3FoYNQ==",
+      "dependencies": {
+        "@vue/reactivity": "3.2.37",
+        "@vue/shared": "3.2.37"
+      }
+    },
+    "node_modules/@vue/runtime-dom": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.2.37.tgz",
+      "integrity": "sha512-HimKdh9BepShW6YozwRKAYjYQWg9mQn63RGEiSswMbW+ssIht1MILYlVGkAGGQbkhSh31PCdoUcfiu4apXJoPw==",
+      "dependencies": {
+        "@vue/runtime-core": "3.2.37",
+        "@vue/shared": "3.2.37",
+        "csstype": "^2.6.8"
+      }
+    },
+    "node_modules/@vue/server-renderer": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.2.37.tgz",
+      "integrity": "sha512-kLITEJvaYgZQ2h47hIzPh2K3jG8c1zCVbp/o/bzQOyvzaKiCquKS7AaioPI28GNxIsE/zSx+EwWYsNxDCX95MA==",
+      "dependencies": {
+        "@vue/compiler-ssr": "3.2.37",
+        "@vue/shared": "3.2.37"
+      },
+      "peerDependencies": {
+        "vue": "3.2.37"
+      }
+    },
+    "node_modules/@vue/shared": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.2.37.tgz",
+      "integrity": "sha512-4rSJemR2NQIo9Klm1vabqWjD8rs/ZaJSzMxkMNeJS6lHiUjjUeYFbooN19NgFjztubEKh3WlZUeOLVdbbUWHsw=="
+    },
+    "node_modules/@vue/test-utils": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@vue/test-utils/-/test-utils-2.0.0.tgz",
+      "integrity": "sha512-zL5kygNq7hONrO1CzaUGprEAklAX+pH8J1MPMCU3Rd2xtSYkZ+PmKU3oEDRg8VAGdL5lNJHzDgrud5amFPtirw==",
+      "dev": true,
+      "peerDependencies": {
+        "vue": "^3.0.1"
+      }
+    },
+    "node_modules/@vue/vue-loader-v15": {
+      "name": "vue-loader",
+      "version": "15.9.8",
+      "resolved": "https://registry.npmjs.org/vue-loader/-/vue-loader-15.9.8.tgz",
+      "integrity": "sha512-GwSkxPrihfLR69/dSV3+5CdMQ0D+jXg8Ma1S4nQXKJAznYFX14vHdc/NetQc34Dw+rBbIJyP7JOuVb9Fhprvog==",
+      "dev": true,
+      "dependencies": {
+        "@vue/component-compiler-utils": "^3.1.0",
+        "hash-sum": "^1.0.2",
+        "loader-utils": "^1.1.0",
+        "vue-hot-reload-api": "^2.3.0",
+        "vue-style-loader": "^4.1.0"
+      },
+      "peerDependencies": {
+        "css-loader": "*",
+        "webpack": "^3.0.0 || ^4.1.0 || ^5.0.0-0"
+      },
+      "peerDependenciesMeta": {
+        "cache-loader": {
+          "optional": true
+        },
+        "vue-template-compiler": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vue/vue-loader-v15/node_modules/hash-sum": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/hash-sum/-/hash-sum-1.0.2.tgz",
+      "integrity": "sha512-fUs4B4L+mlt8/XAtSOGMUO1TXmAelItBPtJG7CyHJfYTdDjwisntGO2JQz7oUsatOY9o68+57eziUVNw/mRHmA==",
+      "dev": true
+    },
+    "node_modules/@vue/vue3-jest": {
+      "version": "27.0.0",
+      "resolved": "https://registry.npmjs.org/@vue/vue3-jest/-/vue3-jest-27.0.0.tgz",
+      "integrity": "sha512-VL61CgZBoQqayXfzlZJHHpZuX4lsT8dmdZMJzADhdAJjKu26JBpypHr/2ppevxItljPiuALQW4MKhhCXZRXnLg==",
+      "dev": true,
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "@babel/plugin-transform-modules-commonjs": "^7.2.0",
+        "chalk": "^2.1.0",
+        "convert-source-map": "^1.6.0",
+        "css-tree": "^2.0.1",
+        "source-map": "0.5.6",
+        "tsconfig": "^7.0.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "7.x",
+        "babel-jest": "27.x",
+        "jest": "27.x",
+        "ts-jest": "27.x",
+        "typescript": ">= 3.x",
+        "vue": "^3.0.0-0"
+      },
+      "peerDependenciesMeta": {
+        "ts-jest": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vue/vue3-jest/node_modules/css-tree": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-2.1.0.tgz",
+      "integrity": "sha512-PcysZRzToBbrpoUrZ9qfblRIRf8zbEAkU0AIpQFtgkFK0vSbzOmBCvdSAx2Zg7Xx5wiYJKUKk0NMP7kxevie/A==",
+      "dev": true,
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "mdn-data": "2.0.27",
+        "source-map-js": "^1.0.1"
+      },
+      "engines": {
+        "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0",
+        "npm": ">=7.0.0"
+      }
+    },
+    "node_modules/@vue/vue3-jest/node_modules/mdn-data": {
+      "version": "2.0.27",
+      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.0.27.tgz",
+      "integrity": "sha512-kwqO0I0jtWr25KcfLm9pia8vLZ8qoAKhWZuZMbneJq3jjBD3gl5nZs8l8Tu3ZBlBAHVQtDur9rdDGyvtfVraHQ==",
+      "dev": true,
+      "optional": true,
+      "peer": true
+    },
+    "node_modules/@vue/vue3-jest/node_modules/source-map": {
+      "version": "0.5.6",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.6.tgz",
+      "integrity": "sha512-MjZkVp0NHr5+TPihLcadqnlVoGIoWo4IBHptutGh9wI3ttUYvCG26HkSuDi+K6lsZ25syXJXcctwgyVCt//xqA==",
+      "dev": true,
+      "optional": true,
+      "peer": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/@vue/web-component-wrapper": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@vue/web-component-wrapper/-/web-component-wrapper-1.3.0.tgz",
+      "integrity": "sha512-Iu8Tbg3f+emIIMmI2ycSI8QcEuAUgPTgHwesDU1eKMLE4YC/c/sFbGc70QgMq31ijRftV0R7vCm9co6rldCeOA==",
+      "dev": true
+    },
+    "node_modules/@webassemblyjs/ast": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/ast/-/ast-1.11.6.tgz",
+      "integrity": "sha512-IN1xI7PwOvLPgjcf180gC1bqn3q/QaOCwYUahIOhbYUu8KA/3tw2RT/T0Gidi1l7Hhj5D/INhJxiICObqpMu4Q==",
+      "dev": true,
+      "dependencies": {
+        "@webassemblyjs/helper-numbers": "1.11.6",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6"
+      }
+    },
+    "node_modules/@webassemblyjs/floating-point-hex-parser": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.11.6.tgz",
+      "integrity": "sha512-ejAj9hfRJ2XMsNHk/v6Fu2dGS+i4UaXBXGemOfQ/JfQ6mdQg/WXtwleQRLLS4OvfDhv8rYnVwH27YJLMyYsxhw==",
+      "dev": true
+    },
+    "node_modules/@webassemblyjs/helper-api-error": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-api-error/-/helper-api-error-1.11.6.tgz",
+      "integrity": "sha512-o0YkoP4pVu4rN8aTJgAyj9hC2Sv5UlkzCHhxqWj8butaLvnpdc2jOwh4ewE6CX0txSfLn/UYaV/pheS2Txg//Q==",
+      "dev": true
+    },
+    "node_modules/@webassemblyjs/helper-buffer": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-buffer/-/helper-buffer-1.11.6.tgz",
+      "integrity": "sha512-z3nFzdcp1mb8nEOFFk8DrYLpHvhKC3grJD2ardfKOzmbmJvEf/tPIqCY+sNcwZIY8ZD7IkB2l7/pqhUhqm7hLA==",
+      "dev": true
+    },
+    "node_modules/@webassemblyjs/helper-numbers": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-numbers/-/helper-numbers-1.11.6.tgz",
+      "integrity": "sha512-vUIhZ8LZoIWHBohiEObxVm6hwP034jwmc9kuq5GdHZH0wiLVLIPcMCdpJzG4C11cHoQ25TFIQj9kaVADVX7N3g==",
+      "dev": true,
+      "dependencies": {
+        "@webassemblyjs/floating-point-hex-parser": "1.11.6",
+        "@webassemblyjs/helper-api-error": "1.11.6",
+        "@xtuc/long": "4.2.2"
+      }
+    },
+    "node_modules/@webassemblyjs/helper-wasm-bytecode": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.11.6.tgz",
+      "integrity": "sha512-sFFHKwcmBprO9e7Icf0+gddyWYDViL8bpPjJJl0WHxCdETktXdmtWLGVzoHbqUcY4Be1LkNfwTmXOJUFZYSJdA==",
+      "dev": true
+    },
+    "node_modules/@webassemblyjs/helper-wasm-section": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.11.6.tgz",
+      "integrity": "sha512-LPpZbSOwTpEC2cgn4hTydySy1Ke+XEu+ETXuoyvuyezHO3Kjdu90KK95Sh9xTbmjrCsUwvWwCOQQNta37VrS9g==",
+      "dev": true,
+      "dependencies": {
+        "@webassemblyjs/ast": "1.11.6",
+        "@webassemblyjs/helper-buffer": "1.11.6",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/wasm-gen": "1.11.6"
+      }
+    },
+    "node_modules/@webassemblyjs/ieee754": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/ieee754/-/ieee754-1.11.6.tgz",
+      "integrity": "sha512-LM4p2csPNvbij6U1f19v6WR56QZ8JcHg3QIJTlSwzFcmx6WSORicYj6I63f9yU1kEUtrpG+kjkiIAkevHpDXrg==",
+      "dev": true,
+      "dependencies": {
+        "@xtuc/ieee754": "^1.2.0"
+      }
+    },
+    "node_modules/@webassemblyjs/leb128": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/leb128/-/leb128-1.11.6.tgz",
+      "integrity": "sha512-m7a0FhE67DQXgouf1tbN5XQcdWoNgaAuoULHIfGFIEVKA6tu/edls6XnIlkmS6FrXAquJRPni3ZZKjw6FSPjPQ==",
+      "dev": true,
+      "dependencies": {
+        "@xtuc/long": "4.2.2"
+      }
+    },
+    "node_modules/@webassemblyjs/utf8": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/utf8/-/utf8-1.11.6.tgz",
+      "integrity": "sha512-vtXf2wTQ3+up9Zsg8sa2yWiQpzSsMyXj0qViVP6xKGCUT8p8YJ6HqI7l5eCnWx1T/FYdsv07HQs2wTFbbof/RA==",
+      "dev": true
+    },
+    "node_modules/@webassemblyjs/wasm-edit": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-edit/-/wasm-edit-1.11.6.tgz",
+      "integrity": "sha512-Ybn2I6fnfIGuCR+Faaz7YcvtBKxvoLV3Lebn1tM4o/IAJzmi9AWYIPWpyBfU8cC+JxAO57bk4+zdsTjJR+VTOw==",
+      "dev": true,
+      "dependencies": {
+        "@webassemblyjs/ast": "1.11.6",
+        "@webassemblyjs/helper-buffer": "1.11.6",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/helper-wasm-section": "1.11.6",
+        "@webassemblyjs/wasm-gen": "1.11.6",
+        "@webassemblyjs/wasm-opt": "1.11.6",
+        "@webassemblyjs/wasm-parser": "1.11.6",
+        "@webassemblyjs/wast-printer": "1.11.6"
+      }
+    },
+    "node_modules/@webassemblyjs/wasm-gen": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-gen/-/wasm-gen-1.11.6.tgz",
+      "integrity": "sha512-3XOqkZP/y6B4F0PBAXvI1/bky7GryoogUtfwExeP/v7Nzwo1QLcq5oQmpKlftZLbT+ERUOAZVQjuNVak6UXjPA==",
+      "dev": true,
+      "dependencies": {
+        "@webassemblyjs/ast": "1.11.6",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/ieee754": "1.11.6",
+        "@webassemblyjs/leb128": "1.11.6",
+        "@webassemblyjs/utf8": "1.11.6"
+      }
+    },
+    "node_modules/@webassemblyjs/wasm-opt": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-opt/-/wasm-opt-1.11.6.tgz",
+      "integrity": "sha512-cOrKuLRE7PCe6AsOVl7WasYf3wbSo4CeOk6PkrjS7g57MFfVUF9u6ysQBBODX0LdgSvQqRiGz3CXvIDKcPNy4g==",
+      "dev": true,
+      "dependencies": {
+        "@webassemblyjs/ast": "1.11.6",
+        "@webassemblyjs/helper-buffer": "1.11.6",
+        "@webassemblyjs/wasm-gen": "1.11.6",
+        "@webassemblyjs/wasm-parser": "1.11.6"
+      }
+    },
+    "node_modules/@webassemblyjs/wasm-parser": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-parser/-/wasm-parser-1.11.6.tgz",
+      "integrity": "sha512-6ZwPeGzMJM3Dqp3hCsLgESxBGtT/OeCvCZ4TA1JUPYgmhAx38tTPR9JaKy0S5H3evQpO/h2uWs2j6Yc/fjkpTQ==",
+      "dev": true,
+      "dependencies": {
+        "@webassemblyjs/ast": "1.11.6",
+        "@webassemblyjs/helper-api-error": "1.11.6",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/ieee754": "1.11.6",
+        "@webassemblyjs/leb128": "1.11.6",
+        "@webassemblyjs/utf8": "1.11.6"
+      }
+    },
+    "node_modules/@webassemblyjs/wast-printer": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wast-printer/-/wast-printer-1.11.6.tgz",
+      "integrity": "sha512-JM7AhRcE+yW2GWYaKeHL5vt4xqee5N2WcezptmgyhNS+ScggqcT1OtXykhAb13Sn5Yas0j2uv9tHgrjwvzAP4A==",
+      "dev": true,
+      "dependencies": {
+        "@webassemblyjs/ast": "1.11.6",
+        "@xtuc/long": "4.2.2"
+      }
+    },
+    "node_modules/@xtuc/ieee754": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@xtuc/ieee754/-/ieee754-1.2.0.tgz",
+      "integrity": "sha512-DX8nKgqcGwsc0eJSqYt5lwP4DH5FlHnmuWWBRy7X0NcaGR0ZtuyeESgMwTYVEtxmsNGY+qit4QYT/MIYTOTPeA==",
+      "dev": true
+    },
+    "node_modules/@xtuc/long": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/@xtuc/long/-/long-4.2.2.tgz",
+      "integrity": "sha512-NuHqBY1PB/D8xU6s/thBgOAiAP7HOYDQ32+BFZILJ8ivkUkAHQnWfn6WhL79Owj1qmUnoN/YPhktdIoucipkAQ==",
+      "dev": true
+    },
+    "node_modules/abab": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/abab/-/abab-2.0.6.tgz",
+      "integrity": "sha512-j2afSsaIENvHZN2B8GOpF566vZ5WVk5opAiMTvWgaQT8DkbOqsTfvNAvHoRGU2zzP8cPoqys+xHTRDWW8L+/BA==",
+      "dev": true
+    },
+    "node_modules/abbrev": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz",
+      "integrity": "sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q==",
+      "dev": true
+    },
+    "node_modules/abortcontroller-polyfill": {
+      "version": "1.7.3",
+      "resolved": "https://registry.npmjs.org/abortcontroller-polyfill/-/abortcontroller-polyfill-1.7.3.tgz",
+      "integrity": "sha512-zetDJxd89y3X99Kvo4qFx8GKlt6GsvN3UcRZHwU6iFA/0KiOmhkTVhe8oRoTBiTVPZu09x3vCra47+w8Yz1+2Q=="
+    },
+    "node_modules/accepts": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
+      "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
+      "dev": true,
+      "dependencies": {
+        "mime-types": "~2.1.34",
+        "negotiator": "0.6.3"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/acorn": {
+      "version": "8.7.1",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.7.1.tgz",
+      "integrity": "sha512-Xx54uLJQZ19lKygFXOWsscKUbsBZW0CPykPhVQdhIeIwrbPmJzqeASDInc8nKBnp/JT6igTs82qPXz069H8I/A==",
+      "dev": true,
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/acorn-globals": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/acorn-globals/-/acorn-globals-6.0.0.tgz",
+      "integrity": "sha512-ZQl7LOWaF5ePqqcX4hLuv/bLXYQNfNWw2c0/yX/TsPRKamzHcTGQnlCjHT3TsmkOUVEPS3crCxiPfdzE/Trlhg==",
+      "dev": true,
+      "dependencies": {
+        "acorn": "^7.1.1",
+        "acorn-walk": "^7.1.1"
+      }
+    },
+    "node_modules/acorn-globals/node_modules/acorn": {
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
+      "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
+      "dev": true,
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/acorn-globals/node_modules/acorn-walk": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-7.2.0.tgz",
+      "integrity": "sha512-OPdCF6GsMIP+Az+aWfAAOEt2/+iVDKE7oy6lJ098aoe59oAmK76qV6Gw60SbZ8jHuG2wH058GF4pLFbYamYrVA==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/acorn-import-assertions": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/acorn-import-assertions/-/acorn-import-assertions-1.8.0.tgz",
+      "integrity": "sha512-m7VZ3jwz4eK6A4Vtt8Ew1/mNbP24u0FhdyfA7fSvnJR6LMdfOYnmuIrrJAgrYfYJ10F/otaHTtrtrtmHdMNzEw==",
+      "dev": true,
+      "peerDependencies": {
+        "acorn": "^8"
+      }
+    },
+    "node_modules/acorn-jsx": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
+      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
+      "dev": true,
+      "peerDependencies": {
+        "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      }
+    },
+    "node_modules/acorn-node": {
+      "version": "1.8.2",
+      "resolved": "https://registry.npmjs.org/acorn-node/-/acorn-node-1.8.2.tgz",
+      "integrity": "sha512-8mt+fslDufLYntIoPAaIMUe/lrbrehIiwmR3t2k9LljIzoigEPF27eLk2hy8zSGzmR/ogr7zbRKINMo1u0yh5A==",
+      "dev": true,
+      "dependencies": {
+        "acorn": "^7.0.0",
+        "acorn-walk": "^7.0.0",
+        "xtend": "^4.0.2"
+      }
+    },
+    "node_modules/acorn-node/node_modules/acorn": {
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
+      "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
+      "dev": true,
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/acorn-node/node_modules/acorn-walk": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-7.2.0.tgz",
+      "integrity": "sha512-OPdCF6GsMIP+Az+aWfAAOEt2/+iVDKE7oy6lJ098aoe59oAmK76qV6Gw60SbZ8jHuG2wH058GF4pLFbYamYrVA==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/acorn-walk": {
+      "version": "8.2.0",
+      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.2.0.tgz",
+      "integrity": "sha512-k+iyHEuPgSw6SbuDpGQM+06HQUa04DZ3o+F6CSzXMvvI5KMvnaEqXe+YVe555R9nn6GPt404fos4wcgpw12SDA==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/address": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/address/-/address-1.2.0.tgz",
+      "integrity": "sha512-tNEZYz5G/zYunxFm7sfhAxkXEuLj3K6BKwv6ZURlsF6yiUQ65z0Q2wZW9L5cPUl9ocofGvXOdFYbFHp0+6MOig==",
+      "dev": true,
+      "engines": {
+        "node": ">= 10.0.0"
+      }
+    },
+    "node_modules/agent-base": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "dev": true,
+      "dependencies": {
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/ajv": {
+      "version": "6.12.6",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
+      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "fast-json-stable-stringify": "^2.0.0",
+        "json-schema-traverse": "^0.4.1",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ajv-formats": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-2.1.1.tgz",
+      "integrity": "sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA==",
+      "dev": true,
+      "dependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/ajv-formats/node_modules/ajv": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.11.0.tgz",
+      "integrity": "sha512-wGgprdCvMalC0BztXvitD2hC04YffAvtsUn93JbGXYLAtCUO4xd17mCCZQxUOItiBwZvJScWo8NIvQMQ71rdpg==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ajv-formats/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true
+    },
+    "node_modules/ajv-keywords": {
+      "version": "3.5.2",
+      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-3.5.2.tgz",
+      "integrity": "sha512-5p6WTN0DdTGVQk6VjcEju19IgaHudalcfabD7yhDGeA6bcQnmL+CpveLJq/3hvfwd1aof6L386Ougkx6RfyMIQ==",
+      "dev": true,
+      "peerDependencies": {
+        "ajv": "^6.9.1"
+      }
+    },
+    "node_modules/ansi-colors": {
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/ansi-colors/-/ansi-colors-4.1.3.tgz",
+      "integrity": "sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/ansi-escapes": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-3.2.0.tgz",
+      "integrity": "sha512-cBhpre4ma+U0T1oM5fXg7Dy1Jw7zzwv7lt/GoCpr+hDQJoYnKVPLL4dCvSEFMmQurOQvSrwT7SL/DAlhBI97RQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/ansi-html-community": {
+      "version": "0.0.8",
+      "resolved": "https://registry.npmjs.org/ansi-html-community/-/ansi-html-community-0.0.8.tgz",
+      "integrity": "sha512-1APHAyr3+PCamwNw3bXCPp4HFLONZt/yIH0sZp0/469KWNTEy+qN5jQ3GVX6DMZ1UXAi34yVwtTeaG/HpBuuzw==",
+      "dev": true,
+      "engines": [
+        "node >= 0.8.0"
+      ],
+      "bin": {
+        "ansi-html": "bin/ansi-html"
+      }
+    },
+    "node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/ansi-styles": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
+      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^1.9.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/any-promise": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/any-promise/-/any-promise-1.3.0.tgz",
+      "integrity": "sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==",
+      "dev": true
+    },
+    "node_modules/anymatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.2.tgz",
+      "integrity": "sha512-P43ePfOAIupkguHUycrc4qJ9kz8ZiuOUijaETwX7THt0Y/GNK7v0aa8rY816xWjZ7rJdA5XdMcpVFTKMq+RvWg==",
+      "dev": true,
+      "dependencies": {
+        "normalize-path": "^3.0.0",
+        "picomatch": "^2.0.4"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/apexcharts": {
+      "version": "3.35.3",
+      "resolved": "https://registry.npmjs.org/apexcharts/-/apexcharts-3.35.3.tgz",
+      "integrity": "sha512-UDlxslJr3DG63I/SgoiivIu4lpP25GMaKFK8NvCHmTksTQshx4ng3oPPrYvdsBFOvD/ajPYIh/p7rNB0jq8vXg==",
+      "dependencies": {
+        "svg.draggable.js": "^2.2.2",
+        "svg.easing.js": "^2.0.0",
+        "svg.filter.js": "^2.0.2",
+        "svg.pathmorphing.js": "^0.1.3",
+        "svg.resize.js": "^1.4.3",
+        "svg.select.js": "^3.0.1"
+      }
+    },
+    "node_modules/arch": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/arch/-/arch-2.2.0.tgz",
+      "integrity": "sha512-Of/R0wqp83cgHozfIYLbBMnej79U/SVGOOyuB3VVFv1NRM/PSFMK12x9KVtiYzJqmnU5WR2qp0Z5rHb7sWGnFQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
+    "node_modules/arg": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/arg/-/arg-5.0.2.tgz",
+      "integrity": "sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==",
+      "dev": true
+    },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="
+    },
+    "node_modules/array-flatten": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-2.1.2.tgz",
+      "integrity": "sha512-hNfzcOV8W4NdualtqBFPyVO+54DSJuZGY9qT4pRroB6S9e3iiido2ISIC5h9R2sPJ8H3FHCIiEnsv1lPXO3KtQ==",
+      "dev": true
+    },
+    "node_modules/array-union": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/array-union/-/array-union-2.1.0.tgz",
+      "integrity": "sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/asn1.js": {
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/asn1.js/-/asn1.js-5.4.1.tgz",
+      "integrity": "sha512-+I//4cYPccV8LdmBLiX8CYvf9Sp3vQsrqu2QNXRcrbiWvcx/UdlFiqUJJzxRQxgsZmvhXhn4cSKeSmoFjVdupA==",
+      "dev": true,
+      "dependencies": {
+        "bn.js": "^4.0.0",
+        "inherits": "^2.0.1",
+        "minimalistic-assert": "^1.0.0",
+        "safer-buffer": "^2.1.0"
+      }
+    },
+    "node_modules/astral-regex": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/astral-regex/-/astral-regex-2.0.0.tgz",
+      "integrity": "sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/async": {
+      "version": "2.6.4",
+      "resolved": "https://registry.npmjs.org/async/-/async-2.6.4.tgz",
+      "integrity": "sha512-mzo5dfJYwAn29PeiJ0zvwTo04zj8HDJj0Mn8TD7sno7q12prdbnasKJHhkm2c1LgrhlJ0teaea8860oxi51mGA==",
+      "dev": true,
+      "dependencies": {
+        "lodash": "^4.17.14"
+      }
+    },
+    "node_modules/asynckit": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
+      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
+      "dev": true
+    },
+    "node_modules/at-least-node": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz",
+      "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 4.0.0"
+      }
+    },
+    "node_modules/autoprefixer": {
+      "version": "10.4.7",
+      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.7.tgz",
+      "integrity": "sha512-ypHju4Y2Oav95SipEcCcI5J7CGPuvz8oat7sUtYj3ClK44bldfvtvcxK6IEK++7rqB7YchDGzweZIBG+SD0ZAA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/autoprefixer"
+        }
+      ],
+      "dependencies": {
+        "browserslist": "^4.20.3",
+        "caniuse-lite": "^1.0.30001335",
+        "fraction.js": "^4.2.0",
+        "normalize-range": "^0.1.2",
+        "picocolors": "^1.0.0",
+        "postcss-value-parser": "^4.2.0"
+      },
+      "bin": {
+        "autoprefixer": "bin/autoprefixer"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      },
+      "peerDependencies": {
+        "postcss": "^8.1.0"
+      }
+    },
+    "node_modules/babel-eslint": {
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/babel-eslint/-/babel-eslint-10.1.0.tgz",
+      "integrity": "sha512-ifWaTHQ0ce+448CYop8AdrQiBsGrnC+bMgfyKFdi6EsPLTAWG+QfyDeM6OH+FmWnKvEq5NnBMLvlBUPKQZoDSg==",
+      "deprecated": "babel-eslint is now @babel/eslint-parser. This package will no longer receive updates.",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.0.0",
+        "@babel/parser": "^7.7.0",
+        "@babel/traverse": "^7.7.0",
+        "@babel/types": "^7.7.0",
+        "eslint-visitor-keys": "^1.0.0",
+        "resolve": "^1.12.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "peerDependencies": {
+        "eslint": ">= 4.12.1"
+      }
+    },
+    "node_modules/babel-eslint/node_modules/eslint-visitor-keys": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-1.3.0.tgz",
+      "integrity": "sha512-6J72N8UNa462wa/KFODt/PJ3IU60SDpC3QXC1Hjc1BXXpfL2C9R5+AU7jhe0F6GREqVMh4Juu+NY7xn+6dipUQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/babel-jest": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-27.5.1.tgz",
+      "integrity": "sha512-cdQ5dXjGRd0IBRATiQ4mZGlGlRE8kJpjPOixdNRdT+m3UcNqmYWN6rK6nvtXYfY3D76cb8s/O1Ss8ea24PIwcg==",
+      "dev": true,
+      "dependencies": {
+        "@jest/transform": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/babel__core": "^7.1.14",
+        "babel-plugin-istanbul": "^6.1.1",
+        "babel-preset-jest": "^27.5.1",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.8.0"
+      }
+    },
+    "node_modules/babel-jest/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/babel-jest/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/babel-jest/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/babel-jest/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/babel-jest/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/babel-jest/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/babel-loader": {
+      "version": "8.2.5",
+      "resolved": "https://registry.npmjs.org/babel-loader/-/babel-loader-8.2.5.tgz",
+      "integrity": "sha512-OSiFfH89LrEMiWd4pLNqGz4CwJDtbs2ZVc+iGu2HrkRfPxId9F2anQj38IxWpmRfsUY0aBZYi1EFcd3mhtRMLQ==",
+      "dev": true,
+      "dependencies": {
+        "find-cache-dir": "^3.3.1",
+        "loader-utils": "^2.0.0",
+        "make-dir": "^3.1.0",
+        "schema-utils": "^2.6.5"
+      },
+      "engines": {
+        "node": ">= 8.9"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0",
+        "webpack": ">=2"
+      }
+    },
+    "node_modules/babel-loader/node_modules/loader-utils": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.4.tgz",
+      "integrity": "sha512-xXqpXoINfFhgua9xiqD8fPFHgkoq1mmmpE92WlDbm9rNRd/EbRb+Gqf908T2DMfuHjjJlksiK2RbHVOdD/MqSw==",
+      "dev": true,
+      "dependencies": {
+        "big.js": "^5.2.2",
+        "emojis-list": "^3.0.0",
+        "json5": "^2.1.2"
+      },
+      "engines": {
+        "node": ">=8.9.0"
+      }
+    },
+    "node_modules/babel-loader/node_modules/schema-utils": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-2.7.1.tgz",
+      "integrity": "sha512-SHiNtMOUGWBQJwzISiVYKu82GiV4QYGePp3odlY1tuKO7gPtphAT5R/py0fA6xtbgLL/RvtJZnU9b8s0F1q0Xg==",
+      "dev": true,
+      "dependencies": {
+        "@types/json-schema": "^7.0.5",
+        "ajv": "^6.12.4",
+        "ajv-keywords": "^3.5.2"
+      },
+      "engines": {
+        "node": ">= 8.9.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      }
+    },
+    "node_modules/babel-plugin-dynamic-import-node": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/babel-plugin-dynamic-import-node/-/babel-plugin-dynamic-import-node-2.3.3.tgz",
+      "integrity": "sha512-jZVI+s9Zg3IqA/kdi0i6UDCybUI3aSBLnglhYbSSjKlV7yF1F/5LWv8MakQmvYpnbJDS6fcBL2KzHSxNCMtWSQ==",
+      "dev": true,
+      "dependencies": {
+        "object.assign": "^4.1.0"
+      }
+    },
+    "node_modules/babel-plugin-istanbul": {
+      "version": "6.1.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-6.1.1.tgz",
+      "integrity": "sha512-Y1IQok9821cC9onCx5otgFfRm7Lm+I+wwxOx738M/WLPZ9Q42m4IG5W0FNX8WLL2gYMZo3JkuXIH2DOpWM+qwA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-plugin-utils": "^7.0.0",
+        "@istanbuljs/load-nyc-config": "^1.0.0",
+        "@istanbuljs/schema": "^0.1.2",
+        "istanbul-lib-instrument": "^5.0.4",
+        "test-exclude": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/babel-plugin-jest-hoist": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-27.5.1.tgz",
+      "integrity": "sha512-50wCwD5EMNW4aRpOwtqzyZHIewTYNxLA4nhB+09d8BIssfNfzBRhkBIHiaPv1Si226TQSvp8gxAJm2iY2qs2hQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/template": "^7.3.3",
+        "@babel/types": "^7.3.3",
+        "@types/babel__core": "^7.0.0",
+        "@types/babel__traverse": "^7.0.6"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/babel-plugin-polyfill-corejs2": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.3.1.tgz",
+      "integrity": "sha512-v7/T6EQcNfVLfcN2X8Lulb7DjprieyLWJK/zOWH5DUYcAgex9sP3h25Q+DLsX9TloXe3y1O8l2q2Jv9q8UVB9w==",
+      "dev": true,
+      "dependencies": {
+        "@babel/compat-data": "^7.13.11",
+        "@babel/helper-define-polyfill-provider": "^0.3.1",
+        "semver": "^6.1.1"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/babel-plugin-polyfill-corejs3": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.5.2.tgz",
+      "integrity": "sha512-G3uJih0XWiID451fpeFaYGVuxHEjzKTHtc9uGFEjR6hHrvNzeS/PX+LLLcetJcytsB5m4j+K3o/EpXJNb/5IEQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-define-polyfill-provider": "^0.3.1",
+        "core-js-compat": "^3.21.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/babel-plugin-polyfill-regenerator": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.3.1.tgz",
+      "integrity": "sha512-Y2B06tvgHYt1x0yz17jGkGeeMr5FeKUu+ASJ+N6nB5lQ8Dapfg42i0OVrf8PNGJ3zKL4A23snMi1IRwrqqND7A==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-define-polyfill-provider": "^0.3.1"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/babel-preset-current-node-syntax": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/babel-preset-current-node-syntax/-/babel-preset-current-node-syntax-1.0.1.tgz",
+      "integrity": "sha512-M7LQ0bxarkxQoN+vz5aJPsLBn77n8QgTFmo8WK0/44auK2xlCXrYcUxHFxgU7qW5Yzw/CjmLRK2uJzaCd7LvqQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/plugin-syntax-async-generators": "^7.8.4",
+        "@babel/plugin-syntax-bigint": "^7.8.3",
+        "@babel/plugin-syntax-class-properties": "^7.8.3",
+        "@babel/plugin-syntax-import-meta": "^7.8.3",
+        "@babel/plugin-syntax-json-strings": "^7.8.3",
+        "@babel/plugin-syntax-logical-assignment-operators": "^7.8.3",
+        "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3",
+        "@babel/plugin-syntax-numeric-separator": "^7.8.3",
+        "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+        "@babel/plugin-syntax-optional-catch-binding": "^7.8.3",
+        "@babel/plugin-syntax-optional-chaining": "^7.8.3",
+        "@babel/plugin-syntax-top-level-await": "^7.8.3"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/babel-preset-jest": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-27.5.1.tgz",
+      "integrity": "sha512-Nptf2FzlPCWYuJg41HBqXVT8ym6bXOevuCTbhxlUpjwtysGaIWFvDEjp4y+G7fl13FgOdjs7P/DmErqH7da0Ag==",
+      "dev": true,
+      "dependencies": {
+        "babel-plugin-jest-hoist": "^27.5.1",
+        "babel-preset-current-node-syntax": "^1.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true
+    },
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
+    "node_modules/batch": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/batch/-/batch-0.6.1.tgz",
+      "integrity": "sha512-x+VAiMRL6UPkx+kudNvxTl6hB2XNNCG2r+7wixVfIYwu/2HKRXimwQyaumLjMveWvT2Hkd/cAJw+QBMfJ/EKVw==",
+      "dev": true
+    },
+    "node_modules/big.js": {
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/big.js/-/big.js-5.2.2.tgz",
+      "integrity": "sha512-vyL2OymJxmarO8gxMr0mhChsO9QGwhynfuu4+MHTAW6czfq9humCB7rKpUjDd9YUiDPU4mzpyupFSvOClAwbmQ==",
+      "dev": true,
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/binary-extensions": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.2.0.tgz",
+      "integrity": "sha512-jDctJ/IVQbZoJykoeHbhXpOlNBqGNcwXJKJog42E5HDPUwQTSdjCHdihjj0DlnheQ7blbT6dHOafNAiS8ooQKA==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/bl": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
+      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+      "dev": true,
+      "dependencies": {
+        "buffer": "^5.5.0",
+        "inherits": "^2.0.4",
+        "readable-stream": "^3.4.0"
+      }
+    },
+    "node_modules/bl/node_modules/buffer": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
+      }
+    },
+    "node_modules/bluebird": {
+      "version": "3.7.2",
+      "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
+      "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==",
+      "dev": true
+    },
+    "node_modules/bn.js": {
+      "version": "4.12.0",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.0.tgz",
+      "integrity": "sha512-c98Bf3tPniI+scsdk237ku1Dc3ujXQTSgyiPUDEOe7tRkhrqridvh8klBv0HCEso1OLOYcHuCv/cS6DNxKH+ZA==",
+      "dev": true
+    },
+    "node_modules/body-parser": {
+      "version": "1.20.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.0.tgz",
+      "integrity": "sha512-DfJ+q6EPcGKZD1QWUjSpqp+Q7bDQTsQIF4zfUAtZ6qk+H/3/QRhg9CEp39ss+/T2vw0+HaidC0ecJj/DRLIaKg==",
+      "dev": true,
+      "dependencies": {
+        "bytes": "3.1.2",
+        "content-type": "~1.0.4",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "1.2.0",
+        "http-errors": "2.0.0",
+        "iconv-lite": "0.4.24",
+        "on-finished": "2.4.1",
+        "qs": "6.10.3",
+        "raw-body": "2.5.1",
+        "type-is": "~1.6.18",
+        "unpipe": "1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
+    "node_modules/body-parser/node_modules/bytes": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/body-parser/node_modules/debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "dev": true,
+      "dependencies": {
+        "ms": "2.0.0"
+      }
+    },
+    "node_modules/body-parser/node_modules/ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "dev": true
+    },
+    "node_modules/bonjour-service": {
+      "version": "1.0.13",
+      "resolved": "https://registry.npmjs.org/bonjour-service/-/bonjour-service-1.0.13.tgz",
+      "integrity": "sha512-LWKRU/7EqDUC9CTAQtuZl5HzBALoCYwtLhffW3et7vZMwv3bWLpJf8bRYlMD5OCcDpTfnPgNCV4yo9ZIaJGMiA==",
+      "dev": true,
+      "dependencies": {
+        "array-flatten": "^2.1.2",
+        "dns-equal": "^1.0.0",
+        "fast-deep-equal": "^3.1.3",
+        "multicast-dns": "^7.2.5"
+      }
+    },
+    "node_modules/boolbase": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/boolbase/-/boolbase-1.0.0.tgz",
+      "integrity": "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==",
+      "dev": true
+    },
+    "node_modules/brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "dev": true,
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/braces": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
+      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
+      "dev": true,
+      "dependencies": {
+        "fill-range": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/browser-process-hrtime": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/browser-process-hrtime/-/browser-process-hrtime-1.0.0.tgz",
+      "integrity": "sha512-9o5UecI3GhkpM6DrXr69PblIuWxPKk9Y0jHBRhdocZ2y7YECBFCsHm79Pr3OyR2AvjhDkabFJaDJMYRazHgsow==",
+      "dev": true
+    },
+    "node_modules/browser-tabs-lock": {
+      "version": "1.2.15",
+      "resolved": "https://registry.npmjs.org/browser-tabs-lock/-/browser-tabs-lock-1.2.15.tgz",
+      "integrity": "sha512-J8K9vdivK0Di+b8SBdE7EZxDr88TnATing7XoLw6+nFkXMQ6sVBh92K3NQvZlZU91AIkFRi0w3sztk5Z+vsswA==",
+      "hasInstallScript": true,
+      "dependencies": {
+        "lodash": ">=4.17.21"
+      }
+    },
+    "node_modules/browserslist": {
+      "version": "4.21.10",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.21.10.tgz",
+      "integrity": "sha512-bipEBdZfVH5/pwrvqc+Ub0kUPVfGUhlKxbvfD+z1BDnPEO/X98ruXGA1WP5ASpAFKan7Qr6j736IacbZQuAlKQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "dependencies": {
+        "caniuse-lite": "^1.0.30001517",
+        "electron-to-chromium": "^1.4.477",
+        "node-releases": "^2.0.13",
+        "update-browserslist-db": "^1.0.11"
+      },
+      "bin": {
+        "browserslist": "cli.js"
+      },
+      "engines": {
+        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
+      }
+    },
+    "node_modules/bs-logger": {
+      "version": "0.2.6",
+      "resolved": "https://registry.npmjs.org/bs-logger/-/bs-logger-0.2.6.tgz",
+      "integrity": "sha512-pd8DCoxmbgc7hyPKOvxtqNcjYoOsABPQdcCUjGp3d42VR2CX1ORhk2A87oqqu5R1kk+76nsxZupkmyd+MVtCog==",
+      "dev": true,
+      "dependencies": {
+        "fast-json-stable-stringify": "2.x"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/bser": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/bser/-/bser-2.1.1.tgz",
+      "integrity": "sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==",
+      "dev": true,
+      "dependencies": {
+        "node-int64": "^0.4.0"
+      }
+    },
+    "node_modules/buffer": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
+      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.2.1"
+      }
+    },
+    "node_modules/buffer-from": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
+      "dev": true
+    },
+    "node_modules/builtin-modules": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/builtin-modules/-/builtin-modules-1.1.1.tgz",
+      "integrity": "sha512-wxXCdllwGhI2kCC0MnvTGYTMvnVZTvqgypkiTI8Pa5tcz2i6VqsqwYGgqwXji+4RgCzms6EajE4IxiUH6HH8nQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/bytes": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.0.0.tgz",
+      "integrity": "sha512-pMhOfFDPiv9t5jjIXkHosWmkSyQbvsgEVNkz0ERHbuLh2T/7j4Mqqpz523Fe8MVY89KC6Sh/QfS2sM+SjgFDcw==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/call-bind": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.2.tgz",
+      "integrity": "sha512-7O+FbCihrB5WGbFYesctwmTKae6rOiIzmz1icreWJ+0aA7LJfuqhEso2T9ncpcFtzMQtzXf2QGGueWJGTYsqrA==",
+      "dev": true,
+      "dependencies": {
+        "function-bind": "^1.1.1",
+        "get-intrinsic": "^1.0.2"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/callsites": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
+      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/camel-case": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/camel-case/-/camel-case-4.1.2.tgz",
+      "integrity": "sha512-gxGWBrTT1JuMx6R+o5PTXMmUnhnVzLQ9SNutD4YqKtI6ap897t3tKECYla6gCWEkplXnlNybEkZg9GEGxKFCgw==",
+      "dev": true,
+      "dependencies": {
+        "pascal-case": "^3.1.2",
+        "tslib": "^2.0.3"
+      }
+    },
+    "node_modules/camelcase": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
+      "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/camelcase-css": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/camelcase-css/-/camelcase-css-2.0.1.tgz",
+      "integrity": "sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==",
+      "dev": true,
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/caniuse-api": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/caniuse-api/-/caniuse-api-3.0.0.tgz",
+      "integrity": "sha512-bsTwuIg/BZZK/vreVTYYbSWoe2F+71P7K5QGEX+pT250DZbfU1MQ5prOKpPR+LL6uWKK3KMwMCAS74QB3Um1uw==",
+      "dev": true,
+      "dependencies": {
+        "browserslist": "^4.0.0",
+        "caniuse-lite": "^1.0.0",
+        "lodash.memoize": "^4.1.2",
+        "lodash.uniq": "^4.5.0"
+      }
+    },
+    "node_modules/caniuse-lite": {
+      "version": "1.0.30001519",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001519.tgz",
+      "integrity": "sha512-0QHgqR+Jv4bxHMp8kZ1Kn8CH55OikjKJ6JmKkZYP1F3D7w+lnFXF70nG5eNfsZS89jadi5Ywy5UCSKLAglIRkg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ]
+    },
+    "node_modules/case-sensitive-paths-webpack-plugin": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/case-sensitive-paths-webpack-plugin/-/case-sensitive-paths-webpack-plugin-2.4.0.tgz",
+      "integrity": "sha512-roIFONhcxog0JSSWbvVAh3OocukmSgpqOH6YpMkCvav/ySIV3JKg4Dc8vYtQjYi/UxpNE36r/9v+VqTQqgkYmw==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/chalk": {
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
+      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^3.2.1",
+        "escape-string-regexp": "^1.0.5",
+        "supports-color": "^5.3.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/char-regex": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/char-regex/-/char-regex-1.0.2.tgz",
+      "integrity": "sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/character-parser": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/character-parser/-/character-parser-2.2.0.tgz",
+      "integrity": "sha512-+UqJQjFEFaTAs3bNsF2j2kEN1baG/zghZbdqoYEDxGZtJo9LBzl1A+m0D4n3qKx8N2FNv8/Xp6yV9mQmBuptaw==",
+      "dev": true,
+      "dependencies": {
+        "is-regex": "^1.0.3"
+      }
+    },
+    "node_modules/chokidar": {
+      "version": "3.5.3",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.5.3.tgz",
+      "integrity": "sha512-Dr3sfKRP6oTcjf2JmUmFJfeVMvXBdegxB0iVQ5eb2V10uFJUCAS8OByZdVAyVb8xXNz3GjjTgj9kLWsZTqE6kw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://paulmillr.com/funding/"
+        }
+      ],
+      "dependencies": {
+        "anymatch": "~3.1.2",
+        "braces": "~3.0.2",
+        "glob-parent": "~5.1.2",
+        "is-binary-path": "~2.1.0",
+        "is-glob": "~4.0.1",
+        "normalize-path": "~3.0.0",
+        "readdirp": "~3.6.0"
+      },
+      "engines": {
+        "node": ">= 8.10.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.2"
+      }
+    },
+    "node_modules/chokidar/node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "dev": true,
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/chrome-trace-event": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/chrome-trace-event/-/chrome-trace-event-1.0.3.tgz",
+      "integrity": "sha512-p3KULyQg4S7NIHixdwbGX+nFHkoBiA4YQmyWtjb8XngSKV124nJmRysgAeujbUVb15vh+RvFUfCPqU7rXk+hZg==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.0"
+      }
+    },
+    "node_modules/ci-info": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-3.3.2.tgz",
+      "integrity": "sha512-xmDt/QIAdeZ9+nfdPsaBCpMvHNLFiLdjj59qjqn+6iPe6YmHGQ35sBnQ8uslRBXFmXkiZQOJRjvQeoGppoTjjg==",
+      "dev": true
+    },
+    "node_modules/cjs-module-lexer": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-1.2.2.tgz",
+      "integrity": "sha512-cOU9usZw8/dXIXKtwa8pM0OTJQuJkxMN6w30csNRUerHfeQ5R6U3kkU/FtJeIf3M202OHfY2U8ccInBG7/xogA==",
+      "dev": true
+    },
+    "node_modules/clean-css": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/clean-css/-/clean-css-5.3.0.tgz",
+      "integrity": "sha512-YYuuxv4H/iNb1Z/5IbMRoxgrzjWGhOEFfd+groZ5dMCVkpENiMZmwspdrzBo9286JjM1gZJPAyL7ZIdzuvu2AQ==",
+      "dev": true,
+      "dependencies": {
+        "source-map": "~0.6.0"
+      },
+      "engines": {
+        "node": ">= 10.0"
+      }
+    },
+    "node_modules/cli-cursor": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-3.1.0.tgz",
+      "integrity": "sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==",
+      "dev": true,
+      "dependencies": {
+        "restore-cursor": "^3.1.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cli-highlight": {
+      "version": "2.1.11",
+      "resolved": "https://registry.npmjs.org/cli-highlight/-/cli-highlight-2.1.11.tgz",
+      "integrity": "sha512-9KDcoEVwyUXrjcJNvHD0NFc/hiwe/WPVYIleQh2O1N2Zro5gWJZ/K+3DGn8w8P/F6FxOgzyC5bxDyHIgCSPhGg==",
+      "dev": true,
+      "dependencies": {
+        "chalk": "^4.0.0",
+        "highlight.js": "^10.7.1",
+        "mz": "^2.4.0",
+        "parse5": "^5.1.1",
+        "parse5-htmlparser2-tree-adapter": "^6.0.0",
+        "yargs": "^16.0.0"
+      },
+      "bin": {
+        "highlight": "bin/highlight"
+      },
+      "engines": {
+        "node": ">=8.0.0",
+        "npm": ">=5.0.0"
+      }
+    },
+    "node_modules/cli-highlight/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/cli-highlight/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/cli-highlight/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/cli-highlight/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/cli-highlight/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cli-highlight/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cli-spinners": {
+      "version": "2.6.1",
+      "resolved": "https://registry.npmjs.org/cli-spinners/-/cli-spinners-2.6.1.tgz",
+      "integrity": "sha512-x/5fWmGMnbKQAaNwN+UZlV79qBLM9JFnJuJ03gIi5whrob0xV0ofNVHy9DhwGdsMJQc2OKv0oGmLzvaqvAVv+g==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/click-outside-vue3": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/click-outside-vue3/-/click-outside-vue3-4.0.1.tgz",
+      "integrity": "sha512-sbplNecrup5oGqA3o4bo8XmvHRT6q9fvw21Z67aDbTqB9M6LF7CuYLTlLvNtOgKU6W3zst5H5zJuEh4auqA34g==",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/clipboard": {
+      "version": "2.0.11",
+      "resolved": "https://registry.npmjs.org/clipboard/-/clipboard-2.0.11.tgz",
+      "integrity": "sha512-C+0bbOqkezLIsmWSvlsXS0Q0bmkugu7jcfMIACB+RDEntIzQIkdr148we28AfSloQLRdZlYL/QYyrq05j/3Faw==",
+      "dependencies": {
+        "good-listener": "^1.2.2",
+        "select": "^1.1.2",
+        "tiny-emitter": "^2.0.0"
+      }
+    },
+    "node_modules/clipboardy": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/clipboardy/-/clipboardy-2.3.0.tgz",
+      "integrity": "sha512-mKhiIL2DrQIsuXMgBgnfEHOZOryC7kY7YO//TN6c63wlEm3NG5tz+YgY5rVi29KCmq/QQjKYvM7a19+MDOTHOQ==",
+      "dev": true,
+      "dependencies": {
+        "arch": "^2.1.1",
+        "execa": "^1.0.0",
+        "is-wsl": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cliui": {
+      "version": "7.0.4",
+      "resolved": "https://registry.npmjs.org/cliui/-/cliui-7.0.4.tgz",
+      "integrity": "sha512-OcRE68cOsVMXp1Yvonl/fzkQOyjLSu/8bhPDfQt0e0/Eb283TKP20Fs2MqoPsr9SwA595rRCA+QMzYc9nBP+JQ==",
+      "dev": true,
+      "dependencies": {
+        "string-width": "^4.2.0",
+        "strip-ansi": "^6.0.0",
+        "wrap-ansi": "^7.0.0"
+      }
+    },
+    "node_modules/clone": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/clone/-/clone-1.0.4.tgz",
+      "integrity": "sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.8"
+      }
+    },
+    "node_modules/clone-deep": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/clone-deep/-/clone-deep-4.0.1.tgz",
+      "integrity": "sha512-neHB9xuzh/wk0dIHweyAXv2aPGZIVk3pLMe+/RNzINf17fe0OG96QroktYAUm7SM1PBnzTabaLboqqxDyMU+SQ==",
+      "dev": true,
+      "dependencies": {
+        "is-plain-object": "^2.0.4",
+        "kind-of": "^6.0.2",
+        "shallow-clone": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/co": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/co/-/co-4.6.0.tgz",
+      "integrity": "sha512-QVb0dM5HvG+uaxitm8wONl7jltx8dqhfU33DcqtOZcLSVIKSDDLDi7+0LbAKiyI8hD9u42m2YxXSkMGWThaecQ==",
+      "dev": true,
+      "engines": {
+        "iojs": ">= 1.0.0",
+        "node": ">= 0.12.0"
+      }
+    },
+    "node_modules/collect-v8-coverage": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/collect-v8-coverage/-/collect-v8-coverage-1.0.1.tgz",
+      "integrity": "sha512-iBPtljfCNcTKNAto0KEtDfZ3qzjJvqE3aTGZsbhjSBlorqpXJlaWWtPO35D+ZImoC3KWejX64o+yPGxhWSTzfg==",
+      "dev": true
+    },
+    "node_modules/color-convert": {
+      "version": "1.9.3",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
+      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "1.1.3"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
+      "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
+      "dev": true
+    },
+    "node_modules/colord": {
+      "version": "2.9.2",
+      "resolved": "https://registry.npmjs.org/colord/-/colord-2.9.2.tgz",
+      "integrity": "sha512-Uqbg+J445nc1TKn4FoDPS6ZZqAvEDnwrH42yo8B40JSOgSLxMZ/gt3h4nmCtPLQeXhjJJkqBx7SCY35WnIixaQ==",
+      "dev": true
+    },
+    "node_modules/colorette": {
+      "version": "2.0.19",
+      "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.19.tgz",
+      "integrity": "sha512-3tlv/dIP7FWvj3BsbHrGLJ6l/oKh1O3TcgBqMn+yyCagOxc23fyzDS6HypQbgxWbkpDnf52p1LuR4eWDQ/K9WQ==",
+      "dev": true
+    },
+    "node_modules/combined-stream": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
+      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
+      "dev": true,
+      "dependencies": {
+        "delayed-stream": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/commander": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz",
+      "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
+      "dev": true,
+      "engines": {
+        "node": ">= 12"
+      }
+    },
+    "node_modules/commondir": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/commondir/-/commondir-1.0.1.tgz",
+      "integrity": "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==",
+      "dev": true
+    },
+    "node_modules/compressible": {
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/compressible/-/compressible-2.0.18.tgz",
+      "integrity": "sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg==",
+      "dev": true,
+      "dependencies": {
+        "mime-db": ">= 1.43.0 < 2"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/compression": {
+      "version": "1.7.4",
+      "resolved": "https://registry.npmjs.org/compression/-/compression-1.7.4.tgz",
+      "integrity": "sha512-jaSIDzP9pZVS4ZfQ+TzvtiWhdpFhE2RDHz8QJkpX9SIpLq88VueF5jJw6t+6CUQcAoA6t+x89MLrWAqpfDE8iQ==",
+      "dev": true,
+      "dependencies": {
+        "accepts": "~1.3.5",
+        "bytes": "3.0.0",
+        "compressible": "~2.0.16",
+        "debug": "2.6.9",
+        "on-headers": "~1.0.2",
+        "safe-buffer": "5.1.2",
+        "vary": "~1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/compression/node_modules/debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "dev": true,
+      "dependencies": {
+        "ms": "2.0.0"
+      }
+    },
+    "node_modules/compression/node_modules/ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "dev": true
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "dev": true
+    },
+    "node_modules/condense-newlines": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/condense-newlines/-/condense-newlines-0.2.1.tgz",
+      "integrity": "sha512-P7X+QL9Hb9B/c8HI5BFFKmjgBu2XpQuF98WZ9XkO+dBGgk5XgwiQz7o1SmpglNWId3581UcS0SFAWfoIhMHPfg==",
+      "dev": true,
+      "dependencies": {
+        "extend-shallow": "^2.0.1",
+        "is-whitespace": "^0.3.0",
+        "kind-of": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/condense-newlines/node_modules/kind-of": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
+      "integrity": "sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ==",
+      "dev": true,
+      "dependencies": {
+        "is-buffer": "^1.1.5"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/config-chain": {
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/config-chain/-/config-chain-1.1.13.tgz",
+      "integrity": "sha512-qj+f8APARXHrM0hraqXYb2/bOVSV4PvJQlNZ/DVj0QrmNM2q2euizkeuVckQ57J+W0mRH6Hvi+k50M4Jul2VRQ==",
+      "dev": true,
+      "dependencies": {
+        "ini": "^1.3.4",
+        "proto-list": "~1.2.1"
+      }
+    },
+    "node_modules/connect-history-api-fallback": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/connect-history-api-fallback/-/connect-history-api-fallback-2.0.0.tgz",
+      "integrity": "sha512-U73+6lQFmfiNPrYbXqr6kZ1i1wiRqXnp2nhMsINseWXO8lDau0LGEffJ8kQi4EjLZympVgRdvqjAgiZ1tgzDDA==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.8"
+      }
+    },
+    "node_modules/consolidate": {
+      "version": "0.15.1",
+      "resolved": "https://registry.npmjs.org/consolidate/-/consolidate-0.15.1.tgz",
+      "integrity": "sha512-DW46nrsMJgy9kqAbPt5rKaCr7uFtpo4mSUvLHIUbJEjm0vo+aY5QLwBUq3FK4tRnJr/X0Psc0C4jf/h+HtXSMw==",
+      "dev": true,
+      "dependencies": {
+        "bluebird": "^3.1.1"
+      },
+      "engines": {
+        "node": ">= 0.10.0"
+      }
+    },
+    "node_modules/content-disposition": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
+      "dev": true,
+      "dependencies": {
+        "safe-buffer": "5.2.1"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/content-disposition/node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
+    "node_modules/content-type": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.4.tgz",
+      "integrity": "sha512-hIP3EEPs8tB9AT1L+NUqtwOAps4mk2Zob89MWXMHjHWg9milF/j4osnnQLXBCBFBk/tvIG/tUc9mOUJiPBhPXA==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/convert-source-map": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.8.0.tgz",
+      "integrity": "sha512-+OQdjP49zViI/6i7nIJpA8rAl4sV/JdPfU9nZs3VqOwGIgizICvuN2ru6fMd+4llL0tar18UYJXfZ/TWtmhUjA==",
+      "dev": true,
+      "dependencies": {
+        "safe-buffer": "~5.1.1"
+      }
+    },
+    "node_modules/cookie": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
+      "integrity": "sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/cookie-signature": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
+      "integrity": "sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ==",
+      "dev": true
+    },
+    "node_modules/copy-webpack-plugin": {
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/copy-webpack-plugin/-/copy-webpack-plugin-9.1.0.tgz",
+      "integrity": "sha512-rxnR7PaGigJzhqETHGmAcxKnLZSR5u1Y3/bcIv/1FnqXedcL/E2ewK7ZCNrArJKCiSv8yVXhTqetJh8inDvfsA==",
+      "dev": true,
+      "dependencies": {
+        "fast-glob": "^3.2.7",
+        "glob-parent": "^6.0.1",
+        "globby": "^11.0.3",
+        "normalize-path": "^3.0.0",
+        "schema-utils": "^3.1.1",
+        "serialize-javascript": "^6.0.0"
+      },
+      "engines": {
+        "node": ">= 12.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      },
+      "peerDependencies": {
+        "webpack": "^5.1.0"
+      }
+    },
+    "node_modules/core-js": {
+      "version": "3.25.1",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.25.1.tgz",
+      "integrity": "sha512-sr0FY4lnO1hkQ4gLDr24K0DGnweGO1QwSj5BpfQjpSJPdqWalja4cTps29Y/PJVG/P7FYlPDkH3hO+Tr0CvDgQ==",
+      "hasInstallScript": true,
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/core-js"
+      }
+    },
+    "node_modules/core-js-compat": {
+      "version": "3.32.0",
+      "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.32.0.tgz",
+      "integrity": "sha512-7a9a3D1k4UCVKnLhrgALyFcP7YCsLOQIxPd0dKjf/6GuPcgyiGP70ewWdCGrSK7evyhymi0qO4EqCmSJofDeYw==",
+      "dev": true,
+      "dependencies": {
+        "browserslist": "^4.21.9"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/core-js"
+      }
+    },
+    "node_modules/core-util-is": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
+      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
+      "dev": true
+    },
+    "node_modules/cosmiconfig": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-7.0.1.tgz",
+      "integrity": "sha512-a1YWNUV2HwGimB7dU2s1wUMurNKjpx60HxBB6xUM8Re+2s1g1IIfJvFR0/iCF+XHdE0GMTKTuLR32UQff4TEyQ==",
+      "dev": true,
+      "dependencies": {
+        "@types/parse-json": "^4.0.0",
+        "import-fresh": "^3.2.1",
+        "parse-json": "^5.0.0",
+        "path-type": "^4.0.0",
+        "yaml": "^1.10.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/cross-spawn": {
+      "version": "6.0.5",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-6.0.5.tgz",
+      "integrity": "sha512-eTVLrBSt7fjbDygz805pMnstIs2VTBNkRm0qxZd+M7A5XDdxVRWO5MxGBXZhjY4cqLYLdtrGqRf8mBPmzwSpWQ==",
+      "dev": true,
+      "dependencies": {
+        "nice-try": "^1.0.4",
+        "path-key": "^2.0.1",
+        "semver": "^5.5.0",
+        "shebang-command": "^1.2.0",
+        "which": "^1.2.9"
+      },
+      "engines": {
+        "node": ">=4.8"
+      }
+    },
+    "node_modules/cross-spawn/node_modules/semver": {
+      "version": "5.7.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+      "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
+      "dev": true,
+      "bin": {
+        "semver": "bin/semver"
+      }
+    },
+    "node_modules/css-declaration-sorter": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/css-declaration-sorter/-/css-declaration-sorter-6.3.0.tgz",
+      "integrity": "sha512-OGT677UGHJTAVMRhPO+HJ4oKln3wkBTwtDFH0ojbqm+MJm6xuDMHp2nkhh/ThaBqq20IbraBQSWKfSLNHQO9Og==",
+      "dev": true,
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      },
+      "peerDependencies": {
+        "postcss": "^8.0.9"
+      }
+    },
+    "node_modules/css-loader": {
+      "version": "6.7.1",
+      "resolved": "https://registry.npmjs.org/css-loader/-/css-loader-6.7.1.tgz",
+      "integrity": "sha512-yB5CNFa14MbPJcomwNh3wLThtkZgcNyI2bNMRt8iE5Z8Vwl7f8vQXFAzn2HDOJvtDq2NTZBUGMSUNNyrv3/+cw==",
+      "dev": true,
+      "dependencies": {
+        "icss-utils": "^5.1.0",
+        "postcss": "^8.4.7",
+        "postcss-modules-extract-imports": "^3.0.0",
+        "postcss-modules-local-by-default": "^4.0.0",
+        "postcss-modules-scope": "^3.0.0",
+        "postcss-modules-values": "^4.0.0",
+        "postcss-value-parser": "^4.2.0",
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": ">= 12.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      },
+      "peerDependencies": {
+        "webpack": "^5.0.0"
+      }
+    },
+    "node_modules/css-loader/node_modules/semver": {
+      "version": "7.5.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/css-minimizer-webpack-plugin": {
+      "version": "3.4.1",
+      "resolved": "https://registry.npmjs.org/css-minimizer-webpack-plugin/-/css-minimizer-webpack-plugin-3.4.1.tgz",
+      "integrity": "sha512-1u6D71zeIfgngN2XNRJefc/hY7Ybsxd74Jm4qngIXyUEk7fss3VUzuHxLAq/R8NAba4QU9OUSaMZlbpRc7bM4Q==",
+      "dev": true,
+      "dependencies": {
+        "cssnano": "^5.0.6",
+        "jest-worker": "^27.0.2",
+        "postcss": "^8.3.5",
+        "schema-utils": "^4.0.0",
+        "serialize-javascript": "^6.0.0",
+        "source-map": "^0.6.1"
+      },
+      "engines": {
+        "node": ">= 12.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      },
+      "peerDependencies": {
+        "webpack": "^5.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@parcel/css": {
+          "optional": true
+        },
+        "clean-css": {
+          "optional": true
+        },
+        "csso": {
+          "optional": true
+        },
+        "esbuild": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/css-minimizer-webpack-plugin/node_modules/ajv": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.11.0.tgz",
+      "integrity": "sha512-wGgprdCvMalC0BztXvitD2hC04YffAvtsUn93JbGXYLAtCUO4xd17mCCZQxUOItiBwZvJScWo8NIvQMQ71rdpg==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/css-minimizer-webpack-plugin/node_modules/ajv-keywords": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-5.1.0.tgz",
+      "integrity": "sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3"
+      },
+      "peerDependencies": {
+        "ajv": "^8.8.2"
+      }
+    },
+    "node_modules/css-minimizer-webpack-plugin/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true
+    },
+    "node_modules/css-minimizer-webpack-plugin/node_modules/schema-utils": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.0.0.tgz",
+      "integrity": "sha512-1edyXKgh6XnJsJSQ8mKWXnN/BVaIbFMLpouRUrXgVq7WYne5kw3MW7UPhO44uRXQSIpTSXoJbmrR2X0w9kUTyg==",
+      "dev": true,
+      "dependencies": {
+        "@types/json-schema": "^7.0.9",
+        "ajv": "^8.8.0",
+        "ajv-formats": "^2.1.1",
+        "ajv-keywords": "^5.0.0"
+      },
+      "engines": {
+        "node": ">= 12.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      }
+    },
+    "node_modules/css-select": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/css-select/-/css-select-4.3.0.tgz",
+      "integrity": "sha512-wPpOYtnsVontu2mODhA19JrqWxNsfdatRKd64kmpRbQgh1KtItko5sTnEpPdpSaJszTOhEMlF/RPz28qj4HqhQ==",
+      "dev": true,
+      "dependencies": {
+        "boolbase": "^1.0.0",
+        "css-what": "^6.0.1",
+        "domhandler": "^4.3.1",
+        "domutils": "^2.8.0",
+        "nth-check": "^2.0.1"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/fb55"
+      }
+    },
+    "node_modules/css-tree": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-1.1.3.tgz",
+      "integrity": "sha512-tRpdppF7TRazZrjJ6v3stzv93qxRcSsFmW6cX0Zm2NVKpxE1WV1HblnghVv9TreireHkqI/VDEsfolRF1p6y7Q==",
+      "dev": true,
+      "dependencies": {
+        "mdn-data": "2.0.14",
+        "source-map": "^0.6.1"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/css-what": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/css-what/-/css-what-6.1.0.tgz",
+      "integrity": "sha512-HTUrgRJ7r4dsZKU6GjmpfRK1O76h97Z8MfS1G0FozR+oF2kG6Vfe8JE6zwrkbxigziPHinCJ+gCPjA9EaBDtRw==",
+      "dev": true,
+      "engines": {
+        "node": ">= 6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/fb55"
+      }
+    },
+    "node_modules/cssesc": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
+      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
+      "dev": true,
+      "bin": {
+        "cssesc": "bin/cssesc"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/cssnano": {
+      "version": "5.1.12",
+      "resolved": "https://registry.npmjs.org/cssnano/-/cssnano-5.1.12.tgz",
+      "integrity": "sha512-TgvArbEZu0lk/dvg2ja+B7kYoD7BBCmn3+k58xD0qjrGHsFzXY/wKTo9M5egcUCabPol05e/PVoIu79s2JN4WQ==",
+      "dev": true,
+      "dependencies": {
+        "cssnano-preset-default": "^5.2.12",
+        "lilconfig": "^2.0.3",
+        "yaml": "^1.10.2"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/cssnano"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/cssnano-preset-default": {
+      "version": "5.2.12",
+      "resolved": "https://registry.npmjs.org/cssnano-preset-default/-/cssnano-preset-default-5.2.12.tgz",
+      "integrity": "sha512-OyCBTZi+PXgylz9HAA5kHyoYhfGcYdwFmyaJzWnzxuGRtnMw/kR6ilW9XzlzlRAtB6PLT/r+prYgkef7hngFew==",
+      "dev": true,
+      "dependencies": {
+        "css-declaration-sorter": "^6.3.0",
+        "cssnano-utils": "^3.1.0",
+        "postcss-calc": "^8.2.3",
+        "postcss-colormin": "^5.3.0",
+        "postcss-convert-values": "^5.1.2",
+        "postcss-discard-comments": "^5.1.2",
+        "postcss-discard-duplicates": "^5.1.0",
+        "postcss-discard-empty": "^5.1.1",
+        "postcss-discard-overridden": "^5.1.0",
+        "postcss-merge-longhand": "^5.1.6",
+        "postcss-merge-rules": "^5.1.2",
+        "postcss-minify-font-values": "^5.1.0",
+        "postcss-minify-gradients": "^5.1.1",
+        "postcss-minify-params": "^5.1.3",
+        "postcss-minify-selectors": "^5.2.1",
+        "postcss-normalize-charset": "^5.1.0",
+        "postcss-normalize-display-values": "^5.1.0",
+        "postcss-normalize-positions": "^5.1.1",
+        "postcss-normalize-repeat-style": "^5.1.1",
+        "postcss-normalize-string": "^5.1.0",
+        "postcss-normalize-timing-functions": "^5.1.0",
+        "postcss-normalize-unicode": "^5.1.0",
+        "postcss-normalize-url": "^5.1.0",
+        "postcss-normalize-whitespace": "^5.1.1",
+        "postcss-ordered-values": "^5.1.3",
+        "postcss-reduce-initial": "^5.1.0",
+        "postcss-reduce-transforms": "^5.1.0",
+        "postcss-svgo": "^5.1.0",
+        "postcss-unique-selectors": "^5.1.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/cssnano-utils": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/cssnano-utils/-/cssnano-utils-3.1.0.tgz",
+      "integrity": "sha512-JQNR19/YZhz4psLX/rQ9M83e3z2Wf/HdJbryzte4a3NSuafyp9w/I4U+hx5C2S9g41qlstH7DEWnZaaj83OuEA==",
+      "dev": true,
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/csso": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/csso/-/csso-4.2.0.tgz",
+      "integrity": "sha512-wvlcdIbf6pwKEk7vHj8/Bkc0B4ylXZruLvOgs9doS5eOsOpuodOV2zJChSpkp+pRpYQLQMeF04nr3Z68Sta9jA==",
+      "dev": true,
+      "dependencies": {
+        "css-tree": "^1.1.2"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/cssom": {
+      "version": "0.4.4",
+      "resolved": "https://registry.npmjs.org/cssom/-/cssom-0.4.4.tgz",
+      "integrity": "sha512-p3pvU7r1MyyqbTk+WbNJIgJjG2VmTIaB10rI93LzVPrmDJKkzKYMtxxyAvQXR/NS6otuzveI7+7BBq3SjBS2mw==",
+      "dev": true
+    },
+    "node_modules/cssstyle": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-2.3.0.tgz",
+      "integrity": "sha512-AZL67abkUzIuvcHqk7c09cezpGNcxUxU4Ioi/05xHk4DQeTkWmGYftIE6ctU6AEt+Gn4n1lDStOtj7FKycP71A==",
+      "dev": true,
+      "dependencies": {
+        "cssom": "~0.3.6"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cssstyle/node_modules/cssom": {
+      "version": "0.3.8",
+      "resolved": "https://registry.npmjs.org/cssom/-/cssom-0.3.8.tgz",
+      "integrity": "sha512-b0tGHbfegbhPJpxpiBPU2sCkigAqtM9O121le6bbOlgyV+NyGyCmVfJ6QW9eRjz8CpNfWEOYBIMIGRYkLwsIYg==",
+      "dev": true
+    },
+    "node_modules/csstype": {
+      "version": "2.6.20",
+      "resolved": "https://registry.npmjs.org/csstype/-/csstype-2.6.20.tgz",
+      "integrity": "sha512-/WwNkdXfckNgw6S5R125rrW8ez139lBHWouiBvX8dfMFtcn6V81REDqnH7+CRpRipfYlyU1CmOnOxrmGcFOjeA=="
+    },
+    "node_modules/data-urls": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-2.0.0.tgz",
+      "integrity": "sha512-X5eWTSXO/BJmpdIKCRuKUgSCgAN0OwliVK3yPKbwIWU1Tdw5BRajxlzMidvh+gwko9AfQ9zIj52pzF91Q3YAvQ==",
+      "dev": true,
+      "dependencies": {
+        "abab": "^2.0.3",
+        "whatwg-mimetype": "^2.3.0",
+        "whatwg-url": "^8.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/data-urls/node_modules/tr46": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-2.1.0.tgz",
+      "integrity": "sha512-15Ih7phfcdP5YxqiB+iDtLoaTz4Nd35+IiAv0kQ5FNKHzXgdWqPoTIqEDDJmXceQt4JZk6lVPT8lnDlPpGDppw==",
+      "dev": true,
+      "dependencies": {
+        "punycode": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/data-urls/node_modules/webidl-conversions": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-6.1.0.tgz",
+      "integrity": "sha512-qBIvFLGiBpLjfwmYAaHPXsn+ho5xZnGvyGvsarywGNc8VyQJUMHJ8OBKGGrPER0okBeMDaan4mNBlgBROxuI8w==",
+      "dev": true,
+      "engines": {
+        "node": ">=10.4"
+      }
+    },
+    "node_modules/data-urls/node_modules/whatwg-url": {
+      "version": "8.7.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-8.7.0.tgz",
+      "integrity": "sha512-gAojqb/m9Q8a5IV96E3fHJM70AzCkgt4uXYX2O7EmuyOnLrViCQlsEBmF9UQIu3/aeAIp2U17rtbpZWNntQqdg==",
+      "dev": true,
+      "dependencies": {
+        "lodash": "^4.7.0",
+        "tr46": "^2.1.0",
+        "webidl-conversions": "^6.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/debounce": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/debounce/-/debounce-1.2.1.tgz",
+      "integrity": "sha512-XRRe6Glud4rd/ZGQfiV1ruXSfbvfJedlV9Y6zOlP+2K04vBYiJEte6stfFkCP03aMnY5tsipamumUjL14fofug=="
+    },
+    "node_modules/debug": {
+      "version": "4.3.4",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
+      "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+      "dev": true,
+      "dependencies": {
+        "ms": "2.1.2"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/decimal.js": {
+      "version": "10.3.1",
+      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.3.1.tgz",
+      "integrity": "sha512-V0pfhfr8suzyPGOx3nmq4aHqabehUZn6Ch9kyFpV79TGDTWFmHqUqXdabR7QHqxzrYolF4+tVmJhUG4OURg5dQ==",
+      "dev": true
+    },
+    "node_modules/dedent": {
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/dedent/-/dedent-0.7.0.tgz",
+      "integrity": "sha512-Q6fKUPqnAHAyhiUgFU7BUzLiv0kd8saH9al7tnu5Q/okj6dnupxyTgFIBjVzJATdfIAm9NAsvXNzjaKa+bxVyA==",
+      "dev": true
+    },
+    "node_modules/deep-is": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
+      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
+      "dev": true
+    },
+    "node_modules/deepmerge": {
+      "version": "1.5.2",
+      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-1.5.2.tgz",
+      "integrity": "sha512-95k0GDqvBjZavkuvzx/YqVLv/6YYa17fz6ILMSf7neqQITCPbnfEnQvEgMPNjH4kgobe7+WIL0yJEHku+H3qtQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/default-gateway": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/default-gateway/-/default-gateway-6.0.3.tgz",
+      "integrity": "sha512-fwSOJsbbNzZ/CUFpqFBqYfYNLj1NbMPm8MMCIzHjC83iSJRBEGmDUxU+WP661BaBQImeC2yHwXtz+P/O9o+XEg==",
+      "dev": true,
+      "dependencies": {
+        "execa": "^5.0.0"
+      },
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/default-gateway/node_modules/cross-spawn": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "dev": true,
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/default-gateway/node_modules/execa": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
+      "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
+      "dev": true,
+      "dependencies": {
+        "cross-spawn": "^7.0.3",
+        "get-stream": "^6.0.0",
+        "human-signals": "^2.1.0",
+        "is-stream": "^2.0.0",
+        "merge-stream": "^2.0.0",
+        "npm-run-path": "^4.0.1",
+        "onetime": "^5.1.2",
+        "signal-exit": "^3.0.3",
+        "strip-final-newline": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/execa?sponsor=1"
+      }
+    },
+    "node_modules/default-gateway/node_modules/get-stream": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
+      "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/default-gateway/node_modules/is-stream": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/default-gateway/node_modules/npm-run-path": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
+      "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
+      "dev": true,
+      "dependencies": {
+        "path-key": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/default-gateway/node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/default-gateway/node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/default-gateway/node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/default-gateway/node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/defaults": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/defaults/-/defaults-1.0.3.tgz",
+      "integrity": "sha512-s82itHOnYrN0Ib8r+z7laQz3sdE+4FP3d9Q7VLO7U+KRT+CR0GsWuyHxzdAY82I7cXv0G/twrqomTJLOssO5HA==",
+      "dev": true,
+      "dependencies": {
+        "clone": "^1.0.2"
+      }
+    },
+    "node_modules/define-lazy-prop": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/define-lazy-prop/-/define-lazy-prop-2.0.0.tgz",
+      "integrity": "sha512-Ds09qNh8yw3khSjiJjiUInaGX9xlqZDY7JVryGxdxV7NPeuqQfplOpQ66yJFZut3jLa5zOwkXw1g9EI2uKh4Og==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/define-properties": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.1.4.tgz",
+      "integrity": "sha512-uckOqKcfaVvtBdsVkdPv3XjveQJsNQqmhXgRi8uhvWWuPYZCNlzT8qAyblUgNoXdHdjMTzAqeGjAoli8f+bzPA==",
+      "dev": true,
+      "dependencies": {
+        "has-property-descriptors": "^1.0.0",
+        "object-keys": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/defined": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/defined/-/defined-1.0.0.tgz",
+      "integrity": "sha512-Y2caI5+ZwS5c3RiNDJ6u53VhQHv+hHKwhkI1iHvceKUHw9Df6EK2zRLfjejRgMuCuxK7PfSWIMwWecceVvThjQ==",
+      "dev": true
+    },
+    "node_modules/delayed-stream": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
+      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/delegate": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/delegate/-/delegate-3.2.0.tgz",
+      "integrity": "sha512-IofjkYBZaZivn0V8nnsMJGBr4jVLxHDheKSW88PyxS5QC4Vo9ZbZVvhzlSxY87fVq3STR6r+4cGepyHkcWOQSw=="
+    },
+    "node_modules/depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/destroy": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
+      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8",
+        "npm": "1.2.8000 || >= 1.4.16"
+      }
+    },
+    "node_modules/detect-newline": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz",
+      "integrity": "sha512-TLz+x/vEXm/Y7P7wn1EJFNLxYpUD4TgMosxY6fAVJUnJMbupHBOncxyWUG9OpTaH9EBD7uFI5LfEgmMOc54DsA==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/detect-node": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/detect-node/-/detect-node-2.1.0.tgz",
+      "integrity": "sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g==",
+      "dev": true
+    },
+    "node_modules/detective": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/detective/-/detective-5.2.1.tgz",
+      "integrity": "sha512-v9XE1zRnz1wRtgurGu0Bs8uHKFSTdteYZNbIPFVhUZ39L/S79ppMpdmVOZAnoz1jfEFodc48n6MX483Xo3t1yw==",
+      "dev": true,
+      "dependencies": {
+        "acorn-node": "^1.8.2",
+        "defined": "^1.0.0",
+        "minimist": "^1.2.6"
+      },
+      "bin": {
+        "detective": "bin/detective.js"
+      },
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
+    "node_modules/didyoumean": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/didyoumean/-/didyoumean-1.2.2.tgz",
+      "integrity": "sha512-gxtyfqMg7GKyhQmb056K7M3xszy/myH8w+B4RT+QXBQsvAOdc3XymqDDPHx1BgPgsdAA5SIifona89YtRATDzw==",
+      "dev": true
+    },
+    "node_modules/diff": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.2.tgz",
+      "integrity": "sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.3.1"
+      }
+    },
+    "node_modules/diff-sequences": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/diff-sequences/-/diff-sequences-27.5.1.tgz",
+      "integrity": "sha512-k1gCAXAsNgLwEL+Y8Wvl+M6oEFj5bgazfZULpS5CneoPPXRaCCW7dm+q21Ky2VEE5X+VeRDBVg1Pcvvsr4TtNQ==",
+      "dev": true,
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/dir-glob": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/dir-glob/-/dir-glob-3.0.1.tgz",
+      "integrity": "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==",
+      "dev": true,
+      "dependencies": {
+        "path-type": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/dlv": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/dlv/-/dlv-1.1.3.tgz",
+      "integrity": "sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==",
+      "dev": true
+    },
+    "node_modules/dns-equal": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/dns-equal/-/dns-equal-1.0.0.tgz",
+      "integrity": "sha512-z+paD6YUQsk+AbGCEM4PrOXSss5gd66QfcVBFTKR/HpFL9jCqikS94HYwKww6fQyO7IxrIIyUu+g0Ka9tUS2Cg==",
+      "dev": true
+    },
+    "node_modules/dns-packet": {
+      "version": "5.4.0",
+      "resolved": "https://registry.npmjs.org/dns-packet/-/dns-packet-5.4.0.tgz",
+      "integrity": "sha512-EgqGeaBB8hLiHLZtp/IbaDQTL8pZ0+IvwzSHA6d7VyMDM+B9hgddEMa9xjK5oYnw0ci0JQ6g2XCD7/f6cafU6g==",
+      "dev": true,
+      "dependencies": {
+        "@leichtgewicht/ip-codec": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/doctrine": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz",
+      "integrity": "sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==",
+      "dev": true,
+      "dependencies": {
+        "esutils": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/dom-converter": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/dom-converter/-/dom-converter-0.2.0.tgz",
+      "integrity": "sha512-gd3ypIPfOMr9h5jIKq8E3sHOTCjeirnl0WK5ZdS1AW0Odt0b1PaWaHdJ4Qk4klv+YB9aJBS7mESXjFoDQPu6DA==",
+      "dev": true,
+      "dependencies": {
+        "utila": "~0.4"
+      }
+    },
+    "node_modules/dom-serializer": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-1.4.1.tgz",
+      "integrity": "sha512-VHwB3KfrcOOkelEG2ZOfxqLZdfkil8PtJi4P8N2MMXucZq2yLp75ClViUlOVwyoHEDjYU433Aq+5zWP61+RGag==",
+      "dev": true,
+      "dependencies": {
+        "domelementtype": "^2.0.1",
+        "domhandler": "^4.2.0",
+        "entities": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/cheeriojs/dom-serializer?sponsor=1"
+      }
+    },
+    "node_modules/domelementtype": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.3.0.tgz",
+      "integrity": "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fb55"
+        }
+      ]
+    },
+    "node_modules/domexception": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/domexception/-/domexception-2.0.1.tgz",
+      "integrity": "sha512-yxJ2mFy/sibVQlu5qHjOkf9J3K6zgmCxgJ94u2EdvDOV09H+32LtRswEcUsmUWN72pVLOEnTSRaIVVzVQgS0dg==",
+      "dev": true,
+      "dependencies": {
+        "webidl-conversions": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/domexception/node_modules/webidl-conversions": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-5.0.0.tgz",
+      "integrity": "sha512-VlZwKPCkYKxQgeSbH5EyngOmRp7Ww7I9rQLERETtf5ofd9pGeswWiOtogpEO850jziPRarreGxn5QIiTqpb2wA==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/domhandler": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/domhandler/-/domhandler-4.3.1.tgz",
+      "integrity": "sha512-GrwoxYN+uWlzO8uhUXRl0P+kHE4GtVPfYzVLcUxPL7KNdHKj66vvlhiweIHqYYXWlw+T8iLMp42Lm67ghw4WMQ==",
+      "dev": true,
+      "dependencies": {
+        "domelementtype": "^2.2.0"
+      },
+      "engines": {
+        "node": ">= 4"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/domhandler?sponsor=1"
+      }
+    },
+    "node_modules/domutils": {
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/domutils/-/domutils-2.8.0.tgz",
+      "integrity": "sha512-w96Cjofp72M5IIhpjgobBimYEfoPjx1Vx0BSX9P30WBdZW2WIKU0T1Bd0kz2eNZ9ikjKgHbEyKx8BB6H1L3h3A==",
+      "dev": true,
+      "dependencies": {
+        "dom-serializer": "^1.0.1",
+        "domelementtype": "^2.2.0",
+        "domhandler": "^4.2.0"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/domutils?sponsor=1"
+      }
+    },
+    "node_modules/dot-case": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/dot-case/-/dot-case-3.0.4.tgz",
+      "integrity": "sha512-Kv5nKlh6yRrdrGvxeJ2e5y2eRUpkUosIW4A2AS38zwSz27zu7ufDwQPi5Jhs3XAlGNetl3bmnGhQsMtkKJnj3w==",
+      "dev": true,
+      "dependencies": {
+        "no-case": "^3.0.4",
+        "tslib": "^2.0.3"
+      }
+    },
+    "node_modules/dotenv": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-10.0.0.tgz",
+      "integrity": "sha512-rlBi9d8jpv9Sf1klPjNfFAuWDjKLwTIJJ/VxtoTwIR6hnZxcEOQCZg2oIL3MWBYw5GpUDKOEnND7LXTbIpQ03Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/dotenv-expand": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/dotenv-expand/-/dotenv-expand-5.1.0.tgz",
+      "integrity": "sha512-YXQl1DSa4/PQyRfgrv6aoNjhasp/p4qs9FjJ4q4cQk+8m4r6k4ZSiEyytKG8f8W9gi8WsQtIObNmKd+tMzNTmA==",
+      "dev": true
+    },
+    "node_modules/duplexer": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/duplexer/-/duplexer-0.1.2.tgz",
+      "integrity": "sha512-jtD6YG370ZCIi/9GTaJKQxWTZD045+4R4hTk/x1UyoqadyJ9x9CgSi1RlVDQF8U2sxLLSnFkCaMihqljHIWgMg==",
+      "dev": true
+    },
+    "node_modules/easy-stack": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/easy-stack/-/easy-stack-1.0.1.tgz",
+      "integrity": "sha512-wK2sCs4feiiJeFXn3zvY0p41mdU5VUgbgs1rNsc/y5ngFUijdWd+iIN8eoyuZHKB8xN6BL4PdWmzqFmxNg6V2w==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/editorconfig": {
+      "version": "0.15.3",
+      "resolved": "https://registry.npmjs.org/editorconfig/-/editorconfig-0.15.3.tgz",
+      "integrity": "sha512-M9wIMFx96vq0R4F+gRpY3o2exzb8hEj/n9S8unZtHSvYjibBp/iMufSzvmOcV/laG0ZtuTVGtiJggPOSW2r93g==",
+      "dev": true,
+      "dependencies": {
+        "commander": "^2.19.0",
+        "lru-cache": "^4.1.5",
+        "semver": "^5.6.0",
+        "sigmund": "^1.0.1"
+      },
+      "bin": {
+        "editorconfig": "bin/editorconfig"
+      }
+    },
+    "node_modules/editorconfig/node_modules/commander": {
+      "version": "2.20.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+      "dev": true
+    },
+    "node_modules/editorconfig/node_modules/lru-cache": {
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-4.1.5.tgz",
+      "integrity": "sha512-sWZlbEP2OsHNkXrMl5GYk/jKk70MBng6UU4YI/qGDYbgf6YbP4EvmqISbXCoJiRKs+1bSpFHVgQxvJ17F2li5g==",
+      "dev": true,
+      "dependencies": {
+        "pseudomap": "^1.0.2",
+        "yallist": "^2.1.2"
+      }
+    },
+    "node_modules/editorconfig/node_modules/semver": {
+      "version": "5.7.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+      "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
+      "dev": true,
+      "bin": {
+        "semver": "bin/semver"
+      }
+    },
+    "node_modules/editorconfig/node_modules/yallist": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-2.1.2.tgz",
+      "integrity": "sha512-ncTzHV7NvsQZkYe1DW7cbDLm0YpzHmZF5r/iyP3ZnQtMiJ+pjzisCiMNI+Sj+xQF5pXhSHxSB3uDbsBTzY/c2A==",
+      "dev": true
+    },
+    "node_modules/ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+      "dev": true
+    },
+    "node_modules/electron-to-chromium": {
+      "version": "1.4.482",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.482.tgz",
+      "integrity": "sha512-h+UqpfmEr1Qkk0zp7ej/jid7CXoq4m4QzW6wNTb0ELJ/BZCpA4wgUylBIMGCe621tnr4l5VmoHjdoSx2lbnNJA==",
+      "dev": true
+    },
+    "node_modules/emittery": {
+      "version": "0.10.2",
+      "resolved": "https://registry.npmjs.org/emittery/-/emittery-0.10.2.tgz",
+      "integrity": "sha512-aITqOwnLanpHLNXZJENbOgjUBeHocD+xsSJmNrjovKBW5HbSpW3d1pEls7GFQPUWXiwG9+0P4GtHfEqC/4M0Iw==",
+      "dev": true,
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/emittery?sponsor=1"
+      }
+    },
+    "node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true
+    },
+    "node_modules/emojis-list": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/emojis-list/-/emojis-list-3.0.0.tgz",
+      "integrity": "sha512-/kyM18EfinwXZbno9FyUGeFh87KC8HRQBQGildHZbEuRyWFOmv1U10o9BBp8XVZDVNNuQKyIGIu5ZYAAXJ0V2Q==",
+      "dev": true,
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/encodeurl": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
+      "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/end-of-stream": {
+      "version": "1.4.4",
+      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz",
+      "integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==",
+      "dev": true,
+      "dependencies": {
+        "once": "^1.4.0"
+      }
+    },
+    "node_modules/enhanced-resolve": {
+      "version": "5.14.0",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.14.0.tgz",
+      "integrity": "sha512-+DCows0XNwLDcUhbFJPdlQEVnT2zXlCv7hPxemTz86/O+B/hCQ+mb7ydkPKiflpVraqLPCAfu7lDy+hBXueojw==",
+      "dev": true,
+      "dependencies": {
+        "graceful-fs": "^4.2.4",
+        "tapable": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/enquirer": {
+      "version": "2.3.6",
+      "resolved": "https://registry.npmjs.org/enquirer/-/enquirer-2.3.6.tgz",
+      "integrity": "sha512-yjNnPr315/FjS4zIsUxYguYUPP2e1NK4d7E7ZOLiyYCcbFBiTMyID+2wvm2w6+pZ/odMA7cRkjhsPbltwBOrLg==",
+      "dev": true,
+      "dependencies": {
+        "ansi-colors": "^4.1.1"
+      },
+      "engines": {
+        "node": ">=8.6"
+      }
+    },
+    "node_modules/entities": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-2.2.0.tgz",
+      "integrity": "sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==",
+      "dev": true,
+      "funding": {
+        "url": "https://github.com/fb55/entities?sponsor=1"
+      }
+    },
+    "node_modules/error-ex": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.2.tgz",
+      "integrity": "sha512-7dFHNmqeFSEt2ZBsCriorKnn3Z2pj+fd9kmI6QoWw4//DL+icEBfc0U7qJCisqrTsKTjw4fNFy2pW9OqStD84g==",
+      "dev": true,
+      "dependencies": {
+        "is-arrayish": "^0.2.1"
+      }
+    },
+    "node_modules/error-stack-parser": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/error-stack-parser/-/error-stack-parser-2.1.4.tgz",
+      "integrity": "sha512-Sk5V6wVazPhq5MhpO+AUxJn5x7XSXGl1R93Vn7i+zS15KDVxQijejNCrz8340/2bgLBjR9GtEG8ZVKONDjcqGQ==",
+      "dev": true,
+      "dependencies": {
+        "stackframe": "^1.3.4"
+      }
+    },
+    "node_modules/es-cookie": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/es-cookie/-/es-cookie-1.3.2.tgz",
+      "integrity": "sha512-UTlYYhXGLOy05P/vKVT2Ui7WtC7NiRzGtJyAKKn32g5Gvcjn7KAClLPWlipCtxIus934dFg9o9jXiBL0nP+t9Q=="
+    },
+    "node_modules/es-module-lexer": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.2.1.tgz",
+      "integrity": "sha512-9978wrXM50Y4rTMmW5kXIC09ZdXQZqkE4mxhwkd8VbzsGkXGPgV4zWuqQJgCEzYngdo2dYDa0l8xhX4fkSwJSg==",
+      "dev": true
+    },
+    "node_modules/escalade": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
+      "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+      "dev": true
+    },
+    "node_modules/escape-string-regexp": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
+      "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
+    "node_modules/escodegen": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/escodegen/-/escodegen-2.0.0.tgz",
+      "integrity": "sha512-mmHKys/C8BFUGI+MAWNcSYoORYLMdPzjrknd2Vc+bUsjN5bXcr8EhrNB+UTqfL1y3I9c4fw2ihgtMPQLBRiQxw==",
+      "dev": true,
+      "dependencies": {
+        "esprima": "^4.0.1",
+        "estraverse": "^5.2.0",
+        "esutils": "^2.0.2",
+        "optionator": "^0.8.1"
+      },
+      "bin": {
+        "escodegen": "bin/escodegen.js",
+        "esgenerate": "bin/esgenerate.js"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "optionalDependencies": {
+        "source-map": "~0.6.1"
+      }
+    },
+    "node_modules/escodegen/node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/escodegen/node_modules/levn": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/levn/-/levn-0.3.0.tgz",
+      "integrity": "sha512-0OO4y2iOHix2W6ujICbKIaEQXvFQHue65vUG3pb5EUomzPI90z9hsA1VsO/dbIIpC53J8gxM9Q4Oho0jrCM/yA==",
+      "dev": true,
+      "dependencies": {
+        "prelude-ls": "~1.1.2",
+        "type-check": "~0.3.2"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/escodegen/node_modules/optionator": {
+      "version": "0.8.3",
+      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.8.3.tgz",
+      "integrity": "sha512-+IW9pACdk3XWmmTXG8m3upGUJst5XRGzxMRjXzAuJ1XnIFNvfhjjIuYkDvysnPQ7qzqVzLt78BCruntqRhWQbA==",
+      "dev": true,
+      "dependencies": {
+        "deep-is": "~0.1.3",
+        "fast-levenshtein": "~2.0.6",
+        "levn": "~0.3.0",
+        "prelude-ls": "~1.1.2",
+        "type-check": "~0.3.2",
+        "word-wrap": "~1.2.3"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/escodegen/node_modules/prelude-ls": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.1.2.tgz",
+      "integrity": "sha512-ESF23V4SKG6lVSGZgYNpbsiaAkdab6ZgOxe52p7+Kid3W3u3bxR4Vfd/o21dmN7jSt0IwgZ4v5MUd26FEtXE9w==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/escodegen/node_modules/type-check": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.3.2.tgz",
+      "integrity": "sha512-ZCmOJdvOWDBYJlzAoFkC+Q0+bUyEOS1ltgp1MGU03fqHG+dbi9tBFU2Rd9QKiDZFAYrhPh2JUf7rZRIuHRKtOg==",
+      "dev": true,
+      "dependencies": {
+        "prelude-ls": "~1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/eslint": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.18.0.tgz",
+      "integrity": "sha512-As1EfFMVk7Xc6/CvhssHUjsAQSkpfXvUGMFC3ce8JDe6WvqCgRrLOBQbVpsBFr1X1V+RACOadnzVvcUS5ni2bA==",
+      "dev": true,
+      "dependencies": {
+        "@eslint/eslintrc": "^1.3.0",
+        "@humanwhocodes/config-array": "^0.9.2",
+        "ajv": "^6.10.0",
+        "chalk": "^4.0.0",
+        "cross-spawn": "^7.0.2",
+        "debug": "^4.3.2",
+        "doctrine": "^3.0.0",
+        "escape-string-regexp": "^4.0.0",
+        "eslint-scope": "^7.1.1",
+        "eslint-utils": "^3.0.0",
+        "eslint-visitor-keys": "^3.3.0",
+        "espree": "^9.3.2",
+        "esquery": "^1.4.0",
+        "esutils": "^2.0.2",
+        "fast-deep-equal": "^3.1.3",
+        "file-entry-cache": "^6.0.1",
+        "functional-red-black-tree": "^1.0.1",
+        "glob-parent": "^6.0.1",
+        "globals": "^13.15.0",
+        "ignore": "^5.2.0",
+        "import-fresh": "^3.0.0",
+        "imurmurhash": "^0.1.4",
+        "is-glob": "^4.0.0",
+        "js-yaml": "^4.1.0",
+        "json-stable-stringify-without-jsonify": "^1.0.1",
+        "levn": "^0.4.1",
+        "lodash.merge": "^4.6.2",
+        "minimatch": "^3.1.2",
+        "natural-compare": "^1.4.0",
+        "optionator": "^0.9.1",
+        "regexpp": "^3.2.0",
+        "strip-ansi": "^6.0.1",
+        "strip-json-comments": "^3.1.0",
+        "text-table": "^0.2.0",
+        "v8-compile-cache": "^2.0.3"
+      },
+      "bin": {
+        "eslint": "bin/eslint.js"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/eslint-plugin-vue": {
+      "version": "9.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-vue/-/eslint-plugin-vue-9.1.1.tgz",
+      "integrity": "sha512-W9n5PB1X2jzC7CK6riG0oAcxjmKrjTF6+keL1rni8n57DZeilx/Fulz+IRJK3lYseLNAygN0I62L7DvioW40Tw==",
+      "dev": true,
+      "dependencies": {
+        "eslint-utils": "^3.0.0",
+        "natural-compare": "^1.4.0",
+        "nth-check": "^2.0.1",
+        "postcss-selector-parser": "^6.0.9",
+        "semver": "^7.3.5",
+        "vue-eslint-parser": "^9.0.1",
+        "xml-name-validator": "^4.0.0"
+      },
+      "engines": {
+        "node": "^14.17.0 || >=16.0.0"
+      },
+      "peerDependencies": {
+        "eslint": "^6.2.0 || ^7.0.0 || ^8.0.0"
+      }
+    },
+    "node_modules/eslint-plugin-vue/node_modules/semver": {
+      "version": "7.5.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/eslint-scope": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz",
+      "integrity": "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==",
+      "dev": true,
+      "dependencies": {
+        "esrecurse": "^4.3.0",
+        "estraverse": "^4.1.1"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/eslint-utils": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/eslint-utils/-/eslint-utils-3.0.0.tgz",
+      "integrity": "sha512-uuQC43IGctw68pJA1RgbQS8/NP7rch6Cwd4j3ZBtgo4/8Flj4eGE7ZYSZRN3iq5pVUv6GPdW5Z1RFleo84uLDA==",
+      "dev": true,
+      "dependencies": {
+        "eslint-visitor-keys": "^2.0.0"
+      },
+      "engines": {
+        "node": "^10.0.0 || ^12.0.0 || >= 14.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/mysticatea"
+      },
+      "peerDependencies": {
+        "eslint": ">=5"
+      }
+    },
+    "node_modules/eslint-utils/node_modules/eslint-visitor-keys": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz",
+      "integrity": "sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/eslint-visitor-keys": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.3.0.tgz",
+      "integrity": "sha512-mQ+suqKJVyeuwGYHAdjMFqjCyfl8+Ldnxuyp3ldiMBFKkvytrXUZWaiPCEav8qDHKty44bD+qV1IP4T+w+xXRA==",
+      "dev": true,
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
+    "node_modules/eslint-webpack-plugin": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/eslint-webpack-plugin/-/eslint-webpack-plugin-3.2.0.tgz",
+      "integrity": "sha512-avrKcGncpPbPSUHX6B3stNGzkKFto3eL+DKM4+VyMrVnhPc3vRczVlCq3uhuFOdRvDHTVXuzwk1ZKUrqDQHQ9w==",
+      "dev": true,
+      "dependencies": {
+        "@types/eslint": "^7.29.0 || ^8.4.1",
+        "jest-worker": "^28.0.2",
+        "micromatch": "^4.0.5",
+        "normalize-path": "^3.0.0",
+        "schema-utils": "^4.0.0"
+      },
+      "engines": {
+        "node": ">= 12.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      },
+      "peerDependencies": {
+        "eslint": "^7.0.0 || ^8.0.0",
+        "webpack": "^5.0.0"
+      }
+    },
+    "node_modules/eslint-webpack-plugin/node_modules/ajv": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.11.0.tgz",
+      "integrity": "sha512-wGgprdCvMalC0BztXvitD2hC04YffAvtsUn93JbGXYLAtCUO4xd17mCCZQxUOItiBwZvJScWo8NIvQMQ71rdpg==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/eslint-webpack-plugin/node_modules/ajv-keywords": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-5.1.0.tgz",
+      "integrity": "sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3"
+      },
+      "peerDependencies": {
+        "ajv": "^8.8.2"
+      }
+    },
+    "node_modules/eslint-webpack-plugin/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/eslint-webpack-plugin/node_modules/jest-worker": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-28.1.1.tgz",
+      "integrity": "sha512-Au7slXB08C6h+xbJPp7VIb6U0XX5Kc9uel/WFc6/rcTzGiaVCBRngBExSYuXSLFPULPSYU3cJ3ybS988lNFQhQ==",
+      "dev": true,
+      "dependencies": {
+        "@types/node": "*",
+        "merge-stream": "^2.0.0",
+        "supports-color": "^8.0.0"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
+      }
+    },
+    "node_modules/eslint-webpack-plugin/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true
+    },
+    "node_modules/eslint-webpack-plugin/node_modules/schema-utils": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.0.0.tgz",
+      "integrity": "sha512-1edyXKgh6XnJsJSQ8mKWXnN/BVaIbFMLpouRUrXgVq7WYne5kw3MW7UPhO44uRXQSIpTSXoJbmrR2X0w9kUTyg==",
+      "dev": true,
+      "dependencies": {
+        "@types/json-schema": "^7.0.9",
+        "ajv": "^8.8.0",
+        "ajv-formats": "^2.1.1",
+        "ajv-keywords": "^5.0.0"
+      },
+      "engines": {
+        "node": ">= 12.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      }
+    },
+    "node_modules/eslint-webpack-plugin/node_modules/supports-color": {
+      "version": "8.1.1",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
+      "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/supports-color?sponsor=1"
+      }
+    },
+    "node_modules/eslint/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/eslint/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/eslint/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/eslint/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/eslint/node_modules/cross-spawn": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "dev": true,
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/eslint/node_modules/escape-string-regexp": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/eslint/node_modules/eslint-scope": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.1.1.tgz",
+      "integrity": "sha512-QKQM/UXpIiHcLqJ5AOyIW7XZmzjkzQXYE54n1++wb0u9V/abW3l9uQnxX8Z5Xd18xyKIMTUAyQ0k1e8pz6LUrw==",
+      "dev": true,
+      "dependencies": {
+        "esrecurse": "^4.3.0",
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
+    "node_modules/eslint/node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/eslint/node_modules/globals": {
+      "version": "13.15.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-13.15.0.tgz",
+      "integrity": "sha512-bpzcOlgDhMG070Av0Vy5Owklpv1I6+j96GhUI7Rh7IzDCKLzboflLrrfqMu8NquDbiR4EOQk7XzJwqVJxicxog==",
+      "dev": true,
+      "dependencies": {
+        "type-fest": "^0.20.2"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/eslint/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/eslint/node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/eslint/node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/eslint/node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/eslint/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/eslint/node_modules/type-fest": {
+      "version": "0.20.2",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
+      "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/eslint/node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/espree": {
+      "version": "9.3.2",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-9.3.2.tgz",
+      "integrity": "sha512-D211tC7ZwouTIuY5x9XnS0E9sWNChB7IYKX/Xp5eQj3nFXhqmiUDB9q27y76oFl8jTg3pXcQx/bpxMfs3CIZbA==",
+      "dev": true,
+      "dependencies": {
+        "acorn": "^8.7.1",
+        "acorn-jsx": "^5.3.2",
+        "eslint-visitor-keys": "^3.3.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
+    "node_modules/esprima": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
+      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
+      "dev": true,
+      "bin": {
+        "esparse": "bin/esparse.js",
+        "esvalidate": "bin/esvalidate.js"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/esquery": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.4.0.tgz",
+      "integrity": "sha512-cCDispWt5vHHtwMY2YrAQ4ibFkAL8RbH5YGBnZBc90MolvvfkkQcJro/aZiAQUlQ3qgrYS6D6v8Gc5G5CQsc9w==",
+      "dev": true,
+      "dependencies": {
+        "estraverse": "^5.1.0"
+      },
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
+    "node_modules/esquery/node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/esrecurse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
+      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
+      "dev": true,
+      "dependencies": {
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/esrecurse/node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/estraverse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
+      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/estree-walker": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-2.0.2.tgz",
+      "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="
+    },
+    "node_modules/esutils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/event-pubsub": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/event-pubsub/-/event-pubsub-4.3.0.tgz",
+      "integrity": "sha512-z7IyloorXvKbFx9Bpie2+vMJKKx1fH1EN5yiTfp8CiLOTptSYy1g8H4yDpGlEdshL1PBiFtBHepF2cNsqeEeFQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/eventemitter3": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-4.0.7.tgz",
+      "integrity": "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==",
+      "dev": true
+    },
+    "node_modules/events": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
+      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.8.x"
+      }
+    },
+    "node_modules/execa": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/execa/-/execa-1.0.0.tgz",
+      "integrity": "sha512-adbxcyWV46qiHyvSp50TKt05tB4tK3HcmF7/nxfAdhnox83seTDbwnaqKO4sXRy7roHAIFqJP/Rw/AuEbX61LA==",
+      "dev": true,
+      "dependencies": {
+        "cross-spawn": "^6.0.0",
+        "get-stream": "^4.0.0",
+        "is-stream": "^1.1.0",
+        "npm-run-path": "^2.0.0",
+        "p-finally": "^1.0.0",
+        "signal-exit": "^3.0.0",
+        "strip-eof": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/exit": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/exit/-/exit-0.1.2.tgz",
+      "integrity": "sha512-Zk/eNKV2zbjpKzrsQ+n1G6poVbErQxJ0LBOJXaKZ1EViLzH+hrLu9cdXI4zw9dBQJslwBEpbQ2P1oS7nDxs6jQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/expect": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/expect/-/expect-27.5.1.tgz",
+      "integrity": "sha512-E1q5hSUG2AmYQwQJ041nvgpkODHQvB+RKlB4IYdru6uJsyFTRyZAP463M+1lINorwbqAmUggi6+WwkD8lCS/Dw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "jest-get-type": "^27.5.1",
+        "jest-matcher-utils": "^27.5.1",
+        "jest-message-util": "^27.5.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/expect/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/expect/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/expect/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/expect/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/expect/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/expect/node_modules/jest-message-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+      "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.12.13",
+        "@jest/types": "^27.5.1",
+        "@types/stack-utils": "^2.0.0",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "micromatch": "^4.0.4",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/expect/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/express": {
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.18.1.tgz",
+      "integrity": "sha512-zZBcOX9TfehHQhtupq57OF8lFZ3UZi08Y97dwFCkD8p9d/d2Y3M+ykKcwaMDEL+4qyUolgBDX6AblpR3fL212Q==",
+      "dev": true,
+      "dependencies": {
+        "accepts": "~1.3.8",
+        "array-flatten": "1.1.1",
+        "body-parser": "1.20.0",
+        "content-disposition": "0.5.4",
+        "content-type": "~1.0.4",
+        "cookie": "0.5.0",
+        "cookie-signature": "1.0.6",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "finalhandler": "1.2.0",
+        "fresh": "0.5.2",
+        "http-errors": "2.0.0",
+        "merge-descriptors": "1.0.1",
+        "methods": "~1.1.2",
+        "on-finished": "2.4.1",
+        "parseurl": "~1.3.3",
+        "path-to-regexp": "0.1.7",
+        "proxy-addr": "~2.0.7",
+        "qs": "6.10.3",
+        "range-parser": "~1.2.1",
+        "safe-buffer": "5.2.1",
+        "send": "0.18.0",
+        "serve-static": "1.15.0",
+        "setprototypeof": "1.2.0",
+        "statuses": "2.0.1",
+        "type-is": "~1.6.18",
+        "utils-merge": "1.0.1",
+        "vary": "~1.1.2"
+      },
+      "engines": {
+        "node": ">= 0.10.0"
+      }
+    },
+    "node_modules/express/node_modules/array-flatten": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
+      "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
+      "dev": true
+    },
+    "node_modules/express/node_modules/debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "dev": true,
+      "dependencies": {
+        "ms": "2.0.0"
+      }
+    },
+    "node_modules/express/node_modules/ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "dev": true
+    },
+    "node_modules/express/node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
+    "node_modules/extend-shallow": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
+      "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==",
+      "dev": true,
+      "dependencies": {
+        "is-extendable": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "dev": true
+    },
+    "node_modules/fast-glob": {
+      "version": "3.2.11",
+      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.2.11.tgz",
+      "integrity": "sha512-xrO3+1bxSo3ZVHAnqzyuewYT6aMFHRAd4Kcs92MAonjwQZLsK9d0SF1IyQ3k5PoirxTW0Oe/RqFgMQ6TcNE5Ew==",
+      "dev": true,
+      "dependencies": {
+        "@nodelib/fs.stat": "^2.0.2",
+        "@nodelib/fs.walk": "^1.2.3",
+        "glob-parent": "^5.1.2",
+        "merge2": "^1.3.0",
+        "micromatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=8.6.0"
+      }
+    },
+    "node_modules/fast-glob/node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "dev": true,
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/fast-json-stable-stringify": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
+      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
+      "dev": true
+    },
+    "node_modules/fast-levenshtein": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
+      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
+      "dev": true
+    },
+    "node_modules/fast-text-encoding": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/fast-text-encoding/-/fast-text-encoding-1.0.6.tgz",
+      "integrity": "sha512-VhXlQgj9ioXCqGstD37E/HBeqEGV/qOD/kmbVG8h5xKBYvM1L3lR1Zn4555cQ8GkYbJa8aJSipLPndE1k6zK2w=="
+    },
+    "node_modules/fastq": {
+      "version": "1.13.0",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.13.0.tgz",
+      "integrity": "sha512-YpkpUnK8od0o1hmeSc7UUs/eB/vIPWJYjKck2QKIzAf71Vm1AAQ3EbuZB3g2JIy+pg+ERD0vqI79KyZiB2e2Nw==",
+      "dev": true,
+      "dependencies": {
+        "reusify": "^1.0.4"
+      }
+    },
+    "node_modules/faye-websocket": {
+      "version": "0.11.4",
+      "resolved": "https://registry.npmjs.org/faye-websocket/-/faye-websocket-0.11.4.tgz",
+      "integrity": "sha512-CzbClwlXAuiRQAlUyfqPgvPoNKTckTPGfwZV4ZdAhVcP2lh9KUxJg2b5GkE7XbjKQ3YJnQ9z6D9ntLAlB+tP8g==",
+      "dev": true,
+      "dependencies": {
+        "websocket-driver": ">=0.5.1"
+      },
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
+    "node_modules/fb-watchman": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.1.tgz",
+      "integrity": "sha512-DkPJKQeY6kKwmuMretBhr7G6Vodr7bFwDYTXIkfG1gjvNpaxBTQV3PbXg6bR1c1UP4jPOX0jHUbbHANL9vRjVg==",
+      "dev": true,
+      "dependencies": {
+        "bser": "2.1.1"
+      }
+    },
+    "node_modules/fetch-intercept": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/fetch-intercept/-/fetch-intercept-2.4.0.tgz",
+      "integrity": "sha512-BPZ2LM9Dh1ua2ovQf03N6rhWg1qxdVD5qK/G4llvcemt6M+jjxCuIDxJ+6IiG+uz//3UQmgfKEv0gOGvYIxZ7g=="
+    },
+    "node_modules/figures": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/figures/-/figures-2.0.0.tgz",
+      "integrity": "sha512-Oa2M9atig69ZkfwiApY8F2Yy+tzMbazyvqv21R0NsSC8floSOC09BbT1ITWAdoMGQvJ/aZnR1KMwdx9tvHnTNA==",
+      "dev": true,
+      "dependencies": {
+        "escape-string-regexp": "^1.0.5"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/file-entry-cache": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
+      "integrity": "sha512-7Gps/XWymbLk2QLYK4NzpMOrYjMhdIxXuIvy2QBsLE6ljuodKvdkWs/cpyJJ3CVIVpH0Oi1Hvg1ovbMzLdFBBg==",
+      "dev": true,
+      "dependencies": {
+        "flat-cache": "^3.0.4"
+      },
+      "engines": {
+        "node": "^10.12.0 || >=12.0.0"
+      }
+    },
+    "node_modules/fill-range": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
+      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
+      "dev": true,
+      "dependencies": {
+        "to-regex-range": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/finalhandler": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.2.0.tgz",
+      "integrity": "sha512-5uXcUVftlQMFnWC9qu/svkWv3GTd2PfUhK/3PLkYNAe7FbqJMt3515HaxE6eRL74GdsriiwujiawdaB1BpEISg==",
+      "dev": true,
+      "dependencies": {
+        "debug": "2.6.9",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "on-finished": "2.4.1",
+        "parseurl": "~1.3.3",
+        "statuses": "2.0.1",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/finalhandler/node_modules/debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "dev": true,
+      "dependencies": {
+        "ms": "2.0.0"
+      }
+    },
+    "node_modules/finalhandler/node_modules/ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "dev": true
+    },
+    "node_modules/find-cache-dir": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/find-cache-dir/-/find-cache-dir-3.3.2.tgz",
+      "integrity": "sha512-wXZV5emFEjrridIgED11OoUKLxiYjAcqot/NJdAkOhlJ+vGzwhOAfcG5OX1jP+S0PcjEn8bdMJv+g2jwQ3Onig==",
+      "dev": true,
+      "dependencies": {
+        "commondir": "^1.0.1",
+        "make-dir": "^3.0.2",
+        "pkg-dir": "^4.1.0"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/avajs/find-cache-dir?sponsor=1"
+      }
+    },
+    "node_modules/find-up": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
+      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
+      "dev": true,
+      "dependencies": {
+        "locate-path": "^5.0.0",
+        "path-exists": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/flat-cache": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-3.0.4.tgz",
+      "integrity": "sha512-dm9s5Pw7Jc0GvMYbshN6zchCA9RgQlzzEZX3vylR9IqFfS8XciblUXOKfW6SiuJ0e13eDYZoZV5wdrev7P3Nwg==",
+      "dev": true,
+      "dependencies": {
+        "flatted": "^3.1.0",
+        "rimraf": "^3.0.2"
+      },
+      "engines": {
+        "node": "^10.12.0 || >=12.0.0"
+      }
+    },
+    "node_modules/flatted": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.2.6.tgz",
+      "integrity": "sha512-0sQoMh9s0BYsm+12Huy/rkKxVu4R1+r96YX5cG44rHV0pQ6iC3Q+mkoMFaGWObMFYQxCVT+ssG1ksneA2MI9KQ==",
+      "dev": true
+    },
+    "node_modules/follow-redirects": {
+      "version": "1.15.1",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.1.tgz",
+      "integrity": "sha512-yLAMQs+k0b2m7cVxpS1VKJVvoz7SS9Td1zss3XRwXj+ZDH00RJgnuLx7E44wx02kQLrdM3aOOy+FpzS7+8OizA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/RubenVerborgh"
+        }
+      ],
+      "engines": {
+        "node": ">=4.0"
+      },
+      "peerDependenciesMeta": {
+        "debug": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/fork-ts-checker-webpack-plugin": {
+      "version": "6.5.2",
+      "resolved": "https://registry.npmjs.org/fork-ts-checker-webpack-plugin/-/fork-ts-checker-webpack-plugin-6.5.2.tgz",
+      "integrity": "sha512-m5cUmF30xkZ7h4tWUgTAcEaKmUW7tfyUyTqNNOz7OxWJ0v1VWKTcOvH8FWHUwSjlW/356Ijc9vi3XfcPstpQKA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.8.3",
+        "@types/json-schema": "^7.0.5",
+        "chalk": "^4.1.0",
+        "chokidar": "^3.4.2",
+        "cosmiconfig": "^6.0.0",
+        "deepmerge": "^4.2.2",
+        "fs-extra": "^9.0.0",
+        "glob": "^7.1.6",
+        "memfs": "^3.1.2",
+        "minimatch": "^3.0.4",
+        "schema-utils": "2.7.0",
+        "semver": "^7.3.2",
+        "tapable": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=10",
+        "yarn": ">=1.0.0"
+      },
+      "peerDependencies": {
+        "eslint": ">= 6",
+        "typescript": ">= 2.7",
+        "vue-template-compiler": "*",
+        "webpack": ">= 4"
+      },
+      "peerDependenciesMeta": {
+        "eslint": {
+          "optional": true
+        },
+        "vue-template-compiler": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/fork-ts-checker-webpack-plugin/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/fork-ts-checker-webpack-plugin/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/fork-ts-checker-webpack-plugin/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/fork-ts-checker-webpack-plugin/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/fork-ts-checker-webpack-plugin/node_modules/cosmiconfig": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-6.0.0.tgz",
+      "integrity": "sha512-xb3ZL6+L8b9JLLCx3ZdoZy4+2ECphCMo2PwqgP1tlfVq6M6YReyzBJtvWWtbDSpNr9hn96pkCiZqUcFEc+54Qg==",
+      "dev": true,
+      "dependencies": {
+        "@types/parse-json": "^4.0.0",
+        "import-fresh": "^3.1.0",
+        "parse-json": "^5.0.0",
+        "path-type": "^4.0.0",
+        "yaml": "^1.7.2"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/fork-ts-checker-webpack-plugin/node_modules/deepmerge": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.2.2.tgz",
+      "integrity": "sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/fork-ts-checker-webpack-plugin/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/fork-ts-checker-webpack-plugin/node_modules/schema-utils": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-2.7.0.tgz",
+      "integrity": "sha512-0ilKFI6QQF5nxDZLFn2dMjvc4hjg/Wkg7rHd3jK6/A4a1Hl9VFdQWvgB1UMGoU94pad1P/8N7fMcEnLnSiju8A==",
+      "dev": true,
+      "dependencies": {
+        "@types/json-schema": "^7.0.4",
+        "ajv": "^6.12.2",
+        "ajv-keywords": "^3.4.1"
+      },
+      "engines": {
+        "node": ">= 8.9.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      }
+    },
+    "node_modules/fork-ts-checker-webpack-plugin/node_modules/semver": {
+      "version": "7.5.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/fork-ts-checker-webpack-plugin/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/fork-ts-checker-webpack-plugin/node_modules/tapable": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-1.1.3.tgz",
+      "integrity": "sha512-4WK/bYZmj8xLr+HUCODHGF1ZFzsYffasLUgEiMBY4fgtltdO6B4WJtlSbPaDTLpYTcGVwM2qLnFTICEcNxs3kA==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/form-data": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-3.0.1.tgz",
+      "integrity": "sha512-RHkBKtLWUVwd7SqRIvCZMEvAMoGUp0XU+seQiZejj0COz3RI3hWP4sCv3gZWWLjJTd7rGwcsF5eKZGii0r/hbg==",
+      "dev": true,
+      "dependencies": {
+        "asynckit": "^0.4.0",
+        "combined-stream": "^1.0.8",
+        "mime-types": "^2.1.12"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/fraction.js": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-4.2.0.tgz",
+      "integrity": "sha512-MhLuK+2gUcnZe8ZHlaaINnQLl0xRIGRfcGk2yl8xoQAfHrSsL3rYu6FCmBdkdbhc9EPlwyGHewaRsvwRMJtAlA==",
+      "dev": true,
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "type": "patreon",
+        "url": "https://www.patreon.com/infusion"
+      }
+    },
+    "node_modules/fresh": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
+      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/fs-extra": {
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
+      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
+      "dev": true,
+      "dependencies": {
+        "at-least-node": "^1.0.0",
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/fs-monkey": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.0.3.tgz",
+      "integrity": "sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==",
+      "dev": true
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
+      "dev": true
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/function-bind": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.1.tgz",
+      "integrity": "sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A==",
+      "dev": true
+    },
+    "node_modules/functional-red-black-tree": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/functional-red-black-tree/-/functional-red-black-tree-1.0.1.tgz",
+      "integrity": "sha512-dsKNQNdj6xA3T+QlADDA7mOSlX0qiMINjn0cgr+eGHGsbSHzTabcIogz2+p/iqP1Xs6EP/sS2SbqH+brGTbq0g==",
+      "dev": true
+    },
+    "node_modules/gensync": {
+      "version": "1.0.0-beta.2",
+      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
+      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/get-caller-file": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
+      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
+      "dev": true,
+      "engines": {
+        "node": "6.* || 8.* || >= 10.*"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.1.2.tgz",
+      "integrity": "sha512-Jfm3OyCxHh9DJyc28qGk+JmfkpO41A4XkneDSujN9MDXrm4oDKdHvndhZ2dN94+ERNfkYJWDclW6k2L/ZGHjXA==",
+      "dev": true,
+      "dependencies": {
+        "function-bind": "^1.1.1",
+        "has": "^1.0.3",
+        "has-symbols": "^1.0.3"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/get-package-type": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/get-package-type/-/get-package-type-0.1.0.tgz",
+      "integrity": "sha512-pjzuKtY64GYfWizNAJ0fr9VqttZkNiK2iS430LtIHzjBEr6bX8Am2zm4sW4Ro5wjWW5cAlRL1qAMTcXbjNAO2Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/get-stream": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-4.1.0.tgz",
+      "integrity": "sha512-GMat4EJ5161kIy2HevLlr4luNjBgvmj413KaQA7jt4V8B4RDsfpHk7WQ9GVqfYyyx8OS/L66Kox+rJRNklLK7w==",
+      "dev": true,
+      "dependencies": {
+        "pump": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "dev": true,
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/glob-parent": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
+      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
+      "dev": true,
+      "dependencies": {
+        "is-glob": "^4.0.3"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/glob-to-regexp": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/glob-to-regexp/-/glob-to-regexp-0.4.1.tgz",
+      "integrity": "sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==",
+      "dev": true
+    },
+    "node_modules/globals": {
+      "version": "11.12.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz",
+      "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/globby": {
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/globby/-/globby-11.1.0.tgz",
+      "integrity": "sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==",
+      "dev": true,
+      "dependencies": {
+        "array-union": "^2.1.0",
+        "dir-glob": "^3.0.1",
+        "fast-glob": "^3.2.9",
+        "ignore": "^5.2.0",
+        "merge2": "^1.4.1",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/good-listener": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/good-listener/-/good-listener-1.2.2.tgz",
+      "integrity": "sha512-goW1b+d9q/HIwbVYZzZ6SsTr4IgE+WA44A0GmPIQstuOrgsFcT7VEJ48nmr9GaRtNu0XTKacFLGnBPAM6Afouw==",
+      "dependencies": {
+        "delegate": "^3.1.2"
+      }
+    },
+    "node_modules/graceful-fs": {
+      "version": "4.2.10",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.10.tgz",
+      "integrity": "sha512-9ByhssR2fPVsNZj478qUUbKfmL0+t5BDVyjShtyZZLiK7ZDAArFFfopyOTj0M05wE2tJPisA4iTnnXl2YoPvOA==",
+      "dev": true
+    },
+    "node_modules/gzip-size": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/gzip-size/-/gzip-size-6.0.0.tgz",
+      "integrity": "sha512-ax7ZYomf6jqPTQ4+XCpUGyXKHk5WweS+e05MBO4/y3WJ5RkmPXNKvX+bx1behVILVwr6JSQvZAku021CHPXG3Q==",
+      "dev": true,
+      "dependencies": {
+        "duplexer": "^0.1.2"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/handle-thing": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/handle-thing/-/handle-thing-2.0.1.tgz",
+      "integrity": "sha512-9Qn4yBxelxoh2Ow62nP+Ka/kMnOXRi8BXnRaUwezLNhqelnN49xKz4F/dPP8OYLxLxq6JDtZb2i9XznUQbNPTg==",
+      "dev": true
+    },
+    "node_modules/has": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/has/-/has-1.0.3.tgz",
+      "integrity": "sha512-f2dvO0VU6Oej7RkWJGrehjbzMAjFp5/VKPp5tTpWIV4JHHZK1/BxbFRtf/siA2SWTe09caDmVtYYzWEIbBS4zw==",
+      "dev": true,
+      "dependencies": {
+        "function-bind": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4.0"
+      }
+    },
+    "node_modules/has-flag": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
+      "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/has-property-descriptors": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.0.tgz",
+      "integrity": "sha512-62DVLZGoiEBDHQyqG4w9xCuZ7eJEwNmJRWw2VY84Oedb7WFcA27fiEVe8oUQx9hAUJ4ekurquucTGwsyO1XGdQ==",
+      "dev": true,
+      "dependencies": {
+        "get-intrinsic": "^1.1.1"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-symbols": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.3.tgz",
+      "integrity": "sha512-l3LCuF6MgDNwTDKkdYGEihYjt5pRPbEg46rtlmnSPlUbgmB8LOIrKJbYYFBSbnPaJexMKtiPO8hmeRjRz2Td+A==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/has-tostringtag": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.0.tgz",
+      "integrity": "sha512-kFjcSNhnlGV1kyoGk7OXKSawH5JOb/LzUc5w9B02hOTO0dfFRjbHQKvg1d6cf3HbeUmtU9VbbV3qzZ2Teh97WQ==",
+      "dev": true,
+      "dependencies": {
+        "has-symbols": "^1.0.2"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/hash-sum": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/hash-sum/-/hash-sum-2.0.0.tgz",
+      "integrity": "sha512-WdZTbAByD+pHfl/g9QSsBIIwy8IT+EsPiKDs0KNX+zSHhdDLFKdZu0BQHljvO+0QI/BasbMSUa8wYNCZTvhslg==",
+      "dev": true
+    },
+    "node_modules/he": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/he/-/he-1.2.0.tgz",
+      "integrity": "sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==",
+      "dev": true,
+      "bin": {
+        "he": "bin/he"
+      }
+    },
+    "node_modules/highlight.js": {
+      "version": "10.7.3",
+      "resolved": "https://registry.npmjs.org/highlight.js/-/highlight.js-10.7.3.tgz",
+      "integrity": "sha512-tzcUFauisWKNHaRkN4Wjl/ZA07gENAjFl3J/c480dprkGTg5EQstgaNFqBfUqCq54kZRIEcreTsAgF/m2quD7A==",
+      "dev": true,
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/hosted-git-info": {
+      "version": "2.8.9",
+      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.9.tgz",
+      "integrity": "sha512-mxIDAb9Lsm6DoOJ7xH+5+X4y1LU/4Hi50L9C5sIswK3JzULS4bwk1FvjdBgvYR4bzT4tuUQiC15FE2f5HbLvYw==",
+      "dev": true
+    },
+    "node_modules/hpack.js": {
+      "version": "2.1.6",
+      "resolved": "https://registry.npmjs.org/hpack.js/-/hpack.js-2.1.6.tgz",
+      "integrity": "sha512-zJxVehUdMGIKsRaNt7apO2Gqp0BdqW5yaiGHXXmbpvxgBYVZnAql+BJb4RO5ad2MgpbZKn5G6nMnegrH1FcNYQ==",
+      "dev": true,
+      "dependencies": {
+        "inherits": "^2.0.1",
+        "obuf": "^1.0.0",
+        "readable-stream": "^2.0.1",
+        "wbuf": "^1.1.0"
+      }
+    },
+    "node_modules/hpack.js/node_modules/readable-stream": {
+      "version": "2.3.7",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.7.tgz",
+      "integrity": "sha512-Ebho8K4jIbHAxnuxi7o42OrZgF/ZTNcsZj6nRKyUmkhLFq8CHItp/fy6hQZuZmP/n3yZ9VBUbp4zz/mX8hmYPw==",
+      "dev": true,
+      "dependencies": {
+        "core-util-is": "~1.0.0",
+        "inherits": "~2.0.3",
+        "isarray": "~1.0.0",
+        "process-nextick-args": "~2.0.0",
+        "safe-buffer": "~5.1.1",
+        "string_decoder": "~1.1.1",
+        "util-deprecate": "~1.0.1"
+      }
+    },
+    "node_modules/hpack.js/node_modules/string_decoder": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+      "dev": true,
+      "dependencies": {
+        "safe-buffer": "~5.1.0"
+      }
+    },
+    "node_modules/html-encoding-sniffer": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-2.0.1.tgz",
+      "integrity": "sha512-D5JbOMBIR/TVZkubHT+OyT2705QvogUW4IBn6nHd756OwieSF9aDYFj4dv6HHEVGYbHaLETa3WggZYWWMyy3ZQ==",
+      "dev": true,
+      "dependencies": {
+        "whatwg-encoding": "^1.0.5"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/html-entities": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/html-entities/-/html-entities-2.3.3.tgz",
+      "integrity": "sha512-DV5Ln36z34NNTDgnz0EWGBLZENelNAtkiFA4kyNOG2tDI6Mz1uSWiq1wAKdyjnJwyDiDO7Fa2SO1CTxPXL8VxA==",
+      "dev": true
+    },
+    "node_modules/html-escaper": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
+      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
+      "dev": true
+    },
+    "node_modules/html-minifier-terser": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/html-minifier-terser/-/html-minifier-terser-6.1.0.tgz",
+      "integrity": "sha512-YXxSlJBZTP7RS3tWnQw74ooKa6L9b9i9QYXY21eUEvhZ3u9XLfv6OnFsQq6RxkhHygsaUMvYsZRV5rU/OVNZxw==",
+      "dev": true,
+      "dependencies": {
+        "camel-case": "^4.1.2",
+        "clean-css": "^5.2.2",
+        "commander": "^8.3.0",
+        "he": "^1.2.0",
+        "param-case": "^3.0.4",
+        "relateurl": "^0.2.7",
+        "terser": "^5.10.0"
+      },
+      "bin": {
+        "html-minifier-terser": "cli.js"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/html-tags": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/html-tags/-/html-tags-3.2.0.tgz",
+      "integrity": "sha512-vy7ClnArOZwCnqZgvv+ddgHgJiAFXe3Ge9ML5/mBctVJoUoYPCdxVucOywjDARn6CVoh3dRSFdPHy2sX80L0Wg==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/html-webpack-plugin": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/html-webpack-plugin/-/html-webpack-plugin-5.5.0.tgz",
+      "integrity": "sha512-sy88PC2cRTVxvETRgUHFrL4No3UxvcH8G1NepGhqaTT+GXN2kTamqasot0inS5hXeg1cMbFDt27zzo9p35lZVw==",
+      "dev": true,
+      "dependencies": {
+        "@types/html-minifier-terser": "^6.0.0",
+        "html-minifier-terser": "^6.0.2",
+        "lodash": "^4.17.21",
+        "pretty-error": "^4.0.0",
+        "tapable": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/html-webpack-plugin"
+      },
+      "peerDependencies": {
+        "webpack": "^5.20.0"
+      }
+    },
+    "node_modules/htmlparser2": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-6.1.0.tgz",
+      "integrity": "sha512-gyyPk6rgonLFEDGoeRgQNaEUvdJ4ktTmmUh/h2t7s+M8oPpIPxgNACWa+6ESR57kXstwqPiCut0V8NRpcwgU7A==",
+      "dev": true,
+      "funding": [
+        "https://github.com/fb55/htmlparser2?sponsor=1",
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fb55"
+        }
+      ],
+      "dependencies": {
+        "domelementtype": "^2.0.1",
+        "domhandler": "^4.0.0",
+        "domutils": "^2.5.2",
+        "entities": "^2.0.0"
+      }
+    },
+    "node_modules/http-deceiver": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/http-deceiver/-/http-deceiver-1.2.7.tgz",
+      "integrity": "sha512-LmpOGxTfbpgtGVxJrj5k7asXHCgNZp5nLfp+hWc8QQRqtb7fUy6kRY3BO1h9ddF6yIPYUARgxGOwB42DnxIaNw==",
+      "dev": true
+    },
+    "node_modules/http-errors": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.0.tgz",
+      "integrity": "sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==",
+      "dev": true,
+      "dependencies": {
+        "depd": "2.0.0",
+        "inherits": "2.0.4",
+        "setprototypeof": "1.2.0",
+        "statuses": "2.0.1",
+        "toidentifier": "1.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/http-parser-js": {
+      "version": "0.5.8",
+      "resolved": "https://registry.npmjs.org/http-parser-js/-/http-parser-js-0.5.8.tgz",
+      "integrity": "sha512-SGeBX54F94Wgu5RH3X5jsDtf4eHyRogWX1XGT3b4HuW3tQPM4AaBzoUji/4AAJNXCEOWZ5O0DgZmJw1947gD5Q==",
+      "dev": true
+    },
+    "node_modules/http-proxy": {
+      "version": "1.18.1",
+      "resolved": "https://registry.npmjs.org/http-proxy/-/http-proxy-1.18.1.tgz",
+      "integrity": "sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==",
+      "dev": true,
+      "dependencies": {
+        "eventemitter3": "^4.0.0",
+        "follow-redirects": "^1.0.0",
+        "requires-port": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/http-proxy-agent": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-4.0.1.tgz",
+      "integrity": "sha512-k0zdNgqWTGA6aeIRVpvfVob4fL52dTfaehylg0Y4UvSySvOq/Y+BOyPrgpUrA7HylqvU8vIZGsRuXmspskV0Tg==",
+      "dev": true,
+      "dependencies": {
+        "@tootallnate/once": "1",
+        "agent-base": "6",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/http-proxy-middleware": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.6.tgz",
+      "integrity": "sha512-ya/UeJ6HVBYxrgYotAZo1KvPWlgB48kUJLDePFeneHsVujFaW5WNj2NgWCAE//B1Dl02BIfYlpNgBy8Kf8Rjmw==",
+      "dev": true,
+      "dependencies": {
+        "@types/http-proxy": "^1.17.8",
+        "http-proxy": "^1.18.1",
+        "is-glob": "^4.0.1",
+        "is-plain-obj": "^3.0.0",
+        "micromatch": "^4.0.2"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "@types/express": "^4.17.13"
+      },
+      "peerDependenciesMeta": {
+        "@types/express": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+      "dev": true,
+      "dependencies": {
+        "agent-base": "6",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/human-signals": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz",
+      "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==",
+      "dev": true,
+      "engines": {
+        "node": ">=10.17.0"
+      }
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.4.24",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
+      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+      "dev": true,
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/icss-utils": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/icss-utils/-/icss-utils-5.1.0.tgz",
+      "integrity": "sha512-soFhflCVWLfRNOPU3iv5Z9VUdT44xFRbzjLsEzSr5AQmgqPMTHdU3PMT1Cf1ssx8fLNJDA1juftYl+PUcv3MqA==",
+      "dev": true,
+      "engines": {
+        "node": "^10 || ^12 || >= 14"
+      },
+      "peerDependencies": {
+        "postcss": "^8.1.0"
+      }
+    },
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
+    "node_modules/ignore": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.2.0.tgz",
+      "integrity": "sha512-CmxgYGiEPCLhfLnpPp1MoRmifwEIOgjcHXxOBjv7mY96c+eWScsOP9c112ZyLdWHi0FxHjI+4uVhKYp/gcdRmQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/import-fresh": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.0.tgz",
+      "integrity": "sha512-veYYhQa+D1QBKznvhUHxb8faxlrwUnxseDAbAp457E0wLNio2bOSKnjYDhMj+YiAq61xrMGhQk9iXVk5FzgQMw==",
+      "dev": true,
+      "dependencies": {
+        "parent-module": "^1.0.0",
+        "resolve-from": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/import-local": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.1.0.tgz",
+      "integrity": "sha512-ASB07uLtnDs1o6EHjKpX34BKYDSqnFerfTOJL2HvMqF70LnxpjkzDB8J44oT9pu4AMPkQwf8jl6szgvNd2tRIg==",
+      "dev": true,
+      "dependencies": {
+        "pkg-dir": "^4.2.0",
+        "resolve-cwd": "^3.0.0"
+      },
+      "bin": {
+        "import-local-fixture": "fixtures/cli.js"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/imurmurhash": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
+      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.8.19"
+      }
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "dev": true,
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "dev": true
+    },
+    "node_modules/ini": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+      "dev": true
+    },
+    "node_modules/ipaddr.js": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-2.0.1.tgz",
+      "integrity": "sha512-1qTgH9NG+IIJ4yfKs2e6Pp1bZg8wbDbKHT21HrLIeYBTRLgMYKnMTPAuI3Lcs61nfx5h1xlXnbJtH1kX5/d/ng==",
+      "dev": true,
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/is-arrayish": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz",
+      "integrity": "sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==",
+      "dev": true
+    },
+    "node_modules/is-binary-path": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/is-binary-path/-/is-binary-path-2.1.0.tgz",
+      "integrity": "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==",
+      "dev": true,
+      "dependencies": {
+        "binary-extensions": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-buffer": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz",
+      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
+      "dev": true
+    },
+    "node_modules/is-ci": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/is-ci/-/is-ci-1.2.1.tgz",
+      "integrity": "sha512-s6tfsaQaQi3JNciBH6shVqEDvhGut0SUXr31ag8Pd8BBbVVlcGfWhpPmEOoM6RJ5TFhbypvf5yyRw/VXW1IiWg==",
+      "dev": true,
+      "dependencies": {
+        "ci-info": "^1.5.0"
+      },
+      "bin": {
+        "is-ci": "bin.js"
+      }
+    },
+    "node_modules/is-ci/node_modules/ci-info": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-1.6.0.tgz",
+      "integrity": "sha512-vsGdkwSCDpWmP80ncATX7iea5DWQemg1UgCW5J8tqjU3lYw4FBYuj89J0CTVomA7BEfvSZd84GmHko+MxFQU2A==",
+      "dev": true
+    },
+    "node_modules/is-core-module": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.9.0.tgz",
+      "integrity": "sha512-+5FPy5PnwmO3lvfMb0AsoPaBG+5KHUI0wYFXOtYPnVVVspTFUuMZNfNaNVRt3FZadstu2c8x23vykRW/NBoU6A==",
+      "dev": true,
+      "dependencies": {
+        "has": "^1.0.3"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-docker": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
+      "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
+      "dev": true,
+      "bin": {
+        "is-docker": "cli.js"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/is-expression": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/is-expression/-/is-expression-4.0.0.tgz",
+      "integrity": "sha512-zMIXX63sxzG3XrkHkrAPvm/OVZVSCPNkwMHU8oTX7/U3AL78I0QXCEICXUM13BIa8TYGZ68PiTKfQz3yaTNr4A==",
+      "dev": true,
+      "dependencies": {
+        "acorn": "^7.1.1",
+        "object-assign": "^4.1.1"
+      }
+    },
+    "node_modules/is-expression/node_modules/acorn": {
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
+      "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
+      "dev": true,
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/is-extendable": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-0.1.1.tgz",
+      "integrity": "sha512-5BMULNob1vgFX6EjQw5izWDxrecWK9AM72rugNr0TFldMOi0fj6Jk+zeKIt0xGj4cEfQIJth4w3OKWOJ4f+AFw==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-file-esm": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-file-esm/-/is-file-esm-1.0.0.tgz",
+      "integrity": "sha512-rZlaNKb4Mr8WlRu2A9XdeoKgnO5aA53XdPHgCKVyCrQ/rWi89RET1+bq37Ru46obaQXeiX4vmFIm1vks41hoSA==",
+      "dev": true,
+      "dependencies": {
+        "read-pkg-up": "^7.0.1"
+      }
+    },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-generator-fn": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/is-generator-fn/-/is-generator-fn-2.1.0.tgz",
+      "integrity": "sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "dev": true,
+      "dependencies": {
+        "is-extglob": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-interactive": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-interactive/-/is-interactive-1.0.0.tgz",
+      "integrity": "sha512-2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-number": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.12.0"
+      }
+    },
+    "node_modules/is-plain-obj": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-3.0.0.tgz",
+      "integrity": "sha512-gwsOE28k+23GP1B6vFl1oVh/WOzmawBrKwo5Ev6wMKzPkaXaCDIQKzLnvsA42DRlbVTWorkgTKIviAKCWkfUwA==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/is-plain-object": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-2.0.4.tgz",
+      "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==",
+      "dev": true,
+      "dependencies": {
+        "isobject": "^3.0.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-potential-custom-element-name": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
+      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
+      "dev": true
+    },
+    "node_modules/is-regex": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.4.tgz",
+      "integrity": "sha512-kvRdxDsxZjhzUX07ZnLydzS1TU/TJlTUHHY4YLL87e37oUA49DfkLqgy+VjFocowy29cKvcSiu+kIv728jTTVg==",
+      "dev": true,
+      "dependencies": {
+        "call-bind": "^1.0.2",
+        "has-tostringtag": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/is-stream": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-1.1.0.tgz",
+      "integrity": "sha512-uQPm8kcs47jx38atAcWTVxyltQYoPT68y9aWYdV6yWXSyW8mzSat0TL6CiWdZeCdF3KrAvpVtnHbTv4RN+rqdQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-typedarray": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-typedarray/-/is-typedarray-1.0.0.tgz",
+      "integrity": "sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA==",
+      "dev": true
+    },
+    "node_modules/is-unicode-supported": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-0.1.0.tgz",
+      "integrity": "sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/is-whitespace": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/is-whitespace/-/is-whitespace-0.3.0.tgz",
+      "integrity": "sha512-RydPhl4S6JwAyj0JJjshWJEFG6hNye3pZFBRZaTUfZFwGHxzppNaNOVgQuS/E/SlhrApuMXrpnK1EEIXfdo3Dg==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-wsl": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
+      "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
+      "dev": true,
+      "dependencies": {
+        "is-docker": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/isarray": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
+      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
+      "dev": true
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "dev": true
+    },
+    "node_modules/isobject": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
+      "integrity": "sha512-WhB9zCku7EGTj/HQQRz5aUQEUeoQZH2bWcltRErOpymJ4boYE6wL9Tbr23krRPSZ+C5zqNSrSw+Cc7sZZ4b7vg==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/istanbul-lib-coverage": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.0.tgz",
+      "integrity": "sha512-eOeJ5BHCmHYvQK7xt9GkdHuzuCGS1Y6g9Gvnx3Ym33fz/HpLRYxiS0wHNr+m/MBC8B647Xt608vCDEvhl9c6Mw==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/istanbul-lib-instrument": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-instrument/-/istanbul-lib-instrument-5.2.0.tgz",
+      "integrity": "sha512-6Lthe1hqXHBNsqvgDzGO6l03XNeu3CrG4RqQ1KM9+l5+jNGpEJfIELx1NS3SEHmJQA8np/u+E4EPRKRiu6m19A==",
+      "dev": true,
+      "dependencies": {
+        "@babel/core": "^7.12.3",
+        "@babel/parser": "^7.14.7",
+        "@istanbuljs/schema": "^0.1.2",
+        "istanbul-lib-coverage": "^3.2.0",
+        "semver": "^6.3.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/istanbul-lib-report": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.0.tgz",
+      "integrity": "sha512-wcdi+uAKzfiGT2abPpKZ0hSU1rGQjUQnLvtY5MpQ7QCTahD3VODhcu4wcfY1YtkGaDD5yuydOLINXsfbus9ROw==",
+      "dev": true,
+      "dependencies": {
+        "istanbul-lib-coverage": "^3.0.0",
+        "make-dir": "^3.0.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/istanbul-lib-report/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/istanbul-lib-report/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/istanbul-lib-source-maps": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-source-maps/-/istanbul-lib-source-maps-4.0.1.tgz",
+      "integrity": "sha512-n3s8EwkdFIJCG3BPKBYvskgXGoy88ARzvegkitk60NxRdwltLOTaH7CUiMRXvwYorl0Q712iEjcWB+fK/MrWVw==",
+      "dev": true,
+      "dependencies": {
+        "debug": "^4.1.1",
+        "istanbul-lib-coverage": "^3.0.0",
+        "source-map": "^0.6.1"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-reports": {
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.1.4.tgz",
+      "integrity": "sha512-r1/DshN4KSE7xWEknZLLLLDn5CJybV3nw01VTkp6D5jzLuELlcbudfj/eSQFvrKsJuTVCGnePO7ho82Nw9zzfw==",
+      "dev": true,
+      "dependencies": {
+        "html-escaper": "^2.0.0",
+        "istanbul-lib-report": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/javascript-stringify": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/javascript-stringify/-/javascript-stringify-2.1.0.tgz",
+      "integrity": "sha512-JVAfqNPTvNq3sB/VHQJAFxN/sPgKnsKrCwyRt15zwNCdrMMJDdcEOdubuy+DuJYYdm0ox1J4uzEuYKkN+9yhVg==",
+      "dev": true
+    },
+    "node_modules/jest": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest/-/jest-27.5.1.tgz",
+      "integrity": "sha512-Yn0mADZB89zTtjkPJEXwrac3LHudkQMR+Paqa8uxJHCBr9agxztUifWCyiYrjhMPBoUVBjyny0I7XH6ozDr7QQ==",
+      "dev": true,
+      "dependencies": {
+        "@jest/core": "^27.5.1",
+        "import-local": "^3.0.2",
+        "jest-cli": "^27.5.1"
+      },
+      "bin": {
+        "jest": "bin/jest.js"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      },
+      "peerDependencies": {
+        "node-notifier": "^8.0.1 || ^9.0.0 || ^10.0.0"
+      },
+      "peerDependenciesMeta": {
+        "node-notifier": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/jest-changed-files": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-27.5.1.tgz",
+      "integrity": "sha512-buBLMiByfWGCoMsLLzGUUSpAmIAGnbR2KJoMN10ziLhOLvP4e0SlypHnAel8iqQXTrcbmfEY9sSqae5sgUsTvw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "execa": "^5.0.0",
+        "throat": "^6.0.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-changed-files/node_modules/cross-spawn": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "dev": true,
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/jest-changed-files/node_modules/execa": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
+      "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
+      "dev": true,
+      "dependencies": {
+        "cross-spawn": "^7.0.3",
+        "get-stream": "^6.0.0",
+        "human-signals": "^2.1.0",
+        "is-stream": "^2.0.0",
+        "merge-stream": "^2.0.0",
+        "npm-run-path": "^4.0.1",
+        "onetime": "^5.1.2",
+        "signal-exit": "^3.0.3",
+        "strip-final-newline": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/execa?sponsor=1"
+      }
+    },
+    "node_modules/jest-changed-files/node_modules/get-stream": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
+      "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jest-changed-files/node_modules/is-stream": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jest-changed-files/node_modules/npm-run-path": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
+      "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
+      "dev": true,
+      "dependencies": {
+        "path-key": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-changed-files/node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-changed-files/node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-changed-files/node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-changed-files/node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/jest-circus": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-27.5.1.tgz",
+      "integrity": "sha512-D95R7x5UtlMA5iBYsOHFFbMD/GVA4R/Kdq15f7xYWUfWHBto9NYRsOvnSauTgdF+ogCpJ4tyKOXhUifxS65gdw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/environment": "^27.5.1",
+        "@jest/test-result": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "co": "^4.6.0",
+        "dedent": "^0.7.0",
+        "expect": "^27.5.1",
+        "is-generator-fn": "^2.0.0",
+        "jest-each": "^27.5.1",
+        "jest-matcher-utils": "^27.5.1",
+        "jest-message-util": "^27.5.1",
+        "jest-runtime": "^27.5.1",
+        "jest-snapshot": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3",
+        "throat": "^6.0.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-circus/node_modules/@jest/console": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+      "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "jest-message-util": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-circus/node_modules/@jest/test-result": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+      "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+      "dev": true,
+      "dependencies": {
+        "@jest/console": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "collect-v8-coverage": "^1.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-circus/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-circus/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-circus/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-circus/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-circus/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-circus/node_modules/jest-message-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+      "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.12.13",
+        "@jest/types": "^27.5.1",
+        "@types/stack-utils": "^2.0.0",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "micromatch": "^4.0.4",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-circus/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-cli": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-27.5.1.tgz",
+      "integrity": "sha512-Hc6HOOwYq4/74/c62dEE3r5elx8wjYqxY0r0G/nFrLDPMFRu6RA/u8qINOIkvhxG7mMQ5EJsOGfRpI8L6eFUVw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/core": "^27.5.1",
+        "@jest/test-result": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "chalk": "^4.0.0",
+        "exit": "^0.1.2",
+        "graceful-fs": "^4.2.9",
+        "import-local": "^3.0.2",
+        "jest-config": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "jest-validate": "^27.5.1",
+        "prompts": "^2.0.1",
+        "yargs": "^16.2.0"
+      },
+      "bin": {
+        "jest": "bin/jest.js"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      },
+      "peerDependencies": {
+        "node-notifier": "^8.0.1 || ^9.0.0 || ^10.0.0"
+      },
+      "peerDependenciesMeta": {
+        "node-notifier": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/jest-cli/node_modules/@jest/console": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+      "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "jest-message-util": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-cli/node_modules/@jest/test-result": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+      "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+      "dev": true,
+      "dependencies": {
+        "@jest/console": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "collect-v8-coverage": "^1.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-cli/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-cli/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-cli/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-cli/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-cli/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-cli/node_modules/jest-message-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+      "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.12.13",
+        "@jest/types": "^27.5.1",
+        "@types/stack-utils": "^2.0.0",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "micromatch": "^4.0.4",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-cli/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-config": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-27.5.1.tgz",
+      "integrity": "sha512-5sAsjm6tGdsVbW9ahcChPAFCk4IlkQUknH5AvKjuLTSlcO/wCZKyFdn7Rg0EkC+OGgWODEy2hDpWB1PgzH0JNA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/core": "^7.8.0",
+        "@jest/test-sequencer": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "babel-jest": "^27.5.1",
+        "chalk": "^4.0.0",
+        "ci-info": "^3.2.0",
+        "deepmerge": "^4.2.2",
+        "glob": "^7.1.1",
+        "graceful-fs": "^4.2.9",
+        "jest-circus": "^27.5.1",
+        "jest-environment-jsdom": "^27.5.1",
+        "jest-environment-node": "^27.5.1",
+        "jest-get-type": "^27.5.1",
+        "jest-jasmine2": "^27.5.1",
+        "jest-regex-util": "^27.5.1",
+        "jest-resolve": "^27.5.1",
+        "jest-runner": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "jest-validate": "^27.5.1",
+        "micromatch": "^4.0.4",
+        "parse-json": "^5.2.0",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "strip-json-comments": "^3.1.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      },
+      "peerDependencies": {
+        "ts-node": ">=9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ts-node": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/jest-config/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-config/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-config/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-config/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-config/node_modules/deepmerge": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.2.2.tgz",
+      "integrity": "sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/jest-config/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-config/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-diff": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-27.5.1.tgz",
+      "integrity": "sha512-m0NvkX55LDt9T4mctTEgnZk3fmEg3NRYutvMPWM/0iPnkFj2wIeF45O1718cMSOFO1vINkqmxqD8vE37uTEbqw==",
+      "dev": true,
+      "dependencies": {
+        "chalk": "^4.0.0",
+        "diff-sequences": "^27.5.1",
+        "jest-get-type": "^27.5.1",
+        "pretty-format": "^27.5.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-diff/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-diff/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-diff/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-diff/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-diff/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-diff/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-docblock": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-27.5.1.tgz",
+      "integrity": "sha512-rl7hlABeTsRYxKiUfpHrQrG4e2obOiTQWfMEH3PxPjOtdsfLQO4ReWSZaQ7DETm4xu07rl4q/h4zcKXyU0/OzQ==",
+      "dev": true,
+      "dependencies": {
+        "detect-newline": "^3.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-each": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-27.5.1.tgz",
+      "integrity": "sha512-1Ff6p+FbhT/bXQnEouYy00bkNSY7OUpfIcmdl8vZ31A1UUaurOLPA8a8BbJOF2RDUElwJhmeaV7LnagI+5UwNQ==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "chalk": "^4.0.0",
+        "jest-get-type": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "pretty-format": "^27.5.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-each/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-each/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-each/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-each/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-each/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-each/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-environment-jsdom": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-environment-jsdom/-/jest-environment-jsdom-27.5.1.tgz",
+      "integrity": "sha512-TFBvkTC1Hnnnrka/fUb56atfDtJ9VMZ94JkjTbggl1PEpwrYtUBKMezB3inLmWqQsXYLcMwNoDQwoBTAvFfsfw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/environment": "^27.5.1",
+        "@jest/fake-timers": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "jest-mock": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "jsdom": "^16.6.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-environment-node": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-27.5.1.tgz",
+      "integrity": "sha512-Jt4ZUnxdOsTGwSRAfKEnE6BcwsSPNOijjwifq5sDFSA2kesnXTvNqKHYgM0hDq3549Uf/KzdXNYn4wMZJPlFLw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/environment": "^27.5.1",
+        "@jest/fake-timers": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "jest-mock": "^27.5.1",
+        "jest-util": "^27.5.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-get-type": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-get-type/-/jest-get-type-27.5.1.tgz",
+      "integrity": "sha512-2KY95ksYSaK7DMBWQn6dQz3kqAf3BB64y2udeG+hv4KfSOb9qwcYQstTJc1KCbsix+wLZWZYN8t7nwX3GOBLRw==",
+      "dev": true,
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-haste-map": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-27.5.1.tgz",
+      "integrity": "sha512-7GgkZ4Fw4NFbMSDSpZwXeBiIbx+t/46nJ2QitkOjvwPYyZmqttu2TDSimMHP1EkPOi4xUZAN1doE5Vd25H4Jng==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "@types/graceful-fs": "^4.1.2",
+        "@types/node": "*",
+        "anymatch": "^3.0.3",
+        "fb-watchman": "^2.0.0",
+        "graceful-fs": "^4.2.9",
+        "jest-regex-util": "^27.5.1",
+        "jest-serializer": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "jest-worker": "^27.5.1",
+        "micromatch": "^4.0.4",
+        "walker": "^1.0.7"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "^2.3.2"
+      }
+    },
+    "node_modules/jest-jasmine2": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-jasmine2/-/jest-jasmine2-27.5.1.tgz",
+      "integrity": "sha512-jtq7VVyG8SqAorDpApwiJJImd0V2wv1xzdheGHRGyuT7gZm6gG47QEskOlzsN1PG/6WNaCo5pmwMHDf3AkG2pQ==",
+      "dev": true,
+      "dependencies": {
+        "@jest/environment": "^27.5.1",
+        "@jest/source-map": "^27.5.1",
+        "@jest/test-result": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "co": "^4.6.0",
+        "expect": "^27.5.1",
+        "is-generator-fn": "^2.0.0",
+        "jest-each": "^27.5.1",
+        "jest-matcher-utils": "^27.5.1",
+        "jest-message-util": "^27.5.1",
+        "jest-runtime": "^27.5.1",
+        "jest-snapshot": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "pretty-format": "^27.5.1",
+        "throat": "^6.0.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-jasmine2/node_modules/@jest/console": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+      "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "jest-message-util": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-jasmine2/node_modules/@jest/test-result": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+      "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+      "dev": true,
+      "dependencies": {
+        "@jest/console": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "collect-v8-coverage": "^1.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-jasmine2/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-jasmine2/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-jasmine2/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-jasmine2/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-jasmine2/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-jasmine2/node_modules/jest-message-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+      "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.12.13",
+        "@jest/types": "^27.5.1",
+        "@types/stack-utils": "^2.0.0",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "micromatch": "^4.0.4",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-jasmine2/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-leak-detector": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-27.5.1.tgz",
+      "integrity": "sha512-POXfWAMvfU6WMUXftV4HolnJfnPOGEu10fscNCA76KBpRRhcMN2c8d3iT2pxQS3HLbA+5X4sOUPzYO2NUyIlHQ==",
+      "dev": true,
+      "dependencies": {
+        "jest-get-type": "^27.5.1",
+        "pretty-format": "^27.5.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-matcher-utils": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-27.5.1.tgz",
+      "integrity": "sha512-z2uTx/T6LBaCoNWNFWwChLBKYxTMcGBRjAt+2SbP929/Fflb9aa5LGma654Rz8z9HLxsrUaYzxE9T/EFIL/PAw==",
+      "dev": true,
+      "dependencies": {
+        "chalk": "^4.0.0",
+        "jest-diff": "^27.5.1",
+        "jest-get-type": "^27.5.1",
+        "pretty-format": "^27.5.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-matcher-utils/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-matcher-utils/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-matcher-utils/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-matcher-utils/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-matcher-utils/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-matcher-utils/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-message-util": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-28.1.1.tgz",
+      "integrity": "sha512-xoDOOT66fLfmTRiqkoLIU7v42mal/SqwDKvfmfiWAdJMSJiU+ozgluO7KbvoAgiwIrrGZsV7viETjc8GNrA/IQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.12.13",
+        "@jest/types": "^28.1.1",
+        "@types/stack-utils": "^2.0.0",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "micromatch": "^4.0.4",
+        "pretty-format": "^28.1.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
+      }
+    },
+    "node_modules/jest-message-util/node_modules/@jest/types": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-28.1.1.tgz",
+      "integrity": "sha512-vRXVqSg1VhDnB8bWcmvLzmg0Bt9CRKVgHPXqYwvWMX3TvAjeO+nRuK6+VdTKCtWOvYlmkF/HqNAL/z+N3B53Kw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/schemas": "^28.0.2",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "@types/istanbul-reports": "^3.0.0",
+        "@types/node": "*",
+        "@types/yargs": "^17.0.8",
+        "chalk": "^4.0.0"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
+      }
+    },
+    "node_modules/jest-message-util/node_modules/@types/yargs": {
+      "version": "17.0.10",
+      "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.10.tgz",
+      "integrity": "sha512-gmEaFwpj/7f/ROdtIlci1R1VYU1J4j95m8T+Tj3iBgiBFKg1foE/PSl93bBd5T9LDXNPo8UlNN6W0qwD8O5OaA==",
+      "dev": true,
+      "dependencies": {
+        "@types/yargs-parser": "*"
+      }
+    },
+    "node_modules/jest-message-util/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-message-util/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-message-util/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-message-util/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-message-util/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-message-util/node_modules/pretty-format": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-28.1.1.tgz",
+      "integrity": "sha512-wwJbVTGFHeucr5Jw2bQ9P+VYHyLdAqedFLEkdQUVaBF/eiidDwH5OpilINq4mEfhbCjLnirt6HTTDhv1HaTIQw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/schemas": "^28.0.2",
+        "ansi-regex": "^5.0.1",
+        "ansi-styles": "^5.0.0",
+        "react-is": "^18.0.0"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
+      }
+    },
+    "node_modules/jest-message-util/node_modules/pretty-format/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-message-util/node_modules/react-is": {
+      "version": "18.2.0",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.2.0.tgz",
+      "integrity": "sha512-xWGDIW6x921xtzPkhiULtthJHoJvBbF3q26fzloPCK0hsvxtPVelvftw3zjbHWSkR2km9Z+4uxbDDK/6Zw9B8w==",
+      "dev": true
+    },
+    "node_modules/jest-message-util/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-mock": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-27.5.1.tgz",
+      "integrity": "sha512-K4jKbY1d4ENhbrG2zuPWaQBvDly+iZ2yAW+T1fATN78hc0sInwn7wZB8XtlNnvHug5RMwV897Xm4LqmPM4e2Og==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "@types/node": "*"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-pnp-resolver": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.2.tgz",
+      "integrity": "sha512-olV41bKSMm8BdnuMsewT4jqlZ8+3TCARAXjZGT9jcoSnrfUnRCqnMoF9XEeoWjbzObpqF9dRhHQj0Xb9QdF6/w==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      },
+      "peerDependencies": {
+        "jest-resolve": "*"
+      },
+      "peerDependenciesMeta": {
+        "jest-resolve": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/jest-regex-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-27.5.1.tgz",
+      "integrity": "sha512-4bfKq2zie+x16okqDXjXn9ql2B0dScQu+vcwe4TvFVhkVyuWLqpZrZtXxLLWoXYgn0E87I6r6GRYHF7wFZBUvg==",
+      "dev": true,
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-resolve": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-27.5.1.tgz",
+      "integrity": "sha512-FFDy8/9E6CV83IMbDpcjOhumAQPDyETnU2KZ1O98DwTnz8AOBsW/Xv3GySr1mOZdItLR+zDZ7I/UdTFbgSOVCw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "jest-haste-map": "^27.5.1",
+        "jest-pnp-resolver": "^1.2.2",
+        "jest-util": "^27.5.1",
+        "jest-validate": "^27.5.1",
+        "resolve": "^1.20.0",
+        "resolve.exports": "^1.1.0",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-resolve-dependencies": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-27.5.1.tgz",
+      "integrity": "sha512-QQOOdY4PE39iawDn5rzbIePNigfe5B9Z91GDD1ae/xNDlu9kaat8QQ5EKnNmVWPV54hUdxCVwwj6YMgR2O7IOg==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "jest-regex-util": "^27.5.1",
+        "jest-snapshot": "^27.5.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-resolve/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-resolve/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-resolve/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-resolve/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-resolve/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-resolve/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-runner": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-27.5.1.tgz",
+      "integrity": "sha512-g4NPsM4mFCOwFKXO4p/H/kWGdJp9V8kURY2lX8Me2drgXqG7rrZAx5kv+5H7wtt/cdFIjhqYx1HrlqWHaOvDaQ==",
+      "dev": true,
+      "dependencies": {
+        "@jest/console": "^27.5.1",
+        "@jest/environment": "^27.5.1",
+        "@jest/test-result": "^27.5.1",
+        "@jest/transform": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "emittery": "^0.8.1",
+        "graceful-fs": "^4.2.9",
+        "jest-docblock": "^27.5.1",
+        "jest-environment-jsdom": "^27.5.1",
+        "jest-environment-node": "^27.5.1",
+        "jest-haste-map": "^27.5.1",
+        "jest-leak-detector": "^27.5.1",
+        "jest-message-util": "^27.5.1",
+        "jest-resolve": "^27.5.1",
+        "jest-runtime": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "jest-worker": "^27.5.1",
+        "source-map-support": "^0.5.6",
+        "throat": "^6.0.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-runner/node_modules/@jest/console": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+      "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "jest-message-util": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-runner/node_modules/@jest/test-result": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+      "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+      "dev": true,
+      "dependencies": {
+        "@jest/console": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "collect-v8-coverage": "^1.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-runner/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-runner/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-runner/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-runner/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-runner/node_modules/emittery": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/emittery/-/emittery-0.8.1.tgz",
+      "integrity": "sha512-uDfvUjVrfGJJhymx/kz6prltenw1u7WrCg1oa94zYY8xxVpLLUu045LAT0dhDZdXG58/EpPL/5kA180fQ/qudg==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/emittery?sponsor=1"
+      }
+    },
+    "node_modules/jest-runner/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-runner/node_modules/jest-message-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+      "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.12.13",
+        "@jest/types": "^27.5.1",
+        "@types/stack-utils": "^2.0.0",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "micromatch": "^4.0.4",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-runner/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-runtime": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-27.5.1.tgz",
+      "integrity": "sha512-o7gxw3Gf+H2IGt8fv0RiyE1+r83FJBRruoA+FXrlHw6xEyBsU8ugA6IPfTdVyA0w8HClpbK+DGJxH59UrNMx8A==",
+      "dev": true,
+      "dependencies": {
+        "@jest/environment": "^27.5.1",
+        "@jest/fake-timers": "^27.5.1",
+        "@jest/globals": "^27.5.1",
+        "@jest/source-map": "^27.5.1",
+        "@jest/test-result": "^27.5.1",
+        "@jest/transform": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "chalk": "^4.0.0",
+        "cjs-module-lexer": "^1.0.0",
+        "collect-v8-coverage": "^1.0.0",
+        "execa": "^5.0.0",
+        "glob": "^7.1.3",
+        "graceful-fs": "^4.2.9",
+        "jest-haste-map": "^27.5.1",
+        "jest-message-util": "^27.5.1",
+        "jest-mock": "^27.5.1",
+        "jest-regex-util": "^27.5.1",
+        "jest-resolve": "^27.5.1",
+        "jest-snapshot": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "slash": "^3.0.0",
+        "strip-bom": "^4.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/@jest/console": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+      "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "jest-message-util": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/@jest/test-result": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+      "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+      "dev": true,
+      "dependencies": {
+        "@jest/console": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "collect-v8-coverage": "^1.0.0"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-runtime/node_modules/cross-spawn": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "dev": true,
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/execa": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
+      "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
+      "dev": true,
+      "dependencies": {
+        "cross-spawn": "^7.0.3",
+        "get-stream": "^6.0.0",
+        "human-signals": "^2.1.0",
+        "is-stream": "^2.0.0",
+        "merge-stream": "^2.0.0",
+        "npm-run-path": "^4.0.1",
+        "onetime": "^5.1.2",
+        "signal-exit": "^3.0.3",
+        "strip-final-newline": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sindresorhus/execa?sponsor=1"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/get-stream": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
+      "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/is-stream": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/jest-message-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+      "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.12.13",
+        "@jest/types": "^27.5.1",
+        "@types/stack-utils": "^2.0.0",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "micromatch": "^4.0.4",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/npm-run-path": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
+      "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
+      "dev": true,
+      "dependencies": {
+        "path-key": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/jest-serializer": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-serializer/-/jest-serializer-27.5.1.tgz",
+      "integrity": "sha512-jZCyo6iIxO1aqUxpuBlwTDMkzOAJS4a3eYz3YzgxxVQFwLeSA7Jfq5cbqCY+JLvTDrWirgusI/0KwxKMgrdf7w==",
+      "dev": true,
+      "dependencies": {
+        "@types/node": "*",
+        "graceful-fs": "^4.2.9"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-serializer-vue": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/jest-serializer-vue/-/jest-serializer-vue-2.0.2.tgz",
+      "integrity": "sha512-nK/YIFo6qe3i9Ge+hr3h4PpRehuPPGZFt8LDBdTHYldMb7ZWlkanZS8Ls7D8h6qmQP2lBQVDLP0DKn5bJ9QApQ==",
+      "dev": true,
+      "dependencies": {
+        "pretty": "2.0.0"
+      }
+    },
+    "node_modules/jest-snapshot": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-27.5.1.tgz",
+      "integrity": "sha512-yYykXI5a0I31xX67mgeLw1DZ0bJB+gpq5IpSuCAoyDi0+BhgU/RIrL+RTzDmkNTchvDFWKP8lp+w/42Z3us5sA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/core": "^7.7.2",
+        "@babel/generator": "^7.7.2",
+        "@babel/plugin-syntax-typescript": "^7.7.2",
+        "@babel/traverse": "^7.7.2",
+        "@babel/types": "^7.0.0",
+        "@jest/transform": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/babel__traverse": "^7.0.4",
+        "@types/prettier": "^2.1.5",
+        "babel-preset-current-node-syntax": "^1.0.0",
+        "chalk": "^4.0.0",
+        "expect": "^27.5.1",
+        "graceful-fs": "^4.2.9",
+        "jest-diff": "^27.5.1",
+        "jest-get-type": "^27.5.1",
+        "jest-haste-map": "^27.5.1",
+        "jest-matcher-utils": "^27.5.1",
+        "jest-message-util": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "natural-compare": "^1.4.0",
+        "pretty-format": "^27.5.1",
+        "semver": "^7.3.2"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-snapshot/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-snapshot/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-snapshot/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-snapshot/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-snapshot/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-snapshot/node_modules/jest-message-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+      "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.12.13",
+        "@jest/types": "^27.5.1",
+        "@types/stack-utils": "^2.0.0",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "micromatch": "^4.0.4",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-snapshot/node_modules/semver": {
+      "version": "7.5.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/jest-snapshot/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-transform-stub": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/jest-transform-stub/-/jest-transform-stub-2.0.0.tgz",
+      "integrity": "sha512-lspHaCRx/mBbnm3h4uMMS3R5aZzMwyNpNIJLXj4cEsV0mIUtS4IjYJLSoyjRCtnxb6RIGJ4NL2quZzfIeNhbkg==",
+      "dev": true
+    },
+    "node_modules/jest-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-27.5.1.tgz",
+      "integrity": "sha512-Kv2o/8jNvX1MQ0KGtw480E/w4fBCDOnH6+6DmeKi6LZUIlKA5kwY0YNdlzaWTiVgxqAqik11QyxDOKk543aKXw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "ci-info": "^3.2.0",
+        "graceful-fs": "^4.2.9",
+        "picomatch": "^2.2.3"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-util/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-util/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-util/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-util/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-util/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-util/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-validate": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-27.5.1.tgz",
+      "integrity": "sha512-thkNli0LYTmOI1tDB3FI1S1RTp/Bqyd9pTarJwL87OIBFuqEb5Apv5EaApEudYg4g86e3CT6kM0RowkhtEnCBQ==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^27.5.1",
+        "camelcase": "^6.2.0",
+        "chalk": "^4.0.0",
+        "jest-get-type": "^27.5.1",
+        "leven": "^3.1.0",
+        "pretty-format": "^27.5.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/jest-validate/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-validate/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-validate/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-validate/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-validate/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-validate/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-watch-typeahead": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/jest-watch-typeahead/-/jest-watch-typeahead-1.1.0.tgz",
+      "integrity": "sha512-Va5nLSJTN7YFtC2jd+7wsoe1pNe5K4ShLux/E5iHEwlB9AxaxmggY7to9KUqKojhaJw3aXqt5WAb4jGPOolpEw==",
+      "dev": true,
+      "dependencies": {
+        "ansi-escapes": "^4.3.1",
+        "chalk": "^4.0.0",
+        "jest-regex-util": "^28.0.0",
+        "jest-watcher": "^28.0.0",
+        "slash": "^4.0.0",
+        "string-length": "^5.0.1",
+        "strip-ansi": "^7.0.1"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "peerDependencies": {
+        "jest": "^27.0.0 || ^28.0.0"
+      }
+    },
+    "node_modules/jest-watch-typeahead/node_modules/ansi-escapes": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
+      "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
+      "dev": true,
+      "dependencies": {
+        "type-fest": "^0.21.3"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jest-watch-typeahead/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-watch-typeahead/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-watch-typeahead/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-watch-typeahead/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-watch-typeahead/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-watch-typeahead/node_modules/jest-regex-util": {
+      "version": "28.0.2",
+      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-28.0.2.tgz",
+      "integrity": "sha512-4s0IgyNIy0y9FK+cjoVYoxamT7Zeo7MhzqRGx7YDYmaQn1wucY9rotiGkBzzcMXTtjrCAP/f7f+E0F7+fxPNdw==",
+      "dev": true,
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
+      }
+    },
+    "node_modules/jest-watch-typeahead/node_modules/slash": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-4.0.0.tgz",
+      "integrity": "sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==",
+      "dev": true,
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jest-watch-typeahead/node_modules/string-length": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/string-length/-/string-length-5.0.1.tgz",
+      "integrity": "sha512-9Ep08KAMUn0OadnVaBuRdE2l615CQ508kr0XMadjClfYpdCyvrbFp6Taebo8yyxokQ4viUd/xPPUA4FGgUa0ow==",
+      "dev": true,
+      "dependencies": {
+        "char-regex": "^2.0.0",
+        "strip-ansi": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=12.20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jest-watch-typeahead/node_modules/string-length/node_modules/char-regex": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/char-regex/-/char-regex-2.0.1.tgz",
+      "integrity": "sha512-oSvEeo6ZUD7NepqAat3RqoucZ5SeqLJgOvVIwkafu6IP3V0pO38s/ypdVUmDDK6qIIHNlYHJAKX9E7R7HoKElw==",
+      "dev": true,
+      "engines": {
+        "node": ">=12.20"
+      }
+    },
+    "node_modules/jest-watch-typeahead/node_modules/strip-ansi": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.0.1.tgz",
+      "integrity": "sha512-cXNxvT8dFNRVfhVME3JAe98mkXDYN2O1l7jmcwMnOslDeESg1rF/OZMtK0nRAhiari1unG5cD4jG3rapUAkLbw==",
+      "dev": true,
+      "dependencies": {
+        "ansi-regex": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
+      }
+    },
+    "node_modules/jest-watch-typeahead/node_modules/strip-ansi/node_modules/ansi-regex": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.0.1.tgz",
+      "integrity": "sha512-n5M855fKb2SsfMIiFFoVrABHJC8QtHwVx+mHWP3QcEqBHYienj5dHSgjbxtC0WEZXYt4wcD6zrQElDPhFuZgfA==",
+      "dev": true,
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
+      }
+    },
+    "node_modules/jest-watch-typeahead/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-watch-typeahead/node_modules/type-fest": {
+      "version": "0.21.3",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
+      "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jest-watcher": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-28.1.1.tgz",
+      "integrity": "sha512-RQIpeZ8EIJMxbQrXpJQYIIlubBnB9imEHsxxE41f54ZwcqWLysL/A0ZcdMirf+XsMn3xfphVQVV4EW0/p7i7Ug==",
+      "dev": true,
+      "dependencies": {
+        "@jest/test-result": "^28.1.1",
+        "@jest/types": "^28.1.1",
+        "@types/node": "*",
+        "ansi-escapes": "^4.2.1",
+        "chalk": "^4.0.0",
+        "emittery": "^0.10.2",
+        "jest-util": "^28.1.1",
+        "string-length": "^4.0.1"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
+      }
+    },
+    "node_modules/jest-watcher/node_modules/@jest/types": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-28.1.1.tgz",
+      "integrity": "sha512-vRXVqSg1VhDnB8bWcmvLzmg0Bt9CRKVgHPXqYwvWMX3TvAjeO+nRuK6+VdTKCtWOvYlmkF/HqNAL/z+N3B53Kw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/schemas": "^28.0.2",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "@types/istanbul-reports": "^3.0.0",
+        "@types/node": "*",
+        "@types/yargs": "^17.0.8",
+        "chalk": "^4.0.0"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
+      }
+    },
+    "node_modules/jest-watcher/node_modules/@types/yargs": {
+      "version": "17.0.10",
+      "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.10.tgz",
+      "integrity": "sha512-gmEaFwpj/7f/ROdtIlci1R1VYU1J4j95m8T+Tj3iBgiBFKg1foE/PSl93bBd5T9LDXNPo8UlNN6W0qwD8O5OaA==",
+      "dev": true,
+      "dependencies": {
+        "@types/yargs-parser": "*"
+      }
+    },
+    "node_modules/jest-watcher/node_modules/ansi-escapes": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
+      "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
+      "dev": true,
+      "dependencies": {
+        "type-fest": "^0.21.3"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jest-watcher/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/jest-watcher/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/jest-watcher/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/jest-watcher/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/jest-watcher/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-watcher/node_modules/jest-util": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-28.1.1.tgz",
+      "integrity": "sha512-FktOu7ca1DZSyhPAxgxB6hfh2+9zMoJ7aEQA759Z6p45NuO8mWcqujH+UdHlCm/V6JTWwDztM2ITCzU1ijJAfw==",
+      "dev": true,
+      "dependencies": {
+        "@jest/types": "^28.1.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "ci-info": "^3.2.0",
+        "graceful-fs": "^4.2.9",
+        "picomatch": "^2.2.3"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
+      }
+    },
+    "node_modules/jest-watcher/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-watcher/node_modules/type-fest": {
+      "version": "0.21.3",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
+      "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/jest-worker": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-27.5.1.tgz",
+      "integrity": "sha512-7vuh85V5cdDofPyxn58nrPjBktZo0u9x1g8WtjQol+jZDaE+fhN+cIvTj11GndBnMnyfrUOG1sZQxCdjKh+DKg==",
+      "dev": true,
+      "dependencies": {
+        "@types/node": "*",
+        "merge-stream": "^2.0.0",
+        "supports-color": "^8.0.0"
+      },
+      "engines": {
+        "node": ">= 10.13.0"
+      }
+    },
+    "node_modules/jest-worker/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jest-worker/node_modules/supports-color": {
+      "version": "8.1.1",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
+      "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/supports-color?sponsor=1"
+      }
+    },
+    "node_modules/joi": {
+      "version": "17.6.0",
+      "resolved": "https://registry.npmjs.org/joi/-/joi-17.6.0.tgz",
+      "integrity": "sha512-OX5dG6DTbcr/kbMFj0KGYxuew69HPcAE3K/sZpEV2nP6e/j/C0HV+HNiBPCASxdx5T7DMoa0s8UeHWMnb6n2zw==",
+      "dev": true,
+      "dependencies": {
+        "@hapi/hoek": "^9.0.0",
+        "@hapi/topo": "^5.0.0",
+        "@sideway/address": "^4.1.3",
+        "@sideway/formula": "^3.0.0",
+        "@sideway/pinpoint": "^2.0.0"
+      }
+    },
+    "node_modules/js-beautify": {
+      "version": "1.14.4",
+      "resolved": "https://registry.npmjs.org/js-beautify/-/js-beautify-1.14.4.tgz",
+      "integrity": "sha512-+b4A9c3glceZEmxyIbxDOYB0ZJdReLvyU1077RqKsO4dZx9FUHjTOJn8VHwpg33QoucIykOiYbh7MfqBOghnrA==",
+      "dev": true,
+      "dependencies": {
+        "config-chain": "^1.1.13",
+        "editorconfig": "^0.15.3",
+        "glob": "^7.1.3",
+        "nopt": "^5.0.0"
+      },
+      "bin": {
+        "css-beautify": "js/bin/css-beautify.js",
+        "html-beautify": "js/bin/html-beautify.js",
+        "js-beautify": "js/bin/js-beautify.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/js-message": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/js-message/-/js-message-1.0.7.tgz",
+      "integrity": "sha512-efJLHhLjIyKRewNS9EGZ4UpI8NguuL6fKkhRxVuMmrGV2xN/0APGdQYwLFky5w9naebSZ0OwAGp0G6/2Cg90rA==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.6.0"
+      }
+    },
+    "node_modules/js-tokens": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+      "dev": true
+    },
+    "node_modules/js-yaml": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
+      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/jsdom": {
+      "version": "16.7.0",
+      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-16.7.0.tgz",
+      "integrity": "sha512-u9Smc2G1USStM+s/x1ru5Sxrl6mPYCbByG1U/hUmqaVsm4tbNyS7CicOSRyuGQYZhTu0h84qkZZQ/I+dzizSVw==",
+      "dev": true,
+      "dependencies": {
+        "abab": "^2.0.5",
+        "acorn": "^8.2.4",
+        "acorn-globals": "^6.0.0",
+        "cssom": "^0.4.4",
+        "cssstyle": "^2.3.0",
+        "data-urls": "^2.0.0",
+        "decimal.js": "^10.2.1",
+        "domexception": "^2.0.1",
+        "escodegen": "^2.0.0",
+        "form-data": "^3.0.0",
+        "html-encoding-sniffer": "^2.0.1",
+        "http-proxy-agent": "^4.0.1",
+        "https-proxy-agent": "^5.0.0",
+        "is-potential-custom-element-name": "^1.0.1",
+        "nwsapi": "^2.2.0",
+        "parse5": "6.0.1",
+        "saxes": "^5.0.1",
+        "symbol-tree": "^3.2.4",
+        "tough-cookie": "^4.0.0",
+        "w3c-hr-time": "^1.0.2",
+        "w3c-xmlserializer": "^2.0.0",
+        "webidl-conversions": "^6.1.0",
+        "whatwg-encoding": "^1.0.5",
+        "whatwg-mimetype": "^2.3.0",
+        "whatwg-url": "^8.5.0",
+        "ws": "^7.4.6",
+        "xml-name-validator": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "peerDependencies": {
+        "canvas": "^2.5.0"
+      },
+      "peerDependenciesMeta": {
+        "canvas": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/jsdom/node_modules/parse5": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-6.0.1.tgz",
+      "integrity": "sha512-Ofn/CTFzRGTTxwpNEs9PP93gXShHcTq255nzRYSKe8AkVpZY7e1fpmTfOyoIvjP5HG7Z2ZM7VS9PPhQGW2pOpw==",
+      "dev": true
+    },
+    "node_modules/jsdom/node_modules/tr46": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-2.1.0.tgz",
+      "integrity": "sha512-15Ih7phfcdP5YxqiB+iDtLoaTz4Nd35+IiAv0kQ5FNKHzXgdWqPoTIqEDDJmXceQt4JZk6lVPT8lnDlPpGDppw==",
+      "dev": true,
+      "dependencies": {
+        "punycode": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/jsdom/node_modules/webidl-conversions": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-6.1.0.tgz",
+      "integrity": "sha512-qBIvFLGiBpLjfwmYAaHPXsn+ho5xZnGvyGvsarywGNc8VyQJUMHJ8OBKGGrPER0okBeMDaan4mNBlgBROxuI8w==",
+      "dev": true,
+      "engines": {
+        "node": ">=10.4"
+      }
+    },
+    "node_modules/jsdom/node_modules/whatwg-url": {
+      "version": "8.7.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-8.7.0.tgz",
+      "integrity": "sha512-gAojqb/m9Q8a5IV96E3fHJM70AzCkgt4uXYX2O7EmuyOnLrViCQlsEBmF9UQIu3/aeAIp2U17rtbpZWNntQqdg==",
+      "dev": true,
+      "dependencies": {
+        "lodash": "^4.7.0",
+        "tr46": "^2.1.0",
+        "webidl-conversions": "^6.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/jsdom/node_modules/xml-name-validator": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-3.0.0.tgz",
+      "integrity": "sha512-A5CUptxDsvxKJEU3yO6DuWBSJz/qizqzJKOMIfUJHETbBw/sFaDxgd6fxm1ewUaM0jZ444Fc5vC5ROYurg/4Pw==",
+      "dev": true
+    },
+    "node_modules/jsesc": {
+      "version": "2.5.2",
+      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
+      "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
+      "dev": true,
+      "bin": {
+        "jsesc": "bin/jsesc"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/json-parse-better-errors": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/json-parse-better-errors/-/json-parse-better-errors-1.0.2.tgz",
+      "integrity": "sha512-mrqyZKfX5EhL7hvqcV6WG1yYjnjeuYDzDhhcAAUrq8Po85NBQBJP+ZDUT75qZQ98IkUoBqdkExkukOU7Ts2wrw==",
+      "dev": true
+    },
+    "node_modules/json-parse-even-better-errors": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz",
+      "integrity": "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==",
+      "dev": true
+    },
+    "node_modules/json-schema-traverse": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "dev": true
+    },
+    "node_modules/json-stable-stringify-without-jsonify": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
+      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
+      "dev": true
+    },
+    "node_modules/json5": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true,
+      "bin": {
+        "json5": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/jsonc-parser": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.0.tgz",
+      "integrity": "sha512-gfFQZrcTc8CnKXp6Y4/CBT3fTc0OVuDofpre4aEeEpSBPV5X5v4+Vmx+8snU7RLPrNHPKSgLxGo9YuQzz20o+w=="
+    },
+    "node_modules/jsonfile": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
+      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+      "dev": true,
+      "dependencies": {
+        "universalify": "^2.0.0"
+      },
+      "optionalDependencies": {
+        "graceful-fs": "^4.1.6"
+      }
+    },
+    "node_modules/kind-of": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.3.tgz",
+      "integrity": "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/kleur": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/kleur/-/kleur-3.0.3.tgz",
+      "integrity": "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/klona": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/klona/-/klona-2.0.5.tgz",
+      "integrity": "sha512-pJiBpiXMbt7dkzXe8Ghj/u4FfXOOa98fPW+bihOJ4SjnoijweJrNThJfd3ifXpXhREjpoF2mZVH1GfS9LV3kHQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/kubernetes-types": {
+      "version": "1.26.0",
+      "resolved": "https://registry.npmjs.org/kubernetes-types/-/kubernetes-types-1.26.0.tgz",
+      "integrity": "sha512-jv0XaTIGW/p18jaiKRD85hLTYWx0yEj+cb6PDX3GdNa3dWoRxnD4Gv7+bE6C/ehcsp2skcdy34vT25jbPofDIQ==",
+      "dev": true
+    },
+    "node_modules/launch-editor": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/launch-editor/-/launch-editor-2.4.0.tgz",
+      "integrity": "sha512-mZ0BHeSn/ohL+Ib+b+JnxC59vcNz6v5IR9d0CuM8f0x8ni8oK3IIG6G0vMkpxc0gFsmvINkztGOHiWTaX4BmAg==",
+      "dev": true,
+      "dependencies": {
+        "picocolors": "^1.0.0",
+        "shell-quote": "^1.6.1"
+      }
+    },
+    "node_modules/launch-editor-middleware": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/launch-editor-middleware/-/launch-editor-middleware-2.4.0.tgz",
+      "integrity": "sha512-/M7AX/6xktZY60KE7j71XLrj9U6H5TBoP+mJzhYB3fcdAq8rcazit/K0qWiu1jvytUPXP4lJRd1VJFwvdMQ/uw==",
+      "dev": true,
+      "dependencies": {
+        "launch-editor": "^2.4.0"
+      }
+    },
+    "node_modules/leven": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/leven/-/leven-3.1.0.tgz",
+      "integrity": "sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/levn": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
+      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
+      "dev": true,
+      "dependencies": {
+        "prelude-ls": "^1.2.1",
+        "type-check": "~0.4.0"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/lilconfig": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-2.0.5.tgz",
+      "integrity": "sha512-xaYmXZtTHPAw5m+xLN8ab9C+3a8YmV3asNSPOATITbtwrfbwaLJj8h66H1WMIpALCkqsIzK3h7oQ+PdX+LQ9Eg==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/lines-and-columns": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/lines-and-columns/-/lines-and-columns-1.2.4.tgz",
+      "integrity": "sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==",
+      "dev": true
+    },
+    "node_modules/loader-runner": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/loader-runner/-/loader-runner-4.3.0.tgz",
+      "integrity": "sha512-3R/1M+yS3j5ou80Me59j7F9IMs4PXs3VqRrm0TU3AbKPxlmpoY1TNscJV/oGJXo8qCatFGTfDbY6W6ipGOYXfg==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.11.5"
+      }
+    },
+    "node_modules/loader-utils": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.2.tgz",
+      "integrity": "sha512-I5d00Pd/jwMD2QCduo657+YM/6L3KZu++pmX9VFncxaxvHcru9jx1lBaFft+r4Mt2jK0Yhp41XlRAihzPxHNCg==",
+      "dev": true,
+      "dependencies": {
+        "big.js": "^5.2.2",
+        "emojis-list": "^3.0.0",
+        "json5": "^1.0.1"
+      },
+      "engines": {
+        "node": ">=4.0.0"
+      }
+    },
+    "node_modules/loader-utils/node_modules/json5": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz",
+      "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==",
+      "dev": true,
+      "dependencies": {
+        "minimist": "^1.2.0"
+      },
+      "bin": {
+        "json5": "lib/cli.js"
+      }
+    },
+    "node_modules/locate-path": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
+      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
+      "dev": true,
+      "dependencies": {
+        "p-locate": "^4.1.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/lodash": {
+      "version": "4.17.21",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
+      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="
+    },
+    "node_modules/lodash.debounce": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/lodash.debounce/-/lodash.debounce-4.0.8.tgz",
+      "integrity": "sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow==",
+      "dev": true
+    },
+    "node_modules/lodash.defaultsdeep": {
+      "version": "4.6.1",
+      "resolved": "https://registry.npmjs.org/lodash.defaultsdeep/-/lodash.defaultsdeep-4.6.1.tgz",
+      "integrity": "sha512-3j8wdDzYuWO3lM3Reg03MuQR957t287Rpcxp1njpEa8oDrikb+FwGdW3n+FELh/A6qib6yPit0j/pv9G/yeAqA==",
+      "dev": true
+    },
+    "node_modules/lodash.kebabcase": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/lodash.kebabcase/-/lodash.kebabcase-4.1.1.tgz",
+      "integrity": "sha512-N8XRTIMMqqDgSy4VLKPnJ/+hpGZN+PHQiJnSenYqPaVV/NCqEogTnAdZLQiGKhxX+JCs8waWq2t1XHWKOmlY8g==",
+      "dev": true
+    },
+    "node_modules/lodash.mapvalues": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/lodash.mapvalues/-/lodash.mapvalues-4.6.0.tgz",
+      "integrity": "sha512-JPFqXFeZQ7BfS00H58kClY7SPVeHertPE0lNuCyZ26/XlN8TvakYD7b9bGyNmXbT/D3BbtPAAmq90gPWqLkxlQ==",
+      "dev": true
+    },
+    "node_modules/lodash.memoize": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/lodash.memoize/-/lodash.memoize-4.1.2.tgz",
+      "integrity": "sha512-t7j+NzmgnQzTAYXcsHYLgimltOV1MXHtlOWf6GjL9Kj8GK5FInw5JotxvbOs+IvV1/Dzo04/fCGfLVs7aXb4Ag==",
+      "dev": true
+    },
+    "node_modules/lodash.merge": {
+      "version": "4.6.2",
+      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
+      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
+      "dev": true
+    },
+    "node_modules/lodash.truncate": {
+      "version": "4.4.2",
+      "resolved": "https://registry.npmjs.org/lodash.truncate/-/lodash.truncate-4.4.2.tgz",
+      "integrity": "sha512-jttmRe7bRse52OsWIMDLaXxWqRAmtIUccAQ3garviCqJjafXOfNMO0yMfNpdD6zbGaTU0P5Nz7e7gAT6cKmJRw==",
+      "dev": true
+    },
+    "node_modules/lodash.uniq": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/lodash.uniq/-/lodash.uniq-4.5.0.tgz",
+      "integrity": "sha512-xfBaXQd9ryd9dlSDvnvI0lvxfLJlYAZzXomUYzLKtUeOQvOP5piqAWuGtrhWeqaXK9hhoM/iyJc5AV+XfsX3HQ==",
+      "dev": true
+    },
+    "node_modules/log-symbols": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/log-symbols/-/log-symbols-4.1.0.tgz",
+      "integrity": "sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==",
+      "dev": true,
+      "dependencies": {
+        "chalk": "^4.1.0",
+        "is-unicode-supported": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/log-symbols/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/log-symbols/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/log-symbols/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/log-symbols/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/log-symbols/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/log-symbols/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/log-update": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/log-update/-/log-update-2.3.0.tgz",
+      "integrity": "sha512-vlP11XfFGyeNQlmEn9tJ66rEW1coA/79m5z6BCkudjbAGE83uhAcGYrBFwfs3AdLiLzGRusRPAbSPK9xZteCmg==",
+      "dev": true,
+      "dependencies": {
+        "ansi-escapes": "^3.0.0",
+        "cli-cursor": "^2.0.0",
+        "wrap-ansi": "^3.0.1"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/log-update/node_modules/ansi-regex": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.1.tgz",
+      "integrity": "sha512-+O9Jct8wf++lXxxFc4hc8LsjaSq0HFzzL7cVsw8pRDIPdjKD2mT4ytDZlLuSBZ4cLKZFXIrMGO7DbQCtMJJMKw==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/log-update/node_modules/cli-cursor": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-2.1.0.tgz",
+      "integrity": "sha512-8lgKz8LmCRYZZQDpRyT2m5rKJ08TnU4tR9FFFW2rxpxR1FzWi4PQ/NfyODchAatHaUgnSPVcx/R5w6NuTBzFiw==",
+      "dev": true,
+      "dependencies": {
+        "restore-cursor": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/log-update/node_modules/is-fullwidth-code-point": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-2.0.0.tgz",
+      "integrity": "sha512-VHskAKYM8RfSFXwee5t5cbN5PZeq1Wrh6qd5bkyiXIf6UQcN6w/A0eXM9r6t8d+GYOh+o6ZhiEnb88LN/Y8m2w==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/log-update/node_modules/mimic-fn": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-1.2.0.tgz",
+      "integrity": "sha512-jf84uxzwiuiIVKiOLpfYk7N46TSy8ubTonmneY9vrpHNAnp0QBt2BxWV9dO3/j+BoVAb+a5G6YDPW3M5HOdMWQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/log-update/node_modules/onetime": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/onetime/-/onetime-2.0.1.tgz",
+      "integrity": "sha512-oyyPpiMaKARvvcgip+JV+7zci5L8D1W9RZIz2l1o08AM3pfspitVWnPt3mzHcBPp12oYMTy0pqrFs/C+m3EwsQ==",
+      "dev": true,
+      "dependencies": {
+        "mimic-fn": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/log-update/node_modules/restore-cursor": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-2.0.0.tgz",
+      "integrity": "sha512-6IzJLuGi4+R14vwagDHX+JrXmPVtPpn4mffDJ1UdR7/Edm87fl6yi8mMBIVvFtJaNTUvjughmW4hwLhRG7gC1Q==",
+      "dev": true,
+      "dependencies": {
+        "onetime": "^2.0.0",
+        "signal-exit": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/log-update/node_modules/string-width": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-2.1.1.tgz",
+      "integrity": "sha512-nOqH59deCq9SRHlxq1Aw85Jnt4w6KvLKqWVik6oA9ZklXLNIOlqg4F2yrT1MVaTjAqvVwdfeZ7w7aCvJD7ugkw==",
+      "dev": true,
+      "dependencies": {
+        "is-fullwidth-code-point": "^2.0.0",
+        "strip-ansi": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/log-update/node_modules/strip-ansi": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-4.0.0.tgz",
+      "integrity": "sha512-4XaJ2zQdCzROZDivEVIDPkcQn8LMFSa8kj8Gxb/Lnwzv9A8VctNZ+lfivC/sV3ivW8ElJTERXZoPBRrZKkNKow==",
+      "dev": true,
+      "dependencies": {
+        "ansi-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/log-update/node_modules/wrap-ansi": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-3.0.1.tgz",
+      "integrity": "sha512-iXR3tDXpbnTpzjKSylUJRkLuOrEC7hwEB221cgn6wtF8wpmz28puFXAEfPT5zrjM3wahygB//VuWEr1vTkDcNQ==",
+      "dev": true,
+      "dependencies": {
+        "string-width": "^2.1.1",
+        "strip-ansi": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/long": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/long/-/long-5.2.0.tgz",
+      "integrity": "sha512-9RTUNjK60eJbx3uz+TEGF7fUr29ZDxR5QzXcyDpeSfeH28S9ycINflOgOlppit5U+4kNTe83KQnMEerw7GmE8w=="
+    },
+    "node_modules/lower-case": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/lower-case/-/lower-case-2.0.2.tgz",
+      "integrity": "sha512-7fm3l3NAF9WfN6W3JOmf5drwpVqX78JtoGJ3A6W0a6ZnldM41w2fV5D490psKFTpMds8TJse/eHLFFsNHHjHgg==",
+      "dev": true,
+      "dependencies": {
+        "tslib": "^2.0.3"
+      }
+    },
+    "node_modules/lru-cache": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
+      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
+      "dev": true,
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/luxon": {
+      "version": "2.5.2",
+      "resolved": "https://registry.npmjs.org/luxon/-/luxon-2.5.2.tgz",
+      "integrity": "sha512-Yg7/RDp4nedqmLgyH0LwgGRvMEKVzKbUdkBYyCosbHgJ+kaOUx0qzSiSatVc3DFygnirTPYnMM2P5dg2uH1WvA==",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/magic-string": {
+      "version": "0.25.9",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.25.9.tgz",
+      "integrity": "sha512-RmF0AsMzgt25qzqqLc1+MbHmhdx0ojF2Fvs4XnOqz2ZOBXzzkEwc/dJQZCYHAn7v1jbVOjAZfK8msRn4BxO4VQ==",
+      "dependencies": {
+        "sourcemap-codec": "^1.4.8"
+      }
+    },
+    "node_modules/make-dir": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-3.1.0.tgz",
+      "integrity": "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==",
+      "dev": true,
+      "dependencies": {
+        "semver": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/make-error": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz",
+      "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==",
+      "dev": true
+    },
+    "node_modules/makeerror": {
+      "version": "1.0.12",
+      "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz",
+      "integrity": "sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==",
+      "dev": true,
+      "dependencies": {
+        "tmpl": "1.0.5"
+      }
+    },
+    "node_modules/mdn-data": {
+      "version": "2.0.14",
+      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.0.14.tgz",
+      "integrity": "sha512-dn6wd0uw5GsdswPFfsgMp5NSB0/aDe6fK94YJV/AJDYXL6HVLWBsxeq7js7Ad+mU2K9LAlwpk6kN2D5mwCPVow==",
+      "dev": true
+    },
+    "node_modules/media-typer": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
+      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/memfs": {
+      "version": "3.4.7",
+      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.4.7.tgz",
+      "integrity": "sha512-ygaiUSNalBX85388uskeCyhSAoOSgzBbtVCr9jA2RROssFL9Q19/ZXFqS+2Th2sr1ewNIWgFdLzLC3Yl1Zv+lw==",
+      "dev": true,
+      "dependencies": {
+        "fs-monkey": "^1.0.3"
+      },
+      "engines": {
+        "node": ">= 4.0.0"
+      }
+    },
+    "node_modules/merge-descriptors": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.1.tgz",
+      "integrity": "sha512-cCi6g3/Zr1iqQi6ySbseM1Xvooa98N0w31jzUYrXPX2xqObmFGHJ0tQ5u74H3mVh7wLouTseZyYIq39g8cNp1w==",
+      "dev": true
+    },
+    "node_modules/merge-source-map": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/merge-source-map/-/merge-source-map-1.1.0.tgz",
+      "integrity": "sha512-Qkcp7P2ygktpMPh2mCQZaf3jhN6D3Z/qVZHSdWvQ+2Ef5HgRAPBO57A77+ENm0CPx2+1Ce/MYKi3ymqdfuqibw==",
+      "dev": true,
+      "dependencies": {
+        "source-map": "^0.6.1"
+      }
+    },
+    "node_modules/merge-stream": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
+      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==",
+      "dev": true
+    },
+    "node_modules/merge2": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
+      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/methods": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
+      "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/micromatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz",
+      "integrity": "sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==",
+      "dev": true,
+      "dependencies": {
+        "braces": "^3.0.2",
+        "picomatch": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=8.6"
+      }
+    },
+    "node_modules/mime": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
+      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
+      "dev": true,
+      "bin": {
+        "mime": "cli.js"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "dev": true,
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mimic-fn": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
+      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/mini-css-extract-plugin": {
+      "version": "2.6.1",
+      "resolved": "https://registry.npmjs.org/mini-css-extract-plugin/-/mini-css-extract-plugin-2.6.1.tgz",
+      "integrity": "sha512-wd+SD57/K6DiV7jIR34P+s3uckTRuQvx0tKPcvjFlrEylk6P4mQ2KSWk1hblj1Kxaqok7LogKOieygXqBczNlg==",
+      "dev": true,
+      "dependencies": {
+        "schema-utils": "^4.0.0"
+      },
+      "engines": {
+        "node": ">= 12.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      },
+      "peerDependencies": {
+        "webpack": "^5.0.0"
+      }
+    },
+    "node_modules/mini-css-extract-plugin/node_modules/ajv": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.11.0.tgz",
+      "integrity": "sha512-wGgprdCvMalC0BztXvitD2hC04YffAvtsUn93JbGXYLAtCUO4xd17mCCZQxUOItiBwZvJScWo8NIvQMQ71rdpg==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/mini-css-extract-plugin/node_modules/ajv-keywords": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-5.1.0.tgz",
+      "integrity": "sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3"
+      },
+      "peerDependencies": {
+        "ajv": "^8.8.2"
+      }
+    },
+    "node_modules/mini-css-extract-plugin/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true
+    },
+    "node_modules/mini-css-extract-plugin/node_modules/schema-utils": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.0.0.tgz",
+      "integrity": "sha512-1edyXKgh6XnJsJSQ8mKWXnN/BVaIbFMLpouRUrXgVq7WYne5kw3MW7UPhO44uRXQSIpTSXoJbmrR2X0w9kUTyg==",
+      "dev": true,
+      "dependencies": {
+        "@types/json-schema": "^7.0.9",
+        "ajv": "^8.8.0",
+        "ajv-formats": "^2.1.1",
+        "ajv-keywords": "^5.0.0"
+      },
+      "engines": {
+        "node": ">= 12.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      }
+    },
+    "node_modules/minimalistic-assert": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz",
+      "integrity": "sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==",
+      "dev": true
+    },
+    "node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dev": true,
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz",
+      "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q==",
+      "dev": true
+    },
+    "node_modules/minipass": {
+      "version": "3.3.4",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.4.tgz",
+      "integrity": "sha512-I9WPbWHCGu8W+6k1ZiGpPu0GkoKBeorkfKNuAFBNS1HNFJvke82sxvI5bzcCNpWPorkOO5QQ+zomzzwRxejXiw==",
+      "dev": true,
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/mitt": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mitt/-/mitt-2.1.0.tgz",
+      "integrity": "sha512-ILj2TpLiysu2wkBbWjAmww7TkZb65aiQO+DkVdUTBpBXq+MHYiETENkKFMtsJZX1Lf4pe4QOrTSjIfUwN5lRdg=="
+    },
+    "node_modules/mkdirp": {
+      "version": "0.5.6",
+      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
+      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
+      "dev": true,
+      "dependencies": {
+        "minimist": "^1.2.6"
+      },
+      "bin": {
+        "mkdirp": "bin/cmd.js"
+      }
+    },
+    "node_modules/module-alias": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/module-alias/-/module-alias-2.2.2.tgz",
+      "integrity": "sha512-A/78XjoX2EmNvppVWEhM2oGk3x4lLxnkEA4jTbaK97QKSDjkIoOsKQlfylt/d3kKKi596Qy3NP5XrXJ6fZIC9Q==",
+      "dev": true
+    },
+    "node_modules/monaco-editor": {
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/monaco-editor/-/monaco-editor-0.33.0.tgz",
+      "integrity": "sha512-VcRWPSLIUEgQJQIE0pVT8FcGBIgFoxz7jtqctE+IiCxWugD0DwgyQBcZBhdSrdMC84eumoqMZsGl2GTreOzwqw=="
+    },
+    "node_modules/monaco-editor-vue3": {
+      "version": "0.1.10",
+      "resolved": "https://registry.npmjs.org/monaco-editor-vue3/-/monaco-editor-vue3-0.1.10.tgz",
+      "integrity": "sha512-C1jhyx+KHQyW1AbjuA8DhIZSqkVquV7MnuWXG9jESd0e+CkzEFzuk1RvNqlN2eJ2fRkvF32yEPHYfvz9quOhHQ==",
+      "dependencies": {
+        "monaco-editor": "^0.33.0",
+        "vite-plugin-monaco-editor": "^1.1.0",
+        "vue": "^3.2.37"
+      }
+    },
+    "node_modules/monaco-marker-data-provider": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/monaco-marker-data-provider/-/monaco-marker-data-provider-1.1.1.tgz",
+      "integrity": "sha512-PGB7TJSZE5tmHzkxv/OEwK2RGNC2A7dcq4JRJnnj31CUAsfmw0Gl+1QTrH0W0deKhcQmQM0YVPaqgQ+0wCt8Mg==",
+      "funding": {
+        "url": "https://github.com/sponsors/remcohaszing"
+      },
+      "peerDependencies": {
+        "monaco-editor": ">=0.30.0"
+      }
+    },
+    "node_modules/monaco-worker-manager": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/monaco-worker-manager/-/monaco-worker-manager-2.0.1.tgz",
+      "integrity": "sha512-kdPL0yvg5qjhKPNVjJoym331PY/5JC11aPJXtCZNwWRvBr6jhkIamvYAyiY5P1AWFmNOy0aRDRoMdZfa71h8kg==",
+      "peerDependencies": {
+        "monaco-editor": ">=0.30.0"
+      }
+    },
+    "node_modules/monaco-yaml": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/monaco-yaml/-/monaco-yaml-4.0.4.tgz",
+      "integrity": "sha512-qbM36fY1twpDUs4lhhxoXDQGUPVyYAFCPJi3E0JKgLioD8wzsD/pawgauFFXSzpMa09z8wbt/DTLXjXEehnVFA==",
+      "dependencies": {
+        "@types/json-schema": "^7.0.0",
+        "jsonc-parser": "^3.0.0",
+        "monaco-marker-data-provider": "^1.0.0",
+        "monaco-worker-manager": "^2.0.0",
+        "path-browserify": "^1.0.0",
+        "prettier": "^2.0.0",
+        "vscode-languageserver-textdocument": "^1.0.0",
+        "vscode-languageserver-types": "^3.0.0",
+        "vscode-uri": "^3.0.0",
+        "yaml": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/remcohaszing"
+      },
+      "peerDependencies": {
+        "monaco-editor": ">=0.30"
+      }
+    },
+    "node_modules/monaco-yaml/node_modules/yaml": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.2.2.tgz",
+      "integrity": "sha512-CBKFWExMn46Foo4cldiChEzn7S7SRV+wqiluAb6xmueD/fGyRHIhX8m14vVGgeFWjN540nKCNVj6P21eQjgTuA==",
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/mrmime": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/mrmime/-/mrmime-1.0.1.tgz",
+      "integrity": "sha512-hzzEagAgDyoU1Q6yg5uI+AorQgdvMCur3FcKf7NhMKWsaYg+RnbTyHRa/9IlLF9rf455MOCtcqqrQQ83pPP7Uw==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+      "dev": true
+    },
+    "node_modules/multicast-dns": {
+      "version": "7.2.5",
+      "resolved": "https://registry.npmjs.org/multicast-dns/-/multicast-dns-7.2.5.tgz",
+      "integrity": "sha512-2eznPJP8z2BFLX50tf0LuODrpINqP1RVIm/CObbTcBRITQgmC/TjcREF1NeTBzIcR5XO/ukWo+YHOjBbFwIupg==",
+      "dev": true,
+      "dependencies": {
+        "dns-packet": "^5.2.2",
+        "thunky": "^1.0.2"
+      },
+      "bin": {
+        "multicast-dns": "cli.js"
+      }
+    },
+    "node_modules/mz": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/mz/-/mz-2.7.0.tgz",
+      "integrity": "sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==",
+      "dev": true,
+      "dependencies": {
+        "any-promise": "^1.0.0",
+        "object-assign": "^4.0.1",
+        "thenify-all": "^1.0.0"
+      }
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.4",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.4.tgz",
+      "integrity": "sha512-MqBkQh/OHTS2egovRtLk45wEyNXwF+cokD+1YPf9u5VfJiRdAiRwB2froX5Co9Rh20xs4siNPm8naNotSD6RBw==",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/natural-compare": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
+      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
+      "dev": true
+    },
+    "node_modules/negotiator": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
+      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/neo-async": {
+      "version": "2.6.2",
+      "resolved": "https://registry.npmjs.org/neo-async/-/neo-async-2.6.2.tgz",
+      "integrity": "sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==",
+      "dev": true
+    },
+    "node_modules/nice-try": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/nice-try/-/nice-try-1.0.5.tgz",
+      "integrity": "sha512-1nh45deeb5olNY7eX82BkPO7SSxR5SSYJiPTrTdFUVYwAl8CKMA5N9PjTYkHiRjisVcxcQ1HXdLhx2qxxJzLNQ==",
+      "dev": true
+    },
+    "node_modules/no-case": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/no-case/-/no-case-3.0.4.tgz",
+      "integrity": "sha512-fgAN3jGAh+RoxUGZHTSOLJIqUc2wmoBwGR4tbpNAKmmovFoWq0OdRkb0VkldReO2a2iBT/OEulG9XSUc10r3zg==",
+      "dev": true,
+      "dependencies": {
+        "lower-case": "^2.0.2",
+        "tslib": "^2.0.3"
+      }
+    },
+    "node_modules/node-fetch": {
+      "version": "2.6.7",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.7.tgz",
+      "integrity": "sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ==",
+      "dev": true,
+      "dependencies": {
+        "whatwg-url": "^5.0.0"
+      },
+      "engines": {
+        "node": "4.x || >=6.0.0"
+      },
+      "peerDependencies": {
+        "encoding": "^0.1.0"
+      },
+      "peerDependenciesMeta": {
+        "encoding": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/node-forge": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.1.tgz",
+      "integrity": "sha512-dPEtOeMvF9VMcYV/1Wb8CPoVAXtp6MKMlcbAt4ddqmGqUJ6fQZFXkNZNkNlfevtNkGtaSoXf/vNNNSvgrdXwtA==",
+      "dev": true,
+      "engines": {
+        "node": ">= 6.13.0"
+      }
+    },
+    "node_modules/node-int64": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
+      "integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==",
+      "dev": true
+    },
+    "node_modules/node-releases": {
+      "version": "2.0.13",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.13.tgz",
+      "integrity": "sha512-uYr7J37ae/ORWdZeQ1xxMJe3NtdmqMC/JZK+geofDrkLUApKRHPd18/TxtBOJ4A0/+uUIliorNrfYV6s1b02eQ==",
+      "dev": true
+    },
+    "node_modules/nopt": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/nopt/-/nopt-5.0.0.tgz",
+      "integrity": "sha512-Tbj67rffqceeLpcRXrT7vKAN8CwfPeIBgM7E6iBkmKLV7bEMwpGgYLGv0jACUsECaa/vuxP0IjEont6umdMgtQ==",
+      "dev": true,
+      "dependencies": {
+        "abbrev": "1"
+      },
+      "bin": {
+        "nopt": "bin/nopt.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/normalize-package-data": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-2.5.0.tgz",
+      "integrity": "sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==",
+      "dev": true,
+      "dependencies": {
+        "hosted-git-info": "^2.1.4",
+        "resolve": "^1.10.0",
+        "semver": "2 || 3 || 4 || 5",
+        "validate-npm-package-license": "^3.0.1"
+      }
+    },
+    "node_modules/normalize-package-data/node_modules/semver": {
+      "version": "5.7.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+      "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
+      "dev": true,
+      "bin": {
+        "semver": "bin/semver"
+      }
+    },
+    "node_modules/normalize-path": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
+      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/normalize-range": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/normalize-range/-/normalize-range-0.1.2.tgz",
+      "integrity": "sha512-bdok/XvKII3nUpklnV6P2hxtMNrCboOjAcyBuQnWEhO665FwrSNRxU+AqpsyvO6LgGYPspN+lu5CLtw4jPRKNA==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/normalize-url": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-6.1.0.tgz",
+      "integrity": "sha512-DlL+XwOy3NxAQ8xuC0okPgK46iuVNAK01YN7RueYBqqFeGsBjV9XmCAzAdgt+667bCl5kPh9EqKKDwnaPG1I7A==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/npm-run-path": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-2.0.2.tgz",
+      "integrity": "sha512-lJxZYlT4DW/bRUtFh1MQIWqmLwQfAxnqWG4HhEdjMlkrJYnJn0Jrr2u3mgxqaWsdiBc76TYkTG/mhrnYTuzfHw==",
+      "dev": true,
+      "dependencies": {
+        "path-key": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/nth-check": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/nth-check/-/nth-check-2.1.1.tgz",
+      "integrity": "sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==",
+      "dev": true,
+      "dependencies": {
+        "boolbase": "^1.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/fb55/nth-check?sponsor=1"
+      }
+    },
+    "node_modules/nwsapi": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.1.tgz",
+      "integrity": "sha512-JYOWTeFoS0Z93587vRJgASD5Ut11fYl5NyihP3KrYBvMe1FRRs6RN7m20SA/16GM4P6hTnZjT+UmDOt38UeXNg==",
+      "dev": true
+    },
+    "node_modules/object-assign": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
+      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/object-hash": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-3.0.0.tgz",
+      "integrity": "sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==",
+      "dev": true,
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/object-inspect": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.2.tgz",
+      "integrity": "sha512-z+cPxW0QGUp0mcqcsgQyLVRDoXFQbXOwBaqyF7VIgI4TWNQsDHrBpUQslRmIfAoYWdYzs6UlKJtB2XJpTaNSpQ==",
+      "dev": true,
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/object-keys": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
+      "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/object.assign": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/object.assign/-/object.assign-4.1.2.tgz",
+      "integrity": "sha512-ixT2L5THXsApyiUPYKmW+2EHpXXe5Ii3M+f4e+aJFAHao5amFRW6J0OO6c/LU8Be47utCx2GL89hxGB6XSmKuQ==",
+      "dev": true,
+      "dependencies": {
+        "call-bind": "^1.0.0",
+        "define-properties": "^1.1.3",
+        "has-symbols": "^1.0.1",
+        "object-keys": "^1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/obuf": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/obuf/-/obuf-1.1.2.tgz",
+      "integrity": "sha512-PX1wu0AmAdPqOL1mWhqmlOd8kOIZQwGZw6rh7uby9fTc5lhaOWFLX3I6R1hrF9k3zUY40e6igsLGkDXK92LJNg==",
+      "dev": true
+    },
+    "node_modules/on-finished": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
+      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "dev": true,
+      "dependencies": {
+        "ee-first": "1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/on-headers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz",
+      "integrity": "sha512-pZAE+FJLoyITytdqK0U5s+FIpjN0JP3OzFi/u8Rx+EV5/W+JTWGXG8xFzevE7AjBfDqHv/8vL8qQsIhHnqRkrA==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dev": true,
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/onetime": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
+      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
+      "dev": true,
+      "dependencies": {
+        "mimic-fn": "^2.1.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/open": {
+      "version": "8.4.0",
+      "resolved": "https://registry.npmjs.org/open/-/open-8.4.0.tgz",
+      "integrity": "sha512-XgFPPM+B28FtCCgSb9I+s9szOC1vZRSwgWsRUA5ylIxRTgKozqjOCrVOqGsYABPYK5qnfqClxZTFBa8PKt2v6Q==",
+      "dev": true,
+      "dependencies": {
+        "define-lazy-prop": "^2.0.0",
+        "is-docker": "^2.1.1",
+        "is-wsl": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/opener": {
+      "version": "1.5.2",
+      "resolved": "https://registry.npmjs.org/opener/-/opener-1.5.2.tgz",
+      "integrity": "sha512-ur5UIdyw5Y7yEj9wLzhqXiy6GZ3Mwx0yGI+5sMn2r0N0v3cKJvUmFH5yPP+WXh9e0xfyzyJX95D8l088DNFj7A==",
+      "dev": true,
+      "bin": {
+        "opener": "bin/opener-bin.js"
+      }
+    },
+    "node_modules/openpgp": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/openpgp/-/openpgp-5.5.0.tgz",
+      "integrity": "sha512-SpwcJnxrK9Y0HRM6KxSFqkAEOSWEabCH/c8dII/+y2e5f6KvuDG5ZE7JXaPBaVJNE4VUZZeTphxXDoZD0KOHrw==",
+      "dev": true,
+      "dependencies": {
+        "asn1.js": "^5.0.0"
+      },
+      "engines": {
+        "node": ">= 8.0.0"
+      }
+    },
+    "node_modules/optionator": {
+      "version": "0.9.1",
+      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.1.tgz",
+      "integrity": "sha512-74RlY5FCnhq4jRxVUPKDaRwrVNXMqsGsiW6AJw4XK8hmtm10wC0ypZBLw5IIp85NZMr91+qd1RvvENwg7jjRFw==",
+      "dev": true,
+      "dependencies": {
+        "deep-is": "^0.1.3",
+        "fast-levenshtein": "^2.0.6",
+        "levn": "^0.4.1",
+        "prelude-ls": "^1.2.1",
+        "type-check": "^0.4.0",
+        "word-wrap": "^1.2.3"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/ora": {
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/ora/-/ora-5.4.1.tgz",
+      "integrity": "sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==",
+      "dev": true,
+      "dependencies": {
+        "bl": "^4.1.0",
+        "chalk": "^4.1.0",
+        "cli-cursor": "^3.1.0",
+        "cli-spinners": "^2.5.0",
+        "is-interactive": "^1.0.0",
+        "is-unicode-supported": "^0.1.0",
+        "log-symbols": "^4.1.0",
+        "strip-ansi": "^6.0.0",
+        "wcwidth": "^1.0.1"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/ora/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/ora/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/ora/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/ora/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/ora/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/ora/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/p-finally": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/p-finally/-/p-finally-1.0.0.tgz",
+      "integrity": "sha512-LICb2p9CB7FS+0eR1oqWnHhp0FljGLZCWBE9aix0Uye9W8LTQPwMTYVGWQWIw9RdQiDg4+epXQODwIYJtSJaow==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/p-limit": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
+      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
+      "dev": true,
+      "dependencies": {
+        "p-try": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/p-locate": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
+      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
+      "dev": true,
+      "dependencies": {
+        "p-limit": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/p-retry": {
+      "version": "4.6.2",
+      "resolved": "https://registry.npmjs.org/p-retry/-/p-retry-4.6.2.tgz",
+      "integrity": "sha512-312Id396EbJdvRONlngUx0NydfrIQ5lsYu0znKVUzVvArzEIt08V1qhtyESbGVd1FGX7UKtiFp5uwKZdM8wIuQ==",
+      "dev": true,
+      "dependencies": {
+        "@types/retry": "0.12.0",
+        "retry": "^0.13.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/p-try": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
+      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/param-case": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/param-case/-/param-case-3.0.4.tgz",
+      "integrity": "sha512-RXlj7zCYokReqWpOPH9oYivUzLYZ5vAPIfEmCTNViosC78F8F0H9y7T7gG2M39ymgutxF5gcFEsyZQSph9Bp3A==",
+      "dev": true,
+      "dependencies": {
+        "dot-case": "^3.0.4",
+        "tslib": "^2.0.3"
+      }
+    },
+    "node_modules/parent-module": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
+      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
+      "dev": true,
+      "dependencies": {
+        "callsites": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/parse-json": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-5.2.0.tgz",
+      "integrity": "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.0.0",
+        "error-ex": "^1.3.1",
+        "json-parse-even-better-errors": "^2.3.0",
+        "lines-and-columns": "^1.1.6"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/parse5": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-5.1.1.tgz",
+      "integrity": "sha512-ugq4DFI0Ptb+WWjAdOK16+u/nHfiIrcE+sh8kZMaM0WllQKLI9rOUq6c2b7cwPkXdzfQESqvoqK6ug7U/Yyzug==",
+      "dev": true
+    },
+    "node_modules/parse5-htmlparser2-tree-adapter": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/parse5-htmlparser2-tree-adapter/-/parse5-htmlparser2-tree-adapter-6.0.1.tgz",
+      "integrity": "sha512-qPuWvbLgvDGilKc5BoicRovlT4MtYT6JfJyBOMDsKoiT+GiuP5qyrPCnR9HcPECIJJmZh5jRndyNThnhhb/vlA==",
+      "dev": true,
+      "dependencies": {
+        "parse5": "^6.0.1"
+      }
+    },
+    "node_modules/parse5-htmlparser2-tree-adapter/node_modules/parse5": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-6.0.1.tgz",
+      "integrity": "sha512-Ofn/CTFzRGTTxwpNEs9PP93gXShHcTq255nzRYSKe8AkVpZY7e1fpmTfOyoIvjP5HG7Z2ZM7VS9PPhQGW2pOpw==",
+      "dev": true
+    },
+    "node_modules/parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/pascal-case": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/pascal-case/-/pascal-case-3.1.2.tgz",
+      "integrity": "sha512-uWlGT3YSnK9x3BQJaOdcZwrnV6hPpd8jFH1/ucpiLRPh/2zCVJKS19E4GvYHvaCcACn3foXZ0cLB9Wrx1KGe5g==",
+      "dev": true,
+      "dependencies": {
+        "no-case": "^3.0.4",
+        "tslib": "^2.0.3"
+      }
+    },
+    "node_modules/path-browserify": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-browserify/-/path-browserify-1.0.1.tgz",
+      "integrity": "sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g=="
+    },
+    "node_modules/path-exists": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
+      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-2.0.1.tgz",
+      "integrity": "sha512-fEHGKCSmUSDPv4uoj8AlD+joPlq3peND+HRYyxFz4KPw4z926S/b8rIuFs2FYJg3BwsxJf6A9/3eIdLaYC+9Dw==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/path-parse": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
+      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
+      "dev": true
+    },
+    "node_modules/path-to-regexp": {
+      "version": "0.1.7",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz",
+      "integrity": "sha512-5DFkuoqlv1uYQKxy8omFBeJPQcdoE07Kv2sferDCrAq1ohOU+MSDswDIbnx3YAM60qIOnYa53wBhXW0EbMonrQ==",
+      "dev": true
+    },
+    "node_modules/path-type": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
+      "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/picocolors": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.0.tgz",
+      "integrity": "sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ=="
+    },
+    "node_modules/picomatch": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "dev": true,
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/pify": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/pify/-/pify-2.3.0.tgz",
+      "integrity": "sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/pirates": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/pirates/-/pirates-4.0.5.tgz",
+      "integrity": "sha512-8V9+HQPupnaXMA23c5hvl69zXvTwTzyAYasnkb0Tts4XvO4CliqONMOnvlq26rkhLC3nWDFBJf73LU1e1VZLaQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/pkg-dir": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz",
+      "integrity": "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==",
+      "dev": true,
+      "dependencies": {
+        "find-up": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/pluralize": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/pluralize/-/pluralize-8.0.0.tgz",
+      "integrity": "sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA==",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/portfinder": {
+      "version": "1.0.28",
+      "resolved": "https://registry.npmjs.org/portfinder/-/portfinder-1.0.28.tgz",
+      "integrity": "sha512-Se+2isanIcEqf2XMHjyUKskczxbPH7dQnlMjXX6+dybayyHvAf/TCgyMRlzf/B6QDhAEFOGes0pzRo3by4AbMA==",
+      "dev": true,
+      "dependencies": {
+        "async": "^2.6.2",
+        "debug": "^3.1.1",
+        "mkdirp": "^0.5.5"
+      },
+      "engines": {
+        "node": ">= 0.12.0"
+      }
+    },
+    "node_modules/portfinder/node_modules/debug": {
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
+      "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
+      "dev": true,
+      "dependencies": {
+        "ms": "^2.1.1"
+      }
+    },
+    "node_modules/postcss": {
+      "version": "8.4.14",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.14.tgz",
+      "integrity": "sha512-E398TUmfAYFPBSdzgeieK2Y1+1cpdxJx8yXbK/m57nRhKSmk1GB2tO4lbLBtlkfPQTDKfe4Xqv1ASWPpayPEig==",
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        }
+      ],
+      "dependencies": {
+        "nanoid": "^3.3.4",
+        "picocolors": "^1.0.0",
+        "source-map-js": "^1.0.2"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
+    "node_modules/postcss-calc": {
+      "version": "8.2.4",
+      "resolved": "https://registry.npmjs.org/postcss-calc/-/postcss-calc-8.2.4.tgz",
+      "integrity": "sha512-SmWMSJmB8MRnnULldx0lQIyhSNvuDl9HfrZkaqqE/WHAhToYsAvDq+yAsA/kIyINDszOp3Rh0GFoNuH5Ypsm3Q==",
+      "dev": true,
+      "dependencies": {
+        "postcss-selector-parser": "^6.0.9",
+        "postcss-value-parser": "^4.2.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.2"
+      }
+    },
+    "node_modules/postcss-colormin": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/postcss-colormin/-/postcss-colormin-5.3.0.tgz",
+      "integrity": "sha512-WdDO4gOFG2Z8n4P8TWBpshnL3JpmNmJwdnfP2gbk2qBA8PWwOYcmjmI/t3CmMeL72a7Hkd+x/Mg9O2/0rD54Pg==",
+      "dev": true,
+      "dependencies": {
+        "browserslist": "^4.16.6",
+        "caniuse-api": "^3.0.0",
+        "colord": "^2.9.1",
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-convert-values": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/postcss-convert-values/-/postcss-convert-values-5.1.2.tgz",
+      "integrity": "sha512-c6Hzc4GAv95B7suy4udszX9Zy4ETyMCgFPUDtWjdFTKH1SE9eFY/jEpHSwTH1QPuwxHpWslhckUQWbNRM4ho5g==",
+      "dev": true,
+      "dependencies": {
+        "browserslist": "^4.20.3",
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-discard-comments": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/postcss-discard-comments/-/postcss-discard-comments-5.1.2.tgz",
+      "integrity": "sha512-+L8208OVbHVF2UQf1iDmRcbdjJkuBF6IS29yBDSiWUIzpYaAhtNl6JYnYm12FnkeCwQqF5LeklOu6rAqgfBZqQ==",
+      "dev": true,
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-discard-duplicates": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-discard-duplicates/-/postcss-discard-duplicates-5.1.0.tgz",
+      "integrity": "sha512-zmX3IoSI2aoenxHV6C7plngHWWhUOV3sP1T8y2ifzxzbtnuhk1EdPwm0S1bIUNaJ2eNbWeGLEwzw8huPD67aQw==",
+      "dev": true,
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-discard-empty": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/postcss-discard-empty/-/postcss-discard-empty-5.1.1.tgz",
+      "integrity": "sha512-zPz4WljiSuLWsI0ir4Mcnr4qQQ5e1Ukc3i7UfE2XcrwKK2LIPIqE5jxMRxO6GbI3cv//ztXDsXwEWT3BHOGh3A==",
+      "dev": true,
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-discard-overridden": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-discard-overridden/-/postcss-discard-overridden-5.1.0.tgz",
+      "integrity": "sha512-21nOL7RqWR1kasIVdKs8HNqQJhFxLsyRfAnUDm4Fe4t4mCWL9OJiHvlHPjcd8zc5Myu89b/7wZDnOSjFgeWRtw==",
+      "dev": true,
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-import": {
+      "version": "14.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-import/-/postcss-import-14.1.0.tgz",
+      "integrity": "sha512-flwI+Vgm4SElObFVPpTIT7SU7R3qk2L7PyduMcokiaVKuWv9d/U+Gm/QAd8NDLuykTWTkcrjOeD2Pp1rMeBTGw==",
+      "dev": true,
+      "dependencies": {
+        "postcss-value-parser": "^4.0.0",
+        "read-cache": "^1.0.0",
+        "resolve": "^1.1.7"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.0.0"
+      }
+    },
+    "node_modules/postcss-js": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/postcss-js/-/postcss-js-4.0.0.tgz",
+      "integrity": "sha512-77QESFBwgX4irogGVPgQ5s07vLvFqWr228qZY+w6lW599cRlK/HmnlivnnVUxkjHnCu4J16PDMHcH+e+2HbvTQ==",
+      "dev": true,
+      "dependencies": {
+        "camelcase-css": "^2.0.1"
+      },
+      "engines": {
+        "node": "^12 || ^14 || >= 16"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/postcss/"
+      },
+      "peerDependencies": {
+        "postcss": "^8.3.3"
+      }
+    },
+    "node_modules/postcss-load-config": {
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-3.1.4.tgz",
+      "integrity": "sha512-6DiM4E7v4coTE4uzA8U//WhtPwyhiim3eyjEMFCnUpzbrkK9wJHgKDT2mR+HbtSrd/NubVaYTOpSpjUl8NQeRg==",
+      "dev": true,
+      "dependencies": {
+        "lilconfig": "^2.0.5",
+        "yaml": "^1.10.2"
+      },
+      "engines": {
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/postcss/"
+      },
+      "peerDependencies": {
+        "postcss": ">=8.0.9",
+        "ts-node": ">=9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "postcss": {
+          "optional": true
+        },
+        "ts-node": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/postcss-loader": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/postcss-loader/-/postcss-loader-6.2.1.tgz",
+      "integrity": "sha512-WbbYpmAaKcux/P66bZ40bpWsBucjx/TTgVVzRZ9yUO8yQfVBlameJ0ZGVaPfH64hNSBh63a+ICP5nqOpBA0w+Q==",
+      "dev": true,
+      "dependencies": {
+        "cosmiconfig": "^7.0.0",
+        "klona": "^2.0.5",
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": ">= 12.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      },
+      "peerDependencies": {
+        "postcss": "^7.0.0 || ^8.0.1",
+        "webpack": "^5.0.0"
+      }
+    },
+    "node_modules/postcss-loader/node_modules/semver": {
+      "version": "7.5.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/postcss-merge-longhand": {
+      "version": "5.1.6",
+      "resolved": "https://registry.npmjs.org/postcss-merge-longhand/-/postcss-merge-longhand-5.1.6.tgz",
+      "integrity": "sha512-6C/UGF/3T5OE2CEbOuX7iNO63dnvqhGZeUnKkDeifebY0XqkkvrctYSZurpNE902LDf2yKwwPFgotnfSoPhQiw==",
+      "dev": true,
+      "dependencies": {
+        "postcss-value-parser": "^4.2.0",
+        "stylehacks": "^5.1.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-merge-rules": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/postcss-merge-rules/-/postcss-merge-rules-5.1.2.tgz",
+      "integrity": "sha512-zKMUlnw+zYCWoPN6yhPjtcEdlJaMUZ0WyVcxTAmw3lkkN/NDMRkOkiuctQEoWAOvH7twaxUUdvBWl0d4+hifRQ==",
+      "dev": true,
+      "dependencies": {
+        "browserslist": "^4.16.6",
+        "caniuse-api": "^3.0.0",
+        "cssnano-utils": "^3.1.0",
+        "postcss-selector-parser": "^6.0.5"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-minify-font-values": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-minify-font-values/-/postcss-minify-font-values-5.1.0.tgz",
+      "integrity": "sha512-el3mYTgx13ZAPPirSVsHqFzl+BBBDrXvbySvPGFnQcTI4iNslrPaFq4muTkLZmKlGk4gyFAYUBMH30+HurREyA==",
+      "dev": true,
+      "dependencies": {
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-minify-gradients": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/postcss-minify-gradients/-/postcss-minify-gradients-5.1.1.tgz",
+      "integrity": "sha512-VGvXMTpCEo4qHTNSa9A0a3D+dxGFZCYwR6Jokk+/3oB6flu2/PnPXAh2x7x52EkY5xlIHLm+Le8tJxe/7TNhzw==",
+      "dev": true,
+      "dependencies": {
+        "colord": "^2.9.1",
+        "cssnano-utils": "^3.1.0",
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-minify-params": {
+      "version": "5.1.3",
+      "resolved": "https://registry.npmjs.org/postcss-minify-params/-/postcss-minify-params-5.1.3.tgz",
+      "integrity": "sha512-bkzpWcjykkqIujNL+EVEPOlLYi/eZ050oImVtHU7b4lFS82jPnsCb44gvC6pxaNt38Els3jWYDHTjHKf0koTgg==",
+      "dev": true,
+      "dependencies": {
+        "browserslist": "^4.16.6",
+        "cssnano-utils": "^3.1.0",
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-minify-selectors": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/postcss-minify-selectors/-/postcss-minify-selectors-5.2.1.tgz",
+      "integrity": "sha512-nPJu7OjZJTsVUmPdm2TcaiohIwxP+v8ha9NehQ2ye9szv4orirRU3SDdtUmKH+10nzn0bAyOXZ0UEr7OpvLehg==",
+      "dev": true,
+      "dependencies": {
+        "postcss-selector-parser": "^6.0.5"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-modules-extract-imports": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/postcss-modules-extract-imports/-/postcss-modules-extract-imports-3.0.0.tgz",
+      "integrity": "sha512-bdHleFnP3kZ4NYDhuGlVK+CMrQ/pqUm8bx/oGL93K6gVwiclvX5x0n76fYMKuIGKzlABOy13zsvqjb0f92TEXw==",
+      "dev": true,
+      "engines": {
+        "node": "^10 || ^12 || >= 14"
+      },
+      "peerDependencies": {
+        "postcss": "^8.1.0"
+      }
+    },
+    "node_modules/postcss-modules-local-by-default": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/postcss-modules-local-by-default/-/postcss-modules-local-by-default-4.0.0.tgz",
+      "integrity": "sha512-sT7ihtmGSF9yhm6ggikHdV0hlziDTX7oFoXtuVWeDd3hHObNkcHRo9V3yg7vCAY7cONyxJC/XXCmmiHHcvX7bQ==",
+      "dev": true,
+      "dependencies": {
+        "icss-utils": "^5.0.0",
+        "postcss-selector-parser": "^6.0.2",
+        "postcss-value-parser": "^4.1.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >= 14"
+      },
+      "peerDependencies": {
+        "postcss": "^8.1.0"
+      }
+    },
+    "node_modules/postcss-modules-scope": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/postcss-modules-scope/-/postcss-modules-scope-3.0.0.tgz",
+      "integrity": "sha512-hncihwFA2yPath8oZ15PZqvWGkWf+XUfQgUGamS4LqoP1anQLOsOJw0vr7J7IwLpoY9fatA2qiGUGmuZL0Iqlg==",
+      "dev": true,
+      "dependencies": {
+        "postcss-selector-parser": "^6.0.4"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >= 14"
+      },
+      "peerDependencies": {
+        "postcss": "^8.1.0"
+      }
+    },
+    "node_modules/postcss-modules-values": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/postcss-modules-values/-/postcss-modules-values-4.0.0.tgz",
+      "integrity": "sha512-RDxHkAiEGI78gS2ofyvCsu7iycRv7oqw5xMWn9iMoR0N/7mf9D50ecQqUo5BZ9Zh2vH4bCUR/ktCqbB9m8vJjQ==",
+      "dev": true,
+      "dependencies": {
+        "icss-utils": "^5.0.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >= 14"
+      },
+      "peerDependencies": {
+        "postcss": "^8.1.0"
+      }
+    },
+    "node_modules/postcss-nested": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/postcss-nested/-/postcss-nested-5.0.6.tgz",
+      "integrity": "sha512-rKqm2Fk0KbA8Vt3AdGN0FB9OBOMDVajMG6ZCf/GoHgdxUJ4sBFp0A/uMIRm+MJUdo33YXEtjqIz8u7DAp8B7DA==",
+      "dev": true,
+      "dependencies": {
+        "postcss-selector-parser": "^6.0.6"
+      },
+      "engines": {
+        "node": ">=12.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/postcss/"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.14"
+      }
+    },
+    "node_modules/postcss-normalize-charset": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-charset/-/postcss-normalize-charset-5.1.0.tgz",
+      "integrity": "sha512-mSgUJ+pd/ldRGVx26p2wz9dNZ7ji6Pn8VWBajMXFf8jk7vUoSrZ2lt/wZR7DtlZYKesmZI680qjr2CeFF2fbUg==",
+      "dev": true,
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-normalize-display-values": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-display-values/-/postcss-normalize-display-values-5.1.0.tgz",
+      "integrity": "sha512-WP4KIM4o2dazQXWmFaqMmcvsKmhdINFblgSeRgn8BJ6vxaMyaJkwAzpPpuvSIoG/rmX3M+IrRZEz2H0glrQNEA==",
+      "dev": true,
+      "dependencies": {
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-normalize-positions": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-positions/-/postcss-normalize-positions-5.1.1.tgz",
+      "integrity": "sha512-6UpCb0G4eofTCQLFVuI3EVNZzBNPiIKcA1AKVka+31fTVySphr3VUgAIULBhxZkKgwLImhzMR2Bw1ORK+37INg==",
+      "dev": true,
+      "dependencies": {
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-normalize-repeat-style": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-repeat-style/-/postcss-normalize-repeat-style-5.1.1.tgz",
+      "integrity": "sha512-mFpLspGWkQtBcWIRFLmewo8aC3ImN2i/J3v8YCFUwDnPu3Xz4rLohDO26lGjwNsQxB3YF0KKRwspGzE2JEuS0g==",
+      "dev": true,
+      "dependencies": {
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-normalize-string": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-string/-/postcss-normalize-string-5.1.0.tgz",
+      "integrity": "sha512-oYiIJOf4T9T1N4i+abeIc7Vgm/xPCGih4bZz5Nm0/ARVJ7K6xrDlLwvwqOydvyL3RHNf8qZk6vo3aatiw/go3w==",
+      "dev": true,
+      "dependencies": {
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-normalize-timing-functions": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-timing-functions/-/postcss-normalize-timing-functions-5.1.0.tgz",
+      "integrity": "sha512-DOEkzJ4SAXv5xkHl0Wa9cZLF3WCBhF3o1SKVxKQAa+0pYKlueTpCgvkFAHfk+Y64ezX9+nITGrDZeVGgITJXjg==",
+      "dev": true,
+      "dependencies": {
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-normalize-unicode": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-unicode/-/postcss-normalize-unicode-5.1.0.tgz",
+      "integrity": "sha512-J6M3MizAAZ2dOdSjy2caayJLQT8E8K9XjLce8AUQMwOrCvjCHv24aLC/Lps1R1ylOfol5VIDMaM/Lo9NGlk1SQ==",
+      "dev": true,
+      "dependencies": {
+        "browserslist": "^4.16.6",
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-normalize-url": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-url/-/postcss-normalize-url-5.1.0.tgz",
+      "integrity": "sha512-5upGeDO+PVthOxSmds43ZeMeZfKH+/DKgGRD7TElkkyS46JXAUhMzIKiCa7BabPeIy3AQcTkXwVVN7DbqsiCew==",
+      "dev": true,
+      "dependencies": {
+        "normalize-url": "^6.0.1",
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-normalize-whitespace": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-whitespace/-/postcss-normalize-whitespace-5.1.1.tgz",
+      "integrity": "sha512-83ZJ4t3NUDETIHTa3uEg6asWjSBYL5EdkVB0sDncx9ERzOKBVJIUeDO9RyA9Zwtig8El1d79HBp0JEi8wvGQnA==",
+      "dev": true,
+      "dependencies": {
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-ordered-values": {
+      "version": "5.1.3",
+      "resolved": "https://registry.npmjs.org/postcss-ordered-values/-/postcss-ordered-values-5.1.3.tgz",
+      "integrity": "sha512-9UO79VUhPwEkzbb3RNpqqghc6lcYej1aveQteWY+4POIwlqkYE21HKWaLDF6lWNuqCobEAyTovVhtI32Rbv2RQ==",
+      "dev": true,
+      "dependencies": {
+        "cssnano-utils": "^3.1.0",
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-reduce-initial": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-reduce-initial/-/postcss-reduce-initial-5.1.0.tgz",
+      "integrity": "sha512-5OgTUviz0aeH6MtBjHfbr57tml13PuedK/Ecg8szzd4XRMbYxH4572JFG067z+FqBIf6Zp/d+0581glkvvWMFw==",
+      "dev": true,
+      "dependencies": {
+        "browserslist": "^4.16.6",
+        "caniuse-api": "^3.0.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-reduce-transforms": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-reduce-transforms/-/postcss-reduce-transforms-5.1.0.tgz",
+      "integrity": "sha512-2fbdbmgir5AvpW9RLtdONx1QoYG2/EtqpNQbFASDlixBbAYuTcJ0dECwlqNqH7VbaUnEnh8SrxOe2sRIn24XyQ==",
+      "dev": true,
+      "dependencies": {
+        "postcss-value-parser": "^4.2.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-selector-parser": {
+      "version": "6.0.10",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.10.tgz",
+      "integrity": "sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==",
+      "dev": true,
+      "dependencies": {
+        "cssesc": "^3.0.0",
+        "util-deprecate": "^1.0.2"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/postcss-svgo": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-svgo/-/postcss-svgo-5.1.0.tgz",
+      "integrity": "sha512-D75KsH1zm5ZrHyxPakAxJWtkyXew5qwS70v56exwvw542d9CRtTo78K0WeFxZB4G7JXKKMbEZtZayTGdIky/eA==",
+      "dev": true,
+      "dependencies": {
+        "postcss-value-parser": "^4.2.0",
+        "svgo": "^2.7.0"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-unique-selectors": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/postcss-unique-selectors/-/postcss-unique-selectors-5.1.1.tgz",
+      "integrity": "sha512-5JiODlELrz8L2HwxfPnhOWZYWDxVHWL83ufOv84NrcgipI7TaeRsatAhK4Tr2/ZiYldpK/wBvw5BD3qfaK96GA==",
+      "dev": true,
+      "dependencies": {
+        "postcss-selector-parser": "^6.0.5"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/postcss-value-parser": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz",
+      "integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==",
+      "dev": true
+    },
+    "node_modules/prelude-ls": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
+      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/prettier": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.7.1.tgz",
+      "integrity": "sha512-ujppO+MkdPqoVINuDFDRLClm7D78qbDt0/NR+wp5FqEZOoTNAjPHWj17QRhu7geIHJfcNhRk1XVQmF8Bp3ye+g==",
+      "bin": {
+        "prettier": "bin-prettier.js"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      },
+      "funding": {
+        "url": "https://github.com/prettier/prettier?sponsor=1"
+      }
+    },
+    "node_modules/pretty": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/pretty/-/pretty-2.0.0.tgz",
+      "integrity": "sha512-G9xUchgTEiNpormdYBl+Pha50gOUovT18IvAe7EYMZ1/f9W/WWMPRn+xI68yXNMUk3QXHDwo/1wV/4NejVNe1w==",
+      "dev": true,
+      "dependencies": {
+        "condense-newlines": "^0.2.1",
+        "extend-shallow": "^2.0.1",
+        "js-beautify": "^1.6.12"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/pretty-error": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/pretty-error/-/pretty-error-4.0.0.tgz",
+      "integrity": "sha512-AoJ5YMAcXKYxKhuJGdcvse+Voc6v1RgnsR3nWcYU7q4t6z0Q6T86sv5Zq8VIRbOWWFpvdGE83LtdSMNd+6Y0xw==",
+      "dev": true,
+      "dependencies": {
+        "lodash": "^4.17.20",
+        "renderkid": "^3.0.0"
+      }
+    },
+    "node_modules/pretty-format": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-27.5.1.tgz",
+      "integrity": "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==",
+      "dev": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1",
+        "ansi-styles": "^5.0.0",
+        "react-is": "^17.0.1"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      }
+    },
+    "node_modules/pretty-format/node_modules/ansi-styles": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/process-nextick-args": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
+      "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
+      "dev": true
+    },
+    "node_modules/progress": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/progress/-/progress-2.0.3.tgz",
+      "integrity": "sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/progress-webpack-plugin": {
+      "version": "1.0.16",
+      "resolved": "https://registry.npmjs.org/progress-webpack-plugin/-/progress-webpack-plugin-1.0.16.tgz",
+      "integrity": "sha512-sdiHuuKOzELcBANHfrupYo+r99iPRyOnw15qX+rNlVUqXGfjXdH4IgxriKwG1kNJwVswKQHMdj1hYZMcb9jFaA==",
+      "dev": true,
+      "dependencies": {
+        "chalk": "^2.1.0",
+        "figures": "^2.0.0",
+        "log-update": "^2.3.0"
+      },
+      "engines": {
+        "node": ">= 10.13.0"
+      },
+      "peerDependencies": {
+        "webpack": "^2.0.0 || ^3.0.0 || ^4.0.0 || ^5.0.0"
+      }
+    },
+    "node_modules/promise-polyfill": {
+      "version": "8.2.3",
+      "resolved": "https://registry.npmjs.org/promise-polyfill/-/promise-polyfill-8.2.3.tgz",
+      "integrity": "sha512-Og0+jCRQetV84U8wVjMNccfGCnMQ9mGs9Hv78QFe+pSDD3gWTpz0y+1QCuxy5d/vBFuZ3iwP2eycAkvqIMPmWg=="
+    },
+    "node_modules/prompts": {
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/prompts/-/prompts-2.4.2.tgz",
+      "integrity": "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==",
+      "dev": true,
+      "dependencies": {
+        "kleur": "^3.0.3",
+        "sisteransi": "^1.0.5"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/proto-list": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/proto-list/-/proto-list-1.2.4.tgz",
+      "integrity": "sha512-vtK/94akxsTMhe0/cbfpR+syPuszcuwhqVjJq26CuNDgFGj682oRBXOP5MJpv2r7JtE8MsiepGIqvvOTBwn2vA==",
+      "dev": true
+    },
+    "node_modules/protobufjs": {
+      "version": "6.11.3",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-6.11.3.tgz",
+      "integrity": "sha512-xL96WDdCZYdU7Slin569tFX712BxsxslWwAfAhCYjQKGTq7dAU91Lomy6nLLhh/dyGhk/YH4TwTSRxTzhuHyZg==",
+      "hasInstallScript": true,
+      "dependencies": {
+        "@protobufjs/aspromise": "^1.1.2",
+        "@protobufjs/base64": "^1.1.2",
+        "@protobufjs/codegen": "^2.0.4",
+        "@protobufjs/eventemitter": "^1.1.0",
+        "@protobufjs/fetch": "^1.1.0",
+        "@protobufjs/float": "^1.0.2",
+        "@protobufjs/inquire": "^1.1.0",
+        "@protobufjs/path": "^1.1.2",
+        "@protobufjs/pool": "^1.1.0",
+        "@protobufjs/utf8": "^1.1.0",
+        "@types/long": "^4.0.1",
+        "@types/node": ">=13.7.0",
+        "long": "^4.0.0"
+      },
+      "bin": {
+        "pbjs": "bin/pbjs",
+        "pbts": "bin/pbts"
+      }
+    },
+    "node_modules/protobufjs/node_modules/long": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/long/-/long-4.0.0.tgz",
+      "integrity": "sha512-XsP+KhQif4bjX1kbuSiySJFNAehNxgLb6hPRGJ9QsUr8ajHkuXGdrHmFUTUUXhDwVX2R5bY4JNZEwbUiMhV+MA=="
+    },
+    "node_modules/proxy-addr": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
+      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "dev": true,
+      "dependencies": {
+        "forwarded": "0.2.0",
+        "ipaddr.js": "1.9.1"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/proxy-addr/node_modules/ipaddr.js": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/pseudomap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/pseudomap/-/pseudomap-1.0.2.tgz",
+      "integrity": "sha512-b/YwNhb8lk1Zz2+bXXpS/LK9OisiZZ1SNsSLxN1x2OXVEhW2Ckr/7mWE5vrC1ZTiJlD9g19jWszTmJsB+oEpFQ==",
+      "dev": true
+    },
+    "node_modules/psl": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/psl/-/psl-1.8.0.tgz",
+      "integrity": "sha512-RIdOzyoavK+hA18OGGWDqUTsCLhtA7IcZ/6NCs4fFJaHBDab+pDDmDIByWFRQJq2Cd7r1OoQxBGKOaztq+hjIQ==",
+      "dev": true
+    },
+    "node_modules/pug-error": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/pug-error/-/pug-error-2.0.0.tgz",
+      "integrity": "sha512-sjiUsi9M4RAGHktC1drQfCr5C5eriu24Lfbt4s+7SykztEOwVZtbFk1RRq0tzLxcMxMYTBR+zMQaG07J/btayQ==",
+      "dev": true
+    },
+    "node_modules/pug-lexer": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/pug-lexer/-/pug-lexer-5.0.1.tgz",
+      "integrity": "sha512-0I6C62+keXlZPZkOJeVam9aBLVP2EnbeDw3An+k0/QlqdwH6rv8284nko14Na7c0TtqtogfWXcRoFE4O4Ff20w==",
+      "dev": true,
+      "dependencies": {
+        "character-parser": "^2.2.0",
+        "is-expression": "^4.0.0",
+        "pug-error": "^2.0.0"
+      }
+    },
+    "node_modules/pump": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.0.tgz",
+      "integrity": "sha512-LwZy+p3SFs1Pytd/jYct4wpv49HiYCqd9Rlc5ZVdk0V+8Yzv6jR5Blk3TRmPL1ft69TxP0IMZGJ+WPFU2BFhww==",
+      "dev": true,
+      "dependencies": {
+        "end-of-stream": "^1.1.0",
+        "once": "^1.3.1"
+      }
+    },
+    "node_modules/punycode": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.1.1.tgz",
+      "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/qs": {
+      "version": "6.10.3",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.10.3.tgz",
+      "integrity": "sha512-wr7M2E0OFRfIfJZjKGieI8lBKb7fRCH4Fv5KNPEs7gJ8jadvotdsS08PzOKR7opXhZ/Xkjtt3WF9g38drmyRqQ==",
+      "dev": true,
+      "dependencies": {
+        "side-channel": "^1.0.4"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/querystringify": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/querystringify/-/querystringify-2.2.0.tgz",
+      "integrity": "sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==",
+      "dev": true
+    },
+    "node_modules/queue-microtask": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
+      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
+    "node_modules/quick-lru": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/quick-lru/-/quick-lru-5.1.1.tgz",
+      "integrity": "sha512-WuyALRjWPDGtt/wzJiadO5AXY+8hZ80hVpe6MyivgraREW751X3SbhRvG3eLKOYN+8VEvqLcf3wdnt44Z4S4SA==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/randombytes": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz",
+      "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==",
+      "dev": true,
+      "dependencies": {
+        "safe-buffer": "^5.1.0"
+      }
+    },
+    "node_modules/range-parser": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
+      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/raw-body": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.1.tgz",
+      "integrity": "sha512-qqJBtEyVgS0ZmPGdCFPWJ3FreoqvG4MVQln/kCgF7Olq95IbOp0/BWyMwbdtn4VTvkM8Y7khCQ2Xgk/tcrCXig==",
+      "dev": true,
+      "dependencies": {
+        "bytes": "3.1.2",
+        "http-errors": "2.0.0",
+        "iconv-lite": "0.4.24",
+        "unpipe": "1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/raw-body/node_modules/bytes": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/react-is": {
+      "version": "17.0.2",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
+      "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
+      "dev": true
+    },
+    "node_modules/read-cache": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/read-cache/-/read-cache-1.0.0.tgz",
+      "integrity": "sha512-Owdv/Ft7IjOgm/i0xvNDZ1LrRANRfew4b2prF3OWMQLxLfu3bS8FVhCsrSCMK4lR56Y9ya+AThoTpDCTxCmpRA==",
+      "dev": true,
+      "dependencies": {
+        "pify": "^2.3.0"
+      }
+    },
+    "node_modules/read-pkg": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-5.2.0.tgz",
+      "integrity": "sha512-Ug69mNOpfvKDAc2Q8DRpMjjzdtrnv9HcSMX+4VsZxD1aZ6ZzrIE7rlzXBtWTyhULSMKg076AW6WR5iZpD0JiOg==",
+      "dev": true,
+      "dependencies": {
+        "@types/normalize-package-data": "^2.4.0",
+        "normalize-package-data": "^2.5.0",
+        "parse-json": "^5.0.0",
+        "type-fest": "^0.6.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/read-pkg-up": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/read-pkg-up/-/read-pkg-up-7.0.1.tgz",
+      "integrity": "sha512-zK0TB7Xd6JpCLmlLmufqykGE+/TlOePD6qKClNW7hHDKFh/J7/7gCWGR7joEQEW1bKq3a3yUZSObOoWLFQ4ohg==",
+      "dev": true,
+      "dependencies": {
+        "find-up": "^4.1.0",
+        "read-pkg": "^5.2.0",
+        "type-fest": "^0.8.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/read-pkg-up/node_modules/type-fest": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.8.1.tgz",
+      "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/readable-stream": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.0.tgz",
+      "integrity": "sha512-BViHy7LKeTz4oNnkcLJ+lVSL6vpiFeX6/d3oSH8zCW7UxP2onchk+vTGB143xuFjHS3deTgkKoXXymXqymiIdA==",
+      "dev": true,
+      "dependencies": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/readdirp": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
+      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
+      "dev": true,
+      "dependencies": {
+        "picomatch": "^2.2.1"
+      },
+      "engines": {
+        "node": ">=8.10.0"
+      }
+    },
+    "node_modules/regenerate": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/regenerate/-/regenerate-1.4.2.tgz",
+      "integrity": "sha512-zrceR/XhGYU/d/opr2EKO7aRHUeiBI8qjtfHqADTwZd6Szfy16la6kqD0MIUs5z5hx6AaKa+PixpPrR289+I0A==",
+      "dev": true
+    },
+    "node_modules/regenerate-unicode-properties": {
+      "version": "10.0.1",
+      "resolved": "https://registry.npmjs.org/regenerate-unicode-properties/-/regenerate-unicode-properties-10.0.1.tgz",
+      "integrity": "sha512-vn5DU6yg6h8hP/2OkQo3K7uVILvY4iu0oI4t3HFa81UPkhGJwkRwM10JEc3upjdhHjs/k8GJY1sRBhk5sr69Bw==",
+      "dev": true,
+      "dependencies": {
+        "regenerate": "^1.4.2"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/regenerator-runtime": {
+      "version": "0.13.9",
+      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.9.tgz",
+      "integrity": "sha512-p3VT+cOEgxFsRRA9X4lkI1E+k2/CtnKtU4gcxyaCUreilL/vqI6CdZ3wxVUx3UOUg+gnUOQQcRI7BmSI656MYA==",
+      "dev": true
+    },
+    "node_modules/regenerator-transform": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/regenerator-transform/-/regenerator-transform-0.15.0.tgz",
+      "integrity": "sha512-LsrGtPmbYg19bcPHwdtmXwbW+TqNvtY4riE3P83foeHRroMbH6/2ddFBfab3t7kbzc7v7p4wbkIecHImqt0QNg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/runtime": "^7.8.4"
+      }
+    },
+    "node_modules/regexpp": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/regexpp/-/regexpp-3.2.0.tgz",
+      "integrity": "sha512-pq2bWo9mVD43nbts2wGv17XLiNLya+GklZ8kaDLV2Z08gDCsGpnKn9BFMepvWuHCbyVvY7J5o5+BVvoQbmlJLg==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/mysticatea"
+      }
+    },
+    "node_modules/regexpu-core": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/regexpu-core/-/regexpu-core-5.1.0.tgz",
+      "integrity": "sha512-bb6hk+xWd2PEOkj5It46A16zFMs2mv86Iwpdu94la4S3sJ7C973h2dHpYKwIBGaWSO7cIRJ+UX0IeMaWcO4qwA==",
+      "dev": true,
+      "dependencies": {
+        "regenerate": "^1.4.2",
+        "regenerate-unicode-properties": "^10.0.1",
+        "regjsgen": "^0.6.0",
+        "regjsparser": "^0.8.2",
+        "unicode-match-property-ecmascript": "^2.0.0",
+        "unicode-match-property-value-ecmascript": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/regjsgen": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/regjsgen/-/regjsgen-0.6.0.tgz",
+      "integrity": "sha512-ozE883Uigtqj3bx7OhL1KNbCzGyW2NQZPl6Hs09WTvCuZD5sTI4JY58bkbQWa/Y9hxIsvJ3M8Nbf7j54IqeZbA==",
+      "dev": true
+    },
+    "node_modules/regjsparser": {
+      "version": "0.8.4",
+      "resolved": "https://registry.npmjs.org/regjsparser/-/regjsparser-0.8.4.tgz",
+      "integrity": "sha512-J3LABycON/VNEu3abOviqGHuB/LOtOQj8SKmfP9anY5GfAVw/SPjwzSjxGjbZXIxbGfqTHtJw58C2Li/WkStmA==",
+      "dev": true,
+      "dependencies": {
+        "jsesc": "~0.5.0"
+      },
+      "bin": {
+        "regjsparser": "bin/parser"
+      }
+    },
+    "node_modules/regjsparser/node_modules/jsesc": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-0.5.0.tgz",
+      "integrity": "sha512-uZz5UnB7u4T9LvwmFqXii7pZSouaRPorGs5who1Ip7VO0wxanFvBL7GkM6dTHlgX+jhBApRetaWpnDabOeTcnA==",
+      "dev": true,
+      "bin": {
+        "jsesc": "bin/jsesc"
+      }
+    },
+    "node_modules/relateurl": {
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/relateurl/-/relateurl-0.2.7.tgz",
+      "integrity": "sha512-G08Dxvm4iDN3MLM0EsP62EDV9IuhXPR6blNz6Utcp7zyV3tr4HVNINt6MpaRWbxoOHT3Q7YN2P+jaHX8vUbgog==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.10"
+      }
+    },
+    "node_modules/renderkid": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/renderkid/-/renderkid-3.0.0.tgz",
+      "integrity": "sha512-q/7VIQA8lmM1hF+jn+sFSPWGlMkSAeNYcPLmDQx2zzuiDfaLrOmumR8iaUKlenFgh0XRPIUeSPlH3A+AW3Z5pg==",
+      "dev": true,
+      "dependencies": {
+        "css-select": "^4.1.3",
+        "dom-converter": "^0.2.0",
+        "htmlparser2": "^6.1.0",
+        "lodash": "^4.17.21",
+        "strip-ansi": "^6.0.1"
+      }
+    },
+    "node_modules/require-directory": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
+      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/requires-port": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz",
+      "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==",
+      "dev": true
+    },
+    "node_modules/resolve": {
+      "version": "1.22.1",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.1.tgz",
+      "integrity": "sha512-nBpuuYuY5jFsli/JIs1oldw6fOQCBioohqWZg/2hiaOybXOft4lonv85uDOKXdf8rhyK159cxU5cDcK/NKk8zw==",
+      "dev": true,
+      "dependencies": {
+        "is-core-module": "^2.9.0",
+        "path-parse": "^1.0.7",
+        "supports-preserve-symlinks-flag": "^1.0.0"
+      },
+      "bin": {
+        "resolve": "bin/resolve"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/resolve-cwd": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-cwd/-/resolve-cwd-3.0.0.tgz",
+      "integrity": "sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==",
+      "dev": true,
+      "dependencies": {
+        "resolve-from": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/resolve-cwd/node_modules/resolve-from": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
+      "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/resolve-from": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
+      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/resolve.exports": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/resolve.exports/-/resolve.exports-1.1.0.tgz",
+      "integrity": "sha512-J1l+Zxxp4XK3LUDZ9m60LRJF/mAe4z6a4xyabPHk7pvK5t35dACV32iIjJDFeWZFfZlO29w6SZ67knR0tHzJtQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/restore-cursor": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-3.1.0.tgz",
+      "integrity": "sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==",
+      "dev": true,
+      "dependencies": {
+        "onetime": "^5.1.0",
+        "signal-exit": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/retry": {
+      "version": "0.13.1",
+      "resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz",
+      "integrity": "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/reusify": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.0.4.tgz",
+      "integrity": "sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==",
+      "dev": true,
+      "engines": {
+        "iojs": ">=1.0.0",
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/rimraf": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz",
+      "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
+      "dev": true,
+      "dependencies": {
+        "glob": "^7.1.3"
+      },
+      "bin": {
+        "rimraf": "bin.js"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/run-parallel": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
+      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "dependencies": {
+        "queue-microtask": "^1.2.2"
+      }
+    },
+    "node_modules/rxjs": {
+      "version": "7.5.5",
+      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.5.5.tgz",
+      "integrity": "sha512-sy+H0pQofO95VDmFLzyaw9xNJU4KTRSwQIGM6+iG3SypAtCiLDzpeG8sJrNCWn2Up9km+KhkvTdbkrdy+yzZdw==",
+      "dependencies": {
+        "tslib": "^2.1.0"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+      "dev": true
+    },
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "dev": true
+    },
+    "node_modules/saxes": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/saxes/-/saxes-5.0.1.tgz",
+      "integrity": "sha512-5LBh1Tls8c9xgGjw3QrMwETmTMVk0oFgvrFSvWx62llR2hcEInrKNZ2GZCCuuy2lvWrdl5jhbpeqc5hRYKFOcw==",
+      "dev": true,
+      "dependencies": {
+        "xmlchars": "^2.2.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/schema-utils": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-3.1.2.tgz",
+      "integrity": "sha512-pvjEHOgWc9OWA/f/DE3ohBWTD6EleVLf7iFUkoSwAxttdBhB9QUebQgxER2kWueOvRJXPHNnyrvvh9eZINB8Eg==",
+      "dev": true,
+      "dependencies": {
+        "@types/json-schema": "^7.0.8",
+        "ajv": "^6.12.5",
+        "ajv-keywords": "^3.5.2"
+      },
+      "engines": {
+        "node": ">= 10.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      }
+    },
+    "node_modules/select": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/select/-/select-1.1.2.tgz",
+      "integrity": "sha512-OwpTSOfy6xSs1+pwcNrv0RBMOzI39Lp3qQKUTPVVPRjCdNa5JH/oPRiqsesIskK8TVgmRiHwO4KXlV2Li9dANA=="
+    },
+    "node_modules/select-hose": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/select-hose/-/select-hose-2.0.0.tgz",
+      "integrity": "sha512-mEugaLK+YfkijB4fx0e6kImuJdCIt2LxCRcbEYPqRGCs4F2ogyfZU5IAZRdjCP8JPq2AtdNoC/Dux63d9Kiryg==",
+      "dev": true
+    },
+    "node_modules/selfsigned": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/selfsigned/-/selfsigned-2.0.1.tgz",
+      "integrity": "sha512-LmME957M1zOsUhG+67rAjKfiWFox3SBxE/yymatMZsAx+oMrJ0YQ8AToOnyCm7xbeg2ep37IHLxdu0o2MavQOQ==",
+      "dev": true,
+      "dependencies": {
+        "node-forge": "^1"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true,
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/semver-parser": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/semver-parser/-/semver-parser-4.0.1.tgz",
+      "integrity": "sha512-ZdnhLJSeLkc9fXEwqdvVXqrVJ8jq/vhGlFfsMhOE4oIiSZlvUC6Ar4NAbdj+H5DEkhFjyhucce7BO8VL/rpY9g=="
+    },
+    "node_modules/send": {
+      "version": "0.18.0",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.18.0.tgz",
+      "integrity": "sha512-qqWzuOjSFOuqPjFe4NOsMLafToQQwBSOEpS+FwEt3A2V3vKubTquT3vmLTQpFgMXp8AlFWFuP1qKaJZOtPpVXg==",
+      "dev": true,
+      "dependencies": {
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "1.2.0",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "fresh": "0.5.2",
+        "http-errors": "2.0.0",
+        "mime": "1.6.0",
+        "ms": "2.1.3",
+        "on-finished": "2.4.1",
+        "range-parser": "~1.2.1",
+        "statuses": "2.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/send/node_modules/debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "dev": true,
+      "dependencies": {
+        "ms": "2.0.0"
+      }
+    },
+    "node_modules/send/node_modules/debug/node_modules/ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "dev": true
+    },
+    "node_modules/send/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "dev": true
+    },
+    "node_modules/serialize-javascript": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.1.tgz",
+      "integrity": "sha512-owoXEFjWRllis8/M1Q+Cw5k8ZH40e3zhp/ovX+Xr/vi1qj6QesbyXXViFbpNvWvPNAD62SutwEXavefrLJWj7w==",
+      "dev": true,
+      "dependencies": {
+        "randombytes": "^2.1.0"
+      }
+    },
+    "node_modules/serve-index": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/serve-index/-/serve-index-1.9.1.tgz",
+      "integrity": "sha512-pXHfKNP4qujrtteMrSBb0rc8HJ9Ms/GrXwcUtUtD5s4ewDJI8bT3Cz2zTVRMKtri49pLx2e0Ya8ziP5Ya2pZZw==",
+      "dev": true,
+      "dependencies": {
+        "accepts": "~1.3.4",
+        "batch": "0.6.1",
+        "debug": "2.6.9",
+        "escape-html": "~1.0.3",
+        "http-errors": "~1.6.2",
+        "mime-types": "~2.1.17",
+        "parseurl": "~1.3.2"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/serve-index/node_modules/debug": {
+      "version": "2.6.9",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "dev": true,
+      "dependencies": {
+        "ms": "2.0.0"
+      }
+    },
+    "node_modules/serve-index/node_modules/depd": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-1.1.2.tgz",
+      "integrity": "sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/serve-index/node_modules/http-errors": {
+      "version": "1.6.3",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.6.3.tgz",
+      "integrity": "sha512-lks+lVC8dgGyh97jxvxeYTWQFvh4uw4yC12gVl63Cg30sjPX4wuGcdkICVXDAESr6OJGjqGA8Iz5mkeN6zlD7A==",
+      "dev": true,
+      "dependencies": {
+        "depd": "~1.1.2",
+        "inherits": "2.0.3",
+        "setprototypeof": "1.1.0",
+        "statuses": ">= 1.4.0 < 2"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/serve-index/node_modules/inherits": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
+      "integrity": "sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw==",
+      "dev": true
+    },
+    "node_modules/serve-index/node_modules/ms": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "dev": true
+    },
+    "node_modules/serve-index/node_modules/setprototypeof": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.1.0.tgz",
+      "integrity": "sha512-BvE/TwpZX4FXExxOxZyRGQQv651MSwmWKZGqvmPcRIjDqWub67kTKuIMx43cZZrS/cBBzwBcNDWoFxt2XEFIpQ==",
+      "dev": true
+    },
+    "node_modules/serve-index/node_modules/statuses": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-1.5.0.tgz",
+      "integrity": "sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/serve-static": {
+      "version": "1.15.0",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.15.0.tgz",
+      "integrity": "sha512-XGuRDNjXUijsUL0vl6nSD7cwURuzEgglbOaFuZM9g3kwDXOWVTck0jLzjPzGD+TazWbboZYu52/9/XPdUgne9g==",
+      "dev": true,
+      "dependencies": {
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "parseurl": "~1.3.3",
+        "send": "0.18.0"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+      "dev": true
+    },
+    "node_modules/shallow-clone": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/shallow-clone/-/shallow-clone-3.0.1.tgz",
+      "integrity": "sha512-/6KqX+GVUdqPuPPd2LxDDxzX6CAbjJehAAOKlNpqqUpAqPM6HeL8f+o3a+JsyGjn2lv0WY8UsTgUJjU9Ok55NA==",
+      "dev": true,
+      "dependencies": {
+        "kind-of": "^6.0.2"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-command": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-1.2.0.tgz",
+      "integrity": "sha512-EV3L1+UQWGor21OmnvojK36mhg+TyIKDh3iFBKBohr5xeXIhNBcx8oWdgkTEEQ+BEFFYdLRuqMfd5L84N1V5Vg==",
+      "dev": true,
+      "dependencies": {
+        "shebang-regex": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-1.0.0.tgz",
+      "integrity": "sha512-wpoSFAxys6b2a2wHZ1XpDSgD7N9iVjg29Ph9uV/uaP9Ex/KXlkTZTeddxDPSYQpgvzKLGJke2UU0AzoGCjNIvQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/shell-quote": {
+      "version": "1.7.3",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.7.3.tgz",
+      "integrity": "sha512-Vpfqwm4EnqGdlsBFNmHhxhElJYrdfcxPThu+ryKS5J8L/fhAwLazFZtq+S+TWZ9ANj2piSQLGj6NQg+lKPmxrw==",
+      "dev": true
+    },
+    "node_modules/side-channel": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.4.tgz",
+      "integrity": "sha512-q5XPytqFEIKHkGdiMIrY10mvLRvnQh42/+GoBlFW3b2LXLE2xxJpZFdm94we0BaoV3RwJyGqg5wS7epxTv0Zvw==",
+      "dev": true,
+      "dependencies": {
+        "call-bind": "^1.0.0",
+        "get-intrinsic": "^1.0.2",
+        "object-inspect": "^1.9.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/sigmund": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/sigmund/-/sigmund-1.0.1.tgz",
+      "integrity": "sha512-fCvEXfh6NWpm+YSuY2bpXb/VIihqWA6hLsgboC+0nl71Q7N7o2eaCW8mJa/NLvQhs6jpd3VZV4UiUQlV6+lc8g==",
+      "dev": true
+    },
+    "node_modules/signal-exit": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "dev": true
+    },
+    "node_modules/sirv": {
+      "version": "1.0.19",
+      "resolved": "https://registry.npmjs.org/sirv/-/sirv-1.0.19.tgz",
+      "integrity": "sha512-JuLThK3TnZG1TAKDwNIqNq6QA2afLOCcm+iE8D1Kj3GA40pSPsxQjjJl0J8X3tsR7T+CP1GavpzLwYkgVLWrZQ==",
+      "dev": true,
+      "dependencies": {
+        "@polka/url": "^1.0.0-next.20",
+        "mrmime": "^1.0.0",
+        "totalist": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/sisteransi": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz",
+      "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==",
+      "dev": true
+    },
+    "node_modules/slash": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
+      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/slice-ansi": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-4.0.0.tgz",
+      "integrity": "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "astral-regex": "^2.0.0",
+        "is-fullwidth-code-point": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/slice-ansi?sponsor=1"
+      }
+    },
+    "node_modules/slice-ansi/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/slice-ansi/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/slice-ansi/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/slugify": {
+      "version": "1.6.5",
+      "resolved": "https://registry.npmjs.org/slugify/-/slugify-1.6.5.tgz",
+      "integrity": "sha512-8mo9bslnBO3tr5PEVFzMPIWwWnipGS0xVbYf65zxDqfNwmzYn1LpiKNrR6DlClusuvo+hDHd1zKpmfAe83NQSQ==",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/sockjs": {
+      "version": "0.3.24",
+      "resolved": "https://registry.npmjs.org/sockjs/-/sockjs-0.3.24.tgz",
+      "integrity": "sha512-GJgLTZ7vYb/JtPSSZ10hsOYIvEYsjbNU+zPdIHcUaWVNUEPivzxku31865sSSud0Da0W4lEeOPlmw93zLQchuQ==",
+      "dev": true,
+      "dependencies": {
+        "faye-websocket": "^0.11.3",
+        "uuid": "^8.3.2",
+        "websocket-driver": "^0.7.4"
+      }
+    },
+    "node_modules/source-map": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/source-map-js": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.0.2.tgz",
+      "integrity": "sha512-R0XvVJ9WusLiqTCEiGCmICCMplcCkIwwR11mOSD9CR5u+IXYdiseeEuXCVAjS54zqwkLcPNnmU4OeJ6tUrWhDw==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/source-map-support": {
+      "version": "0.5.21",
+      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
+      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+      "dev": true,
+      "dependencies": {
+        "buffer-from": "^1.0.0",
+        "source-map": "^0.6.0"
+      }
+    },
+    "node_modules/sourcemap-codec": {
+      "version": "1.4.8",
+      "resolved": "https://registry.npmjs.org/sourcemap-codec/-/sourcemap-codec-1.4.8.tgz",
+      "integrity": "sha512-9NykojV5Uih4lgo5So5dtw+f0JgJX30KCNI8gwhz2J9A15wD0Ml6tjHKwf6fTSa6fAdVBdZeNOs9eJ71qCk8vA=="
+    },
+    "node_modules/spdx-correct": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.1.1.tgz",
+      "integrity": "sha512-cOYcUWwhCuHCXi49RhFRCyJEK3iPj1Ziz9DpViV3tbZOwXD49QzIN3MpOLJNxh2qwq2lJJZaKMVw9qNi4jTC0w==",
+      "dev": true,
+      "dependencies": {
+        "spdx-expression-parse": "^3.0.0",
+        "spdx-license-ids": "^3.0.0"
+      }
+    },
+    "node_modules/spdx-exceptions": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.3.0.tgz",
+      "integrity": "sha512-/tTrYOC7PPI1nUAgx34hUpqXuyJG+DTHJTnIULG4rDygi4xu/tfgmq1e1cIRwRzwZgo4NLySi+ricLkZkw4i5A==",
+      "dev": true
+    },
+    "node_modules/spdx-expression-parse": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
+      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
+      "dev": true,
+      "dependencies": {
+        "spdx-exceptions": "^2.1.0",
+        "spdx-license-ids": "^3.0.0"
+      }
+    },
+    "node_modules/spdx-license-ids": {
+      "version": "3.0.11",
+      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.11.tgz",
+      "integrity": "sha512-Ctl2BrFiM0X3MANYgj3CkygxhRmr9mi6xhejbdO960nF6EDJApTYpn0BQnDKlnNBULKiCN1n3w9EBkHK8ZWg+g==",
+      "dev": true
+    },
+    "node_modules/spdy": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/spdy/-/spdy-4.0.2.tgz",
+      "integrity": "sha512-r46gZQZQV+Kl9oItvl1JZZqJKGr+oEkB08A6BzkiR7593/7IbtuncXHd2YoYeTsG4157ZssMu9KYvUHLcjcDoA==",
+      "dev": true,
+      "dependencies": {
+        "debug": "^4.1.0",
+        "handle-thing": "^2.0.0",
+        "http-deceiver": "^1.2.7",
+        "select-hose": "^2.0.0",
+        "spdy-transport": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/spdy-transport": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/spdy-transport/-/spdy-transport-3.0.0.tgz",
+      "integrity": "sha512-hsLVFE5SjA6TCisWeJXFKniGGOpBgMLmerfO2aCyCU5s7nJ/rpAepqmFifv/GCbSbueEeAJJnmSQ2rKC/g8Fcw==",
+      "dev": true,
+      "dependencies": {
+        "debug": "^4.1.0",
+        "detect-node": "^2.0.4",
+        "hpack.js": "^2.1.6",
+        "obuf": "^1.1.2",
+        "readable-stream": "^3.0.6",
+        "wbuf": "^1.7.3"
+      }
+    },
+    "node_modules/sprintf-js": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
+      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
+      "dev": true
+    },
+    "node_modules/ssri": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/ssri/-/ssri-8.0.1.tgz",
+      "integrity": "sha512-97qShzy1AiyxvPNIkLWoGua7xoQzzPjQ0HAH4B0rWKo7SZ6USuPcrUiAFrws0UH8RrbWmgq3LMTObhPIHbbBeQ==",
+      "dev": true,
+      "dependencies": {
+        "minipass": "^3.1.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/stable": {
+      "version": "0.1.8",
+      "resolved": "https://registry.npmjs.org/stable/-/stable-0.1.8.tgz",
+      "integrity": "sha512-ji9qxRnOVfcuLDySj9qzhGSEFVobyt1kIOSkj1qZzYLzq7Tos/oUUWvotUPQLlrsidqsK6tBH89Bc9kL5zHA6w==",
+      "deprecated": "Modern JS already guarantees Array#sort() is a stable sort, so this library is deprecated. See the compatibility table on MDN: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility",
+      "dev": true
+    },
+    "node_modules/stack-utils": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/stack-utils/-/stack-utils-2.0.5.tgz",
+      "integrity": "sha512-xrQcmYhOsn/1kX+Vraq+7j4oE2j/6BFscZ0etmYg81xuM8Gq0022Pxb8+IqgOFUIaxHs0KaSb7T1+OegiNrNFA==",
+      "dev": true,
+      "dependencies": {
+        "escape-string-regexp": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/stack-utils/node_modules/escape-string-regexp": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz",
+      "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/stackframe": {
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/stackframe/-/stackframe-1.3.4.tgz",
+      "integrity": "sha512-oeVtt7eWQS+Na6F//S4kJ2K2VbRlS9D43mAlMyVpVWovy9o+jfgH8O9agzANzaiLjclA0oYzUXEM4PurhSUChw==",
+      "dev": true
+    },
+    "node_modules/statuses": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz",
+      "integrity": "sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "dev": true,
+      "dependencies": {
+        "safe-buffer": "~5.2.0"
+      }
+    },
+    "node_modules/string_decoder/node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
+    "node_modules/string-length": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/string-length/-/string-length-4.0.2.tgz",
+      "integrity": "sha512-+l6rNN5fYHNhZZy41RXsYptCjA2Igmq4EG7kZAYFQI1E1VTXarr6ZPXBg6eq7Y6eK4FEhY6AJlyuFIb/v/S0VQ==",
+      "dev": true,
+      "dependencies": {
+        "char-regex": "^1.0.2",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-bom": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-4.0.0.tgz",
+      "integrity": "sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-eof": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/strip-eof/-/strip-eof-1.0.0.tgz",
+      "integrity": "sha512-7FCwGGmx8mD5xQd3RPUvnSpUXHM3BWuzjtpD4TXsfcZ9EL4azvVVUscFYwD9nx8Kh+uCBC00XBtAykoMHwTh8Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/strip-final-newline": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz",
+      "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/strip-indent": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/strip-indent/-/strip-indent-2.0.0.tgz",
+      "integrity": "sha512-RsSNPLpq6YUL7QYy44RnPVTn/lcVZtb48Uof3X5JLbF4zD/Gs7ZFDv2HWol+leoQN2mT86LAzSshGfkTlSOpsA==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/stylehacks": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/stylehacks/-/stylehacks-5.1.0.tgz",
+      "integrity": "sha512-SzLmvHQTrIWfSgljkQCw2++C9+Ne91d/6Sp92I8c5uHTcy/PgeHamwITIbBW9wnFTY/3ZfSXR9HIL6Ikqmcu6Q==",
+      "dev": true,
+      "dependencies": {
+        "browserslist": "^4.16.6",
+        "postcss-selector-parser": "^6.0.4"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.2.15"
+      }
+    },
+    "node_modules/supports-color": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
+      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/supports-hyperlinks": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/supports-hyperlinks/-/supports-hyperlinks-2.2.0.tgz",
+      "integrity": "sha512-6sXEzV5+I5j8Bmq9/vUphGRM/RJNT9SCURJLjwfOg51heRtguGWDzcaBlgAzKhQa0EVNpPEKzQuBwZ8S8WaCeQ==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0",
+        "supports-color": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/supports-hyperlinks/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/supports-hyperlinks/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/supports-preserve-symlinks-flag": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
+      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/svg-tags": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/svg-tags/-/svg-tags-1.0.0.tgz",
+      "integrity": "sha512-ovssysQTa+luh7A5Weu3Rta6FJlFBBbInjOh722LIt6klpU2/HtdUbszju/G4devcvk8PGt7FCLv5wftu3THUA==",
+      "dev": true
+    },
+    "node_modules/svg.draggable.js": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/svg.draggable.js/-/svg.draggable.js-2.2.2.tgz",
+      "integrity": "sha512-JzNHBc2fLQMzYCZ90KZHN2ohXL0BQJGQimK1kGk6AvSeibuKcIdDX9Kr0dT9+UJ5O8nYA0RB839Lhvk4CY4MZw==",
+      "dependencies": {
+        "svg.js": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/svg.easing.js": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/svg.easing.js/-/svg.easing.js-2.0.0.tgz",
+      "integrity": "sha512-//ctPdJMGy22YoYGV+3HEfHbm6/69LJUTAqI2/5qBvaNHZ9uUFVC82B0Pl299HzgH13rKrBgi4+XyXXyVWWthA==",
+      "dependencies": {
+        "svg.js": ">=2.3.x"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/svg.filter.js": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/svg.filter.js/-/svg.filter.js-2.0.2.tgz",
+      "integrity": "sha512-xkGBwU+dKBzqg5PtilaTb0EYPqPfJ9Q6saVldX+5vCRy31P6TlRCP3U9NxH3HEufkKkpNgdTLBJnmhDHeTqAkw==",
+      "dependencies": {
+        "svg.js": "^2.2.5"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/svg.js": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/svg.js/-/svg.js-2.7.1.tgz",
+      "integrity": "sha512-ycbxpizEQktk3FYvn/8BH+6/EuWXg7ZpQREJvgacqn46gIddG24tNNe4Son6omdXCnSOaApnpZw6MPCBA1dODA=="
+    },
+    "node_modules/svg.pathmorphing.js": {
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/svg.pathmorphing.js/-/svg.pathmorphing.js-0.1.3.tgz",
+      "integrity": "sha512-49HWI9X4XQR/JG1qXkSDV8xViuTLIWm/B/7YuQELV5KMOPtXjiwH4XPJvr/ghEDibmLQ9Oc22dpWpG0vUDDNww==",
+      "dependencies": {
+        "svg.js": "^2.4.0"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/svg.resize.js": {
+      "version": "1.4.3",
+      "resolved": "https://registry.npmjs.org/svg.resize.js/-/svg.resize.js-1.4.3.tgz",
+      "integrity": "sha512-9k5sXJuPKp+mVzXNvxz7U0uC9oVMQrrf7cFsETznzUDDm0x8+77dtZkWdMfRlmbkEEYvUn9btKuZ3n41oNA+uw==",
+      "dependencies": {
+        "svg.js": "^2.6.5",
+        "svg.select.js": "^2.1.2"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/svg.resize.js/node_modules/svg.select.js": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/svg.select.js/-/svg.select.js-2.1.2.tgz",
+      "integrity": "sha512-tH6ABEyJsAOVAhwcCjF8mw4crjXSI1aa7j2VQR8ZuJ37H2MBUbyeqYr5nEO7sSN3cy9AR9DUwNg0t/962HlDbQ==",
+      "dependencies": {
+        "svg.js": "^2.2.5"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/svg.select.js": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/svg.select.js/-/svg.select.js-3.0.1.tgz",
+      "integrity": "sha512-h5IS/hKkuVCbKSieR9uQCj9w+zLHoPh+ce19bBYyqF53g6mnPB8sAtIbe1s9dh2S2fCmYX2xel1Ln3PJBbK4kw==",
+      "dependencies": {
+        "svg.js": "^2.6.5"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/svgo": {
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/svgo/-/svgo-2.8.0.tgz",
+      "integrity": "sha512-+N/Q9kV1+F+UeWYoSiULYo4xYSDQlTgb+ayMobAXPwMnLvop7oxKMo9OzIrX5x3eS4L4f2UHhc9axXwY8DpChg==",
+      "dev": true,
+      "dependencies": {
+        "@trysound/sax": "0.2.0",
+        "commander": "^7.2.0",
+        "css-select": "^4.1.3",
+        "css-tree": "^1.1.3",
+        "csso": "^4.2.0",
+        "picocolors": "^1.0.0",
+        "stable": "^0.1.8"
+      },
+      "bin": {
+        "svgo": "bin/svgo"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/svgo/node_modules/commander": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-7.2.0.tgz",
+      "integrity": "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==",
+      "dev": true,
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/symbol-tree": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
+      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
+      "dev": true
+    },
+    "node_modules/table": {
+      "version": "6.8.1",
+      "resolved": "https://registry.npmjs.org/table/-/table-6.8.1.tgz",
+      "integrity": "sha512-Y4X9zqrCftUhMeH2EptSSERdVKt/nEdijTOacGD/97EKjhQ/Qs8RTlEGABSJNNN8lac9kheH+af7yAkEWlgneA==",
+      "dev": true,
+      "dependencies": {
+        "ajv": "^8.0.1",
+        "lodash.truncate": "^4.4.2",
+        "slice-ansi": "^4.0.0",
+        "string-width": "^4.2.3",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/table/node_modules/ajv": {
+      "version": "8.12.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.12.0.tgz",
+      "integrity": "sha512-sRu1kpcO9yLtYxBKvqfTeh9KzZEwO3STyX1HT+4CaDzC6HpTGYhIhPIzj9XuKU7KYDwnaeh5hcOwjy1QuJzBPA==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/table/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true
+    },
+    "node_modules/tailwindcss": {
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-3.1.4.tgz",
+      "integrity": "sha512-NrxbFV4tYsga/hpWbRyUfIaBrNMXDxx5BsHgBS4v5tlyjf+sDsgBg5m9OxjrXIqAS/uR9kicxLKP+bEHI7BSeQ==",
+      "dev": true,
+      "dependencies": {
+        "arg": "^5.0.2",
+        "chokidar": "^3.5.3",
+        "color-name": "^1.1.4",
+        "detective": "^5.2.1",
+        "didyoumean": "^1.2.2",
+        "dlv": "^1.1.3",
+        "fast-glob": "^3.2.11",
+        "glob-parent": "^6.0.2",
+        "is-glob": "^4.0.3",
+        "lilconfig": "^2.0.5",
+        "normalize-path": "^3.0.0",
+        "object-hash": "^3.0.0",
+        "picocolors": "^1.0.0",
+        "postcss": "^8.4.14",
+        "postcss-import": "^14.1.0",
+        "postcss-js": "^4.0.0",
+        "postcss-load-config": "^3.1.4",
+        "postcss-nested": "5.0.6",
+        "postcss-selector-parser": "^6.0.10",
+        "postcss-value-parser": "^4.2.0",
+        "quick-lru": "^5.1.1",
+        "resolve": "^1.22.0"
+      },
+      "bin": {
+        "tailwind": "lib/cli.js",
+        "tailwindcss": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=12.13.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.0.9"
+      }
+    },
+    "node_modules/tailwindcss/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/tapable": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.2.1.tgz",
+      "integrity": "sha512-GNzQvQTOIP6RyTfE2Qxb8ZVlNmw0n88vp1szwWRimP02mnTsx3Wtn5qRdqY9w2XduFNUgvOwhNnQsjwCp+kqaQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/terminal-link": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/terminal-link/-/terminal-link-2.1.1.tgz",
+      "integrity": "sha512-un0FmiRUQNr5PJqy9kP7c40F5BOfpGlYTrxonDChEZB7pzZxRNp/bt+ymiy9/npwXya9KH99nJ/GXFIiUkYGFQ==",
+      "dev": true,
+      "dependencies": {
+        "ansi-escapes": "^4.2.1",
+        "supports-hyperlinks": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/terminal-link/node_modules/ansi-escapes": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
+      "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
+      "dev": true,
+      "dependencies": {
+        "type-fest": "^0.21.3"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/terminal-link/node_modules/type-fest": {
+      "version": "0.21.3",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
+      "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/terser": {
+      "version": "5.17.3",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.17.3.tgz",
+      "integrity": "sha512-AudpAZKmZHkG9jueayypz4duuCFJMMNGRMwaPvQKWfxKedh8Z2x3OCoDqIIi1xx5+iwx1u6Au8XQcc9Lke65Yg==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/source-map": "^0.3.2",
+        "acorn": "^8.5.0",
+        "commander": "^2.20.0",
+        "source-map-support": "~0.5.20"
+      },
+      "bin": {
+        "terser": "bin/terser"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/terser-webpack-plugin": {
+      "version": "5.3.8",
+      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.3.8.tgz",
+      "integrity": "sha512-WiHL3ElchZMsK27P8uIUh4604IgJyAW47LVXGbEoB21DbQcZ+OuMpGjVYnEUaqcWM6dO8uS2qUbA7LSCWqvsbg==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/trace-mapping": "^0.3.17",
+        "jest-worker": "^27.4.5",
+        "schema-utils": "^3.1.1",
+        "serialize-javascript": "^6.0.1",
+        "terser": "^5.16.8"
+      },
+      "engines": {
+        "node": ">= 10.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      },
+      "peerDependencies": {
+        "webpack": "^5.1.0"
+      },
+      "peerDependenciesMeta": {
+        "@swc/core": {
+          "optional": true
+        },
+        "esbuild": {
+          "optional": true
+        },
+        "uglify-js": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/terser/node_modules/commander": {
+      "version": "2.20.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+      "dev": true
+    },
+    "node_modules/test-exclude": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
+      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
+      "dev": true,
+      "dependencies": {
+        "@istanbuljs/schema": "^0.1.2",
+        "glob": "^7.1.4",
+        "minimatch": "^3.0.4"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/text-table": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
+      "integrity": "sha512-N+8UisAXDGk8PFXP4HAzVR9nbfmVJ3zYLAWiTIoqC5v5isinhr+r5uaO8+7r3BMfuNIufIsA7RdpVgacC2cSpw==",
+      "dev": true
+    },
+    "node_modules/thenify": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/thenify/-/thenify-3.3.1.tgz",
+      "integrity": "sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==",
+      "dev": true,
+      "dependencies": {
+        "any-promise": "^1.0.0"
+      }
+    },
+    "node_modules/thenify-all": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/thenify-all/-/thenify-all-1.6.0.tgz",
+      "integrity": "sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==",
+      "dev": true,
+      "dependencies": {
+        "thenify": ">= 3.1.0 < 4"
+      },
+      "engines": {
+        "node": ">=0.8"
+      }
+    },
+    "node_modules/thread-loader": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/thread-loader/-/thread-loader-3.0.4.tgz",
+      "integrity": "sha512-ByaL2TPb+m6yArpqQUZvP+5S1mZtXsEP7nWKKlAUTm7fCml8kB5s1uI3+eHRP2bk5mVYfRSBI7FFf+tWEyLZwA==",
+      "dev": true,
+      "dependencies": {
+        "json-parse-better-errors": "^1.0.2",
+        "loader-runner": "^4.1.0",
+        "loader-utils": "^2.0.0",
+        "neo-async": "^2.6.2",
+        "schema-utils": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 10.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      },
+      "peerDependencies": {
+        "webpack": "^4.27.0 || ^5.0.0"
+      }
+    },
+    "node_modules/thread-loader/node_modules/loader-utils": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.4.tgz",
+      "integrity": "sha512-xXqpXoINfFhgua9xiqD8fPFHgkoq1mmmpE92WlDbm9rNRd/EbRb+Gqf908T2DMfuHjjJlksiK2RbHVOdD/MqSw==",
+      "dev": true,
+      "dependencies": {
+        "big.js": "^5.2.2",
+        "emojis-list": "^3.0.0",
+        "json5": "^2.1.2"
+      },
+      "engines": {
+        "node": ">=8.9.0"
+      }
+    },
+    "node_modules/throat": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/throat/-/throat-6.0.1.tgz",
+      "integrity": "sha512-8hmiGIJMDlwjg7dlJ4yKGLK8EsYqKgPWbG3b4wjJddKNwc7N7Dpn08Df4szr/sZdMVeOstrdYSsqzX6BYbcB+w==",
+      "dev": true
+    },
+    "node_modules/thunky": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/thunky/-/thunky-1.1.0.tgz",
+      "integrity": "sha512-eHY7nBftgThBqOyHGVN+l8gF0BucP09fMo0oO/Lb0w1OF80dJv+lDVpXG60WMQvkcxAkNybKsrEIE3ZtKGmPrA==",
+      "dev": true
+    },
+    "node_modules/tiny-emitter": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/tiny-emitter/-/tiny-emitter-2.1.0.tgz",
+      "integrity": "sha512-NB6Dk1A9xgQPMoGqC5CVXn123gWyte215ONT5Pp5a0yt4nlEoO1ZWeCwpncaekPHXO60i47ihFnZPiRPjRMq4Q=="
+    },
+    "node_modules/tmpl": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/tmpl/-/tmpl-1.0.5.tgz",
+      "integrity": "sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==",
+      "dev": true
+    },
+    "node_modules/to-fast-properties": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
+      "integrity": "sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "dev": true,
+      "dependencies": {
+        "is-number": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=8.0"
+      }
+    },
+    "node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.6"
+      }
+    },
+    "node_modules/totalist": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/totalist/-/totalist-1.1.0.tgz",
+      "integrity": "sha512-gduQwd1rOdDMGxFG1gEvhV88Oirdo2p+KjoYFU7k2g+i7n6AFFbDQ5kMPUsW0pNbfQsB/cwXvT1i4Bue0s9g5g==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/tough-cookie": {
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.3.tgz",
+      "integrity": "sha512-aX/y5pVRkfRnfmuX+OdbSdXvPe6ieKX/G2s7e98f4poJHnqH3281gDPm/metm6E/WRamfx7WC4HUqkWHfQHprw==",
+      "dev": true,
+      "dependencies": {
+        "psl": "^1.1.33",
+        "punycode": "^2.1.1",
+        "universalify": "^0.2.0",
+        "url-parse": "^1.5.3"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/tough-cookie/node_modules/universalify": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.2.0.tgz",
+      "integrity": "sha512-CJ1QgKmNg3CwvAv/kOFmtnEN05f0D/cn9QntgNOQlQF9dgvVTHj3t+8JPdjqawCHk7V/KA+fbUqzZ9XWhcqPUg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 4.0.0"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
+      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
+      "dev": true
+    },
+    "node_modules/ts-jest": {
+      "version": "27.1.5",
+      "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-27.1.5.tgz",
+      "integrity": "sha512-Xv6jBQPoBEvBq/5i2TeSG9tt/nqkbpcurrEG1b+2yfBrcJelOZF9Ml6dmyMh7bcW9JyFbRYpR5rxROSlBLTZHA==",
+      "dev": true,
+      "dependencies": {
+        "bs-logger": "0.x",
+        "fast-json-stable-stringify": "2.x",
+        "jest-util": "^27.0.0",
+        "json5": "2.x",
+        "lodash.memoize": "4.x",
+        "make-error": "1.x",
+        "semver": "7.x",
+        "yargs-parser": "20.x"
+      },
+      "bin": {
+        "ts-jest": "cli.js"
+      },
+      "engines": {
+        "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
+      },
+      "peerDependencies": {
+        "@babel/core": ">=7.0.0-beta.0 <8",
+        "@types/jest": "^27.0.0",
+        "babel-jest": ">=27.0.0 <28",
+        "jest": "^27.0.0",
+        "typescript": ">=3.8 <5.0"
+      },
+      "peerDependenciesMeta": {
+        "@babel/core": {
+          "optional": true
+        },
+        "@types/jest": {
+          "optional": true
+        },
+        "babel-jest": {
+          "optional": true
+        },
+        "esbuild": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/ts-jest/node_modules/semver": {
+      "version": "7.5.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/ts-loader": {
+      "version": "9.3.1",
+      "resolved": "https://registry.npmjs.org/ts-loader/-/ts-loader-9.3.1.tgz",
+      "integrity": "sha512-OkyShkcZTsTwyS3Kt7a4rsT/t2qvEVQuKCTg4LJmpj9fhFR7ukGdZwV6Qq3tRUkqcXtfGpPR7+hFKHCG/0d3Lw==",
+      "dev": true,
+      "dependencies": {
+        "chalk": "^4.1.0",
+        "enhanced-resolve": "^5.0.0",
+        "micromatch": "^4.0.0",
+        "semver": "^7.3.4"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "typescript": "*",
+        "webpack": "^5.0.0"
+      }
+    },
+    "node_modules/ts-loader/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/ts-loader/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/ts-loader/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/ts-loader/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/ts-loader/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/ts-loader/node_modules/semver": {
+      "version": "7.5.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/ts-loader/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/tsconfig": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/tsconfig/-/tsconfig-7.0.0.tgz",
+      "integrity": "sha512-vZXmzPrL+EmC4T/4rVlT2jNVMWCi/O4DIiSj3UHg1OE5kCKbk4mfrXc6dZksLgRM/TZlKnousKH9bbTazUWRRw==",
+      "dev": true,
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "@types/strip-bom": "^3.0.0",
+        "@types/strip-json-comments": "0.0.30",
+        "strip-bom": "^3.0.0",
+        "strip-json-comments": "^2.0.0"
+      }
+    },
+    "node_modules/tsconfig/node_modules/strip-bom": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
+      "integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==",
+      "dev": true,
+      "optional": true,
+      "peer": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/tsconfig/node_modules/strip-json-comments": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+      "dev": true,
+      "optional": true,
+      "peer": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/tslib": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.4.0.tgz",
+      "integrity": "sha512-d6xOpEDfsi2CZVlPQzGeux8XMwLT9hssAsaPYExaQMuYskwb+x1x7J371tWlbBdWHroy99KnVB6qIkUbs5X3UQ=="
+    },
+    "node_modules/tslint": {
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/tslint/-/tslint-6.1.3.tgz",
+      "integrity": "sha512-IbR4nkT96EQOvKE2PW/djGz8iGNeJ4rF2mBfiYaR/nvUWYKJhLwimoJKgjIFEIDibBtOevj7BqCRL4oHeWWUCg==",
+      "deprecated": "TSLint has been deprecated in favor of ESLint. Please see https://github.com/palantir/tslint/issues/4534 for more information.",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.0.0",
+        "builtin-modules": "^1.1.1",
+        "chalk": "^2.3.0",
+        "commander": "^2.12.1",
+        "diff": "^4.0.1",
+        "glob": "^7.1.1",
+        "js-yaml": "^3.13.1",
+        "minimatch": "^3.0.4",
+        "mkdirp": "^0.5.3",
+        "resolve": "^1.3.2",
+        "semver": "^5.3.0",
+        "tslib": "^1.13.0",
+        "tsutils": "^2.29.0"
+      },
+      "bin": {
+        "tslint": "bin/tslint"
+      },
+      "engines": {
+        "node": ">=4.8.0"
+      },
+      "peerDependencies": {
+        "typescript": ">=2.3.0-dev || >=2.4.0-dev || >=2.5.0-dev || >=2.6.0-dev || >=2.7.0-dev || >=2.8.0-dev || >=2.9.0-dev || >=3.0.0-dev || >= 3.1.0-dev || >= 3.2.0-dev || >= 4.0.0-dev"
+      }
+    },
+    "node_modules/tslint/node_modules/argparse": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
+      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+      "dev": true,
+      "dependencies": {
+        "sprintf-js": "~1.0.2"
+      }
+    },
+    "node_modules/tslint/node_modules/commander": {
+      "version": "2.20.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+      "dev": true
+    },
+    "node_modules/tslint/node_modules/js-yaml": {
+      "version": "3.14.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
+      "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
+      "dev": true,
+      "dependencies": {
+        "argparse": "^1.0.7",
+        "esprima": "^4.0.0"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/tslint/node_modules/semver": {
+      "version": "5.7.2",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+      "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
+      "dev": true,
+      "bin": {
+        "semver": "bin/semver"
+      }
+    },
+    "node_modules/tslint/node_modules/tslib": {
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
+      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
+      "dev": true
+    },
+    "node_modules/tslint/node_modules/tsutils": {
+      "version": "2.29.0",
+      "resolved": "https://registry.npmjs.org/tsutils/-/tsutils-2.29.0.tgz",
+      "integrity": "sha512-g5JVHCIJwzfISaXpXE1qvNalca5Jwob6FjI4AoPlqMusJ6ftFE7IkkFoMhVLRgK+4Kx3gkzb8UZK5t5yTTvEmA==",
+      "dev": true,
+      "dependencies": {
+        "tslib": "^1.8.1"
+      },
+      "peerDependencies": {
+        "typescript": ">=2.1.0 || >=2.1.0-dev || >=2.2.0-dev || >=2.3.0-dev || >=2.4.0-dev || >=2.5.0-dev || >=2.6.0-dev || >=2.7.0-dev || >=2.8.0-dev || >=2.9.0-dev || >= 3.0.0-dev || >= 3.1.0-dev"
+      }
+    },
+    "node_modules/tsutils": {
+      "version": "3.21.0",
+      "resolved": "https://registry.npmjs.org/tsutils/-/tsutils-3.21.0.tgz",
+      "integrity": "sha512-mHKK3iUXL+3UF6xL5k0PEhKRUBKPBCv/+RkEOpjRWxxx27KKRBmmA60A9pgOUvMi8GKhRMPEmjBRPzs2W7O1OA==",
+      "dev": true,
+      "dependencies": {
+        "tslib": "^1.8.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      },
+      "peerDependencies": {
+        "typescript": ">=2.8.0 || >= 3.2.0-dev || >= 3.3.0-dev || >= 3.4.0-dev || >= 3.5.0-dev || >= 3.6.0-dev || >= 3.6.0-beta || >= 3.7.0-dev || >= 3.7.0-beta"
+      }
+    },
+    "node_modules/tsutils/node_modules/tslib": {
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
+      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
+      "dev": true
+    },
+    "node_modules/type-check": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
+      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
+      "dev": true,
+      "dependencies": {
+        "prelude-ls": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/type-detect": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz",
+      "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/type-fest": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.6.0.tgz",
+      "integrity": "sha512-q+MB8nYR1KDLrgr4G5yemftpMC7/QLqVndBmEEdqzmNj5dcFOO4Oo8qlwZE3ULT3+Zim1F8Kq4cBnikNhlCMlg==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/type-is": {
+      "version": "1.6.18",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
+      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
+      "dev": true,
+      "dependencies": {
+        "media-typer": "0.3.0",
+        "mime-types": "~2.1.24"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/typedarray-to-buffer": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/typedarray-to-buffer/-/typedarray-to-buffer-3.1.5.tgz",
+      "integrity": "sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==",
+      "dev": true,
+      "dependencies": {
+        "is-typedarray": "^1.0.0"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "4.7.4",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.7.4.tgz",
+      "integrity": "sha512-C0WQT0gezHuw6AdY1M2jxUO83Rjf0HP7Sk1DtXj6j1EwkQNZrHAg2XPWlq62oqEhYvONq5pkC2Y9oPljWToLmQ==",
+      "dev": true,
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=4.2.0"
+      }
+    },
+    "node_modules/unfetch": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/unfetch/-/unfetch-4.2.0.tgz",
+      "integrity": "sha512-F9p7yYCn6cIW9El1zi0HI6vqpeIvBsr3dSuRO6Xuppb1u5rXpCPmMvLSyECLhybr9isec8Ohl0hPekMVrEinDA=="
+    },
+    "node_modules/unicode-canonical-property-names-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-canonical-property-names-ecmascript/-/unicode-canonical-property-names-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-yY5PpDlfVIU5+y/BSCxAJRBIS1Zc2dDG3Ujq+sR0U+JjUevW2JhocOF+soROYDSaAezOzOKuyyixhD6mBknSmQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/unicode-match-property-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-match-property-ecmascript/-/unicode-match-property-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-5kaZCrbp5mmbz5ulBkDkbY0SsPOjKqVS35VpL9ulMPfSl0J0Xsm+9Evphv9CoIZFwre7aJoa94AY6seMKGVN5Q==",
+      "dev": true,
+      "dependencies": {
+        "unicode-canonical-property-names-ecmascript": "^2.0.0",
+        "unicode-property-aliases-ecmascript": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/unicode-match-property-value-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-match-property-value-ecmascript/-/unicode-match-property-value-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-7Yhkc0Ye+t4PNYzOGKedDhXbYIBe1XEQYQxOPyhcXNMJ0WCABqqj6ckydd6pWRZTHV4GuCPKdBAUiMc60tsKVw==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/unicode-property-aliases-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-property-aliases-ecmascript/-/unicode-property-aliases-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-5Zfuy9q/DFr4tfO7ZPeVXb1aPoeQSdeFMLpYuFebehDAhbuevLs5yxSZmIFN1tP5F9Wl4IpJrYojg85/zgyZHQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/universalify": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.0.tgz",
+      "integrity": "sha512-hAZsKq7Yy11Zu1DE0OzWjw7nnLZmJZYTDZZyEFHZdUhV8FkH5MCfoU1XMaxXovpyW5nq5scPqq0ZDP9Zyl04oQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 10.0.0"
+      }
+    },
+    "node_modules/unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/update-browserslist-db": {
+      "version": "1.0.11",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.0.11.tgz",
+      "integrity": "sha512-dCwEFf0/oT85M1fHBg4F0jtLwJrutGoHSQXCh7u4o2t1drG+c0a9Flnqww6XUKSfQMPpJBRjU8d4RXB09qtvaA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "dependencies": {
+        "escalade": "^3.1.1",
+        "picocolors": "^1.0.0"
+      },
+      "bin": {
+        "update-browserslist-db": "cli.js"
+      },
+      "peerDependencies": {
+        "browserslist": ">= 4.21.0"
+      }
+    },
+    "node_modules/uri-js": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
+      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
+      "dev": true,
+      "dependencies": {
+        "punycode": "^2.1.0"
+      }
+    },
+    "node_modules/url-parse": {
+      "version": "1.5.10",
+      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz",
+      "integrity": "sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==",
+      "dev": true,
+      "dependencies": {
+        "querystringify": "^2.1.1",
+        "requires-port": "^1.0.0"
+      }
+    },
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "dev": true
+    },
+    "node_modules/utila": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/utila/-/utila-0.4.0.tgz",
+      "integrity": "sha512-Z0DbgELS9/L/75wZbro8xAnT50pBVFQZ+hUEueGDU5FN51YSCYM+jdxsfCiHjwNP/4LCDD0i/graKpeBnOXKRA==",
+      "dev": true
+    },
+    "node_modules/utils-merge": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
+      "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.4.0"
+      }
+    },
+    "node_modules/uuid": {
+      "version": "8.3.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
+    },
+    "node_modules/v8-compile-cache": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/v8-compile-cache/-/v8-compile-cache-2.3.0.tgz",
+      "integrity": "sha512-l8lCEmLcLYZh4nbunNZvQCJc5pv7+RCwa8q/LdUx8u7lsWvPDKmpodJAJNwkAhJC//dFY48KuIEmjtd4RViDrA==",
+      "dev": true
+    },
+    "node_modules/v8-to-istanbul": {
+      "version": "8.1.1",
+      "resolved": "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-8.1.1.tgz",
+      "integrity": "sha512-FGtKtv3xIpR6BYhvgH8MI/y78oT7d8Au3ww4QIxymrCtZEh5b8gCw2siywE+puhEmuWKDtmfrvF5UlB298ut3w==",
+      "dev": true,
+      "dependencies": {
+        "@types/istanbul-lib-coverage": "^2.0.1",
+        "convert-source-map": "^1.6.0",
+        "source-map": "^0.7.3"
+      },
+      "engines": {
+        "node": ">=10.12.0"
+      }
+    },
+    "node_modules/v8-to-istanbul/node_modules/source-map": {
+      "version": "0.7.4",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.4.tgz",
+      "integrity": "sha512-l3BikUxvPOcn5E74dZiq5BGsTb5yEwhaTSzccU6t4sDOH8NWJCstKO5QT2CvtFoK6F0saL7p9xHAqHOlCPJygA==",
+      "dev": true,
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/validate-npm-package-license": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz",
+      "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
+      "dev": true,
+      "dependencies": {
+        "spdx-correct": "^3.0.0",
+        "spdx-expression-parse": "^3.0.0"
+      }
+    },
+    "node_modules/vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/vite-plugin-monaco-editor": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/vite-plugin-monaco-editor/-/vite-plugin-monaco-editor-1.1.0.tgz",
+      "integrity": "sha512-IvtUqZotrRoVqwT0PBBDIZPNraya3BxN/bfcNfnxZ5rkJiGcNtO5eAOWWSgT7zullIAEqQwxMU83yL9J5k7gww==",
+      "peerDependencies": {
+        "monaco-editor": ">=0.33.0"
+      }
+    },
+    "node_modules/vls": {
+      "version": "0.8.2",
+      "resolved": "https://registry.npmjs.org/vls/-/vls-0.8.2.tgz",
+      "integrity": "sha512-esrJmf7yRY5rlG7d5Jmucp7P2ZeWHOi7p1aADwxbPiN69SgNUq1Tp24YJ0vUXiEU8mgOW0tf0dL4f6LlSu6K/g==",
+      "dev": true,
+      "dependencies": {
+        "eslint": "^7.32.0",
+        "eslint-plugin-vue": "^7.19.1",
+        "prettier": "^2.4.1",
+        "pug-lexer": "^5.0.1",
+        "tslint": "6.1.3",
+        "typescript": "^4.4.4"
+      },
+      "bin": {
+        "vls": "bin/vls"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/vls/node_modules/@babel/code-frame": {
+      "version": "7.12.11",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.12.11.tgz",
+      "integrity": "sha512-Zt1yodBx1UcyiePMSkWnU4hPqhwq7hGi2nFL1LeA3EUl+q2LQx16MISgJ0+z7dnmgvP9QtIleuETGOiOH1RcIw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/highlight": "^7.10.4"
+      }
+    },
+    "node_modules/vls/node_modules/@eslint/eslintrc": {
+      "version": "0.4.3",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-0.4.3.tgz",
+      "integrity": "sha512-J6KFFz5QCYUJq3pf0mjEcCJVERbzv71PUIDczuh9JkwGEzced6CO5ADLHB1rbf/+oPBtoPfMYNOpGDzCANlbXw==",
+      "dev": true,
+      "dependencies": {
+        "ajv": "^6.12.4",
+        "debug": "^4.1.1",
+        "espree": "^7.3.0",
+        "globals": "^13.9.0",
+        "ignore": "^4.0.6",
+        "import-fresh": "^3.2.1",
+        "js-yaml": "^3.13.1",
+        "minimatch": "^3.0.4",
+        "strip-json-comments": "^3.1.1"
+      },
+      "engines": {
+        "node": "^10.12.0 || >=12.0.0"
+      }
+    },
+    "node_modules/vls/node_modules/@humanwhocodes/config-array": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.5.0.tgz",
+      "integrity": "sha512-FagtKFz74XrTl7y6HCzQpwDfXP0yhxe9lHLD1UZxjvZIcbyRz8zTFF/yYNfSfzU414eDwZ1SrO0Qvtyf+wFMQg==",
+      "dev": true,
+      "dependencies": {
+        "@humanwhocodes/object-schema": "^1.2.0",
+        "debug": "^4.1.1",
+        "minimatch": "^3.0.4"
+      },
+      "engines": {
+        "node": ">=10.10.0"
+      }
+    },
+    "node_modules/vls/node_modules/acorn": {
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
+      "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
+      "dev": true,
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/vls/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/vls/node_modules/argparse": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
+      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+      "dev": true,
+      "dependencies": {
+        "sprintf-js": "~1.0.2"
+      }
+    },
+    "node_modules/vls/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/vls/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/vls/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/vls/node_modules/cross-spawn": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "dev": true,
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/vls/node_modules/escape-string-regexp": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/vls/node_modules/eslint": {
+      "version": "7.32.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.32.0.tgz",
+      "integrity": "sha512-VHZ8gX+EDfz+97jGcgyGCyRia/dPOd6Xh9yPv8Bl1+SoaIwD+a/vlrOmGRUyOYu7MwUhc7CxqeaDZU13S4+EpA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "7.12.11",
+        "@eslint/eslintrc": "^0.4.3",
+        "@humanwhocodes/config-array": "^0.5.0",
+        "ajv": "^6.10.0",
+        "chalk": "^4.0.0",
+        "cross-spawn": "^7.0.2",
+        "debug": "^4.0.1",
+        "doctrine": "^3.0.0",
+        "enquirer": "^2.3.5",
+        "escape-string-regexp": "^4.0.0",
+        "eslint-scope": "^5.1.1",
+        "eslint-utils": "^2.1.0",
+        "eslint-visitor-keys": "^2.0.0",
+        "espree": "^7.3.1",
+        "esquery": "^1.4.0",
+        "esutils": "^2.0.2",
+        "fast-deep-equal": "^3.1.3",
+        "file-entry-cache": "^6.0.1",
+        "functional-red-black-tree": "^1.0.1",
+        "glob-parent": "^5.1.2",
+        "globals": "^13.6.0",
+        "ignore": "^4.0.6",
+        "import-fresh": "^3.0.0",
+        "imurmurhash": "^0.1.4",
+        "is-glob": "^4.0.0",
+        "js-yaml": "^3.13.1",
+        "json-stable-stringify-without-jsonify": "^1.0.1",
+        "levn": "^0.4.1",
+        "lodash.merge": "^4.6.2",
+        "minimatch": "^3.0.4",
+        "natural-compare": "^1.4.0",
+        "optionator": "^0.9.1",
+        "progress": "^2.0.0",
+        "regexpp": "^3.1.0",
+        "semver": "^7.2.1",
+        "strip-ansi": "^6.0.0",
+        "strip-json-comments": "^3.1.0",
+        "table": "^6.0.9",
+        "text-table": "^0.2.0",
+        "v8-compile-cache": "^2.0.3"
+      },
+      "bin": {
+        "eslint": "bin/eslint.js"
+      },
+      "engines": {
+        "node": "^10.12.0 || >=12.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/vls/node_modules/eslint-plugin-vue": {
+      "version": "7.20.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-vue/-/eslint-plugin-vue-7.20.0.tgz",
+      "integrity": "sha512-oVNDqzBC9h3GO+NTgWeLMhhGigy6/bQaQbHS+0z7C4YEu/qK/yxHvca/2PTZtGNPsCrHwOTgKMrwu02A9iPBmw==",
+      "dev": true,
+      "dependencies": {
+        "eslint-utils": "^2.1.0",
+        "natural-compare": "^1.4.0",
+        "semver": "^6.3.0",
+        "vue-eslint-parser": "^7.10.0"
+      },
+      "engines": {
+        "node": ">=8.10"
+      },
+      "peerDependencies": {
+        "eslint": "^6.2.0 || ^7.0.0 || ^8.0.0"
+      }
+    },
+    "node_modules/vls/node_modules/eslint-utils": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/eslint-utils/-/eslint-utils-2.1.0.tgz",
+      "integrity": "sha512-w94dQYoauyvlDc43XnGB8lU3Zt713vNChgt4EWwhXAP2XkBvndfxF0AgIqKOOasjPIPzj9JqgwkwbCYD0/V3Zg==",
+      "dev": true,
+      "dependencies": {
+        "eslint-visitor-keys": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/mysticatea"
+      }
+    },
+    "node_modules/vls/node_modules/eslint-utils/node_modules/eslint-visitor-keys": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-1.3.0.tgz",
+      "integrity": "sha512-6J72N8UNa462wa/KFODt/PJ3IU60SDpC3QXC1Hjc1BXXpfL2C9R5+AU7jhe0F6GREqVMh4Juu+NY7xn+6dipUQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/vls/node_modules/eslint-visitor-keys": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz",
+      "integrity": "sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/vls/node_modules/eslint/node_modules/semver": {
+      "version": "7.5.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/vls/node_modules/espree": {
+      "version": "7.3.1",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-7.3.1.tgz",
+      "integrity": "sha512-v3JCNCE64umkFpmkFGqzVKsOT0tN1Zr+ueqLZfpV1Ob8e+CEgPWa+OxCoGH3tnhimMKIaBm4m/vaRpJ/krRz2g==",
+      "dev": true,
+      "dependencies": {
+        "acorn": "^7.4.0",
+        "acorn-jsx": "^5.3.1",
+        "eslint-visitor-keys": "^1.3.0"
+      },
+      "engines": {
+        "node": "^10.12.0 || >=12.0.0"
+      }
+    },
+    "node_modules/vls/node_modules/espree/node_modules/eslint-visitor-keys": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-1.3.0.tgz",
+      "integrity": "sha512-6J72N8UNa462wa/KFODt/PJ3IU60SDpC3QXC1Hjc1BXXpfL2C9R5+AU7jhe0F6GREqVMh4Juu+NY7xn+6dipUQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/vls/node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "dev": true,
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/vls/node_modules/globals": {
+      "version": "13.20.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-13.20.0.tgz",
+      "integrity": "sha512-Qg5QtVkCy/kv3FUSlu4ukeZDVf9ee0iXLAUYX13gbR17bnejFTzr4iS9bY7kwCf1NztRNm1t91fjOiyx4CSwPQ==",
+      "dev": true,
+      "dependencies": {
+        "type-fest": "^0.20.2"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/vls/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/vls/node_modules/ignore": {
+      "version": "4.0.6",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-4.0.6.tgz",
+      "integrity": "sha512-cyFDKrqc/YdcWFniJhzI42+AzS+gNwmUzOSFcRCQYwySuBBBy/KjuxWLZ/FHEH6Moq1NizMOBWyTcv8O4OZIMg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/vls/node_modules/js-yaml": {
+      "version": "3.14.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
+      "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
+      "dev": true,
+      "dependencies": {
+        "argparse": "^1.0.7",
+        "esprima": "^4.0.0"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/vls/node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/vls/node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/vls/node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/vls/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/vls/node_modules/type-fest": {
+      "version": "0.20.2",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
+      "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/vls/node_modules/vue-eslint-parser": {
+      "version": "7.11.0",
+      "resolved": "https://registry.npmjs.org/vue-eslint-parser/-/vue-eslint-parser-7.11.0.tgz",
+      "integrity": "sha512-qh3VhDLeh773wjgNTl7ss0VejY9bMMa0GoDG2fQVyDzRFdiU3L7fw74tWZDHNQXdZqxO3EveQroa9ct39D2nqg==",
+      "dev": true,
+      "dependencies": {
+        "debug": "^4.1.1",
+        "eslint-scope": "^5.1.1",
+        "eslint-visitor-keys": "^1.1.0",
+        "espree": "^6.2.1",
+        "esquery": "^1.4.0",
+        "lodash": "^4.17.21",
+        "semver": "^6.3.0"
+      },
+      "engines": {
+        "node": ">=8.10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/mysticatea"
+      },
+      "peerDependencies": {
+        "eslint": ">=5.0.0"
+      }
+    },
+    "node_modules/vls/node_modules/vue-eslint-parser/node_modules/eslint-visitor-keys": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-1.3.0.tgz",
+      "integrity": "sha512-6J72N8UNa462wa/KFODt/PJ3IU60SDpC3QXC1Hjc1BXXpfL2C9R5+AU7jhe0F6GREqVMh4Juu+NY7xn+6dipUQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/vls/node_modules/vue-eslint-parser/node_modules/espree": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-6.2.1.tgz",
+      "integrity": "sha512-ysCxRQY3WaXJz9tdbWOwuWr5Y/XrPTGX9Kiz3yoUXwW0VZ4w30HTkQLaGx/+ttFjF8i+ACbArnB4ce68a9m5hw==",
+      "dev": true,
+      "dependencies": {
+        "acorn": "^7.1.1",
+        "acorn-jsx": "^5.2.0",
+        "eslint-visitor-keys": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/vls/node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/vscode-html-languageservice": {
+      "version": "5.0.4",
+      "resolved": "https://registry.npmjs.org/vscode-html-languageservice/-/vscode-html-languageservice-5.0.4.tgz",
+      "integrity": "sha512-tvrySfpglu4B2rQgWGVO/IL+skvU7kBkQotRlxA7ocSyRXOZUd6GA13XHkxo8LPe07KWjeoBlN1aVGqdfTK4xA==",
+      "dev": true,
+      "dependencies": {
+        "@vscode/l10n": "^0.0.11",
+        "vscode-languageserver-textdocument": "^1.0.8",
+        "vscode-languageserver-types": "^3.17.2",
+        "vscode-uri": "^3.0.7"
+      }
+    },
+    "node_modules/vscode-jsonrpc": {
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/vscode-jsonrpc/-/vscode-jsonrpc-8.0.2.tgz",
+      "integrity": "sha512-RY7HwI/ydoC1Wwg4gJ3y6LpU9FJRZAUnTYMXthqhFXXu77ErDd/xkREpGuk4MyYkk4a+XDWAMqe0S3KkelYQEQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/vscode-languageserver-protocol": {
+      "version": "3.17.2",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-protocol/-/vscode-languageserver-protocol-3.17.2.tgz",
+      "integrity": "sha512-8kYisQ3z/SQ2kyjlNeQxbkkTNmVFoQCqkmGrzLH6A9ecPlgTbp3wDTnUNqaUxYr4vlAcloxx8zwy7G5WdguYNg==",
+      "dev": true,
+      "dependencies": {
+        "vscode-jsonrpc": "8.0.2",
+        "vscode-languageserver-types": "3.17.2"
+      }
+    },
+    "node_modules/vscode-languageserver-textdocument": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-textdocument/-/vscode-languageserver-textdocument-1.0.8.tgz",
+      "integrity": "sha512-1bonkGqQs5/fxGT5UchTgjGVnfysL0O8v1AYMBjqTbWQTFn721zaPGDYFkOKtfDgFiSgXM3KwaG3FMGfW4Ed9Q=="
+    },
+    "node_modules/vscode-languageserver-types": {
+      "version": "3.17.2",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-types/-/vscode-languageserver-types-3.17.2.tgz",
+      "integrity": "sha512-zHhCWatviizPIq9B7Vh9uvrH6x3sK8itC84HkamnBWoDFJtzBf7SWlpLCZUit72b3os45h6RWQNC9xHRDF8dRA=="
+    },
+    "node_modules/vscode-uri": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/vscode-uri/-/vscode-uri-3.0.7.tgz",
+      "integrity": "sha512-eOpPHogvorZRobNqJGhapa0JdwaxpjVvyBp0QIUMRMSf8ZAlqOdEquKuRmw9Qwu0qXtJIWqFtMkmvJjUZmMjVA=="
+    },
+    "node_modules/vue": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/vue/-/vue-3.2.37.tgz",
+      "integrity": "sha512-bOKEZxrm8Eh+fveCqS1/NkG/n6aMidsI6hahas7pa0w/l7jkbssJVsRhVDs07IdDq7h9KHswZOgItnwJAgtVtQ==",
+      "dependencies": {
+        "@vue/compiler-dom": "3.2.37",
+        "@vue/compiler-sfc": "3.2.37",
+        "@vue/runtime-dom": "3.2.37",
+        "@vue/server-renderer": "3.2.37",
+        "@vue/shared": "3.2.37"
+      }
+    },
+    "node_modules/vue-cli-plugin-tailwind": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/vue-cli-plugin-tailwind/-/vue-cli-plugin-tailwind-3.0.0.tgz",
+      "integrity": "sha512-bUWjfwGtJCeBU7pL4lD86RC+HsJAmAlYqr8e65NGC3q/ZBzC9KQs1Iy/vTyfDTnB7ZJm3huB+1a/m+17fdMZ8A==",
+      "dev": true
+    },
+    "node_modules/vue-eslint-parser": {
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/vue-eslint-parser/-/vue-eslint-parser-9.0.3.tgz",
+      "integrity": "sha512-yL+ZDb+9T0ELG4VIFo/2anAOz8SvBdlqEnQnvJ3M7Scq56DvtjY0VY88bByRZB0D4J0u8olBcfrXTVONXsh4og==",
+      "dev": true,
+      "dependencies": {
+        "debug": "^4.3.4",
+        "eslint-scope": "^7.1.1",
+        "eslint-visitor-keys": "^3.3.0",
+        "espree": "^9.3.1",
+        "esquery": "^1.4.0",
+        "lodash": "^4.17.21",
+        "semver": "^7.3.6"
+      },
+      "engines": {
+        "node": "^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/mysticatea"
+      },
+      "peerDependencies": {
+        "eslint": ">=6.0.0"
+      }
+    },
+    "node_modules/vue-eslint-parser/node_modules/eslint-scope": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.1.1.tgz",
+      "integrity": "sha512-QKQM/UXpIiHcLqJ5AOyIW7XZmzjkzQXYE54n1++wb0u9V/abW3l9uQnxX8Z5Xd18xyKIMTUAyQ0k1e8pz6LUrw==",
+      "dev": true,
+      "dependencies": {
+        "esrecurse": "^4.3.0",
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
+    "node_modules/vue-eslint-parser/node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/vue-eslint-parser/node_modules/semver": {
+      "version": "7.5.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+      "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/vue-hot-reload-api": {
+      "version": "2.3.4",
+      "resolved": "https://registry.npmjs.org/vue-hot-reload-api/-/vue-hot-reload-api-2.3.4.tgz",
+      "integrity": "sha512-BXq3jwIagosjgNVae6tkHzzIk6a8MHFtzAdwhnV5VlvPTFxDCvIttgSiHWjdGoTJvXtmRu5HacExfdarRcFhog==",
+      "dev": true
+    },
+    "node_modules/vue-loader": {
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/vue-loader/-/vue-loader-17.0.0.tgz",
+      "integrity": "sha512-OWSXjrzIvbF2LtOUmxT3HYgwwubbfFelN8PAP9R9dwpIkj48TVioHhWWSx7W7fk+iF5cgg3CBJRxwTdtLU4Ecg==",
+      "dev": true,
+      "dependencies": {
+        "chalk": "^4.1.0",
+        "hash-sum": "^2.0.0",
+        "loader-utils": "^2.0.0"
+      },
+      "peerDependencies": {
+        "webpack": "^4.1.0 || ^5.0.0-0"
+      }
+    },
+    "node_modules/vue-loader/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/vue-loader/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/vue-loader/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/vue-loader/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/vue-loader/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/vue-loader/node_modules/loader-utils": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.4.tgz",
+      "integrity": "sha512-xXqpXoINfFhgua9xiqD8fPFHgkoq1mmmpE92WlDbm9rNRd/EbRb+Gqf908T2DMfuHjjJlksiK2RbHVOdD/MqSw==",
+      "dev": true,
+      "dependencies": {
+        "big.js": "^5.2.2",
+        "emojis-list": "^3.0.0",
+        "json5": "^2.1.2"
+      },
+      "engines": {
+        "node": ">=8.9.0"
+      }
+    },
+    "node_modules/vue-loader/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/vue-observe-visibility": {
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/vue-observe-visibility/-/vue-observe-visibility-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-flFbp/gs9pZniXR6fans8smv1kDScJ8RS7rEpMjhVabiKeq7Qz3D9+eGsypncjfIyyU84saU88XZ0zjbD6Gq/g==",
+      "peerDependencies": {
+        "vue": "^3.0.0"
+      }
+    },
+    "node_modules/vue-resize": {
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/vue-resize/-/vue-resize-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-7+iqOueLU7uc9NrMfrzbG8hwMqchfVfSzpVlCMeJQe4pyibqyoifDNbKTZvwxZKDvGkB+PdFeKvnGZMoEb8esg==",
+      "peerDependencies": {
+        "vue": "^3.0.0"
+      }
+    },
+    "node_modules/vue-router": {
+      "version": "4.0.16",
+      "resolved": "https://registry.npmjs.org/vue-router/-/vue-router-4.0.16.tgz",
+      "integrity": "sha512-JcO7cb8QJLBWE+DfxGUL3xUDOae/8nhM1KVdnudadTAORbuxIC/xAydC5Zr/VLHUDQi1ppuTF5/rjBGzgzrJNA==",
+      "dependencies": {
+        "@vue/devtools-api": "^6.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/posva"
+      },
+      "peerDependencies": {
+        "vue": "^3.2.0"
+      }
+    },
+    "node_modules/vue-style-loader": {
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/vue-style-loader/-/vue-style-loader-4.1.3.tgz",
+      "integrity": "sha512-sFuh0xfbtpRlKfm39ss/ikqs9AbKCoXZBpHeVZ8Tx650o0k0q/YCM7FRvigtxpACezfq6af+a7JeqVTWvncqDg==",
+      "dev": true,
+      "dependencies": {
+        "hash-sum": "^1.0.2",
+        "loader-utils": "^1.0.2"
+      }
+    },
+    "node_modules/vue-style-loader/node_modules/hash-sum": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/hash-sum/-/hash-sum-1.0.2.tgz",
+      "integrity": "sha512-fUs4B4L+mlt8/XAtSOGMUO1TXmAelItBPtJG7CyHJfYTdDjwisntGO2JQz7oUsatOY9o68+57eziUVNw/mRHmA==",
+      "dev": true
+    },
+    "node_modules/vue-template-es2015-compiler": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/vue-template-es2015-compiler/-/vue-template-es2015-compiler-1.9.1.tgz",
+      "integrity": "sha512-4gDntzrifFnCEvyoO8PqyJDmguXgVPxKiIxrBKjIowvL9l+N66196+72XVYR8BBf1Uv1Fgt3bGevJ+sEmxfZzw==",
+      "dev": true
+    },
+    "node_modules/vue-virtual-scroller": {
+      "version": "2.0.0-beta.8",
+      "resolved": "https://registry.npmjs.org/vue-virtual-scroller/-/vue-virtual-scroller-2.0.0-beta.8.tgz",
+      "integrity": "sha512-b8/f5NQ5nIEBRTNi6GcPItE4s7kxNHw2AIHLtDp+2QvqdTjVN0FgONwX9cr53jWRgnu+HRLPaWDOR2JPI5MTfQ==",
+      "dependencies": {
+        "mitt": "^2.1.0",
+        "vue-observe-visibility": "^2.0.0-alpha.1",
+        "vue-resize": "^2.0.0-alpha.1"
+      },
+      "peerDependencies": {
+        "vue": "^3.2.0"
+      }
+    },
+    "node_modules/vue-word-highlighter": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/vue-word-highlighter/-/vue-word-highlighter-1.0.4.tgz",
+      "integrity": "sha512-jtwnkEBnwMzmKTvpStbffbEpWkW4Fpb2ErdqDqAGOZlrjCgTJczBCpIQiGyBF2jNvYxvCvN5HqIldoNaMS0XYQ==",
+      "dependencies": {
+        "vue-demi": "^0.11.2"
+      },
+      "peerDependencies": {
+        "@vue/composition-api": "^1.0.0-rc.1",
+        "vue": "^2.0.0 || >=3.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@vue/composition-api": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vue-word-highlighter/node_modules/vue-demi": {
+      "version": "0.11.4",
+      "resolved": "https://registry.npmjs.org/vue-demi/-/vue-demi-0.11.4.tgz",
+      "integrity": "sha512-/3xFwzSykLW2HiiLie43a+FFgNOcokbBJ+fzvFXd0r2T8MYohqvphUyDQ8lbAwzQ3Dlcrb1c9ykifGkhSIAk6A==",
+      "hasInstallScript": true,
+      "bin": {
+        "vue-demi-fix": "bin/vue-demi-fix.js",
+        "vue-demi-switch": "bin/vue-demi-switch.js"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      },
+      "peerDependencies": {
+        "@vue/composition-api": "^1.0.0-rc.1",
+        "vue": "^3.0.0-0 || ^2.6.0"
+      },
+      "peerDependenciesMeta": {
+        "@vue/composition-api": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vue3-apexcharts": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/vue3-apexcharts/-/vue3-apexcharts-1.4.1.tgz",
+      "integrity": "sha512-96qP8JDqB9vwU7bkG5nVU+E0UGQn7yYQVqUUCLQMYWDuQyu2vE77H/UFZ1yI+hwzlSTBKT9BqnNG8JsFegB3eg==",
+      "peerDependencies": {
+        "apexcharts": "> 3.0.0",
+        "vue": "> 3.0.0"
+      }
+    },
+    "node_modules/vue3-clipboard": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/vue3-clipboard/-/vue3-clipboard-1.0.0.tgz",
+      "integrity": "sha512-GUqKh1oO79xDpq0z+cCv/NDVTpcJGNDzeNgT3PmTdTp/WJh3gcTrDqIYKycKhzMFOtIFJ7hO/+usgyWtT+fNhA==",
+      "dependencies": {
+        "clipboard": "^2.0.6"
+      },
+      "peerDependencies": {
+        "vue": "^3.0.0"
+      }
+    },
+    "node_modules/vue3-popper": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/vue3-popper/-/vue3-popper-1.5.0.tgz",
+      "integrity": "sha512-xaEnx90YBnlSg5G2yWqm2DHWHg+DB99UVRp4VsyTF0QLXyHrqSuE1Xo5+sG0AQq/lBcrGMlk5NU5xE2MDLKViw==",
+      "dependencies": {
+        "@popperjs/core": "^2.9.2",
+        "debounce": "^1.2.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "peerDependencies": {
+        "vue": "^3.2.20"
+      }
+    },
+    "node_modules/w3c-hr-time": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/w3c-hr-time/-/w3c-hr-time-1.0.2.tgz",
+      "integrity": "sha512-z8P5DvDNjKDoFIHK7q8r8lackT6l+jo/Ye3HOle7l9nICP9lf1Ci25fy9vHd0JOWewkIFzXIEig3TdKT7JQ5fQ==",
+      "dev": true,
+      "dependencies": {
+        "browser-process-hrtime": "^1.0.0"
+      }
+    },
+    "node_modules/w3c-xmlserializer": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-2.0.0.tgz",
+      "integrity": "sha512-4tzD0mF8iSiMiNs30BiLO3EpfGLZUT2MSX/G+o7ZywDzliWQ3OPtTZ0PTC3B3ca1UAf4cJMHB+2Bf56EriJuRA==",
+      "dev": true,
+      "dependencies": {
+        "xml-name-validator": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/w3c-xmlserializer/node_modules/xml-name-validator": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-3.0.0.tgz",
+      "integrity": "sha512-A5CUptxDsvxKJEU3yO6DuWBSJz/qizqzJKOMIfUJHETbBw/sFaDxgd6fxm1ewUaM0jZ444Fc5vC5ROYurg/4Pw==",
+      "dev": true
+    },
+    "node_modules/walker": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/walker/-/walker-1.0.8.tgz",
+      "integrity": "sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==",
+      "dev": true,
+      "dependencies": {
+        "makeerror": "1.0.12"
+      }
+    },
+    "node_modules/watchpack": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.4.0.tgz",
+      "integrity": "sha512-Lcvm7MGST/4fup+ifyKi2hjyIAwcdI4HRgtvTpIUxBRhB+RFtUh8XtDOxUfctVCnhVi+QQj49i91OyvzkJl6cg==",
+      "dev": true,
+      "dependencies": {
+        "glob-to-regexp": "^0.4.1",
+        "graceful-fs": "^4.1.2"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/wbuf": {
+      "version": "1.7.3",
+      "resolved": "https://registry.npmjs.org/wbuf/-/wbuf-1.7.3.tgz",
+      "integrity": "sha512-O84QOnr0icsbFGLS0O3bI5FswxzRr8/gHwWkDlQFskhSPryQXvrTMxjxGP4+iWYoauLoBvfDpkrOauZ+0iZpDA==",
+      "dev": true,
+      "dependencies": {
+        "minimalistic-assert": "^1.0.0"
+      }
+    },
+    "node_modules/wcwidth": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/wcwidth/-/wcwidth-1.0.1.tgz",
+      "integrity": "sha512-XHPEwS0q6TaxcvG85+8EYkbiCux2XtWG2mkc47Ng2A77BQu9+DqIOJldST4HgPkuea7dvKSj5VgX3P1d4rW8Tg==",
+      "dev": true,
+      "dependencies": {
+        "defaults": "^1.0.3"
+      }
+    },
+    "node_modules/webidl-conversions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
+      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
+      "dev": true
+    },
+    "node_modules/webpack": {
+      "version": "5.82.1",
+      "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.82.1.tgz",
+      "integrity": "sha512-C6uiGQJ+Gt4RyHXXYt+v9f+SN1v83x68URwgxNQ98cvH8kxiuywWGP4XeNZ1paOzZ63aY3cTciCEQJNFUljlLw==",
+      "dev": true,
+      "dependencies": {
+        "@types/eslint-scope": "^3.7.3",
+        "@types/estree": "^1.0.0",
+        "@webassemblyjs/ast": "^1.11.5",
+        "@webassemblyjs/wasm-edit": "^1.11.5",
+        "@webassemblyjs/wasm-parser": "^1.11.5",
+        "acorn": "^8.7.1",
+        "acorn-import-assertions": "^1.7.6",
+        "browserslist": "^4.14.5",
+        "chrome-trace-event": "^1.0.2",
+        "enhanced-resolve": "^5.14.0",
+        "es-module-lexer": "^1.2.1",
+        "eslint-scope": "5.1.1",
+        "events": "^3.2.0",
+        "glob-to-regexp": "^0.4.1",
+        "graceful-fs": "^4.2.9",
+        "json-parse-even-better-errors": "^2.3.1",
+        "loader-runner": "^4.2.0",
+        "mime-types": "^2.1.27",
+        "neo-async": "^2.6.2",
+        "schema-utils": "^3.1.2",
+        "tapable": "^2.1.1",
+        "terser-webpack-plugin": "^5.3.7",
+        "watchpack": "^2.4.0",
+        "webpack-sources": "^3.2.3"
+      },
+      "bin": {
+        "webpack": "bin/webpack.js"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      },
+      "peerDependenciesMeta": {
+        "webpack-cli": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/webpack-bundle-analyzer": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/webpack-bundle-analyzer/-/webpack-bundle-analyzer-4.5.0.tgz",
+      "integrity": "sha512-GUMZlM3SKwS8Z+CKeIFx7CVoHn3dXFcUAjT/dcZQQmfSZGvitPfMob2ipjai7ovFFqPvTqkEZ/leL4O0YOdAYQ==",
+      "dev": true,
+      "dependencies": {
+        "acorn": "^8.0.4",
+        "acorn-walk": "^8.0.0",
+        "chalk": "^4.1.0",
+        "commander": "^7.2.0",
+        "gzip-size": "^6.0.0",
+        "lodash": "^4.17.20",
+        "opener": "^1.5.2",
+        "sirv": "^1.0.7",
+        "ws": "^7.3.1"
+      },
+      "bin": {
+        "webpack-bundle-analyzer": "lib/bin/analyzer.js"
+      },
+      "engines": {
+        "node": ">= 10.13.0"
+      }
+    },
+    "node_modules/webpack-bundle-analyzer/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/webpack-bundle-analyzer/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/webpack-bundle-analyzer/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/webpack-bundle-analyzer/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/webpack-bundle-analyzer/node_modules/commander": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-7.2.0.tgz",
+      "integrity": "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==",
+      "dev": true,
+      "engines": {
+        "node": ">= 10"
+      }
+    },
+    "node_modules/webpack-bundle-analyzer/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/webpack-bundle-analyzer/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/webpack-chain": {
+      "version": "6.5.1",
+      "resolved": "https://registry.npmjs.org/webpack-chain/-/webpack-chain-6.5.1.tgz",
+      "integrity": "sha512-7doO/SRtLu8q5WM0s7vPKPWX580qhi0/yBHkOxNkv50f6qB76Zy9o2wRTrrPULqYTvQlVHuvbA8v+G5ayuUDsA==",
+      "dev": true,
+      "dependencies": {
+        "deepmerge": "^1.5.2",
+        "javascript-stringify": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/webpack-dev-middleware": {
+      "version": "5.3.3",
+      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.3.tgz",
+      "integrity": "sha512-hj5CYrY0bZLB+eTO+x/j67Pkrquiy7kWepMHmUMoPsmcUaeEnQJqFzHJOyxgWlq746/wUuA64p9ta34Kyb01pA==",
+      "dev": true,
+      "dependencies": {
+        "colorette": "^2.0.10",
+        "memfs": "^3.4.3",
+        "mime-types": "^2.1.31",
+        "range-parser": "^1.2.1",
+        "schema-utils": "^4.0.0"
+      },
+      "engines": {
+        "node": ">= 12.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      },
+      "peerDependencies": {
+        "webpack": "^4.0.0 || ^5.0.0"
+      }
+    },
+    "node_modules/webpack-dev-middleware/node_modules/ajv": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.11.0.tgz",
+      "integrity": "sha512-wGgprdCvMalC0BztXvitD2hC04YffAvtsUn93JbGXYLAtCUO4xd17mCCZQxUOItiBwZvJScWo8NIvQMQ71rdpg==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/webpack-dev-middleware/node_modules/ajv-keywords": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-5.1.0.tgz",
+      "integrity": "sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3"
+      },
+      "peerDependencies": {
+        "ajv": "^8.8.2"
+      }
+    },
+    "node_modules/webpack-dev-middleware/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true
+    },
+    "node_modules/webpack-dev-middleware/node_modules/schema-utils": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.0.0.tgz",
+      "integrity": "sha512-1edyXKgh6XnJsJSQ8mKWXnN/BVaIbFMLpouRUrXgVq7WYne5kw3MW7UPhO44uRXQSIpTSXoJbmrR2X0w9kUTyg==",
+      "dev": true,
+      "dependencies": {
+        "@types/json-schema": "^7.0.9",
+        "ajv": "^8.8.0",
+        "ajv-formats": "^2.1.1",
+        "ajv-keywords": "^5.0.0"
+      },
+      "engines": {
+        "node": ">= 12.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      }
+    },
+    "node_modules/webpack-dev-server": {
+      "version": "4.9.3",
+      "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-4.9.3.tgz",
+      "integrity": "sha512-3qp/eoboZG5/6QgiZ3llN8TUzkSpYg1Ko9khWX1h40MIEUNS2mDoIa8aXsPfskER+GbTvs/IJZ1QTBBhhuetSw==",
+      "dev": true,
+      "dependencies": {
+        "@types/bonjour": "^3.5.9",
+        "@types/connect-history-api-fallback": "^1.3.5",
+        "@types/express": "^4.17.13",
+        "@types/serve-index": "^1.9.1",
+        "@types/serve-static": "^1.13.10",
+        "@types/sockjs": "^0.3.33",
+        "@types/ws": "^8.5.1",
+        "ansi-html-community": "^0.0.8",
+        "bonjour-service": "^1.0.11",
+        "chokidar": "^3.5.3",
+        "colorette": "^2.0.10",
+        "compression": "^1.7.4",
+        "connect-history-api-fallback": "^2.0.0",
+        "default-gateway": "^6.0.3",
+        "express": "^4.17.3",
+        "graceful-fs": "^4.2.6",
+        "html-entities": "^2.3.2",
+        "http-proxy-middleware": "^2.0.3",
+        "ipaddr.js": "^2.0.1",
+        "open": "^8.0.9",
+        "p-retry": "^4.5.0",
+        "rimraf": "^3.0.2",
+        "schema-utils": "^4.0.0",
+        "selfsigned": "^2.0.1",
+        "serve-index": "^1.9.1",
+        "sockjs": "^0.3.24",
+        "spdy": "^4.0.2",
+        "webpack-dev-middleware": "^5.3.1",
+        "ws": "^8.4.2"
+      },
+      "bin": {
+        "webpack-dev-server": "bin/webpack-dev-server.js"
+      },
+      "engines": {
+        "node": ">= 12.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      },
+      "peerDependencies": {
+        "webpack": "^4.37.0 || ^5.0.0"
+      },
+      "peerDependenciesMeta": {
+        "webpack-cli": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/webpack-dev-server/node_modules/ajv": {
+      "version": "8.11.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.11.0.tgz",
+      "integrity": "sha512-wGgprdCvMalC0BztXvitD2hC04YffAvtsUn93JbGXYLAtCUO4xd17mCCZQxUOItiBwZvJScWo8NIvQMQ71rdpg==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/webpack-dev-server/node_modules/ajv-keywords": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-5.1.0.tgz",
+      "integrity": "sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3"
+      },
+      "peerDependencies": {
+        "ajv": "^8.8.2"
+      }
+    },
+    "node_modules/webpack-dev-server/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true
+    },
+    "node_modules/webpack-dev-server/node_modules/schema-utils": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.0.0.tgz",
+      "integrity": "sha512-1edyXKgh6XnJsJSQ8mKWXnN/BVaIbFMLpouRUrXgVq7WYne5kw3MW7UPhO44uRXQSIpTSXoJbmrR2X0w9kUTyg==",
+      "dev": true,
+      "dependencies": {
+        "@types/json-schema": "^7.0.9",
+        "ajv": "^8.8.0",
+        "ajv-formats": "^2.1.1",
+        "ajv-keywords": "^5.0.0"
+      },
+      "engines": {
+        "node": ">= 12.13.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
+      }
+    },
+    "node_modules/webpack-dev-server/node_modules/ws": {
+      "version": "8.8.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.8.0.tgz",
+      "integrity": "sha512-JDAgSYQ1ksuwqfChJusw1LSJ8BizJ2e/vVu5Lxjq3YvNJNlROv1ui4i+c/kUUrPheBvQl4c5UbERhTwKa6QBJQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": "^5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/webpack-merge": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/webpack-merge/-/webpack-merge-5.8.0.tgz",
+      "integrity": "sha512-/SaI7xY0831XwP6kzuwhKWVKDP9t1QY1h65lAFLbZqMPIuYcD9QAW4u9STIbU9kaJbPBB/geU/gLr1wDjOhQ+Q==",
+      "dev": true,
+      "dependencies": {
+        "clone-deep": "^4.0.1",
+        "wildcard": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/webpack-sources": {
+      "version": "3.2.3",
+      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.2.3.tgz",
+      "integrity": "sha512-/DyMEOrDgLKKIG0fmvtz+4dUX/3Ghozwgm6iPp8KRhvn+eQf9+Q7GWxVNMk3+uCPWfdXYC4ExGBckIXdFEfH1w==",
+      "dev": true,
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/webpack-virtual-modules": {
+      "version": "0.4.4",
+      "resolved": "https://registry.npmjs.org/webpack-virtual-modules/-/webpack-virtual-modules-0.4.4.tgz",
+      "integrity": "sha512-h9atBP/bsZohWpHnr+2sic8Iecb60GxftXsWNLLLSqewgIsGzByd2gcIID4nXcG+3tNe4GQG3dLcff3kXupdRA==",
+      "dev": true
+    },
+    "node_modules/websocket-driver": {
+      "version": "0.7.4",
+      "resolved": "https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.4.tgz",
+      "integrity": "sha512-b17KeDIQVjvb0ssuSDF2cYXSg2iztliJ4B9WdsuB6J952qCPKmnVq4DyW5motImXHDC1cBT/1UezrJVsKw5zjg==",
+      "dev": true,
+      "dependencies": {
+        "http-parser-js": ">=0.5.1",
+        "safe-buffer": ">=5.1.0",
+        "websocket-extensions": ">=0.1.1"
+      },
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
+    "node_modules/websocket-extensions": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/websocket-extensions/-/websocket-extensions-0.1.4.tgz",
+      "integrity": "sha512-OqedPIGOfsDlo31UNwYbCFMSaO9m9G/0faIHj5/dZFDMFqPTcx6UwqyOy3COEaEOg/9VsGIpdqn62W5KhoKSpg==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
+    "node_modules/whatwg-encoding": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-1.0.5.tgz",
+      "integrity": "sha512-b5lim54JOPN9HtzvK9HFXvBma/rnfFeqsic0hSpjtDbVxR3dJKLc+KB4V6GgiGOvl7CY/KNh8rxSo9DKQrnUEw==",
+      "dev": true,
+      "dependencies": {
+        "iconv-lite": "0.4.24"
+      }
+    },
+    "node_modules/whatwg-fetch": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/whatwg-fetch/-/whatwg-fetch-3.6.2.tgz",
+      "integrity": "sha512-bJlen0FcuU/0EMLrdbJ7zOnW6ITZLrZMIarMUVmdKtsGvZna8vxKYaexICWPfZ8qwf9fzNq+UEIZrnSaApt6RA=="
+    },
+    "node_modules/whatwg-mimetype": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-2.3.0.tgz",
+      "integrity": "sha512-M4yMwr6mAnQz76TbJm914+gPpB/nCwvZbJU28cUD6dR004SAxDLOOSUaB1JDRqLtaOV/vi0IC5lEAGFgrjGv/g==",
+      "dev": true
+    },
+    "node_modules/whatwg-url": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
+      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
+      "dev": true,
+      "dependencies": {
+        "tr46": "~0.0.3",
+        "webidl-conversions": "^3.0.0"
+      }
+    },
+    "node_modules/which": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/which/-/which-1.3.1.tgz",
+      "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==",
+      "dev": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "which": "bin/which"
+      }
+    },
+    "node_modules/wildcard": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/wildcard/-/wildcard-2.0.0.tgz",
+      "integrity": "sha512-JcKqAHLPxcdb9KM49dufGXn2x3ssnfjbcaQdLlfZsL9rH9wgDQjUtDxbo8NE0F6SFvydeu1VhZe7hZuHsB2/pw==",
+      "dev": true
+    },
+    "node_modules/word-wrap": {
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
+      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/wrap-ansi": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/wrap-ansi/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "dev": true
+    },
+    "node_modules/write-file-atomic": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-3.0.3.tgz",
+      "integrity": "sha512-AvHcyZ5JnSfq3ioSyjrBkH9yW4m7Ayk8/9My/DD9onKeu/94fwrMocemO2QAJFAlnnDN+ZDS+ZjAR5ua1/PV/Q==",
+      "dev": true,
+      "dependencies": {
+        "imurmurhash": "^0.1.4",
+        "is-typedarray": "^1.0.0",
+        "signal-exit": "^3.0.2",
+        "typedarray-to-buffer": "^3.1.5"
+      }
+    },
+    "node_modules/ws": {
+      "version": "7.5.8",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.8.tgz",
+      "integrity": "sha512-ri1Id1WinAX5Jqn9HejiGb8crfRio0Qgu8+MtL36rlTA6RLsMdWt1Az/19A2Qij6uSHUMphEFaTKa4WG+UNHNw==",
+      "dev": true,
+      "engines": {
+        "node": ">=8.3.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": "^5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/xml-name-validator": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-4.0.0.tgz",
+      "integrity": "sha512-ICP2e+jsHvAj2E2lIHxa5tjXRlKDJo4IdvPvCXbXQGdzSfmSpNVyIKMvoZHjDY9DP0zV17iI85o90vRFXNccRw==",
+      "dev": true,
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/xmlchars": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
+      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
+      "dev": true
+    },
+    "node_modules/xtend": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
+      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.4"
+      }
+    },
+    "node_modules/y18n": {
+      "version": "5.0.8",
+      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
+      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+      "dev": true
+    },
+    "node_modules/yaml": {
+      "version": "1.10.2",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz",
+      "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/yargs": {
+      "version": "16.2.0",
+      "resolved": "https://registry.npmjs.org/yargs/-/yargs-16.2.0.tgz",
+      "integrity": "sha512-D1mvvtDG0L5ft/jGWkLpG1+m0eQxOfaBvTNELraWj22wSVUMWxZUvYgJYcKh6jGGIkJFhH4IZPQhR4TKpc8mBw==",
+      "dev": true,
+      "dependencies": {
+        "cliui": "^7.0.2",
+        "escalade": "^3.1.1",
+        "get-caller-file": "^2.0.5",
+        "require-directory": "^2.1.1",
+        "string-width": "^4.2.0",
+        "y18n": "^5.0.5",
+        "yargs-parser": "^20.2.2"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/yargs-parser": {
+      "version": "20.2.9",
+      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.9.tgz",
+      "integrity": "sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/yorkie": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/yorkie/-/yorkie-2.0.0.tgz",
+      "integrity": "sha512-jcKpkthap6x63MB4TxwCyuIGkV0oYP/YRyuQU5UO0Yz/E/ZAu+653/uov+phdmO54n6BcvFRyyt0RRrWdN2mpw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "dependencies": {
+        "execa": "^0.8.0",
+        "is-ci": "^1.0.10",
+        "normalize-path": "^1.0.0",
+        "strip-indent": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/yorkie/node_modules/cross-spawn": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-5.1.0.tgz",
+      "integrity": "sha512-pTgQJ5KC0d2hcY8eyL1IzlBPYjTkyH72XRZPnLyKus2mBfNjQs3klqbJU2VILqZryAZUt9JOb3h/mWMy23/f5A==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^4.0.1",
+        "shebang-command": "^1.2.0",
+        "which": "^1.2.9"
+      }
+    },
+    "node_modules/yorkie/node_modules/execa": {
+      "version": "0.8.0",
+      "resolved": "https://registry.npmjs.org/execa/-/execa-0.8.0.tgz",
+      "integrity": "sha512-zDWS+Rb1E8BlqqhALSt9kUhss8Qq4nN3iof3gsOdyINksElaPyNBtKUMTR62qhvgVWR0CqCX7sdnKe4MnUbFEA==",
+      "dev": true,
+      "dependencies": {
+        "cross-spawn": "^5.0.1",
+        "get-stream": "^3.0.0",
+        "is-stream": "^1.1.0",
+        "npm-run-path": "^2.0.0",
+        "p-finally": "^1.0.0",
+        "signal-exit": "^3.0.0",
+        "strip-eof": "^1.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/yorkie/node_modules/get-stream": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-3.0.0.tgz",
+      "integrity": "sha512-GlhdIUuVakc8SJ6kK0zAFbiGzRFzNnY4jUuEbV9UROo4Y+0Ny4fjvcZFVTeDA4odpFyOQzaw6hXukJSq/f28sQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/yorkie/node_modules/lru-cache": {
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-4.1.5.tgz",
+      "integrity": "sha512-sWZlbEP2OsHNkXrMl5GYk/jKk70MBng6UU4YI/qGDYbgf6YbP4EvmqISbXCoJiRKs+1bSpFHVgQxvJ17F2li5g==",
+      "dev": true,
+      "dependencies": {
+        "pseudomap": "^1.0.2",
+        "yallist": "^2.1.2"
+      }
+    },
+    "node_modules/yorkie/node_modules/normalize-path": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-1.0.0.tgz",
+      "integrity": "sha512-7WyT0w8jhpDStXRq5836AMmihQwq2nrUVQrgjvUo/p/NZf9uy/MeJ246lBJVmWuYXMlJuG9BNZHF0hWjfTbQUA==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/yorkie/node_modules/yallist": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-2.1.2.tgz",
+      "integrity": "sha512-ncTzHV7NvsQZkYe1DW7cbDLm0YpzHmZF5r/iyP3ZnQtMiJ+pjzisCiMNI+Sj+xQF5pXhSHxSB3uDbsBTzY/c2A==",
+      "dev": true
+    }
+  },
+  "dependencies": {
+    "@achrinza/node-ipc": {
+      "version": "9.2.5",
+      "resolved": "https://registry.npmjs.org/@achrinza/node-ipc/-/node-ipc-9.2.5.tgz",
+      "integrity": "sha512-kBX7Ay911iXZ3VZ1pYltj3Rfu7Ow9H7sK4H4RSfWIfWR2JKNB40K808wppoRIEzE2j2hXLU+r6TJgCAliCGhyQ==",
+      "dev": true,
+      "requires": {
+        "@node-ipc/js-queue": "2.0.3",
+        "event-pubsub": "4.3.0",
+        "js-message": "1.0.7"
+      }
+    },
+    "@ampproject/remapping": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.2.0.tgz",
+      "integrity": "sha512-qRmjj8nj9qmLTQXXmaR1cck3UXSRMPrbsLJAasZpF+t3riI71BXed5ebIOYwQntykeZuhjsdweEc9BxH5Jc26w==",
+      "dev": true,
+      "requires": {
+        "@jridgewell/gen-mapping": "^0.1.0",
+        "@jridgewell/trace-mapping": "^0.3.9"
+      }
+    },
+    "@auth0/auth0-spa-js": {
+      "version": "1.22.4",
+      "resolved": "https://registry.npmjs.org/@auth0/auth0-spa-js/-/auth0-spa-js-1.22.4.tgz",
+      "integrity": "sha512-iOboSV+aUsExV1onKvGKEqi626sjJt+61c3EvA4mkn9RM7RV9RMjPI+cInNFHWjwAd2Sdi3LqBj6/MfcHh69dg==",
+      "requires": {
+        "abortcontroller-polyfill": "^1.7.3",
+        "browser-tabs-lock": "^1.2.15",
+        "core-js": "^3.24.0",
+        "es-cookie": "~1.3.2",
+        "fast-text-encoding": "^1.0.4",
+        "promise-polyfill": "^8.2.3",
+        "unfetch": "^4.2.0"
+      }
+    },
+    "@auth0/auth0-vue": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@auth0/auth0-vue/-/auth0-vue-1.0.2.tgz",
+      "integrity": "sha512-Oj64AV9ti3AwyKBpEnLvhj16xL2erXFRJrqVI/kvLxYjLnn5GWui/7/iJghvCEHjyxIaJRUtgh3+ZiQgMkDvzQ==",
+      "requires": {
+        "@auth0/auth0-spa-js": "^1.22.1",
+        "vue": "^3.2.35"
+      }
+    },
+    "@babel/code-frame": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.18.6.tgz",
+      "integrity": "sha512-TDCmlK5eOvH+eH7cdAFlNXeVJqWIQ7gW9tY1GJIpUtFb6CmjVyq2VM3u71bOyR8CRihcCgMUYoDNyLXao3+70Q==",
+      "dev": true,
+      "requires": {
+        "@babel/highlight": "^7.18.6"
+      }
+    },
+    "@babel/compat-data": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.18.6.tgz",
+      "integrity": "sha512-tzulrgDT0QD6U7BJ4TKVk2SDDg7wlP39P9yAx1RfLy7vP/7rsDRlWVfbWxElslu56+r7QOhB2NSDsabYYruoZQ==",
+      "dev": true
+    },
+    "@babel/core": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.18.6.tgz",
+      "integrity": "sha512-cQbWBpxcbbs/IUredIPkHiAGULLV8iwgNRMFzvbhEXISp4f3rUUXE5+TIw6KwUWUR3DwyI6gmBRnmAtYaWehwQ==",
+      "dev": true,
+      "requires": {
+        "@ampproject/remapping": "^2.1.0",
+        "@babel/code-frame": "^7.18.6",
+        "@babel/generator": "^7.18.6",
+        "@babel/helper-compilation-targets": "^7.18.6",
+        "@babel/helper-module-transforms": "^7.18.6",
+        "@babel/helpers": "^7.18.6",
+        "@babel/parser": "^7.18.6",
+        "@babel/template": "^7.18.6",
+        "@babel/traverse": "^7.18.6",
+        "@babel/types": "^7.18.6",
+        "convert-source-map": "^1.7.0",
+        "debug": "^4.1.0",
+        "gensync": "^1.0.0-beta.2",
+        "json5": "^2.2.1",
+        "semver": "^6.3.0"
+      }
+    },
+    "@babel/generator": {
+      "version": "7.18.7",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.18.7.tgz",
+      "integrity": "sha512-shck+7VLlY72a2w9c3zYWuE1pwOKEiQHV7GTUbSnhyl5eu3i04t30tBY82ZRWrDfo3gkakCFtevExnxbkf2a3A==",
+      "dev": true,
+      "requires": {
+        "@babel/types": "^7.18.7",
+        "@jridgewell/gen-mapping": "^0.3.2",
+        "jsesc": "^2.5.1"
+      },
+      "dependencies": {
+        "@jridgewell/gen-mapping": {
+          "version": "0.3.2",
+          "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.2.tgz",
+          "integrity": "sha512-mh65xKQAzI6iBcFzwv28KVWSmCkdRBWoOh+bYQGW3+6OZvbbN3TqMGo5hqYxQniRcH9F2VZIoJCm4pa3BPDK/A==",
+          "dev": true,
+          "requires": {
+            "@jridgewell/set-array": "^1.0.1",
+            "@jridgewell/sourcemap-codec": "^1.4.10",
+            "@jridgewell/trace-mapping": "^0.3.9"
+          }
+        }
+      }
+    },
+    "@babel/helper-annotate-as-pure": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.18.6.tgz",
+      "integrity": "sha512-duORpUiYrEpzKIop6iNbjnwKLAKnJ47csTyRACyEmWj0QdUrm5aqNJGHSSEQSUAvNW0ojX0dOmK9dZduvkfeXA==",
+      "dev": true,
+      "requires": {
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helper-builder-binary-assignment-operator-visitor": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-builder-binary-assignment-operator-visitor/-/helper-builder-binary-assignment-operator-visitor-7.18.6.tgz",
+      "integrity": "sha512-KT10c1oWEpmrIRYnthbzHgoOf6B+Xd6a5yhdbNtdhtG7aO1or5HViuf1TQR36xY/QprXA5nvxO6nAjhJ4y38jw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-explode-assignable-expression": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helper-compilation-targets": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.18.6.tgz",
+      "integrity": "sha512-vFjbfhNCzqdeAtZflUFrG5YIFqGTqsctrtkZ1D/NB0mDW9TwW3GmmUepYY4G9wCET5rY5ugz4OGTcLd614IzQg==",
+      "dev": true,
+      "requires": {
+        "@babel/compat-data": "^7.18.6",
+        "@babel/helper-validator-option": "^7.18.6",
+        "browserslist": "^4.20.2",
+        "semver": "^6.3.0"
+      }
+    },
+    "@babel/helper-create-class-features-plugin": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.18.6.tgz",
+      "integrity": "sha512-YfDzdnoxHGV8CzqHGyCbFvXg5QESPFkXlHtvdCkesLjjVMT2Adxe4FGUR5ChIb3DxSaXO12iIOCWoXdsUVwnqw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-annotate-as-pure": "^7.18.6",
+        "@babel/helper-environment-visitor": "^7.18.6",
+        "@babel/helper-function-name": "^7.18.6",
+        "@babel/helper-member-expression-to-functions": "^7.18.6",
+        "@babel/helper-optimise-call-expression": "^7.18.6",
+        "@babel/helper-replace-supers": "^7.18.6",
+        "@babel/helper-split-export-declaration": "^7.18.6"
+      }
+    },
+    "@babel/helper-create-regexp-features-plugin": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.18.6.tgz",
+      "integrity": "sha512-7LcpH1wnQLGrI+4v+nPp+zUvIkF9x0ddv1Hkdue10tg3gmRnLy97DXh4STiOf1qeIInyD69Qv5kKSZzKD8B/7A==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-annotate-as-pure": "^7.18.6",
+        "regexpu-core": "^5.1.0"
+      }
+    },
+    "@babel/helper-define-polyfill-provider": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.3.1.tgz",
+      "integrity": "sha512-J9hGMpJQmtWmj46B3kBHmL38UhJGhYX7eqkcq+2gsstyYt341HmPeWspihX43yVRA0mS+8GGk2Gckc7bY/HCmA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-compilation-targets": "^7.13.0",
+        "@babel/helper-module-imports": "^7.12.13",
+        "@babel/helper-plugin-utils": "^7.13.0",
+        "@babel/traverse": "^7.13.0",
+        "debug": "^4.1.1",
+        "lodash.debounce": "^4.0.8",
+        "resolve": "^1.14.2",
+        "semver": "^6.1.2"
+      }
+    },
+    "@babel/helper-environment-visitor": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.18.6.tgz",
+      "integrity": "sha512-8n6gSfn2baOY+qlp+VSzsosjCVGFqWKmDF0cCWOybh52Dw3SEyoWR1KrhMJASjLwIEkkAufZ0xvr+SxLHSpy2Q==",
+      "dev": true
+    },
+    "@babel/helper-explode-assignable-expression": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-explode-assignable-expression/-/helper-explode-assignable-expression-7.18.6.tgz",
+      "integrity": "sha512-eyAYAsQmB80jNfg4baAtLeWAQHfHFiR483rzFK+BhETlGZaQC9bsfrugfXDCbRHLQbIA7U5NxhhOxN7p/dWIcg==",
+      "dev": true,
+      "requires": {
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helper-function-name": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.18.6.tgz",
+      "integrity": "sha512-0mWMxV1aC97dhjCah5U5Ua7668r5ZmSC2DLfH2EZnf9c3/dHZKiFa5pRLMH5tjSl471tY6496ZWk/kjNONBxhw==",
+      "dev": true,
+      "requires": {
+        "@babel/template": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helper-hoist-variables": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.18.6.tgz",
+      "integrity": "sha512-UlJQPkFqFULIcyW5sbzgbkxn2FKRgwWiRexcuaR8RNJRy8+LLveqPjwZV/bwrLZCN0eUHD/x8D0heK1ozuoo6Q==",
+      "dev": true,
+      "requires": {
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helper-member-expression-to-functions": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.18.6.tgz",
+      "integrity": "sha512-CeHxqwwipekotzPDUuJOfIMtcIHBuc7WAzLmTYWctVigqS5RktNMQ5bEwQSuGewzYnCtTWa3BARXeiLxDTv+Ng==",
+      "dev": true,
+      "requires": {
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helper-module-imports": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.18.6.tgz",
+      "integrity": "sha512-0NFvs3VkuSYbFi1x2Vd6tKrywq+z/cLeYC/RJNFrIX/30Bf5aiGYbtvGXolEktzJH8o5E5KJ3tT+nkxuuZFVlA==",
+      "dev": true,
+      "requires": {
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helper-module-transforms": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.18.6.tgz",
+      "integrity": "sha512-L//phhB4al5uucwzlimruukHB3jRd5JGClwRMD/ROrVjXfLqovYnvQrK/JK36WYyVwGGO7OD3kMyVTjx+WVPhw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-environment-visitor": "^7.18.6",
+        "@babel/helper-module-imports": "^7.18.6",
+        "@babel/helper-simple-access": "^7.18.6",
+        "@babel/helper-split-export-declaration": "^7.18.6",
+        "@babel/helper-validator-identifier": "^7.18.6",
+        "@babel/template": "^7.18.6",
+        "@babel/traverse": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helper-optimise-call-expression": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.18.6.tgz",
+      "integrity": "sha512-HP59oD9/fEHQkdcbgFCnbmgH5vIQTJbxh2yf+CdM89/glUNnuzr87Q8GIjGEnOktTROemO0Pe0iPAYbqZuOUiA==",
+      "dev": true,
+      "requires": {
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helper-plugin-utils": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.18.6.tgz",
+      "integrity": "sha512-gvZnm1YAAxh13eJdkb9EWHBnF3eAub3XTLCZEehHT2kWxiKVRL64+ae5Y6Ivne0mVHmMYKT+xWgZO+gQhuLUBg==",
+      "dev": true
+    },
+    "@babel/helper-remap-async-to-generator": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.18.6.tgz",
+      "integrity": "sha512-z5wbmV55TveUPZlCLZvxWHtrjuJd+8inFhk7DG0WW87/oJuGDcjDiu7HIvGcpf5464L6xKCg3vNkmlVVz9hwyQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-annotate-as-pure": "^7.18.6",
+        "@babel/helper-environment-visitor": "^7.18.6",
+        "@babel/helper-wrap-function": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helper-replace-supers": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.18.6.tgz",
+      "integrity": "sha512-fTf7zoXnUGl9gF25fXCWE26t7Tvtyn6H4hkLSYhATwJvw2uYxd3aoXplMSe0g9XbwK7bmxNes7+FGO0rB/xC0g==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-environment-visitor": "^7.18.6",
+        "@babel/helper-member-expression-to-functions": "^7.18.6",
+        "@babel/helper-optimise-call-expression": "^7.18.6",
+        "@babel/traverse": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helper-simple-access": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.18.6.tgz",
+      "integrity": "sha512-iNpIgTgyAvDQpDj76POqg+YEt8fPxx3yaNBg3S30dxNKm2SWfYhD0TGrK/Eu9wHpUW63VQU894TsTg+GLbUa1g==",
+      "dev": true,
+      "requires": {
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helper-skip-transparent-expression-wrappers": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.18.6.tgz",
+      "integrity": "sha512-4KoLhwGS9vGethZpAhYnMejWkX64wsnHPDwvOsKWU6Fg4+AlK2Jz3TyjQLMEPvz+1zemi/WBdkYxCD0bAfIkiw==",
+      "dev": true,
+      "requires": {
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helper-split-export-declaration": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.18.6.tgz",
+      "integrity": "sha512-bde1etTx6ZyTmobl9LLMMQsaizFVZrquTEHOqKeQESMKo4PlObf+8+JA25ZsIpZhT/WEd39+vOdLXAFG/nELpA==",
+      "dev": true,
+      "requires": {
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helper-validator-identifier": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.18.6.tgz",
+      "integrity": "sha512-MmetCkz9ej86nJQV+sFCxoGGrUbU3q02kgLciwkrt9QqEB7cP39oKEY0PakknEO0Gu20SskMRi+AYZ3b1TpN9g==",
+      "dev": true
+    },
+    "@babel/helper-validator-option": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.18.6.tgz",
+      "integrity": "sha512-XO7gESt5ouv/LRJdrVjkShckw6STTaB7l9BrpBaAHDeF5YZT+01PCwmR0SJHnkW6i8OwW/EVWRShfi4j2x+KQw==",
+      "dev": true
+    },
+    "@babel/helper-wrap-function": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helper-wrap-function/-/helper-wrap-function-7.18.6.tgz",
+      "integrity": "sha512-I5/LZfozwMNbwr/b1vhhuYD+J/mU+gfGAj5td7l5Rv9WYmH6i3Om69WGKNmlIpsVW/mF6O5bvTKbvDQZVgjqOw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-function-name": "^7.18.6",
+        "@babel/template": "^7.18.6",
+        "@babel/traverse": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/helpers": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.18.6.tgz",
+      "integrity": "sha512-vzSiiqbQOghPngUYt/zWGvK3LAsPhz55vc9XNN0xAl2gV4ieShI2OQli5duxWHD+72PZPTKAcfcZDE1Cwc5zsQ==",
+      "dev": true,
+      "requires": {
+        "@babel/template": "^7.18.6",
+        "@babel/traverse": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/highlight": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.18.6.tgz",
+      "integrity": "sha512-u7stbOuYjaPezCuLj29hNW1v64M2Md2qupEKP1fHc7WdOA3DgLh37suiSrZYY7haUB7iBeQZ9P1uiRF359do3g==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-validator-identifier": "^7.18.6",
+        "chalk": "^2.0.0",
+        "js-tokens": "^4.0.0"
+      }
+    },
+    "@babel/parser": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.18.6.tgz",
+      "integrity": "sha512-uQVSa9jJUe/G/304lXspfWVpKpK4euFLgGiMQFOCpM/bgcAdeoHwi/OQz23O9GK2osz26ZiXRRV9aV+Yl1O8tw=="
+    },
+    "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.18.6.tgz",
+      "integrity": "sha512-Dgxsyg54Fx1d4Nge8UnvTrED63vrwOdPmyvPzlNN/boaliRP54pm3pGzZD1SJUwrBA+Cs/xdG8kXX6Mn/RfISQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.18.6.tgz",
+      "integrity": "sha512-Udgu8ZRgrBrttVz6A0EVL0SJ1z+RLbIeqsu632SA1hf0awEppD6TvdznoH+orIF8wtFFAV/Enmw9Y+9oV8TQcw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.18.6",
+        "@babel/plugin-proposal-optional-chaining": "^7.18.6"
+      }
+    },
+    "@babel/plugin-proposal-async-generator-functions": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-async-generator-functions/-/plugin-proposal-async-generator-functions-7.18.6.tgz",
+      "integrity": "sha512-WAz4R9bvozx4qwf74M+sfqPMKfSqwM0phxPTR6iJIi8robgzXwkEgmeJG1gEKhm6sDqT/U9aV3lfcqybIpev8w==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-environment-visitor": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-remap-async-to-generator": "^7.18.6",
+        "@babel/plugin-syntax-async-generators": "^7.8.4"
+      }
+    },
+    "@babel/plugin-proposal-class-properties": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-properties/-/plugin-proposal-class-properties-7.18.6.tgz",
+      "integrity": "sha512-cumfXOF0+nzZrrN8Rf0t7M+tF6sZc7vhQwYQck9q1/5w2OExlD+b4v4RpMJFaV1Z7WcDRgO6FqvxqxGlwo+RHQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-create-class-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-proposal-class-static-block": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-static-block/-/plugin-proposal-class-static-block-7.18.6.tgz",
+      "integrity": "sha512-+I3oIiNxrCpup3Gi8n5IGMwj0gOCAjcJUSQEcotNnCCPMEnixawOQ+KeJPlgfjzx+FKQ1QSyZOWe7wmoJp7vhw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-create-class-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-class-static-block": "^7.14.5"
+      }
+    },
+    "@babel/plugin-proposal-decorators": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-decorators/-/plugin-proposal-decorators-7.18.6.tgz",
+      "integrity": "sha512-gAdhsjaYmiZVxx5vTMiRfj31nB7LhwBJFMSLzeDxc7X4tKLixup0+k9ughn0RcpBrv9E3PBaXJW7jF5TCihAOg==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-create-class-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-replace-supers": "^7.18.6",
+        "@babel/helper-split-export-declaration": "^7.18.6",
+        "@babel/plugin-syntax-decorators": "^7.18.6"
+      }
+    },
+    "@babel/plugin-proposal-dynamic-import": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-dynamic-import/-/plugin-proposal-dynamic-import-7.18.6.tgz",
+      "integrity": "sha512-1auuwmK+Rz13SJj36R+jqFPMJWyKEDd7lLSdOj4oJK0UTgGueSAtkrCvz9ewmgyU/P941Rv2fQwZJN8s6QruXw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-dynamic-import": "^7.8.3"
+      }
+    },
+    "@babel/plugin-proposal-export-namespace-from": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-export-namespace-from/-/plugin-proposal-export-namespace-from-7.18.6.tgz",
+      "integrity": "sha512-zr/QcUlUo7GPo6+X1wC98NJADqmy5QTFWWhqeQWiki4XHafJtLl/YMGkmRB2szDD2IYJCCdBTd4ElwhId9T7Xw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-export-namespace-from": "^7.8.3"
+      }
+    },
+    "@babel/plugin-proposal-json-strings": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-json-strings/-/plugin-proposal-json-strings-7.18.6.tgz",
+      "integrity": "sha512-lr1peyn9kOdbYc0xr0OdHTZ5FMqS6Di+H0Fz2I/JwMzGmzJETNeOFq2pBySw6X/KFL5EWDjlJuMsUGRFb8fQgQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-json-strings": "^7.8.3"
+      }
+    },
+    "@babel/plugin-proposal-logical-assignment-operators": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-logical-assignment-operators/-/plugin-proposal-logical-assignment-operators-7.18.6.tgz",
+      "integrity": "sha512-zMo66azZth/0tVd7gmkxOkOjs2rpHyhpcFo565PUP37hSp6hSd9uUKIfTDFMz58BwqgQKhJ9YxtM5XddjXVn+Q==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4"
+      }
+    },
+    "@babel/plugin-proposal-nullish-coalescing-operator": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-nullish-coalescing-operator/-/plugin-proposal-nullish-coalescing-operator-7.18.6.tgz",
+      "integrity": "sha512-wQxQzxYeJqHcfppzBDnm1yAY0jSRkUXR2z8RePZYrKwMKgMlE8+Z6LUno+bd6LvbGh8Gltvy74+9pIYkr+XkKA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3"
+      }
+    },
+    "@babel/plugin-proposal-numeric-separator": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-numeric-separator/-/plugin-proposal-numeric-separator-7.18.6.tgz",
+      "integrity": "sha512-ozlZFogPqoLm8WBr5Z8UckIoE4YQ5KESVcNudyXOR8uqIkliTEgJ3RoketfG6pmzLdeZF0H/wjE9/cCEitBl7Q==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-numeric-separator": "^7.10.4"
+      }
+    },
+    "@babel/plugin-proposal-object-rest-spread": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-object-rest-spread/-/plugin-proposal-object-rest-spread-7.18.6.tgz",
+      "integrity": "sha512-9yuM6wr4rIsKa1wlUAbZEazkCrgw2sMPEXCr4Rnwetu7cEW1NydkCWytLuYletbf8vFxdJxFhwEZqMpOx2eZyw==",
+      "dev": true,
+      "requires": {
+        "@babel/compat-data": "^7.18.6",
+        "@babel/helper-compilation-targets": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+        "@babel/plugin-transform-parameters": "^7.18.6"
+      }
+    },
+    "@babel/plugin-proposal-optional-catch-binding": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-catch-binding/-/plugin-proposal-optional-catch-binding-7.18.6.tgz",
+      "integrity": "sha512-Q40HEhs9DJQyaZfUjjn6vE8Cv4GmMHCYuMGIWUnlxH6400VGxOuwWsPt4FxXxJkC/5eOzgn0z21M9gMT4MOhbw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-optional-catch-binding": "^7.8.3"
+      }
+    },
+    "@babel/plugin-proposal-optional-chaining": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-chaining/-/plugin-proposal-optional-chaining-7.18.6.tgz",
+      "integrity": "sha512-PatI6elL5eMzoypFAiYDpYQyMtXTn+iMhuxxQt5mAXD4fEmKorpSI3PHd+i3JXBJN3xyA6MvJv7at23HffFHwA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.18.6",
+        "@babel/plugin-syntax-optional-chaining": "^7.8.3"
+      }
+    },
+    "@babel/plugin-proposal-private-methods": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-methods/-/plugin-proposal-private-methods-7.18.6.tgz",
+      "integrity": "sha512-nutsvktDItsNn4rpGItSNV2sz1XwS+nfU0Rg8aCx3W3NOKVzdMjJRu0O5OkgDp3ZGICSTbgRpxZoWsxoKRvbeA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-create-class-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-proposal-private-property-in-object": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.18.6.tgz",
+      "integrity": "sha512-9Rysx7FOctvT5ouj5JODjAFAkgGoudQuLPamZb0v1TGLpapdNaftzifU8NTWQm0IRjqoYypdrSmyWgkocDQ8Dw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-annotate-as-pure": "^7.18.6",
+        "@babel/helper-create-class-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/plugin-syntax-private-property-in-object": "^7.14.5"
+      }
+    },
+    "@babel/plugin-proposal-unicode-property-regex": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-unicode-property-regex/-/plugin-proposal-unicode-property-regex-7.18.6.tgz",
+      "integrity": "sha512-2BShG/d5yoZyXZfVePH91urL5wTG6ASZU9M4o03lKK8u8UW1y08OMttBSOADTcJrnPMpvDXRG3G8fyLh4ovs8w==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-syntax-async-generators": {
+      "version": "7.8.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz",
+      "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-bigint": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-bigint/-/plugin-syntax-bigint-7.8.3.tgz",
+      "integrity": "sha512-wnTnFlG+YxQm3vDxpGE57Pj0srRU4sHE/mDkt1qv2YJJSeUAec2ma4WLUnUPeKjyrfntVwe/N6dCXpU+zL3Npg==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-class-properties": {
+      "version": "7.12.13",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz",
+      "integrity": "sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.12.13"
+      }
+    },
+    "@babel/plugin-syntax-class-static-block": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-static-block/-/plugin-syntax-class-static-block-7.14.5.tgz",
+      "integrity": "sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      }
+    },
+    "@babel/plugin-syntax-decorators": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-decorators/-/plugin-syntax-decorators-7.18.6.tgz",
+      "integrity": "sha512-fqyLgjcxf/1yhyZ6A+yo1u9gJ7eleFQod2lkaUsF9DQ7sbbY3Ligym3L0+I2c0WmqNKDpoD9UTb1AKP3qRMOAQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-syntax-dynamic-import": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-dynamic-import/-/plugin-syntax-dynamic-import-7.8.3.tgz",
+      "integrity": "sha512-5gdGbFon+PszYzqs83S3E5mpi7/y/8M9eC90MRTZfduQOYW76ig6SOSPNe41IG5LoP3FGBn2N0RjVDSQiS94kQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-export-namespace-from": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-export-namespace-from/-/plugin-syntax-export-namespace-from-7.8.3.tgz",
+      "integrity": "sha512-MXf5laXo6c1IbEbegDmzGPwGNTsHZmEy6QGznu5Sh2UCWvueywb2ee+CCE4zQiZstxU9BMoQO9i6zUFSY0Kj0Q==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.3"
+      }
+    },
+    "@babel/plugin-syntax-import-assertions": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-assertions/-/plugin-syntax-import-assertions-7.18.6.tgz",
+      "integrity": "sha512-/DU3RXad9+bZwrgWJQKbr39gYbJpLJHezqEzRzi/BHRlJ9zsQb4CK2CA/5apllXNomwA1qHwzvHl+AdEmC5krQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-syntax-import-meta": {
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-meta/-/plugin-syntax-import-meta-7.10.4.tgz",
+      "integrity": "sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.10.4"
+      }
+    },
+    "@babel/plugin-syntax-json-strings": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz",
+      "integrity": "sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-jsx": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.18.6.tgz",
+      "integrity": "sha512-6mmljtAedFGTWu2p/8WIORGwy+61PLgOMPOdazc7YoJ9ZCWUyFy3A6CpPkRKLKD1ToAesxX8KGEViAiLo9N+7Q==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-syntax-logical-assignment-operators": {
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.10.4.tgz",
+      "integrity": "sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.10.4"
+      }
+    },
+    "@babel/plugin-syntax-nullish-coalescing-operator": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz",
+      "integrity": "sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-numeric-separator": {
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.10.4.tgz",
+      "integrity": "sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.10.4"
+      }
+    },
+    "@babel/plugin-syntax-object-rest-spread": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz",
+      "integrity": "sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-optional-catch-binding": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz",
+      "integrity": "sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-optional-chaining": {
+      "version": "7.8.3",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz",
+      "integrity": "sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.8.0"
+      }
+    },
+    "@babel/plugin-syntax-private-property-in-object": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-private-property-in-object/-/plugin-syntax-private-property-in-object-7.14.5.tgz",
+      "integrity": "sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      }
+    },
+    "@babel/plugin-syntax-top-level-await": {
+      "version": "7.14.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz",
+      "integrity": "sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.14.5"
+      }
+    },
+    "@babel/plugin-syntax-typescript": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.18.6.tgz",
+      "integrity": "sha512-mAWAuq4rvOepWCBid55JuRNvpTNf2UGVgoz4JV0fXEKolsVZDzsa4NqCef758WZJj/GDu0gVGItjKFiClTAmZA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-arrow-functions": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.18.6.tgz",
+      "integrity": "sha512-9S9X9RUefzrsHZmKMbDXxweEH+YlE8JJEuat9FdvW9Qh1cw7W64jELCtWNkPBPX5En45uy28KGvA/AySqUh8CQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-async-to-generator": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.18.6.tgz",
+      "integrity": "sha512-ARE5wZLKnTgPW7/1ftQmSi1CmkqqHo2DNmtztFhvgtOWSDfq0Cq9/9L+KnZNYSNrydBekhW3rwShduf59RoXag==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-module-imports": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-remap-async-to-generator": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-block-scoped-functions": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.18.6.tgz",
+      "integrity": "sha512-ExUcOqpPWnliRcPqves5HJcJOvHvIIWfuS4sroBUenPuMdmW+SMHDakmtS7qOo13sVppmUijqeTv7qqGsvURpQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-block-scoping": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoping/-/plugin-transform-block-scoping-7.18.6.tgz",
+      "integrity": "sha512-pRqwb91C42vs1ahSAWJkxOxU1RHWDn16XAa6ggQ72wjLlWyYeAcLvTtE0aM8ph3KNydy9CQF2nLYcjq1WysgxQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-classes": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-classes/-/plugin-transform-classes-7.18.6.tgz",
+      "integrity": "sha512-XTg8XW/mKpzAF3actL554Jl/dOYoJtv3l8fxaEczpgz84IeeVf+T1u2CSvPHuZbt0w3JkIx4rdn/MRQI7mo0HQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-annotate-as-pure": "^7.18.6",
+        "@babel/helper-environment-visitor": "^7.18.6",
+        "@babel/helper-function-name": "^7.18.6",
+        "@babel/helper-optimise-call-expression": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-replace-supers": "^7.18.6",
+        "@babel/helper-split-export-declaration": "^7.18.6",
+        "globals": "^11.1.0"
+      }
+    },
+    "@babel/plugin-transform-computed-properties": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.18.6.tgz",
+      "integrity": "sha512-9repI4BhNrR0KenoR9vm3/cIc1tSBIo+u1WVjKCAynahj25O8zfbiE6JtAtHPGQSs4yZ+bA8mRasRP+qc+2R5A==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-destructuring": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.18.6.tgz",
+      "integrity": "sha512-tgy3u6lRp17ilY8r1kP4i2+HDUwxlVqq3RTc943eAWSzGgpU1qhiKpqZ5CMyHReIYPHdo3Kg8v8edKtDqSVEyQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-dotall-regex": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.18.6.tgz",
+      "integrity": "sha512-6S3jpun1eEbAxq7TdjLotAsl4WpQI9DxfkycRcKrjhQYzU87qpXdknpBg/e+TdcMehqGnLFi7tnFUBR02Vq6wg==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-duplicate-keys": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.18.6.tgz",
+      "integrity": "sha512-NJU26U/208+sxYszf82nmGYqVF9QN8py2HFTblPT9hbawi8+1C5a9JubODLTGFuT0qlkqVinmkwOD13s0sZktg==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-exponentiation-operator": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.18.6.tgz",
+      "integrity": "sha512-wzEtc0+2c88FVR34aQmiz56dxEkxr2g8DQb/KfaFa1JYXOFVsbhvAonFN6PwVWj++fKmku8NP80plJ5Et4wqHw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-builder-binary-assignment-operator-visitor": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-for-of": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.18.6.tgz",
+      "integrity": "sha512-WAjoMf4wIiSsy88KmG7tgj2nFdEK7E46tArVtcgED7Bkj6Fg/tG5SbvNIOKxbFS2VFgNh6+iaPswBeQZm4ox8w==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-function-name": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.18.6.tgz",
+      "integrity": "sha512-kJha/Gbs5RjzIu0CxZwf5e3aTTSlhZnHMT8zPWnJMjNpLOUgqevg+PN5oMH68nMCXnfiMo4Bhgxqj59KHTlAnA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-compilation-targets": "^7.18.6",
+        "@babel/helper-function-name": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-literals": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-literals/-/plugin-transform-literals-7.18.6.tgz",
+      "integrity": "sha512-x3HEw0cJZVDoENXOp20HlypIHfl0zMIhMVZEBVTfmqbObIpsMxMbmU5nOEO8R7LYT+z5RORKPlTI5Hj4OsO9/Q==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-member-expression-literals": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.18.6.tgz",
+      "integrity": "sha512-qSF1ihLGO3q+/g48k85tUjD033C29TNTVB2paCwZPVmOsjn9pClvYYrM2VeJpBY2bcNkuny0YUyTNRyRxJ54KA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-modules-amd": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.18.6.tgz",
+      "integrity": "sha512-Pra5aXsmTsOnjM3IajS8rTaLCy++nGM4v3YR4esk5PCsyg9z8NA5oQLwxzMUtDBd8F+UmVza3VxoAaWCbzH1rg==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-module-transforms": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "babel-plugin-dynamic-import-node": "^2.3.3"
+      }
+    },
+    "@babel/plugin-transform-modules-commonjs": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.18.6.tgz",
+      "integrity": "sha512-Qfv2ZOWikpvmedXQJDSbxNqy7Xr/j2Y8/KfijM0iJyKkBTmWuvCA1yeH1yDM7NJhBW/2aXxeucLj6i80/LAJ/Q==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-module-transforms": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-simple-access": "^7.18.6",
+        "babel-plugin-dynamic-import-node": "^2.3.3"
+      }
+    },
+    "@babel/plugin-transform-modules-systemjs": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.18.6.tgz",
+      "integrity": "sha512-UbPYpXxLjTw6w6yXX2BYNxF3p6QY225wcTkfQCy3OMnSlS/C3xGtwUjEzGkldb/sy6PWLiCQ3NbYfjWUTI3t4g==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-hoist-variables": "^7.18.6",
+        "@babel/helper-module-transforms": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-validator-identifier": "^7.18.6",
+        "babel-plugin-dynamic-import-node": "^2.3.3"
+      }
+    },
+    "@babel/plugin-transform-modules-umd": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.18.6.tgz",
+      "integrity": "sha512-dcegErExVeXcRqNtkRU/z8WlBLnvD4MRnHgNs3MytRO1Mn1sHRyhbcpYbVMGclAqOjdW+9cfkdZno9dFdfKLfQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-module-transforms": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-named-capturing-groups-regex": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.18.6.tgz",
+      "integrity": "sha512-UmEOGF8XgaIqD74bC8g7iV3RYj8lMf0Bw7NJzvnS9qQhM4mg+1WHKotUIdjxgD2RGrgFLZZPCFPFj3P/kVDYhg==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-new-target": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.18.6.tgz",
+      "integrity": "sha512-DjwFA/9Iu3Z+vrAn+8pBUGcjhxKguSMlsFqeCKbhb9BAV756v0krzVK04CRDi/4aqmk8BsHb4a/gFcaA5joXRw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-object-super": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.18.6.tgz",
+      "integrity": "sha512-uvGz6zk+pZoS1aTZrOvrbj6Pp/kK2mp45t2B+bTDre2UgsZZ8EZLSJtUg7m/no0zOJUWgFONpB7Zv9W2tSaFlA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-replace-supers": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-parameters": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.18.6.tgz",
+      "integrity": "sha512-FjdqgMv37yVl/gwvzkcB+wfjRI8HQmc5EgOG9iGNvUY1ok+TjsoaMP7IqCDZBhkFcM5f3OPVMs6Dmp03C5k4/A==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-property-literals": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.18.6.tgz",
+      "integrity": "sha512-cYcs6qlgafTud3PAzrrRNbQtfpQ8+y/+M5tKmksS9+M1ckbH6kzY8MrexEM9mcA6JDsukE19iIRvAyYl463sMg==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-regenerator": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.18.6.tgz",
+      "integrity": "sha512-poqRI2+qiSdeldcz4wTSTXBRryoq3Gc70ye7m7UD5Ww0nE29IXqMl6r7Nd15WBgRd74vloEMlShtH6CKxVzfmQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "regenerator-transform": "^0.15.0"
+      }
+    },
+    "@babel/plugin-transform-reserved-words": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.18.6.tgz",
+      "integrity": "sha512-oX/4MyMoypzHjFrT1CdivfKZ+XvIPMFXwwxHp/r0Ddy2Vuomt4HDFGmft1TAY2yiTKiNSsh3kjBAzcM8kSdsjA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-runtime": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-runtime/-/plugin-transform-runtime-7.18.6.tgz",
+      "integrity": "sha512-8uRHk9ZmRSnWqUgyae249EJZ94b0yAGLBIqzZzl+0iEdbno55Pmlt/32JZsHwXD9k/uZj18Aqqk35wBX4CBTXA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-module-imports": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "babel-plugin-polyfill-corejs2": "^0.3.1",
+        "babel-plugin-polyfill-corejs3": "^0.5.2",
+        "babel-plugin-polyfill-regenerator": "^0.3.1",
+        "semver": "^6.3.0"
+      }
+    },
+    "@babel/plugin-transform-shorthand-properties": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.18.6.tgz",
+      "integrity": "sha512-eCLXXJqv8okzg86ywZJbRn19YJHU4XUa55oz2wbHhaQVn/MM+XhukiT7SYqp/7o00dg52Rj51Ny+Ecw4oyoygw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-spread": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-spread/-/plugin-transform-spread-7.18.6.tgz",
+      "integrity": "sha512-ayT53rT/ENF8WWexIRg9AiV9h0aIteyWn5ptfZTZQrjk/+f3WdrJGCY4c9wcgl2+MKkKPhzbYp97FTsquZpDCw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-skip-transparent-expression-wrappers": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-sticky-regex": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.18.6.tgz",
+      "integrity": "sha512-kfiDrDQ+PBsQDO85yj1icueWMfGfJFKN1KCkndygtu/C9+XUfydLC8Iv5UYJqRwy4zk8EcplRxEOeLyjq1gm6Q==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-template-literals": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.18.6.tgz",
+      "integrity": "sha512-UuqlRrQmT2SWRvahW46cGSany0uTlcj8NYOS5sRGYi8FxPYPoLd5DDmMd32ZXEj2Jq+06uGVQKHxa/hJx2EzKw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-typeof-symbol": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.18.6.tgz",
+      "integrity": "sha512-7m71iS/QhsPk85xSjFPovHPcH3H9qeyzsujhTc+vcdnsXavoWYJ74zx0lP5RhpC5+iDnVLO+PPMHzC11qels1g==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-unicode-escapes": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.18.6.tgz",
+      "integrity": "sha512-XNRwQUXYMP7VLuy54cr/KS/WeL3AZeORhrmeZ7iewgu+X2eBqmpaLI/hzqr9ZxCeUoq0ASK4GUzSM0BDhZkLFw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/plugin-transform-unicode-regex": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.18.6.tgz",
+      "integrity": "sha512-gE7A6Lt7YLnNOL3Pb9BNeZvi+d8l7tcRrG4+pwJjK9hD2xX4mEvjlQW60G9EEmfXVYRPv9VRQcyegIVHCql/AA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-create-regexp-features-plugin": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6"
+      }
+    },
+    "@babel/preset-env": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.18.6.tgz",
+      "integrity": "sha512-WrthhuIIYKrEFAwttYzgRNQ5hULGmwTj+D6l7Zdfsv5M7IWV/OZbUfbeL++Qrzx1nVJwWROIFhCHRYQV4xbPNw==",
+      "dev": true,
+      "requires": {
+        "@babel/compat-data": "^7.18.6",
+        "@babel/helper-compilation-targets": "^7.18.6",
+        "@babel/helper-plugin-utils": "^7.18.6",
+        "@babel/helper-validator-option": "^7.18.6",
+        "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": "^7.18.6",
+        "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": "^7.18.6",
+        "@babel/plugin-proposal-async-generator-functions": "^7.18.6",
+        "@babel/plugin-proposal-class-properties": "^7.18.6",
+        "@babel/plugin-proposal-class-static-block": "^7.18.6",
+        "@babel/plugin-proposal-dynamic-import": "^7.18.6",
+        "@babel/plugin-proposal-export-namespace-from": "^7.18.6",
+        "@babel/plugin-proposal-json-strings": "^7.18.6",
+        "@babel/plugin-proposal-logical-assignment-operators": "^7.18.6",
+        "@babel/plugin-proposal-nullish-coalescing-operator": "^7.18.6",
+        "@babel/plugin-proposal-numeric-separator": "^7.18.6",
+        "@babel/plugin-proposal-object-rest-spread": "^7.18.6",
+        "@babel/plugin-proposal-optional-catch-binding": "^7.18.6",
+        "@babel/plugin-proposal-optional-chaining": "^7.18.6",
+        "@babel/plugin-proposal-private-methods": "^7.18.6",
+        "@babel/plugin-proposal-private-property-in-object": "^7.18.6",
+        "@babel/plugin-proposal-unicode-property-regex": "^7.18.6",
+        "@babel/plugin-syntax-async-generators": "^7.8.4",
+        "@babel/plugin-syntax-class-properties": "^7.12.13",
+        "@babel/plugin-syntax-class-static-block": "^7.14.5",
+        "@babel/plugin-syntax-dynamic-import": "^7.8.3",
+        "@babel/plugin-syntax-export-namespace-from": "^7.8.3",
+        "@babel/plugin-syntax-import-assertions": "^7.18.6",
+        "@babel/plugin-syntax-json-strings": "^7.8.3",
+        "@babel/plugin-syntax-logical-assignment-operators": "^7.10.4",
+        "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3",
+        "@babel/plugin-syntax-numeric-separator": "^7.10.4",
+        "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+        "@babel/plugin-syntax-optional-catch-binding": "^7.8.3",
+        "@babel/plugin-syntax-optional-chaining": "^7.8.3",
+        "@babel/plugin-syntax-private-property-in-object": "^7.14.5",
+        "@babel/plugin-syntax-top-level-await": "^7.14.5",
+        "@babel/plugin-transform-arrow-functions": "^7.18.6",
+        "@babel/plugin-transform-async-to-generator": "^7.18.6",
+        "@babel/plugin-transform-block-scoped-functions": "^7.18.6",
+        "@babel/plugin-transform-block-scoping": "^7.18.6",
+        "@babel/plugin-transform-classes": "^7.18.6",
+        "@babel/plugin-transform-computed-properties": "^7.18.6",
+        "@babel/plugin-transform-destructuring": "^7.18.6",
+        "@babel/plugin-transform-dotall-regex": "^7.18.6",
+        "@babel/plugin-transform-duplicate-keys": "^7.18.6",
+        "@babel/plugin-transform-exponentiation-operator": "^7.18.6",
+        "@babel/plugin-transform-for-of": "^7.18.6",
+        "@babel/plugin-transform-function-name": "^7.18.6",
+        "@babel/plugin-transform-literals": "^7.18.6",
+        "@babel/plugin-transform-member-expression-literals": "^7.18.6",
+        "@babel/plugin-transform-modules-amd": "^7.18.6",
+        "@babel/plugin-transform-modules-commonjs": "^7.18.6",
+        "@babel/plugin-transform-modules-systemjs": "^7.18.6",
+        "@babel/plugin-transform-modules-umd": "^7.18.6",
+        "@babel/plugin-transform-named-capturing-groups-regex": "^7.18.6",
+        "@babel/plugin-transform-new-target": "^7.18.6",
+        "@babel/plugin-transform-object-super": "^7.18.6",
+        "@babel/plugin-transform-parameters": "^7.18.6",
+        "@babel/plugin-transform-property-literals": "^7.18.6",
+        "@babel/plugin-transform-regenerator": "^7.18.6",
+        "@babel/plugin-transform-reserved-words": "^7.18.6",
+        "@babel/plugin-transform-shorthand-properties": "^7.18.6",
+        "@babel/plugin-transform-spread": "^7.18.6",
+        "@babel/plugin-transform-sticky-regex": "^7.18.6",
+        "@babel/plugin-transform-template-literals": "^7.18.6",
+        "@babel/plugin-transform-typeof-symbol": "^7.18.6",
+        "@babel/plugin-transform-unicode-escapes": "^7.18.6",
+        "@babel/plugin-transform-unicode-regex": "^7.18.6",
+        "@babel/preset-modules": "^0.1.5",
+        "@babel/types": "^7.18.6",
+        "babel-plugin-polyfill-corejs2": "^0.3.1",
+        "babel-plugin-polyfill-corejs3": "^0.5.2",
+        "babel-plugin-polyfill-regenerator": "^0.3.1",
+        "core-js-compat": "^3.22.1",
+        "semver": "^6.3.0"
+      }
+    },
+    "@babel/preset-modules": {
+      "version": "0.1.5",
+      "resolved": "https://registry.npmjs.org/@babel/preset-modules/-/preset-modules-0.1.5.tgz",
+      "integrity": "sha512-A57th6YRG7oR3cq/yt/Y84MvGgE0eJG2F1JLhKuyG+jFxEgrd/HAMJatiFtmOiZurz+0DkrvbheCLaV5f2JfjA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.0.0",
+        "@babel/plugin-proposal-unicode-property-regex": "^7.4.4",
+        "@babel/plugin-transform-dotall-regex": "^7.4.4",
+        "@babel/types": "^7.4.4",
+        "esutils": "^2.0.2"
+      }
+    },
+    "@babel/runtime": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.18.6.tgz",
+      "integrity": "sha512-t9wi7/AW6XtKahAe20Yw0/mMljKq0B1r2fPdvaAdV/KPDZewFXdaaa6K7lxmZBZ8FBNpCiAT6iHPmd6QO9bKfQ==",
+      "dev": true,
+      "requires": {
+        "regenerator-runtime": "^0.13.4"
+      }
+    },
+    "@babel/template": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.18.6.tgz",
+      "integrity": "sha512-JoDWzPe+wgBsTTgdnIma3iHNFC7YVJoPssVBDjiHfNlyt4YcunDtcDOUmfVDfCK5MfdsaIoX9PkijPhjH3nYUw==",
+      "dev": true,
+      "requires": {
+        "@babel/code-frame": "^7.18.6",
+        "@babel/parser": "^7.18.6",
+        "@babel/types": "^7.18.6"
+      }
+    },
+    "@babel/traverse": {
+      "version": "7.18.6",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.18.6.tgz",
+      "integrity": "sha512-zS/OKyqmD7lslOtFqbscH6gMLFYOfG1YPqCKfAW5KrTeolKqvB8UelR49Fpr6y93kYkW2Ik00mT1LOGiAGvizw==",
+      "dev": true,
+      "requires": {
+        "@babel/code-frame": "^7.18.6",
+        "@babel/generator": "^7.18.6",
+        "@babel/helper-environment-visitor": "^7.18.6",
+        "@babel/helper-function-name": "^7.18.6",
+        "@babel/helper-hoist-variables": "^7.18.6",
+        "@babel/helper-split-export-declaration": "^7.18.6",
+        "@babel/parser": "^7.18.6",
+        "@babel/types": "^7.18.6",
+        "debug": "^4.1.0",
+        "globals": "^11.1.0"
+      }
+    },
+    "@babel/types": {
+      "version": "7.18.7",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.18.7.tgz",
+      "integrity": "sha512-QG3yxTcTIBoAcQmkCs+wAPYZhu7Dk9rXKacINfNbdJDNERTbLQbHGyVG8q/YGMPeCJRIhSY0+fTc5+xuh6WPSQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-validator-identifier": "^7.18.6",
+        "to-fast-properties": "^2.0.0"
+      }
+    },
+    "@bcoe/v8-coverage": {
+      "version": "0.2.3",
+      "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz",
+      "integrity": "sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==",
+      "dev": true
+    },
+    "@eslint/eslintrc": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-1.3.0.tgz",
+      "integrity": "sha512-UWW0TMTmk2d7hLcWD1/e2g5HDM/HQ3csaLSqXCfqwh4uNDuNqlaKWXmEsL4Cs41Z0KnILNvwbHAah3C2yt06kw==",
+      "dev": true,
+      "requires": {
+        "ajv": "^6.12.4",
+        "debug": "^4.3.2",
+        "espree": "^9.3.2",
+        "globals": "^13.15.0",
+        "ignore": "^5.2.0",
+        "import-fresh": "^3.2.1",
+        "js-yaml": "^4.1.0",
+        "minimatch": "^3.1.2",
+        "strip-json-comments": "^3.1.1"
+      },
+      "dependencies": {
+        "globals": {
+          "version": "13.15.0",
+          "resolved": "https://registry.npmjs.org/globals/-/globals-13.15.0.tgz",
+          "integrity": "sha512-bpzcOlgDhMG070Av0Vy5Owklpv1I6+j96GhUI7Rh7IzDCKLzboflLrrfqMu8NquDbiR4EOQk7XzJwqVJxicxog==",
+          "dev": true,
+          "requires": {
+            "type-fest": "^0.20.2"
+          }
+        },
+        "type-fest": {
+          "version": "0.20.2",
+          "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
+          "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
+          "dev": true
+        }
+      }
+    },
+    "@hapi/hoek": {
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/@hapi/hoek/-/hoek-9.3.0.tgz",
+      "integrity": "sha512-/c6rf4UJlmHlC9b5BaNvzAcFv7HZ2QHaV0D4/HNlBdvFnvQq8RI4kYdhyPCl7Xj+oWvTWQ8ujhqS53LIgAe6KQ==",
+      "dev": true
+    },
+    "@hapi/topo": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@hapi/topo/-/topo-5.1.0.tgz",
+      "integrity": "sha512-foQZKJig7Ob0BMAYBfcJk8d77QtOe7Wo4ox7ff1lQYoNNAb6jwcY1ncdoy2e9wQZzvNy7ODZCYJkK8kzmcAnAg==",
+      "dev": true,
+      "requires": {
+        "@hapi/hoek": "^9.0.0"
+      }
+    },
+    "@headlessui/vue": {
+      "version": "1.6.5",
+      "resolved": "https://registry.npmjs.org/@headlessui/vue/-/vue-1.6.5.tgz",
+      "integrity": "sha512-C/BeTVuowTDLkGgUd6UfiPZVDLdR7OTnd8o4wF37Ub9Js1uhQ3XSTfitdZvlJALUqeQ30j+5Hk3KyjVDLQ3GYQ==",
+      "requires": {}
+    },
+    "@heroicons/vue": {
+      "version": "2.0.13",
+      "resolved": "https://registry.npmjs.org/@heroicons/vue/-/vue-2.0.13.tgz",
+      "integrity": "sha512-vVCVF02+rNKXEmanVNnmktJlxCbOn0qVFP1gfZPn4bcBIwPX3h9AVHGCkwly+IWDEME8w5oooG0KRd2hhSe/HQ==",
+      "requires": {}
+    },
+    "@humanwhocodes/config-array": {
+      "version": "0.9.5",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.9.5.tgz",
+      "integrity": "sha512-ObyMyWxZiCu/yTisA7uzx81s40xR2fD5Cg/2Kq7G02ajkNubJf6BopgDTmDyc3U7sXpNKM8cYOw7s7Tyr+DnCw==",
+      "dev": true,
+      "requires": {
+        "@humanwhocodes/object-schema": "^1.2.1",
+        "debug": "^4.1.1",
+        "minimatch": "^3.0.4"
+      }
+    },
+    "@humanwhocodes/object-schema": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-1.2.1.tgz",
+      "integrity": "sha512-ZnQMnLV4e7hDlUvw8H+U8ASL02SS2Gn6+9Ac3wGGLIe7+je2AeAOxPY+izIPJDfFDb7eDjev0Us8MO1iFRN8hA==",
+      "dev": true
+    },
+    "@istanbuljs/load-nyc-config": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz",
+      "integrity": "sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==",
+      "dev": true,
+      "requires": {
+        "camelcase": "^5.3.1",
+        "find-up": "^4.1.0",
+        "get-package-type": "^0.1.0",
+        "js-yaml": "^3.13.1",
+        "resolve-from": "^5.0.0"
+      },
+      "dependencies": {
+        "argparse": {
+          "version": "1.0.10",
+          "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
+          "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+          "dev": true,
+          "requires": {
+            "sprintf-js": "~1.0.2"
+          }
+        },
+        "camelcase": {
+          "version": "5.3.1",
+          "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
+          "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
+          "dev": true
+        },
+        "js-yaml": {
+          "version": "3.14.1",
+          "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
+          "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
+          "dev": true,
+          "requires": {
+            "argparse": "^1.0.7",
+            "esprima": "^4.0.0"
+          }
+        },
+        "resolve-from": {
+          "version": "5.0.0",
+          "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
+          "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
+          "dev": true
+        }
+      }
+    },
+    "@istanbuljs/schema": {
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.3.tgz",
+      "integrity": "sha512-ZXRY4jNvVgSVQ8DL3LTcakaAtXwTVUxE81hslsyD2AtoXW/wVob10HkOJ1X/pAlcI7D+2YoZKg5do8G/w6RYgA==",
+      "dev": true
+    },
+    "@jest/console": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/@jest/console/-/console-28.1.1.tgz",
+      "integrity": "sha512-0RiUocPVFEm3WRMOStIHbRWllG6iW6E3/gUPnf4lkrVFyXIIDeCe+vlKeYyFOMhB2EPE6FLFCNADSOOQMaqvyA==",
+      "dev": true,
+      "requires": {
+        "@jest/types": "^28.1.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "jest-message-util": "^28.1.1",
+        "jest-util": "^28.1.1",
+        "slash": "^3.0.0"
+      },
+      "dependencies": {
+        "@jest/types": {
+          "version": "28.1.1",
+          "resolved": "https://registry.npmjs.org/@jest/types/-/types-28.1.1.tgz",
+          "integrity": "sha512-vRXVqSg1VhDnB8bWcmvLzmg0Bt9CRKVgHPXqYwvWMX3TvAjeO+nRuK6+VdTKCtWOvYlmkF/HqNAL/z+N3B53Kw==",
+          "dev": true,
+          "requires": {
+            "@jest/schemas": "^28.0.2",
+            "@types/istanbul-lib-coverage": "^2.0.0",
+            "@types/istanbul-reports": "^3.0.0",
+            "@types/node": "*",
+            "@types/yargs": "^17.0.8",
+            "chalk": "^4.0.0"
+          }
+        },
+        "@types/yargs": {
+          "version": "17.0.10",
+          "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.10.tgz",
+          "integrity": "sha512-gmEaFwpj/7f/ROdtIlci1R1VYU1J4j95m8T+Tj3iBgiBFKg1foE/PSl93bBd5T9LDXNPo8UlNN6W0qwD8O5OaA==",
+          "dev": true,
+          "requires": {
+            "@types/yargs-parser": "*"
+          }
+        },
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-util": {
+          "version": "28.1.1",
+          "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-28.1.1.tgz",
+          "integrity": "sha512-FktOu7ca1DZSyhPAxgxB6hfh2+9zMoJ7aEQA759Z6p45NuO8mWcqujH+UdHlCm/V6JTWwDztM2ITCzU1ijJAfw==",
+          "dev": true,
+          "requires": {
+            "@jest/types": "^28.1.1",
+            "@types/node": "*",
+            "chalk": "^4.0.0",
+            "ci-info": "^3.2.0",
+            "graceful-fs": "^4.2.9",
+            "picomatch": "^2.2.3"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "@jest/core": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/core/-/core-27.5.1.tgz",
+      "integrity": "sha512-AK6/UTrvQD0Cd24NSqmIA6rKsu0tKIxfiCducZvqxYdmMisOYAsdItspT+fQDQYARPf8XgjAFZi0ogW2agH5nQ==",
+      "dev": true,
+      "requires": {
+        "@jest/console": "^27.5.1",
+        "@jest/reporters": "^27.5.1",
+        "@jest/test-result": "^27.5.1",
+        "@jest/transform": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "ansi-escapes": "^4.2.1",
+        "chalk": "^4.0.0",
+        "emittery": "^0.8.1",
+        "exit": "^0.1.2",
+        "graceful-fs": "^4.2.9",
+        "jest-changed-files": "^27.5.1",
+        "jest-config": "^27.5.1",
+        "jest-haste-map": "^27.5.1",
+        "jest-message-util": "^27.5.1",
+        "jest-regex-util": "^27.5.1",
+        "jest-resolve": "^27.5.1",
+        "jest-resolve-dependencies": "^27.5.1",
+        "jest-runner": "^27.5.1",
+        "jest-runtime": "^27.5.1",
+        "jest-snapshot": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "jest-validate": "^27.5.1",
+        "jest-watcher": "^27.5.1",
+        "micromatch": "^4.0.4",
+        "rimraf": "^3.0.0",
+        "slash": "^3.0.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "dependencies": {
+        "@jest/console": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+          "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+          "dev": true,
+          "requires": {
+            "@jest/types": "^27.5.1",
+            "@types/node": "*",
+            "chalk": "^4.0.0",
+            "jest-message-util": "^27.5.1",
+            "jest-util": "^27.5.1",
+            "slash": "^3.0.0"
+          }
+        },
+        "@jest/test-result": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+          "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+          "dev": true,
+          "requires": {
+            "@jest/console": "^27.5.1",
+            "@jest/types": "^27.5.1",
+            "@types/istanbul-lib-coverage": "^2.0.0",
+            "collect-v8-coverage": "^1.0.0"
+          }
+        },
+        "ansi-escapes": {
+          "version": "4.3.2",
+          "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
+          "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
+          "dev": true,
+          "requires": {
+            "type-fest": "^0.21.3"
+          }
+        },
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "emittery": {
+          "version": "0.8.1",
+          "resolved": "https://registry.npmjs.org/emittery/-/emittery-0.8.1.tgz",
+          "integrity": "sha512-uDfvUjVrfGJJhymx/kz6prltenw1u7WrCg1oa94zYY8xxVpLLUu045LAT0dhDZdXG58/EpPL/5kA180fQ/qudg==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-message-util": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+          "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+          "dev": true,
+          "requires": {
+            "@babel/code-frame": "^7.12.13",
+            "@jest/types": "^27.5.1",
+            "@types/stack-utils": "^2.0.0",
+            "chalk": "^4.0.0",
+            "graceful-fs": "^4.2.9",
+            "micromatch": "^4.0.4",
+            "pretty-format": "^27.5.1",
+            "slash": "^3.0.0",
+            "stack-utils": "^2.0.3"
+          }
+        },
+        "jest-watcher": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-27.5.1.tgz",
+          "integrity": "sha512-z676SuD6Z8o8qbmEGhoEUFOM1+jfEiL3DXHK/xgEiG2EyNYfFG60jluWcupY6dATjfEsKQuibReS1djInQnoVw==",
+          "dev": true,
+          "requires": {
+            "@jest/test-result": "^27.5.1",
+            "@jest/types": "^27.5.1",
+            "@types/node": "*",
+            "ansi-escapes": "^4.2.1",
+            "chalk": "^4.0.0",
+            "jest-util": "^27.5.1",
+            "string-length": "^4.0.1"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        },
+        "type-fest": {
+          "version": "0.21.3",
+          "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
+          "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
+          "dev": true
+        }
+      }
+    },
+    "@jest/environment": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-27.5.1.tgz",
+      "integrity": "sha512-/WQjhPJe3/ghaol/4Bq480JKXV/Rfw8nQdN7f41fM8VDHLcxKXou6QyXAh3EFr9/bVG3x74z1NWDkP87EiY8gA==",
+      "dev": true,
+      "requires": {
+        "@jest/fake-timers": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "jest-mock": "^27.5.1"
+      }
+    },
+    "@jest/fake-timers": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-27.5.1.tgz",
+      "integrity": "sha512-/aPowoolwa07k7/oM3aASneNeBGCmGQsc3ugN4u6s4C/+s5M64MFo/+djTdiwcbQlRfFElGuDXWzaWj6QgKObQ==",
+      "dev": true,
+      "requires": {
+        "@jest/types": "^27.5.1",
+        "@sinonjs/fake-timers": "^8.0.1",
+        "@types/node": "*",
+        "jest-message-util": "^27.5.1",
+        "jest-mock": "^27.5.1",
+        "jest-util": "^27.5.1"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-message-util": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+          "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+          "dev": true,
+          "requires": {
+            "@babel/code-frame": "^7.12.13",
+            "@jest/types": "^27.5.1",
+            "@types/stack-utils": "^2.0.0",
+            "chalk": "^4.0.0",
+            "graceful-fs": "^4.2.9",
+            "micromatch": "^4.0.4",
+            "pretty-format": "^27.5.1",
+            "slash": "^3.0.0",
+            "stack-utils": "^2.0.3"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "@jest/globals": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-27.5.1.tgz",
+      "integrity": "sha512-ZEJNB41OBQQgGzgyInAv0UUfDDj3upmHydjieSxFvTRuZElrx7tXg/uVQ5hYVEwiXs3+aMsAeEc9X7xiSKCm4Q==",
+      "dev": true,
+      "requires": {
+        "@jest/environment": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "expect": "^27.5.1"
+      }
+    },
+    "@jest/reporters": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-27.5.1.tgz",
+      "integrity": "sha512-cPXh9hWIlVJMQkVk84aIvXuBB4uQQmFqZiacloFuGiP3ah1sbCxCosidXFDfqG8+6fO1oR2dTJTlsOy4VFmUfw==",
+      "dev": true,
+      "requires": {
+        "@bcoe/v8-coverage": "^0.2.3",
+        "@jest/console": "^27.5.1",
+        "@jest/test-result": "^27.5.1",
+        "@jest/transform": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "collect-v8-coverage": "^1.0.0",
+        "exit": "^0.1.2",
+        "glob": "^7.1.2",
+        "graceful-fs": "^4.2.9",
+        "istanbul-lib-coverage": "^3.0.0",
+        "istanbul-lib-instrument": "^5.1.0",
+        "istanbul-lib-report": "^3.0.0",
+        "istanbul-lib-source-maps": "^4.0.0",
+        "istanbul-reports": "^3.1.3",
+        "jest-haste-map": "^27.5.1",
+        "jest-resolve": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "jest-worker": "^27.5.1",
+        "slash": "^3.0.0",
+        "source-map": "^0.6.0",
+        "string-length": "^4.0.1",
+        "terminal-link": "^2.0.0",
+        "v8-to-istanbul": "^8.1.0"
+      },
+      "dependencies": {
+        "@jest/console": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+          "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+          "dev": true,
+          "requires": {
+            "@jest/types": "^27.5.1",
+            "@types/node": "*",
+            "chalk": "^4.0.0",
+            "jest-message-util": "^27.5.1",
+            "jest-util": "^27.5.1",
+            "slash": "^3.0.0"
+          }
+        },
+        "@jest/test-result": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+          "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+          "dev": true,
+          "requires": {
+            "@jest/console": "^27.5.1",
+            "@jest/types": "^27.5.1",
+            "@types/istanbul-lib-coverage": "^2.0.0",
+            "collect-v8-coverage": "^1.0.0"
+          }
+        },
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-message-util": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+          "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+          "dev": true,
+          "requires": {
+            "@babel/code-frame": "^7.12.13",
+            "@jest/types": "^27.5.1",
+            "@types/stack-utils": "^2.0.0",
+            "chalk": "^4.0.0",
+            "graceful-fs": "^4.2.9",
+            "micromatch": "^4.0.4",
+            "pretty-format": "^27.5.1",
+            "slash": "^3.0.0",
+            "stack-utils": "^2.0.3"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "@jest/schemas": {
+      "version": "28.0.2",
+      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-28.0.2.tgz",
+      "integrity": "sha512-YVDJZjd4izeTDkij00vHHAymNXQ6WWsdChFRK86qck6Jpr3DCL5W3Is3vslviRlP+bLuMYRLbdp98amMvqudhA==",
+      "dev": true,
+      "requires": {
+        "@sinclair/typebox": "^0.23.3"
+      }
+    },
+    "@jest/source-map": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-27.5.1.tgz",
+      "integrity": "sha512-y9NIHUYF3PJRlHk98NdC/N1gl88BL08aQQgu4k4ZopQkCw9t9cV8mtl3TV8b/YCB8XaVTFrmUTAJvjsntDireg==",
+      "dev": true,
+      "requires": {
+        "callsites": "^3.0.0",
+        "graceful-fs": "^4.2.9",
+        "source-map": "^0.6.0"
+      }
+    },
+    "@jest/test-result": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-28.1.1.tgz",
+      "integrity": "sha512-hPmkugBktqL6rRzwWAtp1JtYT4VHwv8OQ+9lE5Gymj6dHzubI/oJHMUpPOt8NrdVWSrz9S7bHjJUmv2ggFoUNQ==",
+      "dev": true,
+      "requires": {
+        "@jest/console": "^28.1.1",
+        "@jest/types": "^28.1.1",
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "collect-v8-coverage": "^1.0.0"
+      },
+      "dependencies": {
+        "@jest/types": {
+          "version": "28.1.1",
+          "resolved": "https://registry.npmjs.org/@jest/types/-/types-28.1.1.tgz",
+          "integrity": "sha512-vRXVqSg1VhDnB8bWcmvLzmg0Bt9CRKVgHPXqYwvWMX3TvAjeO+nRuK6+VdTKCtWOvYlmkF/HqNAL/z+N3B53Kw==",
+          "dev": true,
+          "requires": {
+            "@jest/schemas": "^28.0.2",
+            "@types/istanbul-lib-coverage": "^2.0.0",
+            "@types/istanbul-reports": "^3.0.0",
+            "@types/node": "*",
+            "@types/yargs": "^17.0.8",
+            "chalk": "^4.0.0"
+          }
+        },
+        "@types/yargs": {
+          "version": "17.0.10",
+          "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.10.tgz",
+          "integrity": "sha512-gmEaFwpj/7f/ROdtIlci1R1VYU1J4j95m8T+Tj3iBgiBFKg1foE/PSl93bBd5T9LDXNPo8UlNN6W0qwD8O5OaA==",
+          "dev": true,
+          "requires": {
+            "@types/yargs-parser": "*"
+          }
+        },
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "@jest/test-sequencer": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-27.5.1.tgz",
+      "integrity": "sha512-LCheJF7WB2+9JuCS7VB/EmGIdQuhtqjRNI9A43idHv3E4KltCTsPsLxvdaubFHSYwY/fNjMWjl6vNRhDiN7vpQ==",
+      "dev": true,
+      "requires": {
+        "@jest/test-result": "^27.5.1",
+        "graceful-fs": "^4.2.9",
+        "jest-haste-map": "^27.5.1",
+        "jest-runtime": "^27.5.1"
+      },
+      "dependencies": {
+        "@jest/console": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+          "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+          "dev": true,
+          "requires": {
+            "@jest/types": "^27.5.1",
+            "@types/node": "*",
+            "chalk": "^4.0.0",
+            "jest-message-util": "^27.5.1",
+            "jest-util": "^27.5.1",
+            "slash": "^3.0.0"
+          }
+        },
+        "@jest/test-result": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+          "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+          "dev": true,
+          "requires": {
+            "@jest/console": "^27.5.1",
+            "@jest/types": "^27.5.1",
+            "@types/istanbul-lib-coverage": "^2.0.0",
+            "collect-v8-coverage": "^1.0.0"
+          }
+        },
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-message-util": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+          "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+          "dev": true,
+          "requires": {
+            "@babel/code-frame": "^7.12.13",
+            "@jest/types": "^27.5.1",
+            "@types/stack-utils": "^2.0.0",
+            "chalk": "^4.0.0",
+            "graceful-fs": "^4.2.9",
+            "micromatch": "^4.0.4",
+            "pretty-format": "^27.5.1",
+            "slash": "^3.0.0",
+            "stack-utils": "^2.0.3"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "@jest/transform": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-27.5.1.tgz",
+      "integrity": "sha512-ipON6WtYgl/1329g5AIJVbUuEh0wZVbdpGwC99Jw4LwuoBNS95MVphU6zOeD9pDkon+LLbFL7lOQRapbB8SCHw==",
+      "dev": true,
+      "requires": {
+        "@babel/core": "^7.1.0",
+        "@jest/types": "^27.5.1",
+        "babel-plugin-istanbul": "^6.1.1",
+        "chalk": "^4.0.0",
+        "convert-source-map": "^1.4.0",
+        "fast-json-stable-stringify": "^2.0.0",
+        "graceful-fs": "^4.2.9",
+        "jest-haste-map": "^27.5.1",
+        "jest-regex-util": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "micromatch": "^4.0.4",
+        "pirates": "^4.0.4",
+        "slash": "^3.0.0",
+        "source-map": "^0.6.1",
+        "write-file-atomic": "^3.0.0"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "@jest/types": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-27.5.1.tgz",
+      "integrity": "sha512-Cx46iJ9QpwQTjIdq5VJu2QTMMs3QlEjI0x1QbBP5W1+nMzyc2XmimiRR/CbX9TO0cPTeUlxWMOu8mslYsJ8DEw==",
+      "dev": true,
+      "requires": {
+        "@types/istanbul-lib-coverage": "^2.0.0",
+        "@types/istanbul-reports": "^3.0.0",
+        "@types/node": "*",
+        "@types/yargs": "^16.0.0",
+        "chalk": "^4.0.0"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "@jridgewell/gen-mapping": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.1.1.tgz",
+      "integrity": "sha512-sQXCasFk+U8lWYEe66WxRDOE9PjVz4vSM51fTu3Hw+ClTpUSQb718772vH3pyS5pShp6lvQM7SxgIDXXXmOX7w==",
+      "dev": true,
+      "requires": {
+        "@jridgewell/set-array": "^1.0.0",
+        "@jridgewell/sourcemap-codec": "^1.4.10"
+      }
+    },
+    "@jridgewell/resolve-uri": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.0.tgz",
+      "integrity": "sha512-F2msla3tad+Mfht5cJq7LSXcdudKTWCVYUgw6pLFOOHSTtZlj6SWNYAp+AhuqLmWdBO2X5hPrLcu8cVP8fy28w==",
+      "dev": true
+    },
+    "@jridgewell/set-array": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.1.2.tgz",
+      "integrity": "sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==",
+      "dev": true
+    },
+    "@jridgewell/source-map": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.2.tgz",
+      "integrity": "sha512-m7O9o2uR8k2ObDysZYzdfhb08VuEml5oWGiosa1VdaPZ/A6QyPkAJuwN0Q1lhULOf6B7MtQmHENS743hWtCrgw==",
+      "dev": true,
+      "requires": {
+        "@jridgewell/gen-mapping": "^0.3.0",
+        "@jridgewell/trace-mapping": "^0.3.9"
+      },
+      "dependencies": {
+        "@jridgewell/gen-mapping": {
+          "version": "0.3.2",
+          "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.2.tgz",
+          "integrity": "sha512-mh65xKQAzI6iBcFzwv28KVWSmCkdRBWoOh+bYQGW3+6OZvbbN3TqMGo5hqYxQniRcH9F2VZIoJCm4pa3BPDK/A==",
+          "dev": true,
+          "requires": {
+            "@jridgewell/set-array": "^1.0.1",
+            "@jridgewell/sourcemap-codec": "^1.4.10",
+            "@jridgewell/trace-mapping": "^0.3.9"
+          }
+        }
+      }
+    },
+    "@jridgewell/sourcemap-codec": {
+      "version": "1.4.14",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.14.tgz",
+      "integrity": "sha512-XPSJHWmi394fuUuzDnGz1wiKqWfo1yXecHQMRf2l6hztTO+nPru658AyDngaBe7isIxEkRsPR3FZh+s7iVa4Uw==",
+      "dev": true
+    },
+    "@jridgewell/trace-mapping": {
+      "version": "0.3.18",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.18.tgz",
+      "integrity": "sha512-w+niJYzMHdd7USdiH2U6869nqhD2nbfZXND5Yp93qIbEmnDNk7PD48o+YchRVpzMU7M6jVCbenTR7PA1FLQ9pA==",
+      "dev": true,
+      "requires": {
+        "@jridgewell/resolve-uri": "3.1.0",
+        "@jridgewell/sourcemap-codec": "1.4.14"
+      }
+    },
+    "@leichtgewicht/ip-codec": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@leichtgewicht/ip-codec/-/ip-codec-2.0.4.tgz",
+      "integrity": "sha512-Hcv+nVC0kZnQ3tD9GVu5xSMR4VVYOteQIr/hwFPVEvPdlXqgGEuRjiheChHgdM+JyqdgNcmzZOX/tnl0JOiI7A==",
+      "dev": true
+    },
+    "@node-ipc/js-queue": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@node-ipc/js-queue/-/js-queue-2.0.3.tgz",
+      "integrity": "sha512-fL1wpr8hhD5gT2dA1qifeVaoDFlQR5es8tFuKqjHX+kdOtdNHnxkVZbtIrR2rxnMFvehkjaZRNV2H/gPXlb0hw==",
+      "dev": true,
+      "requires": {
+        "easy-stack": "1.0.1"
+      }
+    },
+    "@nodelib/fs.scandir": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
+      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+      "dev": true,
+      "requires": {
+        "@nodelib/fs.stat": "2.0.5",
+        "run-parallel": "^1.1.9"
+      }
+    },
+    "@nodelib/fs.stat": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
+      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
+      "dev": true
+    },
+    "@nodelib/fs.walk": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+      "dev": true,
+      "requires": {
+        "@nodelib/fs.scandir": "2.1.5",
+        "fastq": "^1.6.0"
+      }
+    },
+    "@polka/url": {
+      "version": "1.0.0-next.21",
+      "resolved": "https://registry.npmjs.org/@polka/url/-/url-1.0.0-next.21.tgz",
+      "integrity": "sha512-a5Sab1C4/icpTZVzZc5Ghpz88yQtGOyNqYXcZgOssB2uuAr+wF/MvN6bgtW32q7HHrvBki+BsZ0OuNv6EV3K9g==",
+      "dev": true
+    },
+    "@popperjs/core": {
+      "version": "2.11.5",
+      "resolved": "https://registry.npmjs.org/@popperjs/core/-/core-2.11.5.tgz",
+      "integrity": "sha512-9X2obfABZuDVLCgPK9aX0a/x4jaOEweTTWE2+9sr0Qqqevj2Uv5XorvusThmc9XGYpS9yI+fhh8RTafBtGposw=="
+    },
+    "@protobufjs/aspromise": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
+      "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ=="
+    },
+    "@protobufjs/base64": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
+      "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg=="
+    },
+    "@protobufjs/codegen": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.4.tgz",
+      "integrity": "sha512-YyFaikqM5sH0ziFZCN3xDC7zeGaB/d0IUb9CATugHWbd1FRFwWwt4ld4OYMPWu5a3Xe01mGAULCdqhMlPl29Jg=="
+    },
+    "@protobufjs/eventemitter": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.0.tgz",
+      "integrity": "sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q=="
+    },
+    "@protobufjs/fetch": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.0.tgz",
+      "integrity": "sha512-lljVXpqXebpsijW71PZaCYeIcE5on1w5DlQy5WH6GLbFryLUrBD4932W/E2BSpfRJWseIL4v/KPgBFxDOIdKpQ==",
+      "requires": {
+        "@protobufjs/aspromise": "^1.1.1",
+        "@protobufjs/inquire": "^1.1.0"
+      }
+    },
+    "@protobufjs/float": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
+      "integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ=="
+    },
+    "@protobufjs/inquire": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.0.tgz",
+      "integrity": "sha512-kdSefcPdruJiFMVSbn801t4vFK7KB/5gd2fYvrxhuJYg8ILrmn9SKSX2tZdV6V+ksulWqS7aXjBcRXl3wHoD9Q=="
+    },
+    "@protobufjs/path": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
+      "integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA=="
+    },
+    "@protobufjs/pool": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
+      "integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw=="
+    },
+    "@protobufjs/utf8": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.0.tgz",
+      "integrity": "sha512-Vvn3zZrhQZkkBE8LSuW3em98c0FwgO4nxzv6OdSxPKJIEKY2bGbHn+mhGIPerzI4twdxaP8/0+06HBpwf345Lw=="
+    },
+    "@rushstack/eslint-patch": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/@rushstack/eslint-patch/-/eslint-patch-1.1.4.tgz",
+      "integrity": "sha512-LwzQKA4vzIct1zNZzBmRKI9QuNpLgTQMEjsQLf3BXuGYb3QPTP4Yjf6mkdX+X1mYttZ808QpOwAzZjv28kq7DA==",
+      "dev": true
+    },
+    "@sideway/address": {
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/@sideway/address/-/address-4.1.4.tgz",
+      "integrity": "sha512-7vwq+rOHVWjyXxVlR76Agnvhy8I9rpzjosTESvmhNeXOXdZZB15Fl+TI9x1SiHZH5Jv2wTGduSxFDIaq0m3DUw==",
+      "dev": true,
+      "requires": {
+        "@hapi/hoek": "^9.0.0"
+      }
+    },
+    "@sideway/formula": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@sideway/formula/-/formula-3.0.1.tgz",
+      "integrity": "sha512-/poHZJJVjx3L+zVD6g9KgHfYnb443oi7wLu/XKojDviHy6HOEOA6z1Trk5aR1dGcmPenJEgb2sK2I80LeS3MIg==",
+      "dev": true
+    },
+    "@sideway/pinpoint": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@sideway/pinpoint/-/pinpoint-2.0.0.tgz",
+      "integrity": "sha512-RNiOoTPkptFtSVzQevY/yWtZwf/RxyVnPy/OcA9HBM3MlGDnBEYL5B41H0MTn0Uec8Hi+2qUtTfG2WWZBmMejQ==",
+      "dev": true
+    },
+    "@sinclair/typebox": {
+      "version": "0.23.5",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.23.5.tgz",
+      "integrity": "sha512-AFBVi/iT4g20DHoujvMH1aEDn8fGJh4xsRGCP6d8RpLPMqsNPvW01Jcn0QysXTsg++/xj25NmJsGyH9xug/wKg==",
+      "dev": true
+    },
+    "@sinonjs/commons": {
+      "version": "1.8.3",
+      "resolved": "https://registry.npmjs.org/@sinonjs/commons/-/commons-1.8.3.tgz",
+      "integrity": "sha512-xkNcLAn/wZaX14RPlwizcKicDk9G3F8m2nU3L7Ukm5zBgTwiT0wsoFAHx9Jq56fJA1z/7uKGtCRu16sOUCLIHQ==",
+      "dev": true,
+      "requires": {
+        "type-detect": "4.0.8"
+      }
+    },
+    "@sinonjs/fake-timers": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-8.1.0.tgz",
+      "integrity": "sha512-OAPJUAtgeINhh/TAlUID4QTs53Njm7xzddaVlEs/SXwgtiD1tW22zAB/W1wdqfrpmikgaWQ9Fw6Ws+hsiRm5Vg==",
+      "dev": true,
+      "requires": {
+        "@sinonjs/commons": "^1.7.0"
+      }
+    },
+    "@soda/friendly-errors-webpack-plugin": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/@soda/friendly-errors-webpack-plugin/-/friendly-errors-webpack-plugin-1.8.1.tgz",
+      "integrity": "sha512-h2ooWqP8XuFqTXT+NyAFbrArzfQA7R6HTezADrvD9Re8fxMLTPPniLdqVTdDaO0eIoLaAwKT+d6w+5GeTk7Vbg==",
+      "dev": true,
+      "requires": {
+        "chalk": "^3.0.0",
+        "error-stack-parser": "^2.0.6",
+        "string-width": "^4.2.3",
+        "strip-ansi": "^6.0.1"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-3.0.0.tgz",
+          "integrity": "sha512-4D3B6Wf41KOYRFdszmDqMCGq5VV/uMAB273JILmO+3jAlh8X4qDtdtgCR3fxtbLEMzSx22QdhnDcJvu2u1fVwg==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "@soda/get-current-script": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@soda/get-current-script/-/get-current-script-1.0.2.tgz",
+      "integrity": "sha512-T7VNNlYVM1SgQ+VsMYhnDkcGmWhQdL0bDyGm5TlQ3GBXnJscEClUUOKduWTmm2zCnvNLC1hc3JpuXjs/nFOc5w==",
+      "dev": true
+    },
+    "@stardazed/streams-polyfill": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@stardazed/streams-polyfill/-/streams-polyfill-2.4.0.tgz",
+      "integrity": "sha512-W6Yg9cA8YT1b9qCQsz/2+kmKt7i/Za2Nj4QOLqdiANzpTiGy5mOyCQNyh0CVpbvXkjCBo2QxrwPvbDlP9u9k+Q=="
+    },
+    "@tootallnate/once": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-1.1.2.tgz",
+      "integrity": "sha512-RbzJvlNzmRq5c3O09UipeuXno4tA1FE6ikOjxZK0tuxVv3412l64l5t1W5pj4+rJq9vpkm/kwiR07aZXnsKPxw==",
+      "dev": true
+    },
+    "@trysound/sax": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/@trysound/sax/-/sax-0.2.0.tgz",
+      "integrity": "sha512-L7z9BgrNEcYyUYtF+HaEfiS5ebkh9jXqbszz7pC0hRBPaatV0XjSD3+eHrpqFemQfgwiFF0QPIarnIihIDn7OA==",
+      "dev": true
+    },
+    "@types/babel__core": {
+      "version": "7.1.19",
+      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.1.19.tgz",
+      "integrity": "sha512-WEOTgRsbYkvA/KCsDwVEGkd7WAr1e3g31VHQ8zy5gul/V1qKullU/BU5I68X5v7V3GnB9eotmom4v5a5gjxorw==",
+      "dev": true,
+      "requires": {
+        "@babel/parser": "^7.1.0",
+        "@babel/types": "^7.0.0",
+        "@types/babel__generator": "*",
+        "@types/babel__template": "*",
+        "@types/babel__traverse": "*"
+      }
+    },
+    "@types/babel__generator": {
+      "version": "7.6.4",
+      "resolved": "https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.6.4.tgz",
+      "integrity": "sha512-tFkciB9j2K755yrTALxD44McOrk+gfpIpvC3sxHjRawj6PfnQxrse4Clq5y/Rq+G3mrBurMax/lG8Qn2t9mSsg==",
+      "dev": true,
+      "requires": {
+        "@babel/types": "^7.0.0"
+      }
+    },
+    "@types/babel__template": {
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/@types/babel__template/-/babel__template-7.4.1.tgz",
+      "integrity": "sha512-azBFKemX6kMg5Io+/rdGT0dkGreboUVR0Cdm3fz9QJWpaQGJRQXl7C+6hOTCZcMll7KFyEQpgbYI2lHdsS4U7g==",
+      "dev": true,
+      "requires": {
+        "@babel/parser": "^7.1.0",
+        "@babel/types": "^7.0.0"
+      }
+    },
+    "@types/babel__traverse": {
+      "version": "7.17.1",
+      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.17.1.tgz",
+      "integrity": "sha512-kVzjari1s2YVi77D3w1yuvohV2idweYXMCDzqBiVNN63TcDWrIlTVOYpqVrvbbyOE/IyzBoTKF0fdnLPEORFxA==",
+      "dev": true,
+      "requires": {
+        "@babel/types": "^7.3.0"
+      }
+    },
+    "@types/body-parser": {
+      "version": "1.19.2",
+      "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.2.tgz",
+      "integrity": "sha512-ALYone6pm6QmwZoAgeyNksccT9Q4AWZQ6PvfwR37GT6r6FWUPguq6sUmNGSMV2Wr761oQoBxwGGa6DR5o1DC9g==",
+      "dev": true,
+      "requires": {
+        "@types/connect": "*",
+        "@types/node": "*"
+      }
+    },
+    "@types/bonjour": {
+      "version": "3.5.10",
+      "resolved": "https://registry.npmjs.org/@types/bonjour/-/bonjour-3.5.10.tgz",
+      "integrity": "sha512-p7ienRMiS41Nu2/igbJxxLDWrSZ0WxM8UQgCeO9KhoVF7cOVFkrKsiDr1EsJIla8vV3oEEjGcz11jc5yimhzZw==",
+      "dev": true,
+      "requires": {
+        "@types/node": "*"
+      }
+    },
+    "@types/connect": {
+      "version": "3.4.35",
+      "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.35.tgz",
+      "integrity": "sha512-cdeYyv4KWoEgpBISTxWvqYsVy444DOqehiF3fM3ne10AmJ62RSyNkUnxMJXHQWRQQX2eR94m5y1IZyDwBjV9FQ==",
+      "dev": true,
+      "requires": {
+        "@types/node": "*"
+      }
+    },
+    "@types/connect-history-api-fallback": {
+      "version": "1.3.5",
+      "resolved": "https://registry.npmjs.org/@types/connect-history-api-fallback/-/connect-history-api-fallback-1.3.5.tgz",
+      "integrity": "sha512-h8QJa8xSb1WD4fpKBDcATDNGXghFj6/3GRWG6dhmRcu0RX1Ubasur2Uvx5aeEwlf0MwblEC2bMzzMQntxnw/Cw==",
+      "dev": true,
+      "requires": {
+        "@types/express-serve-static-core": "*",
+        "@types/node": "*"
+      }
+    },
+    "@types/eslint": {
+      "version": "8.4.3",
+      "resolved": "https://registry.npmjs.org/@types/eslint/-/eslint-8.4.3.tgz",
+      "integrity": "sha512-YP1S7YJRMPs+7KZKDb9G63n8YejIwW9BALq7a5j2+H4yl6iOv9CB29edho+cuFRrvmJbbaH2yiVChKLJVysDGw==",
+      "dev": true,
+      "requires": {
+        "@types/estree": "*",
+        "@types/json-schema": "*"
+      }
+    },
+    "@types/eslint-scope": {
+      "version": "3.7.3",
+      "resolved": "https://registry.npmjs.org/@types/eslint-scope/-/eslint-scope-3.7.3.tgz",
+      "integrity": "sha512-PB3ldyrcnAicT35TWPs5IcwKD8S333HMaa2VVv4+wdvebJkjWuW/xESoB8IwRcog8HYVYamb1g/R31Qv5Bx03g==",
+      "dev": true,
+      "requires": {
+        "@types/eslint": "*",
+        "@types/estree": "*"
+      }
+    },
+    "@types/estree": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.1.tgz",
+      "integrity": "sha512-LG4opVs2ANWZ1TJoKc937iMmNstM/d0ae1vNbnBvBhqCSezgVUOzcLCqbI5elV8Vy6WKwKjaqR+zO9VKirBBCA==",
+      "dev": true
+    },
+    "@types/express": {
+      "version": "4.17.13",
+      "resolved": "https://registry.npmjs.org/@types/express/-/express-4.17.13.tgz",
+      "integrity": "sha512-6bSZTPaTIACxn48l50SR+axgrqm6qXFIxrdAKaG6PaJk3+zuUr35hBlgT7vOmJcum+OEaIBLtHV/qloEAFITeA==",
+      "dev": true,
+      "requires": {
+        "@types/body-parser": "*",
+        "@types/express-serve-static-core": "^4.17.18",
+        "@types/qs": "*",
+        "@types/serve-static": "*"
+      }
+    },
+    "@types/express-serve-static-core": {
+      "version": "4.17.29",
+      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.17.29.tgz",
+      "integrity": "sha512-uMd++6dMKS32EOuw1Uli3e3BPgdLIXmezcfHv7N4c1s3gkhikBplORPpMq3fuWkxncZN1reb16d5n8yhQ80x7Q==",
+      "dev": true,
+      "requires": {
+        "@types/node": "*",
+        "@types/qs": "*",
+        "@types/range-parser": "*"
+      }
+    },
+    "@types/graceful-fs": {
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/@types/graceful-fs/-/graceful-fs-4.1.5.tgz",
+      "integrity": "sha512-anKkLmZZ+xm4p8JWBf4hElkM4XR+EZeA2M9BAkkTldmcyDY4mbdIJnRghDJH3Ov5ooY7/UAoENtmdMSkaAd7Cw==",
+      "dev": true,
+      "requires": {
+        "@types/node": "*"
+      }
+    },
+    "@types/html-minifier-terser": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/@types/html-minifier-terser/-/html-minifier-terser-6.1.0.tgz",
+      "integrity": "sha512-oh/6byDPnL1zeNXFrDXFLyZjkr1MsBG667IM792caf1L2UPOOMf65NFzjUH/ltyfwjAGfs1rsX1eftK0jC/KIg==",
+      "dev": true
+    },
+    "@types/http-proxy": {
+      "version": "1.17.9",
+      "resolved": "https://registry.npmjs.org/@types/http-proxy/-/http-proxy-1.17.9.tgz",
+      "integrity": "sha512-QsbSjA/fSk7xB+UXlCT3wHBy5ai9wOcNDWwZAtud+jXhwOM3l+EYZh8Lng4+/6n8uar0J7xILzqftJdJ/Wdfkw==",
+      "dev": true,
+      "requires": {
+        "@types/node": "*"
+      }
+    },
+    "@types/istanbul-lib-coverage": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.4.tgz",
+      "integrity": "sha512-z/QT1XN4K4KYuslS23k62yDIDLwLFkzxOuMplDtObz0+y7VqJCaO2o+SPwHCvLFZh7xazvvoor2tA/hPz9ee7g==",
+      "dev": true
+    },
+    "@types/istanbul-lib-report": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-report/-/istanbul-lib-report-3.0.0.tgz",
+      "integrity": "sha512-plGgXAPfVKFoYfa9NpYDAkseG+g6Jr294RqeqcqDixSbU34MZVJRi/P+7Y8GDpzkEwLaGZZOpKIEmeVZNtKsrg==",
+      "dev": true,
+      "requires": {
+        "@types/istanbul-lib-coverage": "*"
+      }
+    },
+    "@types/istanbul-reports": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@types/istanbul-reports/-/istanbul-reports-3.0.1.tgz",
+      "integrity": "sha512-c3mAZEuK0lvBp8tmuL74XRKn1+y2dcwOUpH7x4WrF6gk1GIgiluDRgMYQtw2OFcBvAJWlt6ASU3tSqxp0Uu0Aw==",
+      "dev": true,
+      "requires": {
+        "@types/istanbul-lib-report": "*"
+      }
+    },
+    "@types/jest": {
+      "version": "27.5.2",
+      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-27.5.2.tgz",
+      "integrity": "sha512-mpT8LJJ4CMeeahobofYWIjFo0xonRS/HfxnVEPMPFSQdGUt1uHCnoPT7Zhb+sjDU2wz0oKV0OLUR0WzrHNgfeA==",
+      "dev": true,
+      "requires": {
+        "jest-matcher-utils": "^27.0.0",
+        "pretty-format": "^27.0.0"
+      }
+    },
+    "@types/json-schema": {
+      "version": "7.0.11",
+      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.11.tgz",
+      "integrity": "sha512-wOuvG1SN4Us4rez+tylwwwCV1psiNVOkJeM3AUWUNWg/jDQY2+HE/444y5gc+jBmRqASOm2Oeh5c1axHobwRKQ=="
+    },
+    "@types/long": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/long/-/long-4.0.2.tgz",
+      "integrity": "sha512-MqTGEo5bj5t157U6fA/BiDynNkn0YknVdh48CMPkTSpFTVmvao5UQmm7uEF6xBEo7qIMAlY/JSleYaE6VOdpaA=="
+    },
+    "@types/luxon": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@types/luxon/-/luxon-2.4.0.tgz",
+      "integrity": "sha512-oCavjEjRXuR6URJEtQm0eBdfsBiEcGBZbq21of8iGkeKxU1+1xgKuFPClaBZl2KB8ZZBSWlgk61tH6Mf+nvZVw==",
+      "dev": true
+    },
+    "@types/mime": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.2.tgz",
+      "integrity": "sha512-YATxVxgRqNH6nHEIsvg6k2Boc1JHI9ZbH5iWFFv/MTkchz3b1ieGDa5T0a9RznNdI0KhVbdbWSN+KWWrQZRxTw==",
+      "dev": true
+    },
+    "@types/minimist": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@types/minimist/-/minimist-1.2.2.tgz",
+      "integrity": "sha512-jhuKLIRrhvCPLqwPcx6INqmKeiA5EWrsCOPhrlFSrbrmU4ZMPjj5Ul/oLCMDO98XRUIwVm78xICz4EPCektzeQ==",
+      "dev": true
+    },
+    "@types/node": {
+      "version": "18.0.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.0.0.tgz",
+      "integrity": "sha512-cHlGmko4gWLVI27cGJntjs/Sj8th9aYwplmZFwmmgYQQvL5NUsgVJG7OddLvNfLqYS31KFN0s3qlaD9qCaxACA=="
+    },
+    "@types/normalize-package-data": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/@types/normalize-package-data/-/normalize-package-data-2.4.1.tgz",
+      "integrity": "sha512-Gj7cI7z+98M282Tqmp2K5EIsoouUEzbBJhQQzDE3jSIRk6r9gsz0oUokqIUR4u1R3dMHo0pDHM7sNOHyhulypw==",
+      "dev": true
+    },
+    "@types/parse-json": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@types/parse-json/-/parse-json-4.0.0.tgz",
+      "integrity": "sha512-//oorEZjL6sbPcKUaCdIGlIUeH26mgzimjBB77G6XRgnDl/L5wOnpyBGRe/Mmf5CVW3PwEBE1NjiMZ/ssFh4wA==",
+      "dev": true
+    },
+    "@types/pluralize": {
+      "version": "0.0.29",
+      "resolved": "https://registry.npmjs.org/@types/pluralize/-/pluralize-0.0.29.tgz",
+      "integrity": "sha512-BYOID+l2Aco2nBik+iYS4SZX0Lf20KPILP5RGmM1IgzdwNdTs0eebiFriOPcej1sX9mLnSoiNte5zcFxssgpGA==",
+      "dev": true
+    },
+    "@types/prettier": {
+      "version": "2.6.3",
+      "resolved": "https://registry.npmjs.org/@types/prettier/-/prettier-2.6.3.tgz",
+      "integrity": "sha512-ymZk3LEC/fsut+/Q5qejp6R9O1rMxz3XaRHDV6kX8MrGAhOSPqVARbDi+EZvInBpw+BnCX3TD240byVkOfQsHg==",
+      "dev": true
+    },
+    "@types/qs": {
+      "version": "6.9.7",
+      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.9.7.tgz",
+      "integrity": "sha512-FGa1F62FT09qcrueBA6qYTrJPVDzah9a+493+o2PCXsesWHIn27G98TsSMs3WPNbZIEj4+VJf6saSFpvD+3Zsw==",
+      "dev": true
+    },
+    "@types/range-parser": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.4.tgz",
+      "integrity": "sha512-EEhsLsD6UsDM1yFhAvy0Cjr6VwmpMWqFBCb9w07wVugF7w9nfajxLuVmngTIpgS6svCnm6Vaw+MZhoDCKnOfsw==",
+      "dev": true
+    },
+    "@types/retry": {
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@types/retry/-/retry-0.12.0.tgz",
+      "integrity": "sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA==",
+      "dev": true
+    },
+    "@types/serve-index": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/@types/serve-index/-/serve-index-1.9.1.tgz",
+      "integrity": "sha512-d/Hs3nWDxNL2xAczmOVZNj92YZCS6RGxfBPjKzuu/XirCgXdpKEb88dYNbrYGint6IVWLNP+yonwVAuRC0T2Dg==",
+      "dev": true,
+      "requires": {
+        "@types/express": "*"
+      }
+    },
+    "@types/serve-static": {
+      "version": "1.13.10",
+      "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-1.13.10.tgz",
+      "integrity": "sha512-nCkHGI4w7ZgAdNkrEu0bv+4xNV/XDqW+DydknebMOQwkpDGx8G+HTlj7R7ABI8i8nKxVw0wtKPi1D+lPOkh4YQ==",
+      "dev": true,
+      "requires": {
+        "@types/mime": "^1",
+        "@types/node": "*"
+      }
+    },
+    "@types/sockjs": {
+      "version": "0.3.33",
+      "resolved": "https://registry.npmjs.org/@types/sockjs/-/sockjs-0.3.33.tgz",
+      "integrity": "sha512-f0KEEe05NvUnat+boPTZ0dgaLZ4SfSouXUgv5noUiefG2ajgKjmETo9ZJyuqsl7dfl2aHlLJUiki6B4ZYldiiw==",
+      "dev": true,
+      "requires": {
+        "@types/node": "*"
+      }
+    },
+    "@types/stack-utils": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/@types/stack-utils/-/stack-utils-2.0.1.tgz",
+      "integrity": "sha512-Hl219/BT5fLAaz6NDkSuhzasy49dwQS/DSdu4MdggFB8zcXv7vflBI3xp7FEmkmdDkBUI2bPUNeMttp2knYdxw==",
+      "dev": true
+    },
+    "@types/strip-bom": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@types/strip-bom/-/strip-bom-3.0.0.tgz",
+      "integrity": "sha512-xevGOReSYGM7g/kUBZzPqCrR/KYAo+F0yiPc85WFTJa0MSLtyFTVTU6cJu/aV4mid7IffDIWqo69THF2o4JiEQ==",
+      "dev": true,
+      "optional": true,
+      "peer": true
+    },
+    "@types/strip-json-comments": {
+      "version": "0.0.30",
+      "resolved": "https://registry.npmjs.org/@types/strip-json-comments/-/strip-json-comments-0.0.30.tgz",
+      "integrity": "sha512-7NQmHra/JILCd1QqpSzl8+mJRc8ZHz3uDm8YV1Ks9IhK0epEiTw8aIErbvH9PI+6XbqhyIQy3462nEsn7UVzjQ==",
+      "dev": true,
+      "optional": true,
+      "peer": true
+    },
+    "@types/uuid": {
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-9.0.0.tgz",
+      "integrity": "sha512-kr90f+ERiQtKWMz5rP32ltJ/BtULDI5RVO0uavn1HQUOwjx0R1h0rnDYNL0CepF1zL5bSY6FISAfd9tOdDhU5Q==",
+      "dev": true
+    },
+    "@types/webpack-env": {
+      "version": "1.17.0",
+      "resolved": "https://registry.npmjs.org/@types/webpack-env/-/webpack-env-1.17.0.tgz",
+      "integrity": "sha512-eHSaNYEyxRA5IAG0Ym/yCyf86niZUIF/TpWKofQI/CVfh5HsMEUyfE2kwFxha4ow0s5g0LfISQxpDKjbRDrizw==",
+      "dev": true
+    },
+    "@types/ws": {
+      "version": "8.5.3",
+      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.5.3.tgz",
+      "integrity": "sha512-6YOoWjruKj1uLf3INHH7D3qTXwFfEsg1kf3c0uDdSBJwfa/llkwIjrAGV7j7mVgGNbzTQ3HiHKKDXl6bJPD97w==",
+      "dev": true,
+      "requires": {
+        "@types/node": "*"
+      }
+    },
+    "@types/yargs": {
+      "version": "16.0.4",
+      "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-16.0.4.tgz",
+      "integrity": "sha512-T8Yc9wt/5LbJyCaLiHPReJa0kApcIgJ7Bn735GjItUfh08Z1pJvu8QZqb9s+mMvKV6WUQRV7K2R46YbjMXTTJw==",
+      "dev": true,
+      "requires": {
+        "@types/yargs-parser": "*"
+      }
+    },
+    "@types/yargs-parser": {
+      "version": "21.0.0",
+      "resolved": "https://registry.npmjs.org/@types/yargs-parser/-/yargs-parser-21.0.0.tgz",
+      "integrity": "sha512-iO9ZQHkZxHn4mSakYV0vFHAVDyEOIJQrV2uZ06HxEPcx+mt8swXoZHIbaaJ2crJYFfErySgktuTZ3BeLz+XmFA==",
+      "dev": true
+    },
+    "@typescript-eslint/eslint-plugin": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-5.30.0.tgz",
+      "integrity": "sha512-lvhRJ2pGe2V9MEU46ELTdiHgiAFZPKtLhiU5wlnaYpMc2+c1R8fh8i80ZAa665drvjHKUJyRRGg3gEm1If54ow==",
+      "dev": true,
+      "requires": {
+        "@typescript-eslint/scope-manager": "5.30.0",
+        "@typescript-eslint/type-utils": "5.30.0",
+        "@typescript-eslint/utils": "5.30.0",
+        "debug": "^4.3.4",
+        "functional-red-black-tree": "^1.0.1",
+        "ignore": "^5.2.0",
+        "regexpp": "^3.2.0",
+        "semver": "^7.3.7",
+        "tsutils": "^3.21.0"
+      },
+      "dependencies": {
+        "semver": {
+          "version": "7.5.4",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+          "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^6.0.0"
+          }
+        }
+      }
+    },
+    "@typescript-eslint/parser": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-5.30.0.tgz",
+      "integrity": "sha512-2oYYUws5o2liX6SrFQ5RB88+PuRymaM2EU02/9Ppoyu70vllPnHVO7ioxDdq/ypXHA277R04SVjxvwI8HmZpzA==",
+      "dev": true,
+      "requires": {
+        "@typescript-eslint/scope-manager": "5.30.0",
+        "@typescript-eslint/types": "5.30.0",
+        "@typescript-eslint/typescript-estree": "5.30.0",
+        "debug": "^4.3.4"
+      }
+    },
+    "@typescript-eslint/scope-manager": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-5.30.0.tgz",
+      "integrity": "sha512-3TZxvlQcK5fhTBw5solQucWSJvonXf5yua5nx8OqK94hxdrT7/6W3/CS42MLd/f1BmlmmbGEgQcTHHCktUX5bQ==",
+      "dev": true,
+      "requires": {
+        "@typescript-eslint/types": "5.30.0",
+        "@typescript-eslint/visitor-keys": "5.30.0"
+      }
+    },
+    "@typescript-eslint/type-utils": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-5.30.0.tgz",
+      "integrity": "sha512-GF8JZbZqSS+azehzlv/lmQQ3EU3VfWYzCczdZjJRxSEeXDQkqFhCBgFhallLDbPwQOEQ4MHpiPfkjKk7zlmeNg==",
+      "dev": true,
+      "requires": {
+        "@typescript-eslint/utils": "5.30.0",
+        "debug": "^4.3.4",
+        "tsutils": "^3.21.0"
+      }
+    },
+    "@typescript-eslint/types": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-5.30.0.tgz",
+      "integrity": "sha512-vfqcBrsRNWw/LBXyncMF/KrUTYYzzygCSsVqlZ1qGu1QtGs6vMkt3US0VNSQ05grXi5Yadp3qv5XZdYLjpp8ag==",
+      "dev": true
+    },
+    "@typescript-eslint/typescript-estree": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-5.30.0.tgz",
+      "integrity": "sha512-hDEawogreZB4n1zoqcrrtg/wPyyiCxmhPLpZ6kmWfKF5M5G0clRLaEexpuWr31fZ42F96SlD/5xCt1bT5Qm4Nw==",
+      "dev": true,
+      "requires": {
+        "@typescript-eslint/types": "5.30.0",
+        "@typescript-eslint/visitor-keys": "5.30.0",
+        "debug": "^4.3.4",
+        "globby": "^11.1.0",
+        "is-glob": "^4.0.3",
+        "semver": "^7.3.7",
+        "tsutils": "^3.21.0"
+      },
+      "dependencies": {
+        "semver": {
+          "version": "7.5.4",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+          "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^6.0.0"
+          }
+        }
+      }
+    },
+    "@typescript-eslint/utils": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-5.30.0.tgz",
+      "integrity": "sha512-0bIgOgZflLKIcZsWvfklsaQTM3ZUbmtH0rJ1hKyV3raoUYyeZwcjQ8ZUJTzS7KnhNcsVT1Rxs7zeeMHEhGlltw==",
+      "dev": true,
+      "requires": {
+        "@types/json-schema": "^7.0.9",
+        "@typescript-eslint/scope-manager": "5.30.0",
+        "@typescript-eslint/types": "5.30.0",
+        "@typescript-eslint/typescript-estree": "5.30.0",
+        "eslint-scope": "^5.1.1",
+        "eslint-utils": "^3.0.0"
+      }
+    },
+    "@typescript-eslint/visitor-keys": {
+      "version": "5.30.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-5.30.0.tgz",
+      "integrity": "sha512-6WcIeRk2DQ3pHKxU1Ni0qMXJkjO/zLjBymlYBy/53qxe7yjEFSvzKLDToJjURUhSl2Fzhkl4SMXQoETauF74cw==",
+      "dev": true,
+      "requires": {
+        "@typescript-eslint/types": "5.30.0",
+        "eslint-visitor-keys": "^3.3.0"
+      }
+    },
+    "@volar-plugins/vetur": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/@volar-plugins/vetur/-/vetur-0.1.0.tgz",
+      "integrity": "sha512-Qaws7TI8d/kkjihSQrW/3YGqiLeLZ1dMjfxDBe4vJKhzXw82sN4+Wr8NwGf2s15KyVDPQTjkPHv6ukn4vFD9Og==",
+      "dev": true,
+      "requires": {
+        "@volar/vue-language-service-types": "^0.34.0",
+        "vls": "^0.8.0",
+        "vscode-html-languageservice": "^5.0.0",
+        "vscode-uri": "^3.0.3"
+      }
+    },
+    "@volar/vue-language-service-types": {
+      "version": "0.34.17",
+      "resolved": "https://registry.npmjs.org/@volar/vue-language-service-types/-/vue-language-service-types-0.34.17.tgz",
+      "integrity": "sha512-skDO8ZS6Vs0M+zbnYeoBWk7JX8WbCeCohOwnkstqYxXtcqEU4HTeTShhVxrfyWGS0FLHVE79VAhicxjul2EnHw==",
+      "dev": true,
+      "requires": {
+        "vscode-languageserver-protocol": "^3.17.1",
+        "vscode-languageserver-textdocument": "^1.0.4"
+      }
+    },
+    "@vscode/l10n": {
+      "version": "0.0.11",
+      "resolved": "https://registry.npmjs.org/@vscode/l10n/-/l10n-0.0.11.tgz",
+      "integrity": "sha512-ukOMWnCg1tCvT7WnDfsUKQOFDQGsyR5tNgRpwmqi+5/vzU3ghdDXzvIM4IOPdSb3OeSsBNvmSL8nxIVOqi2WXA==",
+      "dev": true
+    },
+    "@vue/babel-helper-vue-jsx-merge-props": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@vue/babel-helper-vue-jsx-merge-props/-/babel-helper-vue-jsx-merge-props-1.2.1.tgz",
+      "integrity": "sha512-QOi5OW45e2R20VygMSNhyQHvpdUwQZqGPc748JLGCYEy+yp8fNFNdbNIGAgZmi9e+2JHPd6i6idRuqivyicIkA==",
+      "dev": true
+    },
+    "@vue/babel-helper-vue-transform-on": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@vue/babel-helper-vue-transform-on/-/babel-helper-vue-transform-on-1.0.2.tgz",
+      "integrity": "sha512-hz4R8tS5jMn8lDq6iD+yWL6XNB699pGIVLk7WSJnn1dbpjaazsjZQkieJoRX6gW5zpYSCFqQ7jUquPNY65tQYA==",
+      "dev": true
+    },
+    "@vue/babel-plugin-jsx": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@vue/babel-plugin-jsx/-/babel-plugin-jsx-1.1.1.tgz",
+      "integrity": "sha512-j2uVfZjnB5+zkcbc/zsOc0fSNGCMMjaEXP52wdwdIfn0qjFfEYpYZBFKFg+HHnQeJCVrjOeO0YxgaL7DMrym9w==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-module-imports": "^7.0.0",
+        "@babel/plugin-syntax-jsx": "^7.0.0",
+        "@babel/template": "^7.0.0",
+        "@babel/traverse": "^7.0.0",
+        "@babel/types": "^7.0.0",
+        "@vue/babel-helper-vue-transform-on": "^1.0.2",
+        "camelcase": "^6.0.0",
+        "html-tags": "^3.1.0",
+        "svg-tags": "^1.0.0"
+      }
+    },
+    "@vue/babel-plugin-transform-vue-jsx": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@vue/babel-plugin-transform-vue-jsx/-/babel-plugin-transform-vue-jsx-1.2.1.tgz",
+      "integrity": "sha512-HJuqwACYehQwh1fNT8f4kyzqlNMpBuUK4rSiSES5D4QsYncv5fxFsLyrxFPG2ksO7t5WP+Vgix6tt6yKClwPzA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-module-imports": "^7.0.0",
+        "@babel/plugin-syntax-jsx": "^7.2.0",
+        "@vue/babel-helper-vue-jsx-merge-props": "^1.2.1",
+        "html-tags": "^2.0.0",
+        "lodash.kebabcase": "^4.1.1",
+        "svg-tags": "^1.0.0"
+      },
+      "dependencies": {
+        "html-tags": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/html-tags/-/html-tags-2.0.0.tgz",
+          "integrity": "sha512-+Il6N8cCo2wB/Vd3gqy/8TZhTD3QvcVeQLCnZiGkGCH3JP28IgGAY41giccp2W4R3jfyJPAP318FQTa1yU7K7g==",
+          "dev": true
+        }
+      }
+    },
+    "@vue/babel-preset-app": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/babel-preset-app/-/babel-preset-app-5.0.6.tgz",
+      "integrity": "sha512-hoVr5M5RIvAL8F6MX8ZG0RvjA7MB7eDOkykK+M+qThkkrsAvlianzygnE86xN1N7JVSq7kGOyZk0Te+L20KqeQ==",
+      "dev": true,
+      "requires": {
+        "@babel/core": "^7.12.16",
+        "@babel/helper-compilation-targets": "^7.12.16",
+        "@babel/helper-module-imports": "^7.12.13",
+        "@babel/plugin-proposal-class-properties": "^7.12.13",
+        "@babel/plugin-proposal-decorators": "^7.12.13",
+        "@babel/plugin-syntax-dynamic-import": "^7.8.3",
+        "@babel/plugin-syntax-jsx": "^7.12.13",
+        "@babel/plugin-transform-runtime": "^7.12.15",
+        "@babel/preset-env": "^7.12.16",
+        "@babel/runtime": "^7.12.13",
+        "@vue/babel-plugin-jsx": "^1.0.3",
+        "@vue/babel-preset-jsx": "^1.1.2",
+        "babel-plugin-dynamic-import-node": "^2.3.3",
+        "core-js": "^3.8.3",
+        "core-js-compat": "^3.8.3",
+        "semver": "^7.3.4"
+      },
+      "dependencies": {
+        "semver": {
+          "version": "7.5.4",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+          "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^6.0.0"
+          }
+        }
+      }
+    },
+    "@vue/babel-preset-jsx": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@vue/babel-preset-jsx/-/babel-preset-jsx-1.2.4.tgz",
+      "integrity": "sha512-oRVnmN2a77bYDJzeGSt92AuHXbkIxbf/XXSE3klINnh9AXBmVS1DGa1f0d+dDYpLfsAKElMnqKTQfKn7obcL4w==",
+      "dev": true,
+      "requires": {
+        "@vue/babel-helper-vue-jsx-merge-props": "^1.2.1",
+        "@vue/babel-plugin-transform-vue-jsx": "^1.2.1",
+        "@vue/babel-sugar-composition-api-inject-h": "^1.2.1",
+        "@vue/babel-sugar-composition-api-render-instance": "^1.2.4",
+        "@vue/babel-sugar-functional-vue": "^1.2.2",
+        "@vue/babel-sugar-inject-h": "^1.2.2",
+        "@vue/babel-sugar-v-model": "^1.2.3",
+        "@vue/babel-sugar-v-on": "^1.2.3"
+      }
+    },
+    "@vue/babel-sugar-composition-api-inject-h": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@vue/babel-sugar-composition-api-inject-h/-/babel-sugar-composition-api-inject-h-1.2.1.tgz",
+      "integrity": "sha512-4B3L5Z2G+7s+9Bwbf+zPIifkFNcKth7fQwekVbnOA3cr3Pq71q71goWr97sk4/yyzH8phfe5ODVzEjX7HU7ItQ==",
+      "dev": true,
+      "requires": {
+        "@babel/plugin-syntax-jsx": "^7.2.0"
+      }
+    },
+    "@vue/babel-sugar-composition-api-render-instance": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/@vue/babel-sugar-composition-api-render-instance/-/babel-sugar-composition-api-render-instance-1.2.4.tgz",
+      "integrity": "sha512-joha4PZznQMsxQYXtR3MnTgCASC9u3zt9KfBxIeuI5g2gscpTsSKRDzWQt4aqNIpx6cv8On7/m6zmmovlNsG7Q==",
+      "dev": true,
+      "requires": {
+        "@babel/plugin-syntax-jsx": "^7.2.0"
+      }
+    },
+    "@vue/babel-sugar-functional-vue": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@vue/babel-sugar-functional-vue/-/babel-sugar-functional-vue-1.2.2.tgz",
+      "integrity": "sha512-JvbgGn1bjCLByIAU1VOoepHQ1vFsroSA/QkzdiSs657V79q6OwEWLCQtQnEXD/rLTA8rRit4rMOhFpbjRFm82w==",
+      "dev": true,
+      "requires": {
+        "@babel/plugin-syntax-jsx": "^7.2.0"
+      }
+    },
+    "@vue/babel-sugar-inject-h": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/@vue/babel-sugar-inject-h/-/babel-sugar-inject-h-1.2.2.tgz",
+      "integrity": "sha512-y8vTo00oRkzQTgufeotjCLPAvlhnpSkcHFEp60+LJUwygGcd5Chrpn5480AQp/thrxVm8m2ifAk0LyFel9oCnw==",
+      "dev": true,
+      "requires": {
+        "@babel/plugin-syntax-jsx": "^7.2.0"
+      }
+    },
+    "@vue/babel-sugar-v-model": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@vue/babel-sugar-v-model/-/babel-sugar-v-model-1.2.3.tgz",
+      "integrity": "sha512-A2jxx87mySr/ulAsSSyYE8un6SIH0NWHiLaCWpodPCVOlQVODCaSpiR4+IMsmBr73haG+oeCuSvMOM+ttWUqRQ==",
+      "dev": true,
+      "requires": {
+        "@babel/plugin-syntax-jsx": "^7.2.0",
+        "@vue/babel-helper-vue-jsx-merge-props": "^1.2.1",
+        "@vue/babel-plugin-transform-vue-jsx": "^1.2.1",
+        "camelcase": "^5.0.0",
+        "html-tags": "^2.0.0",
+        "svg-tags": "^1.0.0"
+      },
+      "dependencies": {
+        "camelcase": {
+          "version": "5.3.1",
+          "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
+          "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
+          "dev": true
+        },
+        "html-tags": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/html-tags/-/html-tags-2.0.0.tgz",
+          "integrity": "sha512-+Il6N8cCo2wB/Vd3gqy/8TZhTD3QvcVeQLCnZiGkGCH3JP28IgGAY41giccp2W4R3jfyJPAP318FQTa1yU7K7g==",
+          "dev": true
+        }
+      }
+    },
+    "@vue/babel-sugar-v-on": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@vue/babel-sugar-v-on/-/babel-sugar-v-on-1.2.3.tgz",
+      "integrity": "sha512-kt12VJdz/37D3N3eglBywV8GStKNUhNrsxChXIV+o0MwVXORYuhDTHJRKPgLJRb/EY3vM2aRFQdxJBp9CLikjw==",
+      "dev": true,
+      "requires": {
+        "@babel/plugin-syntax-jsx": "^7.2.0",
+        "@vue/babel-plugin-transform-vue-jsx": "^1.2.1",
+        "camelcase": "^5.0.0"
+      },
+      "dependencies": {
+        "camelcase": {
+          "version": "5.3.1",
+          "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
+          "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
+          "dev": true
+        }
+      }
+    },
+    "@vue/cli-overlay": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-overlay/-/cli-overlay-5.0.6.tgz",
+      "integrity": "sha512-rghCRMPVQ4FIKmQy8ipn8fKztdaQSQTktAKob2SGuEL/iBWfclSMAQCXfj908nyzOBymo+q/Sn/oiLhi07oHlA==",
+      "dev": true
+    },
+    "@vue/cli-plugin-babel": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-babel/-/cli-plugin-babel-5.0.6.tgz",
+      "integrity": "sha512-ruQhfhj2WM6Fe/VDQneQc/kqNp/p138SjQMfz7q/rxMTMG1kpV5B0jYWschXHXLQ6aDsFnqmBmIK+XjU3XTF3g==",
+      "dev": true,
+      "requires": {
+        "@babel/core": "^7.12.16",
+        "@vue/babel-preset-app": "^5.0.6",
+        "@vue/cli-shared-utils": "^5.0.6",
+        "babel-loader": "^8.2.2",
+        "thread-loader": "^3.0.0",
+        "webpack": "^5.54.0"
+      }
+    },
+    "@vue/cli-plugin-eslint": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-eslint/-/cli-plugin-eslint-5.0.6.tgz",
+      "integrity": "sha512-fuc8w2IujzoenA/cdr/QYYMq2yaI1fYr0Fqom/M55B+DmW19GIuIRxYQvh0CEeCbFB2hAl3Flrazfx96/nAaQA==",
+      "dev": true,
+      "requires": {
+        "@vue/cli-shared-utils": "^5.0.6",
+        "eslint-webpack-plugin": "^3.1.0",
+        "globby": "^11.0.2",
+        "webpack": "^5.54.0",
+        "yorkie": "^2.0.0"
+      }
+    },
+    "@vue/cli-plugin-router": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-router/-/cli-plugin-router-5.0.6.tgz",
+      "integrity": "sha512-5ikUdfsSoKqpBhB5GhGYijH6mJnU+ZGqDv3QBf0brDeeh7PhClntxNAOLkB73c+LNxjBrlNCTkItuByF+AD29w==",
+      "dev": true,
+      "requires": {
+        "@vue/cli-shared-utils": "^5.0.6"
+      }
+    },
+    "@vue/cli-plugin-typescript": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-typescript/-/cli-plugin-typescript-5.0.6.tgz",
+      "integrity": "sha512-DKw3SZEWs+9v6oUMTJAGcmJY4XCIdLhwXU1MsXDmhea/VqoGTcY9yl1mb/QfZ3AttdRtC7n4Vk01tGa0pnewsA==",
+      "dev": true,
+      "requires": {
+        "@babel/core": "^7.12.16",
+        "@types/webpack-env": "^1.15.2",
+        "@vue/cli-shared-utils": "^5.0.6",
+        "babel-loader": "^8.2.2",
+        "fork-ts-checker-webpack-plugin": "^6.4.0",
+        "globby": "^11.0.2",
+        "thread-loader": "^3.0.0",
+        "ts-loader": "^9.2.5",
+        "webpack": "^5.54.0"
+      }
+    },
+    "@vue/cli-plugin-unit-jest": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-unit-jest/-/cli-plugin-unit-jest-5.0.6.tgz",
+      "integrity": "sha512-PZ2/q4bo7UWKI2CXNomGrutJTPD+LHZWlz4QQ5uTTLSvrvWxZaULuMItIrTIZPUfDTnl98LpyTLRzNAhZBr63A==",
+      "dev": true,
+      "requires": {
+        "@babel/core": "^7.12.16",
+        "@babel/plugin-transform-modules-commonjs": "^7.15.0",
+        "@types/jest": "^27.0.1",
+        "@vue/cli-shared-utils": "^5.0.6",
+        "babel-jest": "^27.1.0",
+        "deepmerge": "^4.2.2",
+        "jest": "^27.1.0",
+        "jest-serializer-vue": "^2.0.2",
+        "jest-transform-stub": "^2.0.0",
+        "jest-watch-typeahead": "^1.0.0"
+      },
+      "dependencies": {
+        "deepmerge": {
+          "version": "4.2.2",
+          "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.2.2.tgz",
+          "integrity": "sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==",
+          "dev": true
+        }
+      }
+    },
+    "@vue/cli-plugin-vuex": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-plugin-vuex/-/cli-plugin-vuex-5.0.6.tgz",
+      "integrity": "sha512-9bwkaLxGqqrD5FPN7iNsIe5x60P0nScioMQvHf2ZIIoFAiM5yuTgOQkdSKGBhn0YG4IjYd1tnlVY4Q/P4ZHaTA==",
+      "dev": true,
+      "requires": {}
+    },
+    "@vue/cli-service": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-service/-/cli-service-5.0.6.tgz",
+      "integrity": "sha512-XSiTCjUMk8adjvQIJXBxk3ltEBLyBme8rpqdhJrpgCgSj+8pcPPyYKs1M0petkhwLMv3mEXVPNQmXKFzpdWVrw==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-compilation-targets": "^7.12.16",
+        "@soda/friendly-errors-webpack-plugin": "^1.8.0",
+        "@soda/get-current-script": "^1.0.2",
+        "@types/minimist": "^1.2.0",
+        "@vue/cli-overlay": "^5.0.6",
+        "@vue/cli-plugin-router": "^5.0.6",
+        "@vue/cli-plugin-vuex": "^5.0.6",
+        "@vue/cli-shared-utils": "^5.0.6",
+        "@vue/component-compiler-utils": "^3.3.0",
+        "@vue/vue-loader-v15": "npm:vue-loader@^15.9.7",
+        "@vue/web-component-wrapper": "^1.3.0",
+        "acorn": "^8.0.5",
+        "acorn-walk": "^8.0.2",
+        "address": "^1.1.2",
+        "autoprefixer": "^10.2.4",
+        "browserslist": "^4.16.3",
+        "case-sensitive-paths-webpack-plugin": "^2.3.0",
+        "cli-highlight": "^2.1.10",
+        "clipboardy": "^2.3.0",
+        "cliui": "^7.0.4",
+        "copy-webpack-plugin": "^9.0.1",
+        "css-loader": "^6.5.0",
+        "css-minimizer-webpack-plugin": "^3.0.2",
+        "cssnano": "^5.0.0",
+        "debug": "^4.1.1",
+        "default-gateway": "^6.0.3",
+        "dotenv": "^10.0.0",
+        "dotenv-expand": "^5.1.0",
+        "fs-extra": "^9.1.0",
+        "globby": "^11.0.2",
+        "hash-sum": "^2.0.0",
+        "html-webpack-plugin": "^5.1.0",
+        "is-file-esm": "^1.0.0",
+        "launch-editor-middleware": "^2.2.1",
+        "lodash.defaultsdeep": "^4.6.1",
+        "lodash.mapvalues": "^4.6.0",
+        "mini-css-extract-plugin": "^2.5.3",
+        "minimist": "^1.2.5",
+        "module-alias": "^2.2.2",
+        "portfinder": "^1.0.26",
+        "postcss": "^8.2.6",
+        "postcss-loader": "^6.1.1",
+        "progress-webpack-plugin": "^1.0.12",
+        "ssri": "^8.0.1",
+        "terser-webpack-plugin": "^5.1.1",
+        "thread-loader": "^3.0.0",
+        "vue-loader": "^17.0.0",
+        "vue-style-loader": "^4.1.3",
+        "webpack": "^5.54.0",
+        "webpack-bundle-analyzer": "^4.4.0",
+        "webpack-chain": "^6.5.1",
+        "webpack-dev-server": "^4.7.3",
+        "webpack-merge": "^5.7.3",
+        "webpack-virtual-modules": "^0.4.2",
+        "whatwg-fetch": "^3.6.2"
+      }
+    },
+    "@vue/cli-shared-utils": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/@vue/cli-shared-utils/-/cli-shared-utils-5.0.6.tgz",
+      "integrity": "sha512-5HmlRtMByOCFO0P3mMUx8dVruTRhZ3pqQ0f1cCH9TmAoDjetmD/Ib7yx/5KxTHV8QY3xZJxYvgAmOU5C49K5xA==",
+      "dev": true,
+      "requires": {
+        "@achrinza/node-ipc": "^9.2.5",
+        "chalk": "^4.1.2",
+        "execa": "^1.0.0",
+        "joi": "^17.4.0",
+        "launch-editor": "^2.2.1",
+        "lru-cache": "^6.0.0",
+        "node-fetch": "^2.6.7",
+        "open": "^8.0.2",
+        "ora": "^5.3.0",
+        "read-pkg": "^5.1.1",
+        "semver": "^7.3.4",
+        "strip-ansi": "^6.0.0"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "semver": {
+          "version": "7.5.4",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+          "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^6.0.0"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "@vue/compiler-core": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.2.37.tgz",
+      "integrity": "sha512-81KhEjo7YAOh0vQJoSmAD68wLfYqJvoiD4ulyedzF+OEk/bk6/hx3fTNVfuzugIIaTrOx4PGx6pAiBRe5e9Zmg==",
+      "requires": {
+        "@babel/parser": "^7.16.4",
+        "@vue/shared": "3.2.37",
+        "estree-walker": "^2.0.2",
+        "source-map": "^0.6.1"
+      }
+    },
+    "@vue/compiler-dom": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-dom/-/compiler-dom-3.2.37.tgz",
+      "integrity": "sha512-yxJLH167fucHKxaqXpYk7x8z7mMEnXOw3G2q62FTkmsvNxu4FQSu5+3UMb+L7fjKa26DEzhrmCxAgFLLIzVfqQ==",
+      "requires": {
+        "@vue/compiler-core": "3.2.37",
+        "@vue/shared": "3.2.37"
+      }
+    },
+    "@vue/compiler-sfc": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-3.2.37.tgz",
+      "integrity": "sha512-+7i/2+9LYlpqDv+KTtWhOZH+pa8/HnX/905MdVmAcI/mPQOBwkHHIzrsEsucyOIZQYMkXUiTkmZq5am/NyXKkg==",
+      "requires": {
+        "@babel/parser": "^7.16.4",
+        "@vue/compiler-core": "3.2.37",
+        "@vue/compiler-dom": "3.2.37",
+        "@vue/compiler-ssr": "3.2.37",
+        "@vue/reactivity-transform": "3.2.37",
+        "@vue/shared": "3.2.37",
+        "estree-walker": "^2.0.2",
+        "magic-string": "^0.25.7",
+        "postcss": "^8.1.10",
+        "source-map": "^0.6.1"
+      }
+    },
+    "@vue/compiler-ssr": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/compiler-ssr/-/compiler-ssr-3.2.37.tgz",
+      "integrity": "sha512-7mQJD7HdXxQjktmsWp/J67lThEIcxLemz1Vb5I6rYJHR5vI+lON3nPGOH3ubmbvYGt8xEUaAr1j7/tIFWiEOqw==",
+      "requires": {
+        "@vue/compiler-dom": "3.2.37",
+        "@vue/shared": "3.2.37"
+      }
+    },
+    "@vue/component-compiler-utils": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@vue/component-compiler-utils/-/component-compiler-utils-3.3.0.tgz",
+      "integrity": "sha512-97sfH2mYNU+2PzGrmK2haqffDpVASuib9/w2/noxiFi31Z54hW+q3izKQXXQZSNhtiUpAI36uSuYepeBe4wpHQ==",
+      "dev": true,
+      "requires": {
+        "consolidate": "^0.15.1",
+        "hash-sum": "^1.0.2",
+        "lru-cache": "^4.1.2",
+        "merge-source-map": "^1.1.0",
+        "postcss": "^7.0.36",
+        "postcss-selector-parser": "^6.0.2",
+        "prettier": "^1.18.2 || ^2.0.0",
+        "source-map": "~0.6.1",
+        "vue-template-es2015-compiler": "^1.9.0"
+      },
+      "dependencies": {
+        "hash-sum": {
+          "version": "1.0.2",
+          "resolved": "https://registry.npmjs.org/hash-sum/-/hash-sum-1.0.2.tgz",
+          "integrity": "sha512-fUs4B4L+mlt8/XAtSOGMUO1TXmAelItBPtJG7CyHJfYTdDjwisntGO2JQz7oUsatOY9o68+57eziUVNw/mRHmA==",
+          "dev": true
+        },
+        "lru-cache": {
+          "version": "4.1.5",
+          "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-4.1.5.tgz",
+          "integrity": "sha512-sWZlbEP2OsHNkXrMl5GYk/jKk70MBng6UU4YI/qGDYbgf6YbP4EvmqISbXCoJiRKs+1bSpFHVgQxvJ17F2li5g==",
+          "dev": true,
+          "requires": {
+            "pseudomap": "^1.0.2",
+            "yallist": "^2.1.2"
+          }
+        },
+        "picocolors": {
+          "version": "0.2.1",
+          "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-0.2.1.tgz",
+          "integrity": "sha512-cMlDqaLEqfSaW8Z7N5Jw+lyIW869EzT73/F5lhtY9cLGoVxSXznfgfXMO0Z5K0o0Q2TkTXq+0KFsdnSe3jDViA==",
+          "dev": true
+        },
+        "postcss": {
+          "version": "7.0.39",
+          "resolved": "https://registry.npmjs.org/postcss/-/postcss-7.0.39.tgz",
+          "integrity": "sha512-yioayjNbHn6z1/Bywyb2Y4s3yvDAeXGOyxqD+LnVOinq6Mdmd++SW2wUNVzavyyHxd6+DxzWGIuosg6P1Rj8uA==",
+          "dev": true,
+          "requires": {
+            "picocolors": "^0.2.1",
+            "source-map": "^0.6.1"
+          }
+        },
+        "yallist": {
+          "version": "2.1.2",
+          "resolved": "https://registry.npmjs.org/yallist/-/yallist-2.1.2.tgz",
+          "integrity": "sha512-ncTzHV7NvsQZkYe1DW7cbDLm0YpzHmZF5r/iyP3ZnQtMiJ+pjzisCiMNI+Sj+xQF5pXhSHxSB3uDbsBTzY/c2A==",
+          "dev": true
+        }
+      }
+    },
+    "@vue/devtools-api": {
+      "version": "6.1.4",
+      "resolved": "https://registry.npmjs.org/@vue/devtools-api/-/devtools-api-6.1.4.tgz",
+      "integrity": "sha512-IiA0SvDrJEgXvVxjNkHPFfDx6SXw0b/TUkqMcDZWNg9fnCAHbTpoo59YfJ9QLFkwa3raau5vSlRVzMSLDnfdtQ=="
+    },
+    "@vue/eslint-config-typescript": {
+      "version": "11.0.0",
+      "resolved": "https://registry.npmjs.org/@vue/eslint-config-typescript/-/eslint-config-typescript-11.0.0.tgz",
+      "integrity": "sha512-txuRzxnQVmtUvvy9UyWUy9sHWXNeRPGmSPqP53hRtaiUeCTAondI9Ho9GQYI/8/eWljYOST7iA4Aa8sANBkWaA==",
+      "dev": true,
+      "requires": {
+        "@typescript-eslint/eslint-plugin": "^5.0.0",
+        "@typescript-eslint/parser": "^5.0.0",
+        "vue-eslint-parser": "^9.0.0"
+      }
+    },
+    "@vue/reactivity": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.2.37.tgz",
+      "integrity": "sha512-/7WRafBOshOc6m3F7plwzPeCu/RCVv9uMpOwa/5PiY1Zz+WLVRWiy0MYKwmg19KBdGtFWsmZ4cD+LOdVPcs52A==",
+      "requires": {
+        "@vue/shared": "3.2.37"
+      }
+    },
+    "@vue/reactivity-transform": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/reactivity-transform/-/reactivity-transform-3.2.37.tgz",
+      "integrity": "sha512-IWopkKEb+8qpu/1eMKVeXrK0NLw9HicGviJzhJDEyfxTR9e1WtpnnbYkJWurX6WwoFP0sz10xQg8yL8lgskAZg==",
+      "requires": {
+        "@babel/parser": "^7.16.4",
+        "@vue/compiler-core": "3.2.37",
+        "@vue/shared": "3.2.37",
+        "estree-walker": "^2.0.2",
+        "magic-string": "^0.25.7"
+      }
+    },
+    "@vue/runtime-core": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/runtime-core/-/runtime-core-3.2.37.tgz",
+      "integrity": "sha512-JPcd9kFyEdXLl/i0ClS7lwgcs0QpUAWj+SKX2ZC3ANKi1U4DOtiEr6cRqFXsPwY5u1L9fAjkinIdB8Rz3FoYNQ==",
+      "requires": {
+        "@vue/reactivity": "3.2.37",
+        "@vue/shared": "3.2.37"
+      }
+    },
+    "@vue/runtime-dom": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/runtime-dom/-/runtime-dom-3.2.37.tgz",
+      "integrity": "sha512-HimKdh9BepShW6YozwRKAYjYQWg9mQn63RGEiSswMbW+ssIht1MILYlVGkAGGQbkhSh31PCdoUcfiu4apXJoPw==",
+      "requires": {
+        "@vue/runtime-core": "3.2.37",
+        "@vue/shared": "3.2.37",
+        "csstype": "^2.6.8"
+      }
+    },
+    "@vue/server-renderer": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/server-renderer/-/server-renderer-3.2.37.tgz",
+      "integrity": "sha512-kLITEJvaYgZQ2h47hIzPh2K3jG8c1zCVbp/o/bzQOyvzaKiCquKS7AaioPI28GNxIsE/zSx+EwWYsNxDCX95MA==",
+      "requires": {
+        "@vue/compiler-ssr": "3.2.37",
+        "@vue/shared": "3.2.37"
+      }
+    },
+    "@vue/shared": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/@vue/shared/-/shared-3.2.37.tgz",
+      "integrity": "sha512-4rSJemR2NQIo9Klm1vabqWjD8rs/ZaJSzMxkMNeJS6lHiUjjUeYFbooN19NgFjztubEKh3WlZUeOLVdbbUWHsw=="
+    },
+    "@vue/test-utils": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@vue/test-utils/-/test-utils-2.0.0.tgz",
+      "integrity": "sha512-zL5kygNq7hONrO1CzaUGprEAklAX+pH8J1MPMCU3Rd2xtSYkZ+PmKU3oEDRg8VAGdL5lNJHzDgrud5amFPtirw==",
+      "dev": true,
+      "requires": {}
+    },
+    "@vue/vue-loader-v15": {
+      "version": "npm:vue-loader@15.9.8",
+      "resolved": "https://registry.npmjs.org/vue-loader/-/vue-loader-15.9.8.tgz",
+      "integrity": "sha512-GwSkxPrihfLR69/dSV3+5CdMQ0D+jXg8Ma1S4nQXKJAznYFX14vHdc/NetQc34Dw+rBbIJyP7JOuVb9Fhprvog==",
+      "dev": true,
+      "requires": {
+        "@vue/component-compiler-utils": "^3.1.0",
+        "hash-sum": "^1.0.2",
+        "loader-utils": "^1.1.0",
+        "vue-hot-reload-api": "^2.3.0",
+        "vue-style-loader": "^4.1.0"
+      },
+      "dependencies": {
+        "hash-sum": {
+          "version": "1.0.2",
+          "resolved": "https://registry.npmjs.org/hash-sum/-/hash-sum-1.0.2.tgz",
+          "integrity": "sha512-fUs4B4L+mlt8/XAtSOGMUO1TXmAelItBPtJG7CyHJfYTdDjwisntGO2JQz7oUsatOY9o68+57eziUVNw/mRHmA==",
+          "dev": true
+        }
+      }
+    },
+    "@vue/vue3-jest": {
+      "version": "27.0.0",
+      "resolved": "https://registry.npmjs.org/@vue/vue3-jest/-/vue3-jest-27.0.0.tgz",
+      "integrity": "sha512-VL61CgZBoQqayXfzlZJHHpZuX4lsT8dmdZMJzADhdAJjKu26JBpypHr/2ppevxItljPiuALQW4MKhhCXZRXnLg==",
+      "dev": true,
+      "optional": true,
+      "peer": true,
+      "requires": {
+        "@babel/plugin-transform-modules-commonjs": "^7.2.0",
+        "chalk": "^2.1.0",
+        "convert-source-map": "^1.6.0",
+        "css-tree": "^2.0.1",
+        "source-map": "0.5.6",
+        "tsconfig": "^7.0.0"
+      },
+      "dependencies": {
+        "css-tree": {
+          "version": "2.1.0",
+          "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-2.1.0.tgz",
+          "integrity": "sha512-PcysZRzToBbrpoUrZ9qfblRIRf8zbEAkU0AIpQFtgkFK0vSbzOmBCvdSAx2Zg7Xx5wiYJKUKk0NMP7kxevie/A==",
+          "dev": true,
+          "optional": true,
+          "peer": true,
+          "requires": {
+            "mdn-data": "2.0.27",
+            "source-map-js": "^1.0.1"
+          }
+        },
+        "mdn-data": {
+          "version": "2.0.27",
+          "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.0.27.tgz",
+          "integrity": "sha512-kwqO0I0jtWr25KcfLm9pia8vLZ8qoAKhWZuZMbneJq3jjBD3gl5nZs8l8Tu3ZBlBAHVQtDur9rdDGyvtfVraHQ==",
+          "dev": true,
+          "optional": true,
+          "peer": true
+        },
+        "source-map": {
+          "version": "0.5.6",
+          "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.6.tgz",
+          "integrity": "sha512-MjZkVp0NHr5+TPihLcadqnlVoGIoWo4IBHptutGh9wI3ttUYvCG26HkSuDi+K6lsZ25syXJXcctwgyVCt//xqA==",
+          "dev": true,
+          "optional": true,
+          "peer": true
+        }
+      }
+    },
+    "@vue/web-component-wrapper": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@vue/web-component-wrapper/-/web-component-wrapper-1.3.0.tgz",
+      "integrity": "sha512-Iu8Tbg3f+emIIMmI2ycSI8QcEuAUgPTgHwesDU1eKMLE4YC/c/sFbGc70QgMq31ijRftV0R7vCm9co6rldCeOA==",
+      "dev": true
+    },
+    "@webassemblyjs/ast": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/ast/-/ast-1.11.6.tgz",
+      "integrity": "sha512-IN1xI7PwOvLPgjcf180gC1bqn3q/QaOCwYUahIOhbYUu8KA/3tw2RT/T0Gidi1l7Hhj5D/INhJxiICObqpMu4Q==",
+      "dev": true,
+      "requires": {
+        "@webassemblyjs/helper-numbers": "1.11.6",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6"
+      }
+    },
+    "@webassemblyjs/floating-point-hex-parser": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.11.6.tgz",
+      "integrity": "sha512-ejAj9hfRJ2XMsNHk/v6Fu2dGS+i4UaXBXGemOfQ/JfQ6mdQg/WXtwleQRLLS4OvfDhv8rYnVwH27YJLMyYsxhw==",
+      "dev": true
+    },
+    "@webassemblyjs/helper-api-error": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-api-error/-/helper-api-error-1.11.6.tgz",
+      "integrity": "sha512-o0YkoP4pVu4rN8aTJgAyj9hC2Sv5UlkzCHhxqWj8butaLvnpdc2jOwh4ewE6CX0txSfLn/UYaV/pheS2Txg//Q==",
+      "dev": true
+    },
+    "@webassemblyjs/helper-buffer": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-buffer/-/helper-buffer-1.11.6.tgz",
+      "integrity": "sha512-z3nFzdcp1mb8nEOFFk8DrYLpHvhKC3grJD2ardfKOzmbmJvEf/tPIqCY+sNcwZIY8ZD7IkB2l7/pqhUhqm7hLA==",
+      "dev": true
+    },
+    "@webassemblyjs/helper-numbers": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-numbers/-/helper-numbers-1.11.6.tgz",
+      "integrity": "sha512-vUIhZ8LZoIWHBohiEObxVm6hwP034jwmc9kuq5GdHZH0wiLVLIPcMCdpJzG4C11cHoQ25TFIQj9kaVADVX7N3g==",
+      "dev": true,
+      "requires": {
+        "@webassemblyjs/floating-point-hex-parser": "1.11.6",
+        "@webassemblyjs/helper-api-error": "1.11.6",
+        "@xtuc/long": "4.2.2"
+      }
+    },
+    "@webassemblyjs/helper-wasm-bytecode": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.11.6.tgz",
+      "integrity": "sha512-sFFHKwcmBprO9e7Icf0+gddyWYDViL8bpPjJJl0WHxCdETktXdmtWLGVzoHbqUcY4Be1LkNfwTmXOJUFZYSJdA==",
+      "dev": true
+    },
+    "@webassemblyjs/helper-wasm-section": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.11.6.tgz",
+      "integrity": "sha512-LPpZbSOwTpEC2cgn4hTydySy1Ke+XEu+ETXuoyvuyezHO3Kjdu90KK95Sh9xTbmjrCsUwvWwCOQQNta37VrS9g==",
+      "dev": true,
+      "requires": {
+        "@webassemblyjs/ast": "1.11.6",
+        "@webassemblyjs/helper-buffer": "1.11.6",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/wasm-gen": "1.11.6"
+      }
+    },
+    "@webassemblyjs/ieee754": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/ieee754/-/ieee754-1.11.6.tgz",
+      "integrity": "sha512-LM4p2csPNvbij6U1f19v6WR56QZ8JcHg3QIJTlSwzFcmx6WSORicYj6I63f9yU1kEUtrpG+kjkiIAkevHpDXrg==",
+      "dev": true,
+      "requires": {
+        "@xtuc/ieee754": "^1.2.0"
+      }
+    },
+    "@webassemblyjs/leb128": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/leb128/-/leb128-1.11.6.tgz",
+      "integrity": "sha512-m7a0FhE67DQXgouf1tbN5XQcdWoNgaAuoULHIfGFIEVKA6tu/edls6XnIlkmS6FrXAquJRPni3ZZKjw6FSPjPQ==",
+      "dev": true,
+      "requires": {
+        "@xtuc/long": "4.2.2"
+      }
+    },
+    "@webassemblyjs/utf8": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/utf8/-/utf8-1.11.6.tgz",
+      "integrity": "sha512-vtXf2wTQ3+up9Zsg8sa2yWiQpzSsMyXj0qViVP6xKGCUT8p8YJ6HqI7l5eCnWx1T/FYdsv07HQs2wTFbbof/RA==",
+      "dev": true
+    },
+    "@webassemblyjs/wasm-edit": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-edit/-/wasm-edit-1.11.6.tgz",
+      "integrity": "sha512-Ybn2I6fnfIGuCR+Faaz7YcvtBKxvoLV3Lebn1tM4o/IAJzmi9AWYIPWpyBfU8cC+JxAO57bk4+zdsTjJR+VTOw==",
+      "dev": true,
+      "requires": {
+        "@webassemblyjs/ast": "1.11.6",
+        "@webassemblyjs/helper-buffer": "1.11.6",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/helper-wasm-section": "1.11.6",
+        "@webassemblyjs/wasm-gen": "1.11.6",
+        "@webassemblyjs/wasm-opt": "1.11.6",
+        "@webassemblyjs/wasm-parser": "1.11.6",
+        "@webassemblyjs/wast-printer": "1.11.6"
+      }
+    },
+    "@webassemblyjs/wasm-gen": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-gen/-/wasm-gen-1.11.6.tgz",
+      "integrity": "sha512-3XOqkZP/y6B4F0PBAXvI1/bky7GryoogUtfwExeP/v7Nzwo1QLcq5oQmpKlftZLbT+ERUOAZVQjuNVak6UXjPA==",
+      "dev": true,
+      "requires": {
+        "@webassemblyjs/ast": "1.11.6",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/ieee754": "1.11.6",
+        "@webassemblyjs/leb128": "1.11.6",
+        "@webassemblyjs/utf8": "1.11.6"
+      }
+    },
+    "@webassemblyjs/wasm-opt": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-opt/-/wasm-opt-1.11.6.tgz",
+      "integrity": "sha512-cOrKuLRE7PCe6AsOVl7WasYf3wbSo4CeOk6PkrjS7g57MFfVUF9u6ysQBBODX0LdgSvQqRiGz3CXvIDKcPNy4g==",
+      "dev": true,
+      "requires": {
+        "@webassemblyjs/ast": "1.11.6",
+        "@webassemblyjs/helper-buffer": "1.11.6",
+        "@webassemblyjs/wasm-gen": "1.11.6",
+        "@webassemblyjs/wasm-parser": "1.11.6"
+      }
+    },
+    "@webassemblyjs/wasm-parser": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-parser/-/wasm-parser-1.11.6.tgz",
+      "integrity": "sha512-6ZwPeGzMJM3Dqp3hCsLgESxBGtT/OeCvCZ4TA1JUPYgmhAx38tTPR9JaKy0S5H3evQpO/h2uWs2j6Yc/fjkpTQ==",
+      "dev": true,
+      "requires": {
+        "@webassemblyjs/ast": "1.11.6",
+        "@webassemblyjs/helper-api-error": "1.11.6",
+        "@webassemblyjs/helper-wasm-bytecode": "1.11.6",
+        "@webassemblyjs/ieee754": "1.11.6",
+        "@webassemblyjs/leb128": "1.11.6",
+        "@webassemblyjs/utf8": "1.11.6"
+      }
+    },
+    "@webassemblyjs/wast-printer": {
+      "version": "1.11.6",
+      "resolved": "https://registry.npmjs.org/@webassemblyjs/wast-printer/-/wast-printer-1.11.6.tgz",
+      "integrity": "sha512-JM7AhRcE+yW2GWYaKeHL5vt4xqee5N2WcezptmgyhNS+ScggqcT1OtXykhAb13Sn5Yas0j2uv9tHgrjwvzAP4A==",
+      "dev": true,
+      "requires": {
+        "@webassemblyjs/ast": "1.11.6",
+        "@xtuc/long": "4.2.2"
+      }
+    },
+    "@xtuc/ieee754": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@xtuc/ieee754/-/ieee754-1.2.0.tgz",
+      "integrity": "sha512-DX8nKgqcGwsc0eJSqYt5lwP4DH5FlHnmuWWBRy7X0NcaGR0ZtuyeESgMwTYVEtxmsNGY+qit4QYT/MIYTOTPeA==",
+      "dev": true
+    },
+    "@xtuc/long": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/@xtuc/long/-/long-4.2.2.tgz",
+      "integrity": "sha512-NuHqBY1PB/D8xU6s/thBgOAiAP7HOYDQ32+BFZILJ8ivkUkAHQnWfn6WhL79Owj1qmUnoN/YPhktdIoucipkAQ==",
+      "dev": true
+    },
+    "abab": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/abab/-/abab-2.0.6.tgz",
+      "integrity": "sha512-j2afSsaIENvHZN2B8GOpF566vZ5WVk5opAiMTvWgaQT8DkbOqsTfvNAvHoRGU2zzP8cPoqys+xHTRDWW8L+/BA==",
+      "dev": true
+    },
+    "abbrev": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz",
+      "integrity": "sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q==",
+      "dev": true
+    },
+    "abortcontroller-polyfill": {
+      "version": "1.7.3",
+      "resolved": "https://registry.npmjs.org/abortcontroller-polyfill/-/abortcontroller-polyfill-1.7.3.tgz",
+      "integrity": "sha512-zetDJxd89y3X99Kvo4qFx8GKlt6GsvN3UcRZHwU6iFA/0KiOmhkTVhe8oRoTBiTVPZu09x3vCra47+w8Yz1+2Q=="
+    },
+    "accepts": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
+      "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
+      "dev": true,
+      "requires": {
+        "mime-types": "~2.1.34",
+        "negotiator": "0.6.3"
+      }
+    },
+    "acorn": {
+      "version": "8.7.1",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.7.1.tgz",
+      "integrity": "sha512-Xx54uLJQZ19lKygFXOWsscKUbsBZW0CPykPhVQdhIeIwrbPmJzqeASDInc8nKBnp/JT6igTs82qPXz069H8I/A==",
+      "dev": true
+    },
+    "acorn-globals": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/acorn-globals/-/acorn-globals-6.0.0.tgz",
+      "integrity": "sha512-ZQl7LOWaF5ePqqcX4hLuv/bLXYQNfNWw2c0/yX/TsPRKamzHcTGQnlCjHT3TsmkOUVEPS3crCxiPfdzE/Trlhg==",
+      "dev": true,
+      "requires": {
+        "acorn": "^7.1.1",
+        "acorn-walk": "^7.1.1"
+      },
+      "dependencies": {
+        "acorn": {
+          "version": "7.4.1",
+          "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
+          "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
+          "dev": true
+        },
+        "acorn-walk": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-7.2.0.tgz",
+          "integrity": "sha512-OPdCF6GsMIP+Az+aWfAAOEt2/+iVDKE7oy6lJ098aoe59oAmK76qV6Gw60SbZ8jHuG2wH058GF4pLFbYamYrVA==",
+          "dev": true
+        }
+      }
+    },
+    "acorn-import-assertions": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/acorn-import-assertions/-/acorn-import-assertions-1.8.0.tgz",
+      "integrity": "sha512-m7VZ3jwz4eK6A4Vtt8Ew1/mNbP24u0FhdyfA7fSvnJR6LMdfOYnmuIrrJAgrYfYJ10F/otaHTtrtrtmHdMNzEw==",
+      "dev": true,
+      "requires": {}
+    },
+    "acorn-jsx": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
+      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
+      "dev": true,
+      "requires": {}
+    },
+    "acorn-node": {
+      "version": "1.8.2",
+      "resolved": "https://registry.npmjs.org/acorn-node/-/acorn-node-1.8.2.tgz",
+      "integrity": "sha512-8mt+fslDufLYntIoPAaIMUe/lrbrehIiwmR3t2k9LljIzoigEPF27eLk2hy8zSGzmR/ogr7zbRKINMo1u0yh5A==",
+      "dev": true,
+      "requires": {
+        "acorn": "^7.0.0",
+        "acorn-walk": "^7.0.0",
+        "xtend": "^4.0.2"
+      },
+      "dependencies": {
+        "acorn": {
+          "version": "7.4.1",
+          "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
+          "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
+          "dev": true
+        },
+        "acorn-walk": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-7.2.0.tgz",
+          "integrity": "sha512-OPdCF6GsMIP+Az+aWfAAOEt2/+iVDKE7oy6lJ098aoe59oAmK76qV6Gw60SbZ8jHuG2wH058GF4pLFbYamYrVA==",
+          "dev": true
+        }
+      }
+    },
+    "acorn-walk": {
+      "version": "8.2.0",
+      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.2.0.tgz",
+      "integrity": "sha512-k+iyHEuPgSw6SbuDpGQM+06HQUa04DZ3o+F6CSzXMvvI5KMvnaEqXe+YVe555R9nn6GPt404fos4wcgpw12SDA==",
+      "dev": true
+    },
+    "address": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/address/-/address-1.2.0.tgz",
+      "integrity": "sha512-tNEZYz5G/zYunxFm7sfhAxkXEuLj3K6BKwv6ZURlsF6yiUQ65z0Q2wZW9L5cPUl9ocofGvXOdFYbFHp0+6MOig==",
+      "dev": true
+    },
+    "agent-base": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "dev": true,
+      "requires": {
+        "debug": "4"
+      }
+    },
+    "ajv": {
+      "version": "6.12.6",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
+      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "dev": true,
+      "requires": {
+        "fast-deep-equal": "^3.1.1",
+        "fast-json-stable-stringify": "^2.0.0",
+        "json-schema-traverse": "^0.4.1",
+        "uri-js": "^4.2.2"
+      }
+    },
+    "ajv-formats": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-2.1.1.tgz",
+      "integrity": "sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA==",
+      "dev": true,
+      "requires": {
+        "ajv": "^8.0.0"
+      },
+      "dependencies": {
+        "ajv": {
+          "version": "8.11.0",
+          "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.11.0.tgz",
+          "integrity": "sha512-wGgprdCvMalC0BztXvitD2hC04YffAvtsUn93JbGXYLAtCUO4xd17mCCZQxUOItiBwZvJScWo8NIvQMQ71rdpg==",
+          "dev": true,
+          "requires": {
+            "fast-deep-equal": "^3.1.1",
+            "json-schema-traverse": "^1.0.0",
+            "require-from-string": "^2.0.2",
+            "uri-js": "^4.2.2"
+          }
+        },
+        "json-schema-traverse": {
+          "version": "1.0.0",
+          "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+          "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+          "dev": true
+        }
+      }
+    },
+    "ajv-keywords": {
+      "version": "3.5.2",
+      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-3.5.2.tgz",
+      "integrity": "sha512-5p6WTN0DdTGVQk6VjcEju19IgaHudalcfabD7yhDGeA6bcQnmL+CpveLJq/3hvfwd1aof6L386Ougkx6RfyMIQ==",
+      "dev": true,
+      "requires": {}
+    },
+    "ansi-colors": {
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/ansi-colors/-/ansi-colors-4.1.3.tgz",
+      "integrity": "sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==",
+      "dev": true
+    },
+    "ansi-escapes": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-3.2.0.tgz",
+      "integrity": "sha512-cBhpre4ma+U0T1oM5fXg7Dy1Jw7zzwv7lt/GoCpr+hDQJoYnKVPLL4dCvSEFMmQurOQvSrwT7SL/DAlhBI97RQ==",
+      "dev": true
+    },
+    "ansi-html-community": {
+      "version": "0.0.8",
+      "resolved": "https://registry.npmjs.org/ansi-html-community/-/ansi-html-community-0.0.8.tgz",
+      "integrity": "sha512-1APHAyr3+PCamwNw3bXCPp4HFLONZt/yIH0sZp0/469KWNTEy+qN5jQ3GVX6DMZ1UXAi34yVwtTeaG/HpBuuzw==",
+      "dev": true
+    },
+    "ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true
+    },
+    "ansi-styles": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
+      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
+      "dev": true,
+      "requires": {
+        "color-convert": "^1.9.0"
+      }
+    },
+    "any-promise": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/any-promise/-/any-promise-1.3.0.tgz",
+      "integrity": "sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==",
+      "dev": true
+    },
+    "anymatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.2.tgz",
+      "integrity": "sha512-P43ePfOAIupkguHUycrc4qJ9kz8ZiuOUijaETwX7THt0Y/GNK7v0aa8rY816xWjZ7rJdA5XdMcpVFTKMq+RvWg==",
+      "dev": true,
+      "requires": {
+        "normalize-path": "^3.0.0",
+        "picomatch": "^2.0.4"
+      }
+    },
+    "apexcharts": {
+      "version": "3.35.3",
+      "resolved": "https://registry.npmjs.org/apexcharts/-/apexcharts-3.35.3.tgz",
+      "integrity": "sha512-UDlxslJr3DG63I/SgoiivIu4lpP25GMaKFK8NvCHmTksTQshx4ng3oPPrYvdsBFOvD/ajPYIh/p7rNB0jq8vXg==",
+      "requires": {
+        "svg.draggable.js": "^2.2.2",
+        "svg.easing.js": "^2.0.0",
+        "svg.filter.js": "^2.0.2",
+        "svg.pathmorphing.js": "^0.1.3",
+        "svg.resize.js": "^1.4.3",
+        "svg.select.js": "^3.0.1"
+      }
+    },
+    "arch": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/arch/-/arch-2.2.0.tgz",
+      "integrity": "sha512-Of/R0wqp83cgHozfIYLbBMnej79U/SVGOOyuB3VVFv1NRM/PSFMK12x9KVtiYzJqmnU5WR2qp0Z5rHb7sWGnFQ==",
+      "dev": true
+    },
+    "arg": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/arg/-/arg-5.0.2.tgz",
+      "integrity": "sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==",
+      "dev": true
+    },
+    "argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="
+    },
+    "array-flatten": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-2.1.2.tgz",
+      "integrity": "sha512-hNfzcOV8W4NdualtqBFPyVO+54DSJuZGY9qT4pRroB6S9e3iiido2ISIC5h9R2sPJ8H3FHCIiEnsv1lPXO3KtQ==",
+      "dev": true
+    },
+    "array-union": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/array-union/-/array-union-2.1.0.tgz",
+      "integrity": "sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==",
+      "dev": true
+    },
+    "asn1.js": {
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/asn1.js/-/asn1.js-5.4.1.tgz",
+      "integrity": "sha512-+I//4cYPccV8LdmBLiX8CYvf9Sp3vQsrqu2QNXRcrbiWvcx/UdlFiqUJJzxRQxgsZmvhXhn4cSKeSmoFjVdupA==",
+      "dev": true,
+      "requires": {
+        "bn.js": "^4.0.0",
+        "inherits": "^2.0.1",
+        "minimalistic-assert": "^1.0.0",
+        "safer-buffer": "^2.1.0"
+      }
+    },
+    "astral-regex": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/astral-regex/-/astral-regex-2.0.0.tgz",
+      "integrity": "sha512-Z7tMw1ytTXt5jqMcOP+OQteU1VuNK9Y02uuJtKQ1Sv69jXQKKg5cibLwGJow8yzZP+eAc18EmLGPal0bp36rvQ==",
+      "dev": true
+    },
+    "async": {
+      "version": "2.6.4",
+      "resolved": "https://registry.npmjs.org/async/-/async-2.6.4.tgz",
+      "integrity": "sha512-mzo5dfJYwAn29PeiJ0zvwTo04zj8HDJj0Mn8TD7sno7q12prdbnasKJHhkm2c1LgrhlJ0teaea8860oxi51mGA==",
+      "dev": true,
+      "requires": {
+        "lodash": "^4.17.14"
+      }
+    },
+    "asynckit": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
+      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
+      "dev": true
+    },
+    "at-least-node": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz",
+      "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==",
+      "dev": true
+    },
+    "autoprefixer": {
+      "version": "10.4.7",
+      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.7.tgz",
+      "integrity": "sha512-ypHju4Y2Oav95SipEcCcI5J7CGPuvz8oat7sUtYj3ClK44bldfvtvcxK6IEK++7rqB7YchDGzweZIBG+SD0ZAA==",
+      "dev": true,
+      "requires": {
+        "browserslist": "^4.20.3",
+        "caniuse-lite": "^1.0.30001335",
+        "fraction.js": "^4.2.0",
+        "normalize-range": "^0.1.2",
+        "picocolors": "^1.0.0",
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "babel-eslint": {
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/babel-eslint/-/babel-eslint-10.1.0.tgz",
+      "integrity": "sha512-ifWaTHQ0ce+448CYop8AdrQiBsGrnC+bMgfyKFdi6EsPLTAWG+QfyDeM6OH+FmWnKvEq5NnBMLvlBUPKQZoDSg==",
+      "dev": true,
+      "requires": {
+        "@babel/code-frame": "^7.0.0",
+        "@babel/parser": "^7.7.0",
+        "@babel/traverse": "^7.7.0",
+        "@babel/types": "^7.7.0",
+        "eslint-visitor-keys": "^1.0.0",
+        "resolve": "^1.12.0"
+      },
+      "dependencies": {
+        "eslint-visitor-keys": {
+          "version": "1.3.0",
+          "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-1.3.0.tgz",
+          "integrity": "sha512-6J72N8UNa462wa/KFODt/PJ3IU60SDpC3QXC1Hjc1BXXpfL2C9R5+AU7jhe0F6GREqVMh4Juu+NY7xn+6dipUQ==",
+          "dev": true
+        }
+      }
+    },
+    "babel-jest": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-27.5.1.tgz",
+      "integrity": "sha512-cdQ5dXjGRd0IBRATiQ4mZGlGlRE8kJpjPOixdNRdT+m3UcNqmYWN6rK6nvtXYfY3D76cb8s/O1Ss8ea24PIwcg==",
+      "dev": true,
+      "requires": {
+        "@jest/transform": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/babel__core": "^7.1.14",
+        "babel-plugin-istanbul": "^6.1.1",
+        "babel-preset-jest": "^27.5.1",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "slash": "^3.0.0"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "babel-loader": {
+      "version": "8.2.5",
+      "resolved": "https://registry.npmjs.org/babel-loader/-/babel-loader-8.2.5.tgz",
+      "integrity": "sha512-OSiFfH89LrEMiWd4pLNqGz4CwJDtbs2ZVc+iGu2HrkRfPxId9F2anQj38IxWpmRfsUY0aBZYi1EFcd3mhtRMLQ==",
+      "dev": true,
+      "requires": {
+        "find-cache-dir": "^3.3.1",
+        "loader-utils": "^2.0.0",
+        "make-dir": "^3.1.0",
+        "schema-utils": "^2.6.5"
+      },
+      "dependencies": {
+        "loader-utils": {
+          "version": "2.0.4",
+          "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.4.tgz",
+          "integrity": "sha512-xXqpXoINfFhgua9xiqD8fPFHgkoq1mmmpE92WlDbm9rNRd/EbRb+Gqf908T2DMfuHjjJlksiK2RbHVOdD/MqSw==",
+          "dev": true,
+          "requires": {
+            "big.js": "^5.2.2",
+            "emojis-list": "^3.0.0",
+            "json5": "^2.1.2"
+          }
+        },
+        "schema-utils": {
+          "version": "2.7.1",
+          "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-2.7.1.tgz",
+          "integrity": "sha512-SHiNtMOUGWBQJwzISiVYKu82GiV4QYGePp3odlY1tuKO7gPtphAT5R/py0fA6xtbgLL/RvtJZnU9b8s0F1q0Xg==",
+          "dev": true,
+          "requires": {
+            "@types/json-schema": "^7.0.5",
+            "ajv": "^6.12.4",
+            "ajv-keywords": "^3.5.2"
+          }
+        }
+      }
+    },
+    "babel-plugin-dynamic-import-node": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/babel-plugin-dynamic-import-node/-/babel-plugin-dynamic-import-node-2.3.3.tgz",
+      "integrity": "sha512-jZVI+s9Zg3IqA/kdi0i6UDCybUI3aSBLnglhYbSSjKlV7yF1F/5LWv8MakQmvYpnbJDS6fcBL2KzHSxNCMtWSQ==",
+      "dev": true,
+      "requires": {
+        "object.assign": "^4.1.0"
+      }
+    },
+    "babel-plugin-istanbul": {
+      "version": "6.1.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-6.1.1.tgz",
+      "integrity": "sha512-Y1IQok9821cC9onCx5otgFfRm7Lm+I+wwxOx738M/WLPZ9Q42m4IG5W0FNX8WLL2gYMZo3JkuXIH2DOpWM+qwA==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-plugin-utils": "^7.0.0",
+        "@istanbuljs/load-nyc-config": "^1.0.0",
+        "@istanbuljs/schema": "^0.1.2",
+        "istanbul-lib-instrument": "^5.0.4",
+        "test-exclude": "^6.0.0"
+      }
+    },
+    "babel-plugin-jest-hoist": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-27.5.1.tgz",
+      "integrity": "sha512-50wCwD5EMNW4aRpOwtqzyZHIewTYNxLA4nhB+09d8BIssfNfzBRhkBIHiaPv1Si226TQSvp8gxAJm2iY2qs2hQ==",
+      "dev": true,
+      "requires": {
+        "@babel/template": "^7.3.3",
+        "@babel/types": "^7.3.3",
+        "@types/babel__core": "^7.0.0",
+        "@types/babel__traverse": "^7.0.6"
+      }
+    },
+    "babel-plugin-polyfill-corejs2": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.3.1.tgz",
+      "integrity": "sha512-v7/T6EQcNfVLfcN2X8Lulb7DjprieyLWJK/zOWH5DUYcAgex9sP3h25Q+DLsX9TloXe3y1O8l2q2Jv9q8UVB9w==",
+      "dev": true,
+      "requires": {
+        "@babel/compat-data": "^7.13.11",
+        "@babel/helper-define-polyfill-provider": "^0.3.1",
+        "semver": "^6.1.1"
+      }
+    },
+    "babel-plugin-polyfill-corejs3": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.5.2.tgz",
+      "integrity": "sha512-G3uJih0XWiID451fpeFaYGVuxHEjzKTHtc9uGFEjR6hHrvNzeS/PX+LLLcetJcytsB5m4j+K3o/EpXJNb/5IEQ==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-define-polyfill-provider": "^0.3.1",
+        "core-js-compat": "^3.21.0"
+      }
+    },
+    "babel-plugin-polyfill-regenerator": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.3.1.tgz",
+      "integrity": "sha512-Y2B06tvgHYt1x0yz17jGkGeeMr5FeKUu+ASJ+N6nB5lQ8Dapfg42i0OVrf8PNGJ3zKL4A23snMi1IRwrqqND7A==",
+      "dev": true,
+      "requires": {
+        "@babel/helper-define-polyfill-provider": "^0.3.1"
+      }
+    },
+    "babel-preset-current-node-syntax": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/babel-preset-current-node-syntax/-/babel-preset-current-node-syntax-1.0.1.tgz",
+      "integrity": "sha512-M7LQ0bxarkxQoN+vz5aJPsLBn77n8QgTFmo8WK0/44auK2xlCXrYcUxHFxgU7qW5Yzw/CjmLRK2uJzaCd7LvqQ==",
+      "dev": true,
+      "requires": {
+        "@babel/plugin-syntax-async-generators": "^7.8.4",
+        "@babel/plugin-syntax-bigint": "^7.8.3",
+        "@babel/plugin-syntax-class-properties": "^7.8.3",
+        "@babel/plugin-syntax-import-meta": "^7.8.3",
+        "@babel/plugin-syntax-json-strings": "^7.8.3",
+        "@babel/plugin-syntax-logical-assignment-operators": "^7.8.3",
+        "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3",
+        "@babel/plugin-syntax-numeric-separator": "^7.8.3",
+        "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
+        "@babel/plugin-syntax-optional-catch-binding": "^7.8.3",
+        "@babel/plugin-syntax-optional-chaining": "^7.8.3",
+        "@babel/plugin-syntax-top-level-await": "^7.8.3"
+      }
+    },
+    "babel-preset-jest": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-27.5.1.tgz",
+      "integrity": "sha512-Nptf2FzlPCWYuJg41HBqXVT8ym6bXOevuCTbhxlUpjwtysGaIWFvDEjp4y+G7fl13FgOdjs7P/DmErqH7da0Ag==",
+      "dev": true,
+      "requires": {
+        "babel-plugin-jest-hoist": "^27.5.1",
+        "babel-preset-current-node-syntax": "^1.0.0"
+      }
+    },
+    "balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true
+    },
+    "base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="
+    },
+    "batch": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/batch/-/batch-0.6.1.tgz",
+      "integrity": "sha512-x+VAiMRL6UPkx+kudNvxTl6hB2XNNCG2r+7wixVfIYwu/2HKRXimwQyaumLjMveWvT2Hkd/cAJw+QBMfJ/EKVw==",
+      "dev": true
+    },
+    "big.js": {
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/big.js/-/big.js-5.2.2.tgz",
+      "integrity": "sha512-vyL2OymJxmarO8gxMr0mhChsO9QGwhynfuu4+MHTAW6czfq9humCB7rKpUjDd9YUiDPU4mzpyupFSvOClAwbmQ==",
+      "dev": true
+    },
+    "binary-extensions": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.2.0.tgz",
+      "integrity": "sha512-jDctJ/IVQbZoJykoeHbhXpOlNBqGNcwXJKJog42E5HDPUwQTSdjCHdihjj0DlnheQ7blbT6dHOafNAiS8ooQKA==",
+      "dev": true
+    },
+    "bl": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
+      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+      "dev": true,
+      "requires": {
+        "buffer": "^5.5.0",
+        "inherits": "^2.0.4",
+        "readable-stream": "^3.4.0"
+      },
+      "dependencies": {
+        "buffer": {
+          "version": "5.7.1",
+          "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+          "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+          "dev": true,
+          "requires": {
+            "base64-js": "^1.3.1",
+            "ieee754": "^1.1.13"
+          }
+        }
+      }
+    },
+    "bluebird": {
+      "version": "3.7.2",
+      "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
+      "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==",
+      "dev": true
+    },
+    "bn.js": {
+      "version": "4.12.0",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.0.tgz",
+      "integrity": "sha512-c98Bf3tPniI+scsdk237ku1Dc3ujXQTSgyiPUDEOe7tRkhrqridvh8klBv0HCEso1OLOYcHuCv/cS6DNxKH+ZA==",
+      "dev": true
+    },
+    "body-parser": {
+      "version": "1.20.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.0.tgz",
+      "integrity": "sha512-DfJ+q6EPcGKZD1QWUjSpqp+Q7bDQTsQIF4zfUAtZ6qk+H/3/QRhg9CEp39ss+/T2vw0+HaidC0ecJj/DRLIaKg==",
+      "dev": true,
+      "requires": {
+        "bytes": "3.1.2",
+        "content-type": "~1.0.4",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "1.2.0",
+        "http-errors": "2.0.0",
+        "iconv-lite": "0.4.24",
+        "on-finished": "2.4.1",
+        "qs": "6.10.3",
+        "raw-body": "2.5.1",
+        "type-is": "~1.6.18",
+        "unpipe": "1.0.0"
+      },
+      "dependencies": {
+        "bytes": {
+          "version": "3.1.2",
+          "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+          "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+          "dev": true
+        },
+        "debug": {
+          "version": "2.6.9",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+          "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+          "dev": true,
+          "requires": {
+            "ms": "2.0.0"
+          }
+        },
+        "ms": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+          "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+          "dev": true
+        }
+      }
+    },
+    "bonjour-service": {
+      "version": "1.0.13",
+      "resolved": "https://registry.npmjs.org/bonjour-service/-/bonjour-service-1.0.13.tgz",
+      "integrity": "sha512-LWKRU/7EqDUC9CTAQtuZl5HzBALoCYwtLhffW3et7vZMwv3bWLpJf8bRYlMD5OCcDpTfnPgNCV4yo9ZIaJGMiA==",
+      "dev": true,
+      "requires": {
+        "array-flatten": "^2.1.2",
+        "dns-equal": "^1.0.0",
+        "fast-deep-equal": "^3.1.3",
+        "multicast-dns": "^7.2.5"
+      }
+    },
+    "boolbase": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/boolbase/-/boolbase-1.0.0.tgz",
+      "integrity": "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==",
+      "dev": true
+    },
+    "brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "dev": true,
+      "requires": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "braces": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
+      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
+      "dev": true,
+      "requires": {
+        "fill-range": "^7.0.1"
+      }
+    },
+    "browser-process-hrtime": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/browser-process-hrtime/-/browser-process-hrtime-1.0.0.tgz",
+      "integrity": "sha512-9o5UecI3GhkpM6DrXr69PblIuWxPKk9Y0jHBRhdocZ2y7YECBFCsHm79Pr3OyR2AvjhDkabFJaDJMYRazHgsow==",
+      "dev": true
+    },
+    "browser-tabs-lock": {
+      "version": "1.2.15",
+      "resolved": "https://registry.npmjs.org/browser-tabs-lock/-/browser-tabs-lock-1.2.15.tgz",
+      "integrity": "sha512-J8K9vdivK0Di+b8SBdE7EZxDr88TnATing7XoLw6+nFkXMQ6sVBh92K3NQvZlZU91AIkFRi0w3sztk5Z+vsswA==",
+      "requires": {
+        "lodash": ">=4.17.21"
+      }
+    },
+    "browserslist": {
+      "version": "4.21.10",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.21.10.tgz",
+      "integrity": "sha512-bipEBdZfVH5/pwrvqc+Ub0kUPVfGUhlKxbvfD+z1BDnPEO/X98ruXGA1WP5ASpAFKan7Qr6j736IacbZQuAlKQ==",
+      "dev": true,
+      "requires": {
+        "caniuse-lite": "^1.0.30001517",
+        "electron-to-chromium": "^1.4.477",
+        "node-releases": "^2.0.13",
+        "update-browserslist-db": "^1.0.11"
+      }
+    },
+    "bs-logger": {
+      "version": "0.2.6",
+      "resolved": "https://registry.npmjs.org/bs-logger/-/bs-logger-0.2.6.tgz",
+      "integrity": "sha512-pd8DCoxmbgc7hyPKOvxtqNcjYoOsABPQdcCUjGp3d42VR2CX1ORhk2A87oqqu5R1kk+76nsxZupkmyd+MVtCog==",
+      "dev": true,
+      "requires": {
+        "fast-json-stable-stringify": "2.x"
+      }
+    },
+    "bser": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/bser/-/bser-2.1.1.tgz",
+      "integrity": "sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==",
+      "dev": true,
+      "requires": {
+        "node-int64": "^0.4.0"
+      }
+    },
+    "buffer": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
+      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
+      "requires": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.2.1"
+      }
+    },
+    "buffer-from": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
+      "dev": true
+    },
+    "builtin-modules": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/builtin-modules/-/builtin-modules-1.1.1.tgz",
+      "integrity": "sha512-wxXCdllwGhI2kCC0MnvTGYTMvnVZTvqgypkiTI8Pa5tcz2i6VqsqwYGgqwXji+4RgCzms6EajE4IxiUH6HH8nQ==",
+      "dev": true
+    },
+    "bytes": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.0.0.tgz",
+      "integrity": "sha512-pMhOfFDPiv9t5jjIXkHosWmkSyQbvsgEVNkz0ERHbuLh2T/7j4Mqqpz523Fe8MVY89KC6Sh/QfS2sM+SjgFDcw==",
+      "dev": true
+    },
+    "call-bind": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.2.tgz",
+      "integrity": "sha512-7O+FbCihrB5WGbFYesctwmTKae6rOiIzmz1icreWJ+0aA7LJfuqhEso2T9ncpcFtzMQtzXf2QGGueWJGTYsqrA==",
+      "dev": true,
+      "requires": {
+        "function-bind": "^1.1.1",
+        "get-intrinsic": "^1.0.2"
+      }
+    },
+    "callsites": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
+      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
+      "dev": true
+    },
+    "camel-case": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/camel-case/-/camel-case-4.1.2.tgz",
+      "integrity": "sha512-gxGWBrTT1JuMx6R+o5PTXMmUnhnVzLQ9SNutD4YqKtI6ap897t3tKECYla6gCWEkplXnlNybEkZg9GEGxKFCgw==",
+      "dev": true,
+      "requires": {
+        "pascal-case": "^3.1.2",
+        "tslib": "^2.0.3"
+      }
+    },
+    "camelcase": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
+      "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
+      "dev": true
+    },
+    "camelcase-css": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/camelcase-css/-/camelcase-css-2.0.1.tgz",
+      "integrity": "sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==",
+      "dev": true
+    },
+    "caniuse-api": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/caniuse-api/-/caniuse-api-3.0.0.tgz",
+      "integrity": "sha512-bsTwuIg/BZZK/vreVTYYbSWoe2F+71P7K5QGEX+pT250DZbfU1MQ5prOKpPR+LL6uWKK3KMwMCAS74QB3Um1uw==",
+      "dev": true,
+      "requires": {
+        "browserslist": "^4.0.0",
+        "caniuse-lite": "^1.0.0",
+        "lodash.memoize": "^4.1.2",
+        "lodash.uniq": "^4.5.0"
+      }
+    },
+    "caniuse-lite": {
+      "version": "1.0.30001519",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001519.tgz",
+      "integrity": "sha512-0QHgqR+Jv4bxHMp8kZ1Kn8CH55OikjKJ6JmKkZYP1F3D7w+lnFXF70nG5eNfsZS89jadi5Ywy5UCSKLAglIRkg==",
+      "dev": true
+    },
+    "case-sensitive-paths-webpack-plugin": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/case-sensitive-paths-webpack-plugin/-/case-sensitive-paths-webpack-plugin-2.4.0.tgz",
+      "integrity": "sha512-roIFONhcxog0JSSWbvVAh3OocukmSgpqOH6YpMkCvav/ySIV3JKg4Dc8vYtQjYi/UxpNE36r/9v+VqTQqgkYmw==",
+      "dev": true
+    },
+    "chalk": {
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
+      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
+      "dev": true,
+      "requires": {
+        "ansi-styles": "^3.2.1",
+        "escape-string-regexp": "^1.0.5",
+        "supports-color": "^5.3.0"
+      }
+    },
+    "char-regex": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/char-regex/-/char-regex-1.0.2.tgz",
+      "integrity": "sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==",
+      "dev": true
+    },
+    "character-parser": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/character-parser/-/character-parser-2.2.0.tgz",
+      "integrity": "sha512-+UqJQjFEFaTAs3bNsF2j2kEN1baG/zghZbdqoYEDxGZtJo9LBzl1A+m0D4n3qKx8N2FNv8/Xp6yV9mQmBuptaw==",
+      "dev": true,
+      "requires": {
+        "is-regex": "^1.0.3"
+      }
+    },
+    "chokidar": {
+      "version": "3.5.3",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.5.3.tgz",
+      "integrity": "sha512-Dr3sfKRP6oTcjf2JmUmFJfeVMvXBdegxB0iVQ5eb2V10uFJUCAS8OByZdVAyVb8xXNz3GjjTgj9kLWsZTqE6kw==",
+      "dev": true,
+      "requires": {
+        "anymatch": "~3.1.2",
+        "braces": "~3.0.2",
+        "fsevents": "~2.3.2",
+        "glob-parent": "~5.1.2",
+        "is-binary-path": "~2.1.0",
+        "is-glob": "~4.0.1",
+        "normalize-path": "~3.0.0",
+        "readdirp": "~3.6.0"
+      },
+      "dependencies": {
+        "glob-parent": {
+          "version": "5.1.2",
+          "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+          "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+          "dev": true,
+          "requires": {
+            "is-glob": "^4.0.1"
+          }
+        }
+      }
+    },
+    "chrome-trace-event": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/chrome-trace-event/-/chrome-trace-event-1.0.3.tgz",
+      "integrity": "sha512-p3KULyQg4S7NIHixdwbGX+nFHkoBiA4YQmyWtjb8XngSKV124nJmRysgAeujbUVb15vh+RvFUfCPqU7rXk+hZg==",
+      "dev": true
+    },
+    "ci-info": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-3.3.2.tgz",
+      "integrity": "sha512-xmDt/QIAdeZ9+nfdPsaBCpMvHNLFiLdjj59qjqn+6iPe6YmHGQ35sBnQ8uslRBXFmXkiZQOJRjvQeoGppoTjjg==",
+      "dev": true
+    },
+    "cjs-module-lexer": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-1.2.2.tgz",
+      "integrity": "sha512-cOU9usZw8/dXIXKtwa8pM0OTJQuJkxMN6w30csNRUerHfeQ5R6U3kkU/FtJeIf3M202OHfY2U8ccInBG7/xogA==",
+      "dev": true
+    },
+    "clean-css": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/clean-css/-/clean-css-5.3.0.tgz",
+      "integrity": "sha512-YYuuxv4H/iNb1Z/5IbMRoxgrzjWGhOEFfd+groZ5dMCVkpENiMZmwspdrzBo9286JjM1gZJPAyL7ZIdzuvu2AQ==",
+      "dev": true,
+      "requires": {
+        "source-map": "~0.6.0"
+      }
+    },
+    "cli-cursor": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-3.1.0.tgz",
+      "integrity": "sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==",
+      "dev": true,
+      "requires": {
+        "restore-cursor": "^3.1.0"
+      }
+    },
+    "cli-highlight": {
+      "version": "2.1.11",
+      "resolved": "https://registry.npmjs.org/cli-highlight/-/cli-highlight-2.1.11.tgz",
+      "integrity": "sha512-9KDcoEVwyUXrjcJNvHD0NFc/hiwe/WPVYIleQh2O1N2Zro5gWJZ/K+3DGn8w8P/F6FxOgzyC5bxDyHIgCSPhGg==",
+      "dev": true,
+      "requires": {
+        "chalk": "^4.0.0",
+        "highlight.js": "^10.7.1",
+        "mz": "^2.4.0",
+        "parse5": "^5.1.1",
+        "parse5-htmlparser2-tree-adapter": "^6.0.0",
+        "yargs": "^16.0.0"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "cli-spinners": {
+      "version": "2.6.1",
+      "resolved": "https://registry.npmjs.org/cli-spinners/-/cli-spinners-2.6.1.tgz",
+      "integrity": "sha512-x/5fWmGMnbKQAaNwN+UZlV79qBLM9JFnJuJ03gIi5whrob0xV0ofNVHy9DhwGdsMJQc2OKv0oGmLzvaqvAVv+g==",
+      "dev": true
+    },
+    "click-outside-vue3": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/click-outside-vue3/-/click-outside-vue3-4.0.1.tgz",
+      "integrity": "sha512-sbplNecrup5oGqA3o4bo8XmvHRT6q9fvw21Z67aDbTqB9M6LF7CuYLTlLvNtOgKU6W3zst5H5zJuEh4auqA34g=="
+    },
+    "clipboard": {
+      "version": "2.0.11",
+      "resolved": "https://registry.npmjs.org/clipboard/-/clipboard-2.0.11.tgz",
+      "integrity": "sha512-C+0bbOqkezLIsmWSvlsXS0Q0bmkugu7jcfMIACB+RDEntIzQIkdr148we28AfSloQLRdZlYL/QYyrq05j/3Faw==",
+      "requires": {
+        "good-listener": "^1.2.2",
+        "select": "^1.1.2",
+        "tiny-emitter": "^2.0.0"
+      }
+    },
+    "clipboardy": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/clipboardy/-/clipboardy-2.3.0.tgz",
+      "integrity": "sha512-mKhiIL2DrQIsuXMgBgnfEHOZOryC7kY7YO//TN6c63wlEm3NG5tz+YgY5rVi29KCmq/QQjKYvM7a19+MDOTHOQ==",
+      "dev": true,
+      "requires": {
+        "arch": "^2.1.1",
+        "execa": "^1.0.0",
+        "is-wsl": "^2.1.1"
+      }
+    },
+    "cliui": {
+      "version": "7.0.4",
+      "resolved": "https://registry.npmjs.org/cliui/-/cliui-7.0.4.tgz",
+      "integrity": "sha512-OcRE68cOsVMXp1Yvonl/fzkQOyjLSu/8bhPDfQt0e0/Eb283TKP20Fs2MqoPsr9SwA595rRCA+QMzYc9nBP+JQ==",
+      "dev": true,
+      "requires": {
+        "string-width": "^4.2.0",
+        "strip-ansi": "^6.0.0",
+        "wrap-ansi": "^7.0.0"
+      }
+    },
+    "clone": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/clone/-/clone-1.0.4.tgz",
+      "integrity": "sha512-JQHZ2QMW6l3aH/j6xCqQThY/9OH4D/9ls34cgkUBiEeocRTU04tHfKPBsUK1PqZCUQM7GiA0IIXJSuXHI64Kbg==",
+      "dev": true
+    },
+    "clone-deep": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/clone-deep/-/clone-deep-4.0.1.tgz",
+      "integrity": "sha512-neHB9xuzh/wk0dIHweyAXv2aPGZIVk3pLMe+/RNzINf17fe0OG96QroktYAUm7SM1PBnzTabaLboqqxDyMU+SQ==",
+      "dev": true,
+      "requires": {
+        "is-plain-object": "^2.0.4",
+        "kind-of": "^6.0.2",
+        "shallow-clone": "^3.0.0"
+      }
+    },
+    "co": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/co/-/co-4.6.0.tgz",
+      "integrity": "sha512-QVb0dM5HvG+uaxitm8wONl7jltx8dqhfU33DcqtOZcLSVIKSDDLDi7+0LbAKiyI8hD9u42m2YxXSkMGWThaecQ==",
+      "dev": true
+    },
+    "collect-v8-coverage": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/collect-v8-coverage/-/collect-v8-coverage-1.0.1.tgz",
+      "integrity": "sha512-iBPtljfCNcTKNAto0KEtDfZ3qzjJvqE3aTGZsbhjSBlorqpXJlaWWtPO35D+ZImoC3KWejX64o+yPGxhWSTzfg==",
+      "dev": true
+    },
+    "color-convert": {
+      "version": "1.9.3",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
+      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
+      "dev": true,
+      "requires": {
+        "color-name": "1.1.3"
+      }
+    },
+    "color-name": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
+      "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
+      "dev": true
+    },
+    "colord": {
+      "version": "2.9.2",
+      "resolved": "https://registry.npmjs.org/colord/-/colord-2.9.2.tgz",
+      "integrity": "sha512-Uqbg+J445nc1TKn4FoDPS6ZZqAvEDnwrH42yo8B40JSOgSLxMZ/gt3h4nmCtPLQeXhjJJkqBx7SCY35WnIixaQ==",
+      "dev": true
+    },
+    "colorette": {
+      "version": "2.0.19",
+      "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.19.tgz",
+      "integrity": "sha512-3tlv/dIP7FWvj3BsbHrGLJ6l/oKh1O3TcgBqMn+yyCagOxc23fyzDS6HypQbgxWbkpDnf52p1LuR4eWDQ/K9WQ==",
+      "dev": true
+    },
+    "combined-stream": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
+      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
+      "dev": true,
+      "requires": {
+        "delayed-stream": "~1.0.0"
+      }
+    },
+    "commander": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz",
+      "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
+      "dev": true
+    },
+    "commondir": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/commondir/-/commondir-1.0.1.tgz",
+      "integrity": "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==",
+      "dev": true
+    },
+    "compressible": {
+      "version": "2.0.18",
+      "resolved": "https://registry.npmjs.org/compressible/-/compressible-2.0.18.tgz",
+      "integrity": "sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg==",
+      "dev": true,
+      "requires": {
+        "mime-db": ">= 1.43.0 < 2"
+      }
+    },
+    "compression": {
+      "version": "1.7.4",
+      "resolved": "https://registry.npmjs.org/compression/-/compression-1.7.4.tgz",
+      "integrity": "sha512-jaSIDzP9pZVS4ZfQ+TzvtiWhdpFhE2RDHz8QJkpX9SIpLq88VueF5jJw6t+6CUQcAoA6t+x89MLrWAqpfDE8iQ==",
+      "dev": true,
+      "requires": {
+        "accepts": "~1.3.5",
+        "bytes": "3.0.0",
+        "compressible": "~2.0.16",
+        "debug": "2.6.9",
+        "on-headers": "~1.0.2",
+        "safe-buffer": "5.1.2",
+        "vary": "~1.1.2"
+      },
+      "dependencies": {
+        "debug": {
+          "version": "2.6.9",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+          "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+          "dev": true,
+          "requires": {
+            "ms": "2.0.0"
+          }
+        },
+        "ms": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+          "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+          "dev": true
+        }
+      }
+    },
+    "concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "dev": true
+    },
+    "condense-newlines": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/condense-newlines/-/condense-newlines-0.2.1.tgz",
+      "integrity": "sha512-P7X+QL9Hb9B/c8HI5BFFKmjgBu2XpQuF98WZ9XkO+dBGgk5XgwiQz7o1SmpglNWId3581UcS0SFAWfoIhMHPfg==",
+      "dev": true,
+      "requires": {
+        "extend-shallow": "^2.0.1",
+        "is-whitespace": "^0.3.0",
+        "kind-of": "^3.0.2"
+      },
+      "dependencies": {
+        "kind-of": {
+          "version": "3.2.2",
+          "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
+          "integrity": "sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ==",
+          "dev": true,
+          "requires": {
+            "is-buffer": "^1.1.5"
+          }
+        }
+      }
+    },
+    "config-chain": {
+      "version": "1.1.13",
+      "resolved": "https://registry.npmjs.org/config-chain/-/config-chain-1.1.13.tgz",
+      "integrity": "sha512-qj+f8APARXHrM0hraqXYb2/bOVSV4PvJQlNZ/DVj0QrmNM2q2euizkeuVckQ57J+W0mRH6Hvi+k50M4Jul2VRQ==",
+      "dev": true,
+      "requires": {
+        "ini": "^1.3.4",
+        "proto-list": "~1.2.1"
+      }
+    },
+    "connect-history-api-fallback": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/connect-history-api-fallback/-/connect-history-api-fallback-2.0.0.tgz",
+      "integrity": "sha512-U73+6lQFmfiNPrYbXqr6kZ1i1wiRqXnp2nhMsINseWXO8lDau0LGEffJ8kQi4EjLZympVgRdvqjAgiZ1tgzDDA==",
+      "dev": true
+    },
+    "consolidate": {
+      "version": "0.15.1",
+      "resolved": "https://registry.npmjs.org/consolidate/-/consolidate-0.15.1.tgz",
+      "integrity": "sha512-DW46nrsMJgy9kqAbPt5rKaCr7uFtpo4mSUvLHIUbJEjm0vo+aY5QLwBUq3FK4tRnJr/X0Psc0C4jf/h+HtXSMw==",
+      "dev": true,
+      "requires": {
+        "bluebird": "^3.1.1"
+      }
+    },
+    "content-disposition": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
+      "dev": true,
+      "requires": {
+        "safe-buffer": "5.2.1"
+      },
+      "dependencies": {
+        "safe-buffer": {
+          "version": "5.2.1",
+          "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+          "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+          "dev": true
+        }
+      }
+    },
+    "content-type": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.4.tgz",
+      "integrity": "sha512-hIP3EEPs8tB9AT1L+NUqtwOAps4mk2Zob89MWXMHjHWg9milF/j4osnnQLXBCBFBk/tvIG/tUc9mOUJiPBhPXA==",
+      "dev": true
+    },
+    "convert-source-map": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.8.0.tgz",
+      "integrity": "sha512-+OQdjP49zViI/6i7nIJpA8rAl4sV/JdPfU9nZs3VqOwGIgizICvuN2ru6fMd+4llL0tar18UYJXfZ/TWtmhUjA==",
+      "dev": true,
+      "requires": {
+        "safe-buffer": "~5.1.1"
+      }
+    },
+    "cookie": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.5.0.tgz",
+      "integrity": "sha512-YZ3GUyn/o8gfKJlnlX7g7xq4gyO6OSuhGPKaaGssGB2qgDUS0gPgtTvoyZLTt9Ab6dC4hfc9dV5arkvc/OCmrw==",
+      "dev": true
+    },
+    "cookie-signature": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
+      "integrity": "sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ==",
+      "dev": true
+    },
+    "copy-webpack-plugin": {
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/copy-webpack-plugin/-/copy-webpack-plugin-9.1.0.tgz",
+      "integrity": "sha512-rxnR7PaGigJzhqETHGmAcxKnLZSR5u1Y3/bcIv/1FnqXedcL/E2ewK7ZCNrArJKCiSv8yVXhTqetJh8inDvfsA==",
+      "dev": true,
+      "requires": {
+        "fast-glob": "^3.2.7",
+        "glob-parent": "^6.0.1",
+        "globby": "^11.0.3",
+        "normalize-path": "^3.0.0",
+        "schema-utils": "^3.1.1",
+        "serialize-javascript": "^6.0.0"
+      }
+    },
+    "core-js": {
+      "version": "3.25.1",
+      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.25.1.tgz",
+      "integrity": "sha512-sr0FY4lnO1hkQ4gLDr24K0DGnweGO1QwSj5BpfQjpSJPdqWalja4cTps29Y/PJVG/P7FYlPDkH3hO+Tr0CvDgQ=="
+    },
+    "core-js-compat": {
+      "version": "3.32.0",
+      "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.32.0.tgz",
+      "integrity": "sha512-7a9a3D1k4UCVKnLhrgALyFcP7YCsLOQIxPd0dKjf/6GuPcgyiGP70ewWdCGrSK7evyhymi0qO4EqCmSJofDeYw==",
+      "dev": true,
+      "requires": {
+        "browserslist": "^4.21.9"
+      }
+    },
+    "core-util-is": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
+      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
+      "dev": true
+    },
+    "cosmiconfig": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-7.0.1.tgz",
+      "integrity": "sha512-a1YWNUV2HwGimB7dU2s1wUMurNKjpx60HxBB6xUM8Re+2s1g1IIfJvFR0/iCF+XHdE0GMTKTuLR32UQff4TEyQ==",
+      "dev": true,
+      "requires": {
+        "@types/parse-json": "^4.0.0",
+        "import-fresh": "^3.2.1",
+        "parse-json": "^5.0.0",
+        "path-type": "^4.0.0",
+        "yaml": "^1.10.0"
+      }
+    },
+    "cross-spawn": {
+      "version": "6.0.5",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-6.0.5.tgz",
+      "integrity": "sha512-eTVLrBSt7fjbDygz805pMnstIs2VTBNkRm0qxZd+M7A5XDdxVRWO5MxGBXZhjY4cqLYLdtrGqRf8mBPmzwSpWQ==",
+      "dev": true,
+      "requires": {
+        "nice-try": "^1.0.4",
+        "path-key": "^2.0.1",
+        "semver": "^5.5.0",
+        "shebang-command": "^1.2.0",
+        "which": "^1.2.9"
+      },
+      "dependencies": {
+        "semver": {
+          "version": "5.7.2",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+          "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
+          "dev": true
+        }
+      }
+    },
+    "css-declaration-sorter": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/css-declaration-sorter/-/css-declaration-sorter-6.3.0.tgz",
+      "integrity": "sha512-OGT677UGHJTAVMRhPO+HJ4oKln3wkBTwtDFH0ojbqm+MJm6xuDMHp2nkhh/ThaBqq20IbraBQSWKfSLNHQO9Og==",
+      "dev": true,
+      "requires": {}
+    },
+    "css-loader": {
+      "version": "6.7.1",
+      "resolved": "https://registry.npmjs.org/css-loader/-/css-loader-6.7.1.tgz",
+      "integrity": "sha512-yB5CNFa14MbPJcomwNh3wLThtkZgcNyI2bNMRt8iE5Z8Vwl7f8vQXFAzn2HDOJvtDq2NTZBUGMSUNNyrv3/+cw==",
+      "dev": true,
+      "requires": {
+        "icss-utils": "^5.1.0",
+        "postcss": "^8.4.7",
+        "postcss-modules-extract-imports": "^3.0.0",
+        "postcss-modules-local-by-default": "^4.0.0",
+        "postcss-modules-scope": "^3.0.0",
+        "postcss-modules-values": "^4.0.0",
+        "postcss-value-parser": "^4.2.0",
+        "semver": "^7.3.5"
+      },
+      "dependencies": {
+        "semver": {
+          "version": "7.5.4",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+          "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^6.0.0"
+          }
+        }
+      }
+    },
+    "css-minimizer-webpack-plugin": {
+      "version": "3.4.1",
+      "resolved": "https://registry.npmjs.org/css-minimizer-webpack-plugin/-/css-minimizer-webpack-plugin-3.4.1.tgz",
+      "integrity": "sha512-1u6D71zeIfgngN2XNRJefc/hY7Ybsxd74Jm4qngIXyUEk7fss3VUzuHxLAq/R8NAba4QU9OUSaMZlbpRc7bM4Q==",
+      "dev": true,
+      "requires": {
+        "cssnano": "^5.0.6",
+        "jest-worker": "^27.0.2",
+        "postcss": "^8.3.5",
+        "schema-utils": "^4.0.0",
+        "serialize-javascript": "^6.0.0",
+        "source-map": "^0.6.1"
+      },
+      "dependencies": {
+        "ajv": {
+          "version": "8.11.0",
+          "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.11.0.tgz",
+          "integrity": "sha512-wGgprdCvMalC0BztXvitD2hC04YffAvtsUn93JbGXYLAtCUO4xd17mCCZQxUOItiBwZvJScWo8NIvQMQ71rdpg==",
+          "dev": true,
+          "requires": {
+            "fast-deep-equal": "^3.1.1",
+            "json-schema-traverse": "^1.0.0",
+            "require-from-string": "^2.0.2",
+            "uri-js": "^4.2.2"
+          }
+        },
+        "ajv-keywords": {
+          "version": "5.1.0",
+          "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-5.1.0.tgz",
+          "integrity": "sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw==",
+          "dev": true,
+          "requires": {
+            "fast-deep-equal": "^3.1.3"
+          }
+        },
+        "json-schema-traverse": {
+          "version": "1.0.0",
+          "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+          "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+          "dev": true
+        },
+        "schema-utils": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.0.0.tgz",
+          "integrity": "sha512-1edyXKgh6XnJsJSQ8mKWXnN/BVaIbFMLpouRUrXgVq7WYne5kw3MW7UPhO44uRXQSIpTSXoJbmrR2X0w9kUTyg==",
+          "dev": true,
+          "requires": {
+            "@types/json-schema": "^7.0.9",
+            "ajv": "^8.8.0",
+            "ajv-formats": "^2.1.1",
+            "ajv-keywords": "^5.0.0"
+          }
+        }
+      }
+    },
+    "css-select": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/css-select/-/css-select-4.3.0.tgz",
+      "integrity": "sha512-wPpOYtnsVontu2mODhA19JrqWxNsfdatRKd64kmpRbQgh1KtItko5sTnEpPdpSaJszTOhEMlF/RPz28qj4HqhQ==",
+      "dev": true,
+      "requires": {
+        "boolbase": "^1.0.0",
+        "css-what": "^6.0.1",
+        "domhandler": "^4.3.1",
+        "domutils": "^2.8.0",
+        "nth-check": "^2.0.1"
+      }
+    },
+    "css-tree": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-1.1.3.tgz",
+      "integrity": "sha512-tRpdppF7TRazZrjJ6v3stzv93qxRcSsFmW6cX0Zm2NVKpxE1WV1HblnghVv9TreireHkqI/VDEsfolRF1p6y7Q==",
+      "dev": true,
+      "requires": {
+        "mdn-data": "2.0.14",
+        "source-map": "^0.6.1"
+      }
+    },
+    "css-what": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/css-what/-/css-what-6.1.0.tgz",
+      "integrity": "sha512-HTUrgRJ7r4dsZKU6GjmpfRK1O76h97Z8MfS1G0FozR+oF2kG6Vfe8JE6zwrkbxigziPHinCJ+gCPjA9EaBDtRw==",
+      "dev": true
+    },
+    "cssesc": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
+      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
+      "dev": true
+    },
+    "cssnano": {
+      "version": "5.1.12",
+      "resolved": "https://registry.npmjs.org/cssnano/-/cssnano-5.1.12.tgz",
+      "integrity": "sha512-TgvArbEZu0lk/dvg2ja+B7kYoD7BBCmn3+k58xD0qjrGHsFzXY/wKTo9M5egcUCabPol05e/PVoIu79s2JN4WQ==",
+      "dev": true,
+      "requires": {
+        "cssnano-preset-default": "^5.2.12",
+        "lilconfig": "^2.0.3",
+        "yaml": "^1.10.2"
+      }
+    },
+    "cssnano-preset-default": {
+      "version": "5.2.12",
+      "resolved": "https://registry.npmjs.org/cssnano-preset-default/-/cssnano-preset-default-5.2.12.tgz",
+      "integrity": "sha512-OyCBTZi+PXgylz9HAA5kHyoYhfGcYdwFmyaJzWnzxuGRtnMw/kR6ilW9XzlzlRAtB6PLT/r+prYgkef7hngFew==",
+      "dev": true,
+      "requires": {
+        "css-declaration-sorter": "^6.3.0",
+        "cssnano-utils": "^3.1.0",
+        "postcss-calc": "^8.2.3",
+        "postcss-colormin": "^5.3.0",
+        "postcss-convert-values": "^5.1.2",
+        "postcss-discard-comments": "^5.1.2",
+        "postcss-discard-duplicates": "^5.1.0",
+        "postcss-discard-empty": "^5.1.1",
+        "postcss-discard-overridden": "^5.1.0",
+        "postcss-merge-longhand": "^5.1.6",
+        "postcss-merge-rules": "^5.1.2",
+        "postcss-minify-font-values": "^5.1.0",
+        "postcss-minify-gradients": "^5.1.1",
+        "postcss-minify-params": "^5.1.3",
+        "postcss-minify-selectors": "^5.2.1",
+        "postcss-normalize-charset": "^5.1.0",
+        "postcss-normalize-display-values": "^5.1.0",
+        "postcss-normalize-positions": "^5.1.1",
+        "postcss-normalize-repeat-style": "^5.1.1",
+        "postcss-normalize-string": "^5.1.0",
+        "postcss-normalize-timing-functions": "^5.1.0",
+        "postcss-normalize-unicode": "^5.1.0",
+        "postcss-normalize-url": "^5.1.0",
+        "postcss-normalize-whitespace": "^5.1.1",
+        "postcss-ordered-values": "^5.1.3",
+        "postcss-reduce-initial": "^5.1.0",
+        "postcss-reduce-transforms": "^5.1.0",
+        "postcss-svgo": "^5.1.0",
+        "postcss-unique-selectors": "^5.1.1"
+      }
+    },
+    "cssnano-utils": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/cssnano-utils/-/cssnano-utils-3.1.0.tgz",
+      "integrity": "sha512-JQNR19/YZhz4psLX/rQ9M83e3z2Wf/HdJbryzte4a3NSuafyp9w/I4U+hx5C2S9g41qlstH7DEWnZaaj83OuEA==",
+      "dev": true,
+      "requires": {}
+    },
+    "csso": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/csso/-/csso-4.2.0.tgz",
+      "integrity": "sha512-wvlcdIbf6pwKEk7vHj8/Bkc0B4ylXZruLvOgs9doS5eOsOpuodOV2zJChSpkp+pRpYQLQMeF04nr3Z68Sta9jA==",
+      "dev": true,
+      "requires": {
+        "css-tree": "^1.1.2"
+      }
+    },
+    "cssom": {
+      "version": "0.4.4",
+      "resolved": "https://registry.npmjs.org/cssom/-/cssom-0.4.4.tgz",
+      "integrity": "sha512-p3pvU7r1MyyqbTk+WbNJIgJjG2VmTIaB10rI93LzVPrmDJKkzKYMtxxyAvQXR/NS6otuzveI7+7BBq3SjBS2mw==",
+      "dev": true
+    },
+    "cssstyle": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-2.3.0.tgz",
+      "integrity": "sha512-AZL67abkUzIuvcHqk7c09cezpGNcxUxU4Ioi/05xHk4DQeTkWmGYftIE6ctU6AEt+Gn4n1lDStOtj7FKycP71A==",
+      "dev": true,
+      "requires": {
+        "cssom": "~0.3.6"
+      },
+      "dependencies": {
+        "cssom": {
+          "version": "0.3.8",
+          "resolved": "https://registry.npmjs.org/cssom/-/cssom-0.3.8.tgz",
+          "integrity": "sha512-b0tGHbfegbhPJpxpiBPU2sCkigAqtM9O121le6bbOlgyV+NyGyCmVfJ6QW9eRjz8CpNfWEOYBIMIGRYkLwsIYg==",
+          "dev": true
+        }
+      }
+    },
+    "csstype": {
+      "version": "2.6.20",
+      "resolved": "https://registry.npmjs.org/csstype/-/csstype-2.6.20.tgz",
+      "integrity": "sha512-/WwNkdXfckNgw6S5R125rrW8ez139lBHWouiBvX8dfMFtcn6V81REDqnH7+CRpRipfYlyU1CmOnOxrmGcFOjeA=="
+    },
+    "data-urls": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-2.0.0.tgz",
+      "integrity": "sha512-X5eWTSXO/BJmpdIKCRuKUgSCgAN0OwliVK3yPKbwIWU1Tdw5BRajxlzMidvh+gwko9AfQ9zIj52pzF91Q3YAvQ==",
+      "dev": true,
+      "requires": {
+        "abab": "^2.0.3",
+        "whatwg-mimetype": "^2.3.0",
+        "whatwg-url": "^8.0.0"
+      },
+      "dependencies": {
+        "tr46": {
+          "version": "2.1.0",
+          "resolved": "https://registry.npmjs.org/tr46/-/tr46-2.1.0.tgz",
+          "integrity": "sha512-15Ih7phfcdP5YxqiB+iDtLoaTz4Nd35+IiAv0kQ5FNKHzXgdWqPoTIqEDDJmXceQt4JZk6lVPT8lnDlPpGDppw==",
+          "dev": true,
+          "requires": {
+            "punycode": "^2.1.1"
+          }
+        },
+        "webidl-conversions": {
+          "version": "6.1.0",
+          "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-6.1.0.tgz",
+          "integrity": "sha512-qBIvFLGiBpLjfwmYAaHPXsn+ho5xZnGvyGvsarywGNc8VyQJUMHJ8OBKGGrPER0okBeMDaan4mNBlgBROxuI8w==",
+          "dev": true
+        },
+        "whatwg-url": {
+          "version": "8.7.0",
+          "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-8.7.0.tgz",
+          "integrity": "sha512-gAojqb/m9Q8a5IV96E3fHJM70AzCkgt4uXYX2O7EmuyOnLrViCQlsEBmF9UQIu3/aeAIp2U17rtbpZWNntQqdg==",
+          "dev": true,
+          "requires": {
+            "lodash": "^4.7.0",
+            "tr46": "^2.1.0",
+            "webidl-conversions": "^6.1.0"
+          }
+        }
+      }
+    },
+    "debounce": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/debounce/-/debounce-1.2.1.tgz",
+      "integrity": "sha512-XRRe6Glud4rd/ZGQfiV1ruXSfbvfJedlV9Y6zOlP+2K04vBYiJEte6stfFkCP03aMnY5tsipamumUjL14fofug=="
+    },
+    "debug": {
+      "version": "4.3.4",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
+      "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+      "dev": true,
+      "requires": {
+        "ms": "2.1.2"
+      }
+    },
+    "decimal.js": {
+      "version": "10.3.1",
+      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.3.1.tgz",
+      "integrity": "sha512-V0pfhfr8suzyPGOx3nmq4aHqabehUZn6Ch9kyFpV79TGDTWFmHqUqXdabR7QHqxzrYolF4+tVmJhUG4OURg5dQ==",
+      "dev": true
+    },
+    "dedent": {
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/dedent/-/dedent-0.7.0.tgz",
+      "integrity": "sha512-Q6fKUPqnAHAyhiUgFU7BUzLiv0kd8saH9al7tnu5Q/okj6dnupxyTgFIBjVzJATdfIAm9NAsvXNzjaKa+bxVyA==",
+      "dev": true
+    },
+    "deep-is": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
+      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
+      "dev": true
+    },
+    "deepmerge": {
+      "version": "1.5.2",
+      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-1.5.2.tgz",
+      "integrity": "sha512-95k0GDqvBjZavkuvzx/YqVLv/6YYa17fz6ILMSf7neqQITCPbnfEnQvEgMPNjH4kgobe7+WIL0yJEHku+H3qtQ==",
+      "dev": true
+    },
+    "default-gateway": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/default-gateway/-/default-gateway-6.0.3.tgz",
+      "integrity": "sha512-fwSOJsbbNzZ/CUFpqFBqYfYNLj1NbMPm8MMCIzHjC83iSJRBEGmDUxU+WP661BaBQImeC2yHwXtz+P/O9o+XEg==",
+      "dev": true,
+      "requires": {
+        "execa": "^5.0.0"
+      },
+      "dependencies": {
+        "cross-spawn": {
+          "version": "7.0.3",
+          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+          "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+          "dev": true,
+          "requires": {
+            "path-key": "^3.1.0",
+            "shebang-command": "^2.0.0",
+            "which": "^2.0.1"
+          }
+        },
+        "execa": {
+          "version": "5.1.1",
+          "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
+          "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
+          "dev": true,
+          "requires": {
+            "cross-spawn": "^7.0.3",
+            "get-stream": "^6.0.0",
+            "human-signals": "^2.1.0",
+            "is-stream": "^2.0.0",
+            "merge-stream": "^2.0.0",
+            "npm-run-path": "^4.0.1",
+            "onetime": "^5.1.2",
+            "signal-exit": "^3.0.3",
+            "strip-final-newline": "^2.0.0"
+          }
+        },
+        "get-stream": {
+          "version": "6.0.1",
+          "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
+          "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
+          "dev": true
+        },
+        "is-stream": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+          "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+          "dev": true
+        },
+        "npm-run-path": {
+          "version": "4.0.1",
+          "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
+          "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
+          "dev": true,
+          "requires": {
+            "path-key": "^3.0.0"
+          }
+        },
+        "path-key": {
+          "version": "3.1.1",
+          "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+          "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+          "dev": true
+        },
+        "shebang-command": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+          "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+          "dev": true,
+          "requires": {
+            "shebang-regex": "^3.0.0"
+          }
+        },
+        "shebang-regex": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+          "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+          "dev": true
+        },
+        "which": {
+          "version": "2.0.2",
+          "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+          "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+          "dev": true,
+          "requires": {
+            "isexe": "^2.0.0"
+          }
+        }
+      }
+    },
+    "defaults": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/defaults/-/defaults-1.0.3.tgz",
+      "integrity": "sha512-s82itHOnYrN0Ib8r+z7laQz3sdE+4FP3d9Q7VLO7U+KRT+CR0GsWuyHxzdAY82I7cXv0G/twrqomTJLOssO5HA==",
+      "dev": true,
+      "requires": {
+        "clone": "^1.0.2"
+      }
+    },
+    "define-lazy-prop": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/define-lazy-prop/-/define-lazy-prop-2.0.0.tgz",
+      "integrity": "sha512-Ds09qNh8yw3khSjiJjiUInaGX9xlqZDY7JVryGxdxV7NPeuqQfplOpQ66yJFZut3jLa5zOwkXw1g9EI2uKh4Og==",
+      "dev": true
+    },
+    "define-properties": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.1.4.tgz",
+      "integrity": "sha512-uckOqKcfaVvtBdsVkdPv3XjveQJsNQqmhXgRi8uhvWWuPYZCNlzT8qAyblUgNoXdHdjMTzAqeGjAoli8f+bzPA==",
+      "dev": true,
+      "requires": {
+        "has-property-descriptors": "^1.0.0",
+        "object-keys": "^1.1.1"
+      }
+    },
+    "defined": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/defined/-/defined-1.0.0.tgz",
+      "integrity": "sha512-Y2caI5+ZwS5c3RiNDJ6u53VhQHv+hHKwhkI1iHvceKUHw9Df6EK2zRLfjejRgMuCuxK7PfSWIMwWecceVvThjQ==",
+      "dev": true
+    },
+    "delayed-stream": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
+      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
+      "dev": true
+    },
+    "delegate": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/delegate/-/delegate-3.2.0.tgz",
+      "integrity": "sha512-IofjkYBZaZivn0V8nnsMJGBr4jVLxHDheKSW88PyxS5QC4Vo9ZbZVvhzlSxY87fVq3STR6r+4cGepyHkcWOQSw=="
+    },
+    "depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "dev": true
+    },
+    "destroy": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
+      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
+      "dev": true
+    },
+    "detect-newline": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz",
+      "integrity": "sha512-TLz+x/vEXm/Y7P7wn1EJFNLxYpUD4TgMosxY6fAVJUnJMbupHBOncxyWUG9OpTaH9EBD7uFI5LfEgmMOc54DsA==",
+      "dev": true
+    },
+    "detect-node": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/detect-node/-/detect-node-2.1.0.tgz",
+      "integrity": "sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g==",
+      "dev": true
+    },
+    "detective": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/detective/-/detective-5.2.1.tgz",
+      "integrity": "sha512-v9XE1zRnz1wRtgurGu0Bs8uHKFSTdteYZNbIPFVhUZ39L/S79ppMpdmVOZAnoz1jfEFodc48n6MX483Xo3t1yw==",
+      "dev": true,
+      "requires": {
+        "acorn-node": "^1.8.2",
+        "defined": "^1.0.0",
+        "minimist": "^1.2.6"
+      }
+    },
+    "didyoumean": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/didyoumean/-/didyoumean-1.2.2.tgz",
+      "integrity": "sha512-gxtyfqMg7GKyhQmb056K7M3xszy/myH8w+B4RT+QXBQsvAOdc3XymqDDPHx1BgPgsdAA5SIifona89YtRATDzw==",
+      "dev": true
+    },
+    "diff": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.2.tgz",
+      "integrity": "sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A==",
+      "dev": true
+    },
+    "diff-sequences": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/diff-sequences/-/diff-sequences-27.5.1.tgz",
+      "integrity": "sha512-k1gCAXAsNgLwEL+Y8Wvl+M6oEFj5bgazfZULpS5CneoPPXRaCCW7dm+q21Ky2VEE5X+VeRDBVg1Pcvvsr4TtNQ==",
+      "dev": true
+    },
+    "dir-glob": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/dir-glob/-/dir-glob-3.0.1.tgz",
+      "integrity": "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==",
+      "dev": true,
+      "requires": {
+        "path-type": "^4.0.0"
+      }
+    },
+    "dlv": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/dlv/-/dlv-1.1.3.tgz",
+      "integrity": "sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==",
+      "dev": true
+    },
+    "dns-equal": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/dns-equal/-/dns-equal-1.0.0.tgz",
+      "integrity": "sha512-z+paD6YUQsk+AbGCEM4PrOXSss5gd66QfcVBFTKR/HpFL9jCqikS94HYwKww6fQyO7IxrIIyUu+g0Ka9tUS2Cg==",
+      "dev": true
+    },
+    "dns-packet": {
+      "version": "5.4.0",
+      "resolved": "https://registry.npmjs.org/dns-packet/-/dns-packet-5.4.0.tgz",
+      "integrity": "sha512-EgqGeaBB8hLiHLZtp/IbaDQTL8pZ0+IvwzSHA6d7VyMDM+B9hgddEMa9xjK5oYnw0ci0JQ6g2XCD7/f6cafU6g==",
+      "dev": true,
+      "requires": {
+        "@leichtgewicht/ip-codec": "^2.0.1"
+      }
+    },
+    "doctrine": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz",
+      "integrity": "sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==",
+      "dev": true,
+      "requires": {
+        "esutils": "^2.0.2"
+      }
+    },
+    "dom-converter": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/dom-converter/-/dom-converter-0.2.0.tgz",
+      "integrity": "sha512-gd3ypIPfOMr9h5jIKq8E3sHOTCjeirnl0WK5ZdS1AW0Odt0b1PaWaHdJ4Qk4klv+YB9aJBS7mESXjFoDQPu6DA==",
+      "dev": true,
+      "requires": {
+        "utila": "~0.4"
+      }
+    },
+    "dom-serializer": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-1.4.1.tgz",
+      "integrity": "sha512-VHwB3KfrcOOkelEG2ZOfxqLZdfkil8PtJi4P8N2MMXucZq2yLp75ClViUlOVwyoHEDjYU433Aq+5zWP61+RGag==",
+      "dev": true,
+      "requires": {
+        "domelementtype": "^2.0.1",
+        "domhandler": "^4.2.0",
+        "entities": "^2.0.0"
+      }
+    },
+    "domelementtype": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.3.0.tgz",
+      "integrity": "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==",
+      "dev": true
+    },
+    "domexception": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/domexception/-/domexception-2.0.1.tgz",
+      "integrity": "sha512-yxJ2mFy/sibVQlu5qHjOkf9J3K6zgmCxgJ94u2EdvDOV09H+32LtRswEcUsmUWN72pVLOEnTSRaIVVzVQgS0dg==",
+      "dev": true,
+      "requires": {
+        "webidl-conversions": "^5.0.0"
+      },
+      "dependencies": {
+        "webidl-conversions": {
+          "version": "5.0.0",
+          "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-5.0.0.tgz",
+          "integrity": "sha512-VlZwKPCkYKxQgeSbH5EyngOmRp7Ww7I9rQLERETtf5ofd9pGeswWiOtogpEO850jziPRarreGxn5QIiTqpb2wA==",
+          "dev": true
+        }
+      }
+    },
+    "domhandler": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/domhandler/-/domhandler-4.3.1.tgz",
+      "integrity": "sha512-GrwoxYN+uWlzO8uhUXRl0P+kHE4GtVPfYzVLcUxPL7KNdHKj66vvlhiweIHqYYXWlw+T8iLMp42Lm67ghw4WMQ==",
+      "dev": true,
+      "requires": {
+        "domelementtype": "^2.2.0"
+      }
+    },
+    "domutils": {
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/domutils/-/domutils-2.8.0.tgz",
+      "integrity": "sha512-w96Cjofp72M5IIhpjgobBimYEfoPjx1Vx0BSX9P30WBdZW2WIKU0T1Bd0kz2eNZ9ikjKgHbEyKx8BB6H1L3h3A==",
+      "dev": true,
+      "requires": {
+        "dom-serializer": "^1.0.1",
+        "domelementtype": "^2.2.0",
+        "domhandler": "^4.2.0"
+      }
+    },
+    "dot-case": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/dot-case/-/dot-case-3.0.4.tgz",
+      "integrity": "sha512-Kv5nKlh6yRrdrGvxeJ2e5y2eRUpkUosIW4A2AS38zwSz27zu7ufDwQPi5Jhs3XAlGNetl3bmnGhQsMtkKJnj3w==",
+      "dev": true,
+      "requires": {
+        "no-case": "^3.0.4",
+        "tslib": "^2.0.3"
+      }
+    },
+    "dotenv": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-10.0.0.tgz",
+      "integrity": "sha512-rlBi9d8jpv9Sf1klPjNfFAuWDjKLwTIJJ/VxtoTwIR6hnZxcEOQCZg2oIL3MWBYw5GpUDKOEnND7LXTbIpQ03Q==",
+      "dev": true
+    },
+    "dotenv-expand": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/dotenv-expand/-/dotenv-expand-5.1.0.tgz",
+      "integrity": "sha512-YXQl1DSa4/PQyRfgrv6aoNjhasp/p4qs9FjJ4q4cQk+8m4r6k4ZSiEyytKG8f8W9gi8WsQtIObNmKd+tMzNTmA==",
+      "dev": true
+    },
+    "duplexer": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/duplexer/-/duplexer-0.1.2.tgz",
+      "integrity": "sha512-jtD6YG370ZCIi/9GTaJKQxWTZD045+4R4hTk/x1UyoqadyJ9x9CgSi1RlVDQF8U2sxLLSnFkCaMihqljHIWgMg==",
+      "dev": true
+    },
+    "easy-stack": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/easy-stack/-/easy-stack-1.0.1.tgz",
+      "integrity": "sha512-wK2sCs4feiiJeFXn3zvY0p41mdU5VUgbgs1rNsc/y5ngFUijdWd+iIN8eoyuZHKB8xN6BL4PdWmzqFmxNg6V2w==",
+      "dev": true
+    },
+    "editorconfig": {
+      "version": "0.15.3",
+      "resolved": "https://registry.npmjs.org/editorconfig/-/editorconfig-0.15.3.tgz",
+      "integrity": "sha512-M9wIMFx96vq0R4F+gRpY3o2exzb8hEj/n9S8unZtHSvYjibBp/iMufSzvmOcV/laG0ZtuTVGtiJggPOSW2r93g==",
+      "dev": true,
+      "requires": {
+        "commander": "^2.19.0",
+        "lru-cache": "^4.1.5",
+        "semver": "^5.6.0",
+        "sigmund": "^1.0.1"
+      },
+      "dependencies": {
+        "commander": {
+          "version": "2.20.3",
+          "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+          "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+          "dev": true
+        },
+        "lru-cache": {
+          "version": "4.1.5",
+          "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-4.1.5.tgz",
+          "integrity": "sha512-sWZlbEP2OsHNkXrMl5GYk/jKk70MBng6UU4YI/qGDYbgf6YbP4EvmqISbXCoJiRKs+1bSpFHVgQxvJ17F2li5g==",
+          "dev": true,
+          "requires": {
+            "pseudomap": "^1.0.2",
+            "yallist": "^2.1.2"
+          }
+        },
+        "semver": {
+          "version": "5.7.2",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+          "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
+          "dev": true
+        },
+        "yallist": {
+          "version": "2.1.2",
+          "resolved": "https://registry.npmjs.org/yallist/-/yallist-2.1.2.tgz",
+          "integrity": "sha512-ncTzHV7NvsQZkYe1DW7cbDLm0YpzHmZF5r/iyP3ZnQtMiJ+pjzisCiMNI+Sj+xQF5pXhSHxSB3uDbsBTzY/c2A==",
+          "dev": true
+        }
+      }
+    },
+    "ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+      "dev": true
+    },
+    "electron-to-chromium": {
+      "version": "1.4.482",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.482.tgz",
+      "integrity": "sha512-h+UqpfmEr1Qkk0zp7ej/jid7CXoq4m4QzW6wNTb0ELJ/BZCpA4wgUylBIMGCe621tnr4l5VmoHjdoSx2lbnNJA==",
+      "dev": true
+    },
+    "emittery": {
+      "version": "0.10.2",
+      "resolved": "https://registry.npmjs.org/emittery/-/emittery-0.10.2.tgz",
+      "integrity": "sha512-aITqOwnLanpHLNXZJENbOgjUBeHocD+xsSJmNrjovKBW5HbSpW3d1pEls7GFQPUWXiwG9+0P4GtHfEqC/4M0Iw==",
+      "dev": true
+    },
+    "emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true
+    },
+    "emojis-list": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/emojis-list/-/emojis-list-3.0.0.tgz",
+      "integrity": "sha512-/kyM18EfinwXZbno9FyUGeFh87KC8HRQBQGildHZbEuRyWFOmv1U10o9BBp8XVZDVNNuQKyIGIu5ZYAAXJ0V2Q==",
+      "dev": true
+    },
+    "encodeurl": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
+      "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==",
+      "dev": true
+    },
+    "end-of-stream": {
+      "version": "1.4.4",
+      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz",
+      "integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==",
+      "dev": true,
+      "requires": {
+        "once": "^1.4.0"
+      }
+    },
+    "enhanced-resolve": {
+      "version": "5.14.0",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.14.0.tgz",
+      "integrity": "sha512-+DCows0XNwLDcUhbFJPdlQEVnT2zXlCv7hPxemTz86/O+B/hCQ+mb7ydkPKiflpVraqLPCAfu7lDy+hBXueojw==",
+      "dev": true,
+      "requires": {
+        "graceful-fs": "^4.2.4",
+        "tapable": "^2.2.0"
+      }
+    },
+    "enquirer": {
+      "version": "2.3.6",
+      "resolved": "https://registry.npmjs.org/enquirer/-/enquirer-2.3.6.tgz",
+      "integrity": "sha512-yjNnPr315/FjS4zIsUxYguYUPP2e1NK4d7E7ZOLiyYCcbFBiTMyID+2wvm2w6+pZ/odMA7cRkjhsPbltwBOrLg==",
+      "dev": true,
+      "requires": {
+        "ansi-colors": "^4.1.1"
+      }
+    },
+    "entities": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/entities/-/entities-2.2.0.tgz",
+      "integrity": "sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==",
+      "dev": true
+    },
+    "error-ex": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.2.tgz",
+      "integrity": "sha512-7dFHNmqeFSEt2ZBsCriorKnn3Z2pj+fd9kmI6QoWw4//DL+icEBfc0U7qJCisqrTsKTjw4fNFy2pW9OqStD84g==",
+      "dev": true,
+      "requires": {
+        "is-arrayish": "^0.2.1"
+      }
+    },
+    "error-stack-parser": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/error-stack-parser/-/error-stack-parser-2.1.4.tgz",
+      "integrity": "sha512-Sk5V6wVazPhq5MhpO+AUxJn5x7XSXGl1R93Vn7i+zS15KDVxQijejNCrz8340/2bgLBjR9GtEG8ZVKONDjcqGQ==",
+      "dev": true,
+      "requires": {
+        "stackframe": "^1.3.4"
+      }
+    },
+    "es-cookie": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/es-cookie/-/es-cookie-1.3.2.tgz",
+      "integrity": "sha512-UTlYYhXGLOy05P/vKVT2Ui7WtC7NiRzGtJyAKKn32g5Gvcjn7KAClLPWlipCtxIus934dFg9o9jXiBL0nP+t9Q=="
+    },
+    "es-module-lexer": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.2.1.tgz",
+      "integrity": "sha512-9978wrXM50Y4rTMmW5kXIC09ZdXQZqkE4mxhwkd8VbzsGkXGPgV4zWuqQJgCEzYngdo2dYDa0l8xhX4fkSwJSg==",
+      "dev": true
+    },
+    "escalade": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
+      "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==",
+      "dev": true
+    },
+    "escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+      "dev": true
+    },
+    "escape-string-regexp": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
+      "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
+      "dev": true
+    },
+    "escodegen": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/escodegen/-/escodegen-2.0.0.tgz",
+      "integrity": "sha512-mmHKys/C8BFUGI+MAWNcSYoORYLMdPzjrknd2Vc+bUsjN5bXcr8EhrNB+UTqfL1y3I9c4fw2ihgtMPQLBRiQxw==",
+      "dev": true,
+      "requires": {
+        "esprima": "^4.0.1",
+        "estraverse": "^5.2.0",
+        "esutils": "^2.0.2",
+        "optionator": "^0.8.1",
+        "source-map": "~0.6.1"
+      },
+      "dependencies": {
+        "estraverse": {
+          "version": "5.3.0",
+          "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+          "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+          "dev": true
+        },
+        "levn": {
+          "version": "0.3.0",
+          "resolved": "https://registry.npmjs.org/levn/-/levn-0.3.0.tgz",
+          "integrity": "sha512-0OO4y2iOHix2W6ujICbKIaEQXvFQHue65vUG3pb5EUomzPI90z9hsA1VsO/dbIIpC53J8gxM9Q4Oho0jrCM/yA==",
+          "dev": true,
+          "requires": {
+            "prelude-ls": "~1.1.2",
+            "type-check": "~0.3.2"
+          }
+        },
+        "optionator": {
+          "version": "0.8.3",
+          "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.8.3.tgz",
+          "integrity": "sha512-+IW9pACdk3XWmmTXG8m3upGUJst5XRGzxMRjXzAuJ1XnIFNvfhjjIuYkDvysnPQ7qzqVzLt78BCruntqRhWQbA==",
+          "dev": true,
+          "requires": {
+            "deep-is": "~0.1.3",
+            "fast-levenshtein": "~2.0.6",
+            "levn": "~0.3.0",
+            "prelude-ls": "~1.1.2",
+            "type-check": "~0.3.2",
+            "word-wrap": "~1.2.3"
+          }
+        },
+        "prelude-ls": {
+          "version": "1.1.2",
+          "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.1.2.tgz",
+          "integrity": "sha512-ESF23V4SKG6lVSGZgYNpbsiaAkdab6ZgOxe52p7+Kid3W3u3bxR4Vfd/o21dmN7jSt0IwgZ4v5MUd26FEtXE9w==",
+          "dev": true
+        },
+        "type-check": {
+          "version": "0.3.2",
+          "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.3.2.tgz",
+          "integrity": "sha512-ZCmOJdvOWDBYJlzAoFkC+Q0+bUyEOS1ltgp1MGU03fqHG+dbi9tBFU2Rd9QKiDZFAYrhPh2JUf7rZRIuHRKtOg==",
+          "dev": true,
+          "requires": {
+            "prelude-ls": "~1.1.2"
+          }
+        }
+      }
+    },
+    "eslint": {
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.18.0.tgz",
+      "integrity": "sha512-As1EfFMVk7Xc6/CvhssHUjsAQSkpfXvUGMFC3ce8JDe6WvqCgRrLOBQbVpsBFr1X1V+RACOadnzVvcUS5ni2bA==",
+      "dev": true,
+      "requires": {
+        "@eslint/eslintrc": "^1.3.0",
+        "@humanwhocodes/config-array": "^0.9.2",
+        "ajv": "^6.10.0",
+        "chalk": "^4.0.0",
+        "cross-spawn": "^7.0.2",
+        "debug": "^4.3.2",
+        "doctrine": "^3.0.0",
+        "escape-string-regexp": "^4.0.0",
+        "eslint-scope": "^7.1.1",
+        "eslint-utils": "^3.0.0",
+        "eslint-visitor-keys": "^3.3.0",
+        "espree": "^9.3.2",
+        "esquery": "^1.4.0",
+        "esutils": "^2.0.2",
+        "fast-deep-equal": "^3.1.3",
+        "file-entry-cache": "^6.0.1",
+        "functional-red-black-tree": "^1.0.1",
+        "glob-parent": "^6.0.1",
+        "globals": "^13.15.0",
+        "ignore": "^5.2.0",
+        "import-fresh": "^3.0.0",
+        "imurmurhash": "^0.1.4",
+        "is-glob": "^4.0.0",
+        "js-yaml": "^4.1.0",
+        "json-stable-stringify-without-jsonify": "^1.0.1",
+        "levn": "^0.4.1",
+        "lodash.merge": "^4.6.2",
+        "minimatch": "^3.1.2",
+        "natural-compare": "^1.4.0",
+        "optionator": "^0.9.1",
+        "regexpp": "^3.2.0",
+        "strip-ansi": "^6.0.1",
+        "strip-json-comments": "^3.1.0",
+        "text-table": "^0.2.0",
+        "v8-compile-cache": "^2.0.3"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "cross-spawn": {
+          "version": "7.0.3",
+          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+          "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+          "dev": true,
+          "requires": {
+            "path-key": "^3.1.0",
+            "shebang-command": "^2.0.0",
+            "which": "^2.0.1"
+          }
+        },
+        "escape-string-regexp": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+          "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+          "dev": true
+        },
+        "eslint-scope": {
+          "version": "7.1.1",
+          "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.1.1.tgz",
+          "integrity": "sha512-QKQM/UXpIiHcLqJ5AOyIW7XZmzjkzQXYE54n1++wb0u9V/abW3l9uQnxX8Z5Xd18xyKIMTUAyQ0k1e8pz6LUrw==",
+          "dev": true,
+          "requires": {
+            "esrecurse": "^4.3.0",
+            "estraverse": "^5.2.0"
+          }
+        },
+        "estraverse": {
+          "version": "5.3.0",
+          "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+          "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+          "dev": true
+        },
+        "globals": {
+          "version": "13.15.0",
+          "resolved": "https://registry.npmjs.org/globals/-/globals-13.15.0.tgz",
+          "integrity": "sha512-bpzcOlgDhMG070Av0Vy5Owklpv1I6+j96GhUI7Rh7IzDCKLzboflLrrfqMu8NquDbiR4EOQk7XzJwqVJxicxog==",
+          "dev": true,
+          "requires": {
+            "type-fest": "^0.20.2"
+          }
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "path-key": {
+          "version": "3.1.1",
+          "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+          "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+          "dev": true
+        },
+        "shebang-command": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+          "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+          "dev": true,
+          "requires": {
+            "shebang-regex": "^3.0.0"
+          }
+        },
+        "shebang-regex": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+          "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        },
+        "type-fest": {
+          "version": "0.20.2",
+          "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
+          "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
+          "dev": true
+        },
+        "which": {
+          "version": "2.0.2",
+          "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+          "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+          "dev": true,
+          "requires": {
+            "isexe": "^2.0.0"
+          }
+        }
+      }
+    },
+    "eslint-plugin-vue": {
+      "version": "9.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-vue/-/eslint-plugin-vue-9.1.1.tgz",
+      "integrity": "sha512-W9n5PB1X2jzC7CK6riG0oAcxjmKrjTF6+keL1rni8n57DZeilx/Fulz+IRJK3lYseLNAygN0I62L7DvioW40Tw==",
+      "dev": true,
+      "requires": {
+        "eslint-utils": "^3.0.0",
+        "natural-compare": "^1.4.0",
+        "nth-check": "^2.0.1",
+        "postcss-selector-parser": "^6.0.9",
+        "semver": "^7.3.5",
+        "vue-eslint-parser": "^9.0.1",
+        "xml-name-validator": "^4.0.0"
+      },
+      "dependencies": {
+        "semver": {
+          "version": "7.5.4",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+          "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^6.0.0"
+          }
+        }
+      }
+    },
+    "eslint-scope": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz",
+      "integrity": "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==",
+      "dev": true,
+      "requires": {
+        "esrecurse": "^4.3.0",
+        "estraverse": "^4.1.1"
+      }
+    },
+    "eslint-utils": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/eslint-utils/-/eslint-utils-3.0.0.tgz",
+      "integrity": "sha512-uuQC43IGctw68pJA1RgbQS8/NP7rch6Cwd4j3ZBtgo4/8Flj4eGE7ZYSZRN3iq5pVUv6GPdW5Z1RFleo84uLDA==",
+      "dev": true,
+      "requires": {
+        "eslint-visitor-keys": "^2.0.0"
+      },
+      "dependencies": {
+        "eslint-visitor-keys": {
+          "version": "2.1.0",
+          "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz",
+          "integrity": "sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==",
+          "dev": true
+        }
+      }
+    },
+    "eslint-visitor-keys": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.3.0.tgz",
+      "integrity": "sha512-mQ+suqKJVyeuwGYHAdjMFqjCyfl8+Ldnxuyp3ldiMBFKkvytrXUZWaiPCEav8qDHKty44bD+qV1IP4T+w+xXRA==",
+      "dev": true
+    },
+    "eslint-webpack-plugin": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/eslint-webpack-plugin/-/eslint-webpack-plugin-3.2.0.tgz",
+      "integrity": "sha512-avrKcGncpPbPSUHX6B3stNGzkKFto3eL+DKM4+VyMrVnhPc3vRczVlCq3uhuFOdRvDHTVXuzwk1ZKUrqDQHQ9w==",
+      "dev": true,
+      "requires": {
+        "@types/eslint": "^7.29.0 || ^8.4.1",
+        "jest-worker": "^28.0.2",
+        "micromatch": "^4.0.5",
+        "normalize-path": "^3.0.0",
+        "schema-utils": "^4.0.0"
+      },
+      "dependencies": {
+        "ajv": {
+          "version": "8.11.0",
+          "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.11.0.tgz",
+          "integrity": "sha512-wGgprdCvMalC0BztXvitD2hC04YffAvtsUn93JbGXYLAtCUO4xd17mCCZQxUOItiBwZvJScWo8NIvQMQ71rdpg==",
+          "dev": true,
+          "requires": {
+            "fast-deep-equal": "^3.1.1",
+            "json-schema-traverse": "^1.0.0",
+            "require-from-string": "^2.0.2",
+            "uri-js": "^4.2.2"
+          }
+        },
+        "ajv-keywords": {
+          "version": "5.1.0",
+          "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-5.1.0.tgz",
+          "integrity": "sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw==",
+          "dev": true,
+          "requires": {
+            "fast-deep-equal": "^3.1.3"
+          }
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-worker": {
+          "version": "28.1.1",
+          "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-28.1.1.tgz",
+          "integrity": "sha512-Au7slXB08C6h+xbJPp7VIb6U0XX5Kc9uel/WFc6/rcTzGiaVCBRngBExSYuXSLFPULPSYU3cJ3ybS988lNFQhQ==",
+          "dev": true,
+          "requires": {
+            "@types/node": "*",
+            "merge-stream": "^2.0.0",
+            "supports-color": "^8.0.0"
+          }
+        },
+        "json-schema-traverse": {
+          "version": "1.0.0",
+          "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+          "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+          "dev": true
+        },
+        "schema-utils": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.0.0.tgz",
+          "integrity": "sha512-1edyXKgh6XnJsJSQ8mKWXnN/BVaIbFMLpouRUrXgVq7WYne5kw3MW7UPhO44uRXQSIpTSXoJbmrR2X0w9kUTyg==",
+          "dev": true,
+          "requires": {
+            "@types/json-schema": "^7.0.9",
+            "ajv": "^8.8.0",
+            "ajv-formats": "^2.1.1",
+            "ajv-keywords": "^5.0.0"
+          }
+        },
+        "supports-color": {
+          "version": "8.1.1",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
+          "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "espree": {
+      "version": "9.3.2",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-9.3.2.tgz",
+      "integrity": "sha512-D211tC7ZwouTIuY5x9XnS0E9sWNChB7IYKX/Xp5eQj3nFXhqmiUDB9q27y76oFl8jTg3pXcQx/bpxMfs3CIZbA==",
+      "dev": true,
+      "requires": {
+        "acorn": "^8.7.1",
+        "acorn-jsx": "^5.3.2",
+        "eslint-visitor-keys": "^3.3.0"
+      }
+    },
+    "esprima": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
+      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
+      "dev": true
+    },
+    "esquery": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.4.0.tgz",
+      "integrity": "sha512-cCDispWt5vHHtwMY2YrAQ4ibFkAL8RbH5YGBnZBc90MolvvfkkQcJro/aZiAQUlQ3qgrYS6D6v8Gc5G5CQsc9w==",
+      "dev": true,
+      "requires": {
+        "estraverse": "^5.1.0"
+      },
+      "dependencies": {
+        "estraverse": {
+          "version": "5.3.0",
+          "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+          "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+          "dev": true
+        }
+      }
+    },
+    "esrecurse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
+      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
+      "dev": true,
+      "requires": {
+        "estraverse": "^5.2.0"
+      },
+      "dependencies": {
+        "estraverse": {
+          "version": "5.3.0",
+          "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+          "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+          "dev": true
+        }
+      }
+    },
+    "estraverse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
+      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
+      "dev": true
+    },
+    "estree-walker": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-2.0.2.tgz",
+      "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w=="
+    },
+    "esutils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+      "dev": true
+    },
+    "etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
+      "dev": true
+    },
+    "event-pubsub": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/event-pubsub/-/event-pubsub-4.3.0.tgz",
+      "integrity": "sha512-z7IyloorXvKbFx9Bpie2+vMJKKx1fH1EN5yiTfp8CiLOTptSYy1g8H4yDpGlEdshL1PBiFtBHepF2cNsqeEeFQ==",
+      "dev": true
+    },
+    "eventemitter3": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-4.0.7.tgz",
+      "integrity": "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==",
+      "dev": true
+    },
+    "events": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
+      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
+      "dev": true
+    },
+    "execa": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/execa/-/execa-1.0.0.tgz",
+      "integrity": "sha512-adbxcyWV46qiHyvSp50TKt05tB4tK3HcmF7/nxfAdhnox83seTDbwnaqKO4sXRy7roHAIFqJP/Rw/AuEbX61LA==",
+      "dev": true,
+      "requires": {
+        "cross-spawn": "^6.0.0",
+        "get-stream": "^4.0.0",
+        "is-stream": "^1.1.0",
+        "npm-run-path": "^2.0.0",
+        "p-finally": "^1.0.0",
+        "signal-exit": "^3.0.0",
+        "strip-eof": "^1.0.0"
+      }
+    },
+    "exit": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/exit/-/exit-0.1.2.tgz",
+      "integrity": "sha512-Zk/eNKV2zbjpKzrsQ+n1G6poVbErQxJ0LBOJXaKZ1EViLzH+hrLu9cdXI4zw9dBQJslwBEpbQ2P1oS7nDxs6jQ==",
+      "dev": true
+    },
+    "expect": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/expect/-/expect-27.5.1.tgz",
+      "integrity": "sha512-E1q5hSUG2AmYQwQJ041nvgpkODHQvB+RKlB4IYdru6uJsyFTRyZAP463M+1lINorwbqAmUggi6+WwkD8lCS/Dw==",
+      "dev": true,
+      "requires": {
+        "@jest/types": "^27.5.1",
+        "jest-get-type": "^27.5.1",
+        "jest-matcher-utils": "^27.5.1",
+        "jest-message-util": "^27.5.1"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-message-util": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+          "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+          "dev": true,
+          "requires": {
+            "@babel/code-frame": "^7.12.13",
+            "@jest/types": "^27.5.1",
+            "@types/stack-utils": "^2.0.0",
+            "chalk": "^4.0.0",
+            "graceful-fs": "^4.2.9",
+            "micromatch": "^4.0.4",
+            "pretty-format": "^27.5.1",
+            "slash": "^3.0.0",
+            "stack-utils": "^2.0.3"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "express": {
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.18.1.tgz",
+      "integrity": "sha512-zZBcOX9TfehHQhtupq57OF8lFZ3UZi08Y97dwFCkD8p9d/d2Y3M+ykKcwaMDEL+4qyUolgBDX6AblpR3fL212Q==",
+      "dev": true,
+      "requires": {
+        "accepts": "~1.3.8",
+        "array-flatten": "1.1.1",
+        "body-parser": "1.20.0",
+        "content-disposition": "0.5.4",
+        "content-type": "~1.0.4",
+        "cookie": "0.5.0",
+        "cookie-signature": "1.0.6",
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "finalhandler": "1.2.0",
+        "fresh": "0.5.2",
+        "http-errors": "2.0.0",
+        "merge-descriptors": "1.0.1",
+        "methods": "~1.1.2",
+        "on-finished": "2.4.1",
+        "parseurl": "~1.3.3",
+        "path-to-regexp": "0.1.7",
+        "proxy-addr": "~2.0.7",
+        "qs": "6.10.3",
+        "range-parser": "~1.2.1",
+        "safe-buffer": "5.2.1",
+        "send": "0.18.0",
+        "serve-static": "1.15.0",
+        "setprototypeof": "1.2.0",
+        "statuses": "2.0.1",
+        "type-is": "~1.6.18",
+        "utils-merge": "1.0.1",
+        "vary": "~1.1.2"
+      },
+      "dependencies": {
+        "array-flatten": {
+          "version": "1.1.1",
+          "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
+          "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
+          "dev": true
+        },
+        "debug": {
+          "version": "2.6.9",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+          "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+          "dev": true,
+          "requires": {
+            "ms": "2.0.0"
+          }
+        },
+        "ms": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+          "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+          "dev": true
+        },
+        "safe-buffer": {
+          "version": "5.2.1",
+          "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+          "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+          "dev": true
+        }
+      }
+    },
+    "extend-shallow": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
+      "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==",
+      "dev": true,
+      "requires": {
+        "is-extendable": "^0.1.0"
+      }
+    },
+    "fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "dev": true
+    },
+    "fast-glob": {
+      "version": "3.2.11",
+      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.2.11.tgz",
+      "integrity": "sha512-xrO3+1bxSo3ZVHAnqzyuewYT6aMFHRAd4Kcs92MAonjwQZLsK9d0SF1IyQ3k5PoirxTW0Oe/RqFgMQ6TcNE5Ew==",
+      "dev": true,
+      "requires": {
+        "@nodelib/fs.stat": "^2.0.2",
+        "@nodelib/fs.walk": "^1.2.3",
+        "glob-parent": "^5.1.2",
+        "merge2": "^1.3.0",
+        "micromatch": "^4.0.4"
+      },
+      "dependencies": {
+        "glob-parent": {
+          "version": "5.1.2",
+          "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+          "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+          "dev": true,
+          "requires": {
+            "is-glob": "^4.0.1"
+          }
+        }
+      }
+    },
+    "fast-json-stable-stringify": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
+      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
+      "dev": true
+    },
+    "fast-levenshtein": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
+      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
+      "dev": true
+    },
+    "fast-text-encoding": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/fast-text-encoding/-/fast-text-encoding-1.0.6.tgz",
+      "integrity": "sha512-VhXlQgj9ioXCqGstD37E/HBeqEGV/qOD/kmbVG8h5xKBYvM1L3lR1Zn4555cQ8GkYbJa8aJSipLPndE1k6zK2w=="
+    },
+    "fastq": {
+      "version": "1.13.0",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.13.0.tgz",
+      "integrity": "sha512-YpkpUnK8od0o1hmeSc7UUs/eB/vIPWJYjKck2QKIzAf71Vm1AAQ3EbuZB3g2JIy+pg+ERD0vqI79KyZiB2e2Nw==",
+      "dev": true,
+      "requires": {
+        "reusify": "^1.0.4"
+      }
+    },
+    "faye-websocket": {
+      "version": "0.11.4",
+      "resolved": "https://registry.npmjs.org/faye-websocket/-/faye-websocket-0.11.4.tgz",
+      "integrity": "sha512-CzbClwlXAuiRQAlUyfqPgvPoNKTckTPGfwZV4ZdAhVcP2lh9KUxJg2b5GkE7XbjKQ3YJnQ9z6D9ntLAlB+tP8g==",
+      "dev": true,
+      "requires": {
+        "websocket-driver": ">=0.5.1"
+      }
+    },
+    "fb-watchman": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.1.tgz",
+      "integrity": "sha512-DkPJKQeY6kKwmuMretBhr7G6Vodr7bFwDYTXIkfG1gjvNpaxBTQV3PbXg6bR1c1UP4jPOX0jHUbbHANL9vRjVg==",
+      "dev": true,
+      "requires": {
+        "bser": "2.1.1"
+      }
+    },
+    "fetch-intercept": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/fetch-intercept/-/fetch-intercept-2.4.0.tgz",
+      "integrity": "sha512-BPZ2LM9Dh1ua2ovQf03N6rhWg1qxdVD5qK/G4llvcemt6M+jjxCuIDxJ+6IiG+uz//3UQmgfKEv0gOGvYIxZ7g=="
+    },
+    "figures": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/figures/-/figures-2.0.0.tgz",
+      "integrity": "sha512-Oa2M9atig69ZkfwiApY8F2Yy+tzMbazyvqv21R0NsSC8floSOC09BbT1ITWAdoMGQvJ/aZnR1KMwdx9tvHnTNA==",
+      "dev": true,
+      "requires": {
+        "escape-string-regexp": "^1.0.5"
+      }
+    },
+    "file-entry-cache": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
+      "integrity": "sha512-7Gps/XWymbLk2QLYK4NzpMOrYjMhdIxXuIvy2QBsLE6ljuodKvdkWs/cpyJJ3CVIVpH0Oi1Hvg1ovbMzLdFBBg==",
+      "dev": true,
+      "requires": {
+        "flat-cache": "^3.0.4"
+      }
+    },
+    "fill-range": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
+      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
+      "dev": true,
+      "requires": {
+        "to-regex-range": "^5.0.1"
+      }
+    },
+    "finalhandler": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.2.0.tgz",
+      "integrity": "sha512-5uXcUVftlQMFnWC9qu/svkWv3GTd2PfUhK/3PLkYNAe7FbqJMt3515HaxE6eRL74GdsriiwujiawdaB1BpEISg==",
+      "dev": true,
+      "requires": {
+        "debug": "2.6.9",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "on-finished": "2.4.1",
+        "parseurl": "~1.3.3",
+        "statuses": "2.0.1",
+        "unpipe": "~1.0.0"
+      },
+      "dependencies": {
+        "debug": {
+          "version": "2.6.9",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+          "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+          "dev": true,
+          "requires": {
+            "ms": "2.0.0"
+          }
+        },
+        "ms": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+          "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+          "dev": true
+        }
+      }
+    },
+    "find-cache-dir": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/find-cache-dir/-/find-cache-dir-3.3.2.tgz",
+      "integrity": "sha512-wXZV5emFEjrridIgED11OoUKLxiYjAcqot/NJdAkOhlJ+vGzwhOAfcG5OX1jP+S0PcjEn8bdMJv+g2jwQ3Onig==",
+      "dev": true,
+      "requires": {
+        "commondir": "^1.0.1",
+        "make-dir": "^3.0.2",
+        "pkg-dir": "^4.1.0"
+      }
+    },
+    "find-up": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
+      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
+      "dev": true,
+      "requires": {
+        "locate-path": "^5.0.0",
+        "path-exists": "^4.0.0"
+      }
+    },
+    "flat-cache": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-3.0.4.tgz",
+      "integrity": "sha512-dm9s5Pw7Jc0GvMYbshN6zchCA9RgQlzzEZX3vylR9IqFfS8XciblUXOKfW6SiuJ0e13eDYZoZV5wdrev7P3Nwg==",
+      "dev": true,
+      "requires": {
+        "flatted": "^3.1.0",
+        "rimraf": "^3.0.2"
+      }
+    },
+    "flatted": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.2.6.tgz",
+      "integrity": "sha512-0sQoMh9s0BYsm+12Huy/rkKxVu4R1+r96YX5cG44rHV0pQ6iC3Q+mkoMFaGWObMFYQxCVT+ssG1ksneA2MI9KQ==",
+      "dev": true
+    },
+    "follow-redirects": {
+      "version": "1.15.1",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.1.tgz",
+      "integrity": "sha512-yLAMQs+k0b2m7cVxpS1VKJVvoz7SS9Td1zss3XRwXj+ZDH00RJgnuLx7E44wx02kQLrdM3aOOy+FpzS7+8OizA==",
+      "dev": true
+    },
+    "fork-ts-checker-webpack-plugin": {
+      "version": "6.5.2",
+      "resolved": "https://registry.npmjs.org/fork-ts-checker-webpack-plugin/-/fork-ts-checker-webpack-plugin-6.5.2.tgz",
+      "integrity": "sha512-m5cUmF30xkZ7h4tWUgTAcEaKmUW7tfyUyTqNNOz7OxWJ0v1VWKTcOvH8FWHUwSjlW/356Ijc9vi3XfcPstpQKA==",
+      "dev": true,
+      "requires": {
+        "@babel/code-frame": "^7.8.3",
+        "@types/json-schema": "^7.0.5",
+        "chalk": "^4.1.0",
+        "chokidar": "^3.4.2",
+        "cosmiconfig": "^6.0.0",
+        "deepmerge": "^4.2.2",
+        "fs-extra": "^9.0.0",
+        "glob": "^7.1.6",
+        "memfs": "^3.1.2",
+        "minimatch": "^3.0.4",
+        "schema-utils": "2.7.0",
+        "semver": "^7.3.2",
+        "tapable": "^1.0.0"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "cosmiconfig": {
+          "version": "6.0.0",
+          "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-6.0.0.tgz",
+          "integrity": "sha512-xb3ZL6+L8b9JLLCx3ZdoZy4+2ECphCMo2PwqgP1tlfVq6M6YReyzBJtvWWtbDSpNr9hn96pkCiZqUcFEc+54Qg==",
+          "dev": true,
+          "requires": {
+            "@types/parse-json": "^4.0.0",
+            "import-fresh": "^3.1.0",
+            "parse-json": "^5.0.0",
+            "path-type": "^4.0.0",
+            "yaml": "^1.7.2"
+          }
+        },
+        "deepmerge": {
+          "version": "4.2.2",
+          "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.2.2.tgz",
+          "integrity": "sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "schema-utils": {
+          "version": "2.7.0",
+          "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-2.7.0.tgz",
+          "integrity": "sha512-0ilKFI6QQF5nxDZLFn2dMjvc4hjg/Wkg7rHd3jK6/A4a1Hl9VFdQWvgB1UMGoU94pad1P/8N7fMcEnLnSiju8A==",
+          "dev": true,
+          "requires": {
+            "@types/json-schema": "^7.0.4",
+            "ajv": "^6.12.2",
+            "ajv-keywords": "^3.4.1"
+          }
+        },
+        "semver": {
+          "version": "7.5.4",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+          "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^6.0.0"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        },
+        "tapable": {
+          "version": "1.1.3",
+          "resolved": "https://registry.npmjs.org/tapable/-/tapable-1.1.3.tgz",
+          "integrity": "sha512-4WK/bYZmj8xLr+HUCODHGF1ZFzsYffasLUgEiMBY4fgtltdO6B4WJtlSbPaDTLpYTcGVwM2qLnFTICEcNxs3kA==",
+          "dev": true
+        }
+      }
+    },
+    "form-data": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-3.0.1.tgz",
+      "integrity": "sha512-RHkBKtLWUVwd7SqRIvCZMEvAMoGUp0XU+seQiZejj0COz3RI3hWP4sCv3gZWWLjJTd7rGwcsF5eKZGii0r/hbg==",
+      "dev": true,
+      "requires": {
+        "asynckit": "^0.4.0",
+        "combined-stream": "^1.0.8",
+        "mime-types": "^2.1.12"
+      }
+    },
+    "forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+      "dev": true
+    },
+    "fraction.js": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-4.2.0.tgz",
+      "integrity": "sha512-MhLuK+2gUcnZe8ZHlaaINnQLl0xRIGRfcGk2yl8xoQAfHrSsL3rYu6FCmBdkdbhc9EPlwyGHewaRsvwRMJtAlA==",
+      "dev": true
+    },
+    "fresh": {
+      "version": "0.5.2",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
+      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
+      "dev": true
+    },
+    "fs-extra": {
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
+      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
+      "dev": true,
+      "requires": {
+        "at-least-node": "^1.0.0",
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
+      }
+    },
+    "fs-monkey": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.0.3.tgz",
+      "integrity": "sha512-cybjIfiiE+pTWicSCLFHSrXZ6EilF30oh91FDP9S2B051prEa7QWfrVTQm10/dDpswBDXZugPa1Ogu8Yh+HV0Q==",
+      "dev": true
+    },
+    "fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
+      "dev": true
+    },
+    "fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "optional": true
+    },
+    "function-bind": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.1.tgz",
+      "integrity": "sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A==",
+      "dev": true
+    },
+    "functional-red-black-tree": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/functional-red-black-tree/-/functional-red-black-tree-1.0.1.tgz",
+      "integrity": "sha512-dsKNQNdj6xA3T+QlADDA7mOSlX0qiMINjn0cgr+eGHGsbSHzTabcIogz2+p/iqP1Xs6EP/sS2SbqH+brGTbq0g==",
+      "dev": true
+    },
+    "gensync": {
+      "version": "1.0.0-beta.2",
+      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
+      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
+      "dev": true
+    },
+    "get-caller-file": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
+      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
+      "dev": true
+    },
+    "get-intrinsic": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.1.2.tgz",
+      "integrity": "sha512-Jfm3OyCxHh9DJyc28qGk+JmfkpO41A4XkneDSujN9MDXrm4oDKdHvndhZ2dN94+ERNfkYJWDclW6k2L/ZGHjXA==",
+      "dev": true,
+      "requires": {
+        "function-bind": "^1.1.1",
+        "has": "^1.0.3",
+        "has-symbols": "^1.0.3"
+      }
+    },
+    "get-package-type": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/get-package-type/-/get-package-type-0.1.0.tgz",
+      "integrity": "sha512-pjzuKtY64GYfWizNAJ0fr9VqttZkNiK2iS430LtIHzjBEr6bX8Am2zm4sW4Ro5wjWW5cAlRL1qAMTcXbjNAO2Q==",
+      "dev": true
+    },
+    "get-stream": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-4.1.0.tgz",
+      "integrity": "sha512-GMat4EJ5161kIy2HevLlr4luNjBgvmj413KaQA7jt4V8B4RDsfpHk7WQ9GVqfYyyx8OS/L66Kox+rJRNklLK7w==",
+      "dev": true,
+      "requires": {
+        "pump": "^3.0.0"
+      }
+    },
+    "glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "dev": true,
+      "requires": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      }
+    },
+    "glob-parent": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
+      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
+      "dev": true,
+      "requires": {
+        "is-glob": "^4.0.3"
+      }
+    },
+    "glob-to-regexp": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/glob-to-regexp/-/glob-to-regexp-0.4.1.tgz",
+      "integrity": "sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==",
+      "dev": true
+    },
+    "globals": {
+      "version": "11.12.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz",
+      "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
+      "dev": true
+    },
+    "globby": {
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/globby/-/globby-11.1.0.tgz",
+      "integrity": "sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==",
+      "dev": true,
+      "requires": {
+        "array-union": "^2.1.0",
+        "dir-glob": "^3.0.1",
+        "fast-glob": "^3.2.9",
+        "ignore": "^5.2.0",
+        "merge2": "^1.4.1",
+        "slash": "^3.0.0"
+      }
+    },
+    "good-listener": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/good-listener/-/good-listener-1.2.2.tgz",
+      "integrity": "sha512-goW1b+d9q/HIwbVYZzZ6SsTr4IgE+WA44A0GmPIQstuOrgsFcT7VEJ48nmr9GaRtNu0XTKacFLGnBPAM6Afouw==",
+      "requires": {
+        "delegate": "^3.1.2"
+      }
+    },
+    "graceful-fs": {
+      "version": "4.2.10",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.10.tgz",
+      "integrity": "sha512-9ByhssR2fPVsNZj478qUUbKfmL0+t5BDVyjShtyZZLiK7ZDAArFFfopyOTj0M05wE2tJPisA4iTnnXl2YoPvOA==",
+      "dev": true
+    },
+    "gzip-size": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/gzip-size/-/gzip-size-6.0.0.tgz",
+      "integrity": "sha512-ax7ZYomf6jqPTQ4+XCpUGyXKHk5WweS+e05MBO4/y3WJ5RkmPXNKvX+bx1behVILVwr6JSQvZAku021CHPXG3Q==",
+      "dev": true,
+      "requires": {
+        "duplexer": "^0.1.2"
+      }
+    },
+    "handle-thing": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/handle-thing/-/handle-thing-2.0.1.tgz",
+      "integrity": "sha512-9Qn4yBxelxoh2Ow62nP+Ka/kMnOXRi8BXnRaUwezLNhqelnN49xKz4F/dPP8OYLxLxq6JDtZb2i9XznUQbNPTg==",
+      "dev": true
+    },
+    "has": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/has/-/has-1.0.3.tgz",
+      "integrity": "sha512-f2dvO0VU6Oej7RkWJGrehjbzMAjFp5/VKPp5tTpWIV4JHHZK1/BxbFRtf/siA2SWTe09caDmVtYYzWEIbBS4zw==",
+      "dev": true,
+      "requires": {
+        "function-bind": "^1.1.1"
+      }
+    },
+    "has-flag": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
+      "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
+      "dev": true
+    },
+    "has-property-descriptors": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.0.tgz",
+      "integrity": "sha512-62DVLZGoiEBDHQyqG4w9xCuZ7eJEwNmJRWw2VY84Oedb7WFcA27fiEVe8oUQx9hAUJ4ekurquucTGwsyO1XGdQ==",
+      "dev": true,
+      "requires": {
+        "get-intrinsic": "^1.1.1"
+      }
+    },
+    "has-symbols": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.0.3.tgz",
+      "integrity": "sha512-l3LCuF6MgDNwTDKkdYGEihYjt5pRPbEg46rtlmnSPlUbgmB8LOIrKJbYYFBSbnPaJexMKtiPO8hmeRjRz2Td+A==",
+      "dev": true
+    },
+    "has-tostringtag": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.0.tgz",
+      "integrity": "sha512-kFjcSNhnlGV1kyoGk7OXKSawH5JOb/LzUc5w9B02hOTO0dfFRjbHQKvg1d6cf3HbeUmtU9VbbV3qzZ2Teh97WQ==",
+      "dev": true,
+      "requires": {
+        "has-symbols": "^1.0.2"
+      }
+    },
+    "hash-sum": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/hash-sum/-/hash-sum-2.0.0.tgz",
+      "integrity": "sha512-WdZTbAByD+pHfl/g9QSsBIIwy8IT+EsPiKDs0KNX+zSHhdDLFKdZu0BQHljvO+0QI/BasbMSUa8wYNCZTvhslg==",
+      "dev": true
+    },
+    "he": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/he/-/he-1.2.0.tgz",
+      "integrity": "sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==",
+      "dev": true
+    },
+    "highlight.js": {
+      "version": "10.7.3",
+      "resolved": "https://registry.npmjs.org/highlight.js/-/highlight.js-10.7.3.tgz",
+      "integrity": "sha512-tzcUFauisWKNHaRkN4Wjl/ZA07gENAjFl3J/c480dprkGTg5EQstgaNFqBfUqCq54kZRIEcreTsAgF/m2quD7A==",
+      "dev": true
+    },
+    "hosted-git-info": {
+      "version": "2.8.9",
+      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.9.tgz",
+      "integrity": "sha512-mxIDAb9Lsm6DoOJ7xH+5+X4y1LU/4Hi50L9C5sIswK3JzULS4bwk1FvjdBgvYR4bzT4tuUQiC15FE2f5HbLvYw==",
+      "dev": true
+    },
+    "hpack.js": {
+      "version": "2.1.6",
+      "resolved": "https://registry.npmjs.org/hpack.js/-/hpack.js-2.1.6.tgz",
+      "integrity": "sha512-zJxVehUdMGIKsRaNt7apO2Gqp0BdqW5yaiGHXXmbpvxgBYVZnAql+BJb4RO5ad2MgpbZKn5G6nMnegrH1FcNYQ==",
+      "dev": true,
+      "requires": {
+        "inherits": "^2.0.1",
+        "obuf": "^1.0.0",
+        "readable-stream": "^2.0.1",
+        "wbuf": "^1.1.0"
+      },
+      "dependencies": {
+        "readable-stream": {
+          "version": "2.3.7",
+          "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.7.tgz",
+          "integrity": "sha512-Ebho8K4jIbHAxnuxi7o42OrZgF/ZTNcsZj6nRKyUmkhLFq8CHItp/fy6hQZuZmP/n3yZ9VBUbp4zz/mX8hmYPw==",
+          "dev": true,
+          "requires": {
+            "core-util-is": "~1.0.0",
+            "inherits": "~2.0.3",
+            "isarray": "~1.0.0",
+            "process-nextick-args": "~2.0.0",
+            "safe-buffer": "~5.1.1",
+            "string_decoder": "~1.1.1",
+            "util-deprecate": "~1.0.1"
+          }
+        },
+        "string_decoder": {
+          "version": "1.1.1",
+          "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+          "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+          "dev": true,
+          "requires": {
+            "safe-buffer": "~5.1.0"
+          }
+        }
+      }
+    },
+    "html-encoding-sniffer": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-2.0.1.tgz",
+      "integrity": "sha512-D5JbOMBIR/TVZkubHT+OyT2705QvogUW4IBn6nHd756OwieSF9aDYFj4dv6HHEVGYbHaLETa3WggZYWWMyy3ZQ==",
+      "dev": true,
+      "requires": {
+        "whatwg-encoding": "^1.0.5"
+      }
+    },
+    "html-entities": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/html-entities/-/html-entities-2.3.3.tgz",
+      "integrity": "sha512-DV5Ln36z34NNTDgnz0EWGBLZENelNAtkiFA4kyNOG2tDI6Mz1uSWiq1wAKdyjnJwyDiDO7Fa2SO1CTxPXL8VxA==",
+      "dev": true
+    },
+    "html-escaper": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
+      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
+      "dev": true
+    },
+    "html-minifier-terser": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/html-minifier-terser/-/html-minifier-terser-6.1.0.tgz",
+      "integrity": "sha512-YXxSlJBZTP7RS3tWnQw74ooKa6L9b9i9QYXY21eUEvhZ3u9XLfv6OnFsQq6RxkhHygsaUMvYsZRV5rU/OVNZxw==",
+      "dev": true,
+      "requires": {
+        "camel-case": "^4.1.2",
+        "clean-css": "^5.2.2",
+        "commander": "^8.3.0",
+        "he": "^1.2.0",
+        "param-case": "^3.0.4",
+        "relateurl": "^0.2.7",
+        "terser": "^5.10.0"
+      }
+    },
+    "html-tags": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/html-tags/-/html-tags-3.2.0.tgz",
+      "integrity": "sha512-vy7ClnArOZwCnqZgvv+ddgHgJiAFXe3Ge9ML5/mBctVJoUoYPCdxVucOywjDARn6CVoh3dRSFdPHy2sX80L0Wg==",
+      "dev": true
+    },
+    "html-webpack-plugin": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/html-webpack-plugin/-/html-webpack-plugin-5.5.0.tgz",
+      "integrity": "sha512-sy88PC2cRTVxvETRgUHFrL4No3UxvcH8G1NepGhqaTT+GXN2kTamqasot0inS5hXeg1cMbFDt27zzo9p35lZVw==",
+      "dev": true,
+      "requires": {
+        "@types/html-minifier-terser": "^6.0.0",
+        "html-minifier-terser": "^6.0.2",
+        "lodash": "^4.17.21",
+        "pretty-error": "^4.0.0",
+        "tapable": "^2.0.0"
+      }
+    },
+    "htmlparser2": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-6.1.0.tgz",
+      "integrity": "sha512-gyyPk6rgonLFEDGoeRgQNaEUvdJ4ktTmmUh/h2t7s+M8oPpIPxgNACWa+6ESR57kXstwqPiCut0V8NRpcwgU7A==",
+      "dev": true,
+      "requires": {
+        "domelementtype": "^2.0.1",
+        "domhandler": "^4.0.0",
+        "domutils": "^2.5.2",
+        "entities": "^2.0.0"
+      }
+    },
+    "http-deceiver": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/http-deceiver/-/http-deceiver-1.2.7.tgz",
+      "integrity": "sha512-LmpOGxTfbpgtGVxJrj5k7asXHCgNZp5nLfp+hWc8QQRqtb7fUy6kRY3BO1h9ddF6yIPYUARgxGOwB42DnxIaNw==",
+      "dev": true
+    },
+    "http-errors": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.0.tgz",
+      "integrity": "sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==",
+      "dev": true,
+      "requires": {
+        "depd": "2.0.0",
+        "inherits": "2.0.4",
+        "setprototypeof": "1.2.0",
+        "statuses": "2.0.1",
+        "toidentifier": "1.0.1"
+      }
+    },
+    "http-parser-js": {
+      "version": "0.5.8",
+      "resolved": "https://registry.npmjs.org/http-parser-js/-/http-parser-js-0.5.8.tgz",
+      "integrity": "sha512-SGeBX54F94Wgu5RH3X5jsDtf4eHyRogWX1XGT3b4HuW3tQPM4AaBzoUji/4AAJNXCEOWZ5O0DgZmJw1947gD5Q==",
+      "dev": true
+    },
+    "http-proxy": {
+      "version": "1.18.1",
+      "resolved": "https://registry.npmjs.org/http-proxy/-/http-proxy-1.18.1.tgz",
+      "integrity": "sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==",
+      "dev": true,
+      "requires": {
+        "eventemitter3": "^4.0.0",
+        "follow-redirects": "^1.0.0",
+        "requires-port": "^1.0.0"
+      }
+    },
+    "http-proxy-agent": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-4.0.1.tgz",
+      "integrity": "sha512-k0zdNgqWTGA6aeIRVpvfVob4fL52dTfaehylg0Y4UvSySvOq/Y+BOyPrgpUrA7HylqvU8vIZGsRuXmspskV0Tg==",
+      "dev": true,
+      "requires": {
+        "@tootallnate/once": "1",
+        "agent-base": "6",
+        "debug": "4"
+      }
+    },
+    "http-proxy-middleware": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.6.tgz",
+      "integrity": "sha512-ya/UeJ6HVBYxrgYotAZo1KvPWlgB48kUJLDePFeneHsVujFaW5WNj2NgWCAE//B1Dl02BIfYlpNgBy8Kf8Rjmw==",
+      "dev": true,
+      "requires": {
+        "@types/http-proxy": "^1.17.8",
+        "http-proxy": "^1.18.1",
+        "is-glob": "^4.0.1",
+        "is-plain-obj": "^3.0.0",
+        "micromatch": "^4.0.2"
+      }
+    },
+    "https-proxy-agent": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+      "dev": true,
+      "requires": {
+        "agent-base": "6",
+        "debug": "4"
+      }
+    },
+    "human-signals": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz",
+      "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==",
+      "dev": true
+    },
+    "iconv-lite": {
+      "version": "0.4.24",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
+      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+      "dev": true,
+      "requires": {
+        "safer-buffer": ">= 2.1.2 < 3"
+      }
+    },
+    "icss-utils": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/icss-utils/-/icss-utils-5.1.0.tgz",
+      "integrity": "sha512-soFhflCVWLfRNOPU3iv5Z9VUdT44xFRbzjLsEzSr5AQmgqPMTHdU3PMT1Cf1ssx8fLNJDA1juftYl+PUcv3MqA==",
+      "dev": true,
+      "requires": {}
+    },
+    "ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA=="
+    },
+    "ignore": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.2.0.tgz",
+      "integrity": "sha512-CmxgYGiEPCLhfLnpPp1MoRmifwEIOgjcHXxOBjv7mY96c+eWScsOP9c112ZyLdWHi0FxHjI+4uVhKYp/gcdRmQ==",
+      "dev": true
+    },
+    "import-fresh": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.0.tgz",
+      "integrity": "sha512-veYYhQa+D1QBKznvhUHxb8faxlrwUnxseDAbAp457E0wLNio2bOSKnjYDhMj+YiAq61xrMGhQk9iXVk5FzgQMw==",
+      "dev": true,
+      "requires": {
+        "parent-module": "^1.0.0",
+        "resolve-from": "^4.0.0"
+      }
+    },
+    "import-local": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.1.0.tgz",
+      "integrity": "sha512-ASB07uLtnDs1o6EHjKpX34BKYDSqnFerfTOJL2HvMqF70LnxpjkzDB8J44oT9pu4AMPkQwf8jl6szgvNd2tRIg==",
+      "dev": true,
+      "requires": {
+        "pkg-dir": "^4.2.0",
+        "resolve-cwd": "^3.0.0"
+      }
+    },
+    "imurmurhash": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
+      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
+      "dev": true
+    },
+    "inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "dev": true,
+      "requires": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "dev": true
+    },
+    "ini": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+      "dev": true
+    },
+    "ipaddr.js": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-2.0.1.tgz",
+      "integrity": "sha512-1qTgH9NG+IIJ4yfKs2e6Pp1bZg8wbDbKHT21HrLIeYBTRLgMYKnMTPAuI3Lcs61nfx5h1xlXnbJtH1kX5/d/ng==",
+      "dev": true
+    },
+    "is-arrayish": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz",
+      "integrity": "sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==",
+      "dev": true
+    },
+    "is-binary-path": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/is-binary-path/-/is-binary-path-2.1.0.tgz",
+      "integrity": "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==",
+      "dev": true,
+      "requires": {
+        "binary-extensions": "^2.0.0"
+      }
+    },
+    "is-buffer": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz",
+      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
+      "dev": true
+    },
+    "is-ci": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/is-ci/-/is-ci-1.2.1.tgz",
+      "integrity": "sha512-s6tfsaQaQi3JNciBH6shVqEDvhGut0SUXr31ag8Pd8BBbVVlcGfWhpPmEOoM6RJ5TFhbypvf5yyRw/VXW1IiWg==",
+      "dev": true,
+      "requires": {
+        "ci-info": "^1.5.0"
+      },
+      "dependencies": {
+        "ci-info": {
+          "version": "1.6.0",
+          "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-1.6.0.tgz",
+          "integrity": "sha512-vsGdkwSCDpWmP80ncATX7iea5DWQemg1UgCW5J8tqjU3lYw4FBYuj89J0CTVomA7BEfvSZd84GmHko+MxFQU2A==",
+          "dev": true
+        }
+      }
+    },
+    "is-core-module": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.9.0.tgz",
+      "integrity": "sha512-+5FPy5PnwmO3lvfMb0AsoPaBG+5KHUI0wYFXOtYPnVVVspTFUuMZNfNaNVRt3FZadstu2c8x23vykRW/NBoU6A==",
+      "dev": true,
+      "requires": {
+        "has": "^1.0.3"
+      }
+    },
+    "is-docker": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
+      "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
+      "dev": true
+    },
+    "is-expression": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/is-expression/-/is-expression-4.0.0.tgz",
+      "integrity": "sha512-zMIXX63sxzG3XrkHkrAPvm/OVZVSCPNkwMHU8oTX7/U3AL78I0QXCEICXUM13BIa8TYGZ68PiTKfQz3yaTNr4A==",
+      "dev": true,
+      "requires": {
+        "acorn": "^7.1.1",
+        "object-assign": "^4.1.1"
+      },
+      "dependencies": {
+        "acorn": {
+          "version": "7.4.1",
+          "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
+          "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
+          "dev": true
+        }
+      }
+    },
+    "is-extendable": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-0.1.1.tgz",
+      "integrity": "sha512-5BMULNob1vgFX6EjQw5izWDxrecWK9AM72rugNr0TFldMOi0fj6Jk+zeKIt0xGj4cEfQIJth4w3OKWOJ4f+AFw==",
+      "dev": true
+    },
+    "is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+      "dev": true
+    },
+    "is-file-esm": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-file-esm/-/is-file-esm-1.0.0.tgz",
+      "integrity": "sha512-rZlaNKb4Mr8WlRu2A9XdeoKgnO5aA53XdPHgCKVyCrQ/rWi89RET1+bq37Ru46obaQXeiX4vmFIm1vks41hoSA==",
+      "dev": true,
+      "requires": {
+        "read-pkg-up": "^7.0.1"
+      }
+    },
+    "is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "dev": true
+    },
+    "is-generator-fn": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/is-generator-fn/-/is-generator-fn-2.1.0.tgz",
+      "integrity": "sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==",
+      "dev": true
+    },
+    "is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "dev": true,
+      "requires": {
+        "is-extglob": "^2.1.1"
+      }
+    },
+    "is-interactive": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-interactive/-/is-interactive-1.0.0.tgz",
+      "integrity": "sha512-2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==",
+      "dev": true
+    },
+    "is-number": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "dev": true
+    },
+    "is-plain-obj": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-3.0.0.tgz",
+      "integrity": "sha512-gwsOE28k+23GP1B6vFl1oVh/WOzmawBrKwo5Ev6wMKzPkaXaCDIQKzLnvsA42DRlbVTWorkgTKIviAKCWkfUwA==",
+      "dev": true
+    },
+    "is-plain-object": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-2.0.4.tgz",
+      "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==",
+      "dev": true,
+      "requires": {
+        "isobject": "^3.0.1"
+      }
+    },
+    "is-potential-custom-element-name": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
+      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
+      "dev": true
+    },
+    "is-regex": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.1.4.tgz",
+      "integrity": "sha512-kvRdxDsxZjhzUX07ZnLydzS1TU/TJlTUHHY4YLL87e37oUA49DfkLqgy+VjFocowy29cKvcSiu+kIv728jTTVg==",
+      "dev": true,
+      "requires": {
+        "call-bind": "^1.0.2",
+        "has-tostringtag": "^1.0.0"
+      }
+    },
+    "is-stream": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-1.1.0.tgz",
+      "integrity": "sha512-uQPm8kcs47jx38atAcWTVxyltQYoPT68y9aWYdV6yWXSyW8mzSat0TL6CiWdZeCdF3KrAvpVtnHbTv4RN+rqdQ==",
+      "dev": true
+    },
+    "is-typedarray": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-typedarray/-/is-typedarray-1.0.0.tgz",
+      "integrity": "sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA==",
+      "dev": true
+    },
+    "is-unicode-supported": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-0.1.0.tgz",
+      "integrity": "sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==",
+      "dev": true
+    },
+    "is-whitespace": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/is-whitespace/-/is-whitespace-0.3.0.tgz",
+      "integrity": "sha512-RydPhl4S6JwAyj0JJjshWJEFG6hNye3pZFBRZaTUfZFwGHxzppNaNOVgQuS/E/SlhrApuMXrpnK1EEIXfdo3Dg==",
+      "dev": true
+    },
+    "is-wsl": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
+      "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
+      "dev": true,
+      "requires": {
+        "is-docker": "^2.0.0"
+      }
+    },
+    "isarray": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
+      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
+      "dev": true
+    },
+    "isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "dev": true
+    },
+    "isobject": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
+      "integrity": "sha512-WhB9zCku7EGTj/HQQRz5aUQEUeoQZH2bWcltRErOpymJ4boYE6wL9Tbr23krRPSZ+C5zqNSrSw+Cc7sZZ4b7vg==",
+      "dev": true
+    },
+    "istanbul-lib-coverage": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.0.tgz",
+      "integrity": "sha512-eOeJ5BHCmHYvQK7xt9GkdHuzuCGS1Y6g9Gvnx3Ym33fz/HpLRYxiS0wHNr+m/MBC8B647Xt608vCDEvhl9c6Mw==",
+      "dev": true
+    },
+    "istanbul-lib-instrument": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-instrument/-/istanbul-lib-instrument-5.2.0.tgz",
+      "integrity": "sha512-6Lthe1hqXHBNsqvgDzGO6l03XNeu3CrG4RqQ1KM9+l5+jNGpEJfIELx1NS3SEHmJQA8np/u+E4EPRKRiu6m19A==",
+      "dev": true,
+      "requires": {
+        "@babel/core": "^7.12.3",
+        "@babel/parser": "^7.14.7",
+        "@istanbuljs/schema": "^0.1.2",
+        "istanbul-lib-coverage": "^3.2.0",
+        "semver": "^6.3.0"
+      }
+    },
+    "istanbul-lib-report": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.0.tgz",
+      "integrity": "sha512-wcdi+uAKzfiGT2abPpKZ0hSU1rGQjUQnLvtY5MpQ7QCTahD3VODhcu4wcfY1YtkGaDD5yuydOLINXsfbus9ROw==",
+      "dev": true,
+      "requires": {
+        "istanbul-lib-coverage": "^3.0.0",
+        "make-dir": "^3.0.0",
+        "supports-color": "^7.1.0"
+      },
+      "dependencies": {
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "istanbul-lib-source-maps": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-source-maps/-/istanbul-lib-source-maps-4.0.1.tgz",
+      "integrity": "sha512-n3s8EwkdFIJCG3BPKBYvskgXGoy88ARzvegkitk60NxRdwltLOTaH7CUiMRXvwYorl0Q712iEjcWB+fK/MrWVw==",
+      "dev": true,
+      "requires": {
+        "debug": "^4.1.1",
+        "istanbul-lib-coverage": "^3.0.0",
+        "source-map": "^0.6.1"
+      }
+    },
+    "istanbul-reports": {
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.1.4.tgz",
+      "integrity": "sha512-r1/DshN4KSE7xWEknZLLLLDn5CJybV3nw01VTkp6D5jzLuELlcbudfj/eSQFvrKsJuTVCGnePO7ho82Nw9zzfw==",
+      "dev": true,
+      "requires": {
+        "html-escaper": "^2.0.0",
+        "istanbul-lib-report": "^3.0.0"
+      }
+    },
+    "javascript-stringify": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/javascript-stringify/-/javascript-stringify-2.1.0.tgz",
+      "integrity": "sha512-JVAfqNPTvNq3sB/VHQJAFxN/sPgKnsKrCwyRt15zwNCdrMMJDdcEOdubuy+DuJYYdm0ox1J4uzEuYKkN+9yhVg==",
+      "dev": true
+    },
+    "jest": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest/-/jest-27.5.1.tgz",
+      "integrity": "sha512-Yn0mADZB89zTtjkPJEXwrac3LHudkQMR+Paqa8uxJHCBr9agxztUifWCyiYrjhMPBoUVBjyny0I7XH6ozDr7QQ==",
+      "dev": true,
+      "requires": {
+        "@jest/core": "^27.5.1",
+        "import-local": "^3.0.2",
+        "jest-cli": "^27.5.1"
+      }
+    },
+    "jest-changed-files": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-27.5.1.tgz",
+      "integrity": "sha512-buBLMiByfWGCoMsLLzGUUSpAmIAGnbR2KJoMN10ziLhOLvP4e0SlypHnAel8iqQXTrcbmfEY9sSqae5sgUsTvw==",
+      "dev": true,
+      "requires": {
+        "@jest/types": "^27.5.1",
+        "execa": "^5.0.0",
+        "throat": "^6.0.1"
+      },
+      "dependencies": {
+        "cross-spawn": {
+          "version": "7.0.3",
+          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+          "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+          "dev": true,
+          "requires": {
+            "path-key": "^3.1.0",
+            "shebang-command": "^2.0.0",
+            "which": "^2.0.1"
+          }
+        },
+        "execa": {
+          "version": "5.1.1",
+          "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
+          "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
+          "dev": true,
+          "requires": {
+            "cross-spawn": "^7.0.3",
+            "get-stream": "^6.0.0",
+            "human-signals": "^2.1.0",
+            "is-stream": "^2.0.0",
+            "merge-stream": "^2.0.0",
+            "npm-run-path": "^4.0.1",
+            "onetime": "^5.1.2",
+            "signal-exit": "^3.0.3",
+            "strip-final-newline": "^2.0.0"
+          }
+        },
+        "get-stream": {
+          "version": "6.0.1",
+          "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
+          "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
+          "dev": true
+        },
+        "is-stream": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+          "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+          "dev": true
+        },
+        "npm-run-path": {
+          "version": "4.0.1",
+          "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
+          "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
+          "dev": true,
+          "requires": {
+            "path-key": "^3.0.0"
+          }
+        },
+        "path-key": {
+          "version": "3.1.1",
+          "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+          "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+          "dev": true
+        },
+        "shebang-command": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+          "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+          "dev": true,
+          "requires": {
+            "shebang-regex": "^3.0.0"
+          }
+        },
+        "shebang-regex": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+          "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+          "dev": true
+        },
+        "which": {
+          "version": "2.0.2",
+          "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+          "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+          "dev": true,
+          "requires": {
+            "isexe": "^2.0.0"
+          }
+        }
+      }
+    },
+    "jest-circus": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-27.5.1.tgz",
+      "integrity": "sha512-D95R7x5UtlMA5iBYsOHFFbMD/GVA4R/Kdq15f7xYWUfWHBto9NYRsOvnSauTgdF+ogCpJ4tyKOXhUifxS65gdw==",
+      "dev": true,
+      "requires": {
+        "@jest/environment": "^27.5.1",
+        "@jest/test-result": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "co": "^4.6.0",
+        "dedent": "^0.7.0",
+        "expect": "^27.5.1",
+        "is-generator-fn": "^2.0.0",
+        "jest-each": "^27.5.1",
+        "jest-matcher-utils": "^27.5.1",
+        "jest-message-util": "^27.5.1",
+        "jest-runtime": "^27.5.1",
+        "jest-snapshot": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3",
+        "throat": "^6.0.1"
+      },
+      "dependencies": {
+        "@jest/console": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+          "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+          "dev": true,
+          "requires": {
+            "@jest/types": "^27.5.1",
+            "@types/node": "*",
+            "chalk": "^4.0.0",
+            "jest-message-util": "^27.5.1",
+            "jest-util": "^27.5.1",
+            "slash": "^3.0.0"
+          }
+        },
+        "@jest/test-result": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+          "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+          "dev": true,
+          "requires": {
+            "@jest/console": "^27.5.1",
+            "@jest/types": "^27.5.1",
+            "@types/istanbul-lib-coverage": "^2.0.0",
+            "collect-v8-coverage": "^1.0.0"
+          }
+        },
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-message-util": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+          "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+          "dev": true,
+          "requires": {
+            "@babel/code-frame": "^7.12.13",
+            "@jest/types": "^27.5.1",
+            "@types/stack-utils": "^2.0.0",
+            "chalk": "^4.0.0",
+            "graceful-fs": "^4.2.9",
+            "micromatch": "^4.0.4",
+            "pretty-format": "^27.5.1",
+            "slash": "^3.0.0",
+            "stack-utils": "^2.0.3"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "jest-cli": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-27.5.1.tgz",
+      "integrity": "sha512-Hc6HOOwYq4/74/c62dEE3r5elx8wjYqxY0r0G/nFrLDPMFRu6RA/u8qINOIkvhxG7mMQ5EJsOGfRpI8L6eFUVw==",
+      "dev": true,
+      "requires": {
+        "@jest/core": "^27.5.1",
+        "@jest/test-result": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "chalk": "^4.0.0",
+        "exit": "^0.1.2",
+        "graceful-fs": "^4.2.9",
+        "import-local": "^3.0.2",
+        "jest-config": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "jest-validate": "^27.5.1",
+        "prompts": "^2.0.1",
+        "yargs": "^16.2.0"
+      },
+      "dependencies": {
+        "@jest/console": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+          "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+          "dev": true,
+          "requires": {
+            "@jest/types": "^27.5.1",
+            "@types/node": "*",
+            "chalk": "^4.0.0",
+            "jest-message-util": "^27.5.1",
+            "jest-util": "^27.5.1",
+            "slash": "^3.0.0"
+          }
+        },
+        "@jest/test-result": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+          "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+          "dev": true,
+          "requires": {
+            "@jest/console": "^27.5.1",
+            "@jest/types": "^27.5.1",
+            "@types/istanbul-lib-coverage": "^2.0.0",
+            "collect-v8-coverage": "^1.0.0"
+          }
+        },
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-message-util": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+          "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+          "dev": true,
+          "requires": {
+            "@babel/code-frame": "^7.12.13",
+            "@jest/types": "^27.5.1",
+            "@types/stack-utils": "^2.0.0",
+            "chalk": "^4.0.0",
+            "graceful-fs": "^4.2.9",
+            "micromatch": "^4.0.4",
+            "pretty-format": "^27.5.1",
+            "slash": "^3.0.0",
+            "stack-utils": "^2.0.3"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "jest-config": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-27.5.1.tgz",
+      "integrity": "sha512-5sAsjm6tGdsVbW9ahcChPAFCk4IlkQUknH5AvKjuLTSlcO/wCZKyFdn7Rg0EkC+OGgWODEy2hDpWB1PgzH0JNA==",
+      "dev": true,
+      "requires": {
+        "@babel/core": "^7.8.0",
+        "@jest/test-sequencer": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "babel-jest": "^27.5.1",
+        "chalk": "^4.0.0",
+        "ci-info": "^3.2.0",
+        "deepmerge": "^4.2.2",
+        "glob": "^7.1.1",
+        "graceful-fs": "^4.2.9",
+        "jest-circus": "^27.5.1",
+        "jest-environment-jsdom": "^27.5.1",
+        "jest-environment-node": "^27.5.1",
+        "jest-get-type": "^27.5.1",
+        "jest-jasmine2": "^27.5.1",
+        "jest-regex-util": "^27.5.1",
+        "jest-resolve": "^27.5.1",
+        "jest-runner": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "jest-validate": "^27.5.1",
+        "micromatch": "^4.0.4",
+        "parse-json": "^5.2.0",
+        "pretty-format": "^27.5.1",
+        "slash": "^3.0.0",
+        "strip-json-comments": "^3.1.1"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "deepmerge": {
+          "version": "4.2.2",
+          "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.2.2.tgz",
+          "integrity": "sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "jest-diff": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-27.5.1.tgz",
+      "integrity": "sha512-m0NvkX55LDt9T4mctTEgnZk3fmEg3NRYutvMPWM/0iPnkFj2wIeF45O1718cMSOFO1vINkqmxqD8vE37uTEbqw==",
+      "dev": true,
+      "requires": {
+        "chalk": "^4.0.0",
+        "diff-sequences": "^27.5.1",
+        "jest-get-type": "^27.5.1",
+        "pretty-format": "^27.5.1"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "jest-docblock": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-27.5.1.tgz",
+      "integrity": "sha512-rl7hlABeTsRYxKiUfpHrQrG4e2obOiTQWfMEH3PxPjOtdsfLQO4ReWSZaQ7DETm4xu07rl4q/h4zcKXyU0/OzQ==",
+      "dev": true,
+      "requires": {
+        "detect-newline": "^3.0.0"
+      }
+    },
+    "jest-each": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-27.5.1.tgz",
+      "integrity": "sha512-1Ff6p+FbhT/bXQnEouYy00bkNSY7OUpfIcmdl8vZ31A1UUaurOLPA8a8BbJOF2RDUElwJhmeaV7LnagI+5UwNQ==",
+      "dev": true,
+      "requires": {
+        "@jest/types": "^27.5.1",
+        "chalk": "^4.0.0",
+        "jest-get-type": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "pretty-format": "^27.5.1"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "jest-environment-jsdom": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-environment-jsdom/-/jest-environment-jsdom-27.5.1.tgz",
+      "integrity": "sha512-TFBvkTC1Hnnnrka/fUb56atfDtJ9VMZ94JkjTbggl1PEpwrYtUBKMezB3inLmWqQsXYLcMwNoDQwoBTAvFfsfw==",
+      "dev": true,
+      "requires": {
+        "@jest/environment": "^27.5.1",
+        "@jest/fake-timers": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "jest-mock": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "jsdom": "^16.6.0"
+      }
+    },
+    "jest-environment-node": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-27.5.1.tgz",
+      "integrity": "sha512-Jt4ZUnxdOsTGwSRAfKEnE6BcwsSPNOijjwifq5sDFSA2kesnXTvNqKHYgM0hDq3549Uf/KzdXNYn4wMZJPlFLw==",
+      "dev": true,
+      "requires": {
+        "@jest/environment": "^27.5.1",
+        "@jest/fake-timers": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "jest-mock": "^27.5.1",
+        "jest-util": "^27.5.1"
+      }
+    },
+    "jest-get-type": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-get-type/-/jest-get-type-27.5.1.tgz",
+      "integrity": "sha512-2KY95ksYSaK7DMBWQn6dQz3kqAf3BB64y2udeG+hv4KfSOb9qwcYQstTJc1KCbsix+wLZWZYN8t7nwX3GOBLRw==",
+      "dev": true
+    },
+    "jest-haste-map": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-27.5.1.tgz",
+      "integrity": "sha512-7GgkZ4Fw4NFbMSDSpZwXeBiIbx+t/46nJ2QitkOjvwPYyZmqttu2TDSimMHP1EkPOi4xUZAN1doE5Vd25H4Jng==",
+      "dev": true,
+      "requires": {
+        "@jest/types": "^27.5.1",
+        "@types/graceful-fs": "^4.1.2",
+        "@types/node": "*",
+        "anymatch": "^3.0.3",
+        "fb-watchman": "^2.0.0",
+        "fsevents": "^2.3.2",
+        "graceful-fs": "^4.2.9",
+        "jest-regex-util": "^27.5.1",
+        "jest-serializer": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "jest-worker": "^27.5.1",
+        "micromatch": "^4.0.4",
+        "walker": "^1.0.7"
+      }
+    },
+    "jest-jasmine2": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-jasmine2/-/jest-jasmine2-27.5.1.tgz",
+      "integrity": "sha512-jtq7VVyG8SqAorDpApwiJJImd0V2wv1xzdheGHRGyuT7gZm6gG47QEskOlzsN1PG/6WNaCo5pmwMHDf3AkG2pQ==",
+      "dev": true,
+      "requires": {
+        "@jest/environment": "^27.5.1",
+        "@jest/source-map": "^27.5.1",
+        "@jest/test-result": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "co": "^4.6.0",
+        "expect": "^27.5.1",
+        "is-generator-fn": "^2.0.0",
+        "jest-each": "^27.5.1",
+        "jest-matcher-utils": "^27.5.1",
+        "jest-message-util": "^27.5.1",
+        "jest-runtime": "^27.5.1",
+        "jest-snapshot": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "pretty-format": "^27.5.1",
+        "throat": "^6.0.1"
+      },
+      "dependencies": {
+        "@jest/console": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+          "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+          "dev": true,
+          "requires": {
+            "@jest/types": "^27.5.1",
+            "@types/node": "*",
+            "chalk": "^4.0.0",
+            "jest-message-util": "^27.5.1",
+            "jest-util": "^27.5.1",
+            "slash": "^3.0.0"
+          }
+        },
+        "@jest/test-result": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+          "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+          "dev": true,
+          "requires": {
+            "@jest/console": "^27.5.1",
+            "@jest/types": "^27.5.1",
+            "@types/istanbul-lib-coverage": "^2.0.0",
+            "collect-v8-coverage": "^1.0.0"
+          }
+        },
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-message-util": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+          "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+          "dev": true,
+          "requires": {
+            "@babel/code-frame": "^7.12.13",
+            "@jest/types": "^27.5.1",
+            "@types/stack-utils": "^2.0.0",
+            "chalk": "^4.0.0",
+            "graceful-fs": "^4.2.9",
+            "micromatch": "^4.0.4",
+            "pretty-format": "^27.5.1",
+            "slash": "^3.0.0",
+            "stack-utils": "^2.0.3"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "jest-leak-detector": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-27.5.1.tgz",
+      "integrity": "sha512-POXfWAMvfU6WMUXftV4HolnJfnPOGEu10fscNCA76KBpRRhcMN2c8d3iT2pxQS3HLbA+5X4sOUPzYO2NUyIlHQ==",
+      "dev": true,
+      "requires": {
+        "jest-get-type": "^27.5.1",
+        "pretty-format": "^27.5.1"
+      }
+    },
+    "jest-matcher-utils": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-27.5.1.tgz",
+      "integrity": "sha512-z2uTx/T6LBaCoNWNFWwChLBKYxTMcGBRjAt+2SbP929/Fflb9aa5LGma654Rz8z9HLxsrUaYzxE9T/EFIL/PAw==",
+      "dev": true,
+      "requires": {
+        "chalk": "^4.0.0",
+        "jest-diff": "^27.5.1",
+        "jest-get-type": "^27.5.1",
+        "pretty-format": "^27.5.1"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "jest-message-util": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-28.1.1.tgz",
+      "integrity": "sha512-xoDOOT66fLfmTRiqkoLIU7v42mal/SqwDKvfmfiWAdJMSJiU+ozgluO7KbvoAgiwIrrGZsV7viETjc8GNrA/IQ==",
+      "dev": true,
+      "requires": {
+        "@babel/code-frame": "^7.12.13",
+        "@jest/types": "^28.1.1",
+        "@types/stack-utils": "^2.0.0",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "micromatch": "^4.0.4",
+        "pretty-format": "^28.1.1",
+        "slash": "^3.0.0",
+        "stack-utils": "^2.0.3"
+      },
+      "dependencies": {
+        "@jest/types": {
+          "version": "28.1.1",
+          "resolved": "https://registry.npmjs.org/@jest/types/-/types-28.1.1.tgz",
+          "integrity": "sha512-vRXVqSg1VhDnB8bWcmvLzmg0Bt9CRKVgHPXqYwvWMX3TvAjeO+nRuK6+VdTKCtWOvYlmkF/HqNAL/z+N3B53Kw==",
+          "dev": true,
+          "requires": {
+            "@jest/schemas": "^28.0.2",
+            "@types/istanbul-lib-coverage": "^2.0.0",
+            "@types/istanbul-reports": "^3.0.0",
+            "@types/node": "*",
+            "@types/yargs": "^17.0.8",
+            "chalk": "^4.0.0"
+          }
+        },
+        "@types/yargs": {
+          "version": "17.0.10",
+          "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.10.tgz",
+          "integrity": "sha512-gmEaFwpj/7f/ROdtIlci1R1VYU1J4j95m8T+Tj3iBgiBFKg1foE/PSl93bBd5T9LDXNPo8UlNN6W0qwD8O5OaA==",
+          "dev": true,
+          "requires": {
+            "@types/yargs-parser": "*"
+          }
+        },
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "pretty-format": {
+          "version": "28.1.1",
+          "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-28.1.1.tgz",
+          "integrity": "sha512-wwJbVTGFHeucr5Jw2bQ9P+VYHyLdAqedFLEkdQUVaBF/eiidDwH5OpilINq4mEfhbCjLnirt6HTTDhv1HaTIQw==",
+          "dev": true,
+          "requires": {
+            "@jest/schemas": "^28.0.2",
+            "ansi-regex": "^5.0.1",
+            "ansi-styles": "^5.0.0",
+            "react-is": "^18.0.0"
+          },
+          "dependencies": {
+            "ansi-styles": {
+              "version": "5.2.0",
+              "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+              "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+              "dev": true
+            }
+          }
+        },
+        "react-is": {
+          "version": "18.2.0",
+          "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.2.0.tgz",
+          "integrity": "sha512-xWGDIW6x921xtzPkhiULtthJHoJvBbF3q26fzloPCK0hsvxtPVelvftw3zjbHWSkR2km9Z+4uxbDDK/6Zw9B8w==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "jest-mock": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-27.5.1.tgz",
+      "integrity": "sha512-K4jKbY1d4ENhbrG2zuPWaQBvDly+iZ2yAW+T1fATN78hc0sInwn7wZB8XtlNnvHug5RMwV897Xm4LqmPM4e2Og==",
+      "dev": true,
+      "requires": {
+        "@jest/types": "^27.5.1",
+        "@types/node": "*"
+      }
+    },
+    "jest-pnp-resolver": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.2.tgz",
+      "integrity": "sha512-olV41bKSMm8BdnuMsewT4jqlZ8+3TCARAXjZGT9jcoSnrfUnRCqnMoF9XEeoWjbzObpqF9dRhHQj0Xb9QdF6/w==",
+      "dev": true,
+      "requires": {}
+    },
+    "jest-regex-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-27.5.1.tgz",
+      "integrity": "sha512-4bfKq2zie+x16okqDXjXn9ql2B0dScQu+vcwe4TvFVhkVyuWLqpZrZtXxLLWoXYgn0E87I6r6GRYHF7wFZBUvg==",
+      "dev": true
+    },
+    "jest-resolve": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-27.5.1.tgz",
+      "integrity": "sha512-FFDy8/9E6CV83IMbDpcjOhumAQPDyETnU2KZ1O98DwTnz8AOBsW/Xv3GySr1mOZdItLR+zDZ7I/UdTFbgSOVCw==",
+      "dev": true,
+      "requires": {
+        "@jest/types": "^27.5.1",
+        "chalk": "^4.0.0",
+        "graceful-fs": "^4.2.9",
+        "jest-haste-map": "^27.5.1",
+        "jest-pnp-resolver": "^1.2.2",
+        "jest-util": "^27.5.1",
+        "jest-validate": "^27.5.1",
+        "resolve": "^1.20.0",
+        "resolve.exports": "^1.1.0",
+        "slash": "^3.0.0"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "jest-resolve-dependencies": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-27.5.1.tgz",
+      "integrity": "sha512-QQOOdY4PE39iawDn5rzbIePNigfe5B9Z91GDD1ae/xNDlu9kaat8QQ5EKnNmVWPV54hUdxCVwwj6YMgR2O7IOg==",
+      "dev": true,
+      "requires": {
+        "@jest/types": "^27.5.1",
+        "jest-regex-util": "^27.5.1",
+        "jest-snapshot": "^27.5.1"
+      }
+    },
+    "jest-runner": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-27.5.1.tgz",
+      "integrity": "sha512-g4NPsM4mFCOwFKXO4p/H/kWGdJp9V8kURY2lX8Me2drgXqG7rrZAx5kv+5H7wtt/cdFIjhqYx1HrlqWHaOvDaQ==",
+      "dev": true,
+      "requires": {
+        "@jest/console": "^27.5.1",
+        "@jest/environment": "^27.5.1",
+        "@jest/test-result": "^27.5.1",
+        "@jest/transform": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "emittery": "^0.8.1",
+        "graceful-fs": "^4.2.9",
+        "jest-docblock": "^27.5.1",
+        "jest-environment-jsdom": "^27.5.1",
+        "jest-environment-node": "^27.5.1",
+        "jest-haste-map": "^27.5.1",
+        "jest-leak-detector": "^27.5.1",
+        "jest-message-util": "^27.5.1",
+        "jest-resolve": "^27.5.1",
+        "jest-runtime": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "jest-worker": "^27.5.1",
+        "source-map-support": "^0.5.6",
+        "throat": "^6.0.1"
+      },
+      "dependencies": {
+        "@jest/console": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+          "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+          "dev": true,
+          "requires": {
+            "@jest/types": "^27.5.1",
+            "@types/node": "*",
+            "chalk": "^4.0.0",
+            "jest-message-util": "^27.5.1",
+            "jest-util": "^27.5.1",
+            "slash": "^3.0.0"
+          }
+        },
+        "@jest/test-result": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+          "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+          "dev": true,
+          "requires": {
+            "@jest/console": "^27.5.1",
+            "@jest/types": "^27.5.1",
+            "@types/istanbul-lib-coverage": "^2.0.0",
+            "collect-v8-coverage": "^1.0.0"
+          }
+        },
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "emittery": {
+          "version": "0.8.1",
+          "resolved": "https://registry.npmjs.org/emittery/-/emittery-0.8.1.tgz",
+          "integrity": "sha512-uDfvUjVrfGJJhymx/kz6prltenw1u7WrCg1oa94zYY8xxVpLLUu045LAT0dhDZdXG58/EpPL/5kA180fQ/qudg==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-message-util": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+          "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+          "dev": true,
+          "requires": {
+            "@babel/code-frame": "^7.12.13",
+            "@jest/types": "^27.5.1",
+            "@types/stack-utils": "^2.0.0",
+            "chalk": "^4.0.0",
+            "graceful-fs": "^4.2.9",
+            "micromatch": "^4.0.4",
+            "pretty-format": "^27.5.1",
+            "slash": "^3.0.0",
+            "stack-utils": "^2.0.3"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "jest-runtime": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-27.5.1.tgz",
+      "integrity": "sha512-o7gxw3Gf+H2IGt8fv0RiyE1+r83FJBRruoA+FXrlHw6xEyBsU8ugA6IPfTdVyA0w8HClpbK+DGJxH59UrNMx8A==",
+      "dev": true,
+      "requires": {
+        "@jest/environment": "^27.5.1",
+        "@jest/fake-timers": "^27.5.1",
+        "@jest/globals": "^27.5.1",
+        "@jest/source-map": "^27.5.1",
+        "@jest/test-result": "^27.5.1",
+        "@jest/transform": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "chalk": "^4.0.0",
+        "cjs-module-lexer": "^1.0.0",
+        "collect-v8-coverage": "^1.0.0",
+        "execa": "^5.0.0",
+        "glob": "^7.1.3",
+        "graceful-fs": "^4.2.9",
+        "jest-haste-map": "^27.5.1",
+        "jest-message-util": "^27.5.1",
+        "jest-mock": "^27.5.1",
+        "jest-regex-util": "^27.5.1",
+        "jest-resolve": "^27.5.1",
+        "jest-snapshot": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "slash": "^3.0.0",
+        "strip-bom": "^4.0.0"
+      },
+      "dependencies": {
+        "@jest/console": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
+          "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+          "dev": true,
+          "requires": {
+            "@jest/types": "^27.5.1",
+            "@types/node": "*",
+            "chalk": "^4.0.0",
+            "jest-message-util": "^27.5.1",
+            "jest-util": "^27.5.1",
+            "slash": "^3.0.0"
+          }
+        },
+        "@jest/test-result": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
+          "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+          "dev": true,
+          "requires": {
+            "@jest/console": "^27.5.1",
+            "@jest/types": "^27.5.1",
+            "@types/istanbul-lib-coverage": "^2.0.0",
+            "collect-v8-coverage": "^1.0.0"
+          }
+        },
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "cross-spawn": {
+          "version": "7.0.3",
+          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+          "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+          "dev": true,
+          "requires": {
+            "path-key": "^3.1.0",
+            "shebang-command": "^2.0.0",
+            "which": "^2.0.1"
+          }
+        },
+        "execa": {
+          "version": "5.1.1",
+          "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
+          "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
+          "dev": true,
+          "requires": {
+            "cross-spawn": "^7.0.3",
+            "get-stream": "^6.0.0",
+            "human-signals": "^2.1.0",
+            "is-stream": "^2.0.0",
+            "merge-stream": "^2.0.0",
+            "npm-run-path": "^4.0.1",
+            "onetime": "^5.1.2",
+            "signal-exit": "^3.0.3",
+            "strip-final-newline": "^2.0.0"
+          }
+        },
+        "get-stream": {
+          "version": "6.0.1",
+          "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
+          "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "is-stream": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+          "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+          "dev": true
+        },
+        "jest-message-util": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+          "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+          "dev": true,
+          "requires": {
+            "@babel/code-frame": "^7.12.13",
+            "@jest/types": "^27.5.1",
+            "@types/stack-utils": "^2.0.0",
+            "chalk": "^4.0.0",
+            "graceful-fs": "^4.2.9",
+            "micromatch": "^4.0.4",
+            "pretty-format": "^27.5.1",
+            "slash": "^3.0.0",
+            "stack-utils": "^2.0.3"
+          }
+        },
+        "npm-run-path": {
+          "version": "4.0.1",
+          "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
+          "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
+          "dev": true,
+          "requires": {
+            "path-key": "^3.0.0"
+          }
+        },
+        "path-key": {
+          "version": "3.1.1",
+          "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+          "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+          "dev": true
+        },
+        "shebang-command": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+          "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+          "dev": true,
+          "requires": {
+            "shebang-regex": "^3.0.0"
+          }
+        },
+        "shebang-regex": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+          "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        },
+        "which": {
+          "version": "2.0.2",
+          "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+          "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+          "dev": true,
+          "requires": {
+            "isexe": "^2.0.0"
+          }
+        }
+      }
+    },
+    "jest-serializer": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-serializer/-/jest-serializer-27.5.1.tgz",
+      "integrity": "sha512-jZCyo6iIxO1aqUxpuBlwTDMkzOAJS4a3eYz3YzgxxVQFwLeSA7Jfq5cbqCY+JLvTDrWirgusI/0KwxKMgrdf7w==",
+      "dev": true,
+      "requires": {
+        "@types/node": "*",
+        "graceful-fs": "^4.2.9"
+      }
+    },
+    "jest-serializer-vue": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/jest-serializer-vue/-/jest-serializer-vue-2.0.2.tgz",
+      "integrity": "sha512-nK/YIFo6qe3i9Ge+hr3h4PpRehuPPGZFt8LDBdTHYldMb7ZWlkanZS8Ls7D8h6qmQP2lBQVDLP0DKn5bJ9QApQ==",
+      "dev": true,
+      "requires": {
+        "pretty": "2.0.0"
+      }
+    },
+    "jest-snapshot": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-27.5.1.tgz",
+      "integrity": "sha512-yYykXI5a0I31xX67mgeLw1DZ0bJB+gpq5IpSuCAoyDi0+BhgU/RIrL+RTzDmkNTchvDFWKP8lp+w/42Z3us5sA==",
+      "dev": true,
+      "requires": {
+        "@babel/core": "^7.7.2",
+        "@babel/generator": "^7.7.2",
+        "@babel/plugin-syntax-typescript": "^7.7.2",
+        "@babel/traverse": "^7.7.2",
+        "@babel/types": "^7.0.0",
+        "@jest/transform": "^27.5.1",
+        "@jest/types": "^27.5.1",
+        "@types/babel__traverse": "^7.0.4",
+        "@types/prettier": "^2.1.5",
+        "babel-preset-current-node-syntax": "^1.0.0",
+        "chalk": "^4.0.0",
+        "expect": "^27.5.1",
+        "graceful-fs": "^4.2.9",
+        "jest-diff": "^27.5.1",
+        "jest-get-type": "^27.5.1",
+        "jest-haste-map": "^27.5.1",
+        "jest-matcher-utils": "^27.5.1",
+        "jest-message-util": "^27.5.1",
+        "jest-util": "^27.5.1",
+        "natural-compare": "^1.4.0",
+        "pretty-format": "^27.5.1",
+        "semver": "^7.3.2"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-message-util": {
+          "version": "27.5.1",
+          "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
+          "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+          "dev": true,
+          "requires": {
+            "@babel/code-frame": "^7.12.13",
+            "@jest/types": "^27.5.1",
+            "@types/stack-utils": "^2.0.0",
+            "chalk": "^4.0.0",
+            "graceful-fs": "^4.2.9",
+            "micromatch": "^4.0.4",
+            "pretty-format": "^27.5.1",
+            "slash": "^3.0.0",
+            "stack-utils": "^2.0.3"
+          }
+        },
+        "semver": {
+          "version": "7.5.4",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+          "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^6.0.0"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "jest-transform-stub": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/jest-transform-stub/-/jest-transform-stub-2.0.0.tgz",
+      "integrity": "sha512-lspHaCRx/mBbnm3h4uMMS3R5aZzMwyNpNIJLXj4cEsV0mIUtS4IjYJLSoyjRCtnxb6RIGJ4NL2quZzfIeNhbkg==",
+      "dev": true
+    },
+    "jest-util": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-27.5.1.tgz",
+      "integrity": "sha512-Kv2o/8jNvX1MQ0KGtw480E/w4fBCDOnH6+6DmeKi6LZUIlKA5kwY0YNdlzaWTiVgxqAqik11QyxDOKk543aKXw==",
+      "dev": true,
+      "requires": {
+        "@jest/types": "^27.5.1",
+        "@types/node": "*",
+        "chalk": "^4.0.0",
+        "ci-info": "^3.2.0",
+        "graceful-fs": "^4.2.9",
+        "picomatch": "^2.2.3"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "jest-validate": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-27.5.1.tgz",
+      "integrity": "sha512-thkNli0LYTmOI1tDB3FI1S1RTp/Bqyd9pTarJwL87OIBFuqEb5Apv5EaApEudYg4g86e3CT6kM0RowkhtEnCBQ==",
+      "dev": true,
+      "requires": {
+        "@jest/types": "^27.5.1",
+        "camelcase": "^6.2.0",
+        "chalk": "^4.0.0",
+        "jest-get-type": "^27.5.1",
+        "leven": "^3.1.0",
+        "pretty-format": "^27.5.1"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "jest-watch-typeahead": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/jest-watch-typeahead/-/jest-watch-typeahead-1.1.0.tgz",
+      "integrity": "sha512-Va5nLSJTN7YFtC2jd+7wsoe1pNe5K4ShLux/E5iHEwlB9AxaxmggY7to9KUqKojhaJw3aXqt5WAb4jGPOolpEw==",
+      "dev": true,
+      "requires": {
+        "ansi-escapes": "^4.3.1",
+        "chalk": "^4.0.0",
+        "jest-regex-util": "^28.0.0",
+        "jest-watcher": "^28.0.0",
+        "slash": "^4.0.0",
+        "string-length": "^5.0.1",
+        "strip-ansi": "^7.0.1"
+      },
+      "dependencies": {
+        "ansi-escapes": {
+          "version": "4.3.2",
+          "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
+          "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
+          "dev": true,
+          "requires": {
+            "type-fest": "^0.21.3"
+          }
+        },
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-regex-util": {
+          "version": "28.0.2",
+          "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-28.0.2.tgz",
+          "integrity": "sha512-4s0IgyNIy0y9FK+cjoVYoxamT7Zeo7MhzqRGx7YDYmaQn1wucY9rotiGkBzzcMXTtjrCAP/f7f+E0F7+fxPNdw==",
+          "dev": true
+        },
+        "slash": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/slash/-/slash-4.0.0.tgz",
+          "integrity": "sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==",
+          "dev": true
+        },
+        "string-length": {
+          "version": "5.0.1",
+          "resolved": "https://registry.npmjs.org/string-length/-/string-length-5.0.1.tgz",
+          "integrity": "sha512-9Ep08KAMUn0OadnVaBuRdE2l615CQ508kr0XMadjClfYpdCyvrbFp6Taebo8yyxokQ4viUd/xPPUA4FGgUa0ow==",
+          "dev": true,
+          "requires": {
+            "char-regex": "^2.0.0",
+            "strip-ansi": "^7.0.1"
+          },
+          "dependencies": {
+            "char-regex": {
+              "version": "2.0.1",
+              "resolved": "https://registry.npmjs.org/char-regex/-/char-regex-2.0.1.tgz",
+              "integrity": "sha512-oSvEeo6ZUD7NepqAat3RqoucZ5SeqLJgOvVIwkafu6IP3V0pO38s/ypdVUmDDK6qIIHNlYHJAKX9E7R7HoKElw==",
+              "dev": true
+            }
+          }
+        },
+        "strip-ansi": {
+          "version": "7.0.1",
+          "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.0.1.tgz",
+          "integrity": "sha512-cXNxvT8dFNRVfhVME3JAe98mkXDYN2O1l7jmcwMnOslDeESg1rF/OZMtK0nRAhiari1unG5cD4jG3rapUAkLbw==",
+          "dev": true,
+          "requires": {
+            "ansi-regex": "^6.0.1"
+          },
+          "dependencies": {
+            "ansi-regex": {
+              "version": "6.0.1",
+              "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.0.1.tgz",
+              "integrity": "sha512-n5M855fKb2SsfMIiFFoVrABHJC8QtHwVx+mHWP3QcEqBHYienj5dHSgjbxtC0WEZXYt4wcD6zrQElDPhFuZgfA==",
+              "dev": true
+            }
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        },
+        "type-fest": {
+          "version": "0.21.3",
+          "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
+          "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
+          "dev": true
+        }
+      }
+    },
+    "jest-watcher": {
+      "version": "28.1.1",
+      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-28.1.1.tgz",
+      "integrity": "sha512-RQIpeZ8EIJMxbQrXpJQYIIlubBnB9imEHsxxE41f54ZwcqWLysL/A0ZcdMirf+XsMn3xfphVQVV4EW0/p7i7Ug==",
+      "dev": true,
+      "requires": {
+        "@jest/test-result": "^28.1.1",
+        "@jest/types": "^28.1.1",
+        "@types/node": "*",
+        "ansi-escapes": "^4.2.1",
+        "chalk": "^4.0.0",
+        "emittery": "^0.10.2",
+        "jest-util": "^28.1.1",
+        "string-length": "^4.0.1"
+      },
+      "dependencies": {
+        "@jest/types": {
+          "version": "28.1.1",
+          "resolved": "https://registry.npmjs.org/@jest/types/-/types-28.1.1.tgz",
+          "integrity": "sha512-vRXVqSg1VhDnB8bWcmvLzmg0Bt9CRKVgHPXqYwvWMX3TvAjeO+nRuK6+VdTKCtWOvYlmkF/HqNAL/z+N3B53Kw==",
+          "dev": true,
+          "requires": {
+            "@jest/schemas": "^28.0.2",
+            "@types/istanbul-lib-coverage": "^2.0.0",
+            "@types/istanbul-reports": "^3.0.0",
+            "@types/node": "*",
+            "@types/yargs": "^17.0.8",
+            "chalk": "^4.0.0"
+          }
+        },
+        "@types/yargs": {
+          "version": "17.0.10",
+          "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.10.tgz",
+          "integrity": "sha512-gmEaFwpj/7f/ROdtIlci1R1VYU1J4j95m8T+Tj3iBgiBFKg1foE/PSl93bBd5T9LDXNPo8UlNN6W0qwD8O5OaA==",
+          "dev": true,
+          "requires": {
+            "@types/yargs-parser": "*"
+          }
+        },
+        "ansi-escapes": {
+          "version": "4.3.2",
+          "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
+          "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
+          "dev": true,
+          "requires": {
+            "type-fest": "^0.21.3"
+          }
+        },
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "jest-util": {
+          "version": "28.1.1",
+          "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-28.1.1.tgz",
+          "integrity": "sha512-FktOu7ca1DZSyhPAxgxB6hfh2+9zMoJ7aEQA759Z6p45NuO8mWcqujH+UdHlCm/V6JTWwDztM2ITCzU1ijJAfw==",
+          "dev": true,
+          "requires": {
+            "@jest/types": "^28.1.1",
+            "@types/node": "*",
+            "chalk": "^4.0.0",
+            "ci-info": "^3.2.0",
+            "graceful-fs": "^4.2.9",
+            "picomatch": "^2.2.3"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        },
+        "type-fest": {
+          "version": "0.21.3",
+          "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
+          "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
+          "dev": true
+        }
+      }
+    },
+    "jest-worker": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-27.5.1.tgz",
+      "integrity": "sha512-7vuh85V5cdDofPyxn58nrPjBktZo0u9x1g8WtjQol+jZDaE+fhN+cIvTj11GndBnMnyfrUOG1sZQxCdjKh+DKg==",
+      "dev": true,
+      "requires": {
+        "@types/node": "*",
+        "merge-stream": "^2.0.0",
+        "supports-color": "^8.0.0"
+      },
+      "dependencies": {
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "8.1.1",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
+          "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "joi": {
+      "version": "17.6.0",
+      "resolved": "https://registry.npmjs.org/joi/-/joi-17.6.0.tgz",
+      "integrity": "sha512-OX5dG6DTbcr/kbMFj0KGYxuew69HPcAE3K/sZpEV2nP6e/j/C0HV+HNiBPCASxdx5T7DMoa0s8UeHWMnb6n2zw==",
+      "dev": true,
+      "requires": {
+        "@hapi/hoek": "^9.0.0",
+        "@hapi/topo": "^5.0.0",
+        "@sideway/address": "^4.1.3",
+        "@sideway/formula": "^3.0.0",
+        "@sideway/pinpoint": "^2.0.0"
+      }
+    },
+    "js-beautify": {
+      "version": "1.14.4",
+      "resolved": "https://registry.npmjs.org/js-beautify/-/js-beautify-1.14.4.tgz",
+      "integrity": "sha512-+b4A9c3glceZEmxyIbxDOYB0ZJdReLvyU1077RqKsO4dZx9FUHjTOJn8VHwpg33QoucIykOiYbh7MfqBOghnrA==",
+      "dev": true,
+      "requires": {
+        "config-chain": "^1.1.13",
+        "editorconfig": "^0.15.3",
+        "glob": "^7.1.3",
+        "nopt": "^5.0.0"
+      }
+    },
+    "js-message": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/js-message/-/js-message-1.0.7.tgz",
+      "integrity": "sha512-efJLHhLjIyKRewNS9EGZ4UpI8NguuL6fKkhRxVuMmrGV2xN/0APGdQYwLFky5w9naebSZ0OwAGp0G6/2Cg90rA==",
+      "dev": true
+    },
+    "js-tokens": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+      "dev": true
+    },
+    "js-yaml": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
+      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "requires": {
+        "argparse": "^2.0.1"
+      }
+    },
+    "jsdom": {
+      "version": "16.7.0",
+      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-16.7.0.tgz",
+      "integrity": "sha512-u9Smc2G1USStM+s/x1ru5Sxrl6mPYCbByG1U/hUmqaVsm4tbNyS7CicOSRyuGQYZhTu0h84qkZZQ/I+dzizSVw==",
+      "dev": true,
+      "requires": {
+        "abab": "^2.0.5",
+        "acorn": "^8.2.4",
+        "acorn-globals": "^6.0.0",
+        "cssom": "^0.4.4",
+        "cssstyle": "^2.3.0",
+        "data-urls": "^2.0.0",
+        "decimal.js": "^10.2.1",
+        "domexception": "^2.0.1",
+        "escodegen": "^2.0.0",
+        "form-data": "^3.0.0",
+        "html-encoding-sniffer": "^2.0.1",
+        "http-proxy-agent": "^4.0.1",
+        "https-proxy-agent": "^5.0.0",
+        "is-potential-custom-element-name": "^1.0.1",
+        "nwsapi": "^2.2.0",
+        "parse5": "6.0.1",
+        "saxes": "^5.0.1",
+        "symbol-tree": "^3.2.4",
+        "tough-cookie": "^4.0.0",
+        "w3c-hr-time": "^1.0.2",
+        "w3c-xmlserializer": "^2.0.0",
+        "webidl-conversions": "^6.1.0",
+        "whatwg-encoding": "^1.0.5",
+        "whatwg-mimetype": "^2.3.0",
+        "whatwg-url": "^8.5.0",
+        "ws": "^7.4.6",
+        "xml-name-validator": "^3.0.0"
+      },
+      "dependencies": {
+        "parse5": {
+          "version": "6.0.1",
+          "resolved": "https://registry.npmjs.org/parse5/-/parse5-6.0.1.tgz",
+          "integrity": "sha512-Ofn/CTFzRGTTxwpNEs9PP93gXShHcTq255nzRYSKe8AkVpZY7e1fpmTfOyoIvjP5HG7Z2ZM7VS9PPhQGW2pOpw==",
+          "dev": true
+        },
+        "tr46": {
+          "version": "2.1.0",
+          "resolved": "https://registry.npmjs.org/tr46/-/tr46-2.1.0.tgz",
+          "integrity": "sha512-15Ih7phfcdP5YxqiB+iDtLoaTz4Nd35+IiAv0kQ5FNKHzXgdWqPoTIqEDDJmXceQt4JZk6lVPT8lnDlPpGDppw==",
+          "dev": true,
+          "requires": {
+            "punycode": "^2.1.1"
+          }
+        },
+        "webidl-conversions": {
+          "version": "6.1.0",
+          "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-6.1.0.tgz",
+          "integrity": "sha512-qBIvFLGiBpLjfwmYAaHPXsn+ho5xZnGvyGvsarywGNc8VyQJUMHJ8OBKGGrPER0okBeMDaan4mNBlgBROxuI8w==",
+          "dev": true
+        },
+        "whatwg-url": {
+          "version": "8.7.0",
+          "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-8.7.0.tgz",
+          "integrity": "sha512-gAojqb/m9Q8a5IV96E3fHJM70AzCkgt4uXYX2O7EmuyOnLrViCQlsEBmF9UQIu3/aeAIp2U17rtbpZWNntQqdg==",
+          "dev": true,
+          "requires": {
+            "lodash": "^4.7.0",
+            "tr46": "^2.1.0",
+            "webidl-conversions": "^6.1.0"
+          }
+        },
+        "xml-name-validator": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-3.0.0.tgz",
+          "integrity": "sha512-A5CUptxDsvxKJEU3yO6DuWBSJz/qizqzJKOMIfUJHETbBw/sFaDxgd6fxm1ewUaM0jZ444Fc5vC5ROYurg/4Pw==",
+          "dev": true
+        }
+      }
+    },
+    "jsesc": {
+      "version": "2.5.2",
+      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
+      "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
+      "dev": true
+    },
+    "json-parse-better-errors": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/json-parse-better-errors/-/json-parse-better-errors-1.0.2.tgz",
+      "integrity": "sha512-mrqyZKfX5EhL7hvqcV6WG1yYjnjeuYDzDhhcAAUrq8Po85NBQBJP+ZDUT75qZQ98IkUoBqdkExkukOU7Ts2wrw==",
+      "dev": true
+    },
+    "json-parse-even-better-errors": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz",
+      "integrity": "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==",
+      "dev": true
+    },
+    "json-schema-traverse": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "dev": true
+    },
+    "json-stable-stringify-without-jsonify": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
+      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
+      "dev": true
+    },
+    "json5": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true
+    },
+    "jsonc-parser": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.0.tgz",
+      "integrity": "sha512-gfFQZrcTc8CnKXp6Y4/CBT3fTc0OVuDofpre4aEeEpSBPV5X5v4+Vmx+8snU7RLPrNHPKSgLxGo9YuQzz20o+w=="
+    },
+    "jsonfile": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
+      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+      "dev": true,
+      "requires": {
+        "graceful-fs": "^4.1.6",
+        "universalify": "^2.0.0"
+      }
+    },
+    "kind-of": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.3.tgz",
+      "integrity": "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==",
+      "dev": true
+    },
+    "kleur": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/kleur/-/kleur-3.0.3.tgz",
+      "integrity": "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==",
+      "dev": true
+    },
+    "klona": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/klona/-/klona-2.0.5.tgz",
+      "integrity": "sha512-pJiBpiXMbt7dkzXe8Ghj/u4FfXOOa98fPW+bihOJ4SjnoijweJrNThJfd3ifXpXhREjpoF2mZVH1GfS9LV3kHQ==",
+      "dev": true
+    },
+    "kubernetes-types": {
+      "version": "1.26.0",
+      "resolved": "https://registry.npmjs.org/kubernetes-types/-/kubernetes-types-1.26.0.tgz",
+      "integrity": "sha512-jv0XaTIGW/p18jaiKRD85hLTYWx0yEj+cb6PDX3GdNa3dWoRxnD4Gv7+bE6C/ehcsp2skcdy34vT25jbPofDIQ==",
+      "dev": true
+    },
+    "launch-editor": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/launch-editor/-/launch-editor-2.4.0.tgz",
+      "integrity": "sha512-mZ0BHeSn/ohL+Ib+b+JnxC59vcNz6v5IR9d0CuM8f0x8ni8oK3IIG6G0vMkpxc0gFsmvINkztGOHiWTaX4BmAg==",
+      "dev": true,
+      "requires": {
+        "picocolors": "^1.0.0",
+        "shell-quote": "^1.6.1"
+      }
+    },
+    "launch-editor-middleware": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/launch-editor-middleware/-/launch-editor-middleware-2.4.0.tgz",
+      "integrity": "sha512-/M7AX/6xktZY60KE7j71XLrj9U6H5TBoP+mJzhYB3fcdAq8rcazit/K0qWiu1jvytUPXP4lJRd1VJFwvdMQ/uw==",
+      "dev": true,
+      "requires": {
+        "launch-editor": "^2.4.0"
+      }
+    },
+    "leven": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/leven/-/leven-3.1.0.tgz",
+      "integrity": "sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==",
+      "dev": true
+    },
+    "levn": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
+      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
+      "dev": true,
+      "requires": {
+        "prelude-ls": "^1.2.1",
+        "type-check": "~0.4.0"
+      }
+    },
+    "lilconfig": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-2.0.5.tgz",
+      "integrity": "sha512-xaYmXZtTHPAw5m+xLN8ab9C+3a8YmV3asNSPOATITbtwrfbwaLJj8h66H1WMIpALCkqsIzK3h7oQ+PdX+LQ9Eg==",
+      "dev": true
+    },
+    "lines-and-columns": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/lines-and-columns/-/lines-and-columns-1.2.4.tgz",
+      "integrity": "sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==",
+      "dev": true
+    },
+    "loader-runner": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/loader-runner/-/loader-runner-4.3.0.tgz",
+      "integrity": "sha512-3R/1M+yS3j5ou80Me59j7F9IMs4PXs3VqRrm0TU3AbKPxlmpoY1TNscJV/oGJXo8qCatFGTfDbY6W6ipGOYXfg==",
+      "dev": true
+    },
+    "loader-utils": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.2.tgz",
+      "integrity": "sha512-I5d00Pd/jwMD2QCduo657+YM/6L3KZu++pmX9VFncxaxvHcru9jx1lBaFft+r4Mt2jK0Yhp41XlRAihzPxHNCg==",
+      "dev": true,
+      "requires": {
+        "big.js": "^5.2.2",
+        "emojis-list": "^3.0.0",
+        "json5": "^1.0.1"
+      },
+      "dependencies": {
+        "json5": {
+          "version": "1.0.2",
+          "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz",
+          "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==",
+          "dev": true,
+          "requires": {
+            "minimist": "^1.2.0"
+          }
+        }
+      }
+    },
+    "locate-path": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
+      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
+      "dev": true,
+      "requires": {
+        "p-locate": "^4.1.0"
+      }
+    },
+    "lodash": {
+      "version": "4.17.21",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
+      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="
+    },
+    "lodash.debounce": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/lodash.debounce/-/lodash.debounce-4.0.8.tgz",
+      "integrity": "sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow==",
+      "dev": true
+    },
+    "lodash.defaultsdeep": {
+      "version": "4.6.1",
+      "resolved": "https://registry.npmjs.org/lodash.defaultsdeep/-/lodash.defaultsdeep-4.6.1.tgz",
+      "integrity": "sha512-3j8wdDzYuWO3lM3Reg03MuQR957t287Rpcxp1njpEa8oDrikb+FwGdW3n+FELh/A6qib6yPit0j/pv9G/yeAqA==",
+      "dev": true
+    },
+    "lodash.kebabcase": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/lodash.kebabcase/-/lodash.kebabcase-4.1.1.tgz",
+      "integrity": "sha512-N8XRTIMMqqDgSy4VLKPnJ/+hpGZN+PHQiJnSenYqPaVV/NCqEogTnAdZLQiGKhxX+JCs8waWq2t1XHWKOmlY8g==",
+      "dev": true
+    },
+    "lodash.mapvalues": {
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/lodash.mapvalues/-/lodash.mapvalues-4.6.0.tgz",
+      "integrity": "sha512-JPFqXFeZQ7BfS00H58kClY7SPVeHertPE0lNuCyZ26/XlN8TvakYD7b9bGyNmXbT/D3BbtPAAmq90gPWqLkxlQ==",
+      "dev": true
+    },
+    "lodash.memoize": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/lodash.memoize/-/lodash.memoize-4.1.2.tgz",
+      "integrity": "sha512-t7j+NzmgnQzTAYXcsHYLgimltOV1MXHtlOWf6GjL9Kj8GK5FInw5JotxvbOs+IvV1/Dzo04/fCGfLVs7aXb4Ag==",
+      "dev": true
+    },
+    "lodash.merge": {
+      "version": "4.6.2",
+      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
+      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
+      "dev": true
+    },
+    "lodash.truncate": {
+      "version": "4.4.2",
+      "resolved": "https://registry.npmjs.org/lodash.truncate/-/lodash.truncate-4.4.2.tgz",
+      "integrity": "sha512-jttmRe7bRse52OsWIMDLaXxWqRAmtIUccAQ3garviCqJjafXOfNMO0yMfNpdD6zbGaTU0P5Nz7e7gAT6cKmJRw==",
+      "dev": true
+    },
+    "lodash.uniq": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/lodash.uniq/-/lodash.uniq-4.5.0.tgz",
+      "integrity": "sha512-xfBaXQd9ryd9dlSDvnvI0lvxfLJlYAZzXomUYzLKtUeOQvOP5piqAWuGtrhWeqaXK9hhoM/iyJc5AV+XfsX3HQ==",
+      "dev": true
+    },
+    "log-symbols": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/log-symbols/-/log-symbols-4.1.0.tgz",
+      "integrity": "sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==",
+      "dev": true,
+      "requires": {
+        "chalk": "^4.1.0",
+        "is-unicode-supported": "^0.1.0"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "log-update": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/log-update/-/log-update-2.3.0.tgz",
+      "integrity": "sha512-vlP11XfFGyeNQlmEn9tJ66rEW1coA/79m5z6BCkudjbAGE83uhAcGYrBFwfs3AdLiLzGRusRPAbSPK9xZteCmg==",
+      "dev": true,
+      "requires": {
+        "ansi-escapes": "^3.0.0",
+        "cli-cursor": "^2.0.0",
+        "wrap-ansi": "^3.0.1"
+      },
+      "dependencies": {
+        "ansi-regex": {
+          "version": "3.0.1",
+          "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.1.tgz",
+          "integrity": "sha512-+O9Jct8wf++lXxxFc4hc8LsjaSq0HFzzL7cVsw8pRDIPdjKD2mT4ytDZlLuSBZ4cLKZFXIrMGO7DbQCtMJJMKw==",
+          "dev": true
+        },
+        "cli-cursor": {
+          "version": "2.1.0",
+          "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-2.1.0.tgz",
+          "integrity": "sha512-8lgKz8LmCRYZZQDpRyT2m5rKJ08TnU4tR9FFFW2rxpxR1FzWi4PQ/NfyODchAatHaUgnSPVcx/R5w6NuTBzFiw==",
+          "dev": true,
+          "requires": {
+            "restore-cursor": "^2.0.0"
+          }
+        },
+        "is-fullwidth-code-point": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-2.0.0.tgz",
+          "integrity": "sha512-VHskAKYM8RfSFXwee5t5cbN5PZeq1Wrh6qd5bkyiXIf6UQcN6w/A0eXM9r6t8d+GYOh+o6ZhiEnb88LN/Y8m2w==",
+          "dev": true
+        },
+        "mimic-fn": {
+          "version": "1.2.0",
+          "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-1.2.0.tgz",
+          "integrity": "sha512-jf84uxzwiuiIVKiOLpfYk7N46TSy8ubTonmneY9vrpHNAnp0QBt2BxWV9dO3/j+BoVAb+a5G6YDPW3M5HOdMWQ==",
+          "dev": true
+        },
+        "onetime": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/onetime/-/onetime-2.0.1.tgz",
+          "integrity": "sha512-oyyPpiMaKARvvcgip+JV+7zci5L8D1W9RZIz2l1o08AM3pfspitVWnPt3mzHcBPp12oYMTy0pqrFs/C+m3EwsQ==",
+          "dev": true,
+          "requires": {
+            "mimic-fn": "^1.0.0"
+          }
+        },
+        "restore-cursor": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-2.0.0.tgz",
+          "integrity": "sha512-6IzJLuGi4+R14vwagDHX+JrXmPVtPpn4mffDJ1UdR7/Edm87fl6yi8mMBIVvFtJaNTUvjughmW4hwLhRG7gC1Q==",
+          "dev": true,
+          "requires": {
+            "onetime": "^2.0.0",
+            "signal-exit": "^3.0.2"
+          }
+        },
+        "string-width": {
+          "version": "2.1.1",
+          "resolved": "https://registry.npmjs.org/string-width/-/string-width-2.1.1.tgz",
+          "integrity": "sha512-nOqH59deCq9SRHlxq1Aw85Jnt4w6KvLKqWVik6oA9ZklXLNIOlqg4F2yrT1MVaTjAqvVwdfeZ7w7aCvJD7ugkw==",
+          "dev": true,
+          "requires": {
+            "is-fullwidth-code-point": "^2.0.0",
+            "strip-ansi": "^4.0.0"
+          }
+        },
+        "strip-ansi": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-4.0.0.tgz",
+          "integrity": "sha512-4XaJ2zQdCzROZDivEVIDPkcQn8LMFSa8kj8Gxb/Lnwzv9A8VctNZ+lfivC/sV3ivW8ElJTERXZoPBRrZKkNKow==",
+          "dev": true,
+          "requires": {
+            "ansi-regex": "^3.0.0"
+          }
+        },
+        "wrap-ansi": {
+          "version": "3.0.1",
+          "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-3.0.1.tgz",
+          "integrity": "sha512-iXR3tDXpbnTpzjKSylUJRkLuOrEC7hwEB221cgn6wtF8wpmz28puFXAEfPT5zrjM3wahygB//VuWEr1vTkDcNQ==",
+          "dev": true,
+          "requires": {
+            "string-width": "^2.1.1",
+            "strip-ansi": "^4.0.0"
+          }
+        }
+      }
+    },
+    "long": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/long/-/long-5.2.0.tgz",
+      "integrity": "sha512-9RTUNjK60eJbx3uz+TEGF7fUr29ZDxR5QzXcyDpeSfeH28S9ycINflOgOlppit5U+4kNTe83KQnMEerw7GmE8w=="
+    },
+    "lower-case": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/lower-case/-/lower-case-2.0.2.tgz",
+      "integrity": "sha512-7fm3l3NAF9WfN6W3JOmf5drwpVqX78JtoGJ3A6W0a6ZnldM41w2fV5D490psKFTpMds8TJse/eHLFFsNHHjHgg==",
+      "dev": true,
+      "requires": {
+        "tslib": "^2.0.3"
+      }
+    },
+    "lru-cache": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
+      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
+      "dev": true,
+      "requires": {
+        "yallist": "^4.0.0"
+      }
+    },
+    "luxon": {
+      "version": "2.5.2",
+      "resolved": "https://registry.npmjs.org/luxon/-/luxon-2.5.2.tgz",
+      "integrity": "sha512-Yg7/RDp4nedqmLgyH0LwgGRvMEKVzKbUdkBYyCosbHgJ+kaOUx0qzSiSatVc3DFygnirTPYnMM2P5dg2uH1WvA=="
+    },
+    "magic-string": {
+      "version": "0.25.9",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.25.9.tgz",
+      "integrity": "sha512-RmF0AsMzgt25qzqqLc1+MbHmhdx0ojF2Fvs4XnOqz2ZOBXzzkEwc/dJQZCYHAn7v1jbVOjAZfK8msRn4BxO4VQ==",
+      "requires": {
+        "sourcemap-codec": "^1.4.8"
+      }
+    },
+    "make-dir": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-3.1.0.tgz",
+      "integrity": "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==",
+      "dev": true,
+      "requires": {
+        "semver": "^6.0.0"
+      }
+    },
+    "make-error": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz",
+      "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==",
+      "dev": true
+    },
+    "makeerror": {
+      "version": "1.0.12",
+      "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz",
+      "integrity": "sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==",
+      "dev": true,
+      "requires": {
+        "tmpl": "1.0.5"
+      }
+    },
+    "mdn-data": {
+      "version": "2.0.14",
+      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.0.14.tgz",
+      "integrity": "sha512-dn6wd0uw5GsdswPFfsgMp5NSB0/aDe6fK94YJV/AJDYXL6HVLWBsxeq7js7Ad+mU2K9LAlwpk6kN2D5mwCPVow==",
+      "dev": true
+    },
+    "media-typer": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
+      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
+      "dev": true
+    },
+    "memfs": {
+      "version": "3.4.7",
+      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.4.7.tgz",
+      "integrity": "sha512-ygaiUSNalBX85388uskeCyhSAoOSgzBbtVCr9jA2RROssFL9Q19/ZXFqS+2Th2sr1ewNIWgFdLzLC3Yl1Zv+lw==",
+      "dev": true,
+      "requires": {
+        "fs-monkey": "^1.0.3"
+      }
+    },
+    "merge-descriptors": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.1.tgz",
+      "integrity": "sha512-cCi6g3/Zr1iqQi6ySbseM1Xvooa98N0w31jzUYrXPX2xqObmFGHJ0tQ5u74H3mVh7wLouTseZyYIq39g8cNp1w==",
+      "dev": true
+    },
+    "merge-source-map": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/merge-source-map/-/merge-source-map-1.1.0.tgz",
+      "integrity": "sha512-Qkcp7P2ygktpMPh2mCQZaf3jhN6D3Z/qVZHSdWvQ+2Ef5HgRAPBO57A77+ENm0CPx2+1Ce/MYKi3ymqdfuqibw==",
+      "dev": true,
+      "requires": {
+        "source-map": "^0.6.1"
+      }
+    },
+    "merge-stream": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
+      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==",
+      "dev": true
+    },
+    "merge2": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
+      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
+      "dev": true
+    },
+    "methods": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
+      "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
+      "dev": true
+    },
+    "micromatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz",
+      "integrity": "sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==",
+      "dev": true,
+      "requires": {
+        "braces": "^3.0.2",
+        "picomatch": "^2.3.1"
+      }
+    },
+    "mime": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
+      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
+      "dev": true
+    },
+    "mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "dev": true
+    },
+    "mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "dev": true,
+      "requires": {
+        "mime-db": "1.52.0"
+      }
+    },
+    "mimic-fn": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
+      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
+      "dev": true
+    },
+    "mini-css-extract-plugin": {
+      "version": "2.6.1",
+      "resolved": "https://registry.npmjs.org/mini-css-extract-plugin/-/mini-css-extract-plugin-2.6.1.tgz",
+      "integrity": "sha512-wd+SD57/K6DiV7jIR34P+s3uckTRuQvx0tKPcvjFlrEylk6P4mQ2KSWk1hblj1Kxaqok7LogKOieygXqBczNlg==",
+      "dev": true,
+      "requires": {
+        "schema-utils": "^4.0.0"
+      },
+      "dependencies": {
+        "ajv": {
+          "version": "8.11.0",
+          "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.11.0.tgz",
+          "integrity": "sha512-wGgprdCvMalC0BztXvitD2hC04YffAvtsUn93JbGXYLAtCUO4xd17mCCZQxUOItiBwZvJScWo8NIvQMQ71rdpg==",
+          "dev": true,
+          "requires": {
+            "fast-deep-equal": "^3.1.1",
+            "json-schema-traverse": "^1.0.0",
+            "require-from-string": "^2.0.2",
+            "uri-js": "^4.2.2"
+          }
+        },
+        "ajv-keywords": {
+          "version": "5.1.0",
+          "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-5.1.0.tgz",
+          "integrity": "sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw==",
+          "dev": true,
+          "requires": {
+            "fast-deep-equal": "^3.1.3"
+          }
+        },
+        "json-schema-traverse": {
+          "version": "1.0.0",
+          "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+          "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+          "dev": true
+        },
+        "schema-utils": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.0.0.tgz",
+          "integrity": "sha512-1edyXKgh6XnJsJSQ8mKWXnN/BVaIbFMLpouRUrXgVq7WYne5kw3MW7UPhO44uRXQSIpTSXoJbmrR2X0w9kUTyg==",
+          "dev": true,
+          "requires": {
+            "@types/json-schema": "^7.0.9",
+            "ajv": "^8.8.0",
+            "ajv-formats": "^2.1.1",
+            "ajv-keywords": "^5.0.0"
+          }
+        }
+      }
+    },
+    "minimalistic-assert": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz",
+      "integrity": "sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==",
+      "dev": true
+    },
+    "minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dev": true,
+      "requires": {
+        "brace-expansion": "^1.1.7"
+      }
+    },
+    "minimist": {
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz",
+      "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q==",
+      "dev": true
+    },
+    "minipass": {
+      "version": "3.3.4",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.4.tgz",
+      "integrity": "sha512-I9WPbWHCGu8W+6k1ZiGpPu0GkoKBeorkfKNuAFBNS1HNFJvke82sxvI5bzcCNpWPorkOO5QQ+zomzzwRxejXiw==",
+      "dev": true,
+      "requires": {
+        "yallist": "^4.0.0"
+      }
+    },
+    "mitt": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/mitt/-/mitt-2.1.0.tgz",
+      "integrity": "sha512-ILj2TpLiysu2wkBbWjAmww7TkZb65aiQO+DkVdUTBpBXq+MHYiETENkKFMtsJZX1Lf4pe4QOrTSjIfUwN5lRdg=="
+    },
+    "mkdirp": {
+      "version": "0.5.6",
+      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
+      "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
+      "dev": true,
+      "requires": {
+        "minimist": "^1.2.6"
+      }
+    },
+    "module-alias": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/module-alias/-/module-alias-2.2.2.tgz",
+      "integrity": "sha512-A/78XjoX2EmNvppVWEhM2oGk3x4lLxnkEA4jTbaK97QKSDjkIoOsKQlfylt/d3kKKi596Qy3NP5XrXJ6fZIC9Q==",
+      "dev": true
+    },
+    "monaco-editor": {
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/monaco-editor/-/monaco-editor-0.33.0.tgz",
+      "integrity": "sha512-VcRWPSLIUEgQJQIE0pVT8FcGBIgFoxz7jtqctE+IiCxWugD0DwgyQBcZBhdSrdMC84eumoqMZsGl2GTreOzwqw=="
+    },
+    "monaco-editor-vue3": {
+      "version": "0.1.10",
+      "resolved": "https://registry.npmjs.org/monaco-editor-vue3/-/monaco-editor-vue3-0.1.10.tgz",
+      "integrity": "sha512-C1jhyx+KHQyW1AbjuA8DhIZSqkVquV7MnuWXG9jESd0e+CkzEFzuk1RvNqlN2eJ2fRkvF32yEPHYfvz9quOhHQ==",
+      "requires": {
+        "monaco-editor": "^0.33.0",
+        "vite-plugin-monaco-editor": "^1.1.0",
+        "vue": "^3.2.37"
+      }
+    },
+    "monaco-marker-data-provider": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/monaco-marker-data-provider/-/monaco-marker-data-provider-1.1.1.tgz",
+      "integrity": "sha512-PGB7TJSZE5tmHzkxv/OEwK2RGNC2A7dcq4JRJnnj31CUAsfmw0Gl+1QTrH0W0deKhcQmQM0YVPaqgQ+0wCt8Mg==",
+      "requires": {}
+    },
+    "monaco-worker-manager": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/monaco-worker-manager/-/monaco-worker-manager-2.0.1.tgz",
+      "integrity": "sha512-kdPL0yvg5qjhKPNVjJoym331PY/5JC11aPJXtCZNwWRvBr6jhkIamvYAyiY5P1AWFmNOy0aRDRoMdZfa71h8kg==",
+      "requires": {}
+    },
+    "monaco-yaml": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/monaco-yaml/-/monaco-yaml-4.0.4.tgz",
+      "integrity": "sha512-qbM36fY1twpDUs4lhhxoXDQGUPVyYAFCPJi3E0JKgLioD8wzsD/pawgauFFXSzpMa09z8wbt/DTLXjXEehnVFA==",
+      "requires": {
+        "@types/json-schema": "^7.0.0",
+        "jsonc-parser": "^3.0.0",
+        "monaco-marker-data-provider": "^1.0.0",
+        "monaco-worker-manager": "^2.0.0",
+        "path-browserify": "^1.0.0",
+        "prettier": "^2.0.0",
+        "vscode-languageserver-textdocument": "^1.0.0",
+        "vscode-languageserver-types": "^3.0.0",
+        "vscode-uri": "^3.0.0",
+        "yaml": "^2.0.0"
+      },
+      "dependencies": {
+        "yaml": {
+          "version": "2.2.2",
+          "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.2.2.tgz",
+          "integrity": "sha512-CBKFWExMn46Foo4cldiChEzn7S7SRV+wqiluAb6xmueD/fGyRHIhX8m14vVGgeFWjN540nKCNVj6P21eQjgTuA=="
+        }
+      }
+    },
+    "mrmime": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/mrmime/-/mrmime-1.0.1.tgz",
+      "integrity": "sha512-hzzEagAgDyoU1Q6yg5uI+AorQgdvMCur3FcKf7NhMKWsaYg+RnbTyHRa/9IlLF9rf455MOCtcqqrQQ83pPP7Uw==",
+      "dev": true
+    },
+    "ms": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+      "dev": true
+    },
+    "multicast-dns": {
+      "version": "7.2.5",
+      "resolved": "https://registry.npmjs.org/multicast-dns/-/multicast-dns-7.2.5.tgz",
+      "integrity": "sha512-2eznPJP8z2BFLX50tf0LuODrpINqP1RVIm/CObbTcBRITQgmC/TjcREF1NeTBzIcR5XO/ukWo+YHOjBbFwIupg==",
+      "dev": true,
+      "requires": {
+        "dns-packet": "^5.2.2",
+        "thunky": "^1.0.2"
+      }
+    },
+    "mz": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/mz/-/mz-2.7.0.tgz",
+      "integrity": "sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==",
+      "dev": true,
+      "requires": {
+        "any-promise": "^1.0.0",
+        "object-assign": "^4.0.1",
+        "thenify-all": "^1.0.0"
+      }
+    },
+    "nanoid": {
+      "version": "3.3.4",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.4.tgz",
+      "integrity": "sha512-MqBkQh/OHTS2egovRtLk45wEyNXwF+cokD+1YPf9u5VfJiRdAiRwB2froX5Co9Rh20xs4siNPm8naNotSD6RBw=="
+    },
+    "natural-compare": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
+      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
+      "dev": true
+    },
+    "negotiator": {
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
+      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
+      "dev": true
+    },
+    "neo-async": {
+      "version": "2.6.2",
+      "resolved": "https://registry.npmjs.org/neo-async/-/neo-async-2.6.2.tgz",
+      "integrity": "sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==",
+      "dev": true
+    },
+    "nice-try": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/nice-try/-/nice-try-1.0.5.tgz",
+      "integrity": "sha512-1nh45deeb5olNY7eX82BkPO7SSxR5SSYJiPTrTdFUVYwAl8CKMA5N9PjTYkHiRjisVcxcQ1HXdLhx2qxxJzLNQ==",
+      "dev": true
+    },
+    "no-case": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/no-case/-/no-case-3.0.4.tgz",
+      "integrity": "sha512-fgAN3jGAh+RoxUGZHTSOLJIqUc2wmoBwGR4tbpNAKmmovFoWq0OdRkb0VkldReO2a2iBT/OEulG9XSUc10r3zg==",
+      "dev": true,
+      "requires": {
+        "lower-case": "^2.0.2",
+        "tslib": "^2.0.3"
+      }
+    },
+    "node-fetch": {
+      "version": "2.6.7",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.7.tgz",
+      "integrity": "sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ==",
+      "dev": true,
+      "requires": {
+        "whatwg-url": "^5.0.0"
+      }
+    },
+    "node-forge": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.1.tgz",
+      "integrity": "sha512-dPEtOeMvF9VMcYV/1Wb8CPoVAXtp6MKMlcbAt4ddqmGqUJ6fQZFXkNZNkNlfevtNkGtaSoXf/vNNNSvgrdXwtA==",
+      "dev": true
+    },
+    "node-int64": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
+      "integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==",
+      "dev": true
+    },
+    "node-releases": {
+      "version": "2.0.13",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.13.tgz",
+      "integrity": "sha512-uYr7J37ae/ORWdZeQ1xxMJe3NtdmqMC/JZK+geofDrkLUApKRHPd18/TxtBOJ4A0/+uUIliorNrfYV6s1b02eQ==",
+      "dev": true
+    },
+    "nopt": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/nopt/-/nopt-5.0.0.tgz",
+      "integrity": "sha512-Tbj67rffqceeLpcRXrT7vKAN8CwfPeIBgM7E6iBkmKLV7bEMwpGgYLGv0jACUsECaa/vuxP0IjEont6umdMgtQ==",
+      "dev": true,
+      "requires": {
+        "abbrev": "1"
+      }
+    },
+    "normalize-package-data": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-2.5.0.tgz",
+      "integrity": "sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==",
+      "dev": true,
+      "requires": {
+        "hosted-git-info": "^2.1.4",
+        "resolve": "^1.10.0",
+        "semver": "2 || 3 || 4 || 5",
+        "validate-npm-package-license": "^3.0.1"
+      },
+      "dependencies": {
+        "semver": {
+          "version": "5.7.2",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+          "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
+          "dev": true
+        }
+      }
+    },
+    "normalize-path": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
+      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
+      "dev": true
+    },
+    "normalize-range": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/normalize-range/-/normalize-range-0.1.2.tgz",
+      "integrity": "sha512-bdok/XvKII3nUpklnV6P2hxtMNrCboOjAcyBuQnWEhO665FwrSNRxU+AqpsyvO6LgGYPspN+lu5CLtw4jPRKNA==",
+      "dev": true
+    },
+    "normalize-url": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-6.1.0.tgz",
+      "integrity": "sha512-DlL+XwOy3NxAQ8xuC0okPgK46iuVNAK01YN7RueYBqqFeGsBjV9XmCAzAdgt+667bCl5kPh9EqKKDwnaPG1I7A==",
+      "dev": true
+    },
+    "npm-run-path": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-2.0.2.tgz",
+      "integrity": "sha512-lJxZYlT4DW/bRUtFh1MQIWqmLwQfAxnqWG4HhEdjMlkrJYnJn0Jrr2u3mgxqaWsdiBc76TYkTG/mhrnYTuzfHw==",
+      "dev": true,
+      "requires": {
+        "path-key": "^2.0.0"
+      }
+    },
+    "nth-check": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/nth-check/-/nth-check-2.1.1.tgz",
+      "integrity": "sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==",
+      "dev": true,
+      "requires": {
+        "boolbase": "^1.0.0"
+      }
+    },
+    "nwsapi": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.1.tgz",
+      "integrity": "sha512-JYOWTeFoS0Z93587vRJgASD5Ut11fYl5NyihP3KrYBvMe1FRRs6RN7m20SA/16GM4P6hTnZjT+UmDOt38UeXNg==",
+      "dev": true
+    },
+    "object-assign": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
+      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
+      "dev": true
+    },
+    "object-hash": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-3.0.0.tgz",
+      "integrity": "sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==",
+      "dev": true
+    },
+    "object-inspect": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.12.2.tgz",
+      "integrity": "sha512-z+cPxW0QGUp0mcqcsgQyLVRDoXFQbXOwBaqyF7VIgI4TWNQsDHrBpUQslRmIfAoYWdYzs6UlKJtB2XJpTaNSpQ==",
+      "dev": true
+    },
+    "object-keys": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
+      "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==",
+      "dev": true
+    },
+    "object.assign": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/object.assign/-/object.assign-4.1.2.tgz",
+      "integrity": "sha512-ixT2L5THXsApyiUPYKmW+2EHpXXe5Ii3M+f4e+aJFAHao5amFRW6J0OO6c/LU8Be47utCx2GL89hxGB6XSmKuQ==",
+      "dev": true,
+      "requires": {
+        "call-bind": "^1.0.0",
+        "define-properties": "^1.1.3",
+        "has-symbols": "^1.0.1",
+        "object-keys": "^1.1.1"
+      }
+    },
+    "obuf": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/obuf/-/obuf-1.1.2.tgz",
+      "integrity": "sha512-PX1wu0AmAdPqOL1mWhqmlOd8kOIZQwGZw6rh7uby9fTc5lhaOWFLX3I6R1hrF9k3zUY40e6igsLGkDXK92LJNg==",
+      "dev": true
+    },
+    "on-finished": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
+      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "dev": true,
+      "requires": {
+        "ee-first": "1.1.1"
+      }
+    },
+    "on-headers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz",
+      "integrity": "sha512-pZAE+FJLoyITytdqK0U5s+FIpjN0JP3OzFi/u8Rx+EV5/W+JTWGXG8xFzevE7AjBfDqHv/8vL8qQsIhHnqRkrA==",
+      "dev": true
+    },
+    "once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dev": true,
+      "requires": {
+        "wrappy": "1"
+      }
+    },
+    "onetime": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
+      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
+      "dev": true,
+      "requires": {
+        "mimic-fn": "^2.1.0"
+      }
+    },
+    "open": {
+      "version": "8.4.0",
+      "resolved": "https://registry.npmjs.org/open/-/open-8.4.0.tgz",
+      "integrity": "sha512-XgFPPM+B28FtCCgSb9I+s9szOC1vZRSwgWsRUA5ylIxRTgKozqjOCrVOqGsYABPYK5qnfqClxZTFBa8PKt2v6Q==",
+      "dev": true,
+      "requires": {
+        "define-lazy-prop": "^2.0.0",
+        "is-docker": "^2.1.1",
+        "is-wsl": "^2.2.0"
+      }
+    },
+    "opener": {
+      "version": "1.5.2",
+      "resolved": "https://registry.npmjs.org/opener/-/opener-1.5.2.tgz",
+      "integrity": "sha512-ur5UIdyw5Y7yEj9wLzhqXiy6GZ3Mwx0yGI+5sMn2r0N0v3cKJvUmFH5yPP+WXh9e0xfyzyJX95D8l088DNFj7A==",
+      "dev": true
+    },
+    "openpgp": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/openpgp/-/openpgp-5.5.0.tgz",
+      "integrity": "sha512-SpwcJnxrK9Y0HRM6KxSFqkAEOSWEabCH/c8dII/+y2e5f6KvuDG5ZE7JXaPBaVJNE4VUZZeTphxXDoZD0KOHrw==",
+      "dev": true,
+      "requires": {
+        "asn1.js": "^5.0.0"
+      }
+    },
+    "optionator": {
+      "version": "0.9.1",
+      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.1.tgz",
+      "integrity": "sha512-74RlY5FCnhq4jRxVUPKDaRwrVNXMqsGsiW6AJw4XK8hmtm10wC0ypZBLw5IIp85NZMr91+qd1RvvENwg7jjRFw==",
+      "dev": true,
+      "requires": {
+        "deep-is": "^0.1.3",
+        "fast-levenshtein": "^2.0.6",
+        "levn": "^0.4.1",
+        "prelude-ls": "^1.2.1",
+        "type-check": "^0.4.0",
+        "word-wrap": "^1.2.3"
+      }
+    },
+    "ora": {
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/ora/-/ora-5.4.1.tgz",
+      "integrity": "sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==",
+      "dev": true,
+      "requires": {
+        "bl": "^4.1.0",
+        "chalk": "^4.1.0",
+        "cli-cursor": "^3.1.0",
+        "cli-spinners": "^2.5.0",
+        "is-interactive": "^1.0.0",
+        "is-unicode-supported": "^0.1.0",
+        "log-symbols": "^4.1.0",
+        "strip-ansi": "^6.0.0",
+        "wcwidth": "^1.0.1"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "p-finally": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/p-finally/-/p-finally-1.0.0.tgz",
+      "integrity": "sha512-LICb2p9CB7FS+0eR1oqWnHhp0FljGLZCWBE9aix0Uye9W8LTQPwMTYVGWQWIw9RdQiDg4+epXQODwIYJtSJaow==",
+      "dev": true
+    },
+    "p-limit": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
+      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
+      "dev": true,
+      "requires": {
+        "p-try": "^2.0.0"
+      }
+    },
+    "p-locate": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
+      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
+      "dev": true,
+      "requires": {
+        "p-limit": "^2.2.0"
+      }
+    },
+    "p-retry": {
+      "version": "4.6.2",
+      "resolved": "https://registry.npmjs.org/p-retry/-/p-retry-4.6.2.tgz",
+      "integrity": "sha512-312Id396EbJdvRONlngUx0NydfrIQ5lsYu0znKVUzVvArzEIt08V1qhtyESbGVd1FGX7UKtiFp5uwKZdM8wIuQ==",
+      "dev": true,
+      "requires": {
+        "@types/retry": "0.12.0",
+        "retry": "^0.13.1"
+      }
+    },
+    "p-try": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
+      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
+      "dev": true
+    },
+    "param-case": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/param-case/-/param-case-3.0.4.tgz",
+      "integrity": "sha512-RXlj7zCYokReqWpOPH9oYivUzLYZ5vAPIfEmCTNViosC78F8F0H9y7T7gG2M39ymgutxF5gcFEsyZQSph9Bp3A==",
+      "dev": true,
+      "requires": {
+        "dot-case": "^3.0.4",
+        "tslib": "^2.0.3"
+      }
+    },
+    "parent-module": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
+      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
+      "dev": true,
+      "requires": {
+        "callsites": "^3.0.0"
+      }
+    },
+    "parse-json": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-5.2.0.tgz",
+      "integrity": "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==",
+      "dev": true,
+      "requires": {
+        "@babel/code-frame": "^7.0.0",
+        "error-ex": "^1.3.1",
+        "json-parse-even-better-errors": "^2.3.0",
+        "lines-and-columns": "^1.1.6"
+      }
+    },
+    "parse5": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/parse5/-/parse5-5.1.1.tgz",
+      "integrity": "sha512-ugq4DFI0Ptb+WWjAdOK16+u/nHfiIrcE+sh8kZMaM0WllQKLI9rOUq6c2b7cwPkXdzfQESqvoqK6ug7U/Yyzug==",
+      "dev": true
+    },
+    "parse5-htmlparser2-tree-adapter": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/parse5-htmlparser2-tree-adapter/-/parse5-htmlparser2-tree-adapter-6.0.1.tgz",
+      "integrity": "sha512-qPuWvbLgvDGilKc5BoicRovlT4MtYT6JfJyBOMDsKoiT+GiuP5qyrPCnR9HcPECIJJmZh5jRndyNThnhhb/vlA==",
+      "dev": true,
+      "requires": {
+        "parse5": "^6.0.1"
+      },
+      "dependencies": {
+        "parse5": {
+          "version": "6.0.1",
+          "resolved": "https://registry.npmjs.org/parse5/-/parse5-6.0.1.tgz",
+          "integrity": "sha512-Ofn/CTFzRGTTxwpNEs9PP93gXShHcTq255nzRYSKe8AkVpZY7e1fpmTfOyoIvjP5HG7Z2ZM7VS9PPhQGW2pOpw==",
+          "dev": true
+        }
+      }
+    },
+    "parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "dev": true
+    },
+    "pascal-case": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/pascal-case/-/pascal-case-3.1.2.tgz",
+      "integrity": "sha512-uWlGT3YSnK9x3BQJaOdcZwrnV6hPpd8jFH1/ucpiLRPh/2zCVJKS19E4GvYHvaCcACn3foXZ0cLB9Wrx1KGe5g==",
+      "dev": true,
+      "requires": {
+        "no-case": "^3.0.4",
+        "tslib": "^2.0.3"
+      }
+    },
+    "path-browserify": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-browserify/-/path-browserify-1.0.1.tgz",
+      "integrity": "sha512-b7uo2UCUOYZcnF/3ID0lulOJi/bafxa1xPe7ZPsammBSpjSWQkjNxlt635YGS2MiR9GjvuXCtz2emr3jbsz98g=="
+    },
+    "path-exists": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
+      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+      "dev": true
+    },
+    "path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "dev": true
+    },
+    "path-key": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-2.0.1.tgz",
+      "integrity": "sha512-fEHGKCSmUSDPv4uoj8AlD+joPlq3peND+HRYyxFz4KPw4z926S/b8rIuFs2FYJg3BwsxJf6A9/3eIdLaYC+9Dw==",
+      "dev": true
+    },
+    "path-parse": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
+      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
+      "dev": true
+    },
+    "path-to-regexp": {
+      "version": "0.1.7",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz",
+      "integrity": "sha512-5DFkuoqlv1uYQKxy8omFBeJPQcdoE07Kv2sferDCrAq1ohOU+MSDswDIbnx3YAM60qIOnYa53wBhXW0EbMonrQ==",
+      "dev": true
+    },
+    "path-type": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
+      "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
+      "dev": true
+    },
+    "picocolors": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.0.tgz",
+      "integrity": "sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ=="
+    },
+    "picomatch": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "dev": true
+    },
+    "pify": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/pify/-/pify-2.3.0.tgz",
+      "integrity": "sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==",
+      "dev": true
+    },
+    "pirates": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/pirates/-/pirates-4.0.5.tgz",
+      "integrity": "sha512-8V9+HQPupnaXMA23c5hvl69zXvTwTzyAYasnkb0Tts4XvO4CliqONMOnvlq26rkhLC3nWDFBJf73LU1e1VZLaQ==",
+      "dev": true
+    },
+    "pkg-dir": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz",
+      "integrity": "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==",
+      "dev": true,
+      "requires": {
+        "find-up": "^4.0.0"
+      }
+    },
+    "pluralize": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/pluralize/-/pluralize-8.0.0.tgz",
+      "integrity": "sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA=="
+    },
+    "portfinder": {
+      "version": "1.0.28",
+      "resolved": "https://registry.npmjs.org/portfinder/-/portfinder-1.0.28.tgz",
+      "integrity": "sha512-Se+2isanIcEqf2XMHjyUKskczxbPH7dQnlMjXX6+dybayyHvAf/TCgyMRlzf/B6QDhAEFOGes0pzRo3by4AbMA==",
+      "dev": true,
+      "requires": {
+        "async": "^2.6.2",
+        "debug": "^3.1.1",
+        "mkdirp": "^0.5.5"
+      },
+      "dependencies": {
+        "debug": {
+          "version": "3.2.7",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
+          "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
+          "dev": true,
+          "requires": {
+            "ms": "^2.1.1"
+          }
+        }
+      }
+    },
+    "postcss": {
+      "version": "8.4.14",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.14.tgz",
+      "integrity": "sha512-E398TUmfAYFPBSdzgeieK2Y1+1cpdxJx8yXbK/m57nRhKSmk1GB2tO4lbLBtlkfPQTDKfe4Xqv1ASWPpayPEig==",
+      "requires": {
+        "nanoid": "^3.3.4",
+        "picocolors": "^1.0.0",
+        "source-map-js": "^1.0.2"
+      }
+    },
+    "postcss-calc": {
+      "version": "8.2.4",
+      "resolved": "https://registry.npmjs.org/postcss-calc/-/postcss-calc-8.2.4.tgz",
+      "integrity": "sha512-SmWMSJmB8MRnnULldx0lQIyhSNvuDl9HfrZkaqqE/WHAhToYsAvDq+yAsA/kIyINDszOp3Rh0GFoNuH5Ypsm3Q==",
+      "dev": true,
+      "requires": {
+        "postcss-selector-parser": "^6.0.9",
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-colormin": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/postcss-colormin/-/postcss-colormin-5.3.0.tgz",
+      "integrity": "sha512-WdDO4gOFG2Z8n4P8TWBpshnL3JpmNmJwdnfP2gbk2qBA8PWwOYcmjmI/t3CmMeL72a7Hkd+x/Mg9O2/0rD54Pg==",
+      "dev": true,
+      "requires": {
+        "browserslist": "^4.16.6",
+        "caniuse-api": "^3.0.0",
+        "colord": "^2.9.1",
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-convert-values": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/postcss-convert-values/-/postcss-convert-values-5.1.2.tgz",
+      "integrity": "sha512-c6Hzc4GAv95B7suy4udszX9Zy4ETyMCgFPUDtWjdFTKH1SE9eFY/jEpHSwTH1QPuwxHpWslhckUQWbNRM4ho5g==",
+      "dev": true,
+      "requires": {
+        "browserslist": "^4.20.3",
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-discard-comments": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/postcss-discard-comments/-/postcss-discard-comments-5.1.2.tgz",
+      "integrity": "sha512-+L8208OVbHVF2UQf1iDmRcbdjJkuBF6IS29yBDSiWUIzpYaAhtNl6JYnYm12FnkeCwQqF5LeklOu6rAqgfBZqQ==",
+      "dev": true,
+      "requires": {}
+    },
+    "postcss-discard-duplicates": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-discard-duplicates/-/postcss-discard-duplicates-5.1.0.tgz",
+      "integrity": "sha512-zmX3IoSI2aoenxHV6C7plngHWWhUOV3sP1T8y2ifzxzbtnuhk1EdPwm0S1bIUNaJ2eNbWeGLEwzw8huPD67aQw==",
+      "dev": true,
+      "requires": {}
+    },
+    "postcss-discard-empty": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/postcss-discard-empty/-/postcss-discard-empty-5.1.1.tgz",
+      "integrity": "sha512-zPz4WljiSuLWsI0ir4Mcnr4qQQ5e1Ukc3i7UfE2XcrwKK2LIPIqE5jxMRxO6GbI3cv//ztXDsXwEWT3BHOGh3A==",
+      "dev": true,
+      "requires": {}
+    },
+    "postcss-discard-overridden": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-discard-overridden/-/postcss-discard-overridden-5.1.0.tgz",
+      "integrity": "sha512-21nOL7RqWR1kasIVdKs8HNqQJhFxLsyRfAnUDm4Fe4t4mCWL9OJiHvlHPjcd8zc5Myu89b/7wZDnOSjFgeWRtw==",
+      "dev": true,
+      "requires": {}
+    },
+    "postcss-import": {
+      "version": "14.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-import/-/postcss-import-14.1.0.tgz",
+      "integrity": "sha512-flwI+Vgm4SElObFVPpTIT7SU7R3qk2L7PyduMcokiaVKuWv9d/U+Gm/QAd8NDLuykTWTkcrjOeD2Pp1rMeBTGw==",
+      "dev": true,
+      "requires": {
+        "postcss-value-parser": "^4.0.0",
+        "read-cache": "^1.0.0",
+        "resolve": "^1.1.7"
+      }
+    },
+    "postcss-js": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/postcss-js/-/postcss-js-4.0.0.tgz",
+      "integrity": "sha512-77QESFBwgX4irogGVPgQ5s07vLvFqWr228qZY+w6lW599cRlK/HmnlivnnVUxkjHnCu4J16PDMHcH+e+2HbvTQ==",
+      "dev": true,
+      "requires": {
+        "camelcase-css": "^2.0.1"
+      }
+    },
+    "postcss-load-config": {
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-3.1.4.tgz",
+      "integrity": "sha512-6DiM4E7v4coTE4uzA8U//WhtPwyhiim3eyjEMFCnUpzbrkK9wJHgKDT2mR+HbtSrd/NubVaYTOpSpjUl8NQeRg==",
+      "dev": true,
+      "requires": {
+        "lilconfig": "^2.0.5",
+        "yaml": "^1.10.2"
+      }
+    },
+    "postcss-loader": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/postcss-loader/-/postcss-loader-6.2.1.tgz",
+      "integrity": "sha512-WbbYpmAaKcux/P66bZ40bpWsBucjx/TTgVVzRZ9yUO8yQfVBlameJ0ZGVaPfH64hNSBh63a+ICP5nqOpBA0w+Q==",
+      "dev": true,
+      "requires": {
+        "cosmiconfig": "^7.0.0",
+        "klona": "^2.0.5",
+        "semver": "^7.3.5"
+      },
+      "dependencies": {
+        "semver": {
+          "version": "7.5.4",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+          "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^6.0.0"
+          }
+        }
+      }
+    },
+    "postcss-merge-longhand": {
+      "version": "5.1.6",
+      "resolved": "https://registry.npmjs.org/postcss-merge-longhand/-/postcss-merge-longhand-5.1.6.tgz",
+      "integrity": "sha512-6C/UGF/3T5OE2CEbOuX7iNO63dnvqhGZeUnKkDeifebY0XqkkvrctYSZurpNE902LDf2yKwwPFgotnfSoPhQiw==",
+      "dev": true,
+      "requires": {
+        "postcss-value-parser": "^4.2.0",
+        "stylehacks": "^5.1.0"
+      }
+    },
+    "postcss-merge-rules": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/postcss-merge-rules/-/postcss-merge-rules-5.1.2.tgz",
+      "integrity": "sha512-zKMUlnw+zYCWoPN6yhPjtcEdlJaMUZ0WyVcxTAmw3lkkN/NDMRkOkiuctQEoWAOvH7twaxUUdvBWl0d4+hifRQ==",
+      "dev": true,
+      "requires": {
+        "browserslist": "^4.16.6",
+        "caniuse-api": "^3.0.0",
+        "cssnano-utils": "^3.1.0",
+        "postcss-selector-parser": "^6.0.5"
+      }
+    },
+    "postcss-minify-font-values": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-minify-font-values/-/postcss-minify-font-values-5.1.0.tgz",
+      "integrity": "sha512-el3mYTgx13ZAPPirSVsHqFzl+BBBDrXvbySvPGFnQcTI4iNslrPaFq4muTkLZmKlGk4gyFAYUBMH30+HurREyA==",
+      "dev": true,
+      "requires": {
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-minify-gradients": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/postcss-minify-gradients/-/postcss-minify-gradients-5.1.1.tgz",
+      "integrity": "sha512-VGvXMTpCEo4qHTNSa9A0a3D+dxGFZCYwR6Jokk+/3oB6flu2/PnPXAh2x7x52EkY5xlIHLm+Le8tJxe/7TNhzw==",
+      "dev": true,
+      "requires": {
+        "colord": "^2.9.1",
+        "cssnano-utils": "^3.1.0",
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-minify-params": {
+      "version": "5.1.3",
+      "resolved": "https://registry.npmjs.org/postcss-minify-params/-/postcss-minify-params-5.1.3.tgz",
+      "integrity": "sha512-bkzpWcjykkqIujNL+EVEPOlLYi/eZ050oImVtHU7b4lFS82jPnsCb44gvC6pxaNt38Els3jWYDHTjHKf0koTgg==",
+      "dev": true,
+      "requires": {
+        "browserslist": "^4.16.6",
+        "cssnano-utils": "^3.1.0",
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-minify-selectors": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/postcss-minify-selectors/-/postcss-minify-selectors-5.2.1.tgz",
+      "integrity": "sha512-nPJu7OjZJTsVUmPdm2TcaiohIwxP+v8ha9NehQ2ye9szv4orirRU3SDdtUmKH+10nzn0bAyOXZ0UEr7OpvLehg==",
+      "dev": true,
+      "requires": {
+        "postcss-selector-parser": "^6.0.5"
+      }
+    },
+    "postcss-modules-extract-imports": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/postcss-modules-extract-imports/-/postcss-modules-extract-imports-3.0.0.tgz",
+      "integrity": "sha512-bdHleFnP3kZ4NYDhuGlVK+CMrQ/pqUm8bx/oGL93K6gVwiclvX5x0n76fYMKuIGKzlABOy13zsvqjb0f92TEXw==",
+      "dev": true,
+      "requires": {}
+    },
+    "postcss-modules-local-by-default": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/postcss-modules-local-by-default/-/postcss-modules-local-by-default-4.0.0.tgz",
+      "integrity": "sha512-sT7ihtmGSF9yhm6ggikHdV0hlziDTX7oFoXtuVWeDd3hHObNkcHRo9V3yg7vCAY7cONyxJC/XXCmmiHHcvX7bQ==",
+      "dev": true,
+      "requires": {
+        "icss-utils": "^5.0.0",
+        "postcss-selector-parser": "^6.0.2",
+        "postcss-value-parser": "^4.1.0"
+      }
+    },
+    "postcss-modules-scope": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/postcss-modules-scope/-/postcss-modules-scope-3.0.0.tgz",
+      "integrity": "sha512-hncihwFA2yPath8oZ15PZqvWGkWf+XUfQgUGamS4LqoP1anQLOsOJw0vr7J7IwLpoY9fatA2qiGUGmuZL0Iqlg==",
+      "dev": true,
+      "requires": {
+        "postcss-selector-parser": "^6.0.4"
+      }
+    },
+    "postcss-modules-values": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/postcss-modules-values/-/postcss-modules-values-4.0.0.tgz",
+      "integrity": "sha512-RDxHkAiEGI78gS2ofyvCsu7iycRv7oqw5xMWn9iMoR0N/7mf9D50ecQqUo5BZ9Zh2vH4bCUR/ktCqbB9m8vJjQ==",
+      "dev": true,
+      "requires": {
+        "icss-utils": "^5.0.0"
+      }
+    },
+    "postcss-nested": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/postcss-nested/-/postcss-nested-5.0.6.tgz",
+      "integrity": "sha512-rKqm2Fk0KbA8Vt3AdGN0FB9OBOMDVajMG6ZCf/GoHgdxUJ4sBFp0A/uMIRm+MJUdo33YXEtjqIz8u7DAp8B7DA==",
+      "dev": true,
+      "requires": {
+        "postcss-selector-parser": "^6.0.6"
+      }
+    },
+    "postcss-normalize-charset": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-charset/-/postcss-normalize-charset-5.1.0.tgz",
+      "integrity": "sha512-mSgUJ+pd/ldRGVx26p2wz9dNZ7ji6Pn8VWBajMXFf8jk7vUoSrZ2lt/wZR7DtlZYKesmZI680qjr2CeFF2fbUg==",
+      "dev": true,
+      "requires": {}
+    },
+    "postcss-normalize-display-values": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-display-values/-/postcss-normalize-display-values-5.1.0.tgz",
+      "integrity": "sha512-WP4KIM4o2dazQXWmFaqMmcvsKmhdINFblgSeRgn8BJ6vxaMyaJkwAzpPpuvSIoG/rmX3M+IrRZEz2H0glrQNEA==",
+      "dev": true,
+      "requires": {
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-normalize-positions": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-positions/-/postcss-normalize-positions-5.1.1.tgz",
+      "integrity": "sha512-6UpCb0G4eofTCQLFVuI3EVNZzBNPiIKcA1AKVka+31fTVySphr3VUgAIULBhxZkKgwLImhzMR2Bw1ORK+37INg==",
+      "dev": true,
+      "requires": {
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-normalize-repeat-style": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-repeat-style/-/postcss-normalize-repeat-style-5.1.1.tgz",
+      "integrity": "sha512-mFpLspGWkQtBcWIRFLmewo8aC3ImN2i/J3v8YCFUwDnPu3Xz4rLohDO26lGjwNsQxB3YF0KKRwspGzE2JEuS0g==",
+      "dev": true,
+      "requires": {
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-normalize-string": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-string/-/postcss-normalize-string-5.1.0.tgz",
+      "integrity": "sha512-oYiIJOf4T9T1N4i+abeIc7Vgm/xPCGih4bZz5Nm0/ARVJ7K6xrDlLwvwqOydvyL3RHNf8qZk6vo3aatiw/go3w==",
+      "dev": true,
+      "requires": {
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-normalize-timing-functions": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-timing-functions/-/postcss-normalize-timing-functions-5.1.0.tgz",
+      "integrity": "sha512-DOEkzJ4SAXv5xkHl0Wa9cZLF3WCBhF3o1SKVxKQAa+0pYKlueTpCgvkFAHfk+Y64ezX9+nITGrDZeVGgITJXjg==",
+      "dev": true,
+      "requires": {
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-normalize-unicode": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-unicode/-/postcss-normalize-unicode-5.1.0.tgz",
+      "integrity": "sha512-J6M3MizAAZ2dOdSjy2caayJLQT8E8K9XjLce8AUQMwOrCvjCHv24aLC/Lps1R1ylOfol5VIDMaM/Lo9NGlk1SQ==",
+      "dev": true,
+      "requires": {
+        "browserslist": "^4.16.6",
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-normalize-url": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-url/-/postcss-normalize-url-5.1.0.tgz",
+      "integrity": "sha512-5upGeDO+PVthOxSmds43ZeMeZfKH+/DKgGRD7TElkkyS46JXAUhMzIKiCa7BabPeIy3AQcTkXwVVN7DbqsiCew==",
+      "dev": true,
+      "requires": {
+        "normalize-url": "^6.0.1",
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-normalize-whitespace": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/postcss-normalize-whitespace/-/postcss-normalize-whitespace-5.1.1.tgz",
+      "integrity": "sha512-83ZJ4t3NUDETIHTa3uEg6asWjSBYL5EdkVB0sDncx9ERzOKBVJIUeDO9RyA9Zwtig8El1d79HBp0JEi8wvGQnA==",
+      "dev": true,
+      "requires": {
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-ordered-values": {
+      "version": "5.1.3",
+      "resolved": "https://registry.npmjs.org/postcss-ordered-values/-/postcss-ordered-values-5.1.3.tgz",
+      "integrity": "sha512-9UO79VUhPwEkzbb3RNpqqghc6lcYej1aveQteWY+4POIwlqkYE21HKWaLDF6lWNuqCobEAyTovVhtI32Rbv2RQ==",
+      "dev": true,
+      "requires": {
+        "cssnano-utils": "^3.1.0",
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-reduce-initial": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-reduce-initial/-/postcss-reduce-initial-5.1.0.tgz",
+      "integrity": "sha512-5OgTUviz0aeH6MtBjHfbr57tml13PuedK/Ecg8szzd4XRMbYxH4572JFG067z+FqBIf6Zp/d+0581glkvvWMFw==",
+      "dev": true,
+      "requires": {
+        "browserslist": "^4.16.6",
+        "caniuse-api": "^3.0.0"
+      }
+    },
+    "postcss-reduce-transforms": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-reduce-transforms/-/postcss-reduce-transforms-5.1.0.tgz",
+      "integrity": "sha512-2fbdbmgir5AvpW9RLtdONx1QoYG2/EtqpNQbFASDlixBbAYuTcJ0dECwlqNqH7VbaUnEnh8SrxOe2sRIn24XyQ==",
+      "dev": true,
+      "requires": {
+        "postcss-value-parser": "^4.2.0"
+      }
+    },
+    "postcss-selector-parser": {
+      "version": "6.0.10",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.10.tgz",
+      "integrity": "sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==",
+      "dev": true,
+      "requires": {
+        "cssesc": "^3.0.0",
+        "util-deprecate": "^1.0.2"
+      }
+    },
+    "postcss-svgo": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/postcss-svgo/-/postcss-svgo-5.1.0.tgz",
+      "integrity": "sha512-D75KsH1zm5ZrHyxPakAxJWtkyXew5qwS70v56exwvw542d9CRtTo78K0WeFxZB4G7JXKKMbEZtZayTGdIky/eA==",
+      "dev": true,
+      "requires": {
+        "postcss-value-parser": "^4.2.0",
+        "svgo": "^2.7.0"
+      }
+    },
+    "postcss-unique-selectors": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/postcss-unique-selectors/-/postcss-unique-selectors-5.1.1.tgz",
+      "integrity": "sha512-5JiODlELrz8L2HwxfPnhOWZYWDxVHWL83ufOv84NrcgipI7TaeRsatAhK4Tr2/ZiYldpK/wBvw5BD3qfaK96GA==",
+      "dev": true,
+      "requires": {
+        "postcss-selector-parser": "^6.0.5"
+      }
+    },
+    "postcss-value-parser": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz",
+      "integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==",
+      "dev": true
+    },
+    "prelude-ls": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
+      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
+      "dev": true
+    },
+    "prettier": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.7.1.tgz",
+      "integrity": "sha512-ujppO+MkdPqoVINuDFDRLClm7D78qbDt0/NR+wp5FqEZOoTNAjPHWj17QRhu7geIHJfcNhRk1XVQmF8Bp3ye+g=="
+    },
+    "pretty": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/pretty/-/pretty-2.0.0.tgz",
+      "integrity": "sha512-G9xUchgTEiNpormdYBl+Pha50gOUovT18IvAe7EYMZ1/f9W/WWMPRn+xI68yXNMUk3QXHDwo/1wV/4NejVNe1w==",
+      "dev": true,
+      "requires": {
+        "condense-newlines": "^0.2.1",
+        "extend-shallow": "^2.0.1",
+        "js-beautify": "^1.6.12"
+      }
+    },
+    "pretty-error": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/pretty-error/-/pretty-error-4.0.0.tgz",
+      "integrity": "sha512-AoJ5YMAcXKYxKhuJGdcvse+Voc6v1RgnsR3nWcYU7q4t6z0Q6T86sv5Zq8VIRbOWWFpvdGE83LtdSMNd+6Y0xw==",
+      "dev": true,
+      "requires": {
+        "lodash": "^4.17.20",
+        "renderkid": "^3.0.0"
+      }
+    },
+    "pretty-format": {
+      "version": "27.5.1",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-27.5.1.tgz",
+      "integrity": "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==",
+      "dev": true,
+      "requires": {
+        "ansi-regex": "^5.0.1",
+        "ansi-styles": "^5.0.0",
+        "react-is": "^17.0.1"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "5.2.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
+          "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+          "dev": true
+        }
+      }
+    },
+    "process-nextick-args": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
+      "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
+      "dev": true
+    },
+    "progress": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/progress/-/progress-2.0.3.tgz",
+      "integrity": "sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==",
+      "dev": true
+    },
+    "progress-webpack-plugin": {
+      "version": "1.0.16",
+      "resolved": "https://registry.npmjs.org/progress-webpack-plugin/-/progress-webpack-plugin-1.0.16.tgz",
+      "integrity": "sha512-sdiHuuKOzELcBANHfrupYo+r99iPRyOnw15qX+rNlVUqXGfjXdH4IgxriKwG1kNJwVswKQHMdj1hYZMcb9jFaA==",
+      "dev": true,
+      "requires": {
+        "chalk": "^2.1.0",
+        "figures": "^2.0.0",
+        "log-update": "^2.3.0"
+      }
+    },
+    "promise-polyfill": {
+      "version": "8.2.3",
+      "resolved": "https://registry.npmjs.org/promise-polyfill/-/promise-polyfill-8.2.3.tgz",
+      "integrity": "sha512-Og0+jCRQetV84U8wVjMNccfGCnMQ9mGs9Hv78QFe+pSDD3gWTpz0y+1QCuxy5d/vBFuZ3iwP2eycAkvqIMPmWg=="
+    },
+    "prompts": {
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/prompts/-/prompts-2.4.2.tgz",
+      "integrity": "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==",
+      "dev": true,
+      "requires": {
+        "kleur": "^3.0.3",
+        "sisteransi": "^1.0.5"
+      }
+    },
+    "proto-list": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/proto-list/-/proto-list-1.2.4.tgz",
+      "integrity": "sha512-vtK/94akxsTMhe0/cbfpR+syPuszcuwhqVjJq26CuNDgFGj682oRBXOP5MJpv2r7JtE8MsiepGIqvvOTBwn2vA==",
+      "dev": true
+    },
+    "protobufjs": {
+      "version": "6.11.3",
+      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-6.11.3.tgz",
+      "integrity": "sha512-xL96WDdCZYdU7Slin569tFX712BxsxslWwAfAhCYjQKGTq7dAU91Lomy6nLLhh/dyGhk/YH4TwTSRxTzhuHyZg==",
+      "requires": {
+        "@protobufjs/aspromise": "^1.1.2",
+        "@protobufjs/base64": "^1.1.2",
+        "@protobufjs/codegen": "^2.0.4",
+        "@protobufjs/eventemitter": "^1.1.0",
+        "@protobufjs/fetch": "^1.1.0",
+        "@protobufjs/float": "^1.0.2",
+        "@protobufjs/inquire": "^1.1.0",
+        "@protobufjs/path": "^1.1.2",
+        "@protobufjs/pool": "^1.1.0",
+        "@protobufjs/utf8": "^1.1.0",
+        "@types/long": "^4.0.1",
+        "@types/node": ">=13.7.0",
+        "long": "^4.0.0"
+      },
+      "dependencies": {
+        "long": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/long/-/long-4.0.0.tgz",
+          "integrity": "sha512-XsP+KhQif4bjX1kbuSiySJFNAehNxgLb6hPRGJ9QsUr8ajHkuXGdrHmFUTUUXhDwVX2R5bY4JNZEwbUiMhV+MA=="
+        }
+      }
+    },
+    "proxy-addr": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
+      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "dev": true,
+      "requires": {
+        "forwarded": "0.2.0",
+        "ipaddr.js": "1.9.1"
+      },
+      "dependencies": {
+        "ipaddr.js": {
+          "version": "1.9.1",
+          "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+          "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+          "dev": true
+        }
+      }
+    },
+    "pseudomap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/pseudomap/-/pseudomap-1.0.2.tgz",
+      "integrity": "sha512-b/YwNhb8lk1Zz2+bXXpS/LK9OisiZZ1SNsSLxN1x2OXVEhW2Ckr/7mWE5vrC1ZTiJlD9g19jWszTmJsB+oEpFQ==",
+      "dev": true
+    },
+    "psl": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/psl/-/psl-1.8.0.tgz",
+      "integrity": "sha512-RIdOzyoavK+hA18OGGWDqUTsCLhtA7IcZ/6NCs4fFJaHBDab+pDDmDIByWFRQJq2Cd7r1OoQxBGKOaztq+hjIQ==",
+      "dev": true
+    },
+    "pug-error": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/pug-error/-/pug-error-2.0.0.tgz",
+      "integrity": "sha512-sjiUsi9M4RAGHktC1drQfCr5C5eriu24Lfbt4s+7SykztEOwVZtbFk1RRq0tzLxcMxMYTBR+zMQaG07J/btayQ==",
+      "dev": true
+    },
+    "pug-lexer": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/pug-lexer/-/pug-lexer-5.0.1.tgz",
+      "integrity": "sha512-0I6C62+keXlZPZkOJeVam9aBLVP2EnbeDw3An+k0/QlqdwH6rv8284nko14Na7c0TtqtogfWXcRoFE4O4Ff20w==",
+      "dev": true,
+      "requires": {
+        "character-parser": "^2.2.0",
+        "is-expression": "^4.0.0",
+        "pug-error": "^2.0.0"
+      }
+    },
+    "pump": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.0.tgz",
+      "integrity": "sha512-LwZy+p3SFs1Pytd/jYct4wpv49HiYCqd9Rlc5ZVdk0V+8Yzv6jR5Blk3TRmPL1ft69TxP0IMZGJ+WPFU2BFhww==",
+      "dev": true,
+      "requires": {
+        "end-of-stream": "^1.1.0",
+        "once": "^1.3.1"
+      }
+    },
+    "punycode": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.1.1.tgz",
+      "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==",
+      "dev": true
+    },
+    "qs": {
+      "version": "6.10.3",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.10.3.tgz",
+      "integrity": "sha512-wr7M2E0OFRfIfJZjKGieI8lBKb7fRCH4Fv5KNPEs7gJ8jadvotdsS08PzOKR7opXhZ/Xkjtt3WF9g38drmyRqQ==",
+      "dev": true,
+      "requires": {
+        "side-channel": "^1.0.4"
+      }
+    },
+    "querystringify": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/querystringify/-/querystringify-2.2.0.tgz",
+      "integrity": "sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==",
+      "dev": true
+    },
+    "queue-microtask": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
+      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
+      "dev": true
+    },
+    "quick-lru": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/quick-lru/-/quick-lru-5.1.1.tgz",
+      "integrity": "sha512-WuyALRjWPDGtt/wzJiadO5AXY+8hZ80hVpe6MyivgraREW751X3SbhRvG3eLKOYN+8VEvqLcf3wdnt44Z4S4SA==",
+      "dev": true
+    },
+    "randombytes": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz",
+      "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==",
+      "dev": true,
+      "requires": {
+        "safe-buffer": "^5.1.0"
+      }
+    },
+    "range-parser": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
+      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+      "dev": true
+    },
+    "raw-body": {
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.1.tgz",
+      "integrity": "sha512-qqJBtEyVgS0ZmPGdCFPWJ3FreoqvG4MVQln/kCgF7Olq95IbOp0/BWyMwbdtn4VTvkM8Y7khCQ2Xgk/tcrCXig==",
+      "dev": true,
+      "requires": {
+        "bytes": "3.1.2",
+        "http-errors": "2.0.0",
+        "iconv-lite": "0.4.24",
+        "unpipe": "1.0.0"
+      },
+      "dependencies": {
+        "bytes": {
+          "version": "3.1.2",
+          "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+          "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+          "dev": true
+        }
+      }
+    },
+    "react-is": {
+      "version": "17.0.2",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
+      "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
+      "dev": true
+    },
+    "read-cache": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/read-cache/-/read-cache-1.0.0.tgz",
+      "integrity": "sha512-Owdv/Ft7IjOgm/i0xvNDZ1LrRANRfew4b2prF3OWMQLxLfu3bS8FVhCsrSCMK4lR56Y9ya+AThoTpDCTxCmpRA==",
+      "dev": true,
+      "requires": {
+        "pify": "^2.3.0"
+      }
+    },
+    "read-pkg": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-5.2.0.tgz",
+      "integrity": "sha512-Ug69mNOpfvKDAc2Q8DRpMjjzdtrnv9HcSMX+4VsZxD1aZ6ZzrIE7rlzXBtWTyhULSMKg076AW6WR5iZpD0JiOg==",
+      "dev": true,
+      "requires": {
+        "@types/normalize-package-data": "^2.4.0",
+        "normalize-package-data": "^2.5.0",
+        "parse-json": "^5.0.0",
+        "type-fest": "^0.6.0"
+      }
+    },
+    "read-pkg-up": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/read-pkg-up/-/read-pkg-up-7.0.1.tgz",
+      "integrity": "sha512-zK0TB7Xd6JpCLmlLmufqykGE+/TlOePD6qKClNW7hHDKFh/J7/7gCWGR7joEQEW1bKq3a3yUZSObOoWLFQ4ohg==",
+      "dev": true,
+      "requires": {
+        "find-up": "^4.1.0",
+        "read-pkg": "^5.2.0",
+        "type-fest": "^0.8.1"
+      },
+      "dependencies": {
+        "type-fest": {
+          "version": "0.8.1",
+          "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.8.1.tgz",
+          "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==",
+          "dev": true
+        }
+      }
+    },
+    "readable-stream": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.0.tgz",
+      "integrity": "sha512-BViHy7LKeTz4oNnkcLJ+lVSL6vpiFeX6/d3oSH8zCW7UxP2onchk+vTGB143xuFjHS3deTgkKoXXymXqymiIdA==",
+      "dev": true,
+      "requires": {
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
+      }
+    },
+    "readdirp": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
+      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
+      "dev": true,
+      "requires": {
+        "picomatch": "^2.2.1"
+      }
+    },
+    "regenerate": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/regenerate/-/regenerate-1.4.2.tgz",
+      "integrity": "sha512-zrceR/XhGYU/d/opr2EKO7aRHUeiBI8qjtfHqADTwZd6Szfy16la6kqD0MIUs5z5hx6AaKa+PixpPrR289+I0A==",
+      "dev": true
+    },
+    "regenerate-unicode-properties": {
+      "version": "10.0.1",
+      "resolved": "https://registry.npmjs.org/regenerate-unicode-properties/-/regenerate-unicode-properties-10.0.1.tgz",
+      "integrity": "sha512-vn5DU6yg6h8hP/2OkQo3K7uVILvY4iu0oI4t3HFa81UPkhGJwkRwM10JEc3upjdhHjs/k8GJY1sRBhk5sr69Bw==",
+      "dev": true,
+      "requires": {
+        "regenerate": "^1.4.2"
+      }
+    },
+    "regenerator-runtime": {
+      "version": "0.13.9",
+      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.9.tgz",
+      "integrity": "sha512-p3VT+cOEgxFsRRA9X4lkI1E+k2/CtnKtU4gcxyaCUreilL/vqI6CdZ3wxVUx3UOUg+gnUOQQcRI7BmSI656MYA==",
+      "dev": true
+    },
+    "regenerator-transform": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/regenerator-transform/-/regenerator-transform-0.15.0.tgz",
+      "integrity": "sha512-LsrGtPmbYg19bcPHwdtmXwbW+TqNvtY4riE3P83foeHRroMbH6/2ddFBfab3t7kbzc7v7p4wbkIecHImqt0QNg==",
+      "dev": true,
+      "requires": {
+        "@babel/runtime": "^7.8.4"
+      }
+    },
+    "regexpp": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/regexpp/-/regexpp-3.2.0.tgz",
+      "integrity": "sha512-pq2bWo9mVD43nbts2wGv17XLiNLya+GklZ8kaDLV2Z08gDCsGpnKn9BFMepvWuHCbyVvY7J5o5+BVvoQbmlJLg==",
+      "dev": true
+    },
+    "regexpu-core": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/regexpu-core/-/regexpu-core-5.1.0.tgz",
+      "integrity": "sha512-bb6hk+xWd2PEOkj5It46A16zFMs2mv86Iwpdu94la4S3sJ7C973h2dHpYKwIBGaWSO7cIRJ+UX0IeMaWcO4qwA==",
+      "dev": true,
+      "requires": {
+        "regenerate": "^1.4.2",
+        "regenerate-unicode-properties": "^10.0.1",
+        "regjsgen": "^0.6.0",
+        "regjsparser": "^0.8.2",
+        "unicode-match-property-ecmascript": "^2.0.0",
+        "unicode-match-property-value-ecmascript": "^2.0.0"
+      }
+    },
+    "regjsgen": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/regjsgen/-/regjsgen-0.6.0.tgz",
+      "integrity": "sha512-ozE883Uigtqj3bx7OhL1KNbCzGyW2NQZPl6Hs09WTvCuZD5sTI4JY58bkbQWa/Y9hxIsvJ3M8Nbf7j54IqeZbA==",
+      "dev": true
+    },
+    "regjsparser": {
+      "version": "0.8.4",
+      "resolved": "https://registry.npmjs.org/regjsparser/-/regjsparser-0.8.4.tgz",
+      "integrity": "sha512-J3LABycON/VNEu3abOviqGHuB/LOtOQj8SKmfP9anY5GfAVw/SPjwzSjxGjbZXIxbGfqTHtJw58C2Li/WkStmA==",
+      "dev": true,
+      "requires": {
+        "jsesc": "~0.5.0"
+      },
+      "dependencies": {
+        "jsesc": {
+          "version": "0.5.0",
+          "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-0.5.0.tgz",
+          "integrity": "sha512-uZz5UnB7u4T9LvwmFqXii7pZSouaRPorGs5who1Ip7VO0wxanFvBL7GkM6dTHlgX+jhBApRetaWpnDabOeTcnA==",
+          "dev": true
+        }
+      }
+    },
+    "relateurl": {
+      "version": "0.2.7",
+      "resolved": "https://registry.npmjs.org/relateurl/-/relateurl-0.2.7.tgz",
+      "integrity": "sha512-G08Dxvm4iDN3MLM0EsP62EDV9IuhXPR6blNz6Utcp7zyV3tr4HVNINt6MpaRWbxoOHT3Q7YN2P+jaHX8vUbgog==",
+      "dev": true
+    },
+    "renderkid": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/renderkid/-/renderkid-3.0.0.tgz",
+      "integrity": "sha512-q/7VIQA8lmM1hF+jn+sFSPWGlMkSAeNYcPLmDQx2zzuiDfaLrOmumR8iaUKlenFgh0XRPIUeSPlH3A+AW3Z5pg==",
+      "dev": true,
+      "requires": {
+        "css-select": "^4.1.3",
+        "dom-converter": "^0.2.0",
+        "htmlparser2": "^6.1.0",
+        "lodash": "^4.17.21",
+        "strip-ansi": "^6.0.1"
+      }
+    },
+    "require-directory": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
+      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
+      "dev": true
+    },
+    "require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "dev": true
+    },
+    "requires-port": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz",
+      "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==",
+      "dev": true
+    },
+    "resolve": {
+      "version": "1.22.1",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.1.tgz",
+      "integrity": "sha512-nBpuuYuY5jFsli/JIs1oldw6fOQCBioohqWZg/2hiaOybXOft4lonv85uDOKXdf8rhyK159cxU5cDcK/NKk8zw==",
+      "dev": true,
+      "requires": {
+        "is-core-module": "^2.9.0",
+        "path-parse": "^1.0.7",
+        "supports-preserve-symlinks-flag": "^1.0.0"
+      }
+    },
+    "resolve-cwd": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-cwd/-/resolve-cwd-3.0.0.tgz",
+      "integrity": "sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==",
+      "dev": true,
+      "requires": {
+        "resolve-from": "^5.0.0"
+      },
+      "dependencies": {
+        "resolve-from": {
+          "version": "5.0.0",
+          "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
+          "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
+          "dev": true
+        }
+      }
+    },
+    "resolve-from": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
+      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
+      "dev": true
+    },
+    "resolve.exports": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/resolve.exports/-/resolve.exports-1.1.0.tgz",
+      "integrity": "sha512-J1l+Zxxp4XK3LUDZ9m60LRJF/mAe4z6a4xyabPHk7pvK5t35dACV32iIjJDFeWZFfZlO29w6SZ67knR0tHzJtQ==",
+      "dev": true
+    },
+    "restore-cursor": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-3.1.0.tgz",
+      "integrity": "sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==",
+      "dev": true,
+      "requires": {
+        "onetime": "^5.1.0",
+        "signal-exit": "^3.0.2"
+      }
+    },
+    "retry": {
+      "version": "0.13.1",
+      "resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz",
+      "integrity": "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==",
+      "dev": true
+    },
+    "reusify": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.0.4.tgz",
+      "integrity": "sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==",
+      "dev": true
+    },
+    "rimraf": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz",
+      "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
+      "dev": true,
+      "requires": {
+        "glob": "^7.1.3"
+      }
+    },
+    "run-parallel": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
+      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
+      "dev": true,
+      "requires": {
+        "queue-microtask": "^1.2.2"
+      }
+    },
+    "rxjs": {
+      "version": "7.5.5",
+      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.5.5.tgz",
+      "integrity": "sha512-sy+H0pQofO95VDmFLzyaw9xNJU4KTRSwQIGM6+iG3SypAtCiLDzpeG8sJrNCWn2Up9km+KhkvTdbkrdy+yzZdw==",
+      "requires": {
+        "tslib": "^2.1.0"
+      }
+    },
+    "safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+      "dev": true
+    },
+    "safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "dev": true
+    },
+    "saxes": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/saxes/-/saxes-5.0.1.tgz",
+      "integrity": "sha512-5LBh1Tls8c9xgGjw3QrMwETmTMVk0oFgvrFSvWx62llR2hcEInrKNZ2GZCCuuy2lvWrdl5jhbpeqc5hRYKFOcw==",
+      "dev": true,
+      "requires": {
+        "xmlchars": "^2.2.0"
+      }
+    },
+    "schema-utils": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-3.1.2.tgz",
+      "integrity": "sha512-pvjEHOgWc9OWA/f/DE3ohBWTD6EleVLf7iFUkoSwAxttdBhB9QUebQgxER2kWueOvRJXPHNnyrvvh9eZINB8Eg==",
+      "dev": true,
+      "requires": {
+        "@types/json-schema": "^7.0.8",
+        "ajv": "^6.12.5",
+        "ajv-keywords": "^3.5.2"
+      }
+    },
+    "select": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/select/-/select-1.1.2.tgz",
+      "integrity": "sha512-OwpTSOfy6xSs1+pwcNrv0RBMOzI39Lp3qQKUTPVVPRjCdNa5JH/oPRiqsesIskK8TVgmRiHwO4KXlV2Li9dANA=="
+    },
+    "select-hose": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/select-hose/-/select-hose-2.0.0.tgz",
+      "integrity": "sha512-mEugaLK+YfkijB4fx0e6kImuJdCIt2LxCRcbEYPqRGCs4F2ogyfZU5IAZRdjCP8JPq2AtdNoC/Dux63d9Kiryg==",
+      "dev": true
+    },
+    "selfsigned": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/selfsigned/-/selfsigned-2.0.1.tgz",
+      "integrity": "sha512-LmME957M1zOsUhG+67rAjKfiWFox3SBxE/yymatMZsAx+oMrJ0YQ8AToOnyCm7xbeg2ep37IHLxdu0o2MavQOQ==",
+      "dev": true,
+      "requires": {
+        "node-forge": "^1"
+      }
+    },
+    "semver": {
+      "version": "6.3.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "dev": true
+    },
+    "semver-parser": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/semver-parser/-/semver-parser-4.0.1.tgz",
+      "integrity": "sha512-ZdnhLJSeLkc9fXEwqdvVXqrVJ8jq/vhGlFfsMhOE4oIiSZlvUC6Ar4NAbdj+H5DEkhFjyhucce7BO8VL/rpY9g=="
+    },
+    "send": {
+      "version": "0.18.0",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.18.0.tgz",
+      "integrity": "sha512-qqWzuOjSFOuqPjFe4NOsMLafToQQwBSOEpS+FwEt3A2V3vKubTquT3vmLTQpFgMXp8AlFWFuP1qKaJZOtPpVXg==",
+      "dev": true,
+      "requires": {
+        "debug": "2.6.9",
+        "depd": "2.0.0",
+        "destroy": "1.2.0",
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "etag": "~1.8.1",
+        "fresh": "0.5.2",
+        "http-errors": "2.0.0",
+        "mime": "1.6.0",
+        "ms": "2.1.3",
+        "on-finished": "2.4.1",
+        "range-parser": "~1.2.1",
+        "statuses": "2.0.1"
+      },
+      "dependencies": {
+        "debug": {
+          "version": "2.6.9",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+          "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+          "dev": true,
+          "requires": {
+            "ms": "2.0.0"
+          },
+          "dependencies": {
+            "ms": {
+              "version": "2.0.0",
+              "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+              "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+              "dev": true
+            }
+          }
+        },
+        "ms": {
+          "version": "2.1.3",
+          "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+          "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+          "dev": true
+        }
+      }
+    },
+    "serialize-javascript": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.1.tgz",
+      "integrity": "sha512-owoXEFjWRllis8/M1Q+Cw5k8ZH40e3zhp/ovX+Xr/vi1qj6QesbyXXViFbpNvWvPNAD62SutwEXavefrLJWj7w==",
+      "dev": true,
+      "requires": {
+        "randombytes": "^2.1.0"
+      }
+    },
+    "serve-index": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/serve-index/-/serve-index-1.9.1.tgz",
+      "integrity": "sha512-pXHfKNP4qujrtteMrSBb0rc8HJ9Ms/GrXwcUtUtD5s4ewDJI8bT3Cz2zTVRMKtri49pLx2e0Ya8ziP5Ya2pZZw==",
+      "dev": true,
+      "requires": {
+        "accepts": "~1.3.4",
+        "batch": "0.6.1",
+        "debug": "2.6.9",
+        "escape-html": "~1.0.3",
+        "http-errors": "~1.6.2",
+        "mime-types": "~2.1.17",
+        "parseurl": "~1.3.2"
+      },
+      "dependencies": {
+        "debug": {
+          "version": "2.6.9",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+          "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+          "dev": true,
+          "requires": {
+            "ms": "2.0.0"
+          }
+        },
+        "depd": {
+          "version": "1.1.2",
+          "resolved": "https://registry.npmjs.org/depd/-/depd-1.1.2.tgz",
+          "integrity": "sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ==",
+          "dev": true
+        },
+        "http-errors": {
+          "version": "1.6.3",
+          "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.6.3.tgz",
+          "integrity": "sha512-lks+lVC8dgGyh97jxvxeYTWQFvh4uw4yC12gVl63Cg30sjPX4wuGcdkICVXDAESr6OJGjqGA8Iz5mkeN6zlD7A==",
+          "dev": true,
+          "requires": {
+            "depd": "~1.1.2",
+            "inherits": "2.0.3",
+            "setprototypeof": "1.1.0",
+            "statuses": ">= 1.4.0 < 2"
+          }
+        },
+        "inherits": {
+          "version": "2.0.3",
+          "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
+          "integrity": "sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw==",
+          "dev": true
+        },
+        "ms": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+          "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+          "dev": true
+        },
+        "setprototypeof": {
+          "version": "1.1.0",
+          "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.1.0.tgz",
+          "integrity": "sha512-BvE/TwpZX4FXExxOxZyRGQQv651MSwmWKZGqvmPcRIjDqWub67kTKuIMx43cZZrS/cBBzwBcNDWoFxt2XEFIpQ==",
+          "dev": true
+        },
+        "statuses": {
+          "version": "1.5.0",
+          "resolved": "https://registry.npmjs.org/statuses/-/statuses-1.5.0.tgz",
+          "integrity": "sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA==",
+          "dev": true
+        }
+      }
+    },
+    "serve-static": {
+      "version": "1.15.0",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.15.0.tgz",
+      "integrity": "sha512-XGuRDNjXUijsUL0vl6nSD7cwURuzEgglbOaFuZM9g3kwDXOWVTck0jLzjPzGD+TazWbboZYu52/9/XPdUgne9g==",
+      "dev": true,
+      "requires": {
+        "encodeurl": "~1.0.2",
+        "escape-html": "~1.0.3",
+        "parseurl": "~1.3.3",
+        "send": "0.18.0"
+      }
+    },
+    "setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+      "dev": true
+    },
+    "shallow-clone": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/shallow-clone/-/shallow-clone-3.0.1.tgz",
+      "integrity": "sha512-/6KqX+GVUdqPuPPd2LxDDxzX6CAbjJehAAOKlNpqqUpAqPM6HeL8f+o3a+JsyGjn2lv0WY8UsTgUJjU9Ok55NA==",
+      "dev": true,
+      "requires": {
+        "kind-of": "^6.0.2"
+      }
+    },
+    "shebang-command": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-1.2.0.tgz",
+      "integrity": "sha512-EV3L1+UQWGor21OmnvojK36mhg+TyIKDh3iFBKBohr5xeXIhNBcx8oWdgkTEEQ+BEFFYdLRuqMfd5L84N1V5Vg==",
+      "dev": true,
+      "requires": {
+        "shebang-regex": "^1.0.0"
+      }
+    },
+    "shebang-regex": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-1.0.0.tgz",
+      "integrity": "sha512-wpoSFAxys6b2a2wHZ1XpDSgD7N9iVjg29Ph9uV/uaP9Ex/KXlkTZTeddxDPSYQpgvzKLGJke2UU0AzoGCjNIvQ==",
+      "dev": true
+    },
+    "shell-quote": {
+      "version": "1.7.3",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.7.3.tgz",
+      "integrity": "sha512-Vpfqwm4EnqGdlsBFNmHhxhElJYrdfcxPThu+ryKS5J8L/fhAwLazFZtq+S+TWZ9ANj2piSQLGj6NQg+lKPmxrw==",
+      "dev": true
+    },
+    "side-channel": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.0.4.tgz",
+      "integrity": "sha512-q5XPytqFEIKHkGdiMIrY10mvLRvnQh42/+GoBlFW3b2LXLE2xxJpZFdm94we0BaoV3RwJyGqg5wS7epxTv0Zvw==",
+      "dev": true,
+      "requires": {
+        "call-bind": "^1.0.0",
+        "get-intrinsic": "^1.0.2",
+        "object-inspect": "^1.9.0"
+      }
+    },
+    "sigmund": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/sigmund/-/sigmund-1.0.1.tgz",
+      "integrity": "sha512-fCvEXfh6NWpm+YSuY2bpXb/VIihqWA6hLsgboC+0nl71Q7N7o2eaCW8mJa/NLvQhs6jpd3VZV4UiUQlV6+lc8g==",
+      "dev": true
+    },
+    "signal-exit": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "dev": true
+    },
+    "sirv": {
+      "version": "1.0.19",
+      "resolved": "https://registry.npmjs.org/sirv/-/sirv-1.0.19.tgz",
+      "integrity": "sha512-JuLThK3TnZG1TAKDwNIqNq6QA2afLOCcm+iE8D1Kj3GA40pSPsxQjjJl0J8X3tsR7T+CP1GavpzLwYkgVLWrZQ==",
+      "dev": true,
+      "requires": {
+        "@polka/url": "^1.0.0-next.20",
+        "mrmime": "^1.0.0",
+        "totalist": "^1.0.0"
+      }
+    },
+    "sisteransi": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz",
+      "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==",
+      "dev": true
+    },
+    "slash": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
+      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
+      "dev": true
+    },
+    "slice-ansi": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-4.0.0.tgz",
+      "integrity": "sha512-qMCMfhY040cVHT43K9BFygqYbUPFZKHOg7K73mtTWJRb8pyP3fzf4Ixd5SzdEJQ6MRUg/WBnOLxghZtKKurENQ==",
+      "dev": true,
+      "requires": {
+        "ansi-styles": "^4.0.0",
+        "astral-regex": "^2.0.0",
+        "is-fullwidth-code-point": "^3.0.0"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        }
+      }
+    },
+    "slugify": {
+      "version": "1.6.5",
+      "resolved": "https://registry.npmjs.org/slugify/-/slugify-1.6.5.tgz",
+      "integrity": "sha512-8mo9bslnBO3tr5PEVFzMPIWwWnipGS0xVbYf65zxDqfNwmzYn1LpiKNrR6DlClusuvo+hDHd1zKpmfAe83NQSQ=="
+    },
+    "sockjs": {
+      "version": "0.3.24",
+      "resolved": "https://registry.npmjs.org/sockjs/-/sockjs-0.3.24.tgz",
+      "integrity": "sha512-GJgLTZ7vYb/JtPSSZ10hsOYIvEYsjbNU+zPdIHcUaWVNUEPivzxku31865sSSud0Da0W4lEeOPlmw93zLQchuQ==",
+      "dev": true,
+      "requires": {
+        "faye-websocket": "^0.11.3",
+        "uuid": "^8.3.2",
+        "websocket-driver": "^0.7.4"
+      }
+    },
+    "source-map": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="
+    },
+    "source-map-js": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.0.2.tgz",
+      "integrity": "sha512-R0XvVJ9WusLiqTCEiGCmICCMplcCkIwwR11mOSD9CR5u+IXYdiseeEuXCVAjS54zqwkLcPNnmU4OeJ6tUrWhDw=="
+    },
+    "source-map-support": {
+      "version": "0.5.21",
+      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
+      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+      "dev": true,
+      "requires": {
+        "buffer-from": "^1.0.0",
+        "source-map": "^0.6.0"
+      }
+    },
+    "sourcemap-codec": {
+      "version": "1.4.8",
+      "resolved": "https://registry.npmjs.org/sourcemap-codec/-/sourcemap-codec-1.4.8.tgz",
+      "integrity": "sha512-9NykojV5Uih4lgo5So5dtw+f0JgJX30KCNI8gwhz2J9A15wD0Ml6tjHKwf6fTSa6fAdVBdZeNOs9eJ71qCk8vA=="
+    },
+    "spdx-correct": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.1.1.tgz",
+      "integrity": "sha512-cOYcUWwhCuHCXi49RhFRCyJEK3iPj1Ziz9DpViV3tbZOwXD49QzIN3MpOLJNxh2qwq2lJJZaKMVw9qNi4jTC0w==",
+      "dev": true,
+      "requires": {
+        "spdx-expression-parse": "^3.0.0",
+        "spdx-license-ids": "^3.0.0"
+      }
+    },
+    "spdx-exceptions": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.3.0.tgz",
+      "integrity": "sha512-/tTrYOC7PPI1nUAgx34hUpqXuyJG+DTHJTnIULG4rDygi4xu/tfgmq1e1cIRwRzwZgo4NLySi+ricLkZkw4i5A==",
+      "dev": true
+    },
+    "spdx-expression-parse": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
+      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
+      "dev": true,
+      "requires": {
+        "spdx-exceptions": "^2.1.0",
+        "spdx-license-ids": "^3.0.0"
+      }
+    },
+    "spdx-license-ids": {
+      "version": "3.0.11",
+      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.11.tgz",
+      "integrity": "sha512-Ctl2BrFiM0X3MANYgj3CkygxhRmr9mi6xhejbdO960nF6EDJApTYpn0BQnDKlnNBULKiCN1n3w9EBkHK8ZWg+g==",
+      "dev": true
+    },
+    "spdy": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/spdy/-/spdy-4.0.2.tgz",
+      "integrity": "sha512-r46gZQZQV+Kl9oItvl1JZZqJKGr+oEkB08A6BzkiR7593/7IbtuncXHd2YoYeTsG4157ZssMu9KYvUHLcjcDoA==",
+      "dev": true,
+      "requires": {
+        "debug": "^4.1.0",
+        "handle-thing": "^2.0.0",
+        "http-deceiver": "^1.2.7",
+        "select-hose": "^2.0.0",
+        "spdy-transport": "^3.0.0"
+      }
+    },
+    "spdy-transport": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/spdy-transport/-/spdy-transport-3.0.0.tgz",
+      "integrity": "sha512-hsLVFE5SjA6TCisWeJXFKniGGOpBgMLmerfO2aCyCU5s7nJ/rpAepqmFifv/GCbSbueEeAJJnmSQ2rKC/g8Fcw==",
+      "dev": true,
+      "requires": {
+        "debug": "^4.1.0",
+        "detect-node": "^2.0.4",
+        "hpack.js": "^2.1.6",
+        "obuf": "^1.1.2",
+        "readable-stream": "^3.0.6",
+        "wbuf": "^1.7.3"
+      }
+    },
+    "sprintf-js": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
+      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
+      "dev": true
+    },
+    "ssri": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/ssri/-/ssri-8.0.1.tgz",
+      "integrity": "sha512-97qShzy1AiyxvPNIkLWoGua7xoQzzPjQ0HAH4B0rWKo7SZ6USuPcrUiAFrws0UH8RrbWmgq3LMTObhPIHbbBeQ==",
+      "dev": true,
+      "requires": {
+        "minipass": "^3.1.1"
+      }
+    },
+    "stable": {
+      "version": "0.1.8",
+      "resolved": "https://registry.npmjs.org/stable/-/stable-0.1.8.tgz",
+      "integrity": "sha512-ji9qxRnOVfcuLDySj9qzhGSEFVobyt1kIOSkj1qZzYLzq7Tos/oUUWvotUPQLlrsidqsK6tBH89Bc9kL5zHA6w==",
+      "dev": true
+    },
+    "stack-utils": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/stack-utils/-/stack-utils-2.0.5.tgz",
+      "integrity": "sha512-xrQcmYhOsn/1kX+Vraq+7j4oE2j/6BFscZ0etmYg81xuM8Gq0022Pxb8+IqgOFUIaxHs0KaSb7T1+OegiNrNFA==",
+      "dev": true,
+      "requires": {
+        "escape-string-regexp": "^2.0.0"
+      },
+      "dependencies": {
+        "escape-string-regexp": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz",
+          "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==",
+          "dev": true
+        }
+      }
+    },
+    "stackframe": {
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/stackframe/-/stackframe-1.3.4.tgz",
+      "integrity": "sha512-oeVtt7eWQS+Na6F//S4kJ2K2VbRlS9D43mAlMyVpVWovy9o+jfgH8O9agzANzaiLjclA0oYzUXEM4PurhSUChw==",
+      "dev": true
+    },
+    "statuses": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz",
+      "integrity": "sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==",
+      "dev": true
+    },
+    "string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "dev": true,
+      "requires": {
+        "safe-buffer": "~5.2.0"
+      },
+      "dependencies": {
+        "safe-buffer": {
+          "version": "5.2.1",
+          "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+          "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+          "dev": true
+        }
+      }
+    },
+    "string-length": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/string-length/-/string-length-4.0.2.tgz",
+      "integrity": "sha512-+l6rNN5fYHNhZZy41RXsYptCjA2Igmq4EG7kZAYFQI1E1VTXarr6ZPXBg6eq7Y6eK4FEhY6AJlyuFIb/v/S0VQ==",
+      "dev": true,
+      "requires": {
+        "char-regex": "^1.0.2",
+        "strip-ansi": "^6.0.0"
+      }
+    },
+    "string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "requires": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      }
+    },
+    "strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "requires": {
+        "ansi-regex": "^5.0.1"
+      }
+    },
+    "strip-bom": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-4.0.0.tgz",
+      "integrity": "sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w==",
+      "dev": true
+    },
+    "strip-eof": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/strip-eof/-/strip-eof-1.0.0.tgz",
+      "integrity": "sha512-7FCwGGmx8mD5xQd3RPUvnSpUXHM3BWuzjtpD4TXsfcZ9EL4azvVVUscFYwD9nx8Kh+uCBC00XBtAykoMHwTh8Q==",
+      "dev": true
+    },
+    "strip-final-newline": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz",
+      "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==",
+      "dev": true
+    },
+    "strip-indent": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/strip-indent/-/strip-indent-2.0.0.tgz",
+      "integrity": "sha512-RsSNPLpq6YUL7QYy44RnPVTn/lcVZtb48Uof3X5JLbF4zD/Gs7ZFDv2HWol+leoQN2mT86LAzSshGfkTlSOpsA==",
+      "dev": true
+    },
+    "strip-json-comments": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+      "dev": true
+    },
+    "stylehacks": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/stylehacks/-/stylehacks-5.1.0.tgz",
+      "integrity": "sha512-SzLmvHQTrIWfSgljkQCw2++C9+Ne91d/6Sp92I8c5uHTcy/PgeHamwITIbBW9wnFTY/3ZfSXR9HIL6Ikqmcu6Q==",
+      "dev": true,
+      "requires": {
+        "browserslist": "^4.16.6",
+        "postcss-selector-parser": "^6.0.4"
+      }
+    },
+    "supports-color": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
+      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
+      "dev": true,
+      "requires": {
+        "has-flag": "^3.0.0"
+      }
+    },
+    "supports-hyperlinks": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/supports-hyperlinks/-/supports-hyperlinks-2.2.0.tgz",
+      "integrity": "sha512-6sXEzV5+I5j8Bmq9/vUphGRM/RJNT9SCURJLjwfOg51heRtguGWDzcaBlgAzKhQa0EVNpPEKzQuBwZ8S8WaCeQ==",
+      "dev": true,
+      "requires": {
+        "has-flag": "^4.0.0",
+        "supports-color": "^7.0.0"
+      },
+      "dependencies": {
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "supports-preserve-symlinks-flag": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
+      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
+      "dev": true
+    },
+    "svg-tags": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/svg-tags/-/svg-tags-1.0.0.tgz",
+      "integrity": "sha512-ovssysQTa+luh7A5Weu3Rta6FJlFBBbInjOh722LIt6klpU2/HtdUbszju/G4devcvk8PGt7FCLv5wftu3THUA==",
+      "dev": true
+    },
+    "svg.draggable.js": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/svg.draggable.js/-/svg.draggable.js-2.2.2.tgz",
+      "integrity": "sha512-JzNHBc2fLQMzYCZ90KZHN2ohXL0BQJGQimK1kGk6AvSeibuKcIdDX9Kr0dT9+UJ5O8nYA0RB839Lhvk4CY4MZw==",
+      "requires": {
+        "svg.js": "^2.0.1"
+      }
+    },
+    "svg.easing.js": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/svg.easing.js/-/svg.easing.js-2.0.0.tgz",
+      "integrity": "sha512-//ctPdJMGy22YoYGV+3HEfHbm6/69LJUTAqI2/5qBvaNHZ9uUFVC82B0Pl299HzgH13rKrBgi4+XyXXyVWWthA==",
+      "requires": {
+        "svg.js": ">=2.3.x"
+      }
+    },
+    "svg.filter.js": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/svg.filter.js/-/svg.filter.js-2.0.2.tgz",
+      "integrity": "sha512-xkGBwU+dKBzqg5PtilaTb0EYPqPfJ9Q6saVldX+5vCRy31P6TlRCP3U9NxH3HEufkKkpNgdTLBJnmhDHeTqAkw==",
+      "requires": {
+        "svg.js": "^2.2.5"
+      }
+    },
+    "svg.js": {
+      "version": "2.7.1",
+      "resolved": "https://registry.npmjs.org/svg.js/-/svg.js-2.7.1.tgz",
+      "integrity": "sha512-ycbxpizEQktk3FYvn/8BH+6/EuWXg7ZpQREJvgacqn46gIddG24tNNe4Son6omdXCnSOaApnpZw6MPCBA1dODA=="
+    },
+    "svg.pathmorphing.js": {
+      "version": "0.1.3",
+      "resolved": "https://registry.npmjs.org/svg.pathmorphing.js/-/svg.pathmorphing.js-0.1.3.tgz",
+      "integrity": "sha512-49HWI9X4XQR/JG1qXkSDV8xViuTLIWm/B/7YuQELV5KMOPtXjiwH4XPJvr/ghEDibmLQ9Oc22dpWpG0vUDDNww==",
+      "requires": {
+        "svg.js": "^2.4.0"
+      }
+    },
+    "svg.resize.js": {
+      "version": "1.4.3",
+      "resolved": "https://registry.npmjs.org/svg.resize.js/-/svg.resize.js-1.4.3.tgz",
+      "integrity": "sha512-9k5sXJuPKp+mVzXNvxz7U0uC9oVMQrrf7cFsETznzUDDm0x8+77dtZkWdMfRlmbkEEYvUn9btKuZ3n41oNA+uw==",
+      "requires": {
+        "svg.js": "^2.6.5",
+        "svg.select.js": "^2.1.2"
+      },
+      "dependencies": {
+        "svg.select.js": {
+          "version": "2.1.2",
+          "resolved": "https://registry.npmjs.org/svg.select.js/-/svg.select.js-2.1.2.tgz",
+          "integrity": "sha512-tH6ABEyJsAOVAhwcCjF8mw4crjXSI1aa7j2VQR8ZuJ37H2MBUbyeqYr5nEO7sSN3cy9AR9DUwNg0t/962HlDbQ==",
+          "requires": {
+            "svg.js": "^2.2.5"
+          }
+        }
+      }
+    },
+    "svg.select.js": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/svg.select.js/-/svg.select.js-3.0.1.tgz",
+      "integrity": "sha512-h5IS/hKkuVCbKSieR9uQCj9w+zLHoPh+ce19bBYyqF53g6mnPB8sAtIbe1s9dh2S2fCmYX2xel1Ln3PJBbK4kw==",
+      "requires": {
+        "svg.js": "^2.6.5"
+      }
+    },
+    "svgo": {
+      "version": "2.8.0",
+      "resolved": "https://registry.npmjs.org/svgo/-/svgo-2.8.0.tgz",
+      "integrity": "sha512-+N/Q9kV1+F+UeWYoSiULYo4xYSDQlTgb+ayMobAXPwMnLvop7oxKMo9OzIrX5x3eS4L4f2UHhc9axXwY8DpChg==",
+      "dev": true,
+      "requires": {
+        "@trysound/sax": "0.2.0",
+        "commander": "^7.2.0",
+        "css-select": "^4.1.3",
+        "css-tree": "^1.1.3",
+        "csso": "^4.2.0",
+        "picocolors": "^1.0.0",
+        "stable": "^0.1.8"
+      },
+      "dependencies": {
+        "commander": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/commander/-/commander-7.2.0.tgz",
+          "integrity": "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==",
+          "dev": true
+        }
+      }
+    },
+    "symbol-tree": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
+      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
+      "dev": true
+    },
+    "table": {
+      "version": "6.8.1",
+      "resolved": "https://registry.npmjs.org/table/-/table-6.8.1.tgz",
+      "integrity": "sha512-Y4X9zqrCftUhMeH2EptSSERdVKt/nEdijTOacGD/97EKjhQ/Qs8RTlEGABSJNNN8lac9kheH+af7yAkEWlgneA==",
+      "dev": true,
+      "requires": {
+        "ajv": "^8.0.1",
+        "lodash.truncate": "^4.4.2",
+        "slice-ansi": "^4.0.0",
+        "string-width": "^4.2.3",
+        "strip-ansi": "^6.0.1"
+      },
+      "dependencies": {
+        "ajv": {
+          "version": "8.12.0",
+          "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.12.0.tgz",
+          "integrity": "sha512-sRu1kpcO9yLtYxBKvqfTeh9KzZEwO3STyX1HT+4CaDzC6HpTGYhIhPIzj9XuKU7KYDwnaeh5hcOwjy1QuJzBPA==",
+          "dev": true,
+          "requires": {
+            "fast-deep-equal": "^3.1.1",
+            "json-schema-traverse": "^1.0.0",
+            "require-from-string": "^2.0.2",
+            "uri-js": "^4.2.2"
+          }
+        },
+        "json-schema-traverse": {
+          "version": "1.0.0",
+          "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+          "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+          "dev": true
+        }
+      }
+    },
+    "tailwindcss": {
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-3.1.4.tgz",
+      "integrity": "sha512-NrxbFV4tYsga/hpWbRyUfIaBrNMXDxx5BsHgBS4v5tlyjf+sDsgBg5m9OxjrXIqAS/uR9kicxLKP+bEHI7BSeQ==",
+      "dev": true,
+      "requires": {
+        "arg": "^5.0.2",
+        "chokidar": "^3.5.3",
+        "color-name": "^1.1.4",
+        "detective": "^5.2.1",
+        "didyoumean": "^1.2.2",
+        "dlv": "^1.1.3",
+        "fast-glob": "^3.2.11",
+        "glob-parent": "^6.0.2",
+        "is-glob": "^4.0.3",
+        "lilconfig": "^2.0.5",
+        "normalize-path": "^3.0.0",
+        "object-hash": "^3.0.0",
+        "picocolors": "^1.0.0",
+        "postcss": "^8.4.14",
+        "postcss-import": "^14.1.0",
+        "postcss-js": "^4.0.0",
+        "postcss-load-config": "^3.1.4",
+        "postcss-nested": "5.0.6",
+        "postcss-selector-parser": "^6.0.10",
+        "postcss-value-parser": "^4.2.0",
+        "quick-lru": "^5.1.1",
+        "resolve": "^1.22.0"
+      },
+      "dependencies": {
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        }
+      }
+    },
+    "tapable": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.2.1.tgz",
+      "integrity": "sha512-GNzQvQTOIP6RyTfE2Qxb8ZVlNmw0n88vp1szwWRimP02mnTsx3Wtn5qRdqY9w2XduFNUgvOwhNnQsjwCp+kqaQ==",
+      "dev": true
+    },
+    "terminal-link": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/terminal-link/-/terminal-link-2.1.1.tgz",
+      "integrity": "sha512-un0FmiRUQNr5PJqy9kP7c40F5BOfpGlYTrxonDChEZB7pzZxRNp/bt+ymiy9/npwXya9KH99nJ/GXFIiUkYGFQ==",
+      "dev": true,
+      "requires": {
+        "ansi-escapes": "^4.2.1",
+        "supports-hyperlinks": "^2.0.0"
+      },
+      "dependencies": {
+        "ansi-escapes": {
+          "version": "4.3.2",
+          "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
+          "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
+          "dev": true,
+          "requires": {
+            "type-fest": "^0.21.3"
+          }
+        },
+        "type-fest": {
+          "version": "0.21.3",
+          "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
+          "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
+          "dev": true
+        }
+      }
+    },
+    "terser": {
+      "version": "5.17.3",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.17.3.tgz",
+      "integrity": "sha512-AudpAZKmZHkG9jueayypz4duuCFJMMNGRMwaPvQKWfxKedh8Z2x3OCoDqIIi1xx5+iwx1u6Au8XQcc9Lke65Yg==",
+      "dev": true,
+      "requires": {
+        "@jridgewell/source-map": "^0.3.2",
+        "acorn": "^8.5.0",
+        "commander": "^2.20.0",
+        "source-map-support": "~0.5.20"
+      },
+      "dependencies": {
+        "commander": {
+          "version": "2.20.3",
+          "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+          "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+          "dev": true
+        }
+      }
+    },
+    "terser-webpack-plugin": {
+      "version": "5.3.8",
+      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.3.8.tgz",
+      "integrity": "sha512-WiHL3ElchZMsK27P8uIUh4604IgJyAW47LVXGbEoB21DbQcZ+OuMpGjVYnEUaqcWM6dO8uS2qUbA7LSCWqvsbg==",
+      "dev": true,
+      "requires": {
+        "@jridgewell/trace-mapping": "^0.3.17",
+        "jest-worker": "^27.4.5",
+        "schema-utils": "^3.1.1",
+        "serialize-javascript": "^6.0.1",
+        "terser": "^5.16.8"
+      }
+    },
+    "test-exclude": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
+      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
+      "dev": true,
+      "requires": {
+        "@istanbuljs/schema": "^0.1.2",
+        "glob": "^7.1.4",
+        "minimatch": "^3.0.4"
+      }
+    },
+    "text-table": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
+      "integrity": "sha512-N+8UisAXDGk8PFXP4HAzVR9nbfmVJ3zYLAWiTIoqC5v5isinhr+r5uaO8+7r3BMfuNIufIsA7RdpVgacC2cSpw==",
+      "dev": true
+    },
+    "thenify": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/thenify/-/thenify-3.3.1.tgz",
+      "integrity": "sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==",
+      "dev": true,
+      "requires": {
+        "any-promise": "^1.0.0"
+      }
+    },
+    "thenify-all": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/thenify-all/-/thenify-all-1.6.0.tgz",
+      "integrity": "sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==",
+      "dev": true,
+      "requires": {
+        "thenify": ">= 3.1.0 < 4"
+      }
+    },
+    "thread-loader": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/thread-loader/-/thread-loader-3.0.4.tgz",
+      "integrity": "sha512-ByaL2TPb+m6yArpqQUZvP+5S1mZtXsEP7nWKKlAUTm7fCml8kB5s1uI3+eHRP2bk5mVYfRSBI7FFf+tWEyLZwA==",
+      "dev": true,
+      "requires": {
+        "json-parse-better-errors": "^1.0.2",
+        "loader-runner": "^4.1.0",
+        "loader-utils": "^2.0.0",
+        "neo-async": "^2.6.2",
+        "schema-utils": "^3.0.0"
+      },
+      "dependencies": {
+        "loader-utils": {
+          "version": "2.0.4",
+          "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.4.tgz",
+          "integrity": "sha512-xXqpXoINfFhgua9xiqD8fPFHgkoq1mmmpE92WlDbm9rNRd/EbRb+Gqf908T2DMfuHjjJlksiK2RbHVOdD/MqSw==",
+          "dev": true,
+          "requires": {
+            "big.js": "^5.2.2",
+            "emojis-list": "^3.0.0",
+            "json5": "^2.1.2"
+          }
+        }
+      }
+    },
+    "throat": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/throat/-/throat-6.0.1.tgz",
+      "integrity": "sha512-8hmiGIJMDlwjg7dlJ4yKGLK8EsYqKgPWbG3b4wjJddKNwc7N7Dpn08Df4szr/sZdMVeOstrdYSsqzX6BYbcB+w==",
+      "dev": true
+    },
+    "thunky": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/thunky/-/thunky-1.1.0.tgz",
+      "integrity": "sha512-eHY7nBftgThBqOyHGVN+l8gF0BucP09fMo0oO/Lb0w1OF80dJv+lDVpXG60WMQvkcxAkNybKsrEIE3ZtKGmPrA==",
+      "dev": true
+    },
+    "tiny-emitter": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/tiny-emitter/-/tiny-emitter-2.1.0.tgz",
+      "integrity": "sha512-NB6Dk1A9xgQPMoGqC5CVXn123gWyte215ONT5Pp5a0yt4nlEoO1ZWeCwpncaekPHXO60i47ihFnZPiRPjRMq4Q=="
+    },
+    "tmpl": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/tmpl/-/tmpl-1.0.5.tgz",
+      "integrity": "sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==",
+      "dev": true
+    },
+    "to-fast-properties": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
+      "integrity": "sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==",
+      "dev": true
+    },
+    "to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "dev": true,
+      "requires": {
+        "is-number": "^7.0.0"
+      }
+    },
+    "toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "dev": true
+    },
+    "totalist": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/totalist/-/totalist-1.1.0.tgz",
+      "integrity": "sha512-gduQwd1rOdDMGxFG1gEvhV88Oirdo2p+KjoYFU7k2g+i7n6AFFbDQ5kMPUsW0pNbfQsB/cwXvT1i4Bue0s9g5g==",
+      "dev": true
+    },
+    "tough-cookie": {
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.3.tgz",
+      "integrity": "sha512-aX/y5pVRkfRnfmuX+OdbSdXvPe6ieKX/G2s7e98f4poJHnqH3281gDPm/metm6E/WRamfx7WC4HUqkWHfQHprw==",
+      "dev": true,
+      "requires": {
+        "psl": "^1.1.33",
+        "punycode": "^2.1.1",
+        "universalify": "^0.2.0",
+        "url-parse": "^1.5.3"
+      },
+      "dependencies": {
+        "universalify": {
+          "version": "0.2.0",
+          "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.2.0.tgz",
+          "integrity": "sha512-CJ1QgKmNg3CwvAv/kOFmtnEN05f0D/cn9QntgNOQlQF9dgvVTHj3t+8JPdjqawCHk7V/KA+fbUqzZ9XWhcqPUg==",
+          "dev": true
+        }
+      }
+    },
+    "tr46": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
+      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
+      "dev": true
+    },
+    "ts-jest": {
+      "version": "27.1.5",
+      "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-27.1.5.tgz",
+      "integrity": "sha512-Xv6jBQPoBEvBq/5i2TeSG9tt/nqkbpcurrEG1b+2yfBrcJelOZF9Ml6dmyMh7bcW9JyFbRYpR5rxROSlBLTZHA==",
+      "dev": true,
+      "requires": {
+        "bs-logger": "0.x",
+        "fast-json-stable-stringify": "2.x",
+        "jest-util": "^27.0.0",
+        "json5": "2.x",
+        "lodash.memoize": "4.x",
+        "make-error": "1.x",
+        "semver": "7.x",
+        "yargs-parser": "20.x"
+      },
+      "dependencies": {
+        "semver": {
+          "version": "7.5.4",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+          "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^6.0.0"
+          }
+        }
+      }
+    },
+    "ts-loader": {
+      "version": "9.3.1",
+      "resolved": "https://registry.npmjs.org/ts-loader/-/ts-loader-9.3.1.tgz",
+      "integrity": "sha512-OkyShkcZTsTwyS3Kt7a4rsT/t2qvEVQuKCTg4LJmpj9fhFR7ukGdZwV6Qq3tRUkqcXtfGpPR7+hFKHCG/0d3Lw==",
+      "dev": true,
+      "requires": {
+        "chalk": "^4.1.0",
+        "enhanced-resolve": "^5.0.0",
+        "micromatch": "^4.0.0",
+        "semver": "^7.3.4"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "semver": {
+          "version": "7.5.4",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+          "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^6.0.0"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "tsconfig": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/tsconfig/-/tsconfig-7.0.0.tgz",
+      "integrity": "sha512-vZXmzPrL+EmC4T/4rVlT2jNVMWCi/O4DIiSj3UHg1OE5kCKbk4mfrXc6dZksLgRM/TZlKnousKH9bbTazUWRRw==",
+      "dev": true,
+      "optional": true,
+      "peer": true,
+      "requires": {
+        "@types/strip-bom": "^3.0.0",
+        "@types/strip-json-comments": "0.0.30",
+        "strip-bom": "^3.0.0",
+        "strip-json-comments": "^2.0.0"
+      },
+      "dependencies": {
+        "strip-bom": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
+          "integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==",
+          "dev": true,
+          "optional": true,
+          "peer": true
+        },
+        "strip-json-comments": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+          "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+          "dev": true,
+          "optional": true,
+          "peer": true
+        }
+      }
+    },
+    "tslib": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.4.0.tgz",
+      "integrity": "sha512-d6xOpEDfsi2CZVlPQzGeux8XMwLT9hssAsaPYExaQMuYskwb+x1x7J371tWlbBdWHroy99KnVB6qIkUbs5X3UQ=="
+    },
+    "tslint": {
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/tslint/-/tslint-6.1.3.tgz",
+      "integrity": "sha512-IbR4nkT96EQOvKE2PW/djGz8iGNeJ4rF2mBfiYaR/nvUWYKJhLwimoJKgjIFEIDibBtOevj7BqCRL4oHeWWUCg==",
+      "dev": true,
+      "requires": {
+        "@babel/code-frame": "^7.0.0",
+        "builtin-modules": "^1.1.1",
+        "chalk": "^2.3.0",
+        "commander": "^2.12.1",
+        "diff": "^4.0.1",
+        "glob": "^7.1.1",
+        "js-yaml": "^3.13.1",
+        "minimatch": "^3.0.4",
+        "mkdirp": "^0.5.3",
+        "resolve": "^1.3.2",
+        "semver": "^5.3.0",
+        "tslib": "^1.13.0",
+        "tsutils": "^2.29.0"
+      },
+      "dependencies": {
+        "argparse": {
+          "version": "1.0.10",
+          "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
+          "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+          "dev": true,
+          "requires": {
+            "sprintf-js": "~1.0.2"
+          }
+        },
+        "commander": {
+          "version": "2.20.3",
+          "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+          "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+          "dev": true
+        },
+        "js-yaml": {
+          "version": "3.14.1",
+          "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
+          "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
+          "dev": true,
+          "requires": {
+            "argparse": "^1.0.7",
+            "esprima": "^4.0.0"
+          }
+        },
+        "semver": {
+          "version": "5.7.2",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz",
+          "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==",
+          "dev": true
+        },
+        "tslib": {
+          "version": "1.14.1",
+          "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
+          "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
+          "dev": true
+        },
+        "tsutils": {
+          "version": "2.29.0",
+          "resolved": "https://registry.npmjs.org/tsutils/-/tsutils-2.29.0.tgz",
+          "integrity": "sha512-g5JVHCIJwzfISaXpXE1qvNalca5Jwob6FjI4AoPlqMusJ6ftFE7IkkFoMhVLRgK+4Kx3gkzb8UZK5t5yTTvEmA==",
+          "dev": true,
+          "requires": {
+            "tslib": "^1.8.1"
+          }
+        }
+      }
+    },
+    "tsutils": {
+      "version": "3.21.0",
+      "resolved": "https://registry.npmjs.org/tsutils/-/tsutils-3.21.0.tgz",
+      "integrity": "sha512-mHKK3iUXL+3UF6xL5k0PEhKRUBKPBCv/+RkEOpjRWxxx27KKRBmmA60A9pgOUvMi8GKhRMPEmjBRPzs2W7O1OA==",
+      "dev": true,
+      "requires": {
+        "tslib": "^1.8.1"
+      },
+      "dependencies": {
+        "tslib": {
+          "version": "1.14.1",
+          "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
+          "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
+          "dev": true
+        }
+      }
+    },
+    "type-check": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
+      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
+      "dev": true,
+      "requires": {
+        "prelude-ls": "^1.2.1"
+      }
+    },
+    "type-detect": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz",
+      "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==",
+      "dev": true
+    },
+    "type-fest": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.6.0.tgz",
+      "integrity": "sha512-q+MB8nYR1KDLrgr4G5yemftpMC7/QLqVndBmEEdqzmNj5dcFOO4Oo8qlwZE3ULT3+Zim1F8Kq4cBnikNhlCMlg==",
+      "dev": true
+    },
+    "type-is": {
+      "version": "1.6.18",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
+      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
+      "dev": true,
+      "requires": {
+        "media-typer": "0.3.0",
+        "mime-types": "~2.1.24"
+      }
+    },
+    "typedarray-to-buffer": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/typedarray-to-buffer/-/typedarray-to-buffer-3.1.5.tgz",
+      "integrity": "sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==",
+      "dev": true,
+      "requires": {
+        "is-typedarray": "^1.0.0"
+      }
+    },
+    "typescript": {
+      "version": "4.7.4",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.7.4.tgz",
+      "integrity": "sha512-C0WQT0gezHuw6AdY1M2jxUO83Rjf0HP7Sk1DtXj6j1EwkQNZrHAg2XPWlq62oqEhYvONq5pkC2Y9oPljWToLmQ==",
+      "dev": true
+    },
+    "unfetch": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/unfetch/-/unfetch-4.2.0.tgz",
+      "integrity": "sha512-F9p7yYCn6cIW9El1zi0HI6vqpeIvBsr3dSuRO6Xuppb1u5rXpCPmMvLSyECLhybr9isec8Ohl0hPekMVrEinDA=="
+    },
+    "unicode-canonical-property-names-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-canonical-property-names-ecmascript/-/unicode-canonical-property-names-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-yY5PpDlfVIU5+y/BSCxAJRBIS1Zc2dDG3Ujq+sR0U+JjUevW2JhocOF+soROYDSaAezOzOKuyyixhD6mBknSmQ==",
+      "dev": true
+    },
+    "unicode-match-property-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-match-property-ecmascript/-/unicode-match-property-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-5kaZCrbp5mmbz5ulBkDkbY0SsPOjKqVS35VpL9ulMPfSl0J0Xsm+9Evphv9CoIZFwre7aJoa94AY6seMKGVN5Q==",
+      "dev": true,
+      "requires": {
+        "unicode-canonical-property-names-ecmascript": "^2.0.0",
+        "unicode-property-aliases-ecmascript": "^2.0.0"
+      }
+    },
+    "unicode-match-property-value-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-match-property-value-ecmascript/-/unicode-match-property-value-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-7Yhkc0Ye+t4PNYzOGKedDhXbYIBe1XEQYQxOPyhcXNMJ0WCABqqj6ckydd6pWRZTHV4GuCPKdBAUiMc60tsKVw==",
+      "dev": true
+    },
+    "unicode-property-aliases-ecmascript": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-property-aliases-ecmascript/-/unicode-property-aliases-ecmascript-2.0.0.tgz",
+      "integrity": "sha512-5Zfuy9q/DFr4tfO7ZPeVXb1aPoeQSdeFMLpYuFebehDAhbuevLs5yxSZmIFN1tP5F9Wl4IpJrYojg85/zgyZHQ==",
+      "dev": true
+    },
+    "universalify": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.0.tgz",
+      "integrity": "sha512-hAZsKq7Yy11Zu1DE0OzWjw7nnLZmJZYTDZZyEFHZdUhV8FkH5MCfoU1XMaxXovpyW5nq5scPqq0ZDP9Zyl04oQ==",
+      "dev": true
+    },
+    "unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+      "dev": true
+    },
+    "update-browserslist-db": {
+      "version": "1.0.11",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.0.11.tgz",
+      "integrity": "sha512-dCwEFf0/oT85M1fHBg4F0jtLwJrutGoHSQXCh7u4o2t1drG+c0a9Flnqww6XUKSfQMPpJBRjU8d4RXB09qtvaA==",
+      "dev": true,
+      "requires": {
+        "escalade": "^3.1.1",
+        "picocolors": "^1.0.0"
+      }
+    },
+    "uri-js": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
+      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
+      "dev": true,
+      "requires": {
+        "punycode": "^2.1.0"
+      }
+    },
+    "url-parse": {
+      "version": "1.5.10",
+      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz",
+      "integrity": "sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==",
+      "dev": true,
+      "requires": {
+        "querystringify": "^2.1.1",
+        "requires-port": "^1.0.0"
+      }
+    },
+    "util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "dev": true
+    },
+    "utila": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/utila/-/utila-0.4.0.tgz",
+      "integrity": "sha512-Z0DbgELS9/L/75wZbro8xAnT50pBVFQZ+hUEueGDU5FN51YSCYM+jdxsfCiHjwNP/4LCDD0i/graKpeBnOXKRA==",
+      "dev": true
+    },
+    "utils-merge": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
+      "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
+      "dev": true
+    },
+    "uuid": {
+      "version": "8.3.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg=="
+    },
+    "v8-compile-cache": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/v8-compile-cache/-/v8-compile-cache-2.3.0.tgz",
+      "integrity": "sha512-l8lCEmLcLYZh4nbunNZvQCJc5pv7+RCwa8q/LdUx8u7lsWvPDKmpodJAJNwkAhJC//dFY48KuIEmjtd4RViDrA==",
+      "dev": true
+    },
+    "v8-to-istanbul": {
+      "version": "8.1.1",
+      "resolved": "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-8.1.1.tgz",
+      "integrity": "sha512-FGtKtv3xIpR6BYhvgH8MI/y78oT7d8Au3ww4QIxymrCtZEh5b8gCw2siywE+puhEmuWKDtmfrvF5UlB298ut3w==",
+      "dev": true,
+      "requires": {
+        "@types/istanbul-lib-coverage": "^2.0.1",
+        "convert-source-map": "^1.6.0",
+        "source-map": "^0.7.3"
+      },
+      "dependencies": {
+        "source-map": {
+          "version": "0.7.4",
+          "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.4.tgz",
+          "integrity": "sha512-l3BikUxvPOcn5E74dZiq5BGsTb5yEwhaTSzccU6t4sDOH8NWJCstKO5QT2CvtFoK6F0saL7p9xHAqHOlCPJygA==",
+          "dev": true
+        }
+      }
+    },
+    "validate-npm-package-license": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz",
+      "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
+      "dev": true,
+      "requires": {
+        "spdx-correct": "^3.0.0",
+        "spdx-expression-parse": "^3.0.0"
+      }
+    },
+    "vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+      "dev": true
+    },
+    "vite-plugin-monaco-editor": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/vite-plugin-monaco-editor/-/vite-plugin-monaco-editor-1.1.0.tgz",
+      "integrity": "sha512-IvtUqZotrRoVqwT0PBBDIZPNraya3BxN/bfcNfnxZ5rkJiGcNtO5eAOWWSgT7zullIAEqQwxMU83yL9J5k7gww==",
+      "requires": {}
+    },
+    "vls": {
+      "version": "0.8.2",
+      "resolved": "https://registry.npmjs.org/vls/-/vls-0.8.2.tgz",
+      "integrity": "sha512-esrJmf7yRY5rlG7d5Jmucp7P2ZeWHOi7p1aADwxbPiN69SgNUq1Tp24YJ0vUXiEU8mgOW0tf0dL4f6LlSu6K/g==",
+      "dev": true,
+      "requires": {
+        "eslint": "^7.32.0",
+        "eslint-plugin-vue": "^7.19.1",
+        "prettier": "^2.4.1",
+        "pug-lexer": "^5.0.1",
+        "tslint": "6.1.3",
+        "typescript": "^4.4.4"
+      },
+      "dependencies": {
+        "@babel/code-frame": {
+          "version": "7.12.11",
+          "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.12.11.tgz",
+          "integrity": "sha512-Zt1yodBx1UcyiePMSkWnU4hPqhwq7hGi2nFL1LeA3EUl+q2LQx16MISgJ0+z7dnmgvP9QtIleuETGOiOH1RcIw==",
+          "dev": true,
+          "requires": {
+            "@babel/highlight": "^7.10.4"
+          }
+        },
+        "@eslint/eslintrc": {
+          "version": "0.4.3",
+          "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-0.4.3.tgz",
+          "integrity": "sha512-J6KFFz5QCYUJq3pf0mjEcCJVERbzv71PUIDczuh9JkwGEzced6CO5ADLHB1rbf/+oPBtoPfMYNOpGDzCANlbXw==",
+          "dev": true,
+          "requires": {
+            "ajv": "^6.12.4",
+            "debug": "^4.1.1",
+            "espree": "^7.3.0",
+            "globals": "^13.9.0",
+            "ignore": "^4.0.6",
+            "import-fresh": "^3.2.1",
+            "js-yaml": "^3.13.1",
+            "minimatch": "^3.0.4",
+            "strip-json-comments": "^3.1.1"
+          }
+        },
+        "@humanwhocodes/config-array": {
+          "version": "0.5.0",
+          "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.5.0.tgz",
+          "integrity": "sha512-FagtKFz74XrTl7y6HCzQpwDfXP0yhxe9lHLD1UZxjvZIcbyRz8zTFF/yYNfSfzU414eDwZ1SrO0Qvtyf+wFMQg==",
+          "dev": true,
+          "requires": {
+            "@humanwhocodes/object-schema": "^1.2.0",
+            "debug": "^4.1.1",
+            "minimatch": "^3.0.4"
+          }
+        },
+        "acorn": {
+          "version": "7.4.1",
+          "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
+          "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
+          "dev": true
+        },
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "argparse": {
+          "version": "1.0.10",
+          "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
+          "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+          "dev": true,
+          "requires": {
+            "sprintf-js": "~1.0.2"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "cross-spawn": {
+          "version": "7.0.3",
+          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+          "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+          "dev": true,
+          "requires": {
+            "path-key": "^3.1.0",
+            "shebang-command": "^2.0.0",
+            "which": "^2.0.1"
+          }
+        },
+        "escape-string-regexp": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+          "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+          "dev": true
+        },
+        "eslint": {
+          "version": "7.32.0",
+          "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.32.0.tgz",
+          "integrity": "sha512-VHZ8gX+EDfz+97jGcgyGCyRia/dPOd6Xh9yPv8Bl1+SoaIwD+a/vlrOmGRUyOYu7MwUhc7CxqeaDZU13S4+EpA==",
+          "dev": true,
+          "requires": {
+            "@babel/code-frame": "7.12.11",
+            "@eslint/eslintrc": "^0.4.3",
+            "@humanwhocodes/config-array": "^0.5.0",
+            "ajv": "^6.10.0",
+            "chalk": "^4.0.0",
+            "cross-spawn": "^7.0.2",
+            "debug": "^4.0.1",
+            "doctrine": "^3.0.0",
+            "enquirer": "^2.3.5",
+            "escape-string-regexp": "^4.0.0",
+            "eslint-scope": "^5.1.1",
+            "eslint-utils": "^2.1.0",
+            "eslint-visitor-keys": "^2.0.0",
+            "espree": "^7.3.1",
+            "esquery": "^1.4.0",
+            "esutils": "^2.0.2",
+            "fast-deep-equal": "^3.1.3",
+            "file-entry-cache": "^6.0.1",
+            "functional-red-black-tree": "^1.0.1",
+            "glob-parent": "^5.1.2",
+            "globals": "^13.6.0",
+            "ignore": "^4.0.6",
+            "import-fresh": "^3.0.0",
+            "imurmurhash": "^0.1.4",
+            "is-glob": "^4.0.0",
+            "js-yaml": "^3.13.1",
+            "json-stable-stringify-without-jsonify": "^1.0.1",
+            "levn": "^0.4.1",
+            "lodash.merge": "^4.6.2",
+            "minimatch": "^3.0.4",
+            "natural-compare": "^1.4.0",
+            "optionator": "^0.9.1",
+            "progress": "^2.0.0",
+            "regexpp": "^3.1.0",
+            "semver": "^7.2.1",
+            "strip-ansi": "^6.0.0",
+            "strip-json-comments": "^3.1.0",
+            "table": "^6.0.9",
+            "text-table": "^0.2.0",
+            "v8-compile-cache": "^2.0.3"
+          },
+          "dependencies": {
+            "semver": {
+              "version": "7.5.4",
+              "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+              "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+              "dev": true,
+              "requires": {
+                "lru-cache": "^6.0.0"
+              }
+            }
+          }
+        },
+        "eslint-plugin-vue": {
+          "version": "7.20.0",
+          "resolved": "https://registry.npmjs.org/eslint-plugin-vue/-/eslint-plugin-vue-7.20.0.tgz",
+          "integrity": "sha512-oVNDqzBC9h3GO+NTgWeLMhhGigy6/bQaQbHS+0z7C4YEu/qK/yxHvca/2PTZtGNPsCrHwOTgKMrwu02A9iPBmw==",
+          "dev": true,
+          "requires": {
+            "eslint-utils": "^2.1.0",
+            "natural-compare": "^1.4.0",
+            "semver": "^6.3.0",
+            "vue-eslint-parser": "^7.10.0"
+          }
+        },
+        "eslint-utils": {
+          "version": "2.1.0",
+          "resolved": "https://registry.npmjs.org/eslint-utils/-/eslint-utils-2.1.0.tgz",
+          "integrity": "sha512-w94dQYoauyvlDc43XnGB8lU3Zt713vNChgt4EWwhXAP2XkBvndfxF0AgIqKOOasjPIPzj9JqgwkwbCYD0/V3Zg==",
+          "dev": true,
+          "requires": {
+            "eslint-visitor-keys": "^1.1.0"
+          },
+          "dependencies": {
+            "eslint-visitor-keys": {
+              "version": "1.3.0",
+              "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-1.3.0.tgz",
+              "integrity": "sha512-6J72N8UNa462wa/KFODt/PJ3IU60SDpC3QXC1Hjc1BXXpfL2C9R5+AU7jhe0F6GREqVMh4Juu+NY7xn+6dipUQ==",
+              "dev": true
+            }
+          }
+        },
+        "eslint-visitor-keys": {
+          "version": "2.1.0",
+          "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz",
+          "integrity": "sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==",
+          "dev": true
+        },
+        "espree": {
+          "version": "7.3.1",
+          "resolved": "https://registry.npmjs.org/espree/-/espree-7.3.1.tgz",
+          "integrity": "sha512-v3JCNCE64umkFpmkFGqzVKsOT0tN1Zr+ueqLZfpV1Ob8e+CEgPWa+OxCoGH3tnhimMKIaBm4m/vaRpJ/krRz2g==",
+          "dev": true,
+          "requires": {
+            "acorn": "^7.4.0",
+            "acorn-jsx": "^5.3.1",
+            "eslint-visitor-keys": "^1.3.0"
+          },
+          "dependencies": {
+            "eslint-visitor-keys": {
+              "version": "1.3.0",
+              "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-1.3.0.tgz",
+              "integrity": "sha512-6J72N8UNa462wa/KFODt/PJ3IU60SDpC3QXC1Hjc1BXXpfL2C9R5+AU7jhe0F6GREqVMh4Juu+NY7xn+6dipUQ==",
+              "dev": true
+            }
+          }
+        },
+        "glob-parent": {
+          "version": "5.1.2",
+          "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+          "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+          "dev": true,
+          "requires": {
+            "is-glob": "^4.0.1"
+          }
+        },
+        "globals": {
+          "version": "13.20.0",
+          "resolved": "https://registry.npmjs.org/globals/-/globals-13.20.0.tgz",
+          "integrity": "sha512-Qg5QtVkCy/kv3FUSlu4ukeZDVf9ee0iXLAUYX13gbR17bnejFTzr4iS9bY7kwCf1NztRNm1t91fjOiyx4CSwPQ==",
+          "dev": true,
+          "requires": {
+            "type-fest": "^0.20.2"
+          }
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "ignore": {
+          "version": "4.0.6",
+          "resolved": "https://registry.npmjs.org/ignore/-/ignore-4.0.6.tgz",
+          "integrity": "sha512-cyFDKrqc/YdcWFniJhzI42+AzS+gNwmUzOSFcRCQYwySuBBBy/KjuxWLZ/FHEH6Moq1NizMOBWyTcv8O4OZIMg==",
+          "dev": true
+        },
+        "js-yaml": {
+          "version": "3.14.1",
+          "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
+          "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
+          "dev": true,
+          "requires": {
+            "argparse": "^1.0.7",
+            "esprima": "^4.0.0"
+          }
+        },
+        "path-key": {
+          "version": "3.1.1",
+          "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+          "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+          "dev": true
+        },
+        "shebang-command": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+          "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+          "dev": true,
+          "requires": {
+            "shebang-regex": "^3.0.0"
+          }
+        },
+        "shebang-regex": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+          "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        },
+        "type-fest": {
+          "version": "0.20.2",
+          "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
+          "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
+          "dev": true
+        },
+        "vue-eslint-parser": {
+          "version": "7.11.0",
+          "resolved": "https://registry.npmjs.org/vue-eslint-parser/-/vue-eslint-parser-7.11.0.tgz",
+          "integrity": "sha512-qh3VhDLeh773wjgNTl7ss0VejY9bMMa0GoDG2fQVyDzRFdiU3L7fw74tWZDHNQXdZqxO3EveQroa9ct39D2nqg==",
+          "dev": true,
+          "requires": {
+            "debug": "^4.1.1",
+            "eslint-scope": "^5.1.1",
+            "eslint-visitor-keys": "^1.1.0",
+            "espree": "^6.2.1",
+            "esquery": "^1.4.0",
+            "lodash": "^4.17.21",
+            "semver": "^6.3.0"
+          },
+          "dependencies": {
+            "eslint-visitor-keys": {
+              "version": "1.3.0",
+              "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-1.3.0.tgz",
+              "integrity": "sha512-6J72N8UNa462wa/KFODt/PJ3IU60SDpC3QXC1Hjc1BXXpfL2C9R5+AU7jhe0F6GREqVMh4Juu+NY7xn+6dipUQ==",
+              "dev": true
+            },
+            "espree": {
+              "version": "6.2.1",
+              "resolved": "https://registry.npmjs.org/espree/-/espree-6.2.1.tgz",
+              "integrity": "sha512-ysCxRQY3WaXJz9tdbWOwuWr5Y/XrPTGX9Kiz3yoUXwW0VZ4w30HTkQLaGx/+ttFjF8i+ACbArnB4ce68a9m5hw==",
+              "dev": true,
+              "requires": {
+                "acorn": "^7.1.1",
+                "acorn-jsx": "^5.2.0",
+                "eslint-visitor-keys": "^1.1.0"
+              }
+            }
+          }
+        },
+        "which": {
+          "version": "2.0.2",
+          "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+          "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+          "dev": true,
+          "requires": {
+            "isexe": "^2.0.0"
+          }
+        }
+      }
+    },
+    "vscode-html-languageservice": {
+      "version": "5.0.4",
+      "resolved": "https://registry.npmjs.org/vscode-html-languageservice/-/vscode-html-languageservice-5.0.4.tgz",
+      "integrity": "sha512-tvrySfpglu4B2rQgWGVO/IL+skvU7kBkQotRlxA7ocSyRXOZUd6GA13XHkxo8LPe07KWjeoBlN1aVGqdfTK4xA==",
+      "dev": true,
+      "requires": {
+        "@vscode/l10n": "^0.0.11",
+        "vscode-languageserver-textdocument": "^1.0.8",
+        "vscode-languageserver-types": "^3.17.2",
+        "vscode-uri": "^3.0.7"
+      }
+    },
+    "vscode-jsonrpc": {
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/vscode-jsonrpc/-/vscode-jsonrpc-8.0.2.tgz",
+      "integrity": "sha512-RY7HwI/ydoC1Wwg4gJ3y6LpU9FJRZAUnTYMXthqhFXXu77ErDd/xkREpGuk4MyYkk4a+XDWAMqe0S3KkelYQEQ==",
+      "dev": true
+    },
+    "vscode-languageserver-protocol": {
+      "version": "3.17.2",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-protocol/-/vscode-languageserver-protocol-3.17.2.tgz",
+      "integrity": "sha512-8kYisQ3z/SQ2kyjlNeQxbkkTNmVFoQCqkmGrzLH6A9ecPlgTbp3wDTnUNqaUxYr4vlAcloxx8zwy7G5WdguYNg==",
+      "dev": true,
+      "requires": {
+        "vscode-jsonrpc": "8.0.2",
+        "vscode-languageserver-types": "3.17.2"
+      }
+    },
+    "vscode-languageserver-textdocument": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-textdocument/-/vscode-languageserver-textdocument-1.0.8.tgz",
+      "integrity": "sha512-1bonkGqQs5/fxGT5UchTgjGVnfysL0O8v1AYMBjqTbWQTFn721zaPGDYFkOKtfDgFiSgXM3KwaG3FMGfW4Ed9Q=="
+    },
+    "vscode-languageserver-types": {
+      "version": "3.17.2",
+      "resolved": "https://registry.npmjs.org/vscode-languageserver-types/-/vscode-languageserver-types-3.17.2.tgz",
+      "integrity": "sha512-zHhCWatviizPIq9B7Vh9uvrH6x3sK8itC84HkamnBWoDFJtzBf7SWlpLCZUit72b3os45h6RWQNC9xHRDF8dRA=="
+    },
+    "vscode-uri": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/vscode-uri/-/vscode-uri-3.0.7.tgz",
+      "integrity": "sha512-eOpPHogvorZRobNqJGhapa0JdwaxpjVvyBp0QIUMRMSf8ZAlqOdEquKuRmw9Qwu0qXtJIWqFtMkmvJjUZmMjVA=="
+    },
+    "vue": {
+      "version": "3.2.37",
+      "resolved": "https://registry.npmjs.org/vue/-/vue-3.2.37.tgz",
+      "integrity": "sha512-bOKEZxrm8Eh+fveCqS1/NkG/n6aMidsI6hahas7pa0w/l7jkbssJVsRhVDs07IdDq7h9KHswZOgItnwJAgtVtQ==",
+      "requires": {
+        "@vue/compiler-dom": "3.2.37",
+        "@vue/compiler-sfc": "3.2.37",
+        "@vue/runtime-dom": "3.2.37",
+        "@vue/server-renderer": "3.2.37",
+        "@vue/shared": "3.2.37"
+      }
+    },
+    "vue-cli-plugin-tailwind": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/vue-cli-plugin-tailwind/-/vue-cli-plugin-tailwind-3.0.0.tgz",
+      "integrity": "sha512-bUWjfwGtJCeBU7pL4lD86RC+HsJAmAlYqr8e65NGC3q/ZBzC9KQs1Iy/vTyfDTnB7ZJm3huB+1a/m+17fdMZ8A==",
+      "dev": true
+    },
+    "vue-eslint-parser": {
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/vue-eslint-parser/-/vue-eslint-parser-9.0.3.tgz",
+      "integrity": "sha512-yL+ZDb+9T0ELG4VIFo/2anAOz8SvBdlqEnQnvJ3M7Scq56DvtjY0VY88bByRZB0D4J0u8olBcfrXTVONXsh4og==",
+      "dev": true,
+      "requires": {
+        "debug": "^4.3.4",
+        "eslint-scope": "^7.1.1",
+        "eslint-visitor-keys": "^3.3.0",
+        "espree": "^9.3.1",
+        "esquery": "^1.4.0",
+        "lodash": "^4.17.21",
+        "semver": "^7.3.6"
+      },
+      "dependencies": {
+        "eslint-scope": {
+          "version": "7.1.1",
+          "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.1.1.tgz",
+          "integrity": "sha512-QKQM/UXpIiHcLqJ5AOyIW7XZmzjkzQXYE54n1++wb0u9V/abW3l9uQnxX8Z5Xd18xyKIMTUAyQ0k1e8pz6LUrw==",
+          "dev": true,
+          "requires": {
+            "esrecurse": "^4.3.0",
+            "estraverse": "^5.2.0"
+          }
+        },
+        "estraverse": {
+          "version": "5.3.0",
+          "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+          "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+          "dev": true
+        },
+        "semver": {
+          "version": "7.5.4",
+          "resolved": "https://registry.npmjs.org/semver/-/semver-7.5.4.tgz",
+          "integrity": "sha512-1bCSESV6Pv+i21Hvpxp3Dx+pSD8lIPt8uVjRrxAUt/nbswYc+tK6Y2btiULjd4+fnq15PX+nqQDC7Oft7WkwcA==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^6.0.0"
+          }
+        }
+      }
+    },
+    "vue-hot-reload-api": {
+      "version": "2.3.4",
+      "resolved": "https://registry.npmjs.org/vue-hot-reload-api/-/vue-hot-reload-api-2.3.4.tgz",
+      "integrity": "sha512-BXq3jwIagosjgNVae6tkHzzIk6a8MHFtzAdwhnV5VlvPTFxDCvIttgSiHWjdGoTJvXtmRu5HacExfdarRcFhog==",
+      "dev": true
+    },
+    "vue-loader": {
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/vue-loader/-/vue-loader-17.0.0.tgz",
+      "integrity": "sha512-OWSXjrzIvbF2LtOUmxT3HYgwwubbfFelN8PAP9R9dwpIkj48TVioHhWWSx7W7fk+iF5cgg3CBJRxwTdtLU4Ecg==",
+      "dev": true,
+      "requires": {
+        "chalk": "^4.1.0",
+        "hash-sum": "^2.0.0",
+        "loader-utils": "^2.0.0"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "loader-utils": {
+          "version": "2.0.4",
+          "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.4.tgz",
+          "integrity": "sha512-xXqpXoINfFhgua9xiqD8fPFHgkoq1mmmpE92WlDbm9rNRd/EbRb+Gqf908T2DMfuHjjJlksiK2RbHVOdD/MqSw==",
+          "dev": true,
+          "requires": {
+            "big.js": "^5.2.2",
+            "emojis-list": "^3.0.0",
+            "json5": "^2.1.2"
+          }
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "vue-observe-visibility": {
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/vue-observe-visibility/-/vue-observe-visibility-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-flFbp/gs9pZniXR6fans8smv1kDScJ8RS7rEpMjhVabiKeq7Qz3D9+eGsypncjfIyyU84saU88XZ0zjbD6Gq/g==",
+      "requires": {}
+    },
+    "vue-resize": {
+      "version": "2.0.0-alpha.1",
+      "resolved": "https://registry.npmjs.org/vue-resize/-/vue-resize-2.0.0-alpha.1.tgz",
+      "integrity": "sha512-7+iqOueLU7uc9NrMfrzbG8hwMqchfVfSzpVlCMeJQe4pyibqyoifDNbKTZvwxZKDvGkB+PdFeKvnGZMoEb8esg==",
+      "requires": {}
+    },
+    "vue-router": {
+      "version": "4.0.16",
+      "resolved": "https://registry.npmjs.org/vue-router/-/vue-router-4.0.16.tgz",
+      "integrity": "sha512-JcO7cb8QJLBWE+DfxGUL3xUDOae/8nhM1KVdnudadTAORbuxIC/xAydC5Zr/VLHUDQi1ppuTF5/rjBGzgzrJNA==",
+      "requires": {
+        "@vue/devtools-api": "^6.0.0"
+      }
+    },
+    "vue-style-loader": {
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/vue-style-loader/-/vue-style-loader-4.1.3.tgz",
+      "integrity": "sha512-sFuh0xfbtpRlKfm39ss/ikqs9AbKCoXZBpHeVZ8Tx650o0k0q/YCM7FRvigtxpACezfq6af+a7JeqVTWvncqDg==",
+      "dev": true,
+      "requires": {
+        "hash-sum": "^1.0.2",
+        "loader-utils": "^1.0.2"
+      },
+      "dependencies": {
+        "hash-sum": {
+          "version": "1.0.2",
+          "resolved": "https://registry.npmjs.org/hash-sum/-/hash-sum-1.0.2.tgz",
+          "integrity": "sha512-fUs4B4L+mlt8/XAtSOGMUO1TXmAelItBPtJG7CyHJfYTdDjwisntGO2JQz7oUsatOY9o68+57eziUVNw/mRHmA==",
+          "dev": true
+        }
+      }
+    },
+    "vue-template-es2015-compiler": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/vue-template-es2015-compiler/-/vue-template-es2015-compiler-1.9.1.tgz",
+      "integrity": "sha512-4gDntzrifFnCEvyoO8PqyJDmguXgVPxKiIxrBKjIowvL9l+N66196+72XVYR8BBf1Uv1Fgt3bGevJ+sEmxfZzw==",
+      "dev": true
+    },
+    "vue-virtual-scroller": {
+      "version": "2.0.0-beta.8",
+      "resolved": "https://registry.npmjs.org/vue-virtual-scroller/-/vue-virtual-scroller-2.0.0-beta.8.tgz",
+      "integrity": "sha512-b8/f5NQ5nIEBRTNi6GcPItE4s7kxNHw2AIHLtDp+2QvqdTjVN0FgONwX9cr53jWRgnu+HRLPaWDOR2JPI5MTfQ==",
+      "requires": {
+        "mitt": "^2.1.0",
+        "vue-observe-visibility": "^2.0.0-alpha.1",
+        "vue-resize": "^2.0.0-alpha.1"
+      }
+    },
+    "vue-word-highlighter": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/vue-word-highlighter/-/vue-word-highlighter-1.0.4.tgz",
+      "integrity": "sha512-jtwnkEBnwMzmKTvpStbffbEpWkW4Fpb2ErdqDqAGOZlrjCgTJczBCpIQiGyBF2jNvYxvCvN5HqIldoNaMS0XYQ==",
+      "requires": {
+        "vue-demi": "^0.11.2"
+      },
+      "dependencies": {
+        "vue-demi": {
+          "version": "0.11.4",
+          "resolved": "https://registry.npmjs.org/vue-demi/-/vue-demi-0.11.4.tgz",
+          "integrity": "sha512-/3xFwzSykLW2HiiLie43a+FFgNOcokbBJ+fzvFXd0r2T8MYohqvphUyDQ8lbAwzQ3Dlcrb1c9ykifGkhSIAk6A==",
+          "requires": {}
+        }
+      }
+    },
+    "vue3-apexcharts": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/vue3-apexcharts/-/vue3-apexcharts-1.4.1.tgz",
+      "integrity": "sha512-96qP8JDqB9vwU7bkG5nVU+E0UGQn7yYQVqUUCLQMYWDuQyu2vE77H/UFZ1yI+hwzlSTBKT9BqnNG8JsFegB3eg==",
+      "requires": {}
+    },
+    "vue3-clipboard": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/vue3-clipboard/-/vue3-clipboard-1.0.0.tgz",
+      "integrity": "sha512-GUqKh1oO79xDpq0z+cCv/NDVTpcJGNDzeNgT3PmTdTp/WJh3gcTrDqIYKycKhzMFOtIFJ7hO/+usgyWtT+fNhA==",
+      "requires": {
+        "clipboard": "^2.0.6"
+      }
+    },
+    "vue3-popper": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/vue3-popper/-/vue3-popper-1.5.0.tgz",
+      "integrity": "sha512-xaEnx90YBnlSg5G2yWqm2DHWHg+DB99UVRp4VsyTF0QLXyHrqSuE1Xo5+sG0AQq/lBcrGMlk5NU5xE2MDLKViw==",
+      "requires": {
+        "@popperjs/core": "^2.9.2",
+        "debounce": "^1.2.1"
+      }
+    },
+    "w3c-hr-time": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/w3c-hr-time/-/w3c-hr-time-1.0.2.tgz",
+      "integrity": "sha512-z8P5DvDNjKDoFIHK7q8r8lackT6l+jo/Ye3HOle7l9nICP9lf1Ci25fy9vHd0JOWewkIFzXIEig3TdKT7JQ5fQ==",
+      "dev": true,
+      "requires": {
+        "browser-process-hrtime": "^1.0.0"
+      }
+    },
+    "w3c-xmlserializer": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-2.0.0.tgz",
+      "integrity": "sha512-4tzD0mF8iSiMiNs30BiLO3EpfGLZUT2MSX/G+o7ZywDzliWQ3OPtTZ0PTC3B3ca1UAf4cJMHB+2Bf56EriJuRA==",
+      "dev": true,
+      "requires": {
+        "xml-name-validator": "^3.0.0"
+      },
+      "dependencies": {
+        "xml-name-validator": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-3.0.0.tgz",
+          "integrity": "sha512-A5CUptxDsvxKJEU3yO6DuWBSJz/qizqzJKOMIfUJHETbBw/sFaDxgd6fxm1ewUaM0jZ444Fc5vC5ROYurg/4Pw==",
+          "dev": true
+        }
+      }
+    },
+    "walker": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/walker/-/walker-1.0.8.tgz",
+      "integrity": "sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==",
+      "dev": true,
+      "requires": {
+        "makeerror": "1.0.12"
+      }
+    },
+    "watchpack": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.4.0.tgz",
+      "integrity": "sha512-Lcvm7MGST/4fup+ifyKi2hjyIAwcdI4HRgtvTpIUxBRhB+RFtUh8XtDOxUfctVCnhVi+QQj49i91OyvzkJl6cg==",
+      "dev": true,
+      "requires": {
+        "glob-to-regexp": "^0.4.1",
+        "graceful-fs": "^4.1.2"
+      }
+    },
+    "wbuf": {
+      "version": "1.7.3",
+      "resolved": "https://registry.npmjs.org/wbuf/-/wbuf-1.7.3.tgz",
+      "integrity": "sha512-O84QOnr0icsbFGLS0O3bI5FswxzRr8/gHwWkDlQFskhSPryQXvrTMxjxGP4+iWYoauLoBvfDpkrOauZ+0iZpDA==",
+      "dev": true,
+      "requires": {
+        "minimalistic-assert": "^1.0.0"
+      }
+    },
+    "wcwidth": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/wcwidth/-/wcwidth-1.0.1.tgz",
+      "integrity": "sha512-XHPEwS0q6TaxcvG85+8EYkbiCux2XtWG2mkc47Ng2A77BQu9+DqIOJldST4HgPkuea7dvKSj5VgX3P1d4rW8Tg==",
+      "dev": true,
+      "requires": {
+        "defaults": "^1.0.3"
+      }
+    },
+    "webidl-conversions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
+      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
+      "dev": true
+    },
+    "webpack": {
+      "version": "5.82.1",
+      "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.82.1.tgz",
+      "integrity": "sha512-C6uiGQJ+Gt4RyHXXYt+v9f+SN1v83x68URwgxNQ98cvH8kxiuywWGP4XeNZ1paOzZ63aY3cTciCEQJNFUljlLw==",
+      "dev": true,
+      "requires": {
+        "@types/eslint-scope": "^3.7.3",
+        "@types/estree": "^1.0.0",
+        "@webassemblyjs/ast": "^1.11.5",
+        "@webassemblyjs/wasm-edit": "^1.11.5",
+        "@webassemblyjs/wasm-parser": "^1.11.5",
+        "acorn": "^8.7.1",
+        "acorn-import-assertions": "^1.7.6",
+        "browserslist": "^4.14.5",
+        "chrome-trace-event": "^1.0.2",
+        "enhanced-resolve": "^5.14.0",
+        "es-module-lexer": "^1.2.1",
+        "eslint-scope": "5.1.1",
+        "events": "^3.2.0",
+        "glob-to-regexp": "^0.4.1",
+        "graceful-fs": "^4.2.9",
+        "json-parse-even-better-errors": "^2.3.1",
+        "loader-runner": "^4.2.0",
+        "mime-types": "^2.1.27",
+        "neo-async": "^2.6.2",
+        "schema-utils": "^3.1.2",
+        "tapable": "^2.1.1",
+        "terser-webpack-plugin": "^5.3.7",
+        "watchpack": "^2.4.0",
+        "webpack-sources": "^3.2.3"
+      }
+    },
+    "webpack-bundle-analyzer": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/webpack-bundle-analyzer/-/webpack-bundle-analyzer-4.5.0.tgz",
+      "integrity": "sha512-GUMZlM3SKwS8Z+CKeIFx7CVoHn3dXFcUAjT/dcZQQmfSZGvitPfMob2ipjai7ovFFqPvTqkEZ/leL4O0YOdAYQ==",
+      "dev": true,
+      "requires": {
+        "acorn": "^8.0.4",
+        "acorn-walk": "^8.0.0",
+        "chalk": "^4.1.0",
+        "commander": "^7.2.0",
+        "gzip-size": "^6.0.0",
+        "lodash": "^4.17.20",
+        "opener": "^1.5.2",
+        "sirv": "^1.0.7",
+        "ws": "^7.3.1"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "chalk": {
+          "version": "4.1.2",
+          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+          "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.1.0",
+            "supports-color": "^7.1.0"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        },
+        "commander": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/commander/-/commander-7.2.0.tgz",
+          "integrity": "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==",
+          "dev": true
+        },
+        "has-flag": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+          "dev": true
+        },
+        "supports-color": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+          "dev": true,
+          "requires": {
+            "has-flag": "^4.0.0"
+          }
+        }
+      }
+    },
+    "webpack-chain": {
+      "version": "6.5.1",
+      "resolved": "https://registry.npmjs.org/webpack-chain/-/webpack-chain-6.5.1.tgz",
+      "integrity": "sha512-7doO/SRtLu8q5WM0s7vPKPWX580qhi0/yBHkOxNkv50f6qB76Zy9o2wRTrrPULqYTvQlVHuvbA8v+G5ayuUDsA==",
+      "dev": true,
+      "requires": {
+        "deepmerge": "^1.5.2",
+        "javascript-stringify": "^2.0.1"
+      }
+    },
+    "webpack-dev-middleware": {
+      "version": "5.3.3",
+      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.3.tgz",
+      "integrity": "sha512-hj5CYrY0bZLB+eTO+x/j67Pkrquiy7kWepMHmUMoPsmcUaeEnQJqFzHJOyxgWlq746/wUuA64p9ta34Kyb01pA==",
+      "dev": true,
+      "requires": {
+        "colorette": "^2.0.10",
+        "memfs": "^3.4.3",
+        "mime-types": "^2.1.31",
+        "range-parser": "^1.2.1",
+        "schema-utils": "^4.0.0"
+      },
+      "dependencies": {
+        "ajv": {
+          "version": "8.11.0",
+          "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.11.0.tgz",
+          "integrity": "sha512-wGgprdCvMalC0BztXvitD2hC04YffAvtsUn93JbGXYLAtCUO4xd17mCCZQxUOItiBwZvJScWo8NIvQMQ71rdpg==",
+          "dev": true,
+          "requires": {
+            "fast-deep-equal": "^3.1.1",
+            "json-schema-traverse": "^1.0.0",
+            "require-from-string": "^2.0.2",
+            "uri-js": "^4.2.2"
+          }
+        },
+        "ajv-keywords": {
+          "version": "5.1.0",
+          "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-5.1.0.tgz",
+          "integrity": "sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw==",
+          "dev": true,
+          "requires": {
+            "fast-deep-equal": "^3.1.3"
+          }
+        },
+        "json-schema-traverse": {
+          "version": "1.0.0",
+          "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+          "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+          "dev": true
+        },
+        "schema-utils": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.0.0.tgz",
+          "integrity": "sha512-1edyXKgh6XnJsJSQ8mKWXnN/BVaIbFMLpouRUrXgVq7WYne5kw3MW7UPhO44uRXQSIpTSXoJbmrR2X0w9kUTyg==",
+          "dev": true,
+          "requires": {
+            "@types/json-schema": "^7.0.9",
+            "ajv": "^8.8.0",
+            "ajv-formats": "^2.1.1",
+            "ajv-keywords": "^5.0.0"
+          }
+        }
+      }
+    },
+    "webpack-dev-server": {
+      "version": "4.9.3",
+      "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-4.9.3.tgz",
+      "integrity": "sha512-3qp/eoboZG5/6QgiZ3llN8TUzkSpYg1Ko9khWX1h40MIEUNS2mDoIa8aXsPfskER+GbTvs/IJZ1QTBBhhuetSw==",
+      "dev": true,
+      "requires": {
+        "@types/bonjour": "^3.5.9",
+        "@types/connect-history-api-fallback": "^1.3.5",
+        "@types/express": "^4.17.13",
+        "@types/serve-index": "^1.9.1",
+        "@types/serve-static": "^1.13.10",
+        "@types/sockjs": "^0.3.33",
+        "@types/ws": "^8.5.1",
+        "ansi-html-community": "^0.0.8",
+        "bonjour-service": "^1.0.11",
+        "chokidar": "^3.5.3",
+        "colorette": "^2.0.10",
+        "compression": "^1.7.4",
+        "connect-history-api-fallback": "^2.0.0",
+        "default-gateway": "^6.0.3",
+        "express": "^4.17.3",
+        "graceful-fs": "^4.2.6",
+        "html-entities": "^2.3.2",
+        "http-proxy-middleware": "^2.0.3",
+        "ipaddr.js": "^2.0.1",
+        "open": "^8.0.9",
+        "p-retry": "^4.5.0",
+        "rimraf": "^3.0.2",
+        "schema-utils": "^4.0.0",
+        "selfsigned": "^2.0.1",
+        "serve-index": "^1.9.1",
+        "sockjs": "^0.3.24",
+        "spdy": "^4.0.2",
+        "webpack-dev-middleware": "^5.3.1",
+        "ws": "^8.4.2"
+      },
+      "dependencies": {
+        "ajv": {
+          "version": "8.11.0",
+          "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.11.0.tgz",
+          "integrity": "sha512-wGgprdCvMalC0BztXvitD2hC04YffAvtsUn93JbGXYLAtCUO4xd17mCCZQxUOItiBwZvJScWo8NIvQMQ71rdpg==",
+          "dev": true,
+          "requires": {
+            "fast-deep-equal": "^3.1.1",
+            "json-schema-traverse": "^1.0.0",
+            "require-from-string": "^2.0.2",
+            "uri-js": "^4.2.2"
+          }
+        },
+        "ajv-keywords": {
+          "version": "5.1.0",
+          "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-5.1.0.tgz",
+          "integrity": "sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw==",
+          "dev": true,
+          "requires": {
+            "fast-deep-equal": "^3.1.3"
+          }
+        },
+        "json-schema-traverse": {
+          "version": "1.0.0",
+          "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+          "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+          "dev": true
+        },
+        "schema-utils": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.0.0.tgz",
+          "integrity": "sha512-1edyXKgh6XnJsJSQ8mKWXnN/BVaIbFMLpouRUrXgVq7WYne5kw3MW7UPhO44uRXQSIpTSXoJbmrR2X0w9kUTyg==",
+          "dev": true,
+          "requires": {
+            "@types/json-schema": "^7.0.9",
+            "ajv": "^8.8.0",
+            "ajv-formats": "^2.1.1",
+            "ajv-keywords": "^5.0.0"
+          }
+        },
+        "ws": {
+          "version": "8.8.0",
+          "resolved": "https://registry.npmjs.org/ws/-/ws-8.8.0.tgz",
+          "integrity": "sha512-JDAgSYQ1ksuwqfChJusw1LSJ8BizJ2e/vVu5Lxjq3YvNJNlROv1ui4i+c/kUUrPheBvQl4c5UbERhTwKa6QBJQ==",
+          "dev": true,
+          "requires": {}
+        }
+      }
+    },
+    "webpack-merge": {
+      "version": "5.8.0",
+      "resolved": "https://registry.npmjs.org/webpack-merge/-/webpack-merge-5.8.0.tgz",
+      "integrity": "sha512-/SaI7xY0831XwP6kzuwhKWVKDP9t1QY1h65lAFLbZqMPIuYcD9QAW4u9STIbU9kaJbPBB/geU/gLr1wDjOhQ+Q==",
+      "dev": true,
+      "requires": {
+        "clone-deep": "^4.0.1",
+        "wildcard": "^2.0.0"
+      }
+    },
+    "webpack-sources": {
+      "version": "3.2.3",
+      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.2.3.tgz",
+      "integrity": "sha512-/DyMEOrDgLKKIG0fmvtz+4dUX/3Ghozwgm6iPp8KRhvn+eQf9+Q7GWxVNMk3+uCPWfdXYC4ExGBckIXdFEfH1w==",
+      "dev": true
+    },
+    "webpack-virtual-modules": {
+      "version": "0.4.4",
+      "resolved": "https://registry.npmjs.org/webpack-virtual-modules/-/webpack-virtual-modules-0.4.4.tgz",
+      "integrity": "sha512-h9atBP/bsZohWpHnr+2sic8Iecb60GxftXsWNLLLSqewgIsGzByd2gcIID4nXcG+3tNe4GQG3dLcff3kXupdRA==",
+      "dev": true
+    },
+    "websocket-driver": {
+      "version": "0.7.4",
+      "resolved": "https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.4.tgz",
+      "integrity": "sha512-b17KeDIQVjvb0ssuSDF2cYXSg2iztliJ4B9WdsuB6J952qCPKmnVq4DyW5motImXHDC1cBT/1UezrJVsKw5zjg==",
+      "dev": true,
+      "requires": {
+        "http-parser-js": ">=0.5.1",
+        "safe-buffer": ">=5.1.0",
+        "websocket-extensions": ">=0.1.1"
+      }
+    },
+    "websocket-extensions": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/websocket-extensions/-/websocket-extensions-0.1.4.tgz",
+      "integrity": "sha512-OqedPIGOfsDlo31UNwYbCFMSaO9m9G/0faIHj5/dZFDMFqPTcx6UwqyOy3COEaEOg/9VsGIpdqn62W5KhoKSpg==",
+      "dev": true
+    },
+    "whatwg-encoding": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-1.0.5.tgz",
+      "integrity": "sha512-b5lim54JOPN9HtzvK9HFXvBma/rnfFeqsic0hSpjtDbVxR3dJKLc+KB4V6GgiGOvl7CY/KNh8rxSo9DKQrnUEw==",
+      "dev": true,
+      "requires": {
+        "iconv-lite": "0.4.24"
+      }
+    },
+    "whatwg-fetch": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/whatwg-fetch/-/whatwg-fetch-3.6.2.tgz",
+      "integrity": "sha512-bJlen0FcuU/0EMLrdbJ7zOnW6ITZLrZMIarMUVmdKtsGvZna8vxKYaexICWPfZ8qwf9fzNq+UEIZrnSaApt6RA=="
+    },
+    "whatwg-mimetype": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-2.3.0.tgz",
+      "integrity": "sha512-M4yMwr6mAnQz76TbJm914+gPpB/nCwvZbJU28cUD6dR004SAxDLOOSUaB1JDRqLtaOV/vi0IC5lEAGFgrjGv/g==",
+      "dev": true
+    },
+    "whatwg-url": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
+      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
+      "dev": true,
+      "requires": {
+        "tr46": "~0.0.3",
+        "webidl-conversions": "^3.0.0"
+      }
+    },
+    "which": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/which/-/which-1.3.1.tgz",
+      "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==",
+      "dev": true,
+      "requires": {
+        "isexe": "^2.0.0"
+      }
+    },
+    "wildcard": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/wildcard/-/wildcard-2.0.0.tgz",
+      "integrity": "sha512-JcKqAHLPxcdb9KM49dufGXn2x3ssnfjbcaQdLlfZsL9rH9wgDQjUtDxbo8NE0F6SFvydeu1VhZe7hZuHsB2/pw==",
+      "dev": true
+    },
+    "word-wrap": {
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
+      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
+      "dev": true
+    },
+    "wrap-ansi": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "dev": true,
+      "requires": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "dependencies": {
+        "ansi-styles": {
+          "version": "4.3.0",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+          "dev": true,
+          "requires": {
+            "color-convert": "^2.0.1"
+          }
+        },
+        "color-convert": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+          "dev": true,
+          "requires": {
+            "color-name": "~1.1.4"
+          }
+        },
+        "color-name": {
+          "version": "1.1.4",
+          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+          "dev": true
+        }
+      }
+    },
+    "wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "dev": true
+    },
+    "write-file-atomic": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-3.0.3.tgz",
+      "integrity": "sha512-AvHcyZ5JnSfq3ioSyjrBkH9yW4m7Ayk8/9My/DD9onKeu/94fwrMocemO2QAJFAlnnDN+ZDS+ZjAR5ua1/PV/Q==",
+      "dev": true,
+      "requires": {
+        "imurmurhash": "^0.1.4",
+        "is-typedarray": "^1.0.0",
+        "signal-exit": "^3.0.2",
+        "typedarray-to-buffer": "^3.1.5"
+      }
+    },
+    "ws": {
+      "version": "7.5.8",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.8.tgz",
+      "integrity": "sha512-ri1Id1WinAX5Jqn9HejiGb8crfRio0Qgu8+MtL36rlTA6RLsMdWt1Az/19A2Qij6uSHUMphEFaTKa4WG+UNHNw==",
+      "dev": true,
+      "requires": {}
+    },
+    "xml-name-validator": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-4.0.0.tgz",
+      "integrity": "sha512-ICP2e+jsHvAj2E2lIHxa5tjXRlKDJo4IdvPvCXbXQGdzSfmSpNVyIKMvoZHjDY9DP0zV17iI85o90vRFXNccRw==",
+      "dev": true
+    },
+    "xmlchars": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
+      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
+      "dev": true
+    },
+    "xtend": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
+      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
+      "dev": true
+    },
+    "y18n": {
+      "version": "5.0.8",
+      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
+      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
+      "dev": true
+    },
+    "yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+      "dev": true
+    },
+    "yaml": {
+      "version": "1.10.2",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz",
+      "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==",
+      "dev": true
+    },
+    "yargs": {
+      "version": "16.2.0",
+      "resolved": "https://registry.npmjs.org/yargs/-/yargs-16.2.0.tgz",
+      "integrity": "sha512-D1mvvtDG0L5ft/jGWkLpG1+m0eQxOfaBvTNELraWj22wSVUMWxZUvYgJYcKh6jGGIkJFhH4IZPQhR4TKpc8mBw==",
+      "dev": true,
+      "requires": {
+        "cliui": "^7.0.2",
+        "escalade": "^3.1.1",
+        "get-caller-file": "^2.0.5",
+        "require-directory": "^2.1.1",
+        "string-width": "^4.2.0",
+        "y18n": "^5.0.5",
+        "yargs-parser": "^20.2.2"
+      }
+    },
+    "yargs-parser": {
+      "version": "20.2.9",
+      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.9.tgz",
+      "integrity": "sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==",
+      "dev": true
+    },
+    "yorkie": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/yorkie/-/yorkie-2.0.0.tgz",
+      "integrity": "sha512-jcKpkthap6x63MB4TxwCyuIGkV0oYP/YRyuQU5UO0Yz/E/ZAu+653/uov+phdmO54n6BcvFRyyt0RRrWdN2mpw==",
+      "dev": true,
+      "requires": {
+        "execa": "^0.8.0",
+        "is-ci": "^1.0.10",
+        "normalize-path": "^1.0.0",
+        "strip-indent": "^2.0.0"
+      },
+      "dependencies": {
+        "cross-spawn": {
+          "version": "5.1.0",
+          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-5.1.0.tgz",
+          "integrity": "sha512-pTgQJ5KC0d2hcY8eyL1IzlBPYjTkyH72XRZPnLyKus2mBfNjQs3klqbJU2VILqZryAZUt9JOb3h/mWMy23/f5A==",
+          "dev": true,
+          "requires": {
+            "lru-cache": "^4.0.1",
+            "shebang-command": "^1.2.0",
+            "which": "^1.2.9"
+          }
+        },
+        "execa": {
+          "version": "0.8.0",
+          "resolved": "https://registry.npmjs.org/execa/-/execa-0.8.0.tgz",
+          "integrity": "sha512-zDWS+Rb1E8BlqqhALSt9kUhss8Qq4nN3iof3gsOdyINksElaPyNBtKUMTR62qhvgVWR0CqCX7sdnKe4MnUbFEA==",
+          "dev": true,
+          "requires": {
+            "cross-spawn": "^5.0.1",
+            "get-stream": "^3.0.0",
+            "is-stream": "^1.1.0",
+            "npm-run-path": "^2.0.0",
+            "p-finally": "^1.0.0",
+            "signal-exit": "^3.0.0",
+            "strip-eof": "^1.0.0"
+          }
+        },
+        "get-stream": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-3.0.0.tgz",
+          "integrity": "sha512-GlhdIUuVakc8SJ6kK0zAFbiGzRFzNnY4jUuEbV9UROo4Y+0Ny4fjvcZFVTeDA4odpFyOQzaw6hXukJSq/f28sQ==",
+          "dev": true
+        },
+        "lru-cache": {
+          "version": "4.1.5",
+          "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-4.1.5.tgz",
+          "integrity": "sha512-sWZlbEP2OsHNkXrMl5GYk/jKk70MBng6UU4YI/qGDYbgf6YbP4EvmqISbXCoJiRKs+1bSpFHVgQxvJ17F2li5g==",
+          "dev": true,
+          "requires": {
+            "pseudomap": "^1.0.2",
+            "yallist": "^2.1.2"
+          }
+        },
+        "normalize-path": {
+          "version": "1.0.0",
+          "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-1.0.0.tgz",
+          "integrity": "sha512-7WyT0w8jhpDStXRq5836AMmihQwq2nrUVQrgjvUo/p/NZf9uy/MeJ246lBJVmWuYXMlJuG9BNZHF0hWjfTbQUA==",
+          "dev": true
+        },
+        "yallist": {
+          "version": "2.1.2",
+          "resolved": "https://registry.npmjs.org/yallist/-/yallist-2.1.2.tgz",
+          "integrity": "sha512-ncTzHV7NvsQZkYe1DW7cbDLm0YpzHmZF5r/iyP3ZnQtMiJ+pjzisCiMNI+Sj+xQF5pXhSHxSB3uDbsBTzY/c2A==",
+          "dev": true
+        }
+      }
+    }
+  }
+}
diff --git a/frontend/package.json b/frontend/package.json
new file mode 100644
index 000000000..9aa25befe
--- /dev/null
+++ b/frontend/package.json
@@ -0,0 +1,73 @@
+{
+  "name": "omni-web",
+  "version": "0.0.1",
+  "private": true,
+  "scripts": {
+    "serve": "vue-cli-service serve",
+    "build": "vue-cli-service build",
+    "test:unit": "vue-cli-service test:unit",
+    "lint": "vue-cli-service lint",
+    "test": "vue-cli-service test:unit"
+  },
+  "dependencies": {
+    "@auth0/auth0-vue": "^1.0.2",
+    "@headlessui/vue": "^1.6.5",
+    "@heroicons/vue": "^2.0.0",
+    "@stardazed/streams-polyfill": "^2.4.0",
+    "apexcharts": "^3.35.3",
+    "buffer": "^6.0.3",
+    "click-outside-vue3": "^4.0.1",
+    "core-js": "^3.23.3",
+    "fetch-intercept": "^2.4.0",
+    "js-yaml": "^4.1.0",
+    "long": "^5.2.0",
+    "luxon": "^2.4.0",
+    "monaco-editor-vue3": "^0.1.10",
+    "monaco-yaml": "^4.0.4",
+    "pluralize": "^8.0.0",
+    "protobufjs": "^6.11.3",
+    "rxjs": "^7.5.5",
+    "semver-parser": "^4.0.1",
+    "slugify": "^1.6.5",
+    "uuid": "^8.3.2",
+    "vue": "^3.2.37",
+    "vue-router": "^4.0.16",
+    "vue-virtual-scroller": "^2.0.0-beta.3",
+    "vue-word-highlighter": "^1.0.4",
+    "vue3-apexcharts": "^1.4.1",
+    "vue3-clipboard": "^1.0.0",
+    "vue3-popper": "^1.5.0",
+    "whatwg-fetch": "^3.6.2"
+  },
+  "devDependencies": {
+    "@rushstack/eslint-patch": "^1.1.4",
+    "@types/luxon": "^2.4.0",
+    "@types/pluralize": "^0.0.29",
+    "@types/uuid": "^9.0.0",
+    "@typescript-eslint/eslint-plugin": "^5.30.0",
+    "@typescript-eslint/parser": "^5.30.0",
+    "@volar-plugins/vetur": "latest",
+    "@vue/cli-plugin-babel": "^5.0.6",
+    "@vue/cli-plugin-eslint": "^5.0.6",
+    "@vue/cli-plugin-typescript": "^5.0.6",
+    "@vue/cli-plugin-unit-jest": "^5.0.6",
+    "@vue/cli-service": "^5.0.6",
+    "@vue/compiler-sfc": "^3.2.37",
+    "@vue/eslint-config-typescript": "^11.0.0",
+    "@vue/test-utils": "^2.0.0",
+    "autoprefixer": "^10.4.7",
+    "babel-eslint": "^10.1.0",
+    "eslint": "^8.18.0",
+    "eslint-plugin-vue": "^9.1.1",
+    "jest": "^27.5.1",
+    "kubernetes-types": "^1.26.0",
+    "lodash": "^4.17.21",
+    "openpgp": "^5.5.0",
+    "postcss": "^8.4.14",
+    "tailwindcss": "^3.1.4",
+    "ts-jest": "^27.1.5",
+    "ts-loader": "^9.3.1",
+    "typescript": "^4.7.4",
+    "vue-cli-plugin-tailwind": "^3.0.0"
+  }
+}
diff --git a/frontend/postcss.config.js b/frontend/postcss.config.js
new file mode 100644
index 000000000..16149f13f
--- /dev/null
+++ b/frontend/postcss.config.js
@@ -0,0 +1,11 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+module.exports = {
+  plugins: {
+    tailwindcss: {},
+    autoprefixer: {}
+  }
+}
diff --git a/frontend/public/favicon.ico b/frontend/public/favicon.ico
new file mode 100644
index 000000000..347b06abb
Binary files /dev/null and b/frontend/public/favicon.ico differ
diff --git a/frontend/public/index.html b/frontend/public/index.html
new file mode 100644
index 000000000..888a50de2
--- /dev/null
+++ b/frontend/public/index.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html lang="">
+  <head>
+    <meta charset="utf-8">
+    <meta http-equiv="X-UA-Compatible" content="IE=edge">
+    <meta name="viewport" content="width=device-width,initial-scale=1.0">
+    <link rel="icon" href="<%= BASE_URL %>favicon.ico">
+    <title>Omni</title>
+  </head>
+  <body>
+    <noscript>
+      <strong>We're sorry but Omni UI doesn't work properly without JavaScript enabled. Please enable it to continue.</strong>
+    </noscript>
+    <div id="app"></div>
+    <!-- built files will be auto injected -->
+  </body>
+</html>
diff --git a/frontend/src/App.vue b/frontend/src/App.vue
new file mode 100644
index 000000000..7868046e3
--- /dev/null
+++ b/frontend/src/App.vue
@@ -0,0 +1,46 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="root">
+    <t-modal/>
+    <t-header id="header"/>
+    <t-shell class="shell">
+      <template #menu>
+        <t-side-bar/>
+      </template>
+      <template #content>
+        <div class="flex flex-col w-full h-full gap-4">
+          <t-suspended v-if="suspended"/>
+          <t-notification v-if="notification" v-bind="notification.props"/>
+          <router-view class="w-full h-full"/>
+        </div>
+      </template>
+    </t-shell>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { notification } from "@/notification";
+import { suspended } from "@/methods";
+
+import THeader from "@/components/THeader/THeader.vue";
+import TShell from "@/components/common/Shell/TShell.vue";
+import TSideBar from "@/components/SideBar/TSideBar.vue";
+import TModal from "@/components/TModal.vue";
+import TSuspended from '@/components/common/Suspended/TSuspended.vue';
+import TNotification from '@/components/common/Notification/TNotification.vue';
+</script>
+
+<style scoped>
+.root {
+  @apply text-naturals-N11 h-screen flex flex-col;
+}
+
+.shell {
+  height: calc(100% - 52px);
+}
+</style>
diff --git a/frontend/src/AppUnavailable.vue b/frontend/src/AppUnavailable.vue
new file mode 100644
index 000000000..0ea77ed7b
--- /dev/null
+++ b/frontend/src/AppUnavailable.vue
@@ -0,0 +1,42 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="root">
+    <t-header />
+    <div class="flex flex-col flex-1 items-center justify-center">
+      <div class="error">
+        <t-icon icon="warning" class="h-12 w-12 fill-current text-naturals-N14"/>
+        <div class="flex flex-col text-naturals-N13">
+          <div>
+            It appears we are experiencing some issues.
+          </div>
+          <div>
+            Please try later again or <a class="contact-link text-naturals-N12" href="https://www.siderolabs.com/contact/">contact us</a>.
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import THeader from "@/components/THeader/THeader.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+</script>
+
+<style scoped>
+.root {
+  @apply flex flex-col;
+  min-height: 100vh;
+}
+.error {
+  @apply flex gap-4 bg-naturals-N6 rounded-lg px-6 py-4 drop-shadow-md;
+}
+.contact-link {
+  @apply underline;
+}
+</style>
diff --git a/frontend/src/api/common/common.pb.ts b/frontend/src/api/common/common.pb.ts
new file mode 100644
index 000000000..6fb721539
--- /dev/null
+++ b/frontend/src/api/common/common.pb.ts
@@ -0,0 +1,75 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as GoogleProtobufAny from "../google/protobuf/any.pb"
+import * as GoogleRpcStatus from "../google/rpc/status.pb"
+
+export enum Code {
+  FATAL = 0,
+  LOCKED = 1,
+  CANCELED = 2,
+}
+
+export enum ContainerDriver {
+  CONTAINERD = 0,
+  CRI = 1,
+}
+
+export type Error = {
+  code?: Code
+  message?: string
+  details?: GoogleProtobufAny.Any[]
+}
+
+export type Metadata = {
+  hostname?: string
+  error?: string
+  status?: GoogleRpcStatus.Status
+}
+
+export type Data = {
+  metadata?: Metadata
+  bytes?: Uint8Array
+}
+
+export type DataResponse = {
+  messages?: Data[]
+}
+
+export type Empty = {
+  metadata?: Metadata
+}
+
+export type EmptyResponse = {
+  messages?: Empty[]
+}
+
+export type URL = {
+  full_path?: string
+}
+
+export type PEMEncodedCertificateAndKey = {
+  crt?: Uint8Array
+  key?: Uint8Array
+}
+
+export type PEMEncodedKey = {
+  key?: Uint8Array
+}
+
+export type NetIP = {
+  ip?: Uint8Array
+}
+
+export type NetIPPort = {
+  ip?: Uint8Array
+  port?: number
+}
+
+export type NetIPPrefix = {
+  ip?: Uint8Array
+  prefix_length?: number
+}
\ No newline at end of file
diff --git a/frontend/src/api/common/common.proto b/frontend/src/api/common/common.proto
new file mode 100644
index 000000000..97bb7fbb7
--- /dev/null
+++ b/frontend/src/api/common/common.proto
@@ -0,0 +1,116 @@
+syntax = "proto3";
+
+package common;
+
+option go_package = "github.com/siderolabs/talos/pkg/machinery/api/common";
+
+import "google/protobuf/any.proto";
+import "google/protobuf/descriptor.proto";
+import "google/rpc/status.proto";
+
+// An alternative to using options could be extracting versions from comments.
+// Unfortunately, they are not available: https://github.com/golang/protobuf/issues/1134
+// Also, while option numbers can be the same,
+// names should be different: https://github.com/protocolbuffers/protobuf/issues/4861
+
+extend google.protobuf.MessageOptions {
+  // Indicates the Talos version when this deprecated message will be removed from API.
+  string remove_deprecated_message = 93117;
+}
+
+extend google.protobuf.FieldOptions {
+  // Indicates the Talos version when this deprecated filed will be removed from API.
+  string remove_deprecated_field = 93117;
+}
+
+extend google.protobuf.EnumOptions {
+  // Indicates the Talos version when this deprecated enum will be removed from API.
+  string remove_deprecated_enum = 93117;
+}
+
+extend google.protobuf.EnumValueOptions {
+  // Indicates the Talos version when this deprecated enum value will be removed from API.
+  string remove_deprecated_enum_value = 93117;
+}
+
+extend google.protobuf.MethodOptions {
+  // Indicates the Talos version when this deprecated method will be removed from API.
+  string remove_deprecated_method = 93117;
+}
+
+extend google.protobuf.ServiceOptions {
+  // Indicates the Talos version when this deprecated service will be removed from API.
+  string remove_deprecated_service = 93117;
+}
+
+enum Code {
+  FATAL = 0;
+  LOCKED = 1;
+  CANCELED = 2;
+}
+
+message Error {
+  Code code = 1;
+  string message = 2;
+  repeated google.protobuf.Any details = 3;
+}
+
+// Common metadata message nested in all reply message types
+message Metadata {
+  // hostname of the server response comes from (injected by proxy)
+  string hostname = 1;
+  // error is set if request failed to the upstream (rest of response is
+  // undefined)
+  string error = 2;
+  // error as gRPC Status
+  google.rpc.Status status = 3;
+}
+
+message Data {
+  Metadata metadata = 1;
+  bytes bytes = 2;
+}
+
+message DataResponse {
+  repeated Data messages = 1;
+}
+
+message Empty {
+  Metadata metadata = 1;
+}
+
+message EmptyResponse {
+  repeated Empty messages = 1;
+}
+
+enum ContainerDriver {
+  CONTAINERD = 0;
+  CRI = 1;
+}
+
+message URL {
+  string full_path = 1;
+}
+
+message PEMEncodedCertificateAndKey {
+  bytes crt = 1;
+  bytes key = 2;
+}
+
+message PEMEncodedKey {
+  bytes key = 1;
+}
+
+message NetIP {
+  bytes ip = 1;
+}
+
+message NetIPPort {
+  bytes ip = 1;
+  int32 port = 2;
+}
+
+message NetIPPrefix {
+  bytes ip = 1;
+  int32 prefix_length = 2;
+}
diff --git a/frontend/src/api/common/omni.pb.ts b/frontend/src/api/common/omni.pb.ts
new file mode 100644
index 000000000..2f2c0dc7e
--- /dev/null
+++ b/frontend/src/api/common/omni.pb.ts
@@ -0,0 +1,15 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+export enum Runtime {
+  Kubernetes = 0,
+  Talos = 1,
+  Omni = 2,
+}
+
+export type Context = {
+  name?: string
+}
\ No newline at end of file
diff --git a/frontend/src/api/fetch.pb.ts b/frontend/src/api/fetch.pb.ts
new file mode 100644
index 000000000..0fdd5cfbf
--- /dev/null
+++ b/frontend/src/api/fetch.pb.ts
@@ -0,0 +1,387 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+/**
+ * base64 encoder and decoder
+ * Copied and adapted from https://github.com/protobufjs/protobuf.js/blob/master/lib/base64/index.js
+ */
+// Base64 encoding table
+const b64 = new Array(64);
+
+// Base64 decoding table
+const s64 = new Array(123);
+
+// 65..90, 97..122, 48..57, 43, 47
+for (let i = 0; i < 64;)
+    s64[b64[i] = i < 26 ? i + 65 : i < 52 ? i + 71 : i < 62 ? i - 4 : i - 59 | 43] = i++;
+
+export function b64Encode(buffer: Uint8Array, start: number, end: number): string {
+	let parts: string[] = null;
+  const chunk = [];
+  let i = 0, // output index
+    j = 0, // goto index
+    t;     // temporary
+  while (start < end) {
+    const b = buffer[start++];
+    switch (j) {
+      case 0:
+        chunk[i++] = b64[b >> 2];
+        t = (b & 3) << 4;
+        j = 1;
+        break;
+      case 1:
+        chunk[i++] = b64[t | b >> 4];
+        t = (b & 15) << 2;
+        j = 2;
+        break;
+      case 2:
+        chunk[i++] = b64[t | b >> 6];
+        chunk[i++] = b64[b & 63];
+        j = 0;
+        break;
+    }
+    if (i > 8191) {
+      (parts || (parts = [])).push(String.fromCharCode.apply(String, chunk));
+      i = 0;
+    }
+  }
+  if (j) {
+    chunk[i++] = b64[t];
+    chunk[i++] = 61;
+    if (j === 1)
+      chunk[i++] = 61;
+  }
+  if (parts) {
+    if (i)
+      parts.push(String.fromCharCode.apply(String, chunk.slice(0, i)));
+    return parts.join("");
+  }
+  return String.fromCharCode.apply(String, chunk.slice(0, i));
+}
+
+const invalidEncoding = "invalid encoding";
+
+export function b64Decode(s: string): Uint8Array {
+	const buffer = [];
+	let offset = 0;
+  let j = 0, // goto index
+      t;     // temporary
+  for (let i = 0; i < s.length;) {
+    let c = s.charCodeAt(i++);
+    if (c === 61 && j > 1)
+        break;
+    if ((c = s64[c]) === undefined)
+        throw Error(invalidEncoding);
+    switch (j) {
+      case 0:
+        t = c;
+        j = 1;
+        break;
+      case 1:
+        buffer[offset++] = t << 2 | (c & 48) >> 4;
+        t = c;
+        j = 2;
+        break;
+      case 2:
+        buffer[offset++] = (t & 15) << 4 | (c & 60) >> 2;
+        t = c;
+        j = 3;
+        break;
+      case 3:
+        buffer[offset++] = (t & 3) << 6 | c;
+        j = 0;
+        break;
+    }
+  }
+  if (j === 1)
+      throw Error(invalidEncoding);
+  return new Uint8Array(buffer);
+}
+
+export interface fetchOption {
+  (req: RequestOptions): void
+}
+
+let commonFetchOptions: fetchOption[];
+
+type Writeable<T> = { -readonly [P in keyof T]: T[P] };
+
+export type RequestOptions = Writeable<Request> & {
+  controller?: AbortController,
+  timeoutID?: number
+};
+
+export const setCommonFetchOptions = (...options: fetchOption[]) => {
+  commonFetchOptions = options;
+}
+
+export function replacer(key: any, value: any): any {
+  if(value && value.constructor === Uint8Array) {
+    return b64Encode(value, 0, value.length);
+  }
+
+  return value;
+}
+
+const createRequest = <T>(method: string, path: string, body?: T, ...options: fetchOption[]): RequestOptions => {
+  const request: RequestOptions = {
+    url: path,
+    method: method,
+  };
+
+  if (body) {
+    request.body = JSON.stringify(body, replacer);
+  }
+
+  for (const opt of (commonFetchOptions ?? [])) {
+    opt(request);
+  }
+
+  for (const opt of options) {
+    opt(request);
+  }
+
+  return request;
+}
+
+export const fetchReq = async <T, O>(method: string, path: string, body?: T, ...options: fetchOption[]): Promise<O> => {
+  const req = createRequest(method, path, body, ...options);
+
+  try {
+    const response = await fetch(req.url, req);
+
+    if (!response.ok) {
+      await getError(response);
+    }
+
+    return (await response.json()) as O;
+  } finally {
+    if (req.timeoutID) {
+      clearTimeout(req.timeoutID);
+    }
+  }
+}
+
+// NotifyStreamEntityArrival is a callback that will be called on streaming entity arrival
+export type NotifyStreamEntityArrival<T> = (resp: T) => void
+
+const getError = async (result: Response) => {
+  let resp: any;
+
+  try {
+    resp = await result.json();
+  } catch (e) {
+    throw new Error(e.message);
+  }
+
+  throw resp;
+}
+
+/**
+ * fetchStreamingRequest is able to handle grpc-gateway server side streaming call
+ * it takes NotifyStreamEntityArrival that lets users respond to entity arrival during the call
+ * all entities will be returned as an array after the call finishes.
+ **/
+export async function fetchStreamingRequest<T, R>(method: string, path: string, body?: T, callback: NotifyStreamEntityArrival<R>, ...options: fetchOption[]): Promise<void> {
+  const req = createRequest(method, path, body, ...options);
+  const result = await fetch(req.url, req);
+
+  // needs to use the .ok to check the status of HTTP status code
+  // http other than 200 will not throw an error, instead the .ok will become false.
+  // see https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API/Using_Fetch#
+  if (!result.ok) {
+    await getError(result);
+  }
+
+  if (!result.body) {
+    throw new Error("response does not have a body")
+  }
+
+  try {
+    await result.body
+      .pipeThrough(new TextDecoderStream())
+      .pipeThrough<R>(getNewLineDelimitedJSONDecodingStream<R>())
+      .pipeTo(getNotifyEntityArrivalSink(callback));
+  } finally {
+    if (req.timeoutID) {
+      clearTimeout(req.timeoutID);
+    }
+  }
+}
+
+/**
+ * JSONStringStreamController represents the transform controller that's able to transform the incoming
+ * new line delimited json content stream into entities and able to push the entity to the down stream
+ */
+interface JSONStringStreamController<T> extends TransformStreamDefaultController {
+  buf?: string
+  pos?: number
+  enqueue: (s: T) => void
+}
+
+/**
+ * getNewLineDelimitedJSONDecodingStream returns a TransformStream that's able to handle new line delimited json stream content into parsed entities
+ */
+function getNewLineDelimitedJSONDecodingStream<T>(): TransformStream<string, T> {
+  return new TransformStream({
+    start(controller: JSONStringStreamController<T>) {
+      controller.buf = ''
+      controller.pos = 0
+    },
+
+    transform(chunk: string, controller: JSONStringStreamController<T>) {
+      if (controller.buf === undefined) {
+        controller.buf = ''
+      }
+      if (controller.pos === undefined) {
+        controller.pos = 0
+      }
+      controller.buf += chunk
+      while (controller.pos < controller.buf.length) {
+        if (controller.buf[controller.pos] === '\n') {
+          const line = controller.buf.substring(0, controller.pos)
+          const response = JSON.parse(line)
+          controller.enqueue(response.result ?? response)
+          controller.buf = controller.buf.substring(controller.pos + 1)
+          controller.pos = 0
+        } else {
+          ++controller.pos
+        }
+      }
+    }
+  })
+
+}
+
+/**
+ * getNotifyEntityArrivalSink takes the NotifyStreamEntityArrival callback and return
+ * a sink that will call the callback on entity arrival
+ * @param notifyCallback
+ */
+function getNotifyEntityArrivalSink<T>(notifyCallback: NotifyStreamEntityArrival<T>) {
+  return new WritableStream<T>({
+    write(entity: T) {
+      notifyCallback(entity)
+    }
+  })
+}
+
+type Primitive = string | boolean | number;
+type RequestPayload = Record<string, unknown>;
+type FlattenedRequestPayload = Record<string, Primitive | Array<Primitive>>;
+
+/**
+ * Checks if given value is a plain object
+ * Logic copied and adapted from below source: 
+ * https://github.com/char0n/ramda-adjunct/blob/master/src/isPlainObj.js
+ * @param  {unknown} value
+ * @return {boolean}
+ */
+function isPlainObject(value: unknown): boolean {
+  const isObject =
+    Object.prototype.toString.call(value).slice(8, -1) === "Object";
+  const isObjLike = value !== null && isObject;
+
+  if (!isObjLike || !isObject) {
+    return false;
+  }
+
+  const proto = Object.getPrototypeOf(value);
+
+  const hasObjectConstructor =
+    typeof proto === "object" &&
+    proto.constructor === Object.prototype.constructor;
+
+  return hasObjectConstructor;
+}
+
+/**
+ * Checks if given value is of a primitive type
+ * @param  {unknown} value
+ * @return {boolean}
+ */
+function isPrimitive(value: unknown): boolean {
+  return ["string", "number", "boolean"].some(t => typeof value === t);
+}
+
+/**
+ * Checks if given primitive is zero-value
+ * @param  {Primitive} value
+ * @return {boolean}
+ */
+function isZeroValuePrimitive(value: Primitive): boolean {
+  return value === false || value === 0 || value === "";
+}
+
+/**
+ * Flattens a deeply nested request payload and returns an object
+ * with only primitive values and non-empty array of primitive values
+ * as per https://github.com/googleapis/googleapis/blob/master/google/api/http.proto
+ * @param  {RequestPayload} requestPayload
+ * @param  {String} path
+ * @return {FlattenedRequestPayload>}
+ */
+function flattenRequestPayload<T extends RequestPayload>(
+  requestPayload: T,
+  path: string = ""
+): FlattenedRequestPayload {
+  return Object.keys(requestPayload).reduce(
+    (acc: T, key: string): T => {
+      const value = requestPayload[key];
+      const newPath = path ? [path, key].join(".") : key;
+
+      const isNonEmptyPrimitiveArray =
+        Array.isArray(value) &&
+        value.every(v => isPrimitive(v)) &&
+        value.length > 0;
+
+      const isNonZeroValuePrimitive =
+        isPrimitive(value) && !isZeroValuePrimitive(value as Primitive);
+
+      let objectToMerge = {};
+
+      if (isPlainObject(value)) {
+        objectToMerge = flattenRequestPayload(value as RequestPayload, newPath);
+      } else if (isNonZeroValuePrimitive || isNonEmptyPrimitiveArray) {
+        objectToMerge = { [newPath]: value };
+      }
+
+      return { ...acc, ...objectToMerge };
+    },
+    {} as T
+  ) as FlattenedRequestPayload;
+}
+
+/**
+ * Renders a deeply nested request payload into a string of URL search
+ * parameters by first flattening the request payload and then removing keys
+ * which are already present in the URL path.
+ * @param  {RequestPayload} requestPayload
+ * @param  {string[]} urlPathParams
+ * @return {string}
+ */
+export function renderURLSearchParams<T extends RequestPayload>(
+  requestPayload: T,
+  urlPathParams: string[] = []
+): string {
+  const flattenedRequestPayload = flattenRequestPayload(requestPayload);
+
+  const urlSearchParams = Object.keys(flattenedRequestPayload).reduce(
+    (acc: string[][], key: string): string[][] => {
+      // key should not be present in the url path as a parameter
+      const value = flattenedRequestPayload[key];
+      if (urlPathParams.find(f => f === key)) {
+        return acc;
+      }
+      return Array.isArray(value)
+        ? [...acc, ...value.map(m => [key, m.toString()])]
+        : (acc = [...acc, [key, value.toString()]]);
+    },
+    [] as string[][]
+  );
+
+  return new URLSearchParams(urlSearchParams).toString();
+}
\ No newline at end of file
diff --git a/frontend/src/api/google/protobuf/any.pb.ts b/frontend/src/api/google/protobuf/any.pb.ts
new file mode 100644
index 000000000..dfad82ca3
--- /dev/null
+++ b/frontend/src/api/google/protobuf/any.pb.ts
@@ -0,0 +1,9 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+export type Any = {
+  type_url?: string
+  value?: Uint8Array
+}
\ No newline at end of file
diff --git a/frontend/src/api/google/protobuf/any.proto b/frontend/src/api/google/protobuf/any.proto
new file mode 100644
index 000000000..eff44e509
--- /dev/null
+++ b/frontend/src/api/google/protobuf/any.proto
@@ -0,0 +1,162 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+// https://developers.google.com/protocol-buffers/
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+syntax = "proto3";
+
+package google.protobuf;
+
+option go_package = "google.golang.org/protobuf/types/known/anypb";
+option java_package = "com.google.protobuf";
+option java_outer_classname = "AnyProto";
+option java_multiple_files = true;
+option objc_class_prefix = "GPB";
+option csharp_namespace = "Google.Protobuf.WellKnownTypes";
+
+// `Any` contains an arbitrary serialized protocol buffer message along with a
+// URL that describes the type of the serialized message.
+//
+// Protobuf library provides support to pack/unpack Any values in the form
+// of utility functions or additional generated methods of the Any type.
+//
+// Example 1: Pack and unpack a message in C++.
+//
+//     Foo foo = ...;
+//     Any any;
+//     any.PackFrom(foo);
+//     ...
+//     if (any.UnpackTo(&foo)) {
+//       ...
+//     }
+//
+// Example 2: Pack and unpack a message in Java.
+//
+//     Foo foo = ...;
+//     Any any = Any.pack(foo);
+//     ...
+//     if (any.is(Foo.class)) {
+//       foo = any.unpack(Foo.class);
+//     }
+//     // or ...
+//     if (any.isSameTypeAs(Foo.getDefaultInstance())) {
+//       foo = any.unpack(Foo.getDefaultInstance());
+//     }
+//
+//  Example 3: Pack and unpack a message in Python.
+//
+//     foo = Foo(...)
+//     any = Any()
+//     any.Pack(foo)
+//     ...
+//     if any.Is(Foo.DESCRIPTOR):
+//       any.Unpack(foo)
+//       ...
+//
+//  Example 4: Pack and unpack a message in Go
+//
+//      foo := &pb.Foo{...}
+//      any, err := anypb.New(foo)
+//      if err != nil {
+//        ...
+//      }
+//      ...
+//      foo := &pb.Foo{}
+//      if err := any.UnmarshalTo(foo); err != nil {
+//        ...
+//      }
+//
+// The pack methods provided by protobuf library will by default use
+// 'type.googleapis.com/full.type.name' as the type URL and the unpack
+// methods only use the fully qualified type name after the last '/'
+// in the type URL, for example "foo.bar.com/x/y.z" will yield type
+// name "y.z".
+//
+// JSON
+// ====
+// The JSON representation of an `Any` value uses the regular
+// representation of the deserialized, embedded message, with an
+// additional field `@type` which contains the type URL. Example:
+//
+//     package google.profile;
+//     message Person {
+//       string first_name = 1;
+//       string last_name = 2;
+//     }
+//
+//     {
+//       "@type": "type.googleapis.com/google.profile.Person",
+//       "firstName": <string>,
+//       "lastName": <string>
+//     }
+//
+// If the embedded message type is well-known and has a custom JSON
+// representation, that representation will be embedded adding a field
+// `value` which holds the custom JSON in addition to the `@type`
+// field. Example (for message [google.protobuf.Duration][]):
+//
+//     {
+//       "@type": "type.googleapis.com/google.protobuf.Duration",
+//       "value": "1.212s"
+//     }
+//
+message Any {
+  // A URL/resource name that uniquely identifies the type of the serialized
+  // protocol buffer message. This string must contain at least
+  // one "/" character. The last segment of the URL's path must represent
+  // the fully qualified name of the type (as in
+  // `path/google.protobuf.Duration`). The name should be in a canonical form
+  // (e.g., leading "." is not accepted).
+  //
+  // In practice, teams usually precompile into the binary all types that they
+  // expect it to use in the context of Any. However, for URLs which use the
+  // scheme `http`, `https`, or no scheme, one can optionally set up a type
+  // server that maps type URLs to message definitions as follows:
+  //
+  // * If no scheme is provided, `https` is assumed.
+  // * An HTTP GET on the URL must yield a [google.protobuf.Type][]
+  //   value in binary format, or produce an error.
+  // * Applications are allowed to cache lookup results based on the
+  //   URL, or have them precompiled into a binary to avoid any
+  //   lookup. Therefore, binary compatibility needs to be preserved
+  //   on changes to types. (Use versioned type names to manage
+  //   breaking changes.)
+  //
+  // Note: this functionality is not currently available in the official
+  // protobuf release, and it is not used for type URLs beginning with
+  // type.googleapis.com. As of May 2023, there are no widely used type server
+  // implementations and no plans to implement one.
+  //
+  // Schemes other than `http`, `https` (or the empty scheme) might be
+  // used with implementation specific semantics.
+  //
+  string type_url = 1;
+
+  // Must be a valid serialized protocol buffer of the above specified type.
+  bytes value = 2;
+}
diff --git a/frontend/src/api/google/protobuf/duration.pb.ts b/frontend/src/api/google/protobuf/duration.pb.ts
new file mode 100644
index 000000000..25688aa05
--- /dev/null
+++ b/frontend/src/api/google/protobuf/duration.pb.ts
@@ -0,0 +1,6 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+export type Duration = string
\ No newline at end of file
diff --git a/frontend/src/api/google/protobuf/duration.proto b/frontend/src/api/google/protobuf/duration.proto
new file mode 100644
index 000000000..41f40c222
--- /dev/null
+++ b/frontend/src/api/google/protobuf/duration.proto
@@ -0,0 +1,115 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+// https://developers.google.com/protocol-buffers/
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+syntax = "proto3";
+
+package google.protobuf;
+
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/protobuf/types/known/durationpb";
+option java_package = "com.google.protobuf";
+option java_outer_classname = "DurationProto";
+option java_multiple_files = true;
+option objc_class_prefix = "GPB";
+option csharp_namespace = "Google.Protobuf.WellKnownTypes";
+
+// A Duration represents a signed, fixed-length span of time represented
+// as a count of seconds and fractions of seconds at nanosecond
+// resolution. It is independent of any calendar and concepts like "day"
+// or "month". It is related to Timestamp in that the difference between
+// two Timestamp values is a Duration and it can be added or subtracted
+// from a Timestamp. Range is approximately +-10,000 years.
+//
+// # Examples
+//
+// Example 1: Compute Duration from two Timestamps in pseudo code.
+//
+//     Timestamp start = ...;
+//     Timestamp end = ...;
+//     Duration duration = ...;
+//
+//     duration.seconds = end.seconds - start.seconds;
+//     duration.nanos = end.nanos - start.nanos;
+//
+//     if (duration.seconds < 0 && duration.nanos > 0) {
+//       duration.seconds += 1;
+//       duration.nanos -= 1000000000;
+//     } else if (duration.seconds > 0 && duration.nanos < 0) {
+//       duration.seconds -= 1;
+//       duration.nanos += 1000000000;
+//     }
+//
+// Example 2: Compute Timestamp from Timestamp + Duration in pseudo code.
+//
+//     Timestamp start = ...;
+//     Duration duration = ...;
+//     Timestamp end = ...;
+//
+//     end.seconds = start.seconds + duration.seconds;
+//     end.nanos = start.nanos + duration.nanos;
+//
+//     if (end.nanos < 0) {
+//       end.seconds -= 1;
+//       end.nanos += 1000000000;
+//     } else if (end.nanos >= 1000000000) {
+//       end.seconds += 1;
+//       end.nanos -= 1000000000;
+//     }
+//
+// Example 3: Compute Duration from datetime.timedelta in Python.
+//
+//     td = datetime.timedelta(days=3, minutes=10)
+//     duration = Duration()
+//     duration.FromTimedelta(td)
+//
+// # JSON Mapping
+//
+// In JSON format, the Duration type is encoded as a string rather than an
+// object, where the string ends in the suffix "s" (indicating seconds) and
+// is preceded by the number of seconds, with nanoseconds expressed as
+// fractional seconds. For example, 3 seconds with 0 nanoseconds should be
+// encoded in JSON format as "3s", while 3 seconds and 1 nanosecond should
+// be expressed in JSON format as "3.000000001s", and 3 seconds and 1
+// microsecond should be expressed in JSON format as "3.000001s".
+//
+message Duration {
+  // Signed seconds of the span of time. Must be from -315,576,000,000
+  // to +315,576,000,000 inclusive. Note: these bounds are computed from:
+  // 60 sec/min * 60 min/hr * 24 hr/day * 365.25 days/year * 10000 years
+  int64 seconds = 1;
+
+  // Signed fractions of a second at nanosecond resolution of the span
+  // of time. Durations less than one second are represented with a 0
+  // `seconds` field and a positive or negative `nanos` field. For durations
+  // of one second or more, a non-zero value for the `nanos` field must be
+  // of the same sign as the `seconds` field. Must be from -999,999,999
+  // to +999,999,999 inclusive.
+  int32 nanos = 2;
+}
diff --git a/frontend/src/api/google/protobuf/empty.pb.ts b/frontend/src/api/google/protobuf/empty.pb.ts
new file mode 100644
index 000000000..d48bd3c9f
--- /dev/null
+++ b/frontend/src/api/google/protobuf/empty.pb.ts
@@ -0,0 +1,7 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+export type Empty = {
+}
\ No newline at end of file
diff --git a/frontend/src/api/google/protobuf/empty.proto b/frontend/src/api/google/protobuf/empty.proto
new file mode 100644
index 000000000..b87c89dcf
--- /dev/null
+++ b/frontend/src/api/google/protobuf/empty.proto
@@ -0,0 +1,51 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+// https://developers.google.com/protocol-buffers/
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+syntax = "proto3";
+
+package google.protobuf;
+
+option go_package = "google.golang.org/protobuf/types/known/emptypb";
+option java_package = "com.google.protobuf";
+option java_outer_classname = "EmptyProto";
+option java_multiple_files = true;
+option objc_class_prefix = "GPB";
+option csharp_namespace = "Google.Protobuf.WellKnownTypes";
+option cc_enable_arenas = true;
+
+// A generic empty message that you can re-use to avoid defining duplicated
+// empty messages in your APIs. A typical example is to use it as the request
+// or the response type of an API method. For instance:
+//
+//     service Foo {
+//       rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);
+//     }
+//
+message Empty {}
diff --git a/frontend/src/api/google/protobuf/timestamp.pb.ts b/frontend/src/api/google/protobuf/timestamp.pb.ts
new file mode 100644
index 000000000..166d9dbc9
--- /dev/null
+++ b/frontend/src/api/google/protobuf/timestamp.pb.ts
@@ -0,0 +1,6 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+export type Timestamp = string
\ No newline at end of file
diff --git a/frontend/src/api/google/protobuf/timestamp.proto b/frontend/src/api/google/protobuf/timestamp.proto
new file mode 100644
index 000000000..fd0bc07dc
--- /dev/null
+++ b/frontend/src/api/google/protobuf/timestamp.proto
@@ -0,0 +1,144 @@
+// Protocol Buffers - Google's data interchange format
+// Copyright 2008 Google Inc.  All rights reserved.
+// https://developers.google.com/protocol-buffers/
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+syntax = "proto3";
+
+package google.protobuf;
+
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/protobuf/types/known/timestamppb";
+option java_package = "com.google.protobuf";
+option java_outer_classname = "TimestampProto";
+option java_multiple_files = true;
+option objc_class_prefix = "GPB";
+option csharp_namespace = "Google.Protobuf.WellKnownTypes";
+
+// A Timestamp represents a point in time independent of any time zone or local
+// calendar, encoded as a count of seconds and fractions of seconds at
+// nanosecond resolution. The count is relative to an epoch at UTC midnight on
+// January 1, 1970, in the proleptic Gregorian calendar which extends the
+// Gregorian calendar backwards to year one.
+//
+// All minutes are 60 seconds long. Leap seconds are "smeared" so that no leap
+// second table is needed for interpretation, using a [24-hour linear
+// smear](https://developers.google.com/time/smear).
+//
+// The range is from 0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z. By
+// restricting to that range, we ensure that we can convert to and from [RFC
+// 3339](https://www.ietf.org/rfc/rfc3339.txt) date strings.
+//
+// # Examples
+//
+// Example 1: Compute Timestamp from POSIX `time()`.
+//
+//     Timestamp timestamp;
+//     timestamp.set_seconds(time(NULL));
+//     timestamp.set_nanos(0);
+//
+// Example 2: Compute Timestamp from POSIX `gettimeofday()`.
+//
+//     struct timeval tv;
+//     gettimeofday(&tv, NULL);
+//
+//     Timestamp timestamp;
+//     timestamp.set_seconds(tv.tv_sec);
+//     timestamp.set_nanos(tv.tv_usec * 1000);
+//
+// Example 3: Compute Timestamp from Win32 `GetSystemTimeAsFileTime()`.
+//
+//     FILETIME ft;
+//     GetSystemTimeAsFileTime(&ft);
+//     UINT64 ticks = (((UINT64)ft.dwHighDateTime) << 32) | ft.dwLowDateTime;
+//
+//     // A Windows tick is 100 nanoseconds. Windows epoch 1601-01-01T00:00:00Z
+//     // is 11644473600 seconds before Unix epoch 1970-01-01T00:00:00Z.
+//     Timestamp timestamp;
+//     timestamp.set_seconds((INT64) ((ticks / 10000000) - 11644473600LL));
+//     timestamp.set_nanos((INT32) ((ticks % 10000000) * 100));
+//
+// Example 4: Compute Timestamp from Java `System.currentTimeMillis()`.
+//
+//     long millis = System.currentTimeMillis();
+//
+//     Timestamp timestamp = Timestamp.newBuilder().setSeconds(millis / 1000)
+//         .setNanos((int) ((millis % 1000) * 1000000)).build();
+//
+// Example 5: Compute Timestamp from Java `Instant.now()`.
+//
+//     Instant now = Instant.now();
+//
+//     Timestamp timestamp =
+//         Timestamp.newBuilder().setSeconds(now.getEpochSecond())
+//             .setNanos(now.getNano()).build();
+//
+// Example 6: Compute Timestamp from current time in Python.
+//
+//     timestamp = Timestamp()
+//     timestamp.GetCurrentTime()
+//
+// # JSON Mapping
+//
+// In JSON format, the Timestamp type is encoded as a string in the
+// [RFC 3339](https://www.ietf.org/rfc/rfc3339.txt) format. That is, the
+// format is "{year}-{month}-{day}T{hour}:{min}:{sec}[.{frac_sec}]Z"
+// where {year} is always expressed using four digits while {month}, {day},
+// {hour}, {min}, and {sec} are zero-padded to two digits each. The fractional
+// seconds, which can go up to 9 digits (i.e. up to 1 nanosecond resolution),
+// are optional. The "Z" suffix indicates the timezone ("UTC"); the timezone
+// is required. A proto3 JSON serializer should always use UTC (as indicated by
+// "Z") when printing the Timestamp type and a proto3 JSON parser should be
+// able to accept both UTC and other timezones (as indicated by an offset).
+//
+// For example, "2017-01-15T01:30:15.01Z" encodes 15.01 seconds past
+// 01:30 UTC on January 15, 2017.
+//
+// In JavaScript, one can convert a Date object to this format using the
+// standard
+// [toISOString()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date/toISOString)
+// method. In Python, a standard `datetime.datetime` object can be converted
+// to this format using
+// [`strftime`](https://docs.python.org/2/library/time.html#time.strftime) with
+// the time format spec '%Y-%m-%dT%H:%M:%S.%fZ'. Likewise, in Java, one can use
+// the Joda Time's [`ISODateTimeFormat.dateTime()`](
+// http://joda-time.sourceforge.net/apidocs/org/joda/time/format/ISODateTimeFormat.html#dateTime()
+// ) to obtain a formatter capable of generating timestamps in this format.
+//
+message Timestamp {
+  // Represents seconds of UTC time since Unix epoch
+  // 1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to
+  // 9999-12-31T23:59:59Z inclusive.
+  int64 seconds = 1;
+
+  // Non-negative fractions of a second at nanosecond resolution. Negative
+  // second values with fractions must still have non-negative nanos values
+  // that count forward in time. Must be from 0 to 999,999,999
+  // inclusive.
+  int32 nanos = 2;
+}
diff --git a/frontend/src/api/google/rpc/code.pb.ts b/frontend/src/api/google/rpc/code.pb.ts
new file mode 100644
index 000000000..6511676a4
--- /dev/null
+++ b/frontend/src/api/google/rpc/code.pb.ts
@@ -0,0 +1,25 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+export enum Code {
+  OK = 0,
+  CANCELLED = 1,
+  UNKNOWN = 2,
+  INVALID_ARGUMENT = 3,
+  DEADLINE_EXCEEDED = 4,
+  NOT_FOUND = 5,
+  ALREADY_EXISTS = 6,
+  PERMISSION_DENIED = 7,
+  UNAUTHENTICATED = 16,
+  RESOURCE_EXHAUSTED = 8,
+  FAILED_PRECONDITION = 9,
+  ABORTED = 10,
+  OUT_OF_RANGE = 11,
+  UNIMPLEMENTED = 12,
+  INTERNAL = 13,
+  UNAVAILABLE = 14,
+  DATA_LOSS = 15,
+}
\ No newline at end of file
diff --git a/frontend/src/api/google/rpc/code.proto b/frontend/src/api/google/rpc/code.proto
new file mode 100644
index 000000000..7c810af40
--- /dev/null
+++ b/frontend/src/api/google/rpc/code.proto
@@ -0,0 +1,186 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.rpc;
+
+option go_package = "google.golang.org/genproto/googleapis/rpc/code;code";
+option java_multiple_files = true;
+option java_outer_classname = "CodeProto";
+option java_package = "com.google.rpc";
+option objc_class_prefix = "RPC";
+
+// The canonical error codes for gRPC APIs.
+//
+//
+// Sometimes multiple error codes may apply.  Services should return
+// the most specific error code that applies.  For example, prefer
+// `OUT_OF_RANGE` over `FAILED_PRECONDITION` if both codes apply.
+// Similarly prefer `NOT_FOUND` or `ALREADY_EXISTS` over `FAILED_PRECONDITION`.
+enum Code {
+  // Not an error; returned on success.
+  //
+  // HTTP Mapping: 200 OK
+  OK = 0;
+
+  // The operation was cancelled, typically by the caller.
+  //
+  // HTTP Mapping: 499 Client Closed Request
+  CANCELLED = 1;
+
+  // Unknown error.  For example, this error may be returned when
+  // a `Status` value received from another address space belongs to
+  // an error space that is not known in this address space.  Also
+  // errors raised by APIs that do not return enough error information
+  // may be converted to this error.
+  //
+  // HTTP Mapping: 500 Internal Server Error
+  UNKNOWN = 2;
+
+  // The client specified an invalid argument.  Note that this differs
+  // from `FAILED_PRECONDITION`.  `INVALID_ARGUMENT` indicates arguments
+  // that are problematic regardless of the state of the system
+  // (e.g., a malformed file name).
+  //
+  // HTTP Mapping: 400 Bad Request
+  INVALID_ARGUMENT = 3;
+
+  // The deadline expired before the operation could complete. For operations
+  // that change the state of the system, this error may be returned
+  // even if the operation has completed successfully.  For example, a
+  // successful response from a server could have been delayed long
+  // enough for the deadline to expire.
+  //
+  // HTTP Mapping: 504 Gateway Timeout
+  DEADLINE_EXCEEDED = 4;
+
+  // Some requested entity (e.g., file or directory) was not found.
+  //
+  // Note to server developers: if a request is denied for an entire class
+  // of users, such as gradual feature rollout or undocumented allowlist,
+  // `NOT_FOUND` may be used. If a request is denied for some users within
+  // a class of users, such as user-based access control, `PERMISSION_DENIED`
+  // must be used.
+  //
+  // HTTP Mapping: 404 Not Found
+  NOT_FOUND = 5;
+
+  // The entity that a client attempted to create (e.g., file or directory)
+  // already exists.
+  //
+  // HTTP Mapping: 409 Conflict
+  ALREADY_EXISTS = 6;
+
+  // The caller does not have permission to execute the specified
+  // operation. `PERMISSION_DENIED` must not be used for rejections
+  // caused by exhausting some resource (use `RESOURCE_EXHAUSTED`
+  // instead for those errors). `PERMISSION_DENIED` must not be
+  // used if the caller can not be identified (use `UNAUTHENTICATED`
+  // instead for those errors). This error code does not imply the
+  // request is valid or the requested entity exists or satisfies
+  // other pre-conditions.
+  //
+  // HTTP Mapping: 403 Forbidden
+  PERMISSION_DENIED = 7;
+
+  // The request does not have valid authentication credentials for the
+  // operation.
+  //
+  // HTTP Mapping: 401 Unauthorized
+  UNAUTHENTICATED = 16;
+
+  // Some resource has been exhausted, perhaps a per-user quota, or
+  // perhaps the entire file system is out of space.
+  //
+  // HTTP Mapping: 429 Too Many Requests
+  RESOURCE_EXHAUSTED = 8;
+
+  // The operation was rejected because the system is not in a state
+  // required for the operation's execution.  For example, the directory
+  // to be deleted is non-empty, an rmdir operation is applied to
+  // a non-directory, etc.
+  //
+  // Service implementors can use the following guidelines to decide
+  // between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`:
+  //  (a) Use `UNAVAILABLE` if the client can retry just the failing call.
+  //  (b) Use `ABORTED` if the client should retry at a higher level. For
+  //      example, when a client-specified test-and-set fails, indicating the
+  //      client should restart a read-modify-write sequence.
+  //  (c) Use `FAILED_PRECONDITION` if the client should not retry until
+  //      the system state has been explicitly fixed. For example, if an "rmdir"
+  //      fails because the directory is non-empty, `FAILED_PRECONDITION`
+  //      should be returned since the client should not retry unless
+  //      the files are deleted from the directory.
+  //
+  // HTTP Mapping: 400 Bad Request
+  FAILED_PRECONDITION = 9;
+
+  // The operation was aborted, typically due to a concurrency issue such as
+  // a sequencer check failure or transaction abort.
+  //
+  // See the guidelines above for deciding between `FAILED_PRECONDITION`,
+  // `ABORTED`, and `UNAVAILABLE`.
+  //
+  // HTTP Mapping: 409 Conflict
+  ABORTED = 10;
+
+  // The operation was attempted past the valid range.  E.g., seeking or
+  // reading past end-of-file.
+  //
+  // Unlike `INVALID_ARGUMENT`, this error indicates a problem that may
+  // be fixed if the system state changes. For example, a 32-bit file
+  // system will generate `INVALID_ARGUMENT` if asked to read at an
+  // offset that is not in the range [0,2^32-1], but it will generate
+  // `OUT_OF_RANGE` if asked to read from an offset past the current
+  // file size.
+  //
+  // There is a fair bit of overlap between `FAILED_PRECONDITION` and
+  // `OUT_OF_RANGE`.  We recommend using `OUT_OF_RANGE` (the more specific
+  // error) when it applies so that callers who are iterating through
+  // a space can easily look for an `OUT_OF_RANGE` error to detect when
+  // they are done.
+  //
+  // HTTP Mapping: 400 Bad Request
+  OUT_OF_RANGE = 11;
+
+  // The operation is not implemented or is not supported/enabled in this
+  // service.
+  //
+  // HTTP Mapping: 501 Not Implemented
+  UNIMPLEMENTED = 12;
+
+  // Internal errors.  This means that some invariants expected by the
+  // underlying system have been broken.  This error code is reserved
+  // for serious errors.
+  //
+  // HTTP Mapping: 500 Internal Server Error
+  INTERNAL = 13;
+
+  // The service is currently unavailable.  This is most likely a
+  // transient condition, which can be corrected by retrying with
+  // a backoff. Note that it is not always safe to retry
+  // non-idempotent operations.
+  //
+  // See the guidelines above for deciding between `FAILED_PRECONDITION`,
+  // `ABORTED`, and `UNAVAILABLE`.
+  //
+  // HTTP Mapping: 503 Service Unavailable
+  UNAVAILABLE = 14;
+
+  // Unrecoverable data loss or corruption.
+  //
+  // HTTP Mapping: 500 Internal Server Error
+  DATA_LOSS = 15;
+}
diff --git a/frontend/src/api/google/rpc/status.pb.ts b/frontend/src/api/google/rpc/status.pb.ts
new file mode 100644
index 000000000..41a0fb74c
--- /dev/null
+++ b/frontend/src/api/google/rpc/status.pb.ts
@@ -0,0 +1,12 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as GoogleProtobufAny from "../protobuf/any.pb"
+export type Status = {
+  code?: number
+  message?: string
+  details?: GoogleProtobufAny.Any[]
+}
\ No newline at end of file
diff --git a/frontend/src/api/google/rpc/status.proto b/frontend/src/api/google/rpc/status.proto
new file mode 100644
index 000000000..923e16938
--- /dev/null
+++ b/frontend/src/api/google/rpc/status.proto
@@ -0,0 +1,49 @@
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.rpc;
+
+import "google/protobuf/any.proto";
+
+option cc_enable_arenas = true;
+option go_package = "google.golang.org/genproto/googleapis/rpc/status;status";
+option java_multiple_files = true;
+option java_outer_classname = "StatusProto";
+option java_package = "com.google.rpc";
+option objc_class_prefix = "RPC";
+
+// The `Status` type defines a logical error model that is suitable for
+// different programming environments, including REST APIs and RPC APIs. It is
+// used by [gRPC](https://github.com/grpc). Each `Status` message contains
+// three pieces of data: error code, error message, and error details.
+//
+// You can find out more about this error model and how to work with it in the
+// [API Design Guide](https://cloud.google.com/apis/design/errors).
+message Status {
+  // The status code, which should be an enum value of
+  // [google.rpc.Code][google.rpc.Code].
+  int32 code = 1;
+
+  // A developer-facing error message, which should be in English. Any
+  // user-facing error message should be localized and sent in the
+  // [google.rpc.Status.details][google.rpc.Status.details] field, or localized
+  // by the client.
+  string message = 2;
+
+  // A list of messages that carry the error details.  There is a common set of
+  // message types for APIs to use.
+  repeated google.protobuf.Any details = 3;
+}
diff --git a/frontend/src/api/grpc.ts b/frontend/src/api/grpc.ts
new file mode 100644
index 000000000..01a9c4b64
--- /dev/null
+++ b/frontend/src/api/grpc.ts
@@ -0,0 +1,251 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import {
+  ResourceService as WrappedResourceService,
+  GetRequest,
+  ListRequest,
+  CreateRequest,
+  UpdateRequest,
+  DeleteRequest,
+  CreateResponse,
+  UpdateResponse,
+  DeleteResponse,
+  WatchRequest,
+  WatchResponse,
+} from '@/api/omni/resources/resources.pb';
+import { Metadata } from '@/api/v1alpha1/resource.pb';
+import { Metadata as TalosMetadata } from "@/api/common/common.pb";
+import { ref, Ref } from 'vue';
+import { Code } from '@/api/google/rpc/code.pb';
+import { fetchOption, NotifyStreamEntityArrival, setCommonFetchOptions } from '@/api/fetch.pb';
+import { withAbortController, withPathPrefix } from '@/api/options';
+
+export const initState = () => {
+  setCommonFetchOptions(
+    withPathPrefix("/api")
+  );
+}
+
+export type RequestContext = {
+  cluster: string,
+  nodes?: string[],
+}
+
+export interface StreamingRequest<R, T> {
+  (req: T, callback: NotifyStreamEntityArrival<R>, ...options: fetchOption[]): Promise<void>
+}
+
+export const subscribe = <R, T>(method: StreamingRequest<R, T>, params: T, handler: NotifyStreamEntityArrival<R>, options?: fetchOption[], onStart?: () => void, onError?: (e: Error) => void, onFinish?: () => void) => {
+  return new Stream(method, params, handler, options, onStart, onError, onFinish);
+}
+
+const delay = (value: number): Promise<void> => {
+  return new Promise<void>((resolve: (value: void | PromiseLike<void>) => void) => {
+    setTimeout(resolve, value)
+  });
+}
+
+export class Stream<R, T> {
+  private stopped: boolean = false;
+  private controller?: AbortController;
+
+  public err: Ref<any> = ref(null);
+
+  constructor(method: StreamingRequest<R, T>, params: T, handler: NotifyStreamEntityArrival<R>, options?: fetchOption[], onStart?: () => void, onError?: (e: Error) => void, onFinish?: () => void) {
+    const opts = options || [];
+    let currentDelay = 0;
+    let retryCount = 0;
+
+    const run = async () => {
+      if (this.stopped) {
+        return;
+      }
+
+      try {
+        this.err.value = null;
+        this.controller = new AbortController();
+
+        const withAbort = opts.concat([withAbortController(this.controller)]);
+
+        if (onStart)
+          onStart();
+
+        const callback = (resp: R) => {
+          if (!resp) {
+            return;
+          }
+
+          // reset backoff delay if anything got received from the stream
+          retryCount = 0;
+
+          const err = resp as { metadata?: TalosMetadata, error?: { code: Code, message?: string } }
+
+          if (err.metadata?.error || err.error) {
+            if (err.error?.code !== Code.CANCELLED && err.error?.code !== Code.INTERNAL) {
+              this.stopped = true;
+            }
+
+            const e = new Error(err.metadata?.error ?? err.error?.message);
+
+            if (onError) {
+              onError(e);
+            } else {
+              console.error("stream error", e)
+            }
+
+            return
+          }
+
+          handler(resp);
+        }
+
+        await method(params, callback, ...withAbort);
+      } catch (e) {
+        if (this.stopped) {
+          return;
+        }
+
+        if (onError) {
+          onError(e.error ?? e);
+        }
+
+        console.error("watch failed", e);
+        throw e.error ? e.error : new Error(e.toString());
+      }
+    }
+
+    (async () => {
+      while (!this.stopped) {
+        try {
+          if (currentDelay > 0) {
+            await delay(currentDelay);
+          }
+
+          await run();
+
+          // break the loop if run ended without any errors
+          break;
+        } catch (e) {
+          if (e.code === Code.INVALID_ARGUMENT || e.code === Code.PERMISSION_DENIED) {
+            return;
+          }
+
+          // max delay 10 seconds
+          currentDelay = Math.min(((Math.pow(2, retryCount) - 1) / 2) * 1000, 10000);
+          // half delay jitter
+          currentDelay = currentDelay / 2 + Math.random() * currentDelay / 2
+
+          retryCount++;
+        }
+      }
+
+      if (onFinish) {
+        onFinish();
+      }
+    })();
+  }
+
+  public shutdown() {
+    this.stopped = true;
+    this.controller?.abort();
+  }
+}
+
+export type Resource<T = any, S = any> = {
+  metadata: Metadata & { name?: string },
+  spec: T,
+  status?: S
+}
+
+export type ResourceTyped<T, S = any> = Resource<S> & {
+  spec: T,
+}
+
+// define a wrapper for grpc resource service.
+export class ResourceService {
+  static async Get<T extends Resource>(request: GetRequest, ...options: fetchOption[]): Promise<T> {
+    const res = await WrappedResourceService.Get(request, ...options);
+
+    checkError(res);
+
+    return JSON.parse(res.body || "{}");
+  }
+
+  static async List<T extends Resource>(request: ListRequest, ...options: fetchOption[]): Promise<T[]> {
+    const res = await WrappedResourceService.List(request, ...options);
+
+    checkError(res);
+
+    const results:T[] = [];
+
+    for (const raw of res.items || []) {
+      results.push(JSON.parse(raw));
+    }
+
+    return results;
+  }
+
+  static async Create<T extends Resource>(resource: ResourceTyped<T>, ...options: fetchOption[]): Promise<CreateResponse> {
+    const request: CreateRequest = {
+      resource: {
+        metadata: resource.metadata,
+        spec: JSON.stringify(resource.spec),
+      }
+    }
+
+    const res = await WrappedResourceService.Create(request, ...options);
+
+    checkError(res);
+
+    return res;
+  }
+
+  static async Update<T extends Resource>(resource: ResourceTyped<T>, currentVersion?: string | number, ...options: fetchOption[]): Promise<UpdateResponse> {
+    resource.metadata.version = (resource.metadata.version || 0)?.toString();
+
+    const request: UpdateRequest = {
+      resource: {
+        metadata: resource.metadata,
+        spec: JSON.stringify(resource.spec),
+      },
+      currentVersion: currentVersion?.toString() || resource.metadata.version,
+    }
+
+    const res = checkError(await WrappedResourceService.Update(request, ...options));
+
+    return res;
+  }
+
+  static async Delete(request: DeleteRequest, ...options: fetchOption[]): Promise<DeleteResponse> {
+    return checkError(await WrappedResourceService.Delete(request, ...options));
+  }
+
+  static async Teardown(request: DeleteRequest, ...options: fetchOption[]): Promise<DeleteResponse> {
+    return checkError(await WrappedResourceService.Teardown(request, ...options));
+  }
+
+  static async Watch(request: WatchRequest, callback: NotifyStreamEntityArrival<WatchResponse>, options?: fetchOption[], onStart?: () => void, onError?: (e: Error) => void): Promise<Stream<WatchRequest, WatchResponse>> {
+    return subscribe(WrappedResourceService.Watch, request, callback, options, onStart, onError);
+  }
+}
+
+export class RequestError extends Error {
+  public code: number = Code.UNKNOWN;
+
+  constructor(response: any) {
+    super(response["message"] || response["code"])
+
+    this.code = response["code"];
+  }
+}
+
+export const checkError = <T>(response: {code?: Code} & T): T => {
+  if(response.code != null) {
+    throw new RequestError(response);
+  }
+
+  return response;
+}
diff --git a/frontend/src/api/omni/auth/auth.pb.ts b/frontend/src/api/omni/auth/auth.pb.ts
new file mode 100644
index 000000000..19f796a22
--- /dev/null
+++ b/frontend/src/api/omni/auth/auth.pb.ts
@@ -0,0 +1,48 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as fm from "../../fetch.pb"
+import * as GoogleProtobufEmpty from "../../google/protobuf/empty.pb"
+export type PublicKey = {
+  pgp_data?: Uint8Array
+  webauthn_data?: Uint8Array
+}
+
+export type Identity = {
+  email?: string
+}
+
+export type RegisterPublicKeyRequest = {
+  public_key?: PublicKey
+  identity?: Identity
+  role?: string
+  skip_user_role?: boolean
+}
+
+export type RegisterPublicKeyResponse = {
+  login_url?: string
+  public_key_id?: string
+}
+
+export type AwaitPublicKeyConfirmationRequest = {
+  public_key_id?: string
+}
+
+export type ConfirmPublicKeyRequest = {
+  public_key_id?: string
+}
+
+export class AuthService {
+  static RegisterPublicKey(req: RegisterPublicKeyRequest, ...options: fm.fetchOption[]): Promise<RegisterPublicKeyResponse> {
+    return fm.fetchReq<RegisterPublicKeyRequest, RegisterPublicKeyResponse>("POST", `/auth.AuthService/RegisterPublicKey`, req, ...options)
+  }
+  static AwaitPublicKeyConfirmation(req: AwaitPublicKeyConfirmationRequest, ...options: fm.fetchOption[]): Promise<GoogleProtobufEmpty.Empty> {
+    return fm.fetchReq<AwaitPublicKeyConfirmationRequest, GoogleProtobufEmpty.Empty>("POST", `/auth.AuthService/AwaitPublicKeyConfirmation`, req, ...options)
+  }
+  static ConfirmPublicKey(req: ConfirmPublicKeyRequest, ...options: fm.fetchOption[]): Promise<GoogleProtobufEmpty.Empty> {
+    return fm.fetchReq<ConfirmPublicKeyRequest, GoogleProtobufEmpty.Empty>("POST", `/auth.AuthService/ConfirmPublicKey`, req, ...options)
+  }
+}
\ No newline at end of file
diff --git a/frontend/src/api/omni/auth/auth.proto b/frontend/src/api/omni/auth/auth.proto
new file mode 100644
index 000000000..35735d290
--- /dev/null
+++ b/frontend/src/api/omni/auth/auth.proto
@@ -0,0 +1,45 @@
+syntax = "proto3";
+package auth;
+
+option go_package = "github.com/siderolabs/go-api-signature/api/auth";
+
+import "google/protobuf/empty.proto";
+
+message PublicKey {
+  bytes pgp_data = 1;
+  bytes webauthn_data = 2;
+}
+
+message Identity {
+  string email = 1;
+}
+
+message RegisterPublicKeyRequest {
+  PublicKey public_key = 1;
+  Identity identity = 2;
+  reserved 3;
+  reserved 4;
+  // The role of the public key. When skip_user_role is true, this field is ignored.
+  string role = 5;
+  // If true, the role field will be used to determine the role of the public key.
+  bool skip_user_role = 6;
+}
+
+message RegisterPublicKeyResponse {
+  string login_url = 1;
+  string public_key_id = 2;
+}
+
+message AwaitPublicKeyConfirmationRequest {
+  string public_key_id = 1;
+}
+
+message ConfirmPublicKeyRequest {
+  string public_key_id = 1;
+}
+
+service AuthService {
+  rpc RegisterPublicKey(RegisterPublicKeyRequest) returns (RegisterPublicKeyResponse);
+  rpc AwaitPublicKeyConfirmation(AwaitPublicKeyConfirmationRequest) returns (google.protobuf.Empty);
+  rpc ConfirmPublicKey(ConfirmPublicKeyRequest) returns (google.protobuf.Empty);
+}
diff --git a/frontend/src/api/omni/config/context.pb.ts b/frontend/src/api/omni/config/context.pb.ts
new file mode 100644
index 000000000..3f587cce5
--- /dev/null
+++ b/frontend/src/api/omni/config/context.pb.ts
@@ -0,0 +1,25 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as fm from "../../fetch.pb"
+export type Context = {
+  name?: string
+  cluster?: string
+}
+
+export type ListContextsRequest = {
+}
+
+export type ListContextsResponse = {
+  current?: string
+  contexts?: Context[]
+}
+
+export class ContextService {
+  static List(req: ListContextsRequest, ...options: fm.fetchOption[]): Promise<ListContextsResponse> {
+    return fm.fetchReq<ListContextsRequest, ListContextsResponse>("POST", `/config.ContextService/List`, req, ...options)
+  }
+}
\ No newline at end of file
diff --git a/frontend/src/api/omni/management/management.pb.ts b/frontend/src/api/omni/management/management.pb.ts
new file mode 100644
index 000000000..899e6933c
--- /dev/null
+++ b/frontend/src/api/omni/management/management.pb.ts
@@ -0,0 +1,160 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as CommonCommon from "../../common/common.pb"
+import * as fm from "../../fetch.pb"
+import * as GoogleProtobufDuration from "../../google/protobuf/duration.pb"
+import * as GoogleProtobufEmpty from "../../google/protobuf/empty.pb"
+import * as GoogleProtobufTimestamp from "../../google/protobuf/timestamp.pb"
+
+export enum KubernetesSyncManifestResponseResponseType {
+  UNKNOWN = 0,
+  MANIFEST = 1,
+  ROLLOUT = 2,
+}
+
+export type KubeconfigResponse = {
+  kubeconfig?: Uint8Array
+}
+
+export type TalosconfigResponse = {
+  talosconfig?: Uint8Array
+}
+
+export type OmniconfigResponse = {
+  omniconfig?: Uint8Array
+}
+
+export type MachineLogsRequest = {
+  machine_id?: string
+  follow?: boolean
+  tail_lines?: number
+}
+
+export type ValidateConfigRequest = {
+  config?: string
+}
+
+export type TalosconfigRequest = {
+  admin?: boolean
+}
+
+export type CreateServiceAccountRequest = {
+  armored_pgp_public_key?: string
+  use_user_role?: boolean
+  role?: string
+}
+
+export type CreateServiceAccountResponse = {
+  public_key_id?: string
+}
+
+export type RenewServiceAccountRequest = {
+  name?: string
+  armored_pgp_public_key?: string
+}
+
+export type RenewServiceAccountResponse = {
+  public_key_id?: string
+}
+
+export type DestroyServiceAccountRequest = {
+  name?: string
+}
+
+export type ListServiceAccountsResponseServiceAccountPgpPublicKey = {
+  id?: string
+  armored?: string
+  expiration?: GoogleProtobufTimestamp.Timestamp
+}
+
+export type ListServiceAccountsResponseServiceAccount = {
+  name?: string
+  pgp_public_keys?: ListServiceAccountsResponseServiceAccountPgpPublicKey[]
+  role?: string
+}
+
+export type ListServiceAccountsResponse = {
+  service_accounts?: ListServiceAccountsResponseServiceAccount[]
+}
+
+export type KubeconfigRequest = {
+  service_account?: boolean
+  service_account_ttl?: GoogleProtobufDuration.Duration
+  service_account_user?: string
+  service_account_groups?: string[]
+}
+
+export type KubernetesUpgradePreChecksRequest = {
+  new_version?: string
+}
+
+export type KubernetesUpgradePreChecksResponse = {
+  ok?: boolean
+  reason?: string
+}
+
+export type KubernetesSyncManifestRequest = {
+  dry_run?: boolean
+}
+
+export type KubernetesSyncManifestResponse = {
+  response_type?: KubernetesSyncManifestResponseResponseType
+  path?: string
+  object?: Uint8Array
+  diff?: string
+  skipped?: boolean
+}
+
+export type CreateSchematicRequest = {
+  extensions?: string[]
+  extra_kernel_args?: string[]
+  meta_values?: {[key: number]: string}
+}
+
+export type CreateSchematicResponse = {
+  schematic_id?: string
+  pxe_url?: string
+}
+
+export class ManagementService {
+  static Kubeconfig(req: KubeconfigRequest, ...options: fm.fetchOption[]): Promise<KubeconfigResponse> {
+    return fm.fetchReq<KubeconfigRequest, KubeconfigResponse>("POST", `/management.ManagementService/Kubeconfig`, req, ...options)
+  }
+  static Talosconfig(req: TalosconfigRequest, ...options: fm.fetchOption[]): Promise<TalosconfigResponse> {
+    return fm.fetchReq<TalosconfigRequest, TalosconfigResponse>("POST", `/management.ManagementService/Talosconfig`, req, ...options)
+  }
+  static Omniconfig(req: GoogleProtobufEmpty.Empty, ...options: fm.fetchOption[]): Promise<OmniconfigResponse> {
+    return fm.fetchReq<GoogleProtobufEmpty.Empty, OmniconfigResponse>("POST", `/management.ManagementService/Omniconfig`, req, ...options)
+  }
+  static MachineLogs(req: MachineLogsRequest, entityNotifier?: fm.NotifyStreamEntityArrival<CommonCommon.Data>, ...options: fm.fetchOption[]): Promise<void> {
+    return fm.fetchStreamingRequest<MachineLogsRequest, CommonCommon.Data>("POST", `/management.ManagementService/MachineLogs`, req, entityNotifier, ...options)
+  }
+  static ValidateConfig(req: ValidateConfigRequest, ...options: fm.fetchOption[]): Promise<GoogleProtobufEmpty.Empty> {
+    return fm.fetchReq<ValidateConfigRequest, GoogleProtobufEmpty.Empty>("POST", `/management.ManagementService/ValidateConfig`, req, ...options)
+  }
+  static CreateServiceAccount(req: CreateServiceAccountRequest, ...options: fm.fetchOption[]): Promise<CreateServiceAccountResponse> {
+    return fm.fetchReq<CreateServiceAccountRequest, CreateServiceAccountResponse>("POST", `/management.ManagementService/CreateServiceAccount`, req, ...options)
+  }
+  static RenewServiceAccount(req: RenewServiceAccountRequest, ...options: fm.fetchOption[]): Promise<RenewServiceAccountResponse> {
+    return fm.fetchReq<RenewServiceAccountRequest, RenewServiceAccountResponse>("POST", `/management.ManagementService/RenewServiceAccount`, req, ...options)
+  }
+  static ListServiceAccounts(req: GoogleProtobufEmpty.Empty, ...options: fm.fetchOption[]): Promise<ListServiceAccountsResponse> {
+    return fm.fetchReq<GoogleProtobufEmpty.Empty, ListServiceAccountsResponse>("POST", `/management.ManagementService/ListServiceAccounts`, req, ...options)
+  }
+  static DestroyServiceAccount(req: DestroyServiceAccountRequest, ...options: fm.fetchOption[]): Promise<GoogleProtobufEmpty.Empty> {
+    return fm.fetchReq<DestroyServiceAccountRequest, GoogleProtobufEmpty.Empty>("POST", `/management.ManagementService/DestroyServiceAccount`, req, ...options)
+  }
+  static KubernetesUpgradePreChecks(req: KubernetesUpgradePreChecksRequest, ...options: fm.fetchOption[]): Promise<KubernetesUpgradePreChecksResponse> {
+    return fm.fetchReq<KubernetesUpgradePreChecksRequest, KubernetesUpgradePreChecksResponse>("POST", `/management.ManagementService/KubernetesUpgradePreChecks`, req, ...options)
+  }
+  static KubernetesSyncManifests(req: KubernetesSyncManifestRequest, entityNotifier?: fm.NotifyStreamEntityArrival<KubernetesSyncManifestResponse>, ...options: fm.fetchOption[]): Promise<void> {
+    return fm.fetchStreamingRequest<KubernetesSyncManifestRequest, KubernetesSyncManifestResponse>("POST", `/management.ManagementService/KubernetesSyncManifests`, req, entityNotifier, ...options)
+  }
+  static CreateSchematic(req: CreateSchematicRequest, ...options: fm.fetchOption[]): Promise<CreateSchematicResponse> {
+    return fm.fetchReq<CreateSchematicRequest, CreateSchematicResponse>("POST", `/management.ManagementService/CreateSchematic`, req, ...options)
+  }
+}
\ No newline at end of file
diff --git a/frontend/src/api/omni/oidc/oidc.pb.ts b/frontend/src/api/omni/oidc/oidc.pb.ts
new file mode 100644
index 000000000..1bb9bb2db
--- /dev/null
+++ b/frontend/src/api/omni/oidc/oidc.pb.ts
@@ -0,0 +1,20 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as fm from "../../fetch.pb"
+export type AuthenticateRequest = {
+  auth_request_id?: string
+}
+
+export type AuthenticateResponse = {
+  redirect_url?: string
+}
+
+export class OIDCService {
+  static Authenticate(req: AuthenticateRequest, ...options: fm.fetchOption[]): Promise<AuthenticateResponse> {
+    return fm.fetchReq<AuthenticateRequest, AuthenticateResponse>("POST", `/oidc.OIDCService/Authenticate`, req, ...options)
+  }
+}
\ No newline at end of file
diff --git a/frontend/src/api/omni/resources/resources.pb.ts b/frontend/src/api/omni/resources/resources.pb.ts
new file mode 100644
index 000000000..8787c585d
--- /dev/null
+++ b/frontend/src/api/omni/resources/resources.pb.ts
@@ -0,0 +1,119 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as fm from "../../fetch.pb"
+import * as CosiResourceResource from "../../v1alpha1/resource.pb"
+
+export enum EventType {
+  UNKNOWN = 0,
+  CREATED = 1,
+  UPDATED = 2,
+  DESTROYED = 3,
+  BOOTSTRAPPED = 4,
+}
+
+export type Resource = {
+  metadata?: CosiResourceResource.Metadata
+  spec?: string
+}
+
+export type GetRequest = {
+  namespace?: string
+  type?: string
+  id?: string
+}
+
+export type GetResponse = {
+  body?: string
+}
+
+export type ListRequest = {
+  namespace?: string
+  type?: string
+  offset?: number
+  limit?: number
+  sort_by_field?: string
+  sort_descending?: boolean
+  search_for?: string[]
+}
+
+export type ListResponse = {
+  items?: string[]
+  total?: number
+}
+
+export type Event = {
+  resource?: string
+  old?: string
+  event_type?: EventType
+}
+
+export type WatchRequest = {
+  namespace?: string
+  type?: string
+  id?: string
+  tail_events?: number
+  offset?: number
+  limit?: number
+  sort_by_field?: string
+  sort_descending?: boolean
+  search_for?: string[]
+}
+
+export type WatchResponse = {
+  event?: Event
+  total?: number
+  sort_field_data?: string
+  sort_descending?: boolean
+}
+
+export type CreateRequest = {
+  resource?: Resource
+}
+
+export type CreateResponse = {
+}
+
+export type UpdateRequest = {
+  currentVersion?: string
+  resource?: Resource
+}
+
+export type UpdateResponse = {
+}
+
+export type DeleteRequest = {
+  namespace?: string
+  type?: string
+  id?: string
+}
+
+export type DeleteResponse = {
+}
+
+export class ResourceService {
+  static Get(req: GetRequest, ...options: fm.fetchOption[]): Promise<GetResponse> {
+    return fm.fetchReq<GetRequest, GetResponse>("POST", `/omni.resources.ResourceService/Get`, req, ...options)
+  }
+  static List(req: ListRequest, ...options: fm.fetchOption[]): Promise<ListResponse> {
+    return fm.fetchReq<ListRequest, ListResponse>("POST", `/omni.resources.ResourceService/List`, req, ...options)
+  }
+  static Create(req: CreateRequest, ...options: fm.fetchOption[]): Promise<CreateResponse> {
+    return fm.fetchReq<CreateRequest, CreateResponse>("POST", `/omni.resources.ResourceService/Create`, req, ...options)
+  }
+  static Update(req: UpdateRequest, ...options: fm.fetchOption[]): Promise<UpdateResponse> {
+    return fm.fetchReq<UpdateRequest, UpdateResponse>("POST", `/omni.resources.ResourceService/Update`, req, ...options)
+  }
+  static Delete(req: DeleteRequest, ...options: fm.fetchOption[]): Promise<DeleteResponse> {
+    return fm.fetchReq<DeleteRequest, DeleteResponse>("POST", `/omni.resources.ResourceService/Delete`, req, ...options)
+  }
+  static Teardown(req: DeleteRequest, ...options: fm.fetchOption[]): Promise<DeleteResponse> {
+    return fm.fetchReq<DeleteRequest, DeleteResponse>("POST", `/omni.resources.ResourceService/Teardown`, req, ...options)
+  }
+  static Watch(req: WatchRequest, entityNotifier?: fm.NotifyStreamEntityArrival<WatchResponse>, ...options: fm.fetchOption[]): Promise<void> {
+    return fm.fetchStreamingRequest<WatchRequest, WatchResponse>("POST", `/omni.resources.ResourceService/Watch`, req, entityNotifier, ...options)
+  }
+}
\ No newline at end of file
diff --git a/frontend/src/api/omni/specs/auth.pb.ts b/frontend/src/api/omni/specs/auth.pb.ts
new file mode 100644
index 000000000..4dd1cd08a
--- /dev/null
+++ b/frontend/src/api/omni/specs/auth.pb.ts
@@ -0,0 +1,134 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as GoogleProtobufTimestamp from "../../google/protobuf/timestamp.pb"
+export type AuthConfigSpecAuth0 = {
+  enabled?: boolean
+  domain?: string
+  client_id?: string
+}
+
+export type AuthConfigSpecWebauthn = {
+  enabled?: boolean
+  required?: boolean
+}
+
+export type AuthConfigSpecSAML = {
+  enabled?: boolean
+  url?: string
+  metadata?: string
+  label_rules?: {[key: string]: string}
+}
+
+export type AuthConfigSpec = {
+  auth0?: AuthConfigSpecAuth0
+  webauthn?: AuthConfigSpecWebauthn
+  suspended?: boolean
+  saml?: AuthConfigSpecSAML
+}
+
+export type SAMLAssertionSpec = {
+  data?: Uint8Array
+  email?: string
+  used?: boolean
+}
+
+export type UserSpec = {
+  scopes?: string[]
+  role?: string
+}
+
+export type IdentitySpec = {
+  user_id?: string
+}
+
+export type Identity = {
+  email?: string
+}
+
+export type PublicKeySpec = {
+  public_key?: Uint8Array
+  scopes?: string[]
+  expiration?: GoogleProtobufTimestamp.Timestamp
+  confirmed?: boolean
+  identity?: Identity
+  role?: string
+}
+
+export type AccessPolicyUserGroupUser = {
+  name?: string
+  match?: string
+  label_selectors?: string[]
+}
+
+export type AccessPolicyUserGroup = {
+  users?: AccessPolicyUserGroupUser[]
+}
+
+export type AccessPolicyClusterGroupCluster = {
+  name?: string
+  match?: string
+}
+
+export type AccessPolicyClusterGroup = {
+  clusters?: AccessPolicyClusterGroupCluster[]
+}
+
+export type AccessPolicyRuleKubernetesImpersonate = {
+  groups?: string[]
+}
+
+export type AccessPolicyRuleKubernetes = {
+  impersonate?: AccessPolicyRuleKubernetesImpersonate
+}
+
+export type AccessPolicyRule = {
+  users?: string[]
+  clusters?: string[]
+  kubernetes?: AccessPolicyRuleKubernetes
+  role?: string
+}
+
+export type AccessPolicyTestExpectedKubernetesImpersonate = {
+  groups?: string[]
+}
+
+export type AccessPolicyTestExpectedKubernetes = {
+  impersonate?: AccessPolicyTestExpectedKubernetesImpersonate
+}
+
+export type AccessPolicyTestExpected = {
+  kubernetes?: AccessPolicyTestExpectedKubernetes
+  role?: string
+}
+
+export type AccessPolicyTestUser = {
+  name?: string
+  labels?: {[key: string]: string}
+}
+
+export type AccessPolicyTestCluster = {
+  name?: string
+}
+
+export type AccessPolicyTest = {
+  name?: string
+  user?: AccessPolicyTestUser
+  cluster?: AccessPolicyTestCluster
+  expected?: AccessPolicyTestExpected
+}
+
+export type AccessPolicySpec = {
+  user_groups?: {[key: string]: AccessPolicyUserGroup}
+  cluster_groups?: {[key: string]: AccessPolicyClusterGroup}
+  rules?: AccessPolicyRule[]
+  tests?: AccessPolicyTest[]
+}
+
+export type SAMLLabelRuleSpec = {
+  match_labels?: string[]
+  assign_role_on_registration?: string
+}
\ No newline at end of file
diff --git a/frontend/src/api/omni/specs/ephemeral.pb.ts b/frontend/src/api/omni/specs/ephemeral.pb.ts
new file mode 100644
index 000000000..70f85462f
--- /dev/null
+++ b/frontend/src/api/omni/specs/ephemeral.pb.ts
@@ -0,0 +1,13 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as SpecsOmni from "./omni.pb"
+import * as SpecsSiderolink from "./siderolink.pb"
+export type MachineStatusLinkSpec = {
+  message_status?: SpecsOmni.MachineStatusSpec
+  siderolink_counter?: SpecsSiderolink.SiderolinkCounterSpec
+  machine_created_at?: string
+}
\ No newline at end of file
diff --git a/frontend/src/api/omni/specs/omni.pb.ts b/frontend/src/api/omni/specs/omni.pb.ts
new file mode 100644
index 000000000..b887cee81
--- /dev/null
+++ b/frontend/src/api/omni/specs/omni.pb.ts
@@ -0,0 +1,622 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as GoogleProtobufDuration from "../../google/protobuf/duration.pb"
+import * as GoogleProtobufTimestamp from "../../google/protobuf/timestamp.pb"
+import * as MachineMachine from "../../talos/machine/machine.pb"
+
+type Absent<T, K extends keyof T> = { [k in Exclude<keyof T, K>]?: undefined };
+type OneOf<T> =
+  | { [k in keyof T]?: undefined }
+  | (
+    keyof T extends infer K ?
+      (K extends string & keyof T ? { [k in K]: T[K] } & Absent<T, K>
+        : never)
+    : never);
+
+export enum ConfigApplyStatus {
+  UNKNOWN = 0,
+  PENDING = 1,
+  APPLIED = 2,
+  FAILED = 3,
+}
+
+export enum MachineSetPhase {
+  Unknown = 0,
+  ScalingUp = 1,
+  ScalingDown = 2,
+  Running = 3,
+  Destroying = 4,
+  Failed = 5,
+  Reconfiguring = 6,
+}
+
+export enum ConditionType {
+  UnknownCondition = 0,
+  Etcd = 1,
+  WireguardConnection = 2,
+}
+
+export enum MachineStatusSpecRole {
+  NONE = 0,
+  CONTROL_PLANE = 1,
+  WORKER = 2,
+}
+
+export enum EtcdBackupStatusSpecStatus {
+  Unknown = 0,
+  Ok = 1,
+  Error = 2,
+  Running = 3,
+}
+
+export enum ClusterMachineStatusSpecStage {
+  UNKNOWN = 0,
+  BOOTING = 1,
+  INSTALLING = 2,
+  UPGRADING = 6,
+  CONFIGURING = 3,
+  RUNNING = 4,
+  REBOOTING = 7,
+  SHUTTING_DOWN = 8,
+  BEFORE_DESTROY = 9,
+  DESTROYING = 5,
+}
+
+export enum ClusterStatusSpecPhase {
+  UNKNOWN = 0,
+  SCALING_UP = 1,
+  SCALING_DOWN = 2,
+  RUNNING = 3,
+  DESTROYING = 4,
+}
+
+export enum MachineSetSpecUpdateStrategy {
+  Unset = 0,
+  Rolling = 1,
+}
+
+export enum MachineSetSpecMachineClassAllocationType {
+  Static = 0,
+  Unlimited = 1,
+}
+
+export enum TalosUpgradeStatusSpecPhase {
+  Unknown = 0,
+  Upgrading = 1,
+  Done = 2,
+  Failed = 3,
+  Reverting = 4,
+}
+
+export enum ControlPlaneStatusSpecConditionStatus {
+  Unknown = 0,
+  Ready = 1,
+  NotReady = 2,
+}
+
+export enum ControlPlaneStatusSpecConditionSeverity {
+  Info = 0,
+  Warning = 1,
+  Error = 2,
+}
+
+export enum KubernetesUpgradeStatusSpecPhase {
+  Unknown = 0,
+  Upgrading = 1,
+  Done = 2,
+  Failed = 3,
+  Reverting = 4,
+}
+
+export enum SchematicConfigurationSpecTarget {
+  Unknown = 0,
+  ClusterMachine = 1,
+  MachineSet = 2,
+  Cluster = 3,
+}
+
+export type MachineSpec = {
+  management_address?: string
+  connected?: boolean
+}
+
+export type MachineStatusSpecHardwareStatusProcessor = {
+  core_count?: number
+  thread_count?: number
+  frequency?: number
+  description?: string
+  manufacturer?: string
+}
+
+export type MachineStatusSpecHardwareStatusMemoryModule = {
+  size_mb?: number
+  description?: string
+}
+
+export type MachineStatusSpecHardwareStatusBlockDevice = {
+  size?: string
+  model?: string
+  linux_name?: string
+  name?: string
+  serial?: string
+  uuid?: string
+  wwid?: string
+  type?: string
+  bus_path?: string
+  system_disk?: boolean
+}
+
+export type MachineStatusSpecHardwareStatus = {
+  processors?: MachineStatusSpecHardwareStatusProcessor[]
+  memory_modules?: MachineStatusSpecHardwareStatusMemoryModule[]
+  blockdevices?: MachineStatusSpecHardwareStatusBlockDevice[]
+  arch?: string
+}
+
+export type MachineStatusSpecNetworkStatusNetworkLinkStatus = {
+  linux_name?: string
+  hardware_address?: string
+  speed_mbps?: number
+  link_up?: boolean
+  description?: string
+}
+
+export type MachineStatusSpecNetworkStatus = {
+  hostname?: string
+  domainname?: string
+  addresses?: string[]
+  default_gateways?: string[]
+  network_links?: MachineStatusSpecNetworkStatusNetworkLinkStatus[]
+}
+
+export type MachineStatusSpecPlatformMetadata = {
+  platform?: string
+  hostname?: string
+  region?: string
+  zone?: string
+  instance_type?: string
+  instance_id?: string
+  provider_id?: string
+  spot?: boolean
+}
+
+export type MachineStatusSpecSchematic = {
+  id?: string
+  invalid?: boolean
+}
+
+export type MachineStatusSpec = {
+  talos_version?: string
+  hardware?: MachineStatusSpecHardwareStatus
+  network?: MachineStatusSpecNetworkStatus
+  last_error?: string
+  management_address?: string
+  connected?: boolean
+  maintenance?: boolean
+  cluster?: string
+  role?: MachineStatusSpecRole
+  platform_metadata?: MachineStatusSpecPlatformMetadata
+  image_labels?: {[key: string]: string}
+  schematic?: MachineStatusSpecSchematic
+}
+
+export type TalosConfigSpec = {
+  ca?: string
+  crt?: string
+  key?: string
+}
+
+export type ClusterSpecFeatures = {
+  enable_workload_proxy?: boolean
+  disk_encryption?: boolean
+}
+
+export type ClusterSpec = {
+  install_image?: string
+  kubernetes_version?: string
+  talos_version?: string
+  features?: ClusterSpecFeatures
+  backup_configuration?: EtcdBackupConf
+}
+
+export type EtcdBackupConf = {
+  interval?: GoogleProtobufDuration.Duration
+  enabled?: boolean
+}
+
+export type EtcdBackupEncryptionSpec = {
+  encryption_key?: Uint8Array
+}
+
+export type EtcdBackupHeader = {
+  version?: string
+}
+
+export type EtcdBackupSpec = {
+  created_at?: GoogleProtobufTimestamp.Timestamp
+  snapshot?: string
+  size?: string
+}
+
+export type BackupDataSpec = {
+  interval?: GoogleProtobufDuration.Duration
+  cluster_uuid?: string
+  encryption_key?: Uint8Array
+  aes_cbc_encryption_secret?: string
+  secretbox_encryption_secret?: string
+}
+
+export type EtcdBackupS3ConfSpec = {
+  bucket?: string
+  region?: string
+  endpoint?: string
+  access_key_id?: string
+  secret_access_key?: string
+  session_token?: string
+}
+
+export type EtcdBackupStatusSpec = {
+  status?: EtcdBackupStatusSpecStatus
+  error?: string
+  last_backup_time?: GoogleProtobufTimestamp.Timestamp
+  last_backup_attempt?: GoogleProtobufTimestamp.Timestamp
+}
+
+export type EtcdManualBackupSpec = {
+  backup_at?: GoogleProtobufTimestamp.Timestamp
+}
+
+export type EtcdBackupStoreStatusSpec = {
+  configuration_name?: string
+  configuration_error?: string
+}
+
+export type EtcdBackupOverallStatusSpec = {
+  configuration_name?: string
+  configuration_error?: string
+  last_backup_status?: EtcdBackupStatusSpec
+}
+
+export type ClusterMachineSpec = {
+  kubernetes_version?: string
+}
+
+export type ClusterMachineConfigPatchesSpec = {
+  patches?: string[]
+}
+
+export type ClusterMachineTalosVersionSpec = {
+  talos_version?: string
+  schematic_id?: string
+}
+
+export type ClusterMachineConfigSpec = {
+  data?: Uint8Array
+  cluster_machine_version?: string
+  generation_error?: string
+}
+
+export type RedactedClusterMachineConfigSpec = {
+  data?: string
+}
+
+export type ClusterMachineIdentitySpec = {
+  node_identity?: string
+  etcd_member_id?: string
+  nodename?: string
+  node_ips?: string[]
+}
+
+export type ClusterMachineTemplateSpec = {
+  install_image?: string
+  kubernetes_version?: string
+  install_disk?: string
+  patch?: string
+}
+
+export type ClusterMachineStatusSpec = {
+  ready?: boolean
+  stage?: ClusterMachineStatusSpecStage
+  apid_available?: boolean
+  config_up_to_date?: boolean
+  last_config_error?: string
+  management_address?: string
+  config_apply_status?: ConfigApplyStatus
+}
+
+export type Machines = {
+  total?: number
+  healthy?: number
+  connected?: number
+  requested?: number
+}
+
+export type ClusterStatusSpec = {
+  available?: boolean
+  machines?: Machines
+  phase?: ClusterStatusSpecPhase
+  ready?: boolean
+  kubernetesAPIReady?: boolean
+  controlplaneReady?: boolean
+  has_connected_control_planes?: boolean
+}
+
+export type ClusterUUID = {
+  uuid?: string
+}
+
+export type ClusterConfigVersionSpec = {
+  version?: string
+}
+
+export type ClusterMachineConfigStatusSpec = {
+  cluster_machine_config_version?: string
+  cluster_machine_version?: string
+  cluster_machine_config_sha256?: string
+  last_config_error?: string
+  talos_version?: string
+  schematic_id?: string
+}
+
+export type ClusterBootstrapStatusSpec = {
+  bootstrapped?: boolean
+}
+
+export type ClusterSecretsSpec = {
+  data?: Uint8Array
+}
+
+export type LoadBalancerConfigSpec = {
+  bind_port?: string
+  siderolink_endpoint?: string
+  endpoints?: string[]
+}
+
+export type LoadBalancerStatusSpec = {
+  healthy?: boolean
+  stopped?: boolean
+}
+
+export type KubernetesVersionSpec = {
+  version?: string
+}
+
+export type TalosVersionSpec = {
+  version?: string
+  compatible_kubernetes_versions?: string[]
+}
+
+export type InstallationMediaSpec = {
+  name?: string
+  architecture?: string
+  profile?: string
+  contentType?: string
+  src_file_prefix?: string
+  dest_file_prefix?: string
+  extension?: string
+  no_secure_boot?: boolean
+}
+
+export type ConfigPatchSpec = {
+  data?: string
+}
+
+export type MachineSetSpecMachineClass = {
+  name?: string
+  machine_count?: number
+  allocation_type?: MachineSetSpecMachineClassAllocationType
+}
+
+export type MachineSetSpecBootstrapSpec = {
+  cluster_uuid?: string
+  snapshot?: string
+}
+
+export type MachineSetSpecRollingUpdateStrategyConfig = {
+  max_parallelism?: number
+}
+
+export type MachineSetSpecUpdateStrategyConfig = {
+  rolling?: MachineSetSpecRollingUpdateStrategyConfig
+}
+
+export type MachineSetSpec = {
+  update_strategy?: MachineSetSpecUpdateStrategy
+  machine_class?: MachineSetSpecMachineClass
+  bootstrap_spec?: MachineSetSpecBootstrapSpec
+  delete_strategy?: MachineSetSpecUpdateStrategy
+  update_strategy_config?: MachineSetSpecUpdateStrategyConfig
+  delete_strategy_config?: MachineSetSpecUpdateStrategyConfig
+}
+
+export type TalosUpgradeStatusSpec = {
+  phase?: TalosUpgradeStatusSpecPhase
+  error?: string
+  step?: string
+  status?: string
+  last_upgrade_version?: string
+  current_upgrade_version?: string
+  upgrade_versions?: string[]
+}
+
+export type MachineSetStatusSpec = {
+  phase?: MachineSetPhase
+  ready?: boolean
+  error?: string
+  machines?: Machines
+  config_hash?: string
+  machine_class?: MachineSetSpecMachineClass
+}
+
+export type MachineSetNodeSpec = {
+}
+
+export type MachineLabelsSpec = {
+}
+
+export type MachineStatusSnapshotSpec = {
+  machine_status?: MachineMachine.MachineStatusEvent
+}
+
+export type ControlPlaneStatusSpecCondition = {
+  type?: ConditionType
+  reason?: string
+  status?: ControlPlaneStatusSpecConditionStatus
+  severity?: ControlPlaneStatusSpecConditionSeverity
+}
+
+export type ControlPlaneStatusSpec = {
+  conditions?: ControlPlaneStatusSpecCondition[]
+}
+
+export type ClusterEndpointSpec = {
+  management_addresses?: string[]
+}
+
+export type KubernetesStatusSpecNodeStatus = {
+  nodename?: string
+  kubelet_version?: string
+  ready?: boolean
+}
+
+export type KubernetesStatusSpecStaticPodStatus = {
+  app?: string
+  version?: string
+  ready?: boolean
+}
+
+export type KubernetesStatusSpecNodeStaticPods = {
+  nodename?: string
+  static_pods?: KubernetesStatusSpecStaticPodStatus[]
+}
+
+export type KubernetesStatusSpec = {
+  nodes?: KubernetesStatusSpecNodeStatus[]
+  static_pods?: KubernetesStatusSpecNodeStaticPods[]
+}
+
+export type KubernetesUpgradeStatusSpec = {
+  phase?: KubernetesUpgradeStatusSpecPhase
+  error?: string
+  step?: string
+  status?: string
+  last_upgrade_version?: string
+  current_upgrade_version?: string
+  upgrade_versions?: string[]
+}
+
+export type KubernetesUpgradeManifestStatusSpec = {
+  out_of_sync?: number
+  last_fatal_error?: string
+}
+
+export type DestroyStatusSpec = {
+  phase?: string
+}
+
+
+type BaseOngoingTaskSpec = {
+  title?: string
+}
+
+export type OngoingTaskSpec = BaseOngoingTaskSpec
+  & OneOf<{ talos_upgrade: TalosUpgradeStatusSpec; kubernetes_upgrade: KubernetesUpgradeStatusSpec; destroy: DestroyStatusSpec }>
+
+export type ClusterMachineEncryptionKeySpec = {
+  data?: Uint8Array
+}
+
+export type ExposedServiceSpec = {
+  port?: number
+  label?: string
+  icon_base64?: string
+}
+
+export type FeaturesConfigSpec = {
+  enable_workload_proxying?: boolean
+  etcd_backup_settings?: EtcdBackupSettings
+}
+
+export type EtcdBackupSettings = {
+  tick_interval?: GoogleProtobufDuration.Duration
+  min_interval?: GoogleProtobufDuration.Duration
+  max_interval?: GoogleProtobufDuration.Duration
+}
+
+export type MachineClassSpec = {
+  match_labels?: string[]
+}
+
+export type MachineConfigGenOptionsSpec = {
+  install_disk?: string
+}
+
+export type EtcdAuditResultSpec = {
+  etcd_member_ids?: string[]
+}
+
+export type KubeconfigSpec = {
+  data?: Uint8Array
+}
+
+export type KubernetesUsageSpecQuantity = {
+  requests?: number
+  limits?: number
+  capacity?: number
+}
+
+export type KubernetesUsageSpecPod = {
+  count?: number
+  capacity?: number
+}
+
+export type KubernetesUsageSpec = {
+  cpu?: KubernetesUsageSpecQuantity
+  mem?: KubernetesUsageSpecQuantity
+  storage?: KubernetesUsageSpecQuantity
+  pods?: KubernetesUsageSpecPod
+}
+
+export type ImagePullRequestSpecNodeImageList = {
+  node?: string
+  images?: string[]
+}
+
+export type ImagePullRequestSpec = {
+  node_image_list?: ImagePullRequestSpecNodeImageList[]
+}
+
+export type ImagePullStatusSpec = {
+  last_processed_node?: string
+  last_processed_image?: string
+  last_processed_error?: string
+  processed_count?: number
+  total_count?: number
+  request_version?: string
+}
+
+export type SchematicSpec = {
+  extensions?: string[]
+}
+
+export type TalosExtensionsSpecInfo = {
+  name?: string
+  author?: string
+  version?: string
+  description?: string
+  ref?: string
+  digest?: string
+}
+
+export type TalosExtensionsSpec = {
+  items?: TalosExtensionsSpecInfo[]
+}
+
+export type SchematicConfigurationSpec = {
+  schematic_id?: string
+  target?: SchematicConfigurationSpecTarget
+}
\ No newline at end of file
diff --git a/frontend/src/api/omni/specs/siderolink.pb.ts b/frontend/src/api/omni/specs/siderolink.pb.ts
new file mode 100644
index 000000000..59b96f1da
--- /dev/null
+++ b/frontend/src/api/omni/specs/siderolink.pb.ts
@@ -0,0 +1,36 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as GoogleProtobufTimestamp from "../../google/protobuf/timestamp.pb"
+export type SiderolinkConfigSpec = {
+  private_key?: string
+  public_key?: string
+  wireguard_endpoint?: string
+  subnet?: string
+  server_address?: string
+  join_token?: string
+  advertised_endpoint?: string
+}
+
+export type SiderolinkSpec = {
+  node_subnet?: string
+  node_public_key?: string
+  last_endpoint?: string
+  connected?: boolean
+}
+
+export type SiderolinkCounterSpec = {
+  bytes_received?: string
+  bytes_sent?: string
+  last_alive?: GoogleProtobufTimestamp.Timestamp
+}
+
+export type ConnectionParamsSpec = {
+  args?: string
+  api_endpoint?: string
+  wireguard_endpoint?: string
+  join_token?: string
+}
\ No newline at end of file
diff --git a/frontend/src/api/omni/specs/system.pb.ts b/frontend/src/api/omni/specs/system.pb.ts
new file mode 100644
index 000000000..2188a5c7d
--- /dev/null
+++ b/frontend/src/api/omni/specs/system.pb.ts
@@ -0,0 +1,17 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+export type DBVersionSpec = {
+  version?: string
+}
+
+export type SysVersionSpec = {
+  backend_version?: string
+  instance_name?: string
+  backend_api_version?: number
+}
+
+export type CertRefreshTickSpec = {
+}
\ No newline at end of file
diff --git a/frontend/src/api/omni/specs/virtual.pb.ts b/frontend/src/api/omni/specs/virtual.pb.ts
new file mode 100644
index 000000000..4206b0d3d
--- /dev/null
+++ b/frontend/src/api/omni/specs/virtual.pb.ts
@@ -0,0 +1,35 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+export type CurrentUserSpec = {
+  identity?: string
+  role?: string
+}
+
+export type PermissionsSpec = {
+  can_read_clusters?: boolean
+  can_create_clusters?: boolean
+  can_manage_users?: boolean
+  can_read_machines?: boolean
+  can_remove_machines?: boolean
+  can_read_machine_logs?: boolean
+  can_read_machine_config_patches?: boolean
+  can_manage_machine_config_patches?: boolean
+  can_manage_backup_store?: boolean
+}
+
+export type ClusterPermissionsSpec = {
+  can_add_machines?: boolean
+  can_remove_machines?: boolean
+  can_reboot_machines?: boolean
+  can_update_kubernetes?: boolean
+  can_download_kubeconfig?: boolean
+  can_sync_kubernetes_manifests?: boolean
+  can_update_talos?: boolean
+  can_download_talosconfig?: boolean
+  can_read_config_patches?: boolean
+  can_manage_config_patches?: boolean
+  can_manage_cluster_features?: boolean
+}
\ No newline at end of file
diff --git a/frontend/src/api/options.ts b/frontend/src/api/options.ts
new file mode 100644
index 000000000..926eadadc
--- /dev/null
+++ b/frontend/src/api/options.ts
@@ -0,0 +1,97 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { clusterName } from "@/context";
+import { Runtime } from "./common/omni.pb";
+import { RequestOptions } from "./fetch.pb";
+import { WatchContext } from "./watch";
+
+export type GRPCMetadata = Record<string, string | string[]>;
+
+const runtimeMap: Record<Runtime, string> = {
+  [Runtime.Kubernetes]: "Kubernetes",
+  [Runtime.Talos]: "Talos",
+  [Runtime.Omni]: "Omni",
+};
+
+export const withAbortController = (controller: AbortController) => {
+  return (req: RequestOptions) => {
+    req.controller = controller;
+    req.signal = controller.signal;
+  }
+}
+
+export const withPathPrefix = (prefix: string) => {
+  return (req: RequestOptions) => {
+    if (!req.url.startsWith(prefix)) {
+      req.url = `${prefix}${req.url}`;
+    }
+  };
+}
+
+export const withRuntime = (runtime: Runtime) => {
+  return (req: RequestOptions) => {
+    addMetadata(req, {runtime: runtimeMap[runtime]});
+  };
+}
+
+export const withMetadata = (metadata: GRPCMetadata) => {
+  return (req: RequestOptions) => {
+    addMetadata(req, metadata);
+  };
+}
+
+export const withSelectors = (selectors: string[]) => {
+  return withMetadata({
+    selectors,
+  })
+}
+
+export const withContext = (context: WatchContext) => {
+  return (req: RequestOptions) => {
+    const md: GRPCMetadata = {};
+
+    if (context.cluster) {
+      md.cluster = context.cluster;
+    } else {
+      const currentContext = clusterName();
+      if (currentContext) {
+        md.cluster = md.cluster || currentContext;
+      }
+    }
+
+    if (context.nodes) {
+      md.nodes = context.nodes;
+    }
+
+    addMetadata(req, md);
+  }
+}
+
+export const withTimeout = (timeout: number) => {
+  return (req: RequestOptions) => {
+    if (!req.controller) {
+      const controller = new AbortController();
+      req.signal = controller.signal;
+      req.controller = controller;
+    }
+
+    setTimeout(() => {
+      req.controller?.abort();
+    }, timeout);
+  }
+}
+
+const addMetadata = (req: RequestInit, headers: GRPCMetadata) => {
+  if (!req.headers) {
+    req.headers = new Headers();
+  }
+
+  const h = req.headers as Headers;
+
+  for (const id in headers) {
+    h.append(`Grpc-Metadata-${id}`, headers[id].toString());
+  }
+};
\ No newline at end of file
diff --git a/frontend/src/api/resources.ts b/frontend/src/api/resources.ts
new file mode 100644
index 000000000..cd796d679
--- /dev/null
+++ b/frontend/src/api/resources.ts
@@ -0,0 +1,207 @@
+// This Runtime Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+
+export const RoleNone = "None";
+export const RoleReader = "Reader";
+export const RoleOperator = "Operator";
+export const RoleAdmin = "Admin";
+export const RedirectQueryParam = "redirect";
+export const AuthFlowQueryParam = "flow";
+export const CLIAuthFlow = "cli";
+export const WorkloadProxyAuthFlow = "workload-proxy";
+export const SignatureHeaderKey = "x-sidero-signature";
+export const TimestampHeaderKey = "x-sidero-timestamp";
+export const PayloadHeaderKey = "x-sidero-payload";
+export const authHeader = "authorization";
+export const authBearerHeaderPrefix = "Bearer ";
+export const SignatureVersionV1 = "siderov1";
+export const samlSessionHeader = "saml-session";
+export const DefaultKubernetesVersion = "1.29.1";
+export const ServiceLabelAnnotationKey = "omni-kube-service-exposer.sidero.dev/label";
+export const ServicePortAnnotationKey = "omni-kube-service-exposer.sidero.dev/port";
+export const ServiceIconAnnotationKey = "omni-kube-service-exposer.sidero.dev/icon";
+export const installDiskMinSize = 5e+09;
+export const workloadProxyHostPrefix = "p";
+export const workloadProxyPublicKeyIdCookie = "publicKeyId";
+export const workloadProxyPublicKeyIdSignatureBase64Cookie = "publicKeyIdSignatureBase64";
+export const authPublicKeyIDQueryParam = "public-key-id";
+export const DefaultNamespace = "default";
+export const EphemeralNamespace = "ephemeral";
+export const MetricsNamespace = "metrics";
+export const VirtualNamespace = "virtual";
+export const ExternalNamespace = "external";
+export const AccessPolicyType = "AccessPolicies.omni.sidero.dev";
+export const AuthConfigID = "auth-config";
+export const AuthConfigType = "AuthConfigs.omni.sidero.dev";
+export const IdentityType = "Identities.omni.sidero.dev";
+export const SAMLLabelPrefix = "saml.omni.sidero.dev/";
+export const LabelIdentityUserID = "user-id";
+export const LabelIdentityTypeServiceAccount = "type-service-account";
+export const PublicKeyType = "PublicKeys.omni.sidero.dev";
+export const SAMLLabelRuleType = "SAMLLabelRules.omni.sidero.dev";
+export const UserType = "Users.omni.sidero.dev";
+export const KubernetesResourceType = "KubernetesResources.omni.sidero.dev";
+export const MachineLocked = "omni.sidero.dev/locked";
+export const ResourceManagedByClusterTemplates = "omni.sidero.dev/managed-by-cluster-templates";
+export const ConfigPatchName = "name";
+export const ConfigPatchDescription = "description";
+export const EtcdBackupS3ConfID = "etcd-backup-s3-conf";
+export const EtcdBackupS3ConfType = "EtcdBackupS3Configs.omni.sidero.dev";
+export const BackupDataType = "BackupDatas.omni.sidero.dev";
+export const ClusterType = "Clusters.omni.sidero.dev";
+export const ClusterBootstrapStatusType = "ClusterBootstrapStatuses.omni.sidero.dev";
+export const ClusterConfigVersionType = "ClusterConfigVersions.omni.sidero.dev";
+export const ClusterDestroyStatusType = "ClusterDestroyStatuses.omni.sidero.dev";
+export const ClusterEndpointType = "ClusterEndpoints.omni.sidero.dev";
+export const ClusterMachineType = "ClusterMachines.omni.sidero.dev";
+export const ClusterMachineConfigType = "ClusterMachineConfigs.omni.sidero.dev";
+export const ClusterMachineConfigPatchesType = "ClusterMachineConfigPatches.omni.sidero.dev";
+export const ClusterMachineConfigStatusType = "ClusterMachineConfigStatuses.omni.sidero.dev";
+export const ClusterMachineEncryptionKeyType = "ClusterMachineEncryptionKeys.omni.sidero.dev";
+export const ClusterMachineIdentityType = "ClusterMachineIdentities.omni.sidero.dev";
+export const ClusterMachineTalosVersionType = "ClusterMachineTalosVersions.omni.sidero.dev";
+export const ClusterMachineStatusType = "ClusterMachineStatuses.omni.sidero.dev";
+export const ClusterMachineTemplateType = "ClusterMachineTemplates.omni.sidero.dev";
+export const ClusterStatusType = "ClusterStatuses.omni.sidero.dev";
+export const ClusterUUIDType = "ClusterUUIDs.omni.sidero.dev";
+export const ConfigPatchType = "ConfigPatches.omni.sidero.dev";
+export const ControlPlaneStatusType = "ControlPlaneStatuses.omni.sidero.dev";
+export const EtcdBackupType = "EtcdBackups.omni.sidero.dev";
+export const EtcdBackupStoreStatusID = "etcdbackup-store-status";
+export const EtcdBackupStoreStatusType = "EtcdBackupStoreStatuses.omni.sidero.dev";
+export const EtcdBackupEncryptionType = "EtcdBackupEncryptions.omni.sidero.dev";
+export const EtcdBackupOverallStatusID = "etcdbackup-overall-status";
+export const EtcdBackupOverallStatusType = "EtcdBackupOverallStatuses.omni.sidero.dev";
+export const EtcdBackupStatusType = "EtcdBackupStatuses.omni.sidero.dev";
+export const EtcdManualBackupType = "EtcdManualBackups.omni.sidero.dev";
+export const ExposedServiceType = "ExposedServices.omni.sidero.dev";
+export const FeaturesConfigID = "features-config";
+export const FeaturesConfigType = "FeaturesConfigs.omni.sidero.dev";
+export const ImagePullRequestType = "ImagePullRequests.omni.sidero.dev";
+export const ImagePullStatusType = "ImagePullStatuses.omni.sidero.dev";
+export const InstallationMediaType = "InstallationMedias.omni.sidero.dev";
+export const KubernetesStatusType = "KubernetesStatuses.omni.sidero.dev";
+export const KubernetesUpgradeManifestStatusType = "KubernetesUpgradeManifestStatuses.omni.sidero.dev";
+export const KubernetesUpgradeStatusType = "KubernetesUpgradeStatuses.omni.sidero.dev";
+export const KubernetesVersionType = "KubernetesVersions.omni.sidero.dev";
+export const SystemLabelPrefix = "omni.sidero.dev/";
+export const LabelControlPlaneRole = "omni.sidero.dev/role-controlplane";
+export const LabelWorkerRole = "omni.sidero.dev/role-worker";
+export const LabelCluster = "omni.sidero.dev/cluster";
+export const LabelClusterUUID = "omni.sidero.dev/cluster-uuid";
+export const LabelHostname = "omni.sidero.dev/hostname";
+export const LabelMachineSet = "omni.sidero.dev/machine-set";
+export const LabelClusterMachine = "omni.sidero.dev/cluster-machine";
+export const LabelMachine = "omni.sidero.dev/machine";
+export const LabelSystemPatch = "omni.sidero.dev/system-patch";
+export const LabelExposedServiceAlias = "omni.sidero.dev/exposed-service-alias";
+export const MachineStatusLabelConnected = "omni.sidero.dev/connected";
+export const MachineStatusLabelDisconnected = "omni.sidero.dev/disconnected";
+export const MachineStatusLabelInvalidState = "omni.sidero.dev/invalid-state";
+export const MachineStatusLabelReportingEvents = "omni.sidero.dev/reporting-events";
+export const MachineStatusLabelAvailable = "omni.sidero.dev/available";
+export const MachineStatusLabelArch = "omni.sidero.dev/arch";
+export const MachineStatusLabelCPU = "omni.sidero.dev/cpu";
+export const MachineStatusLabelCores = "omni.sidero.dev/cores";
+export const MachineStatusLabelMem = "omni.sidero.dev/mem";
+export const MachineStatusLabelStorage = "omni.sidero.dev/storage";
+export const MachineStatusLabelNet = "omni.sidero.dev/net";
+export const MachineStatusLabelPlatform = "omni.sidero.dev/platform";
+export const MachineStatusLabelRegion = "omni.sidero.dev/region";
+export const MachineStatusLabelZone = "omni.sidero.dev/zone";
+export const MachineStatusLabelInstance = "omni.sidero.dev/instance";
+export const ClusterMachineStatusLabelNodeName = "omni.sidero.dev/node-name";
+export const MachineType = "Machines.omni.sidero.dev";
+export const MachineClassType = "MachineClasses.omni.sidero.dev";
+export const MachineConfigGenOptionsType = "MachineConfigGenOptions.omni.sidero.dev";
+export const MachineLabelsType = "MachineLabels.omni.sidero.dev";
+export const ControlPlanesIDSuffix = "control-planes";
+export const DefaultWorkersIDSuffix = "workers";
+export const MachineSetType = "MachineSets.omni.sidero.dev";
+export const MachineSetDestroyStatusType = "MachineSetDestroyStatuses.omni.sidero.dev";
+export const MachineSetNodeType = "MachineSetNodes.omni.sidero.dev";
+export const MachineSetStatusType = "MachineSetStatuses.omni.sidero.dev";
+export const MachineStatusType = "MachineStatuses.omni.sidero.dev";
+export const MachineStatusLinkType = "MachineStatusLinks.omni.sidero.dev";
+export const MachineStatusSnapshotType = "MachineStatusSnapshots.omni.sidero.dev";
+export const OngoingTaskType = "OngoingTasks.omni.sidero.dev";
+export const RedactedClusterMachineConfigType = "RedactedClusterMachineConfigs.omni.sidero.dev";
+export const SchematicType = "Schematics.omni.sidero.dev";
+export const SchematicConfigurationType = "SchematicConfigurations.omni.sidero.dev";
+export const ClusterSecretsType = "ClusterSecrets.omni.sidero.dev";
+export const TalosExtensionsType = "TalosExtensions.omni.sidero.dev";
+export const TalosUpgradeStatusType = "TalosUpgradeStatuses.omni.sidero.dev";
+export const TalosVersionType = "TalosVersions.omni.sidero.dev";
+export const ConfigType = "Configs.omni.sidero.dev";
+export const ConfigID = "siderolink-config";
+export const ConnectionParamsType = "ConnectionParams.omni.sidero.dev";
+export const SiderolinkResourceType = "Links.omni.sidero.dev";
+export const SiderolinkCounterNamespace = "metrics";
+export const SysVersionType = "SysVersions.system.sidero.dev";
+export const SysVersionID = "current";
+export const ClusterPermissionsType = "ClusterPermissions.omni.sidero.dev";
+export const CurrentUserID = "current";
+export const CurrentUserType = "CurrentUsers.omni.sidero.dev";
+export const KubernetesUsageType = "KubernetesUsages.omni.sidero.dev";
+export const PermissionsID = "permissions";
+export const PermissionsType = "Permissions.omni.sidero.dev";
+export const SecureBoot = "secureboot";
+export const DefaultTalosVersion = "1.6.4";
+export const PatchWeightInstallDisk = 0;
+export const PatchBaseWeightCluster = 200;
+export const PatchBaseWeightMachineSet = 400;
+export const PatchBaseWeightClusterMachine = 400;
+export const TalosServiceType = "Services.v1alpha1.talos.dev";
+export const TalosCPUType = "CPUStats.perf.talos.dev";
+export const TalosMemoryType = "MemoryStats.perf.talos.dev";
+export const TalosNodenameType = "Nodenames.kubernetes.talos.dev";
+export const TalosMemberType = "Members.cluster.talos.dev";
+export const TalosNodeAddressType = "NodeAddresses.net.talos.dev";
+export const TalosMountStatusType = "MountStatuses.runtime.talos.dev";
+export const TalosNodenameID = "nodename";
+export const TalosAddressRoutedNoK8s = "routed-no-k8s";
+export const TalosCPUID = "latest";
+export const TalosMemoryID = "latest";
+export const TalosPerfNamespace = "perf";
+export const TalosClusterNamespace = "cluster";
+export const TalosRuntimeNamespace = "runtime";
+export const TalosK8sNamespace = "k8s";
+export const TalosNetworkNamespace = "network";
+export const MetalNetworkPlatformConfig = 10;
+export const LabelsMeta = 12;
+export const NamespaceType = "Namespaces.meta.cosi.dev";
+export const ResourceDefinitionType = "ResourceDefinitions.meta.cosi.dev";
+export const MetaNamespace = "meta";
+
+export const kubernetes = {
+  service: "services.v1",
+  pod: "pods.v1",
+  node: "nodes.v1",
+  cluster: `clusters`,
+  machine: `machines`,
+  sideroServers: "servers",
+  crd: "customresourcedefinitions.v1.apiextensions.k8s.io",
+};
+
+export const talos = {
+  // resources
+  service: "Services.v1alpha1.talos.dev",
+  cpu: "CPUStats.perf.talos.dev",
+  mem: "MemoryStats.perf.talos.dev",
+  nodename: "Nodenames.kubernetes.talos.dev",
+  member: "Members.cluster.talos.dev",
+  nodeaddress: "NodeAddresses.net.talos.dev",
+
+  // well known resource IDs
+  defaultNodeNameID: "nodename",
+
+  // namespaces
+  perfNamespace: "perf",
+  clusterNamespace: "cluster",
+  runtimeNamespace: "runtime",
+  k8sNamespace: "k8s",
+  networkNamespace: "network",
+};
diff --git a/frontend/src/api/talos/machine/machine.pb.ts b/frontend/src/api/talos/machine/machine.pb.ts
new file mode 100644
index 000000000..caf6b2b97
--- /dev/null
+++ b/frontend/src/api/talos/machine/machine.pb.ts
@@ -0,0 +1,1029 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as CommonCommon from "../../common/common.pb"
+import * as fm from "../../fetch.pb"
+import * as GoogleProtobufAny from "../../google/protobuf/any.pb"
+import * as GoogleProtobufDuration from "../../google/protobuf/duration.pb"
+import * as GoogleProtobufEmpty from "../../google/protobuf/empty.pb"
+import * as GoogleProtobufTimestamp from "../../google/protobuf/timestamp.pb"
+
+export enum ApplyConfigurationRequestMode {
+  REBOOT = 0,
+  AUTO = 1,
+  NO_REBOOT = 2,
+  STAGED = 3,
+  TRY = 4,
+}
+
+export enum RebootRequestMode {
+  DEFAULT = 0,
+  POWERCYCLE = 1,
+}
+
+export enum SequenceEventAction {
+  NOOP = 0,
+  START = 1,
+  STOP = 2,
+}
+
+export enum PhaseEventAction {
+  START = 0,
+  STOP = 1,
+}
+
+export enum TaskEventAction {
+  START = 0,
+  STOP = 1,
+}
+
+export enum ServiceStateEventAction {
+  INITIALIZED = 0,
+  PREPARING = 1,
+  WAITING = 2,
+  RUNNING = 3,
+  STOPPING = 4,
+  FINISHED = 5,
+  FAILED = 6,
+  SKIPPED = 7,
+}
+
+export enum MachineStatusEventMachineStage {
+  UNKNOWN = 0,
+  BOOTING = 1,
+  INSTALLING = 2,
+  MAINTENANCE = 3,
+  RUNNING = 4,
+  REBOOTING = 5,
+  SHUTTING_DOWN = 6,
+  RESETTING = 7,
+  UPGRADING = 8,
+}
+
+export enum ListRequestType {
+  REGULAR = 0,
+  DIRECTORY = 1,
+  SYMLINK = 2,
+}
+
+export enum MachineConfigMachineType {
+  TYPE_UNKNOWN = 0,
+  TYPE_INIT = 1,
+  TYPE_CONTROL_PLANE = 2,
+  TYPE_WORKER = 3,
+}
+
+export type ApplyConfigurationRequest = {
+  data?: Uint8Array
+  on_reboot?: boolean
+  immediate?: boolean
+  mode?: ApplyConfigurationRequestMode
+  dry_run?: boolean
+  try_mode_timeout?: GoogleProtobufDuration.Duration
+}
+
+export type ApplyConfiguration = {
+  metadata?: CommonCommon.Metadata
+  warnings?: string[]
+  mode?: ApplyConfigurationRequestMode
+  mode_details?: string
+}
+
+export type ApplyConfigurationResponse = {
+  messages?: ApplyConfiguration[]
+}
+
+export type RebootRequest = {
+  mode?: RebootRequestMode
+}
+
+export type Reboot = {
+  metadata?: CommonCommon.Metadata
+  actor_id?: string
+}
+
+export type RebootResponse = {
+  messages?: Reboot[]
+}
+
+export type BootstrapRequest = {
+  recover_etcd?: boolean
+  recover_skip_hash_check?: boolean
+}
+
+export type Bootstrap = {
+  metadata?: CommonCommon.Metadata
+}
+
+export type BootstrapResponse = {
+  messages?: Bootstrap[]
+}
+
+export type SequenceEvent = {
+  sequence?: string
+  action?: SequenceEventAction
+  error?: CommonCommon.Error
+}
+
+export type PhaseEvent = {
+  phase?: string
+  action?: PhaseEventAction
+}
+
+export type TaskEvent = {
+  task?: string
+  action?: TaskEventAction
+}
+
+export type ServiceStateEvent = {
+  service?: string
+  action?: ServiceStateEventAction
+  message?: string
+  health?: ServiceHealth
+}
+
+export type RestartEvent = {
+  cmd?: string
+}
+
+export type ConfigLoadErrorEvent = {
+  error?: string
+}
+
+export type ConfigValidationErrorEvent = {
+  error?: string
+}
+
+export type AddressEvent = {
+  hostname?: string
+  addresses?: string[]
+}
+
+export type MachineStatusEventMachineStatusUnmetCondition = {
+  name?: string
+  reason?: string
+}
+
+export type MachineStatusEventMachineStatus = {
+  ready?: boolean
+  unmet_conditions?: MachineStatusEventMachineStatusUnmetCondition[]
+}
+
+export type MachineStatusEvent = {
+  stage?: MachineStatusEventMachineStage
+  status?: MachineStatusEventMachineStatus
+}
+
+export type EventsRequest = {
+  tail_events?: number
+  tail_id?: string
+  tail_seconds?: number
+  with_actor_id?: string
+}
+
+export type Event = {
+  metadata?: CommonCommon.Metadata
+  data?: GoogleProtobufAny.Any
+  id?: string
+  actor_id?: string
+}
+
+export type ResetPartitionSpec = {
+  label?: string
+  wipe?: boolean
+}
+
+export type ResetRequest = {
+  graceful?: boolean
+  reboot?: boolean
+  system_partitions_to_wipe?: ResetPartitionSpec[]
+}
+
+export type Reset = {
+  metadata?: CommonCommon.Metadata
+  actor_id?: string
+}
+
+export type ResetResponse = {
+  messages?: Reset[]
+}
+
+export type Shutdown = {
+  metadata?: CommonCommon.Metadata
+  actor_id?: string
+}
+
+export type ShutdownRequest = {
+  force?: boolean
+}
+
+export type ShutdownResponse = {
+  messages?: Shutdown[]
+}
+
+export type UpgradeRequest = {
+  image?: string
+  preserve?: boolean
+  stage?: boolean
+  force?: boolean
+}
+
+export type Upgrade = {
+  metadata?: CommonCommon.Metadata
+  ack?: string
+  actor_id?: string
+}
+
+export type UpgradeResponse = {
+  messages?: Upgrade[]
+}
+
+export type ServiceList = {
+  metadata?: CommonCommon.Metadata
+  services?: ServiceInfo[]
+}
+
+export type ServiceListResponse = {
+  messages?: ServiceList[]
+}
+
+export type ServiceInfo = {
+  id?: string
+  state?: string
+  events?: ServiceEvents
+  health?: ServiceHealth
+}
+
+export type ServiceEvents = {
+  events?: ServiceEvent[]
+}
+
+export type ServiceEvent = {
+  msg?: string
+  state?: string
+  ts?: GoogleProtobufTimestamp.Timestamp
+}
+
+export type ServiceHealth = {
+  unknown?: boolean
+  healthy?: boolean
+  last_message?: string
+  last_change?: GoogleProtobufTimestamp.Timestamp
+}
+
+export type ServiceStartRequest = {
+  id?: string
+}
+
+export type ServiceStart = {
+  metadata?: CommonCommon.Metadata
+  resp?: string
+}
+
+export type ServiceStartResponse = {
+  messages?: ServiceStart[]
+}
+
+export type ServiceStopRequest = {
+  id?: string
+}
+
+export type ServiceStop = {
+  metadata?: CommonCommon.Metadata
+  resp?: string
+}
+
+export type ServiceStopResponse = {
+  messages?: ServiceStop[]
+}
+
+export type ServiceRestartRequest = {
+  id?: string
+}
+
+export type ServiceRestart = {
+  metadata?: CommonCommon.Metadata
+  resp?: string
+}
+
+export type ServiceRestartResponse = {
+  messages?: ServiceRestart[]
+}
+
+export type CopyRequest = {
+  root_path?: string
+}
+
+export type ListRequest = {
+  root?: string
+  recurse?: boolean
+  recursion_depth?: number
+  types?: ListRequestType[]
+}
+
+export type DiskUsageRequest = {
+  recursion_depth?: number
+  all?: boolean
+  threshold?: string
+  paths?: string[]
+}
+
+export type FileInfo = {
+  metadata?: CommonCommon.Metadata
+  name?: string
+  size?: string
+  mode?: number
+  modified?: string
+  is_dir?: boolean
+  error?: string
+  link?: string
+  relative_name?: string
+  uid?: number
+  gid?: number
+}
+
+export type DiskUsageInfo = {
+  metadata?: CommonCommon.Metadata
+  name?: string
+  size?: string
+  error?: string
+  relative_name?: string
+}
+
+export type Mounts = {
+  metadata?: CommonCommon.Metadata
+  stats?: MountStat[]
+}
+
+export type MountsResponse = {
+  messages?: Mounts[]
+}
+
+export type MountStat = {
+  filesystem?: string
+  size?: string
+  available?: string
+  mounted_on?: string
+}
+
+export type Version = {
+  metadata?: CommonCommon.Metadata
+  version?: VersionInfo
+  platform?: PlatformInfo
+  features?: FeaturesInfo
+}
+
+export type VersionResponse = {
+  messages?: Version[]
+}
+
+export type VersionInfo = {
+  tag?: string
+  sha?: string
+  built?: string
+  go_version?: string
+  os?: string
+  arch?: string
+}
+
+export type PlatformInfo = {
+  name?: string
+  mode?: string
+}
+
+export type FeaturesInfo = {
+  rbac?: boolean
+}
+
+export type LogsRequest = {
+  namespace?: string
+  id?: string
+  driver?: CommonCommon.ContainerDriver
+  follow?: boolean
+  tail_lines?: number
+}
+
+export type ReadRequest = {
+  path?: string
+}
+
+export type RollbackRequest = {
+}
+
+export type Rollback = {
+  metadata?: CommonCommon.Metadata
+}
+
+export type RollbackResponse = {
+  messages?: Rollback[]
+}
+
+export type ContainersRequest = {
+  namespace?: string
+  driver?: CommonCommon.ContainerDriver
+}
+
+export type ContainerInfo = {
+  namespace?: string
+  id?: string
+  image?: string
+  pid?: number
+  status?: string
+  pod_id?: string
+  name?: string
+}
+
+export type Container = {
+  metadata?: CommonCommon.Metadata
+  containers?: ContainerInfo[]
+}
+
+export type ContainersResponse = {
+  messages?: Container[]
+}
+
+export type DmesgRequest = {
+  follow?: boolean
+  tail?: boolean
+}
+
+export type ProcessesResponse = {
+  messages?: Process[]
+}
+
+export type Process = {
+  metadata?: CommonCommon.Metadata
+  processes?: ProcessInfo[]
+}
+
+export type ProcessInfo = {
+  pid?: number
+  ppid?: number
+  state?: string
+  threads?: number
+  cpu_time?: number
+  virtual_memory?: string
+  resident_memory?: string
+  command?: string
+  executable?: string
+  args?: string
+}
+
+export type RestartRequest = {
+  namespace?: string
+  id?: string
+  driver?: CommonCommon.ContainerDriver
+}
+
+export type Restart = {
+  metadata?: CommonCommon.Metadata
+}
+
+export type RestartResponse = {
+  messages?: Restart[]
+}
+
+export type StatsRequest = {
+  namespace?: string
+  driver?: CommonCommon.ContainerDriver
+}
+
+export type Stats = {
+  metadata?: CommonCommon.Metadata
+  stats?: Stat[]
+}
+
+export type StatsResponse = {
+  messages?: Stats[]
+}
+
+export type Stat = {
+  namespace?: string
+  id?: string
+  memory_usage?: string
+  cpu_usage?: string
+  pod_id?: string
+  name?: string
+}
+
+export type Memory = {
+  metadata?: CommonCommon.Metadata
+  meminfo?: MemInfo
+}
+
+export type MemoryResponse = {
+  messages?: Memory[]
+}
+
+export type MemInfo = {
+  memtotal?: string
+  memfree?: string
+  memavailable?: string
+  buffers?: string
+  cached?: string
+  swapcached?: string
+  active?: string
+  inactive?: string
+  activeanon?: string
+  inactiveanon?: string
+  activefile?: string
+  inactivefile?: string
+  unevictable?: string
+  mlocked?: string
+  swaptotal?: string
+  swapfree?: string
+  dirty?: string
+  writeback?: string
+  anonpages?: string
+  mapped?: string
+  shmem?: string
+  slab?: string
+  sreclaimable?: string
+  sunreclaim?: string
+  kernelstack?: string
+  pagetables?: string
+  nfsunstable?: string
+  bounce?: string
+  writebacktmp?: string
+  commitlimit?: string
+  committedas?: string
+  vmalloctotal?: string
+  vmallocused?: string
+  vmallocchunk?: string
+  hardwarecorrupted?: string
+  anonhugepages?: string
+  shmemhugepages?: string
+  shmempmdmapped?: string
+  cmatotal?: string
+  cmafree?: string
+  hugepagestotal?: string
+  hugepagesfree?: string
+  hugepagesrsvd?: string
+  hugepagessurp?: string
+  hugepagesize?: string
+  directmap4k?: string
+  directmap2m?: string
+  directmap1g?: string
+}
+
+export type HostnameResponse = {
+  messages?: Hostname[]
+}
+
+export type Hostname = {
+  metadata?: CommonCommon.Metadata
+  hostname?: string
+}
+
+export type LoadAvgResponse = {
+  messages?: LoadAvg[]
+}
+
+export type LoadAvg = {
+  metadata?: CommonCommon.Metadata
+  load1?: number
+  load5?: number
+  load15?: number
+}
+
+export type SystemStatResponse = {
+  messages?: SystemStat[]
+}
+
+export type SystemStat = {
+  metadata?: CommonCommon.Metadata
+  boot_time?: string
+  cpu_total?: CPUStat
+  cpu?: CPUStat[]
+  irq_total?: string
+  irq?: string[]
+  context_switches?: string
+  process_created?: string
+  process_running?: string
+  process_blocked?: string
+  soft_irq_total?: string
+  soft_irq?: SoftIRQStat
+}
+
+export type CPUStat = {
+  user?: number
+  nice?: number
+  system?: number
+  idle?: number
+  iowait?: number
+  irq?: number
+  soft_irq?: number
+  steal?: number
+  guest?: number
+  guest_nice?: number
+}
+
+export type SoftIRQStat = {
+  hi?: string
+  timer?: string
+  net_tx?: string
+  net_rx?: string
+  block?: string
+  block_io_poll?: string
+  tasklet?: string
+  sched?: string
+  hrtimer?: string
+  rcu?: string
+}
+
+export type CPUInfoResponse = {
+  messages?: CPUsInfo[]
+}
+
+export type CPUsInfo = {
+  metadata?: CommonCommon.Metadata
+  cpu_info?: CPUInfo[]
+}
+
+export type CPUInfo = {
+  processor?: number
+  vendor_id?: string
+  cpu_family?: string
+  model?: string
+  model_name?: string
+  stepping?: string
+  microcode?: string
+  cpu_mhz?: number
+  cache_size?: string
+  physical_id?: string
+  siblings?: number
+  core_id?: string
+  cpu_cores?: number
+  apic_id?: string
+  initial_apic_id?: string
+  fpu?: string
+  fpu_exception?: string
+  cpu_id_level?: number
+  wp?: string
+  flags?: string[]
+  bugs?: string[]
+  bogo_mips?: number
+  cl_flush_size?: number
+  cache_alignment?: number
+  address_sizes?: string
+  power_management?: string
+}
+
+export type NetworkDeviceStatsResponse = {
+  messages?: NetworkDeviceStats[]
+}
+
+export type NetworkDeviceStats = {
+  metadata?: CommonCommon.Metadata
+  total?: NetDev
+  devices?: NetDev[]
+}
+
+export type NetDev = {
+  name?: string
+  rx_bytes?: string
+  rx_packets?: string
+  rx_errors?: string
+  rx_dropped?: string
+  rx_fifo?: string
+  rx_frame?: string
+  rx_compressed?: string
+  rx_multicast?: string
+  tx_bytes?: string
+  tx_packets?: string
+  tx_errors?: string
+  tx_dropped?: string
+  tx_fifo?: string
+  tx_collisions?: string
+  tx_carrier?: string
+  tx_compressed?: string
+}
+
+export type DiskStatsResponse = {
+  messages?: DiskStats[]
+}
+
+export type DiskStats = {
+  metadata?: CommonCommon.Metadata
+  total?: DiskStat
+  devices?: DiskStat[]
+}
+
+export type DiskStat = {
+  name?: string
+  read_completed?: string
+  read_merged?: string
+  read_sectors?: string
+  read_time_ms?: string
+  write_completed?: string
+  write_merged?: string
+  write_sectors?: string
+  write_time_ms?: string
+  io_in_progress?: string
+  io_time_ms?: string
+  io_time_weighted_ms?: string
+  discard_completed?: string
+  discard_merged?: string
+  discard_sectors?: string
+  discard_time_ms?: string
+}
+
+export type EtcdLeaveClusterRequest = {
+}
+
+export type EtcdLeaveCluster = {
+  metadata?: CommonCommon.Metadata
+}
+
+export type EtcdLeaveClusterResponse = {
+  messages?: EtcdLeaveCluster[]
+}
+
+export type EtcdRemoveMemberRequest = {
+  member?: string
+}
+
+export type EtcdRemoveMember = {
+  metadata?: CommonCommon.Metadata
+}
+
+export type EtcdRemoveMemberResponse = {
+  messages?: EtcdRemoveMember[]
+}
+
+export type EtcdForfeitLeadershipRequest = {
+}
+
+export type EtcdForfeitLeadership = {
+  metadata?: CommonCommon.Metadata
+  member?: string
+}
+
+export type EtcdForfeitLeadershipResponse = {
+  messages?: EtcdForfeitLeadership[]
+}
+
+export type EtcdMemberListRequest = {
+  query_local?: boolean
+}
+
+export type EtcdMember = {
+  id?: string
+  hostname?: string
+  peer_urls?: string[]
+  client_urls?: string[]
+  is_learner?: boolean
+}
+
+export type EtcdMembers = {
+  metadata?: CommonCommon.Metadata
+  legacy_members?: string[]
+  members?: EtcdMember[]
+}
+
+export type EtcdMemberListResponse = {
+  messages?: EtcdMembers[]
+}
+
+export type EtcdSnapshotRequest = {
+}
+
+export type EtcdRecover = {
+  metadata?: CommonCommon.Metadata
+}
+
+export type EtcdRecoverResponse = {
+  messages?: EtcdRecover[]
+}
+
+export type RouteConfig = {
+  network?: string
+  gateway?: string
+  metric?: number
+}
+
+export type DHCPOptionsConfig = {
+  route_metric?: number
+}
+
+export type NetworkDeviceConfig = {
+  interface?: string
+  cidr?: string
+  mtu?: number
+  dhcp?: boolean
+  ignore?: boolean
+  dhcp_options?: DHCPOptionsConfig
+  routes?: RouteConfig[]
+}
+
+export type NetworkConfig = {
+  hostname?: string
+  interfaces?: NetworkDeviceConfig[]
+}
+
+export type InstallConfig = {
+  install_disk?: string
+  install_image?: string
+}
+
+export type MachineConfig = {
+  type?: MachineConfigMachineType
+  install_config?: InstallConfig
+  network_config?: NetworkConfig
+  kubernetes_version?: string
+}
+
+export type ControlPlaneConfig = {
+  endpoint?: string
+}
+
+export type CNIConfig = {
+  name?: string
+  urls?: string[]
+}
+
+export type ClusterNetworkConfig = {
+  dns_domain?: string
+  cni_config?: CNIConfig
+}
+
+export type ClusterConfig = {
+  name?: string
+  control_plane?: ControlPlaneConfig
+  cluster_network?: ClusterNetworkConfig
+  allow_scheduling_on_control_planes?: boolean
+}
+
+export type GenerateConfigurationRequest = {
+  config_version?: string
+  cluster_config?: ClusterConfig
+  machine_config?: MachineConfig
+  override_time?: GoogleProtobufTimestamp.Timestamp
+}
+
+export type GenerateConfiguration = {
+  metadata?: CommonCommon.Metadata
+  data?: Uint8Array[]
+  talosconfig?: Uint8Array
+}
+
+export type GenerateConfigurationResponse = {
+  messages?: GenerateConfiguration[]
+}
+
+export type GenerateClientConfigurationRequest = {
+  roles?: string[]
+  crt_ttl?: GoogleProtobufDuration.Duration
+}
+
+export type GenerateClientConfiguration = {
+  metadata?: CommonCommon.Metadata
+  ca?: Uint8Array
+  crt?: Uint8Array
+  key?: Uint8Array
+  talosconfig?: Uint8Array
+}
+
+export type GenerateClientConfigurationResponse = {
+  messages?: GenerateClientConfiguration[]
+}
+
+export type PacketCaptureRequest = {
+  interface?: string
+  promiscuous?: boolean
+  snap_len?: number
+  bpf_filter?: BPFInstruction[]
+}
+
+export type BPFInstruction = {
+  op?: number
+  jt?: number
+  jf?: number
+  k?: number
+}
+
+export class MachineService {
+  static ApplyConfiguration(req: ApplyConfigurationRequest, ...options: fm.fetchOption[]): Promise<ApplyConfigurationResponse> {
+    return fm.fetchReq<ApplyConfigurationRequest, ApplyConfigurationResponse>("POST", `/machine.MachineService/ApplyConfiguration`, req, ...options)
+  }
+  static Bootstrap(req: BootstrapRequest, ...options: fm.fetchOption[]): Promise<BootstrapResponse> {
+    return fm.fetchReq<BootstrapRequest, BootstrapResponse>("POST", `/machine.MachineService/Bootstrap`, req, ...options)
+  }
+  static Containers(req: ContainersRequest, ...options: fm.fetchOption[]): Promise<ContainersResponse> {
+    return fm.fetchReq<ContainersRequest, ContainersResponse>("POST", `/machine.MachineService/Containers`, req, ...options)
+  }
+  static Copy(req: CopyRequest, entityNotifier?: fm.NotifyStreamEntityArrival<CommonCommon.Data>, ...options: fm.fetchOption[]): Promise<void> {
+    return fm.fetchStreamingRequest<CopyRequest, CommonCommon.Data>("POST", `/machine.MachineService/Copy`, req, entityNotifier, ...options)
+  }
+  static CPUInfo(req: GoogleProtobufEmpty.Empty, ...options: fm.fetchOption[]): Promise<CPUInfoResponse> {
+    return fm.fetchReq<GoogleProtobufEmpty.Empty, CPUInfoResponse>("POST", `/machine.MachineService/CPUInfo`, req, ...options)
+  }
+  static DiskStats(req: GoogleProtobufEmpty.Empty, ...options: fm.fetchOption[]): Promise<DiskStatsResponse> {
+    return fm.fetchReq<GoogleProtobufEmpty.Empty, DiskStatsResponse>("POST", `/machine.MachineService/DiskStats`, req, ...options)
+  }
+  static Dmesg(req: DmesgRequest, entityNotifier?: fm.NotifyStreamEntityArrival<CommonCommon.Data>, ...options: fm.fetchOption[]): Promise<void> {
+    return fm.fetchStreamingRequest<DmesgRequest, CommonCommon.Data>("POST", `/machine.MachineService/Dmesg`, req, entityNotifier, ...options)
+  }
+  static Events(req: EventsRequest, entityNotifier?: fm.NotifyStreamEntityArrival<Event>, ...options: fm.fetchOption[]): Promise<void> {
+    return fm.fetchStreamingRequest<EventsRequest, Event>("POST", `/machine.MachineService/Events`, req, entityNotifier, ...options)
+  }
+  static EtcdMemberList(req: EtcdMemberListRequest, ...options: fm.fetchOption[]): Promise<EtcdMemberListResponse> {
+    return fm.fetchReq<EtcdMemberListRequest, EtcdMemberListResponse>("POST", `/machine.MachineService/EtcdMemberList`, req, ...options)
+  }
+  static EtcdRemoveMember(req: EtcdRemoveMemberRequest, ...options: fm.fetchOption[]): Promise<EtcdRemoveMemberResponse> {
+    return fm.fetchReq<EtcdRemoveMemberRequest, EtcdRemoveMemberResponse>("POST", `/machine.MachineService/EtcdRemoveMember`, req, ...options)
+  }
+  static EtcdLeaveCluster(req: EtcdLeaveClusterRequest, ...options: fm.fetchOption[]): Promise<EtcdLeaveClusterResponse> {
+    return fm.fetchReq<EtcdLeaveClusterRequest, EtcdLeaveClusterResponse>("POST", `/machine.MachineService/EtcdLeaveCluster`, req, ...options)
+  }
+  static EtcdForfeitLeadership(req: EtcdForfeitLeadershipRequest, ...options: fm.fetchOption[]): Promise<EtcdForfeitLeadershipResponse> {
+    return fm.fetchReq<EtcdForfeitLeadershipRequest, EtcdForfeitLeadershipResponse>("POST", `/machine.MachineService/EtcdForfeitLeadership`, req, ...options)
+  }
+  static EtcdSnapshot(req: EtcdSnapshotRequest, entityNotifier?: fm.NotifyStreamEntityArrival<CommonCommon.Data>, ...options: fm.fetchOption[]): Promise<void> {
+    return fm.fetchStreamingRequest<EtcdSnapshotRequest, CommonCommon.Data>("POST", `/machine.MachineService/EtcdSnapshot`, req, entityNotifier, ...options)
+  }
+  static GenerateConfiguration(req: GenerateConfigurationRequest, ...options: fm.fetchOption[]): Promise<GenerateConfigurationResponse> {
+    return fm.fetchReq<GenerateConfigurationRequest, GenerateConfigurationResponse>("POST", `/machine.MachineService/GenerateConfiguration`, req, ...options)
+  }
+  static Hostname(req: GoogleProtobufEmpty.Empty, ...options: fm.fetchOption[]): Promise<HostnameResponse> {
+    return fm.fetchReq<GoogleProtobufEmpty.Empty, HostnameResponse>("POST", `/machine.MachineService/Hostname`, req, ...options)
+  }
+  static Kubeconfig(req: GoogleProtobufEmpty.Empty, entityNotifier?: fm.NotifyStreamEntityArrival<CommonCommon.Data>, ...options: fm.fetchOption[]): Promise<void> {
+    return fm.fetchStreamingRequest<GoogleProtobufEmpty.Empty, CommonCommon.Data>("POST", `/machine.MachineService/Kubeconfig`, req, entityNotifier, ...options)
+  }
+  static List(req: ListRequest, entityNotifier?: fm.NotifyStreamEntityArrival<FileInfo>, ...options: fm.fetchOption[]): Promise<void> {
+    return fm.fetchStreamingRequest<ListRequest, FileInfo>("POST", `/machine.MachineService/List`, req, entityNotifier, ...options)
+  }
+  static DiskUsage(req: DiskUsageRequest, entityNotifier?: fm.NotifyStreamEntityArrival<DiskUsageInfo>, ...options: fm.fetchOption[]): Promise<void> {
+    return fm.fetchStreamingRequest<DiskUsageRequest, DiskUsageInfo>("POST", `/machine.MachineService/DiskUsage`, req, entityNotifier, ...options)
+  }
+  static LoadAvg(req: GoogleProtobufEmpty.Empty, ...options: fm.fetchOption[]): Promise<LoadAvgResponse> {
+    return fm.fetchReq<GoogleProtobufEmpty.Empty, LoadAvgResponse>("POST", `/machine.MachineService/LoadAvg`, req, ...options)
+  }
+  static Logs(req: LogsRequest, entityNotifier?: fm.NotifyStreamEntityArrival<CommonCommon.Data>, ...options: fm.fetchOption[]): Promise<void> {
+    return fm.fetchStreamingRequest<LogsRequest, CommonCommon.Data>("POST", `/machine.MachineService/Logs`, req, entityNotifier, ...options)
+  }
+  static Memory(req: GoogleProtobufEmpty.Empty, ...options: fm.fetchOption[]): Promise<MemoryResponse> {
+    return fm.fetchReq<GoogleProtobufEmpty.Empty, MemoryResponse>("POST", `/machine.MachineService/Memory`, req, ...options)
+  }
+  static Mounts(req: GoogleProtobufEmpty.Empty, ...options: fm.fetchOption[]): Promise<MountsResponse> {
+    return fm.fetchReq<GoogleProtobufEmpty.Empty, MountsResponse>("POST", `/machine.MachineService/Mounts`, req, ...options)
+  }
+  static NetworkDeviceStats(req: GoogleProtobufEmpty.Empty, ...options: fm.fetchOption[]): Promise<NetworkDeviceStatsResponse> {
+    return fm.fetchReq<GoogleProtobufEmpty.Empty, NetworkDeviceStatsResponse>("POST", `/machine.MachineService/NetworkDeviceStats`, req, ...options)
+  }
+  static Processes(req: GoogleProtobufEmpty.Empty, ...options: fm.fetchOption[]): Promise<ProcessesResponse> {
+    return fm.fetchReq<GoogleProtobufEmpty.Empty, ProcessesResponse>("POST", `/machine.MachineService/Processes`, req, ...options)
+  }
+  static Read(req: ReadRequest, entityNotifier?: fm.NotifyStreamEntityArrival<CommonCommon.Data>, ...options: fm.fetchOption[]): Promise<void> {
+    return fm.fetchStreamingRequest<ReadRequest, CommonCommon.Data>("POST", `/machine.MachineService/Read`, req, entityNotifier, ...options)
+  }
+  static Reboot(req: RebootRequest, ...options: fm.fetchOption[]): Promise<RebootResponse> {
+    return fm.fetchReq<RebootRequest, RebootResponse>("POST", `/machine.MachineService/Reboot`, req, ...options)
+  }
+  static Restart(req: RestartRequest, ...options: fm.fetchOption[]): Promise<RestartResponse> {
+    return fm.fetchReq<RestartRequest, RestartResponse>("POST", `/machine.MachineService/Restart`, req, ...options)
+  }
+  static Rollback(req: RollbackRequest, ...options: fm.fetchOption[]): Promise<RollbackResponse> {
+    return fm.fetchReq<RollbackRequest, RollbackResponse>("POST", `/machine.MachineService/Rollback`, req, ...options)
+  }
+  static Reset(req: ResetRequest, ...options: fm.fetchOption[]): Promise<ResetResponse> {
+    return fm.fetchReq<ResetRequest, ResetResponse>("POST", `/machine.MachineService/Reset`, req, ...options)
+  }
+  static ServiceList(req: GoogleProtobufEmpty.Empty, ...options: fm.fetchOption[]): Promise<ServiceListResponse> {
+    return fm.fetchReq<GoogleProtobufEmpty.Empty, ServiceListResponse>("POST", `/machine.MachineService/ServiceList`, req, ...options)
+  }
+  static ServiceRestart(req: ServiceRestartRequest, ...options: fm.fetchOption[]): Promise<ServiceRestartResponse> {
+    return fm.fetchReq<ServiceRestartRequest, ServiceRestartResponse>("POST", `/machine.MachineService/ServiceRestart`, req, ...options)
+  }
+  static ServiceStart(req: ServiceStartRequest, ...options: fm.fetchOption[]): Promise<ServiceStartResponse> {
+    return fm.fetchReq<ServiceStartRequest, ServiceStartResponse>("POST", `/machine.MachineService/ServiceStart`, req, ...options)
+  }
+  static ServiceStop(req: ServiceStopRequest, ...options: fm.fetchOption[]): Promise<ServiceStopResponse> {
+    return fm.fetchReq<ServiceStopRequest, ServiceStopResponse>("POST", `/machine.MachineService/ServiceStop`, req, ...options)
+  }
+  static Shutdown(req: ShutdownRequest, ...options: fm.fetchOption[]): Promise<ShutdownResponse> {
+    return fm.fetchReq<ShutdownRequest, ShutdownResponse>("POST", `/machine.MachineService/Shutdown`, req, ...options)
+  }
+  static Stats(req: StatsRequest, ...options: fm.fetchOption[]): Promise<StatsResponse> {
+    return fm.fetchReq<StatsRequest, StatsResponse>("POST", `/machine.MachineService/Stats`, req, ...options)
+  }
+  static SystemStat(req: GoogleProtobufEmpty.Empty, ...options: fm.fetchOption[]): Promise<SystemStatResponse> {
+    return fm.fetchReq<GoogleProtobufEmpty.Empty, SystemStatResponse>("POST", `/machine.MachineService/SystemStat`, req, ...options)
+  }
+  static Upgrade(req: UpgradeRequest, ...options: fm.fetchOption[]): Promise<UpgradeResponse> {
+    return fm.fetchReq<UpgradeRequest, UpgradeResponse>("POST", `/machine.MachineService/Upgrade`, req, ...options)
+  }
+  static Version(req: GoogleProtobufEmpty.Empty, ...options: fm.fetchOption[]): Promise<VersionResponse> {
+    return fm.fetchReq<GoogleProtobufEmpty.Empty, VersionResponse>("POST", `/machine.MachineService/Version`, req, ...options)
+  }
+  static GenerateClientConfiguration(req: GenerateClientConfigurationRequest, ...options: fm.fetchOption[]): Promise<GenerateClientConfigurationResponse> {
+    return fm.fetchReq<GenerateClientConfigurationRequest, GenerateClientConfigurationResponse>("POST", `/machine.MachineService/GenerateClientConfiguration`, req, ...options)
+  }
+  static PacketCapture(req: PacketCaptureRequest, entityNotifier?: fm.NotifyStreamEntityArrival<CommonCommon.Data>, ...options: fm.fetchOption[]): Promise<void> {
+    return fm.fetchStreamingRequest<PacketCaptureRequest, CommonCommon.Data>("POST", `/machine.MachineService/PacketCapture`, req, entityNotifier, ...options)
+  }
+}
\ No newline at end of file
diff --git a/frontend/src/api/talos/machine/machine.proto b/frontend/src/api/talos/machine/machine.proto
new file mode 100644
index 000000000..f2d6cdfff
--- /dev/null
+++ b/frontend/src/api/talos/machine/machine.proto
@@ -0,0 +1,1097 @@
+syntax = "proto3";
+
+package machine;
+
+option go_package = "github.com/siderolabs/talos/pkg/machinery/api/machine";
+
+import "common/common.proto";
+import "google/protobuf/any.proto";
+import "google/protobuf/duration.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/timestamp.proto";
+
+// The machine service definition.
+service MachineService {
+  rpc ApplyConfiguration(ApplyConfigurationRequest) returns (ApplyConfigurationResponse);
+  // Bootstrap method makes control plane node enter etcd bootstrap mode.
+  //
+  // Node aborts etcd join sequence and creates single-node etcd cluster.
+  //
+  // If recover_etcd argument is specified, etcd is recovered from a snapshot
+  // uploaded with EtcdRecover.
+  rpc Bootstrap(BootstrapRequest) returns (BootstrapResponse);
+  rpc Containers(ContainersRequest) returns (ContainersResponse);
+  rpc Copy(CopyRequest) returns (stream common.Data);
+  rpc CPUInfo(google.protobuf.Empty) returns (CPUInfoResponse);
+  rpc DiskStats(google.protobuf.Empty) returns (DiskStatsResponse);
+  rpc Dmesg(DmesgRequest) returns (stream common.Data);
+  rpc Events(EventsRequest) returns (stream Event);
+  rpc EtcdMemberList(EtcdMemberListRequest) returns (EtcdMemberListResponse);
+  rpc EtcdRemoveMember(EtcdRemoveMemberRequest) returns (EtcdRemoveMemberResponse);
+  rpc EtcdLeaveCluster(EtcdLeaveClusterRequest) returns (EtcdLeaveClusterResponse);
+  rpc EtcdForfeitLeadership(EtcdForfeitLeadershipRequest) returns (EtcdForfeitLeadershipResponse);
+  // EtcdRecover method uploads etcd data snapshot created with EtcdSnapshot
+  // to the node.
+  //
+  // Snapshot can be later used to recover the cluster via Bootstrap method.
+  rpc EtcdRecover(stream common.Data) returns (EtcdRecoverResponse);
+  // EtcdSnapshot method creates etcd data snapshot (backup) from the local etcd instance
+  // and streams it back to the client.
+  //
+  // This method is available only on control plane nodes (which run etcd).
+  rpc EtcdSnapshot(EtcdSnapshotRequest) returns (stream common.Data);
+  rpc GenerateConfiguration(GenerateConfigurationRequest) returns (GenerateConfigurationResponse);
+  rpc Hostname(google.protobuf.Empty) returns (HostnameResponse);
+  rpc Kubeconfig(google.protobuf.Empty) returns (stream common.Data);
+  rpc List(ListRequest) returns (stream FileInfo);
+  rpc DiskUsage(DiskUsageRequest) returns (stream DiskUsageInfo);
+  rpc LoadAvg(google.protobuf.Empty) returns (LoadAvgResponse);
+  rpc Logs(LogsRequest) returns (stream common.Data);
+  rpc Memory(google.protobuf.Empty) returns (MemoryResponse);
+  rpc Mounts(google.protobuf.Empty) returns (MountsResponse);
+  rpc NetworkDeviceStats(google.protobuf.Empty) returns (NetworkDeviceStatsResponse);
+  rpc Processes(google.protobuf.Empty) returns (ProcessesResponse);
+  rpc Read(ReadRequest) returns (stream common.Data);
+  rpc Reboot(RebootRequest) returns (RebootResponse);
+  rpc Restart(RestartRequest) returns (RestartResponse);
+  rpc Rollback(RollbackRequest) returns (RollbackResponse);
+  rpc Reset(ResetRequest) returns (ResetResponse);
+  rpc ServiceList(google.protobuf.Empty) returns (ServiceListResponse);
+  rpc ServiceRestart(ServiceRestartRequest) returns (ServiceRestartResponse);
+  rpc ServiceStart(ServiceStartRequest) returns (ServiceStartResponse);
+  rpc ServiceStop(ServiceStopRequest) returns (ServiceStopResponse);
+  rpc Shutdown(ShutdownRequest) returns (ShutdownResponse);
+  rpc Stats(StatsRequest) returns (StatsResponse);
+  rpc SystemStat(google.protobuf.Empty) returns (SystemStatResponse);
+  rpc Upgrade(UpgradeRequest) returns (UpgradeResponse);
+  rpc Version(google.protobuf.Empty) returns (VersionResponse);
+  // GenerateClientConfiguration generates talosctl client configuration (talosconfig).
+  rpc GenerateClientConfiguration(GenerateClientConfigurationRequest) returns (GenerateClientConfigurationResponse);
+  // PacketCapture performs packet capture and streams back pcap file.
+  rpc PacketCapture(PacketCaptureRequest) returns (stream common.Data);
+}
+
+// rpc applyConfiguration
+// ApplyConfiguration describes a request to assert a new configuration upon a
+// node.
+message ApplyConfigurationRequest {
+  enum Mode {
+    REBOOT = 0;
+    AUTO = 1;
+    NO_REBOOT = 2;
+    STAGED = 3;
+    TRY = 4;
+  }
+  bytes data = 1;
+  // replaced by mode
+  bool on_reboot = 2 [
+    (common.remove_deprecated_field) = "v1.4",
+    deprecated = true
+  ];
+  // replaced by mode
+  bool immediate = 3 [
+    (common.remove_deprecated_field) = "v1.4",
+    deprecated = true
+  ];
+  Mode mode = 4;
+  bool dry_run = 5;
+  google.protobuf.Duration try_mode_timeout = 6;
+}
+
+// ApplyConfigurationResponse describes the response to a configuration request.
+message ApplyConfiguration {
+  common.Metadata metadata = 1;
+  // Configuration validation warnings.
+  repeated string warnings = 2;
+  // States which mode was actually chosen.
+  ApplyConfigurationRequest.Mode mode = 3;
+  // Human-readable message explaining the result of the apply configuration call.
+  string mode_details = 4;
+}
+
+message ApplyConfigurationResponse {
+  repeated ApplyConfiguration messages = 1;
+}
+
+// rpc reboot
+message RebootRequest {
+  enum Mode {
+    DEFAULT = 0;
+    POWERCYCLE = 1;
+  }
+  Mode mode = 1;
+}
+
+// The reboot message containing the reboot status.
+message Reboot {
+  common.Metadata metadata = 1;
+  string actor_id = 2;
+}
+
+message RebootResponse {
+  repeated Reboot messages = 1;
+}
+
+// rpc Bootstrap
+message BootstrapRequest {
+  // Enable etcd recovery from the snapshot.
+  //
+  // Snapshot should be uploaded before this call via EtcdRecover RPC.
+  bool recover_etcd = 1;
+  // Skip hash check on the snapshot (etcd).
+  //
+  // Enable this when recovering from data directory copy to skip integrity check.
+  bool recover_skip_hash_check = 2;
+}
+
+// The bootstrap message containing the bootstrap status.
+message Bootstrap {
+  common.Metadata metadata = 1;
+}
+
+message BootstrapResponse {
+  repeated Bootstrap messages = 1;
+}
+
+// rpc events
+message SequenceEvent {
+  string sequence = 1;
+  enum Action {
+    NOOP = 0;
+    START = 1;
+    STOP = 2;
+  }
+  Action action = 2;
+  common.Error error = 3;
+}
+
+message PhaseEvent {
+  string phase = 1;
+  enum Action {
+    START = 0;
+    STOP = 1;
+  }
+  Action action = 2;
+}
+
+message TaskEvent {
+  string task = 1;
+  enum Action {
+    START = 0;
+    STOP = 1;
+  }
+  Action action = 2;
+}
+
+message ServiceStateEvent {
+  string service = 1;
+  enum Action {
+    INITIALIZED = 0;
+    PREPARING = 1;
+    WAITING = 2;
+    RUNNING = 3;
+    STOPPING = 4;
+    FINISHED = 5;
+    FAILED = 6;
+    SKIPPED = 7;
+  }
+  Action action = 2;
+  string message = 3;
+  ServiceHealth health = 4;
+}
+
+message RestartEvent {
+  int64 cmd = 1;
+}
+
+// ConfigLoadErrorEvent is reported when the config loading has failed.
+message ConfigLoadErrorEvent {
+  string error = 1;
+}
+
+// ConfigValidationErrorEvent is reported when config validation has failed.
+message ConfigValidationErrorEvent {
+  string error = 1;
+}
+
+// AddressEvent reports node endpoints aggregated from k8s.Endpoints and network.Hostname.
+message AddressEvent {
+  string hostname = 1;
+  repeated string addresses = 2;
+}
+
+// MachineStatusEvent reports changes to the MachineStatus resource.
+message MachineStatusEvent {
+  message MachineStatus {
+    message UnmetCondition {
+      string name = 1;
+      string reason = 2;
+    }
+    bool ready = 1;
+    repeated UnmetCondition unmet_conditions = 2;
+  }
+  enum MachineStage {
+    UNKNOWN = 0;
+    BOOTING = 1;
+    INSTALLING = 2;
+    MAINTENANCE = 3;
+    RUNNING = 4;
+    REBOOTING = 5;
+    SHUTTING_DOWN = 6;
+    RESETTING = 7;
+    UPGRADING = 8;
+  }
+  MachineStage stage = 1;
+  MachineStatus status = 2;
+}
+
+message EventsRequest {
+  int32 tail_events = 1;
+  string tail_id = 2;
+  int32 tail_seconds = 3;
+  string with_actor_id = 4;
+}
+
+message Event {
+  common.Metadata metadata = 1;
+  google.protobuf.Any data = 2;
+  string id = 3;
+  string actor_id = 4;
+}
+
+// rpc reset
+message ResetPartitionSpec {
+  string label = 1;
+  bool wipe = 2;
+}
+
+message ResetRequest {
+  // Graceful indicates whether node should leave etcd before the upgrade, it also
+  // enforces etcd checks before leaving.
+  bool graceful = 1;
+  // Reboot indicates whether node should reboot or halt after resetting.
+  bool reboot = 2;
+  // System_partitions_to_wipe lists specific system disk partitions to be reset (wiped).
+  // If system_partitions_to_wipe is empty, all the partitions are erased.
+  repeated ResetPartitionSpec system_partitions_to_wipe = 3;
+}
+
+// The reset message containing the restart status.
+message Reset {
+  common.Metadata metadata = 1;
+  string actor_id = 2;
+}
+
+message ResetResponse {
+  repeated Reset messages = 1;
+}
+
+// rpc shutdown
+// The messages message containing the shutdown status.
+message Shutdown {
+  common.Metadata metadata = 1;
+  string actor_id = 2;
+}
+
+message ShutdownRequest {
+  // Force indicates whether node should shutdown without first cordening and draining
+  bool force = 1;
+}
+
+message ShutdownResponse {
+  repeated Shutdown messages = 1;
+}
+
+// rpc upgrade
+message UpgradeRequest {
+  string image = 1;
+  bool preserve = 2;
+  bool stage = 3;
+  bool force = 4;
+}
+
+message Upgrade {
+  common.Metadata metadata = 1;
+  string ack = 2;
+  string actor_id = 3;
+}
+
+message UpgradeResponse {
+  repeated Upgrade messages = 1;
+}
+
+// rpc servicelist
+message ServiceList {
+  common.Metadata metadata = 1;
+  repeated ServiceInfo services = 2;
+}
+
+message ServiceListResponse {
+  repeated ServiceList messages = 1;
+}
+
+message ServiceInfo {
+  string id = 1;
+  string state = 2;
+  ServiceEvents events = 3;
+  ServiceHealth health = 4;
+}
+
+message ServiceEvents {
+  repeated ServiceEvent events = 1;
+}
+
+message ServiceEvent {
+  string msg = 1;
+  string state = 2;
+  google.protobuf.Timestamp ts = 3;
+}
+
+message ServiceHealth {
+  bool unknown = 1;
+  bool healthy = 2;
+  string last_message = 3;
+  google.protobuf.Timestamp last_change = 4;
+}
+
+// rpc servicestart
+message ServiceStartRequest {
+  string id = 1;
+}
+
+message ServiceStart {
+  common.Metadata metadata = 1;
+  string resp = 2;
+}
+
+message ServiceStartResponse {
+  repeated ServiceStart messages = 1;
+}
+
+message ServiceStopRequest {
+  string id = 1;
+}
+
+message ServiceStop {
+  common.Metadata metadata = 1;
+  string resp = 2;
+}
+
+message ServiceStopResponse {
+  repeated ServiceStop messages = 1;
+}
+
+message ServiceRestartRequest {
+  string id = 1;
+}
+
+message ServiceRestart {
+  common.Metadata metadata = 1;
+  string resp = 2;
+}
+
+message ServiceRestartResponse {
+  repeated ServiceRestart messages = 1;
+}
+
+// CopyRequest describes a request to copy data out of Talos node
+//
+// Copy produces .tar.gz archive which is streamed back to the caller
+message CopyRequest {
+  // Root path to start copying data out, it might be either a file or directory
+  string root_path = 1;
+}
+
+// ListRequest describes a request to list the contents of a directory.
+message ListRequest {
+  // Root indicates the root directory for the list. If not indicated, '/' is
+  // presumed.
+  string root = 1;
+  // Recurse indicates that subdirectories should be recursed.
+  bool recurse = 2;
+  // RecursionDepth indicates how many levels of subdirectories should be
+  // recursed. The default (0) indicates that no limit should be enforced.
+  int32 recursion_depth = 3;
+  // File type.
+  enum Type {
+    // Regular file (not directory, symlink, etc).
+    REGULAR = 0;
+    // Directory.
+    DIRECTORY = 1;
+    // Symbolic link.
+    SYMLINK = 2;
+  }
+  // Types indicates what file type should be returned. If not indicated,
+  // all files will be returned.
+  repeated Type types = 4;
+}
+
+// DiskUsageRequest describes a request to list disk usage of directories and regular files
+message DiskUsageRequest {
+  // RecursionDepth indicates how many levels of subdirectories should be
+  // recursed. The default (0) indicates that no limit should be enforced.
+  int32 recursion_depth = 1;
+  // All write sizes for all files, not just directories.
+  bool all = 2;
+  // Threshold exclude entries smaller than SIZE if positive,
+  // or entries greater than SIZE if negative.
+  int64 threshold = 3;
+  // DiskUsagePaths is the list of directories to calculate disk usage for.
+  repeated string paths = 4;
+}
+
+// FileInfo describes a file or directory's information
+message FileInfo {
+  common.Metadata metadata = 1;
+  // Name is the name (including prefixed path) of the file or directory
+  string name = 2;
+  // Size indicates the number of bytes contained within the file
+  int64 size = 3;
+  // Mode is the bitmap of UNIX mode/permission flags of the file
+  uint32 mode = 4;
+  // Modified indicates the UNIX timestamp at which the file was last modified
+  int64 modified = 5;
+  // IsDir indicates that the file is a directory
+  bool is_dir = 6;
+  // Error describes any error encountered while trying to read the file
+  // information.
+  string error = 7;
+  // Link is filled with symlink target
+  string link = 8;
+  // RelativeName is the name of the file or directory relative to the RootPath
+  string relative_name = 9;
+  // Owner uid
+  uint32 uid = 10;
+  // Owner gid
+  uint32 gid = 11;
+}
+
+// DiskUsageInfo describes a file or directory's information for du command
+message DiskUsageInfo {
+  common.Metadata metadata = 1;
+  // Name is the name (including prefixed path) of the file or directory
+  string name = 2;
+  // Size indicates the number of bytes contained within the file
+  int64 size = 3;
+  // Error describes any error encountered while trying to read the file
+  // information.
+  string error = 4;
+  // RelativeName is the name of the file or directory relative to the RootPath
+  string relative_name = 5;
+}
+
+// The messages message containing the requested df stats.
+message Mounts {
+  common.Metadata metadata = 1;
+  repeated MountStat stats = 2;
+}
+
+message MountsResponse {
+  repeated Mounts messages = 1;
+}
+
+// The messages message containing the requested processes.
+message MountStat {
+  string filesystem = 1;
+  uint64 size = 2;
+  uint64 available = 3;
+  string mounted_on = 4;
+}
+
+message Version {
+  common.Metadata metadata = 1;
+  VersionInfo version = 2;
+  PlatformInfo platform = 3;
+  // Features describe individual Talos features that can be switched on or off.
+  FeaturesInfo features = 4;
+}
+
+message VersionResponse {
+  repeated Version messages = 1;
+}
+
+message VersionInfo {
+  string tag = 1;
+  string sha = 2;
+  string built = 3;
+  string go_version = 4;
+  string os = 5;
+  string arch = 6;
+}
+
+message PlatformInfo {
+  string name = 1;
+  string mode = 2;
+}
+
+// FeaturesInfo describes individual Talos features that can be switched on or off.
+message FeaturesInfo {
+  // RBAC is true if role-based access control is enabled.
+  bool rbac = 1;
+}
+
+// rpc logs
+// The request message containing the process name.
+message LogsRequest {
+  string namespace = 1;
+  string id = 2;
+  // driver might be default "containerd" or "cri"
+  common.ContainerDriver driver = 3;
+  bool follow = 4;
+  int32 tail_lines = 5;
+}
+
+message ReadRequest {
+  string path = 1;
+}
+
+// rpc rollback
+message RollbackRequest {}
+
+message Rollback {
+  common.Metadata metadata = 1;
+}
+
+message RollbackResponse {
+  repeated Rollback messages = 1;
+}
+
+// rpc Containers
+
+message ContainersRequest {
+  string namespace = 1;
+  // driver might be default "containerd" or "cri"
+  common.ContainerDriver driver = 2;
+}
+
+// The messages message containing the requested containers.
+message ContainerInfo {
+  string namespace = 1;
+  string id = 2;
+  string image = 3;
+  uint32 pid = 4;
+  string status = 5;
+  string pod_id = 6;
+  string name = 7;
+}
+
+// The messages message containing the requested containers.
+message Container {
+  common.Metadata metadata = 1;
+  repeated ContainerInfo containers = 2;
+}
+
+message ContainersResponse {
+  repeated Container messages = 1;
+}
+
+// dmesg
+message DmesgRequest {
+  bool follow = 1;
+  bool tail = 2;
+}
+
+// rpc processes
+message ProcessesResponse {
+  repeated Process messages = 1;
+}
+
+message Process {
+  common.Metadata metadata = 1;
+  repeated ProcessInfo processes = 2;
+}
+
+message ProcessInfo {
+  int32 pid = 1;
+  int32 ppid = 2;
+  string state = 3;
+  int32 threads = 4;
+  double cpu_time = 5;
+  uint64 virtual_memory = 6;
+  uint64 resident_memory = 7;
+  string command = 8;
+  string executable = 9;
+  string args = 10;
+}
+
+// rpc restart
+// The request message containing the process to restart.
+message RestartRequest {
+  string namespace = 1;
+  string id = 2;
+  // driver might be default "containerd" or "cri"
+  common.ContainerDriver driver = 3;
+}
+
+message Restart {
+  common.Metadata metadata = 1;
+}
+
+// The messages message containing the restart status.
+message RestartResponse {
+  repeated Restart messages = 1;
+}
+
+// rpc stats
+
+// The request message containing the containerd namespace.
+message StatsRequest {
+  string namespace = 1;
+  // driver might be default "containerd" or "cri"
+  common.ContainerDriver driver = 2;
+}
+
+// The messages message containing the requested stats.
+message Stats {
+  common.Metadata metadata = 1;
+  repeated Stat stats = 2;
+}
+
+message StatsResponse {
+  repeated Stats messages = 1;
+}
+
+// The messages message containing the requested stat.
+message Stat {
+  string namespace = 1;
+  string id = 2;
+  uint64 memory_usage = 4;
+  uint64 cpu_usage = 5;
+  string pod_id = 6;
+  string name = 7;
+}
+
+message Memory {
+  common.Metadata metadata = 1;
+  MemInfo meminfo = 2;
+}
+
+message MemoryResponse {
+  repeated Memory messages = 1;
+}
+
+message MemInfo {
+  uint64 memtotal = 1;
+  uint64 memfree = 2;
+  uint64 memavailable = 3;
+  uint64 buffers = 4;
+  uint64 cached = 5;
+  uint64 swapcached = 6;
+  uint64 active = 7;
+  uint64 inactive = 8;
+  uint64 activeanon = 9;
+  uint64 inactiveanon = 10;
+  uint64 activefile = 11;
+  uint64 inactivefile = 12;
+  uint64 unevictable = 13;
+  uint64 mlocked = 14;
+  uint64 swaptotal = 15;
+  uint64 swapfree = 16;
+  uint64 dirty = 17;
+  uint64 writeback = 18;
+  uint64 anonpages = 19;
+  uint64 mapped = 20;
+  uint64 shmem = 21;
+  uint64 slab = 22;
+  uint64 sreclaimable = 23;
+  uint64 sunreclaim = 24;
+  uint64 kernelstack = 25;
+  uint64 pagetables = 26;
+  uint64 nfsunstable = 27;
+  uint64 bounce = 28;
+  uint64 writebacktmp = 29;
+  uint64 commitlimit = 30;
+  uint64 committedas = 31;
+  uint64 vmalloctotal = 32;
+  uint64 vmallocused = 33;
+  uint64 vmallocchunk = 34;
+  uint64 hardwarecorrupted = 35;
+  uint64 anonhugepages = 36;
+  uint64 shmemhugepages = 37;
+  uint64 shmempmdmapped = 38;
+  uint64 cmatotal = 39;
+  uint64 cmafree = 40;
+  uint64 hugepagestotal = 41;
+  uint64 hugepagesfree = 42;
+  uint64 hugepagesrsvd = 43;
+  uint64 hugepagessurp = 44;
+  uint64 hugepagesize = 45;
+  uint64 directmap4k = 46;
+  uint64 directmap2m = 47;
+  uint64 directmap1g = 48;
+}
+
+// rpc Hostname
+
+message HostnameResponse {
+  repeated Hostname messages = 1;
+}
+
+message Hostname {
+  common.Metadata metadata = 1;
+  string hostname = 2;
+}
+
+// rpc LoadAvg
+
+message LoadAvgResponse {
+  repeated LoadAvg messages = 1;
+}
+
+message LoadAvg {
+  common.Metadata metadata = 1;
+  double load1 = 2;
+  double load5 = 3;
+  double load15 = 4;
+}
+
+// rpc SystemStat
+
+message SystemStatResponse {
+  repeated SystemStat messages = 1;
+}
+
+message SystemStat {
+  common.Metadata metadata = 1;
+  uint64 boot_time = 2;
+  CPUStat cpu_total = 3;
+  repeated CPUStat cpu = 4;
+  uint64 irq_total = 5;
+  repeated uint64 irq = 6;
+  uint64 context_switches = 7;
+  uint64 process_created = 8;
+  uint64 process_running = 9;
+  uint64 process_blocked = 10;
+  uint64 soft_irq_total = 11;
+  SoftIRQStat soft_irq = 12;
+}
+
+message CPUStat {
+  double user = 1;
+  double nice = 2;
+  double system = 3;
+  double idle = 4;
+  double iowait = 5;
+  double irq = 6;
+  double soft_irq = 7;
+  double steal = 8;
+  double guest = 9;
+  double guest_nice = 10;
+}
+
+message SoftIRQStat {
+  uint64 hi = 1;
+  uint64 timer = 2;
+  uint64 net_tx = 3;
+  uint64 net_rx = 4;
+  uint64 block = 5;
+  uint64 block_io_poll = 6;
+  uint64 tasklet = 7;
+  uint64 sched = 8;
+  uint64 hrtimer = 9;
+  uint64 rcu = 10;
+}
+
+// rpc CPUInfo
+
+message CPUInfoResponse {
+  repeated CPUsInfo messages = 1;
+}
+
+message CPUsInfo {
+  common.Metadata metadata = 1;
+  repeated CPUInfo cpu_info = 2;
+}
+
+message CPUInfo {
+  uint32 processor = 1;
+  string vendor_id = 2;
+  string cpu_family = 3;
+  string model = 4;
+  string model_name = 5;
+  string stepping = 6;
+  string microcode = 7;
+  double cpu_mhz = 8;
+  string cache_size = 9;
+  string physical_id = 10;
+  uint32 siblings = 11;
+  string core_id = 12;
+  uint32 cpu_cores = 13;
+  string apic_id = 14;
+  string initial_apic_id = 15;
+  string fpu = 16;
+  string fpu_exception = 17;
+  uint32 cpu_id_level = 18;
+  string wp = 19;
+  repeated string flags = 20;
+  repeated string bugs = 21;
+  double bogo_mips = 22;
+  uint32 cl_flush_size = 23;
+  uint32 cache_alignment = 24;
+  string address_sizes = 25;
+  string power_management = 26;
+}
+
+// rpc NetworkDeviceStats
+
+message NetworkDeviceStatsResponse {
+  repeated NetworkDeviceStats messages = 1;
+}
+
+message NetworkDeviceStats {
+  common.Metadata metadata = 1;
+  NetDev total = 2;
+  repeated NetDev devices = 3;
+}
+
+message NetDev {
+  string name = 1;
+  uint64 rx_bytes = 2;
+  uint64 rx_packets = 3;
+  uint64 rx_errors = 4;
+  uint64 rx_dropped = 5;
+  uint64 rx_fifo = 6;
+  uint64 rx_frame = 7;
+  uint64 rx_compressed = 8;
+  uint64 rx_multicast = 9;
+  uint64 tx_bytes = 10;
+  uint64 tx_packets = 11;
+  uint64 tx_errors = 12;
+  uint64 tx_dropped = 13;
+  uint64 tx_fifo = 14;
+  uint64 tx_collisions = 15;
+  uint64 tx_carrier = 16;
+  uint64 tx_compressed = 17;
+}
+
+// rpc DiskStats
+
+message DiskStatsResponse {
+  repeated DiskStats messages = 1;
+}
+
+message DiskStats {
+  common.Metadata metadata = 1;
+  DiskStat total = 2;
+  repeated DiskStat devices = 3;
+}
+
+message DiskStat {
+  string name = 1;
+  uint64 read_completed = 2;
+  uint64 read_merged = 3;
+  uint64 read_sectors = 4;
+  uint64 read_time_ms = 5;
+  uint64 write_completed = 6;
+  uint64 write_merged = 7;
+  uint64 write_sectors = 8;
+  uint64 write_time_ms = 9;
+  uint64 io_in_progress = 10;
+  uint64 io_time_ms = 11;
+  uint64 io_time_weighted_ms = 12;
+  uint64 discard_completed = 13;
+  uint64 discard_merged = 14;
+  uint64 discard_sectors = 15;
+  uint64 discard_time_ms = 16;
+}
+
+message EtcdLeaveClusterRequest {}
+
+message EtcdLeaveCluster {
+  common.Metadata metadata = 1;
+}
+
+message EtcdLeaveClusterResponse {
+  repeated EtcdLeaveCluster messages = 1;
+}
+
+message EtcdRemoveMemberRequest {
+  string member = 1;
+}
+
+message EtcdRemoveMember {
+  common.Metadata metadata = 1;
+}
+
+message EtcdRemoveMemberResponse {
+  repeated EtcdRemoveMember messages = 1;
+}
+
+message EtcdForfeitLeadershipRequest {}
+
+message EtcdForfeitLeadership {
+  common.Metadata metadata = 1;
+  string member = 2;
+}
+
+message EtcdForfeitLeadershipResponse {
+  repeated EtcdForfeitLeadership messages = 1;
+}
+
+message EtcdMemberListRequest {
+  bool query_local = 1;
+}
+
+// EtcdMember describes a single etcd member.
+message EtcdMember {
+  // member ID.
+  uint64 id = 2;
+  // human-readable name of the member.
+  string hostname = 3;
+  // the list of URLs the member exposes to clients for communication.
+  repeated string peer_urls = 4;
+  // the list of URLs the member exposes to the cluster for communication.
+  repeated string client_urls = 5;
+  // learner flag
+  bool is_learner = 6;
+}
+
+// EtcdMembers contains the list of members registered on the host.
+message EtcdMembers {
+  common.Metadata metadata = 1;
+  // list of member hostnames.
+  repeated string legacy_members = 2;
+  // the list of etcd members registered on the node.
+  repeated EtcdMember members = 3;
+}
+
+message EtcdMemberListResponse {
+  repeated EtcdMembers messages = 1;
+}
+
+message EtcdSnapshotRequest {}
+
+message EtcdRecover {
+  common.Metadata metadata = 1;
+}
+
+message EtcdRecoverResponse {
+  repeated EtcdRecover messages = 1;
+}
+
+// rpc generateConfiguration
+
+message RouteConfig {
+  string network = 1;
+  string gateway = 2;
+  uint32 metric = 3;
+}
+
+message DHCPOptionsConfig {
+  uint32 route_metric = 1;
+}
+
+message NetworkDeviceConfig {
+  string interface = 1;
+  string cidr = 2;
+  int32 mtu = 3;
+  bool dhcp = 4;
+  bool ignore = 5;
+  DHCPOptionsConfig dhcp_options = 6;
+  repeated RouteConfig routes = 7;
+}
+
+message NetworkConfig {
+  string hostname = 1;
+  repeated NetworkDeviceConfig interfaces = 2;
+}
+
+message InstallConfig {
+  string install_disk = 1;
+  string install_image = 2;
+}
+
+message MachineConfig {
+  enum MachineType {
+    TYPE_UNKNOWN = 0;
+    TYPE_INIT = 1;
+    TYPE_CONTROL_PLANE = 2;
+    TYPE_WORKER = 3;
+  }
+  MachineType type = 1;
+  InstallConfig install_config = 2;
+  NetworkConfig network_config = 3;
+  string kubernetes_version = 4;
+}
+
+message ControlPlaneConfig {
+  string endpoint = 1;
+}
+
+message CNIConfig {
+  string name = 1;
+  repeated string urls = 2;
+}
+
+message ClusterNetworkConfig {
+  string dns_domain = 1;
+  CNIConfig cni_config = 2;
+}
+
+message ClusterConfig {
+  string name = 1;
+  ControlPlaneConfig control_plane = 2;
+  ClusterNetworkConfig cluster_network = 3;
+  bool allow_scheduling_on_control_planes = 4;
+}
+
+// GenerateConfigurationRequest describes a request to generate a new configuration
+// on a node.
+message GenerateConfigurationRequest {
+  string config_version = 1;
+  ClusterConfig cluster_config = 2;
+  MachineConfig machine_config = 3;
+  google.protobuf.Timestamp override_time = 4;
+}
+
+// GenerateConfiguration describes the response to a generate configuration request.
+message GenerateConfiguration {
+  common.Metadata metadata = 1;
+  repeated bytes data = 2;
+  bytes talosconfig = 3;
+}
+
+message GenerateConfigurationResponse {
+  repeated GenerateConfiguration messages = 1;
+}
+
+message GenerateClientConfigurationRequest {
+  // Roles in the generated client certificate.
+  repeated string roles = 1;
+  // Client certificate TTL.
+  google.protobuf.Duration crt_ttl = 2;
+}
+
+message GenerateClientConfiguration {
+  common.Metadata metadata = 1;
+  // PEM-encoded CA certificate.
+  bytes ca = 2;
+  // PEM-encoded generated client certificate.
+  bytes crt = 3;
+  // PEM-encoded generated client key.
+  bytes key = 4;
+  // Client configuration (talosconfig) file content.
+  bytes talosconfig = 5;
+}
+
+message GenerateClientConfigurationResponse {
+  repeated GenerateClientConfiguration messages = 1;
+}
+
+message PacketCaptureRequest {
+  // Interface name to perform packet capture on.
+  string interface = 1;
+  // Enable promiscuous mode.
+  bool promiscuous = 2;
+  // Snap length in bytes.
+  uint32 snap_len = 3;
+  // BPF filter.
+  repeated BPFInstruction bpf_filter = 4;
+}
+
+message BPFInstruction {
+  uint32 op = 1;
+  uint32 jt = 2;
+  uint32 jf = 3;
+  uint32 k = 4;
+}
diff --git a/frontend/src/api/v1alpha1/resource.pb.ts b/frontend/src/api/v1alpha1/resource.pb.ts
new file mode 100644
index 000000000..6b1b25d68
--- /dev/null
+++ b/frontend/src/api/v1alpha1/resource.pb.ts
@@ -0,0 +1,57 @@
+/* eslint-disable */
+// @ts-nocheck
+/*
+* This file is a generated Typescript file for GRPC Gateway, DO NOT MODIFY
+*/
+
+import * as GoogleProtobufTimestamp from "../google/protobuf/timestamp.pb"
+
+export enum LabelTermOperation {
+  EXISTS = 0,
+  EQUAL = 1,
+  NOT_EXISTS = 2,
+  IN = 3,
+  LT = 4,
+  LTE = 5,
+  LT_NUMERIC = 6,
+  LTE_NUMERIC = 7,
+}
+
+export type Metadata = {
+  namespace?: string
+  type?: string
+  id?: string
+  version?: string
+  owner?: string
+  phase?: string
+  created?: GoogleProtobufTimestamp.Timestamp
+  updated?: GoogleProtobufTimestamp.Timestamp
+  finalizers?: string[]
+  annotations?: {[key: string]: string}
+  labels?: {[key: string]: string}
+}
+
+export type Spec = {
+  proto_spec?: Uint8Array
+  yaml_spec?: string
+}
+
+export type Resource = {
+  metadata?: Metadata
+  spec?: Spec
+}
+
+export type LabelTerm = {
+  key?: string
+  op?: LabelTermOperation
+  value?: string[]
+  invert?: boolean
+}
+
+export type LabelQuery = {
+  terms?: LabelTerm[]
+}
+
+export type IDQuery = {
+  regexp?: string
+}
\ No newline at end of file
diff --git a/frontend/src/api/v1alpha1/resource.proto b/frontend/src/api/v1alpha1/resource.proto
new file mode 100644
index 000000000..28121f7bf
--- /dev/null
+++ b/frontend/src/api/v1alpha1/resource.proto
@@ -0,0 +1,84 @@
+syntax = "proto3";
+
+// Resource package defines protobuf serialization of COSI resources.
+package cosi.resource;
+
+option go_package = "github.com/cosi-project/runtime/api/v1alpha1";
+
+import "google/protobuf/timestamp.proto";
+
+// Metadata represents resource metadata.
+//
+// (namespace, type, id) is a resource pointer.
+// (version) is a current resource version.
+// (owner) is filled in for controller-managed resources with controller name.
+// (phase) indicates whether resource is going through tear down phase.
+// (finalizers) are attached controllers blocking teardown of the resource.
+// (labels) and (annotations) are free-form key-value pairs; labels allow queries.
+message Metadata {
+    string namespace = 1;
+    string type = 2;
+    string id = 3;
+    string version = 4;
+    string owner = 5;
+    string phase = 6;
+    google.protobuf.Timestamp created = 7;
+    google.protobuf.Timestamp updated = 8;
+    repeated string finalizers = 9;
+    map<string, string> annotations = 11;
+    map<string, string> labels = 10;
+}
+
+// Spec defines content of the resource.
+message Spec {
+    // Protobuf-serialized representation of the resource.
+    bytes proto_spec = 1;
+    // YAML representation of the spec (optional).
+    string yaml_spec = 2;
+}
+
+// Resource is a combination of metadata and spec.
+message Resource {
+    Metadata metadata = 1;
+    Spec spec = 2;
+}
+
+// LabelTerm is an expression on a label.
+message LabelTerm {
+    enum Operation {
+        // Label exists.
+        EXISTS = 0;
+        // Label value is equal.
+        EQUAL = 1;
+        // Label doesn't exist.
+        NOT_EXISTS = 2 [deprecated=true];
+        // Label value is in the set.
+        IN = 3;
+        // Label value is less.
+        LT = 4;
+        // Label value is less or equal.
+        LTE = 5;
+        // Label value is less than number.
+        LT_NUMERIC = 6;
+        // Label value is less or equal numeric.
+        LTE_NUMERIC = 7;
+    }
+
+    string key = 1;
+    Operation op = 2;
+    repeated string value = 3;
+    // Inverts the condition.
+    bool invert = 5;
+}
+
+// LabelQuery is a query on resource metadata labels.
+//
+// Terms are combined with AND.
+message LabelQuery {
+    repeated LabelTerm terms = 1;
+}
+
+// IDQuery is a query on resource metadata ID.
+message IDQuery {
+    string regexp = 1;
+}
diff --git a/frontend/src/api/watch.ts b/frontend/src/api/watch.ts
new file mode 100644
index 000000000..da58806a9
--- /dev/null
+++ b/frontend/src/api/watch.ts
@@ -0,0 +1,726 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { onBeforeUnmount, onMounted, ref, Ref, watch } from 'vue';
+import { Runtime } from '@/api/common/omni.pb';
+import { EventType, WatchRequest, WatchResponse } from '@/api/omni/resources/resources.pb';
+import { Resource, ResourceService, ResourceTyped, Stream } from '@/api/grpc';
+import { Metadata } from '@/api/v1alpha1/resource.pb';
+import { withContext, withMetadata, withRuntime, GRPCMetadata } from '@/api/options';
+import { fetchOption } from '@/api/fetch.pb';
+
+export interface Callback {
+  (message: WatchResponse, spec: WatchEventSpec)
+}
+
+export type WatchEventSpec = {
+  res?: Resource,
+  old?: Resource,
+};
+
+export class WatchFunc {
+  protected runtime: Runtime = Runtime.Kubernetes;
+  protected callback: (resp: WatchResponse) => void;
+  protected stream?: Stream<WatchRequest, WatchResponse>;
+
+  public readonly loading: Ref<boolean> = ref(false);
+  public readonly running: Ref<boolean> = ref(false);
+  public readonly err: Ref<string |  null> = ref(null);
+
+  constructor(callback: Callback) {
+    this.callback = (message: WatchResponse) => {
+      const spec: WatchEventSpec = {};
+
+      if (message.event?.resource) {
+        spec.res = JSON.parse(message.event?.resource);
+      }
+
+      if (message.event?.old) {
+        spec.old = JSON.parse(message.event?.old);
+      }
+
+      if (message.event?.event_type === EventType.BOOTSTRAPPED) {
+        this.loading.value = false;
+      }
+
+      callback(message, spec);
+    };
+  }
+
+  // setup is meant to be called from the component setup method
+  public setup(opts: WatchSource<WatchOptions | undefined> | WatchOptions) {
+    let unmounted = false;
+
+    const reactiveOpts = isRef(opts) ? (opts as WatchSource<WatchOptions>) : null;
+
+    const startWatch = async () => {
+      stopWatch();
+
+      const watchOptions = reactiveOpts ? reactiveOpts.value : opts;
+
+      if (!watchOptions)
+        return;
+
+      await this.start(watchOptions as WatchOptions);
+
+      if (unmounted) {
+        stopWatch();
+      }
+    };
+
+    if (reactiveOpts) {
+      watch(reactiveOpts, (newval, oldval) => {
+        if (JSON.stringify(newval) !== JSON.stringify(oldval)) {
+          startWatch();
+        }
+      });
+    }
+
+    const stopWatch = async () => {
+      this.stop();
+    };
+
+    onMounted(async () => {
+      await startWatch();
+    });
+
+    onBeforeUnmount(async () => {
+      unmounted = true;
+
+      stopWatch();
+    });
+  }
+
+  public start(opts: WatchOptions): Promise<void> {
+    return this.createStream(opts);
+  }
+
+  public async createStream(opts: WatchOptions, onStart?: () => void, onError?: (err: Error) => void): Promise<void> {
+    this.loading.value = true;
+    this.err.value = "";
+
+    this.runtime = opts.runtime;
+
+    const metadata: GRPCMetadata = {};
+
+    if (opts.selectors?.length) {
+      metadata.selectors = opts.selectors.join(opts.selectUsingOR ? ";" : ",");
+    }
+
+    const fetchOptions: fetchOption[] = [
+      withRuntime(this.runtime),
+      withMetadata(metadata),
+    ];
+
+    if (opts.context) {
+      fetchOptions.push(
+        withContext(opts.context),
+      );
+    }
+
+    this.stream = await ResourceService.Watch({
+      id: opts.resource.id,
+      namespace: opts.resource.namespace,
+      type: opts.resource.type,
+      tail_events: opts.tailEvents,
+      limit: opts.limit,
+      sort_by_field: opts.sortByField,
+      sort_descending: opts.sortDescending,
+      search_for: opts.searchFor,
+      offset: opts.offset,
+    }, this.callback, fetchOptions, () => {
+      this.onStart();
+      if (onStart) onStart();
+    }, (e: Error) => {
+      this.onError(e);
+      if (onError) onError(e);
+    });
+
+    this.running.value = true;
+  }
+
+  public stop() {
+    this.running.value = false;
+
+    if (this.stream) {
+      this.stream.shutdown();
+    }
+  }
+
+  public id(item: {metadata: {id?: string, name?: string, namespace?: string}}): string {
+    return itemID(item);
+  }
+
+  protected onStart() {
+    this.err.value = null;
+    this.loading.value = true;
+  }
+
+  protected onError(error: Error) {
+    this.err.value = error.message ?? error.toString();
+    this.loading.value = false;
+  }
+}
+
+export type WatchContext = {
+  cluster: string,
+  nodes?: string[],
+};
+
+export type WatchOptions = {
+  runtime: Runtime,
+  resource: Metadata,
+  context?: WatchContext,
+  selectors?: string[],
+  selectUsingOR?: boolean,
+  tailEvents?: number,
+  offset?: number,
+  limit?: number,
+  sortByField?: string,
+  sortDescending?: boolean,
+  searchFor?: string[],
+}
+
+export default class Watch<T> extends WatchFunc {
+  public readonly items?: Ref<ResourceTyped<T>[]>;
+  public readonly item?: Ref<ResourceTyped<T> | undefined>;
+  public readonly total: Ref<number> = ref(0);
+
+  private watchItems?: WatchItems<T>;
+  private lastTotal: number = 0;
+
+  constructor(target: Ref<ResourceTyped<T>[]> | Ref<ResourceTyped<T> | undefined>, callback?: Callback) {
+    let handler: Callback | undefined;
+
+    super((event: WatchResponse, spec: WatchEventSpec) => {
+      if (callback) {
+        callback(event, spec);
+      }
+
+      if (handler) {
+        handler(event, spec);
+      }
+
+      if (event.total !== undefined) {
+        this.lastTotal = event.total ?? 0;
+
+        if (this.watchItems?.bootstrapped) {
+          this.total.value = this.lastTotal;
+        }
+      }
+    });
+
+    if (target.value && (<ResourceTyped<T>[]>target.value).push !== undefined) {
+      handler = this.listHandler.bind(this);
+
+      this.items = (<Ref<ResourceTyped<T>[]>>target)
+    } else {
+      handler = this.singleItemHandler.bind(this);
+
+      this.item = (<Ref<ResourceTyped<T> | undefined>>target);
+    }
+  }
+
+  public async start(opts: WatchOptions): Promise<void> {
+    if (this.items) {
+      this.watchItems = new WatchItems(this.items.value);
+
+      this.items.value.splice(0, this.items.value.length);
+    }
+
+    this.watchItems?.setDescending(opts.sortDescending ?? false);
+
+    await this.createStream(opts);
+
+    if (!this.stream) {
+      return;
+    }
+
+    this.running.value = true;
+  }
+
+  public stop() {
+    super.stop();
+
+    if (this.watchItems) {
+      this.watchItems.reset();
+    }
+
+    if (this.items) {
+      this.items.value.splice(0, this.items.value.length);
+    } else if (this.item) {
+      this.item.value = undefined;
+    }
+  }
+
+  protected onStart() {
+    if (this.watchItems) {
+      this.watchItems.reset();
+    }
+
+    super.onStart();
+  }
+
+  private singleItemHandler(message: WatchResponse, spec: WatchEventSpec) {
+    if (message.event?.event_type == EventType.BOOTSTRAPPED) {
+      this.loading.value = false;
+
+      return;
+    }
+
+    if (!spec.res) {
+      throw new Error(`malformed ${message.event?.event_type} event: no resource defined`);
+    }
+
+    if (!this.item) {
+      return;
+    }
+
+    switch(message.event?.event_type) {
+      case EventType.UPDATED:
+      case EventType.CREATED:
+        this.item.value = spec.res;
+        break;
+      case EventType.DESTROYED:
+        this.item.value = undefined;
+        break;
+    }
+  }
+
+  private listHandler(message: WatchResponse, spec: WatchEventSpec) {
+    if (!this.items || !this.watchItems)
+      return;
+
+    if (message.event?.event_type == EventType.BOOTSTRAPPED) {
+      this.loading.value = false;
+
+      this.watchItems.bootstrap();
+
+      return;
+    }
+
+    if (!spec.res) {
+      throw new Error(`malformed ${message.event?.event_type} event: no resource defined`);
+    }
+
+    switch(message.event?.event_type) {
+      case EventType.UPDATED:
+      case EventType.CREATED:
+        this.watchItems.createOrUpdate({...spec.res, sortFieldData: message.sort_field_data}, spec.old);
+
+        break;
+      case EventType.DESTROYED:
+        this.watchItems.remove(itemID(spec.res));
+
+        break;
+    }
+  }
+}
+
+const compareFn = <T>(left: ResourceSort<T>, right: ResourceSort<T>, sortDescending?: boolean): number => {
+  const inv = sortDescending ? -1 : 1;
+
+  if (left.sortFieldData && right.sortFieldData) {
+    if (left.sortFieldData > right.sortFieldData) {
+      return 1 * inv
+    } else if (left.sortFieldData < right.sortFieldData) {
+      return -1 * inv;
+    }
+  }
+
+  const leftID = itemID(left);
+  const rightID = itemID(right);
+
+  if (leftID > rightID) {
+    return 1;
+  } else if (leftID < rightID) {
+    return -1;
+  }
+
+  return 0;
+}
+
+function getInsertionIndex<T>(arr: ResourceTyped<T>[], item: ResourceSort<T>, sortDescending?: boolean): number {
+  const itemsCount = arr.length;
+
+  if (itemsCount === 0) {
+    return 0;
+  }
+
+  const lastItem = arr[itemsCount - 1];
+
+  if (compareFn(item, lastItem, sortDescending) >= 0) {
+    return itemsCount;
+  }
+
+  const getMidPoint = (start: number, end: number) => Math.floor((end - start) / 2) + start;
+  let start = 0;
+  let end = itemsCount - 1;
+  let index = getMidPoint(start, end);
+
+  while (start < end) {
+    const curItem = arr[index];
+
+    const comparison = compareFn(item, curItem, sortDescending);
+
+    if (comparison === 0) {
+      break;
+    } else if (comparison < 0) {
+      end = index;
+    } else {
+      start = index + 1;
+    }
+    index = getMidPoint(start, end);
+  }
+
+  return index;
+}
+
+export const itemID = (item: {metadata: {id?: string, name?: string, namespace?: string}}): string => {
+  if(item.metadata == null) {
+    return "";
+  }
+
+  return `${item.metadata.namespace || "default"}.${item.metadata.name ?? item.metadata.id}`;
+}
+
+export type ResourceSort<T> = ResourceTyped<T> & {sortFieldData?: string};
+
+// WatchItems wraps items list and handles sort order, insertions and removals.
+class WatchItems<T> {
+  private items: ResourceSort<T>[];
+  private bootstrapList: ResourceSort<T>[] = [];
+
+  public bootstrapped: boolean = false;
+  private sortDescending: boolean = false;
+
+  constructor(items: ResourceTyped<T>[]) {
+    this.items = items;
+  }
+
+  public setDescending(descending: boolean) {
+    if (this.sortDescending === descending) {
+      return;
+    }
+
+    this.sortDescending = descending;
+    this.items.sort((a, b): number => {
+      return compareFn(a, b, descending);
+    })
+  }
+
+  public createOrUpdate(item: ResourceSort<T>, old?: ResourceTyped<T>) {
+    const items = this.bootstrapped ? this.items : this.bootstrapList;
+
+    let foundIndex = this.findIndex(itemID(old ?? item), items);
+
+    if (foundIndex > -1) {
+      if (items[foundIndex].sortFieldData !== item.sortFieldData) {
+        items.splice(foundIndex, 1);
+        foundIndex = -1;
+      } else {
+        items[foundIndex] = item;
+      }
+    }
+
+    if (foundIndex < 0) {
+      const index = getInsertionIndex(items, item, this.sortDescending);
+
+      items.splice(index, 0, item);
+    }
+  }
+
+  public remove(id: string) {
+    const items = this.bootstrapped ? this.items : this.bootstrapList;
+
+    const foundIndex = this.findIndex(id, items);
+
+    if (foundIndex == -1) {
+      return;
+    }
+
+    items.splice(foundIndex, 1);
+  }
+
+  public reset() {
+    this.bootstrapList = [];
+    this.bootstrapped = false;
+  }
+
+  public bootstrap() {
+    this.bootstrapped = true;
+
+    if (this.items) {
+      this.items.splice(0, this.items.length);
+      this.items.push(...this.bootstrapList);
+    }
+
+    this.bootstrapList = [];
+  }
+
+  private findIndex(id: string, items: ResourceTyped<T>[]): number {
+    return items.findIndex((element: ResourceTyped<T>) => {
+      return itemID(element) === id;
+    })
+  }
+}
+
+export type WatchJoinOptions = WatchOptions & {idFunc?: <T>(res: ResourceTyped<T>) => string};
+
+interface WatchSource<T> {
+  value: T
+}
+
+export class WatchJoin<T extends Resource> {
+  private watches: WatchFunc[] = [];
+  private items: Ref<ResourceTyped<T>[]>;
+  private watchItems?: WatchItems<T>;
+  private itemMap: Record<string, Record<string, Record<string, ResourceSort<T>>>> = {};
+  private primaryResourceType?: string;
+  private lastTotal: number = 0;
+
+  public readonly loading = ref(false);
+  public readonly err: Ref<string | null> = ref(null);
+  public readonly total: Ref<number> = ref(0);
+
+  constructor(items: Ref<ResourceTyped<T>[]>) {
+    this.items = items;
+  }
+
+  public setup(primary: WatchSource<WatchJoinOptions> | WatchJoinOptions, resources: WatchSource<WatchJoinOptions[]> | WatchJoinOptions[]) {
+    let unmounted = false;
+
+    const reactivePrimary = isRef(primary) ? primary as WatchSource<WatchJoinOptions> : null;
+    const reactiveResources = isRef(resources) ? resources as WatchSource<WatchJoinOptions[]> : null;
+
+    const restartIfDiff = (newval: WatchJoinOptions | WatchJoinOptions[], oldval: WatchJoinOptions | WatchJoinOptions[]) => {
+      if (JSON.stringify(newval) === JSON.stringify(oldval)) {
+        return;
+      }
+
+      startWatch();
+    }
+
+    const startWatch = async () => {
+      stopWatch();
+
+      const primaryOpts: WatchJoinOptions = reactivePrimary ? reactivePrimary.value : primary as WatchJoinOptions;
+      const resourcesOpts: WatchJoinOptions[] = reactiveResources ? reactiveResources.value : resources as WatchJoinOptions[];
+
+      if (!primaryOpts || !resourcesOpts)
+        return;
+
+      await this.start(primaryOpts, ...resourcesOpts);
+
+      if (unmounted) {
+        stopWatch();
+      }
+    };
+    if (reactivePrimary) {
+      watch(reactivePrimary as Ref<WatchJoinOptions | WatchJoinOptions[]>, restartIfDiff);
+    }
+
+    if (reactiveResources) {
+      watch(reactiveResources as Ref<WatchJoinOptions | WatchJoinOptions[]>, restartIfDiff);
+    }
+
+    const stopWatch = async () => {
+      this.stop();
+    };
+
+    onMounted(async () => {
+      await startWatch();
+    });
+
+    onBeforeUnmount(async () => {
+      unmounted = true;
+
+      stopWatch();
+    });
+  }
+
+  // start initializes the list of watches.
+  // the first resource metadata is primary, then it's extended by the specs of the resources defined after.
+  public async start(primary: WatchOptions, ...resources: WatchJoinOptions[]): Promise<void> {
+    this.stop();
+
+    this.watchItems = new WatchItems(this.items.value);
+    this.watchItems.setDescending(primary.sortDescending ?? false);
+    this.loading.value = true;
+    this.err.value = null;
+    this.primaryResourceType = primary.resource.type;
+
+    const handler = (resourceType: string, opts: WatchJoinOptions) => {
+      return (resp: WatchResponse, spec: WatchEventSpec) => {
+        if (!this.itemMap[resourceType]) {
+          this.itemMap[resourceType] = {};
+        }
+
+        if (resourceType == this.primaryResourceType) {
+          this.lastTotal = resp.total ?? 0;
+        }
+
+        if (resourceType == this.primaryResourceType && resp.event?.event_type === EventType.BOOTSTRAPPED) {
+          if (!this.watchItems)
+            throw new Error("assertion failed on watchItems !== null")
+
+          this.watchItems.bootstrap();
+          this.loading.value = false;
+          this.total.value = this.lastTotal;
+
+          return;
+        }
+
+        if (resourceType == this.primaryResourceType) {
+          this.lastTotal = resp.total ?? 0;
+
+          if (this.watchItems?.bootstrapped) {
+            this.total.value = this.lastTotal;
+          }
+        }
+
+        if (!spec.res) {
+          return;
+        }
+
+        const resourceID = itemID(spec.res);
+        const id = opts.idFunc ? `${opts.idFunc(spec.res)}` : resourceID;
+
+        const storeItem = (item: ResourceTyped<T>) => {
+          if (!this.itemMap[resourceType][id]) {
+            this.itemMap[resourceType][id] = {};
+          }
+
+          this.itemMap[resourceType][id][resourceID] = {...item, sortFieldData: resp.sort_field_data};
+        }
+
+        switch (resp.event?.event_type) {
+          case EventType.CREATED:
+            storeItem(spec.res);
+            break;
+          case EventType.UPDATED:
+            storeItem(spec.res);
+            break;
+          case EventType.DESTROYED:
+            delete this.itemMap[resourceType][id][resourceID];
+
+            if (Object.keys(this.itemMap[resourceType][id]).length === 0) {
+              delete this.itemMap[resourceType][id];
+            }
+
+            break;
+        }
+
+        this.updateItem(id, resourceID);
+      };
+    }
+
+    try {
+      const list = [primary].concat(resources);
+      for (const opts of list) {
+        const watch = new WatchFunc(handler(opts.resource.type || "", opts));
+        let onStart: (() => void) | undefined;
+        let onError: ((err: Error) => void) | undefined;
+
+        if (opts.resource.type === this.primaryResourceType) {
+          onStart = () => {
+            this.err.value = null;
+            this.watchItems?.reset();
+          };
+
+          onError = (err: Error) => {
+            this.watchItems?.reset();
+            this.loading.value = false;
+            this.err.value = err.message;
+          }
+        }
+
+        await watch.createStream(opts, onStart, onError);
+
+        this.watches.push(watch);
+      }
+    } catch (err) {
+      this.stop();
+
+      this.err.value = err.message;
+
+      throw err;
+    }
+  }
+
+  public stop() {
+    for (const w of this.watches) {
+      w.stop();
+    }
+
+    this.itemMap = {};
+    this.loading.value = false;
+    this.watchItems?.reset();
+  }
+
+  public getRelatedResources(item: ResourceTyped<T>, resourceType: string): Record<string, ResourceTyped<T>> {
+    const id = itemID(item);
+    if (!this.itemMap[resourceType]) {
+      return {};
+    }
+
+    return this.itemMap[resourceType][id] ?? {};
+  }
+
+  private updateItem(id: string, resourceID: string) {
+    if (!this.watchItems || !this.primaryResourceType || !this.itemMap[this.primaryResourceType]) {
+      return;
+    }
+
+    const mainGroup = this.itemMap[this.primaryResourceType][id];
+    if (!mainGroup) {
+      this.watchItems.remove(resourceID);
+
+      return;
+    }
+
+    const main = mainGroup[Object.keys(mainGroup)[0]];
+
+    const item: ResourceSort<T> = {
+      metadata: main.metadata,
+      spec: main.spec,
+      sortFieldData: main.sortFieldData,
+    };
+
+    for (const key in this.itemMap) {
+      const parts = this.itemMap[key][id];
+      if (!parts) {
+        continue;
+      }
+
+      let part: ResourceTyped<T> | undefined;
+      for (const resourceID in parts) {
+        if (!part || (parts[resourceID]?.metadata?.updated || "") > (part?.metadata?.updated || "")) {
+          part = parts[resourceID];
+        }
+      }
+
+      if (!part) {
+        continue;
+      }
+
+      item.spec = {...item.spec, ...part.spec};
+
+      if (part.status) {
+        item.status = {...part.status, ...item.status}
+      }
+
+      if (part.metadata.labels) {
+        item.metadata.labels = {...item.metadata.labels, ...part.metadata.labels};
+      }
+    }
+
+    this.watchItems.createOrUpdate(item);
+  }
+}
+
+const isRef = <T>(value: T | WatchSource<T>) => {
+  return "value" in value;
+}
diff --git a/frontend/src/components/SideBar/TSideBar.vue b/frontend/src/components/SideBar/TSideBar.vue
new file mode 100644
index 000000000..fe7cc91a6
--- /dev/null
+++ b/frontend/src/components/SideBar/TSideBar.vue
@@ -0,0 +1,42 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <t-animation>
+    <aside class="sidebar" v-if="sidebar">
+      <div class="flex flex-col h-full">
+        <component class="flex-1 overflow-y-auto" :is="sidebar" v-if="sidebar"/>
+        <user-info class="w-full h-16 px-2 border-t border-naturals-N4" with-logout-controls size="small"/>
+      </div>
+    </aside>
+  </t-animation>
+</template>
+
+<script setup lang="ts">
+import { shallowRef, watch } from "vue";
+import { useRoute } from "vue-router";
+import { getSidebar } from "@/router";
+
+import TAnimation from "@/components/common/Animation/TAnimation.vue";
+import UserInfo from "@/components/common/UserInfo/UserInfo.vue";
+
+const route = useRoute();
+
+const sidebar = shallowRef(getSidebar(route));
+
+watch(
+  () => [route.query, route.params],
+  () => {
+    sidebar.value = getSidebar(route);
+  }
+);
+</script>
+
+<style scoped>
+.sidebar {
+  @apply bg-naturals-N1 relative w-48 lg:w-64 h-full;
+}
+</style>
diff --git a/frontend/src/components/SideBar/TSideBarList.vue b/frontend/src/components/SideBar/TSideBarList.vue
new file mode 100644
index 000000000..95fc1091c
--- /dev/null
+++ b/frontend/src/components/SideBar/TSideBarList.vue
@@ -0,0 +1,50 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <nav class="nav">
+    <div class="nav-list">
+      <t-menu-item
+        v-for="item of items"
+        :key="item.name"
+        :route="item.route"
+        :name="item.name"
+        :icon="item.icon"
+        :label="item.label"
+        :label-color="item.labelColor"
+      />
+    </div>
+  </nav>
+</template>
+
+<script setup lang="ts">
+import TMenuItem from "@/components/common/MenuItem/TMenuItem.vue";
+import { RouteLocationRaw } from "vue-router";
+import { IconType } from "../common/Icon/TIcon.vue";
+
+export type SideBarItem = {
+  name: string,
+  route: string | RouteLocationRaw,
+  icon?: IconType,
+  label?: string | number,
+  labelColor?: string
+}
+
+type Props = {
+  items: SideBarItem[]
+}
+
+defineProps<Props>();
+</script>
+
+<style scoped>
+.nav {
+  @apply py-2;
+}
+.nav-list {
+  @apply flex-col;
+}
+</style>
diff --git a/frontend/src/components/SideBar/TSideBarNodesLogs.vue b/frontend/src/components/SideBar/TSideBarNodesLogs.vue
new file mode 100644
index 000000000..6239d4d0d
--- /dev/null
+++ b/frontend/src/components/SideBar/TSideBarNodesLogs.vue
@@ -0,0 +1,110 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <t-animation>
+    <div class="logs">
+      <p class="logs-title">Service logs for:</p>
+      <p class="logs-node-name truncate">{{ node }}</p>
+      <ul class="logs-list">
+        <t-menu-item
+          icon="log"
+          :isItemVisible="true"
+          v-for="service in services"
+          :name="service?.metadata?.id"
+          :key="service?.metadata?.id"
+          :route="{
+            name: 'Logs',
+            query: {
+              cluster: $route.query.cluster,
+              namespace: $route.query.namespace,
+              uid: $route.query.uid,
+            },
+            params: {
+              machine: $route.params.machine,
+              service: service?.metadata?.id,
+            },
+          }"
+        />
+      </ul>
+    </div>
+  </t-animation>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted, Ref } from "vue";
+
+import TMenuItem from "@/components/common/MenuItem/TMenuItem.vue";
+import { getContext } from "@/context";
+import { ResourceService, ResourceTyped } from "@/api/grpc";
+import { Runtime } from "@/api/common/omni.pb";
+import TAnimation from "@/components/common/Animation/TAnimation.vue";
+import { TalosK8sNamespace, TalosNodenameID, TalosNodenameType, TalosRuntimeNamespace, TalosServiceType } from "@/api/resources"
+import { withContext, withRuntime } from "@/api/options";
+
+defineProps<{ name: string }>();
+
+const services: Ref<any[]> = ref([]);
+const node = ref();
+const context = getContext();
+
+onMounted(async () => {
+  const response = await ResourceService.List(
+    {
+      type: TalosServiceType,
+      namespace: TalosRuntimeNamespace,
+    },
+    withRuntime(Runtime.Talos),
+    withContext(context),
+  );
+
+  for (const items of response) {
+    services.value = services.value.concat(items);
+  }
+});
+
+onMounted(async () => {
+  interface Nodename {
+    nodename?: string
+  }
+
+  const nodename: ResourceTyped<Nodename> = await ResourceService.Get(
+    {
+      type: TalosNodenameType,
+      id: TalosNodenameID,
+      namespace: TalosK8sNamespace,
+    },
+    withRuntime(Runtime.Talos),
+    withContext(context),
+  );
+
+  node.value = nodename.spec.nodename;
+});
+</script>
+
+<style scoped>
+.logs {
+  @apply w-full py-4;
+}
+.logs-title {
+  @apply text-xs text-naturals-N8 mb-2 px-6;
+}
+.logs-node-name {
+  @apply text-xs text-naturals-N13 mb-6 px-6;
+  font-size: 13px;
+}
+.logs-item {
+  @apply w-full flex justify-start items-center mb-4 cursor-pointer;
+}
+.logs-icon {
+  @apply mr-4 fill-current text-naturals-N10;
+  width: 16px;
+  height: 16px;
+}
+.logs-log-name {
+  @apply text-xs text-naturals-N10;
+}
+</style>
diff --git a/frontend/src/components/TAlert.vue b/frontend/src/components/TAlert.vue
new file mode 100644
index 000000000..63201a75f
--- /dev/null
+++ b/frontend/src/components/TAlert.vue
@@ -0,0 +1,137 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="alert" :class="'alert-' + type">
+    <div class="alert-box">
+      <div class="alert-icon-wrapper" id="icon">
+        <t-icon :icon="icons[type]"/>
+      </div>
+      <div class="alert-info-wrapper">
+        <h3 id="title">{{ title }}</h3>
+        <div id="description" v-if="$slots.default">
+          <p>
+            <slot></slot>
+          </p>
+        </div>
+      </div>
+      <div class="flex-1 flex justify-end pr-2" v-if="dismiss">
+        <t-button
+          type="compact"
+          class="notification-right-button"
+          @click="dismiss?.action"
+          >{{ dismiss.name }}</t-button
+        >
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import TIcon, { IconType } from "@/components/common/Icon/TIcon.vue";
+
+import TButton from "@/components/common/Button/TButton.vue";
+
+export type AlertType = "error" | "info" | "success" | "warn";
+
+type Props = {
+  type: AlertType;
+  title: string;
+  dismiss?: {
+    name: string;
+    action: () => void;
+  };
+};
+
+defineProps<Props>();
+
+const icons: Record<AlertType, IconType> = {
+  "error": "error",
+  "info": "info",
+  "success": "check-in-circle",
+  "warn": "warning",
+};
+</script>
+
+<style>
+.alert {
+  @apply p-4 rounded-md bg-naturals-N0 border border-naturals-N6 border-l-4;
+}
+
+.alert-box {
+  @apply flex items-center;
+}
+.alert-icon-wrapper {
+  @apply flex justify-center items-center;
+}
+
+.alert-info-wrapper {
+  @apply ml-3 flex flex-col gap-2;
+}
+
+#title {
+  @apply text-sm font-medium;
+}
+
+#description {
+  @apply text-sm font-normal;
+}
+
+#icon > * {
+  @apply w-5 h-5;
+}
+
+.alert-error {
+  border: 1px solid #272932;
+  border-left-width: 4px;
+  border-left-color: #6e2f30;
+}
+
+.alert-error #title {
+  @apply text-red-400;
+}
+
+.alert-error #icon {
+  @apply text-red-400;
+}
+
+.alert-info {
+  @apply border-l-blue-400;
+}
+
+.alert-info #title {
+  @apply text-blue-400;
+}
+
+.alert-info #icon {
+  @apply text-blue-400;
+}
+
+.alert-success {
+  @apply border-l-green-G1;
+}
+
+.alert-success #title {
+  @apply text-green-G1;
+}
+
+.alert-success #icon {
+  @apply text-green-G1;
+}
+
+.alert-warn {
+  border: 1px solid #272932;
+  @apply border-l-yellow-Y1 border-l-4;
+}
+
+.alert-warn #title {
+  @apply text-yellow-Y1;
+}
+
+.alert-warn #icon {
+  @apply text-yellow-Y1;
+}
+</style>
diff --git a/frontend/src/components/TBreadcrumbs.vue b/frontend/src/components/TBreadcrumbs.vue
new file mode 100644
index 000000000..14076da9c
--- /dev/null
+++ b/frontend/src/components/TBreadcrumbs.vue
@@ -0,0 +1,81 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex items-startflex-row flex-wrap" v-if="breadcrumbs.length > 0">
+    <template v-for="(crumb, idx) in breadcrumbs" :key="crumb.text">
+      <div class="flex items-center">
+        <router-link
+          v-if="idx !== breadcrumbs.length - 1"
+          class="all transition"
+          :to="crumb.to"
+          >{{
+            crumb.text === $route.params.machine && !!nodeName
+              ? nodeName
+              : crumb.text
+          }}</router-link
+        >
+        <p v-if="idx == breadcrumbs.length - 1" class="last">
+          {{
+            crumb.text === $route.params.machine && !!nodeName
+              ? nodeName
+              : crumb.text
+          }}
+        </p>
+        <svg
+          v-if="idx < breadcrumbs.length - 1"
+          class="flex-shrink-0 h-5 w-5 text-opacity-50"
+          xmlns="http://www.w3.org/2000/svg"
+          fill="currentColor"
+          viewBox="0 0 20 20"
+          aria-hidden="true"
+        >
+          <path d="M5.555 17.776l8-16 .894.448-8 16-.894-.448z" />
+        </svg>
+      </div>
+    </template>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useRoute } from "vue-router";
+import { computed, toRefs } from "vue";
+import { getBreadcrumbs } from "@/router";
+
+type Props = {
+  nodeName?: string,
+  last?: string
+};
+const props = defineProps<Props>();
+
+const { last } = toRefs(props);
+
+const route = useRoute();
+
+const breadcrumbs = computed(() => {
+  const res = getBreadcrumbs(route);
+
+  if (last?.value) {
+    res.push({
+      text: last.value
+    })
+  }
+
+  return res;
+});
+</script>
+
+<style scoped>
+.all {
+  @apply text-xl font-medium hover:text-opacity-50;
+}
+.last {
+  @apply text-xl font-medium text-naturals-N14 break-all cursor-default;
+}
+.nodeName__multiple {
+  @apply flex items-center;
+}
+</style>
diff --git a/frontend/src/components/THeader/THeader.vue b/frontend/src/components/THeader/THeader.vue
new file mode 100644
index 000000000..cffac75f1
--- /dev/null
+++ b/frontend/src/components/THeader/THeader.vue
@@ -0,0 +1,62 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <header class="t-header">
+    <div class="t-header-nav-wrapper">
+      <div class="t-header-logo-wrapper">
+        <router-link to="/" class="flex items-center gap-1 text-lg text-naturals-N13 uppercase">
+          <t-icon class="t-header-icon w-7 h-7" icon="logo" />
+          <span class="font-bold">Sidero</span>
+          <span>Omni</span>
+        </router-link>
+      </div>
+      <div class="t-header-nav">
+        <a href="https://omni.siderolabs.com/docs/" target="_blank" class="flex hover:text-naturals-N14">
+          <t-icon class="t-header-nav-icon" icon="info" />
+          <span class="t-header-nav-name">Documentation</span>
+        </a>
+        <a href="https://github.com/siderolabs/omni-feedback/issues" target="_blank" class="flex hover:text-naturals-N14">
+          <t-icon class="t-header-nav-icon" icon="check-in-circle" />
+          <span class="t-header-nav-name">Report an issue</span>
+        </a>
+        <ongoing-tasks/>
+      </div>
+    </div>
+  </header>
+</template>
+
+<script setup lang="ts">
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import OngoingTasks from "@/components/common/OngoingTasks/OngoingTasks.vue";
+</script>
+
+<style scoped>
+.t-header {
+  @apply px-6 py-3 flex justify-between items-center bg-naturals-N1 border-b border-naturals-N4;
+  max-height: 52px;
+}
+
+.t-header-logo-wrapper {
+  @apply mr-12 flex flex-1 self-center items-center font-firasans;
+}
+
+.t-header-nav-wrapper {
+  @apply flex justify-start w-full;
+}
+
+.t-header-nav {
+  @apply flex gap-2 text-naturals-N11 items-center justify-end;
+}
+
+.t-header-nav-icon {
+  @apply w-4 h-4 mr-1;
+}
+
+.t-header-nav-name {
+  @apply text-xs;
+}
+</style>
diff --git a/frontend/src/components/TModal.vue b/frontend/src/components/TModal.vue
new file mode 100644
index 000000000..bfd59a595
--- /dev/null
+++ b/frontend/src/components/TModal.vue
@@ -0,0 +1,65 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="container-modal" v-if="view">
+    <component :is="view" v-bind="props" />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { watch, ref, Component, shallowRef, Ref } from "vue";
+import { useRoute, useRouter } from "vue-router";
+import { modals } from "@/router";
+import { modal } from "@/modal";
+
+const route = useRoute();
+const router = useRouter();
+const view: Ref<Component | null> = shallowRef(null);
+const props = ref({});
+
+const updateState = () => {
+  if (modal.value) {
+    view.value = modal.value.component;
+    props.value = modal.value.props || {};
+
+    return;
+  }
+
+  props.value = {};
+  view.value = route.query.modal
+    ? modals[route.query.modal as string]
+    : null;
+};
+
+watch(
+  () => route.query.modal,
+  () => {
+    if (route.query.modal) modal.value = null;
+
+    updateState();
+  }
+);
+
+// modals which do not need to be tied to the URI
+watch(modal, () => {
+  updateState();
+});
+
+updateState();
+
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+const close = () => {
+  router.go(-1);
+};
+</script>
+
+<style scoped>
+.container-modal {
+  @apply fixed left-0 right-0 bottom-0 top-0 z-30 flex justify-center items-center;
+  background-color: rgba(16, 17, 24, 0.9);
+}
+</style>
diff --git a/frontend/src/components/common/ActionsBox/TActionsBox.vue b/frontend/src/components/common/ActionsBox/TActionsBox.vue
new file mode 100644
index 000000000..d0ddd7482
--- /dev/null
+++ b/frontend/src/components/common/ActionsBox/TActionsBox.vue
@@ -0,0 +1,60 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div
+    class="actions-box"
+    v-click-outside="() => open = false"
+  >
+    <Popper offsetDistance="10" :placement="placement" :show="open" offsetSkid="30">
+      <template #content>
+        <div class="actions-list" @click="open = false">
+          <slot/>
+        </div>
+      </template>
+      <icon-button icon="action-horizontal" @click="() => open = !open"/>
+    </Popper>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref } from "vue";
+
+import Popper from "vue3-popper";
+import IconButton from "@/components/common/Button/IconButton.vue";
+
+type PlacementType = "auto"
+  | "auto-start"
+  | "auto-end"
+  | "top"
+  | "top-start"
+  | "top-end"
+  | "bottom"
+  | "bottom-start"
+  | "bottom-end"
+  | "right"
+  | "right-start"
+  | "right-end"
+  | "left"
+  | "left-start"
+  | "left-end";
+
+type Props = {
+  placement?: PlacementType;
+};
+
+withDefaults(defineProps<Props>(), {
+  placement: "left-start",
+});
+
+const open = ref(false);
+</script>
+
+<style scoped>
+.actions-list {
+  @apply bg-naturals-N3 rounded border border-naturals-N4;
+}
+</style>
diff --git a/frontend/src/components/common/ActionsBox/TActionsBoxItem.vue b/frontend/src/components/common/ActionsBox/TActionsBoxItem.vue
new file mode 100644
index 000000000..5d121a58e
--- /dev/null
+++ b/frontend/src/components/common/ActionsBox/TActionsBoxItem.vue
@@ -0,0 +1,54 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="action-item" :class="{'action-item-danger': danger}">
+    <t-icon class="action-item-icon" :icon="icon"/>
+    <span class="action-item-text">
+        <slot/>
+    </span>
+  </div>
+</template>
+
+<script setup lang="ts">
+import TIcon, { IconType } from "@/components/common/Icon/TIcon.vue";
+
+type Props = {
+  icon: IconType;
+  danger?: boolean;
+};
+
+withDefaults(defineProps<Props>(), {
+  danger: false,
+});
+</script>
+
+<style scoped>
+.action-item {
+  @apply flex items-center cursor-pointer w-full px-3 py-2 gap-2;
+}
+
+.action-item:hover > * {
+  @apply text-naturals-N12;
+}
+
+.action-item-icon {
+  @apply w-4 h-4 transition-colors;
+}
+
+.action-item-text {
+  @apply text-xs transition-colors;
+}
+
+.action-item-danger > * {
+  @apply text-red-R1;
+}
+
+.action-item-danger:hover > * {
+  @apply text-primary-P1;
+}
+
+</style>
\ No newline at end of file
diff --git a/frontend/src/components/common/Animation/TAnimation.vue b/frontend/src/components/common/Animation/TAnimation.vue
new file mode 100644
index 000000000..8ae9da4f9
--- /dev/null
+++ b/frontend/src/components/common/Animation/TAnimation.vue
@@ -0,0 +1,50 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <transition :name="name">
+    <slot class="slot" />
+  </transition>
+</template>
+
+<script setup lang="ts">
+import { toRefs } from "vue";
+
+type Props = {
+  name?: string
+}
+
+const props = withDefaults(defineProps<Props>(), {
+  name: "fade",
+})
+
+const { name } = toRefs(props)
+</script>
+
+<style scoped>
+.fade-enter-active,
+.fade-leave-active {
+  transition: all 0.25s linear;
+}
+
+.fade-enter-from,
+.fade-leave-to {
+  opacity: 0;
+}
+.slide-fade-enter-active {
+  transition: all 0.25s ease-out;
+}
+
+.slide-fade-leave-active {
+  transition: all 0.25s cubic-bezier(1, 0.5, 0.8, 1);
+}
+
+.slide-fade-enter-from,
+.slide-fade-leave-to {
+  transform: translateY(-20px);
+  opacity: 0;
+}
+</style>
diff --git a/frontend/src/components/common/Animation/TGroupAnimation.vue b/frontend/src/components/common/Animation/TGroupAnimation.vue
new file mode 100644
index 000000000..20a80cd73
--- /dev/null
+++ b/frontend/src/components/common/Animation/TGroupAnimation.vue
@@ -0,0 +1,25 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <transition-group>
+    <slot />
+  </transition-group>
+</template>
+
+<style>
+.v-item {
+  opacity: 1;
+}
+.v-enter-active,
+.v-leave-active {
+  transition: all 0.3s linear;
+}
+.v-enter-from,
+.v-leave-to {
+  opacity: 0;
+}
+</style>
diff --git a/frontend/src/components/common/Button/IconButton.vue b/frontend/src/components/common/Button/IconButton.vue
new file mode 100644
index 000000000..7cf7510d0
--- /dev/null
+++ b/frontend/src/components/common/Button/IconButton.vue
@@ -0,0 +1,58 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <button :disabled="disabled" class="icon-button">
+    <slot v-if="$slots.default"/>
+    <t-icon
+      v-else
+      class="icon-button-icon"
+      :class="iconClasses"
+      :icon="icon"
+    />
+  </button>
+</template>
+
+<script setup lang="ts">
+import TIcon, { IconType } from "@/components/common/Icon/TIcon.vue";
+import { toRefs } from "vue";
+
+type Props = {
+  icon: IconType;
+  disabled?: boolean;
+  iconClasses?: Record<string, boolean>
+};
+
+const props = withDefaults(defineProps<Props>(), {
+  disabled: false,
+});
+const { icon, disabled } = toRefs(props);
+</script>
+
+<style scoped>
+button {
+  @apply w-6 h-6;
+}
+.icon-button-icon {
+  @apply cursor-pointer p-1 w-full h-full;
+}
+
+.icon-button {
+  @apply text-naturals-N11
+    hover:text-naturals-N13
+    hover:bg-naturals-N7
+    transition-all
+    rounded
+    duration-100
+    disabled:text-naturals-N7
+    disabled:cursor-not-allowed
+    disabled:pointer-events-none;
+}
+
+.icon-button.highlighted {
+  @apply bg-naturals-N7;
+}
+</style>
diff --git a/frontend/src/components/common/Button/TButton.vue b/frontend/src/components/common/Button/TButton.vue
new file mode 100644
index 000000000..f68893350
--- /dev/null
+++ b/frontend/src/components/common/Button/TButton.vue
@@ -0,0 +1,235 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <button
+    type="button"
+    :disabled="disabled"
+    class="t-button"
+    :class="{
+      [type]: true,
+      lightHover: isLightHover,
+      toggle,
+    }"
+  >
+    <span class="t-button-text whitespace-nowrap" v-if="$slots.default" :style="textOrder" :class="{ 'text-red-R1': danger }">
+      <slot />
+    </span>
+    <t-icon :icon="icon" v-if="icon" class="button-icon" :class="{ 'text-red-R1': danger }"/>
+  </button>
+</template>
+
+<script setup lang="ts">
+import { computed, toRefs, StyleValue } from "vue";
+import TIcon, { IconType } from "@/components/common/Icon/TIcon.vue";
+
+type Props = {
+  type?: "primary" | "secondary" | "subtle" | "subtle-xs" |"compact" | "highlighted";
+  toggle?: boolean;
+  disabled?: boolean;
+  icon?: IconType;
+  danger?: boolean;
+  iconPosition?: "left" | "middle" | "right";
+  isLightHover?: boolean;
+};
+
+const props = withDefaults(defineProps<Props>(), {
+  type: "primary",
+  toggle: false,
+  disabled: false,
+  danger: false,
+  iconPosition: "right",
+  isLightHover: false,
+});
+
+const { type, toggle, disabled, icon, danger, iconPosition, isLightHover } = toRefs(props);
+
+const textOrder = computed(() : StyleValue => {
+  if (iconPosition.value === "left") {
+    return { order: 1 };
+  }
+
+  return {};
+});
+
+</script>
+
+<style scoped>
+.t-button {
+  @apply flex
+    items-center
+    justify-center
+    gap-1
+    text-sm
+    transition-colors
+    duration-200
+    border
+    rounded
+    px-4
+    py-1.5;
+}
+
+.t-button.subtle-xs {
+  @apply bg-transparent
+    p-0
+    text-xs
+    border-none
+    text-naturals-N13
+    hover:text-primary-P3
+    focus:text-primary-P2
+    focus:underline
+    active:text-primary-P4
+    active:no-underline
+    disabled:text-naturals-N6
+    disabled:cursor-not-allowed;
+}
+
+.t-button._left {
+  padding-left: 14px;
+}
+
+.t-button._right {
+  padding-right: 14px;
+}
+
+.t-button._middle {
+  padding-right: 9px;
+  padding-left: 9px;
+}
+
+.t-button._middle:hover .button-icon._middle {
+  @apply text-naturals-N14;
+}
+
+.t-button.highlighted {
+  @apply text-naturals-N14
+    border-primary-P2
+    bg-primary-P4
+    hover:bg-primary-P3
+    hover:border-primary-P3
+    hover:text-naturals-N14
+    focus:text-naturals-N14
+    focus:border-primary-P2
+    focus:bg-primary-P2
+    active:bg-primary-P4
+    active:border-primary-P4
+    active:text-naturals-N14
+    disabled:border-naturals-N6
+    disabled:bg-naturals-N4
+    disabled:text-naturals-N7
+    disabled:cursor-not-allowed;
+}
+
+.t-button.primary {
+  @apply text-naturals-N12
+    border-naturals-N5
+    bg-naturals-N3
+    hover:bg-primary-P3
+    hover:border-primary-P3
+    hover:text-naturals-N14
+    focus:text-naturals-N14
+    focus:border-primary-P2
+    focus:bg-primary-P2
+    active:bg-primary-P4
+    active:border-primary-P4
+    active:text-naturals-N14
+    disabled:border-naturals-N6
+    disabled:bg-naturals-N4
+    disabled:text-naturals-N7
+    disabled:cursor-not-allowed;
+}
+
+.t-button.primary.toggle {
+  @apply bg-primary-P4
+    border-primary-P4
+    text-naturals-N14;
+}
+
+.t-button.secondary {
+  @apply bg-transparent
+    text-naturals-N10
+    border-naturals-N5
+    hover:bg-naturals-N5
+    hover:text-naturals-N14
+    focus:bg-naturals-N5
+    focus:text-naturals-N14
+    focus:border-naturals-N7
+    active:bg-naturals-N4
+    active:text-naturals-N14
+    active:border-naturals-N5
+    disabled:bg-transparent
+    disabled:text-naturals-N6
+    disabled:border-naturals-N6
+    disabled:cursor-not-allowed;
+}
+
+.t-button.subtle {
+  @apply bg-transparent
+    p-0
+    border-none
+    text-naturals-N13
+    hover:text-primary-P3
+    focus:text-primary-P2
+    focus:underline
+    active:text-primary-P4
+    active:no-underline
+    disabled:text-naturals-N6
+    disabled:cursor-not-allowed;
+}
+
+.t-button.compact {
+  @apply bg-transparent
+    py-0.5
+    px-2
+    h-6
+    text-naturals-N10
+    border-naturals-N5
+    hover:bg-naturals-N5
+    hover:text-naturals-N14
+    focus:bg-naturals-N5
+    focus:text-naturals-N14
+    focus:border-naturals-N7
+    active:bg-primary-P4
+    active:border-primary-P4
+    active:text-naturals-N14
+    disabled:border-naturals-N6
+    disabled:bg-naturals-N4
+    disabled:text-naturals-N7
+    disabled:cursor-not-allowed;
+}
+
+.t-button.compact.toggle {
+  @apply bg-primary-P4
+    border-primary-P4
+    text-naturals-N14;
+}
+
+.t-button-group > * {
+  @apply rounded-none border-r-0;
+  border-radius: 0;
+}
+
+.t-button-group > *:first-child {
+  @apply rounded-l;
+}
+
+.t-button.subtle.lightHover {
+  @apply bg-transparent
+    p-0
+    border-none
+    hover:text-naturals-N12
+    focus:text-naturals-N13
+    focus:underline
+    active:text-naturals-N13
+    active:no-underline
+    disabled:text-naturals-N6
+    disabled:cursor-not-allowed;
+}
+
+.button-icon {
+  @apply w-4 h-4;
+}
+</style>
diff --git a/frontend/src/components/common/Button/TButtonGroup.vue b/frontend/src/components/common/Button/TButtonGroup.vue
new file mode 100644
index 000000000..e2d7f7bf2
--- /dev/null
+++ b/frontend/src/components/common/Button/TButtonGroup.vue
@@ -0,0 +1,77 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <radio-group :modelValue="modelValue" @update:model-value="(value) => emit('update:modelValue', value)"
+    class="flex p-1 bg-naturals-N3 rounded gap-0.5 t-button-group">
+    <radio-group-option v-for="(option, index) in options" :key="index" v-slot="{ checked }" :value="option.value"
+      as="template" :disabled="option.disabled">
+      <div @click="() => checked ? emit('update:modelValue', null) : null">
+        <popper :disabled="!option.tooltip" hover placement="left" :interactive="false" offsetDistance="10">
+          <template #content>
+            <div class="rounded px-4 py-2 text-naturals-N10 bg-naturals-N4 drop-shadow w-48">
+              {{ option.tooltip }}
+            </div>
+          </template>
+          <button type="button" :class="{ checked }" :disabled="option?.disabled">
+            <span>
+              {{ option?.label || option.value }}
+            </span>
+          </button>
+        </popper>
+      </div>
+    </radio-group-option>
+  </radio-group>
+</template>
+
+<script setup lang="ts">
+import { RadioGroup, RadioGroupOption, } from '@headlessui/vue'
+import Popper from 'vue3-popper';
+
+type Props = {
+  modelValue: any;
+  options: any[];
+}
+
+defineProps<Props>();
+
+const emit = defineEmits(['update:modelValue']);
+</script>
+
+<style scoped>
+.t-button-group button {
+  @apply
+    flex
+    items-center
+    justify-center
+    gap-1
+    text-sm
+    transition-colors
+    duration-200
+    px-2
+    py-0.5
+    text-naturals-N10
+    border-naturals-N5
+    hover:bg-naturals-N5
+    hover:text-naturals-N12;
+}
+
+.t-button-group button {
+  @apply rounded;
+}
+
+.t-button-group button[disabled] {
+  @apply text-naturals-N8 cursor-not-allowed hover:bg-naturals-N3;
+}
+
+.checked {
+  @apply bg-naturals-N4;
+}
+
+.checked span {
+  @apply text-naturals-N12;
+}
+</style>
diff --git a/frontend/src/components/common/Charts/RadialBar.vue b/frontend/src/components/common/Charts/RadialBar.vue
new file mode 100644
index 000000000..8a5e9b2cd
--- /dev/null
+++ b/frontend/src/components/common/Charts/RadialBar.vue
@@ -0,0 +1,109 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="text-xs font-medium flex flex-col items-center justify-center gap-1">
+    <h4 class="text-naturals-N13">{{ name }}</h4>
+    <apex-chart
+      class="flex-1"
+      :height="200"
+      :width="200"
+      type="radialBar"
+      :options="options"
+      :series="normalized"
+    />
+    <div class="flex flex-col gap-1 -mt-4 w-full px-4">
+      <div v-for="(label, index) in labels" :key="label" class="flex gap-1 items-center text-naturals-N13">
+        <div class="w-2.5 h-2.5 rounded-sm" :style="{ 'background-color': colors[index] }"/>
+        <div class="flex-1">{{ label }}</div>
+        <div>{{ formatter(series[index]) }}</div>
+      </div>
+      <div class="flex gap-1 items-center">
+        <div class="flex-1">Capacity</div>
+        <div>{{ formatter(total) }}</div>
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { primary, naturals, green, red, yellow } from "@/vars/colors";
+import { ApexOptions } from "apexcharts";
+import { computed, Ref, toRefs } from "vue";
+
+import ApexChart from "vue3-apexcharts";
+
+type Props = {
+  name: string
+  labels?: string[]
+  total: number
+  series: number[]
+
+  formatter?: (input: number) => string
+};
+
+const props = withDefaults(defineProps<Props>(), {
+  formatter: (input: number) => input.toFixed(2),
+});
+
+const { total, series } = toRefs(props);
+
+const normalized = computed(() => {
+  return series.value.map(value => {
+    if (!total.value) {
+      return 0;
+    }
+
+    return value / total.value * 100;
+  });
+})
+
+const colors = [
+  primary.P3,
+  red.R1,
+  green.G1,
+  yellow.Y1
+]
+
+const options: Ref<ApexOptions> = computed(() => {
+  return {
+    yaxis: {
+      max: total?.value ?? 0,
+    },
+    plotOptions: {
+      radialBar: {
+        hollow: {
+          size: `${80 - series.value.length * 20}`,
+        },
+        track: {
+          background: naturals.N0,
+        },
+        dataLabels: {
+          show: false,
+        },
+      },
+    },
+    fill: {
+      colors: colors,
+    },
+    stroke: {
+      lineCap: "round",
+    },
+    states: {
+      hover: {
+        filter: {
+          type: 'none',
+        }
+      },
+      active: {
+        filter: {
+          type: 'none',
+        }
+      }
+    }
+  }
+});
+</script>
diff --git a/frontend/src/components/common/Checkbox/TCheckbox.vue b/frontend/src/components/common/Checkbox/TCheckbox.vue
new file mode 100644
index 000000000..3201c5015
--- /dev/null
+++ b/frontend/src/components/common/Checkbox/TCheckbox.vue
@@ -0,0 +1,57 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="checkbox-wrapper" :class="{ 'cursor-not-allowed': disabled, 'cursor-pointer': !disabled }" @click="(e) => disabled ? e.stopImmediatePropagation() : null">
+    <div class="checkbox" :class="{ checked: checked, disabled: disabled }">
+      <t-animation>
+        <t-icon class="checkbox-icon" icon="check" v-show="checked && !disabled" />
+      </t-animation>
+      <input type="checkbox" hidden :value="checked" />
+    </div>
+    <span v-if="!!label" class="checkbox-label">{{ label }}</span>
+  </div>
+</template>
+
+<script setup lang="ts">
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import TAnimation from "@/components/common/Animation/TAnimation.vue";
+
+type Props = {
+  checked?: boolean | number;
+  label?: string;
+  disabled?: boolean;
+};
+
+defineProps<Props>();
+</script>
+
+<style scoped>
+.checkbox {
+  @apply border border-naturals-N7 flex items-center justify-center;
+  width: 14px;
+  height: 14px;
+  border-radius: 2px;
+}
+.checkbox-wrapper {
+  @apply flex items-center gap-2;
+}
+.checkbox-label {
+  @apply text-xs text-naturals-N11 block select-none truncate flex-1;
+}
+.checked {
+  @apply border-primary-P6 bg-primary-P6;
+}
+.checkbox-icon {
+  @apply fill-current text-primary-P3;
+  width: 14px;
+  height: 14px;
+}
+
+.disabled {
+  @apply border-naturals-N5 bg-naturals-N4;
+}
+</style>
diff --git a/frontend/src/components/common/CodeEditor/CodeEditor.vue b/frontend/src/components/common/CodeEditor/CodeEditor.vue
new file mode 100644
index 000000000..f1f211d5a
--- /dev/null
+++ b/frontend/src/components/common/CodeEditor/CodeEditor.vue
@@ -0,0 +1,131 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <MonacoEditor
+      :options="finalOptions"
+      @update:value="(val) => emit('update:value', val)"
+      :value="value"
+      @editorWillMount="editorWillMount"
+      @editorDidMount="editorDidMount"
+      width="100%"
+      height="100%"
+  ></MonacoEditor>
+</template>
+
+<script setup lang="ts">
+import MonacoEditor from "monaco-editor-vue3";
+import { setDiagnosticsOptions } from "monaco-yaml";
+import configSchema from "@/schemas/config.schema.json";
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api';
+import { naturals } from "@/vars/colors";
+
+type Props = {
+  value: string,
+  editorDidMount?: (editor: monaco.editor.IStandaloneCodeEditor) => void,
+  options?: monaco.editor.IStandaloneEditorConstructionOptions,
+  validators?: ((model: monaco.editor.ITextModel, tokens: monaco.Token[]) => monaco.editor.IMarkerData[])[]
+};
+
+const emit = defineEmits(["update:value"]);
+const props = defineProps<Props>();
+
+const editorWillMount = () => {
+  setDiagnosticsOptions({
+    hover: true,
+    completion: true,
+    validate: true,
+    format: true,
+    schemas: [
+      {
+        uri: configSchema.$id,
+        fileMatch: ["*"],
+        schema: configSchema,
+      },
+    ],
+  })
+};
+
+if (props.validators?.length) {
+  monaco.editor.onDidCreateModel(function(model) {
+      function validate() {
+        var textToValidate = model.getValue();
+
+        let markers: monaco.editor.IMarkerData[] = [];
+        const tokens = monaco.editor.tokenize(textToValidate, "yaml");
+
+        for (const validator of props.validators!) {
+          markers = markers.concat(validator(model, tokens.flat()));
+        }
+
+        monaco.editor.setModelMarkers(model, "sanityCheck", markers);
+      }
+
+      let handle: any;
+
+      model.onDidChangeContent(() => {
+        // debounce
+        clearTimeout(handle);
+        handle = setTimeout(() => validate(), 500);
+      });
+
+      validate();
+  });
+}
+
+monaco.editor.defineTheme("sidero", {
+  base: 'vs-dark',
+  inherit: true,
+  rules: [],
+  colors: {
+    "dropdown.background": naturals.N3,
+
+    "editor.background": "#00000000",
+
+    "editorHoverWidget.background": naturals.N3,
+    "editorHoverWidget.border": naturals.N7,
+
+    "editorOverviewRuler.border": "#00000000",
+
+    "editorWidget.background": naturals.N3,
+    "editorWidget.border": naturals.N7,
+
+    "input.background": naturals.N1,
+    "input.border": naturals.N7,
+  }
+});
+
+const baseOptions: monaco.editor.IStandaloneEditorConstructionOptions = {
+  theme: "sidero",
+  language: "yaml",
+  fontSize: 14,
+  fontFamily: '"Roboto Mono", monospace',
+  automaticLayout: true,
+  tabSize: 2,
+  fixedOverflowWidgets: true,
+  minimap: {
+    enabled: false,
+  },
+  inlineSuggest: {
+    enabled: true,
+  },
+  quickSuggestions: {
+    strings: true,
+  },
+};
+
+const finalOptions = {
+  ...baseOptions,
+  ...props.options,
+}
+
+</script>
+
+<style>
+.monaco-editor-vue3 h4 {
+  @apply font-bold;
+}
+</style>
diff --git a/frontend/src/components/common/Icon/TIcon.vue b/frontend/src/components/common/Icon/TIcon.vue
new file mode 100644
index 000000000..014fd638e
--- /dev/null
+++ b/frontend/src/components/common/Icon/TIcon.vue
@@ -0,0 +1,144 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <img v-if="svgBase64" alt="" :src="`data:image/svg+xml;base64,${svgBase64}`"/>
+  <component v-else :is="component"/>
+</template>
+
+<script setup lang="ts">
+import { Component, computed, defineAsyncComponent, toRefs } from "vue";
+import {
+  UsersIcon,
+  DocumentIcon,
+  PowerIcon,
+  UserIcon,
+  UserPlusIcon,
+  TagIcon,
+  ArrowUpCircleIcon,
+  ArrowUpTrayIcon,
+  DocumentTextIcon,
+  LockClosedIcon,
+  LockOpenIcon,
+  WindowIcon,
+  CodeBracketIcon,
+  PlayCircleIcon,
+  CircleStackIcon,
+} from "@heroicons/vue/24/outline";
+
+const icons = {
+  "action-horizontal": defineAsyncComponent(() => import("../../icons/IconActionHorizontal.vue")),
+  "dropdown": defineAsyncComponent(() => import("../../icons/IconDropdown.vue")),
+  "cloud-connection": defineAsyncComponent(() => import("../../icons/IconCloudConnection.vue")),
+  "arrow-right-square": defineAsyncComponent(() => import("../../icons/IconArrowRightSquare.vue")),
+  "box": defineAsyncComponent(() => import("../../icons/IconBox.vue")),
+  "minus": defineAsyncComponent(() => import("../../icons/IconMinus.vue")),
+  "plus": defineAsyncComponent(() => import("../../icons/IconPlus.vue")),
+  "loading": defineAsyncComponent(() => import("../../icons/IconLoading.vue")),
+  "check-in-circle": defineAsyncComponent(() => import("../../icons/IconCheckInCircle.vue")),
+  "upload": defineAsyncComponent(() => import("../../icons/IconUpload.vue")),
+  "arrow-down": defineAsyncComponent(() => import("../../icons/IconArrowDown.vue")),
+  "arrow-up": defineAsyncComponent(() => import("../../icons/IconArrowUp.vue")),
+  "arrow-right": defineAsyncComponent(() => import("../../icons/IconArrowRight.vue")),
+  "long-arrow-top": defineAsyncComponent(() => import("../../icons/IconLongArrowTop.vue")),
+  "long-arrow-down": defineAsyncComponent(() => import("../../icons/IconLongArrowDown.vue")),
+  "copy": defineAsyncComponent(() => import("../../icons/IconCopy.vue")),
+  "delete": defineAsyncComponent(() => import("../../icons/IconDelete.vue")),
+  "settings": defineAsyncComponent(() => import("../../icons/IconSettings.vue")),
+  "close": defineAsyncComponent(() => import("../../icons/IconClose.vue")),
+  "error": defineAsyncComponent(() => import("../../icons/IconError.vue")),
+  "info": defineAsyncComponent(() => import("../../icons/IconInfo.vue")),
+  "check-in-circle-classic": defineAsyncComponent(() => import("../../icons/IconCheckInCircleClassic.vue")),
+  "overview": defineAsyncComponent(() => import("../../icons/IconOverview.vue")),
+  "nodes": defineAsyncComponent(() => import("../../icons/IconNodes.vue")),
+  "podes": defineAsyncComponent(() => import("../../icons/IconPodes.vue")),
+  "clusters": defineAsyncComponent(() => import("../../icons/IconClusters.vue")),
+  "clusters-big": defineAsyncComponent(() => import("../../icons/IconClustersBig.vue")),
+  "dot": defineAsyncComponent(() => import("../../icons/IconDot.vue")),
+  "time": defineAsyncComponent(() => import("../../icons/IconTime.vue")),
+  "drop-up": defineAsyncComponent(() => import("../../icons/IconDropUp.vue")),
+  "search": defineAsyncComponent(() => import("../../icons/IconSearch.vue")),
+  "pin": defineAsyncComponent(() => import("../../icons/IconPin.vue")),
+  "arrow-left": defineAsyncComponent(() => import("../../icons/IconArrowLeft.vue")),
+  "check": defineAsyncComponent(() => import("../../icons/IconCheck.vue")),
+  "kube-config": defineAsyncComponent(() => import("../../icons/IconKubeConfig.vue")),
+  "talos-config": defineAsyncComponent(() => import("../../icons/IconTalosConfig.vue")),
+  "kubernetes": defineAsyncComponent(() => import("../../icons/IconKubernetes.vue")),
+  "edit": defineAsyncComponent(() => import("../../icons/IconEdit.vue")),
+  "unlink": defineAsyncComponent(() => import("../../icons/IconUnlink.vue")),
+  "refresh": defineAsyncComponent(() => import("../../icons/IconRefresh.vue")),
+  "long-arrow-left": defineAsyncComponent(() => import("../../icons/IconLongArrowLeft.vue")),
+  "long-arrow-right": defineAsyncComponent(() => import("../../icons/IconLongArrowRight.vue")),
+  "warning-clear": defineAsyncComponent(() => import("../../icons/IconWarningClear.vue")),
+  "warning": defineAsyncComponent(() => import("../../icons/IconWarning.vue")),
+  "dashboard": defineAsyncComponent(() => import("../../icons/IconDashboard.vue")),
+  "reset": defineAsyncComponent(() => import("../../icons/IconReset.vue")),
+  "reboot": defineAsyncComponent(() => import("../../icons/IconReboot.vue")),
+  "change": defineAsyncComponent(() => import("../../icons/IconChange.vue")),
+  "action-vertical": defineAsyncComponent(() => import("../../icons/IconActionVertical.vue")),
+  "ongoing-tasks": defineAsyncComponent(() => import("../../icons/IconOngoingTasks.vue")),
+  "header-logo": defineAsyncComponent(() => import("../../icons/IconHeaderLogo.vue")),
+  "logo": defineAsyncComponent(() => import("../../icons/IconLogo.vue")),
+  "home": defineAsyncComponent(() => import("../../icons/IconHome.vue")),
+  "attention": defineAsyncComponent(() => import("../../icons/IconAttention.vue")),
+  "waiting": defineAsyncComponent(() => import("../../icons/IconWaiting.vue")),
+  "complete": defineAsyncComponent(() => import("../../icons/IconComplete.vue")),
+  "in-progress": defineAsyncComponent(() => import("../../icons/IconInProgress.vue")),
+  "drop-right": defineAsyncComponent(() => import("../../icons/IconDropRight.vue")),
+  "log": defineAsyncComponent(() => import("../../icons/IconLog.vue")),
+  "external-link": defineAsyncComponent(() => import("../../icons/IconExternalLink.vue")),
+  "no-connection": defineAsyncComponent(() => import("../../icons/IconNoConnection.vue")),
+  "fail-auth": defineAsyncComponent(() => import("../../icons/IconFailAuth.vue")),
+  "key": defineAsyncComponent(() => import("../../icons/IconKey.vue")),
+  "aws": defineAsyncComponent(() => import("../../icons/IconAWS.vue")),
+  "gcp": defineAsyncComponent(() => import("../../icons/IconGCP.vue")),
+  "sidero": defineAsyncComponent(() => import("../../icons/IconSidero.vue")),
+  "sidero-monochrome": defineAsyncComponent(() => import("../../icons/IconSideroMonochrome.vue")),
+  "terminal": defineAsyncComponent(() => import("../../icons/IconTerminal.vue")),
+  "unknown": defineAsyncComponent(() => import("../../icons/IconUnknown.vue")),
+  "question": defineAsyncComponent(() => import("../../icons/IconQuestion.vue")),
+  "upgrade-empty-state": defineAsyncComponent(() => import("../../icons/IconUpgradeEmptyState.vue")),
+  "link-down": defineAsyncComponent(() => import("../../icons/IconLinkDown.vue")),
+  "settings-toggle": defineAsyncComponent(() => import("../../icons/IconSettingsToggle.vue")),
+  "rollback": defineAsyncComponent(() => import("../../icons/IconRollback.vue")),
+  "document": DocumentIcon,
+  "power": PowerIcon,
+  "users": UsersIcon,
+  "user": UserIcon,
+  "user-add": UserPlusIcon,
+  "tag": TagIcon,
+  "arrow-up-circle": ArrowUpCircleIcon,
+  "arrow-up-tray": ArrowUpTrayIcon,
+  "bootstrap-manifests": DocumentTextIcon,
+  "exposed-service": WindowIcon,
+  "locked": LockClosedIcon,
+  "unlocked": LockOpenIcon,
+  "code-bracket": CodeBracketIcon,
+  "play-circle": PlayCircleIcon,
+  "circle-stack": CircleStackIcon,
+};
+
+const getComponent = (icon: string): Component | undefined => {
+  return icons[icon];
+}
+
+export type IconType = keyof typeof icons;
+
+type Props = {
+  svgBase64?: string
+  icon?: IconType;
+}
+
+const props = withDefaults(defineProps<Props>(), {
+  icon: "action-horizontal",
+});
+
+const { icon } = toRefs(props);
+
+const component = computed(() => {
+  return getComponent(icon.value);
+});
+</script>
diff --git a/frontend/src/components/common/InfoLabel/TInfoLabel.vue b/frontend/src/components/common/InfoLabel/TInfoLabel.vue
new file mode 100644
index 000000000..b036c96cd
--- /dev/null
+++ b/frontend/src/components/common/InfoLabel/TInfoLabel.vue
@@ -0,0 +1,75 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div
+    class="label"
+    @mouseenter="() => (isInfoVisible = true)"
+    @mouseleave="() => (isInfoVisible = false)"
+  >
+    <div v-if="!!label" class="label__text">{{ label }}</div>
+    <div class="label__icon-wrapper">
+      <t-icon class="label__icon" icon="info" />
+      <t-animation>
+        <div class="label__info-wrapper" v-show="isInfoVisible">
+          <div class="label__info">
+            {{ info }}
+          </div>
+        </div>
+      </t-animation>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, toRefs } from "vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import TAnimation from "@/components/common/Animation/TAnimation.vue";
+
+type Props = {
+  label?: string
+  info?: string
+}
+
+const props = defineProps<Props>()
+
+const { label, info } = toRefs(props)
+
+const isInfoVisible = ref(false);
+</script>
+
+<style scoped>
+.label {
+  @apply flex items-center justify-start cursor-default;
+}
+.label__text {
+  @apply text-xs mr-1;
+}
+.label__icon {
+  @apply w-4 h-4 fill-current relative mr-3;
+}
+.label__icon-wrapper {
+  @apply relative flex items-center justify-start;
+}
+.label__info {
+  @apply px-3 py-2 bg-naturals-N3 border border-naturals-N4 rounded text-xs text-naturals-N10 flex justify-center items-center relative;
+  width: 150px;
+  z-index: 0;
+}
+.label__info::before {
+  content: "";
+  @apply w-3 h-3 bg-naturals-N3 border border-naturals-N4 absolute block border-r-0 border-t-0;
+  border-radius: 1px;
+  transform: rotate(45deg);
+  left: -6px;
+  top: calc(50% - 6px);
+  z-index: -1;
+}
+.label__info-wrapper {
+  @apply absolute;
+  right: -155px;
+}
+</style>
diff --git a/frontend/src/components/common/Labels/Labels.vue b/frontend/src/components/common/Labels/Labels.vue
new file mode 100644
index 000000000..02679ba13
--- /dev/null
+++ b/frontend/src/components/common/Labels/Labels.vue
@@ -0,0 +1,84 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-wrap gap-1.5 items-center text-xs">
+    <span v-for="label, key in modelValue" :key="key" class="flex items-center cursor-pointer" v-bind:class="`resource-label label-${label.color ?? 'light6'}`">
+        <template v-if="label.value">
+        {{ key }}:<span class="font-semibold">{{ label.value }}</span>
+        </template>
+        <span v-else class="font-semibold">
+        {{ key }}
+        </span>
+        <t-icon v-if="label.canRemove" icon="close" class="destroy-label-button" @click.stop="() => removeLabel(key)"/>
+    </span>
+    <t-input @keydown.enter="addLabel" v-model="currentLabel" compact @click.stop @blur="addingLabel = false" :focus="addingLabel" v-if="addingLabel" class="w-24 h-6"/>
+    <t-button icon="tag" type="compact" @click.stop="editLabels" v-else>new label</t-button>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, toRefs } from "vue";
+
+import TButton from "@/components/common/Button/TButton.vue";
+import TInput from "@/components/common/TInput/TInput.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+
+type Label = {
+  value: string
+  canRemove: boolean
+  color?: string
+}
+
+const props = defineProps<{
+  modelValue: Record<string, Label>
+  onAdd?: (value: string) => Promise<void>
+  onRemove?: (value: string) => Promise<void>
+}>();
+
+const { modelValue } = toRefs(props)
+const emit = defineEmits(['update:modelValue']);
+
+const addingLabel = ref(false);
+const currentLabel = ref("");
+
+const editLabels = () => {
+  addingLabel.value = true;
+};
+
+const addLabel = async () => {
+  addingLabel.value = false;
+
+  const parts = currentLabel.value.split(":");
+
+  currentLabel.value = "";
+
+  emit("update:modelValue", {...modelValue.value,
+    [parts[0]]: {
+      value: parts[1] ?? "",
+      canRemove: true,
+    }
+  });
+}
+
+const removeLabel = async (key: string) => {
+  addingLabel.value = false;
+
+  currentLabel.value = "";
+
+  const copied = {...modelValue.value};
+
+  delete copied[key];
+
+  emit("update:modelValue", copied);
+};
+</script>
+
+<style>
+.destroy-label-button {
+  @apply w-3 h-3 -mr-1 ml-1 inline-block hover:text-naturals-N1 cursor-pointer hover:bg-naturals-N14 transition-all rounded-full;
+}
+</style>
diff --git a/frontend/src/components/common/List/TList.vue b/frontend/src/components/common/List/TList.vue
new file mode 100644
index 000000000..a1578e66b
--- /dev/null
+++ b/frontend/src/components/common/List/TList.vue
@@ -0,0 +1,342 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col gap-4">
+    <div class="flex gap-2" v-if="pagination || search || itemsPerPage?.length > 1">
+      <t-input class="flex-1" v-if="search" icon="search" v-model="filterValue"/>
+      <div class="flex-1" v-else/>
+      <t-select-list
+          @checkedValue="(value: string) => { selectedSortOption = value }"
+          v-if="sortOptions"
+          title="Sort by"
+          :defaultValue="selectedSortOption || ''"
+          :values="sortOptionsVariants"
+        />
+      <t-select-list
+          @checkedValue="(value: number) => { selectedItemsPerPage = value; currentPage = 1 }"
+          v-if="itemsPerPage?.length > 1 && pagination"
+          title="Items per Page"
+          :defaultValue="selectedItemsPerPage"
+          :values="itemsPerPage"
+        />
+    </div>
+    <div class="flex-1">
+      <div
+        v-if="loading"
+        class="flex flex-row justify-center items-center w-full h-full"
+      >
+        <t-spinner class="loading-spinner"/>
+      </div>
+      <template v-else-if="err">
+        <t-alert v-if="!$slots.error"
+          title="Failed to Fetch Data"
+          type="error"
+        >
+          {{ err }}.
+        </t-alert>
+        <slot name="error" v-else err="err"/>
+      </template>
+      <template v-else-if="items.length == 0">
+        <t-alert
+          v-if="!$slots.norecords"
+          type="info"
+          title="No Records"
+          >No entries of the requested resource type are found on the
+          server.</t-alert
+        >
+        <slot name="norecords"/>
+      </template>
+      <div class="w-full h-full" v-show="!loading && !err && (items.length > 0)">
+        <slot :items="items" :watch="watch" :searchQuery="searchQuery"/>
+      </div>
+    </div>
+    <div class="flex items-center justify-end gap-2" v-if="showPageSelector">
+      <t-icon icon="arrow-left" class="pagination-icon" :class="{ 'pagination-icon-disabled': currentPage === 1 }"
+        @click="prevPage" />
+      <div class="pagination-pages">
+        <span @click="() => openPage(item)" class="pagination-page-number" :class="{
+              'pagination-page-number-active': item === currentPage,
+              unhovered: item === dots,
+            }" v-for="item, index in paginationRange ?? []" :key="index">
+          {{ item }}</span>
+      </div>
+      <t-icon icon="arrow-right" class="pagination-icon"
+        :class="{ 'pagination-icon-disabled': currentPage === totalPageCount }" @click="nextPage"/>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Resource } from "@/api/grpc";
+import Watch, { WatchJoin, WatchJoinOptions, WatchOptions } from "@/api/watch";
+import TInput from "@/components/common/TInput/TInput.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import TSelectList from "@/components/common/SelectList/TSelectList.vue";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import TAlert from "@/components/TAlert.vue";
+
+import { computed, Ref, ref, toRefs, watch as vueWatch } from "vue";
+import storageRef from "@/methods/storage";
+
+defineExpose({
+  addFilterLabel: (label: {key: string, value?: string}) => {
+    const selector = `${label.key}:${label.value}`;
+    if (filterValue.value.includes(selector)) {
+      return;
+    }
+
+    filterValue.value += (filterValue.value ? " " : "") + selector;
+  }
+});
+
+const dots = "...";
+
+const props = defineProps<{
+  pagination?: boolean,
+  search?: boolean,
+  opts: WatchOptions | WatchJoinOptions[] | Object,
+  sortOptions?: {id: string, desc: string, descending?: boolean}[],
+}>();
+
+const itemsPerPage = [5, 10, 25, 50, 100];
+
+const sortOptionsVariants = computed(() => {
+  if (!props.sortOptions) {
+    return [];
+  }
+
+  return props.sortOptions.map((opt) => {
+    return opt.desc;
+  });
+});
+
+const { opts } = toRefs(props);
+
+const items: Ref<Resource[]> = ref([]);
+
+const optsList = props.opts as WatchJoinOptions[];
+
+const filterValue = ref("");
+const currentPage = ref(1);
+const selectedItemsPerPage: Ref<number> = storageRef(localStorage, 'itemsPerPage', 10);
+const selectedSortOption: Ref<string | null> = ref(sortOptionsVariants?.value?.length ? sortOptionsVariants.value[0] : null);
+
+const offset = computed(() => {
+  return (currentPage.value - 1) * selectedItemsPerPage.value;
+});
+
+const sortByState = computed(() => {
+  if (!props.sortOptions) {
+    return {};
+  }
+
+  for (const opt of props.sortOptions) {
+    if (opt.desc === selectedSortOption?.value) {
+      return {
+        sortByField: opt.id,
+        sortDescending: opt.descending,
+      };
+    }
+  }
+
+  return {};
+});
+
+const watchOptions = computed<WatchOptions>(() => {
+  const watchSingle = opts.value;
+  const watchJoin = opts.value as WatchJoinOptions[];
+
+  return (watchJoin.length ? watchJoin[0] : watchSingle) as WatchOptions;
+});
+
+const paginationState = computed(() => {
+  if (!props.pagination) {
+    return {};
+  }
+
+  return {
+    limit: selectedItemsPerPage.value,
+    offset: offset.value,
+  }
+});
+
+// reset the pagination when the search query changes
+vueWatch(filterValue, () => {
+  currentPage.value = 1;
+})
+
+const searchState = computed(() => {
+  if (!props.search) {
+    return {};
+  }
+
+  const o = watchOptions.value;
+
+  if (!o) {
+    return {};
+  }
+
+  // do not proceed if the pagination is not reset yet - when the currentPage is reset, this will get triggered again
+  if (currentPage.value != 1) {
+    return {}
+  }
+
+  const parts = filterValue.value.split(" ");
+  const selectors: string[] = [];
+  const searchFor: string[] = [];
+
+  for (const part of parts) {
+    const match = part.match(/^(.+):(.*)$/);
+
+    if (!match || match.length < 3) {
+      searchFor.push(part);
+
+      continue
+    }
+
+    selectors.push(`${match[1]}=${match[2]}`);
+  }
+
+  const res: {selectors?: string[], searchFor?: string[]} = {
+    selectors: (o.selectors ?? []).concat(selectors)
+  }
+
+  if (searchFor.length > 0) {
+    res.searchFor = searchFor;
+  }
+
+  return res;
+});
+
+const searchQuery = computed(() => {
+  if (!searchState.value.searchFor) {
+    return undefined;
+  }
+
+  return searchState.value.searchFor.join(" ");
+});
+
+const setupWatch = () => {
+  const w = new Watch(items);
+  const opts = props.opts as WatchOptions;
+
+  w.setup(computed(() => {
+    return {
+      ...paginationState.value,
+      ...opts,
+      ...searchState.value,
+      ...sortByState.value,
+    }
+  }));
+
+  return w;
+}
+
+const setupJoinWatch = () => {
+  const w = new WatchJoin(items);
+  const opts = props.opts as WatchJoinOptions[];
+
+  w.setup(computed(() => {
+    return {
+      ...paginationState.value,
+      ...opts[0],
+      ...searchState.value,
+      ...sortByState.value,
+    }
+  }), opts.slice(1, opts.length));
+
+  return w;
+}
+
+const paginationRange = computed(() => {
+  let ranges: number[][];
+  if (totalPageCount.value < 20) {
+    ranges = [
+      [1, totalPageCount.value]
+    ];
+  } else {
+    if (currentPage.value < 5 || currentPage.value > totalPageCount.value - 4) {
+      ranges = [
+        [1, 5],
+        [totalPageCount.value - 4, totalPageCount.value]
+      ]
+    } else {
+      ranges = [
+        [1, 3],
+        [currentPage.value - 1, currentPage.value + 1],
+        [totalPageCount.value - 2,totalPageCount.value]
+      ]
+    }
+  }
+
+  const res: (string | number)[] = [];
+  for (let i: number = 0; i < ranges.length; i++) {
+    for (let j: number = ranges[i][0]; j <= ranges[i][1]; j++) {
+      res.push(j);
+    }
+
+    if (i !== ranges.length - 1) {
+      res.push(dots);
+    }
+  }
+
+  return res;
+});
+
+const watch = optsList.length ? setupJoinWatch() : setupWatch();
+const err = watch.err;
+const loading = watch.loading;
+
+const totalPageCount = computed(() => {
+  return Math.ceil(watch.total.value / selectedItemsPerPage.value);
+});
+
+const showPageSelector = computed(() => {
+  return props.pagination && totalPageCount.value > 1;
+});
+
+const prevPage = () => {
+  currentPage.value = Math.max(1, currentPage.value - 1);
+};
+
+const nextPage = () => {
+  currentPage.value = Math.min(totalPageCount.value, currentPage.value + 1);
+};
+
+const openPage = (page: number | string) => {
+  if (page === dots) {
+    return;
+  }
+  
+  currentPage.value = page as number;
+};
+</script>
+
+<style scoped>
+.pagination-icon {
+  @apply fill-current text-naturals-N8 cursor-pointer transition-all duration-200 hover:text-naturals-N10 w-5 h-5;
+}
+.pagination-icon-disabled {
+  @apply text-naturals-N6;
+}
+.pagination-pages {
+  @apply flex items-center transition-all duration-200 gap-2;
+}
+.pagination-page-number {
+  @apply w-7 h-7 rounded text-naturals-N8 transition-all duration-200 flex items-center justify-center cursor-pointer hover:text-naturals-N9 select-none;
+}
+.unhovered {
+  @apply hover:text-naturals-N8 cursor-default;
+}
+.pagination-page-number-active {
+  @apply text-naturals-N12 bg-naturals-N4;
+}
+
+.loading-spinner {
+  @apply absolute top-2/4 w-6 h-6;
+}
+</style>
diff --git a/frontend/src/components/common/List/TListItem.vue b/frontend/src/components/common/List/TListItem.vue
new file mode 100644
index 000000000..3b6981eff
--- /dev/null
+++ b/frontend/src/components/common/List/TListItem.vue
@@ -0,0 +1,91 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="row" :class="{ opened: isDropdownOpened }">
+    <t-slide-down-wrapper :isSliderOpened="isDropdownOpened">
+      <template #head>
+        <div class="flex items-center">
+          <span v-if="$slots.details">
+            <t-icon
+              @click="() => (isDropdownOpened = !isDropdownOpened)"
+              class="row-arrow"
+              :class="{ pushed: isDropdownOpened }"
+              icon="drop-up"
+              />
+          </span>
+          <div class="row-head">
+            <slot></slot>
+          </div>
+        </div>
+      </template>
+      <template #body>
+        <div class="row-details">
+          <slot name="details"></slot>
+        </div>
+      </template>
+    </t-slide-down-wrapper>
+  </div>
+</template>
+
+<script setup lang="ts">
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import { toRefs, ref } from "vue";
+
+import TSlideDownWrapper from "@/components/common/SlideDownWrapper/TSlideDownWrapper.vue";
+
+const props = defineProps<{
+  isDefaultOpened?: boolean,
+}>();
+
+const { isDefaultOpened } = toRefs(props);
+
+const isDropdownOpened = ref(isDefaultOpened?.value as boolean);
+</script>
+
+<style scoped>
+.row {
+  @apply w-full border border-transparent flex flex-col items-center transition-all duration-500 text-xs text-naturals-N13 px-2 py-4;
+  min-width: 450px;
+  border-bottom: 1px solid rgba(39, 41, 50);
+  border-radius: 4px 4px 0 0;
+}
+
+.row-head {
+  @apply px-1 flex-1;
+}
+
+.row:last-of-type {
+  border-bottom: transparent;
+}
+
+.opened {
+  @apply rounded border-naturals-N5 mt-1;
+}
+
+.opened:last-of-type {
+  border-bottom: 1px solid rgba(44, 46, 56, var(--tw-border-opacity));
+}
+
+.row-wrapper {
+  @apply w-full flex justify-start items-center;
+}
+
+.row-arrow {
+  @apply fill-current text-naturals-N11 hover:bg-naturals-N7 transition-all rounded duration-300 cursor-pointer mr-1;
+  transform: rotate(-180deg);
+  width: 24px;
+  height: 24px;
+}
+
+.pushed {
+  transform: rotate(0deg);
+}
+
+.row-details {
+  @apply p-2;
+}
+</style>
diff --git a/frontend/src/components/common/LogViewer/LogViewer.vue b/frontend/src/components/common/LogViewer/LogViewer.vue
new file mode 100644
index 000000000..e02b3f3e2
--- /dev/null
+++ b/frontend/src/components/common/LogViewer/LogViewer.vue
@@ -0,0 +1,164 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="logs-list">
+    <div class="logs-list-heading">
+      <div class="logs-list-heading-wrapper">
+        <p class="logs-list-heading-name" v-if="withDate">Date</p>
+        <p class="logs-list-heading-name">Message</p>
+      </div>
+      <div class="flex gap-6">
+        <t-button icon="copy" type="compact" @click="copyLogs">Copy</t-button>
+        <t-checkbox
+            label="Follow Logs"
+            :checked="follow"
+            @click="() => (follow = !follow)"
+        />
+      </div>
+    </div>
+    <dynamic-scroller
+        class="logs-view"
+        ref="logView"
+        @update="scrollToBottom"
+        @resize="scrollToBottom"
+        :emit-update="waitUpdate"
+        :items="displayLogs"
+        :min-item-size="200">
+      <template v-slot="{ item, index, active }">
+        <dynamic-scroller-item class="logs-item grid-cols-6" :key="index" :active="active" :size-dependencies="[item.msg]" :item="item" :data-index="index">
+          <div class="logs-item-date" v-if="withDate">
+            {{ item.date }}
+          </div>
+          <div class="logs-item-message">
+            <WordHighlighter
+                :query="searchOption"
+                :textToHighlight="item.msg"
+                highlightClass="bg-naturals-N14"
+            />
+          </div>
+        </dynamic-scroller-item>
+      </template>
+    </dynamic-scroller>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Component, computed, ref, toRefs, onMounted, onUpdated, watch, nextTick } from "vue";
+import { LogLine } from "@/methods/logs";
+import { DynamicScroller, DynamicScrollerItem } from "vue-virtual-scroller";
+import { copyText } from "vue3-clipboard";
+
+import TButton from "@/components/common/Button/TButton.vue";
+import TCheckbox from "@/components/common/Checkbox/TCheckbox.vue";
+import WordHighlighter from "vue-word-highlighter";
+
+import 'vue-virtual-scroller/dist/vue-virtual-scroller.css'
+
+type Props = {
+  logs: LogLine[];
+  searchOption: string;
+  withDate?: boolean
+};
+
+const props = withDefaults(defineProps<Props>(), {
+  withDate: true,
+});
+
+const follow = ref(true);
+const logView: Component = ref(null);
+const { searchOption, logs } = toRefs(props);
+
+const waitUpdate = ref(false);
+
+const scrollToBottom = () => {
+  if (!logView.value || !follow.value) {
+    return;
+  }
+
+  waitUpdate.value = false;
+  nextTick(() => {
+    logView.value.scrollToItem(filteredLogs.value.length);
+  });
+};
+
+const displayLogs = computed(() => {
+  return filteredLogs.value.map((item: LogLine, index: number) => {
+    return {
+      ...item,
+      id: index,
+    }
+  })
+});
+
+const filteredLogs = computed(() => {
+  if (!searchOption.value) {
+    return logs.value;
+  }
+
+  return logs.value.filter((elem: LogLine) => {
+    return elem?.msg.includes(searchOption.value);
+  });
+});
+
+const copyLogs = () => {
+  return copyText(filteredLogs.value.map((item: LogLine) => {
+    const arr: string[] = [];
+    if (item.date) {
+      arr.push(item.date);
+    }
+
+    arr.push(item.msg);
+
+    return arr.join(" ")
+  }).join("\n"), undefined, () => { });
+};
+
+onMounted(scrollToBottom);
+onUpdated(scrollToBottom);
+
+watch(follow, scrollToBottom);
+watch(logs, () => {
+  waitUpdate.value = true;
+
+  scrollToBottom()
+});
+</script>
+
+<style scoped>
+.logs-list {
+  @apply flex flex-col;
+}
+.logs-list-heading {
+  @apply flex w-full bg-naturals-N2 justify-between items-center;
+  padding: 10px 16px;
+  border-radius: 2px;
+}
+.logs-list-heading-wrapper {
+  @apply flex w-full;
+}
+.logs-list-heading-name {
+  @apply text-xs text-naturals-N13 w-full;
+  min-width: 100px;
+  max-width: 300px;
+}
+.logs-view {
+  @apply flex flex-col w-full grow overflow-auto h-72;
+}
+
+.logs-item {
+  @apply flex w-full;
+  padding: 5px 0px 5px 16px;
+}
+.logs-item-date {
+  @apply text-xs font-roboto w-full;
+  min-width: 100px;
+  max-width: 300px;
+}
+.logs-item-message {
+  @apply w-full text-xs font-roboto break-all;
+}
+</style>
diff --git a/frontend/src/components/common/MenuItem/TMenuItem.vue b/frontend/src/components/common/MenuItem/TMenuItem.vue
new file mode 100644
index 000000000..83ece1cff
--- /dev/null
+++ b/frontend/src/components/common/MenuItem/TMenuItem.vue
@@ -0,0 +1,61 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <router-link :to="route" active-class="item__active">
+    <div class="item">
+      <t-icon v-if="icon" class="item__icon" :icon="icon" :svg-base64="iconSvgBase64"/>
+      <p class="item__name truncate">{{ name }}</p>
+      <div v-if="label" class="rounded-full text-naturals-N13 bg-naturals-N4 text-xs p-1 w-6 h-6 text-center" :class="labelColor ? 'text-' + labelColor : ''">
+        {{ label }}
+      </div>
+    </div>
+  </router-link>
+</template>
+
+<script setup lang="ts">
+import TIcon, { IconType } from "@/components/common/Icon/TIcon.vue";
+
+type Props = {
+  route: string | object,
+  name: string,
+  icon?: IconType,
+  iconSvgBase64?: string,
+  label?: string | number,
+  labelColor?: string
+};
+
+defineProps<Props>();
+</script>
+
+<style scoped>
+.item {
+  @apply flex gap-4 border-l-2 border-transparent justify-start items-center py-1.5 my-1 px-6 transition-all duration-200 hover:bg-naturals-N4;
+}
+.item:hover .item__icon {
+  @apply text-naturals-N13;
+}
+.item:hover .item__name {
+  @apply text-naturals-N13;
+}
+.item__active .item {
+  @apply border-primary-P3;
+}
+.item__active .item__icon {
+  @apply text-naturals-N13;
+}
+.item__active .item__name {
+  @apply text-naturals-N13;
+}
+.item__icon {
+  @apply text-naturals-N11 transition-all duration-200;
+  width: 16px;
+  height: 16px;
+}
+.item__name {
+  @apply text-xs text-naturals-N11 transition-all duration-200 flex-1;
+}
+</style>
diff --git a/frontend/src/components/common/Notification/TNotification.vue b/frontend/src/components/common/Notification/TNotification.vue
new file mode 100644
index 000000000..66b0a4b26
--- /dev/null
+++ b/frontend/src/components/common/Notification/TNotification.vue
@@ -0,0 +1,148 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="notification" :class="'notification--' + type">
+    <div class="notification__wrapper">
+      <t-icon
+        v-if="type === 'in-progress'"
+        class="notification__icon notification__in-progress-icon"
+        icon="loading"
+      />
+      <t-icon
+        v-if="type === 'error'"
+        class="notification__icon notification__error-icon"
+        icon="error"
+      />
+      <t-icon
+        v-if="type === 'success'"
+        class="notification__icon notification__success-icon"
+        icon="check-in-circle-classic"
+      />
+      <div class="notification__content-box">
+        <h2
+          class="notification__title"
+          :class="type === 'error' && 'notification__title--error'"
+        >
+          {{ title }}
+        </h2>
+        <p class="notification__description" v-if="body">{{ body }}</p>
+      </div>
+    </div>
+    <div class="notification__button-box">
+      <!-- Todo -->
+      <!-- <t-button
+        type="subtle"
+        icon="arrow-right"
+        iconPosition="right"
+        class="notification__left-button"
+        @click="$emit('onLeftButtonClick')"
+      >
+        View details</t-button
+      > -->
+      <t-button
+        v-if="!isButtonHidden"
+        type="primary"
+        class="notification__right-button"
+        @click="
+          () => {
+            abort ? abort() : (close ? close(): null);
+          }
+        "
+        >{{ buttonTitle }}</t-button
+      >
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import TButton from "@/components/common/Button/TButton.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+
+import { useRoute } from "vue-router";
+import { watch } from "vue";
+
+type Props = {
+  type?: "error" | "in-progress" | "success" | "info";
+  title?: string;
+  body?: string;
+  abort?: () => void;
+  isButtonHidden?: boolean;
+  buttonTitle?: "Dismiss" | "Abort";
+  onLeftButtonClick?: () => void;
+  onRightButtonClick?: () => void;
+  close?: () => void;
+}
+
+const props = withDefaults(defineProps<Props>(), {
+  type: "in-progress",
+  buttonTitle: "Dismiss",
+  isButtonHidden: false,
+});
+
+const route = useRoute();
+
+watch(
+  () => route.path,
+  () => {
+    props?.close ? props.close() : null;
+  }
+);
+</script>
+
+<style scoped>
+.notification {
+  @apply w-full flex justify-between items-center py-4 px-6 bg-naturals-N0 rounded border border-naturals-N5;
+  min-height: 65px;
+}
+.notification--in-progress {
+  @apply border-l-4;
+  --tw-border-opacity: 1;
+  border-left-color: rgba(169, 120, 9, var(--tw-border-opacity));
+}
+.notification--error {
+  @apply border-l-4;
+  --tw-border-opacity: 1;
+  border-left-color: rgba(110, 47, 48, var(--tw-border-opacity));
+}
+.notification--success {
+  @apply border-l-4;
+  border-left-color: #69c297;
+}
+.notification__wrapper {
+  @apply flex items-center;
+}
+.notification__button-box {
+  @apply flex items-center justify-end;
+}
+.notification__icon {
+  @apply mr-5 fill-current;
+  width: 20px;
+  height: 20px;
+}
+.notification__in-progress-icon {
+  @apply text-yellow-Y1 animate-spin;
+}
+.notification__error-icon {
+  @apply text-red-R1;
+}
+.notification__success-icon {
+  @apply text-green-G1;
+}
+
+.notification__title {
+  @apply text-sm font-medium text-naturals-N14;
+}
+.notification__title--error {
+  @apply text-red-R1;
+}
+.notification__description {
+  @apply text-xs;
+}
+.notification__left-button {
+  @apply mr-6 whitespace-nowrap;
+}
+</style>
diff --git a/frontend/src/components/common/OngoingTasks/OngoingTasks.vue b/frontend/src/components/common/OngoingTasks/OngoingTasks.vue
new file mode 100644
index 000000000..8e463d7e8
--- /dev/null
+++ b/frontend/src/components/common/OngoingTasks/OngoingTasks.vue
@@ -0,0 +1,152 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div v-click-outside="onClickOutside" class="dropdown-wrapper">
+    <watch v-if="watchOpts" :opts="watchOpts" display-always>
+      <template #default="{ items }">
+        <div class="dropdown" @click="() => toggleDropdown()">
+          <icon-header-dropdown-loading :active="items.length > 0"/>
+          <span class="dropdown-name">Ongoing Tasks</span>
+          <t-icon class="dropdown-icon" :class="{ 'dropdown-icon-open': dropdownOpen }" icon="arrow-down" />
+        </div>
+        <t-animation>
+          <div v-show="dropdownOpen" class="dropdown-list">
+            <template v-if="items.length > 0">
+              <div class="item" v-for="item in items" :key="itemID(item)">
+                <div class="item-heading">
+                  <h3 class="item-title">{{ item.spec.title }}</h3>
+                  <span class="item-time">{{
+                    time.formatISO(item.metadata.created as string, "HH:mm:ss")
+                  }}</span>
+                </div>
+                <p class="item-description truncate">
+                  <template v-if="item.spec.destroy">
+                    {{ item.spec.destroy.phase }}
+                  </template>
+                  <template v-else>
+                    <div class="flex gap-2 text-xs items-center">
+                      <template v-if="(item.spec.kubernetes_upgrade ?? item.spec.talos_upgrade).current_upgrade_version">
+                        <span v-if="item.spec.kubernetes_upgrade">Upgrade Kubernetes</span>
+                        <span v-else>Upgrade Talos</span>
+                        <div class="flex-1"/>
+                        <span class="rounded bg-naturals-N4 px-2 text-xs text-naturals-N13 font-bold">
+                          {{ (item.spec.kubernetes_upgrade ?? item.spec.talos_upgrade).last_upgrade_version }}
+                        </span>
+                        <span>⇾</span>
+                        <span class="rounded bg-naturals-N4 px-2 text-xs text-naturals-N13 font-bold">
+                          {{ (item.spec.kubernetes_upgrade ?? item.spec.talos_upgrade).current_upgrade_version }}
+                        </span>
+                      </template>
+                      <template v-else-if="(item.spec?.kubernetes_upgrade?.phase ?? item.spec?.talos_upgrade?.phase) === KubernetesUpgradeStatusSpecPhase.Reverting">
+                        <span>Reverting back to</span>
+                        <div class="flex-1"/>
+                        <span class="rounded bg-naturals-N4 px-2 text-xs text-naturals-N13 font-bold">
+                          {{ (item.spec.kubernetes_upgrade ?? item.spec.talos_upgrade).last_upgrade_version }}
+                        </span>
+                      </template>
+                      <template v-else>
+                        <span>Installing extensions</span>
+                      </template>
+                    </div>
+                  </template>
+                </p>
+              </div>
+            </template>
+            <div v-else class="text-xs w-32 p-4 flex items-center justify-center gap-2">
+              <t-icon icon="check" class="w-4 h-4"/>
+              No tasks
+            </div>
+          </div>
+        </t-animation>
+      </template>
+    </watch>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from "vue";
+
+import { itemID } from "@/api/watch";
+import { Runtime } from "@/api/common/omni.pb";
+import {
+  EphemeralNamespace,
+  OngoingTaskType,
+} from "@/api/resources";
+import { time } from "@/methods/time";
+import { authorized } from "@/methods/key";
+import { KubernetesUpgradeStatusSpecPhase } from "@/api/omni/specs/omni.pb";
+
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import TAnimation from "@/components/common/Animation/TAnimation.vue";
+import Watch from "@/components/common/Watch/Watch.vue";
+import IconHeaderDropdownLoading from "@/components/icons/IconHeaderDropdownLoading.vue";
+
+const watchOpts = computed(() => {
+  if (authorized.value) {
+    return { resource: resource, runtime: Runtime.Omni };
+  }
+
+  return undefined;
+});
+
+const dropdownOpen = ref(false);
+
+const resource = {
+  namespace: EphemeralNamespace,
+  type: OngoingTaskType,
+};
+
+const toggleDropdown = () => {
+  dropdownOpen.value = !dropdownOpen.value;
+};
+
+const onClickOutside = () => {
+  dropdownOpen.value = false;
+};
+</script>
+
+<style scoped>
+.dropdown {
+  @apply flex items-center cursor-pointer gap-1 text-naturals-N11 hover:text-naturals-N13;
+}
+.dropdown-wrapper {
+  @apply relative flex items-center;
+}
+.dropdown-icon {
+  @apply flex justify-center items-center fill-current transition-transform duration-300 w-4 h-4;
+}
+.dropdown-icon-open {
+  transform: rotateX(-180deg);
+}
+.dropdown-name {
+  @apply text-xs font-normal whitespace-nowrap select-none;
+}
+.dropdown-list {
+  @apply absolute -right-2 top-7 bg-naturals-N2 border border-naturals-N4 rounded z-30;
+}
+
+.item {
+  @apply p-6 flex flex-col gap-2;
+}
+
+.item:not(:last-child) {
+  @apply border-b border-naturals-N4;
+}
+
+.item-heading {
+  @apply flex justify-between items-center gap-4;
+}
+.item-title {
+  @apply text-xs text-naturals-N13 w-9/12  whitespace-nowrap;
+}
+.item-time {
+  @apply text-xs text-naturals-N9 w-3/12 text-right;
+}
+.item-description {
+  @apply text-xs text-naturals-N9;
+}
+</style>
\ No newline at end of file
diff --git a/frontend/src/components/common/PageHeader.vue b/frontend/src/components/common/PageHeader.vue
new file mode 100644
index 000000000..70769eff4
--- /dev/null
+++ b/frontend/src/components/common/PageHeader.vue
@@ -0,0 +1,29 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col gap-1" :class="{'mb-7': !subtitle, 'mb-2': subtitle}">
+    <h3 class="title">{{ title }}</h3>
+    <div v-if="subtitle" class="text-sm text-naturals-N13">{{ subtitle }}</div>
+    <div v-if="notes" class="text-sm text-naturals-N10">{{ notes }}</div>
+  </div>
+</template>
+
+<script setup lang="ts">
+type Props = {
+  title: string;
+  subtitle?: string;
+  notes?: string;
+};
+
+defineProps<Props>();
+</script>
+
+<style scoped>
+.title {
+  @apply text-xl font-medium text-naturals-N14;
+}
+</style>
diff --git a/frontend/src/components/common/Pagination/TPagination.vue b/frontend/src/components/common/Pagination/TPagination.vue
new file mode 100644
index 000000000..87461fd45
--- /dev/null
+++ b/frontend/src/components/common/Pagination/TPagination.vue
@@ -0,0 +1,175 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <slot :paginatedItems="filteredItems" />
+  <div class="pagination" :style="{ opacity: isInvisible ? 0 : 1 }">
+    <t-icon
+      icon="arrow-left"
+      class="pagination__icon"
+      :class="{ 'pagination__icon--passive': currentPage === 1 }"
+      @click="onPrevious"
+    />
+
+    <div class="pagination__pages">
+      <span
+        @click="() => onPageClick(item)"
+        class="pagination__page-number"
+        :class="{
+          'pagination__page-number--active': item === currentPage,
+          unhovered: item === DOTS,
+        }"
+        v-for="item in paginationRange || []"
+        :key="item"
+      >
+        {{ item }}</span
+      >
+    </div>
+    <t-icon
+      icon="arrow-right"
+      class="pagination__icon"
+      :class="{ 'pagination__icon--passive': currentPage === totalPageCount }"
+      @click="onNext"
+    />
+  </div>
+</template>
+
+<script setup lang="ts">
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import { computed, ref, toRefs } from "vue";
+import { watch } from "vue";
+
+type Props = {
+  items: any[];
+  perPage?: number;
+  searchOption: string;
+};
+
+const props = withDefaults(defineProps<Props>(), {
+  perPage: 8,
+});
+
+const { items, perPage, searchOption } = toRefs(props);
+const DOTS = "...";
+const currentPage = ref(1);
+const totalPageCount = computed(() => {
+  return Math.ceil(items.value.length / perPage.value);
+});
+const range = (start, end) => {
+  const length = end - start + 1;
+  return Array.from({ length }, (_, idx) => idx + start);
+};
+const siblingCount = ref(1);
+const paginationRange = computed(() => {
+  const totalPageNumbers = siblingCount.value + 5;
+  if (totalPageNumbers >= totalPageCount.value) {
+    return range(1, totalPageCount.value);
+  }
+  const leftSiblingIndex = Math.max(
+    currentPage.value - siblingCount.value,
+    1
+  );
+  const rightSiblingIndex = Math.min(
+    currentPage.value + siblingCount.value,
+    totalPageCount.value
+  );
+  const shouldShowLeftDots = leftSiblingIndex > 2;
+  const shouldShowRightDots = rightSiblingIndex < totalPageCount.value - 2;
+  const firstPageIndex = 1;
+  const lastPageIndex = totalPageCount.value;
+  if (!shouldShowLeftDots && shouldShowRightDots) {
+    const leftItemCount = 3 + 2 * siblingCount.value;
+    const leftRange = range(1, leftItemCount);
+    return [...leftRange, DOTS, totalPageCount.value];
+  }
+  if (shouldShowLeftDots && !shouldShowRightDots) {
+    const rightItemCount = 3 + 2 * siblingCount.value;
+    const rightRange = range(
+      totalPageCount.value - rightItemCount + 1,
+      totalPageCount.value
+    );
+    return [firstPageIndex, DOTS, ...rightRange];
+  }
+  if (shouldShowLeftDots && shouldShowRightDots) {
+    const middleRange = range(leftSiblingIndex, rightSiblingIndex);
+    return [firstPageIndex, DOTS, ...middleRange, DOTS, lastPageIndex];
+  }
+
+  return [];
+});
+const lastPage = computed(() => {
+  return (
+    paginationRange.value &&
+    paginationRange.value[paginationRange.value.length - 1]
+  );
+});
+
+const onNext = () => {
+  if (currentPage.value === lastPage.value) return;
+  currentPage.value += 1;
+};
+
+const onPrevious = () => {
+  if (currentPage.value === 1) return;
+  currentPage.value -= 1;
+};
+const onPageClick = (value) => {
+  if (value !== DOTS) {
+    currentPage.value = value;
+  }
+};
+watch(
+  () => searchOption.value,
+  () => {
+    currentPage.value = 1;
+  });
+
+const isInvisible = computed(() => {
+  return !totalPageCount.value ||
+    currentPage.value === 0 ||
+    (paginationRange.value && paginationRange.value.length < 2);
+});
+
+const filteredItems = computed(() => {
+  return items.value
+    .slice((currentPage.value - 1) * perPage.value)
+    .slice(0, perPage.value);
+});
+</script>
+
+<style scoped>
+.pagination {
+  @apply flex items-center justify-end pt-6;
+}
+.pagination__icon {
+  @apply fill-current text-naturals-N8 cursor-pointer transition-all duration-200 hover:text-naturals-N10;
+  width: 18px;
+  height: 18px;
+}
+.pagination__icon--passive {
+  @apply text-naturals-N6;
+}
+.pagination__icon:nth-child(1) {
+  margin-right: 20px;
+}
+.pagination__pages {
+  @apply flex items-center transition-all duration-200;
+  margin-right: 20px;
+}
+.pagination__page-number {
+  @apply w-7 h-7 rounded text-naturals-N8 transition-all duration-200 flex items-center justify-center cursor-pointer hover:text-naturals-N9;
+  margin-right: 20px;
+}
+.unhovered {
+  @apply hover:text-naturals-N8 cursor-default;
+}
+.pagination__page-number:last-of-type {
+  margin: 0;
+}
+.pagination__page-number--active {
+  @apply text-naturals-N12 bg-naturals-N4;
+}
+</style>
diff --git a/frontend/src/components/common/SelectList/TSelectList.vue b/frontend/src/components/common/SelectList/TSelectList.vue
new file mode 100644
index 000000000..3f25b2611
--- /dev/null
+++ b/frontend/src/components/common/SelectList/TSelectList.vue
@@ -0,0 +1,138 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="menu">
+    <Listbox v-model="selectedItem">
+      <ListboxButton class="menu-button flex items-center gap-1">
+        <div class="flex overflow-hidden">
+          <div class="menu-title">{{ title }}:</div><div class="flex-1 truncate">{{ selectedItem }}</div>
+        </div>
+        <t-icon class="menu-arrow" icon="arrow-down" />
+      </ListboxButton>
+      <t-animation @after-enter="focusSearch = true" @after-leave="focusSearch = false">
+        <ListboxOptions class="menu-items">
+          <t-input @keydown.stop="() => {}" :focus="focusSearch" icon="search" v-if="searcheable" title="" class="search-box" placeholder="Search"
+            v-model="searchTerm"/>
+          <div class="menu-items-wrapper" v-if="filteredValues.length > 0">
+            <div @click="$emit('checkedValue', item)" v-for="(item, idx) in filteredValues" :key="idx">
+              <ListboxOption v-slot="{ active, selected }" class="menu-item" :value="item">
+                <div class="menu-item-wrapper">
+                  <span class="menu-item-text" :class="{ active: active }">
+                    <word-highligher :query="searchTerm" :textToHighlight="item.toString()" highlightClass="text-naturals-N14 font-medium bg-transparent"/>
+                  </span>
+                  <t-icon icon="check" class="menu-check-icon" v-show="selected" />
+                </div>
+              </ListboxOption>
+            </div>
+          </div>
+        </ListboxOptions>
+      </t-animation>
+    </Listbox>
+  </div>
+</template>
+
+<script setup lang="ts">
+import {
+  Listbox,
+  ListboxButton,
+  ListboxOptions,
+  ListboxOption,
+} from "@headlessui/vue";
+
+import { ref, toRefs, computed } from "vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import TInput from "@/components/common/TInput/TInput.vue";
+import TAnimation from "@/components/common/Animation/TAnimation.vue";
+import WordHighligher from "vue-word-highlighter";
+
+const props = defineProps<{
+  title?: string,
+  defaultValue?: (string | number),
+  values: (string | number)[],
+  searcheable?: Boolean,
+}>();
+
+const emit = defineEmits(["checkedValue"]);
+
+const { values } = toRefs(props);
+const searchTerm = ref("");
+const selectedItem = ref(props.defaultValue);
+const focusSearch = ref(false);
+
+defineExpose({
+  selectItem: (value: string) => {
+    selectedItem.value = value;
+    emit("checkedValue", value);
+  }
+});
+
+const filteredValues = computed(() => {
+  if (!searchTerm.value) {
+    return values.value;
+  }
+
+  const term = searchTerm.value.toLowerCase();
+
+  return values.value.filter(item => item.toString().toLowerCase().indexOf(term) != -1);
+});
+</script>
+
+<style scoped>
+.menu {
+  @apply relative;
+}
+
+.menu-button {
+  @apply w-full h-full bg-naturals-N2 rounded border border-naturals-N7 flex justify-between items-center text-xs text-naturals-N14;
+  padding: 9px 12px;
+}
+
+.menu-title {
+  @apply text-xs mr-1 whitespace-nowrap truncate;
+}
+
+.menu-arrow {
+  @apply fill-current transition-all duration-300;
+  width: 16px;
+  height: 16px;
+}
+
+.menu-items {
+  @apply flex flex-col rounded bg-naturals-N3 border border-naturals-N4 absolute top-10 left-0 min-w-full z-10 gap-1 p-1.5;
+  max-height: 280px;
+}
+
+.search-box {
+  @apply text-xs text-naturals-N9 h-8;
+}
+
+.menu-item {
+  @apply text-xs text-naturals-N9 cursor-pointer;
+  padding: 6px 12px;
+}
+
+.menu-item-wrapper {
+  @apply flex justify-between items-center;
+}
+
+.menu-item-text {
+  @apply transition-all truncate;
+  margin-right: 8px;
+}
+
+.active {
+  @apply text-naturals-N13;
+}
+
+.menu-items-wrapper {
+  @apply flex flex-col overflow-auto py-2;
+}
+
+.menu-check-icon {
+  @apply w-3 h-3 fill-current text-naturals-N14;
+}
+</style>
diff --git a/frontend/src/components/common/Shell/TShell.vue b/frontend/src/components/common/Shell/TShell.vue
new file mode 100644
index 000000000..d8121137d
--- /dev/null
+++ b/frontend/src/components/common/Shell/TShell.vue
@@ -0,0 +1,47 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="shell">
+    <div
+      class="shell__menu"
+      :class="{ 'shell__menu--hidden': !isSidebarVisible }"
+    >
+      <slot name="menu"></slot>
+    </div>
+    <div class="shell__content">
+        <slot name="content"></slot>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import { useRoute } from "vue-router";
+
+const route = useRoute();
+const isSidebarVisible = computed(() => {
+  return route.path !== "/dashboard";
+});
+</script>
+
+<style scoped>
+.shell {
+  @apply w-full flex bg-naturals-N0;
+}
+.shell__content {
+  @apply flex justify-end items-start w-full px-2 py-6 px-6 overflow-y-auto;
+}
+.shell__menu {
+  transition: 0.4s ease all;
+  position: relative;
+}
+.shell__menu--hidden {
+  @apply z-10 absolute bottom-0;
+  top: 52px;
+  transform: translateX(-100%);
+}
+</style>
diff --git a/frontend/src/components/common/SlideDownWrapper/TSlideDownWrapper.vue b/frontend/src/components/common/SlideDownWrapper/TSlideDownWrapper.vue
new file mode 100644
index 000000000..38c0e1460
--- /dev/null
+++ b/frontend/src/components/common/SlideDownWrapper/TSlideDownWrapper.vue
@@ -0,0 +1,77 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="wrapper">
+    <div class="wrapper-box">
+      <div class="wrapper-head">
+        <slot name="head"/>
+      </div>
+      <div class="wrapper-body-box">
+        <div
+          class="wrapper-body"
+          :style="{ height }"
+        >
+          <div ref="body">
+            <slot name="body"/>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Ref, ref, toRefs, computed, watch, onUnmounted } from "vue";
+
+const props = withDefaults(defineProps<{
+  isSliderOpened?: boolean,
+}>(), {
+  isSliderOpened: false
+});
+
+const { isSliderOpened } = toRefs(props);
+
+const body: Ref<Element | undefined> = ref();
+
+
+const resizeObserver = new ResizeObserver(function() {
+  elementHeight.value = body.value?.clientHeight ?? 0;
+});
+
+onUnmounted(() => {
+  resizeObserver.disconnect();
+});
+
+const elementHeight = ref(0);
+
+watch(() => body.value, () => {
+  resizeObserver.disconnect();
+
+  if (!body.value) {
+    return;
+  }
+
+  resizeObserver.observe(body.value);
+});
+
+const height = computed(() => {
+  return isSliderOpened.value ? `${elementHeight.value}px` : '0';
+});
+</script>
+
+<style scoped>
+.wrapper {
+  @apply w-full flex flex-col;
+}
+
+.wrapper-body {
+  @apply overflow-hidden transition-all duration-300 ease-in-out;
+}
+.wrapper-body-box {
+  position: relative;
+}
+</style>
diff --git a/frontend/src/components/common/Spinner/TSpinner.vue b/frontend/src/components/common/Spinner/TSpinner.vue
new file mode 100644
index 000000000..1495c4266
--- /dev/null
+++ b/frontend/src/components/common/Spinner/TSpinner.vue
@@ -0,0 +1,49 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div>
+    <svg class="spinner" viewBox="0 0 70 70" xmlns="http://www.w3.org/2000/svg">
+      <circle class="path" fill="none" stroke-width="9" stroke-linecap="round" cx="35" cy="35" r="30"></circle>
+    </svg>
+  </div>
+</template>
+
+<style scoped>
+.spinner {
+  @apply w-full h-full;
+  animation: rotator 1.4s linear infinite;
+}
+@keyframes rotator {
+  0% {
+    transform: rotate(0deg);
+  }
+  100% {
+    transform: rotate(270deg);
+  }
+}
+.path {
+  stroke-dasharray: 187;
+  stroke-dashoffset: 0;
+  transform-origin: center;
+  animation: dash 1.4s ease-in-out infinite;
+  @apply stroke-primary-P3;
+}
+
+@keyframes dash {
+  0% {
+    stroke-dashoffset: 187;
+  }
+  50% {
+    stroke-dashoffset: 46.75;
+    transform: rotate(135deg);
+  }
+  100% {
+    stroke-dashoffset: 187;
+    transform: rotate(450deg);
+  }
+}
+</style>
\ No newline at end of file
diff --git a/frontend/src/components/common/Status/TStatus.vue b/frontend/src/components/common/Status/TStatus.vue
new file mode 100644
index 000000000..84f4485f6
--- /dev/null
+++ b/frontend/src/components/common/Status/TStatus.vue
@@ -0,0 +1,201 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="label">
+    <t-icon
+      class="label-icon"
+      :style="{
+        fill: !!color ? color : iconData?.iconColor || iconColor.color,
+      }"
+      :icon="!!iconType ? iconType : iconData?.iconTypeValue"
+    />
+    <span
+      class="label-title"
+      :style="{
+        color: !!color ? color : iconData?.iconColor || iconColor.color,
+      }"
+      v-if="title"
+      >{{ title }}</span
+    >
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, toRefs } from "vue";
+import TIcon, { IconType } from "@/components/common/Icon/TIcon.vue";
+import {
+  NodesViewFilterOptions,
+  TPodsViewFilterOptions,
+  TCommonStatuses,
+} from "@/constants";
+
+type Props = {
+  iconType?: IconType;
+  title?: string;
+  color?: string;
+};
+
+const props = defineProps<Props>();
+const { iconType, title, color } = toRefs(props);
+
+const iconData = computed((): { iconColor?: string, iconTypeValue?: IconType } => {
+  if (title) {
+    switch (title.value) {
+      case TPodsViewFilterOptions.RUNNING:
+        return {
+          iconTypeValue: "check-in-circle-classic",
+          iconColor: "#69C297",
+        };
+      case NodesViewFilterOptions.READY:
+        return {
+          iconTypeValue: "check-in-circle-classic",
+          iconColor: "#69C297",
+        };
+      case TPodsViewFilterOptions.PENDING:
+        return {
+          iconTypeValue: "time",
+          iconColor: "#FFB200",
+        };
+      case TPodsViewFilterOptions.FAILED:
+        return {
+          iconTypeValue: "error",
+          iconColor: "#FF5C56",
+        };
+      case TPodsViewFilterOptions.UNKNOWN:
+        return {
+          iconTypeValue: "unknown",
+          iconColor: "#FF8B59",
+        }
+      case TPodsViewFilterOptions.SUCCEEDED:
+        return {
+          iconTypeValue: "check-in-circle-classic",
+          iconColor: "#69C297",
+        };
+      case TCommonStatuses.COMPLETED:
+        return {
+          iconTypeValue: "check-in-circle-classic",
+          iconColor: "#69C297",
+        };
+      case TCommonStatuses.FAILED:
+        return {
+          iconTypeValue: "error",
+          iconColor: "#FF5C56",
+        };
+      case TCommonStatuses.ERROR:
+        return {
+          iconTypeValue: "error",
+          iconColor: "#FF5C56",
+        };
+      case NodesViewFilterOptions.NOT_READY:
+        return {
+          iconTypeValue: "time",
+          iconColor: "#FF5C56",
+        };
+      case TCommonStatuses.LOADING:
+        return {
+          iconTypeValue: "time",
+          iconColor: "#FF8B59",
+        };
+      case TCommonStatuses.UNKNOWN:
+        return {
+          iconTypeValue: "unknown",
+          iconColor: "#FF8B59",
+        };
+      case TCommonStatuses.HEALTH_UNKNOWN:
+        return {
+          iconTypeValue: "question",
+          iconColor: "#7D7D85",
+        };
+      case TCommonStatuses.HEALTHY:
+        return {
+          iconTypeValue: "check-in-circle-classic",
+          iconColor: "#69C297",
+        };
+      case TCommonStatuses.UNHEALTHY:
+        return {
+          iconTypeValue: "error",
+          iconColor: "#FF5C56",
+        };
+      case TCommonStatuses.ON:
+        return {
+          iconTypeValue: "dot",
+          iconColor: "#69C297",
+        };
+      case TCommonStatuses.OFF:
+        return {
+          iconTypeValue: "dot",
+          iconColor: "#7D7D85",
+        };
+      case TCommonStatuses.TRUE:
+        return {
+          iconTypeValue: "check-in-circle-classic",
+          iconColor: "#7D7D85",
+        };
+      case TCommonStatuses.FALSE:
+        return {
+          iconTypeValue: "error",
+          iconColor: "#7D7D85",
+        };
+      case TCommonStatuses.UP_TO_DATE:
+        return {
+          iconTypeValue: "check-in-circle-classic",
+          iconColor: "#69C297",
+        };
+      case TCommonStatuses.OUTDATED:
+        return {
+          iconTypeValue: "error",
+          iconColor: "#FF5C56",
+        };
+      case TCommonStatuses.APPLIED:
+        return {
+          iconTypeValue: "check-in-circle-classic",
+          iconColor: "#69C297",
+        };
+      case TCommonStatuses.PENDING:
+        return {
+          iconTypeValue: "time",
+          iconColor: "#FFB200",
+        };
+    }
+  }
+
+  return {};
+});
+
+const iconColor = computed(() => {
+  if (iconType) {
+    switch (iconType.value) {
+      case "check-in-circle-classic":
+        return { color: "#69C297" };
+      case "loading":
+        return { color: "#FFB200" };
+      case "time":
+        return { color: "#7D7D85" };
+      case "refresh":
+        return { color: "#59A5FF" };
+      default:
+        return { color: "#7D7D85" };
+    }
+  }
+
+  return {};
+})
+</script>
+
+<style scoped>
+.label {
+  @apply flex items-center;
+}
+.label-icon {
+  @apply fill-current;
+  width: 16px;
+  height: 16px;
+}
+.label-title {
+  @apply pl-1 text-xs;
+}
+</style>
diff --git a/frontend/src/components/common/Suspended/TSuspended.vue b/frontend/src/components/common/Suspended/TSuspended.vue
new file mode 100644
index 000000000..c7a9b94bb
--- /dev/null
+++ b/frontend/src/components/common/Suspended/TSuspended.vue
@@ -0,0 +1,37 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="suspended">
+    <div class="suspended__wrapper">
+      <t-icon class="suspended__icon" icon="attention" />
+      <div class="suspended__content-box">
+        This account is currently <b>suspended</b> and in read-only mode. You can still access your resources but will not be able to make any changes.<br />
+        Please contact support to resolve this issue.
+      </div>
+    </div> 
+  </div>
+</template>
+
+<script setup lang="ts">
+import TIcon from "@/components/common/Icon/TIcon.vue";
+</script>
+
+<style scoped>
+.suspended {
+  @apply text-red-R1 border-l-4 w-full flex justify-between items-center py-4 px-6 bg-naturals-N0 rounded border border-naturals-N5;
+  min-height: 65px;
+  border-color: rgba(110, 47, 48, var(--tw-border-opacity));
+}
+.suspended__wrapper {
+  @apply flex items-center;
+}
+.suspended__icon {
+  @apply mr-5 fill-current;
+  width: 20px;
+  height: 20px;
+}
+</style>
diff --git a/frontend/src/components/common/TInput/TInput.vue b/frontend/src/components/common/TInput/TInput.vue
new file mode 100644
index 000000000..445539fb3
--- /dev/null
+++ b/frontend/src/components/common/TInput/TInput.vue
@@ -0,0 +1,178 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <label
+    @click.prevent="
+      () => {
+        isFocused = true;
+        ($refs.input as any).focus();
+      }
+    "
+    v-click-outside="() => (isFocused = false)"
+    class="input-box"
+    :class="[{ focused: isFocused, secondary, primary: !secondary, compact }]"
+  >
+    <t-icon class="input-box-icon" v-if="icon" :icon="icon"/>
+    <span v-if="title" class="text-xs min-w-fit mr-1">{{title}}:</span>
+    <input
+      @input="updateValue($event.target?.['value'].trim())"
+      ref="input"
+      :value="modelValue"
+      :type="type"
+      class="input-box-input"
+      @focus="isFocused = true"
+      @blur="blurHandler"
+      :placeholder="placeholder"
+    />
+    <div v-if="type === 'number'" class="flex flex-col select-none">
+      <t-icon class="hover:text-naturals-N14 w-2" icon="arrow-up" @click="updateValue(intValue + 1)"/>
+      <t-icon class="hover:text-naturals-N14 w-2" icon="arrow-down"  @click="updateValue(intValue - 1)"/>
+    </div>
+    <div v-else-if="modelValue !== ''" @click.prevent="clearInput">
+      <t-icon
+        class="input-box-icon"
+        icon="close"
+      />
+    </div>
+  </label>
+</template>
+
+<script setup lang="ts">
+import { watch, ref, toRefs, onMounted, Ref, computed } from "vue";
+
+import TIcon, { IconType } from "@/components/common/Icon/TIcon.vue";
+
+const emit = defineEmits(["update:model-value", "blur"]);
+
+type propsType = {
+  icon?: IconType,
+  title?: string,
+  modelValue: string | number,
+  placeholder?: string,
+  focus?: boolean,
+  secondary?: boolean,
+  compact?: boolean,
+  type?: "text" | "number" | "password",
+  max?: number,
+  min?: number,
+}
+
+const props = withDefaults(
+  defineProps<propsType>(),
+  {
+    type: "text",
+  }
+);
+
+const { modelValue, focus } = toRefs(props);
+
+const intValue = computed(() => {
+  return parseInt(modelValue.value as string);
+});
+
+const updateValue = (value: string | number) => {
+  if (props.type === "number") {
+    let numberValue = typeof value === "number" ? value as number : parseInt(value);
+
+    if (value === undefined || value == '') {
+      return;
+    }
+
+    if (isNaN(numberValue)) {
+      numberValue = 0;
+    }
+
+    if (props.max !== undefined) {
+      numberValue = Math.min(props.max, numberValue);
+    }
+
+    if (props.min !== undefined) {
+      numberValue = Math.max(props.min, numberValue);
+    }
+
+    emit("update:model-value", numberValue);
+
+    return;
+  }
+
+  emit("update:model-value", value);
+}
+
+
+const isFocused = ref(false);
+const input: Ref<{focus: () => void} | null> = ref(null);
+
+const clearInput = () => {
+  updateValue("");
+};
+
+const blurHandler = () => {
+  isFocused.value = false;
+  emit("blur", "");
+};
+
+if (focus) {
+  watch(focus, () => {
+    if (focus.value && input.value) {
+      input.value?.focus();
+    }
+  });
+}
+
+onMounted(() => {
+  if (focus?.value && input.value) {
+    input.value.focus();
+  }
+});
+</script>
+
+<style scoped>
+.input-box {
+  @apply flex justify-start items-center p-2 border border-naturals-N8 rounded transition-colors gap-2 min-w-fit;
+}
+
+.compact {
+  @apply p-1 px-2;
+}
+
+.input-box-icon {
+  @apply fill-current text-naturals-N8 transition-colors cursor-pointer w-4 h-4 min-w-max;
+}
+
+.input-box-input {
+  @apply bg-transparent border-none outline-none w-full text-naturals-N13 focus:outline-none  focus:border-transparent text-xs transition-colors placeholder-naturals-N7;
+
+  min-width: 0.5rem;
+}
+
+.input-box-icon-wrapper {
+  min-width: 16px;
+}
+
+.secondary {
+  @apply border-transparent;
+}
+
+.focused {
+  @apply border border-solid border-naturals-N5;
+}
+
+.focused .input-box-icon {
+  @apply text-naturals-N14;
+}
+
+input::-webkit-outer-spin-button,
+input::-webkit-inner-spin-button {
+  -webkit-appearance: none;
+  margin: 0;
+}
+
+/* Firefox */
+input[type=number] {
+  -moz-appearance: textfield;
+}
+</style>
diff --git a/frontend/src/components/common/Tabs/TabButton.vue b/frontend/src/components/common/Tabs/TabButton.vue
new file mode 100644
index 000000000..29b725a23
--- /dev/null
+++ b/frontend/src/components/common/Tabs/TabButton.vue
@@ -0,0 +1,44 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <component :is="is" class="tab" :class="{ active: selected }">
+    <slot/>
+  </component>
+</template>
+
+<script setup lang="ts">
+import { toRefs } from "vue";
+
+type Props = {
+  selected: boolean;
+  is?: string
+};
+
+const props = withDefaults(defineProps<Props>(),
+  {
+    is: "div"
+  },
+);
+const { selected } = toRefs(props);
+</script>
+
+<style scoped>
+.tab {
+  @apply text-sm hover:text-naturals-N13 transition-colors focus:outline-none outline-none;
+}
+
+.active {
+  @apply text-naturals-N13 relative focus:outline-none outline-none;
+}
+
+.active::before {
+  @apply block absolute bg-primary-P3 w-full animate-fadein;
+  content: "";
+  height: 2px;
+  bottom: -15px;
+}
+</style>
diff --git a/frontend/src/components/common/Tabs/TabList.vue b/frontend/src/components/common/Tabs/TabList.vue
new file mode 100644
index 000000000..89467c64f
--- /dev/null
+++ b/frontend/src/components/common/Tabs/TabList.vue
@@ -0,0 +1,15 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <TabList class="tabs">
+    <slot/>
+  </TabList>
+</template>
+
+<script setup lang="ts">
+import { TabList } from '@headlessui/vue'
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/common/Tabs/TabsHeader.vue b/frontend/src/components/common/Tabs/TabsHeader.vue
new file mode 100644
index 000000000..5d6a48bd8
--- /dev/null
+++ b/frontend/src/components/common/Tabs/TabsHeader.vue
@@ -0,0 +1,11 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex gap-6 pb-3.5 border-b border-naturals-N4">
+    <slot/>
+  </div>
+</template>
\ No newline at end of file
diff --git a/frontend/src/components/common/Tag/TTag.vue b/frontend/src/components/common/Tag/TTag.vue
new file mode 100644
index 000000000..e286013ae
--- /dev/null
+++ b/frontend/src/components/common/Tag/TTag.vue
@@ -0,0 +1,30 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="tag">
+    {{ name }}
+  </div>
+</template>
+
+<script setup lang="ts">
+import { toRefs } from "vue";
+
+type Props = {
+  name: string;
+};
+
+const props = defineProps<Props>();
+const { name } = toRefs(props);
+</script>
+
+<style scoped>
+.tag {
+  @apply bg-naturals-N4 rounded text-xs text-naturals-N10;
+  word-break: break-all;
+  padding: 4px 6px 4px 6px;
+}
+</style>
diff --git a/frontend/src/components/common/Tooltip/Tooltip.vue b/frontend/src/components/common/Tooltip/Tooltip.vue
new file mode 100644
index 000000000..ec207aea7
--- /dev/null
+++ b/frontend/src/components/common/Tooltip/Tooltip.vue
@@ -0,0 +1,53 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <popper offsetDistance="10" offsetSkid="30" :placement="placement" :show="show && (!!description || !!$slots.description)">
+    <template #content>
+      <div class="text-xs bg-naturals-N4 rounded p-4 text-naturals-N12">
+        <p v-if="description" class="whitespace-pre">{{ description }}</p>
+        <slot v-else name="description"/>
+      </div>
+    </template>
+    <div @mouseover="show = true" @mouseleave="show = false">
+      <slot/>
+    </div>
+  </popper>
+</template>
+
+<script setup lang="ts">
+import { ref } from "vue";
+import Popper from "vue3-popper";
+
+type props = {
+  description?: string,
+  placement?:
+      | "auto"
+      | "auto-start"
+      | "auto-end"
+      | "top"
+      | "top-start"
+      | "top-end"
+      | "bottom"
+      | "bottom-start"
+      | "bottom-end"
+      | "right"
+      | "right-start"
+      | "right-end"
+      | "left"
+      | "left-start"
+      | "left-end";
+}
+
+withDefaults(
+  defineProps<props>(),
+  {
+    placement: "auto-start",
+  }
+);
+
+const show = ref(false);
+</script>
diff --git a/frontend/src/components/common/UserInfo/UserInfo.vue b/frontend/src/components/common/UserInfo/UserInfo.vue
new file mode 100644
index 000000000..ab5e9e493
--- /dev/null
+++ b/frontend/src/components/common/UserInfo/UserInfo.vue
@@ -0,0 +1,77 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex gap-2 items-center" :class="fontSize">
+    <img v-if="avatar" class="rounded-full" :class="imageSize" :src="avatar" referrerpolicy="no-referrer"/>
+    <div class="flex flex-col flex-1 truncate">
+      <div class="text-naturals-N13 truncate">{{ fullname }}</div>
+      {{ identity }}
+    </div>
+    <t-actions-box v-if="withLogoutControls" placement="top">
+      <div @click="doLogout">
+        <div class="px-4 py-2 cursor-pointer hover:text-naturals-N12">Log Out</div>
+      </div>
+    </t-actions-box>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useAuth0 } from '@auth0/auth0-vue';
+import { computed } from 'vue';
+import { resetKeys } from "@/methods/key";
+import { currentUser } from "@/methods/auth";
+
+import TActionsBox from "@/components/common/ActionsBox/TActionsBox.vue";
+import { useRoute } from 'vue-router';
+import { AuthType, authType } from '@/methods';
+
+type Props = {
+  withLogoutControls?: boolean;
+  size?: "normal" | "small";
+}
+
+const props = withDefaults(defineProps<Props>(), {
+  withLogoutControls: false,
+  size: "normal",
+});
+
+const auth0 = useAuth0();
+
+const route = useRoute();
+
+const identity = computed(() => route.query.identity || auth0?.user?.value?.email?.toLowerCase() || window.localStorage.getItem("identity"));
+const avatar = computed(() =>  route.query.avatar || auth0?.user?.value?.picture || window.localStorage.getItem("avatar"));
+const fullname = computed(() => route.query.fullname || auth0?.user?.value?.name || window.localStorage.getItem("fullname"));
+
+const fontSize = computed(() => {
+  if (props.size === "small") {
+    return { "text-xs": true };
+  }
+
+  return "";
+});
+
+const imageSize = computed(() => {
+  if (props.size === "small") {
+    return { "w-8": true, "h-8": true };
+  }
+
+  return { "w-12": true, "h-12": true };
+});
+
+const doLogout = async () => {
+  await auth0?.logout({ returnTo: window.location.origin });
+
+  resetKeys();
+
+  currentUser.value = undefined;
+
+  if (authType.value === AuthType.SAML) {
+    location.reload();
+  }
+};
+</script>
diff --git a/frontend/src/components/common/Watch/Watch.vue b/frontend/src/components/common/Watch/Watch.vue
new file mode 100644
index 000000000..a8380f5bd
--- /dev/null
+++ b/frontend/src/components/common/Watch/Watch.vue
@@ -0,0 +1,80 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="watch">
+    <div
+      v-if="spinner && loading"
+      class="flex flex-row justify-center items-center w-full h-full"
+    >
+      <t-spinner class="loading-spinner"/>
+    </div>
+    <template v-else-if="errorsAlert && err">
+      <t-alert v-if="!$slots.error"
+        title="Failed to Fetch Data"
+        type="error"
+      >
+        {{ err }}.
+      </t-alert>
+      <slot name="error" v-else err="err"/>
+    </template>
+    <template v-else-if="noRecordsAlert && items.length == 0">
+      <t-alert
+        v-if="!$slots.norecords"
+        type="info"
+        title="No Records"
+        >No entries of the requested resource type are found on the
+        server.</t-alert
+      >
+      <slot name="norecords"/>
+    </template>
+    <div class="wrapper" v-show="!loading && !err && (items.length > 0 || !noRecordsAlert) || displayAlways">
+      <slot :items="items" :watch="resourceWatch"/>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import Watch, { WatchJoin, WatchOptions, WatchJoinOptions } from "@/api/watch";
+import { ref, toRefs } from "vue";
+
+import TAlert from "@/components/TAlert.vue";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+
+type Props = {
+  opts: WatchJoinOptions[] | WatchOptions & Object, // & Object is used to make Vue validator happy
+  spinner?: boolean,
+  noRecordsAlert?: boolean
+  errorsAlert?: boolean,
+  displayAlways?: boolean,
+};
+
+const props = defineProps<Props>();
+const resourceWatch: Watch<any> | WatchJoin<any> = props.opts.length ? new WatchJoin(ref([])) : new Watch(ref([]));
+const { opts } = toRefs(props);
+
+if (opts.value.length) {
+  resourceWatch.setup(opts.value[0], opts.value.slice(1, opts.value.length));
+} else {
+  resourceWatch.setup(opts);
+}
+
+const items = resourceWatch.items;
+const err = resourceWatch.err;
+const loading = resourceWatch.loading;
+</script>
+
+<style scoped>
+.watch {
+  @apply w-full;
+}
+.wrapper {
+  @apply w-full h-full;
+}
+.loading-spinner {
+  @apply absolute top-2/4 w-6 h-6;
+}
+</style>
diff --git a/frontend/src/components/icons/IconAWS.vue b/frontend/src/components/icons/IconAWS.vue
new file mode 100644
index 000000000..b4b50e27e
--- /dev/null
+++ b/frontend/src/components/icons/IconAWS.vue
@@ -0,0 +1,36 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    width="60"
+    height="60"
+    viewBox="0 0 60 60"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M20.0128 29.7354L18.7812 34.8307H21.2287L20.0406 29.7354H20.0128Z"
+      fill="#F7981F"
+    />
+    <path
+      d="M8 35.2803V36.0219C8 39.7087 11.9852 43.4378 16.898 43.4378H43.102C48.0148 43.4378 52 39.7076 52 36.0219V35.2803C52 31.8529 48.5504 27.5492 44.1153 27.1706C44.0162 24.1063 41.5075 21.6532 38.422 21.6532C37.2238 21.6532 36.1126 22.0252 35.195 22.6554C33.4357 18.7359 29.5084 16 24.933 16C18.7208 16 13.6855 21.0341 13.6855 27.2486C13.6855 27.3599 13.6989 27.4657 13.7022 27.5748C10.3695 28.5403 8 32.442 8 35.2803ZM22.1404 38.682L21.5034 36.1488H18.478L17.8111 38.682H16.0885L19.027 28.3454H21.1404L23.8618 38.682H22.1404ZM32.1752 38.682H30.2645L28.9327 30.8942H28.9038L27.5865 38.682H25.6757L23.677 28.3454H25.3428L26.7024 36.3793H26.7324L28.092 28.3454H29.8302L31.2198 36.4227H31.2488L32.595 28.3454H34.2307L32.1752 38.682ZM38.2249 38.8836C35.6627 38.8836 35.0837 37.1766 35.0837 35.7279V35.4818H36.7339V35.7424C36.7339 37.0017 37.284 37.6387 38.4275 37.6387C39.4698 37.6387 39.9898 36.8993 39.9898 36.131C39.9898 35.0453 39.4408 34.5676 38.5144 34.2937L37.3842 33.9018C35.8776 33.3227 35.2273 32.5422 35.2273 31.0657C35.2273 29.1827 36.5012 28.1405 38.4409 28.1405C41.0899 28.1405 41.3649 29.7907 41.3649 30.8608V31.0935H39.7147V30.8764C39.7147 29.9344 39.295 29.3843 38.2672 29.3843C37.5579 29.3843 36.8775 29.7762 36.8775 30.8764C36.8775 31.7594 37.3263 32.207 38.4275 32.6268L39.541 33.0332C41.0031 33.5532 41.6411 34.3516 41.6411 35.7691C41.6422 37.9727 40.3093 38.8836 38.2249 38.8836Z"
+      fill="#F7981F"
+    />
+    <path
+      d="M19.0264 28.3457L16.0879 38.6823H17.8105L18.4775 36.1491H21.5028L22.1398 38.6823H23.8624L21.141 28.3457H19.0264ZM18.7803 34.8307L20.0108 29.7354H20.0386L21.2256 34.8307H18.7803Z"
+      fill="white"
+    />
+    <path
+      d="M31.2495 36.423H31.2195L29.8298 28.3457H28.0928L26.7332 36.3785H26.7031L25.3435 28.3457H23.6777L25.6765 38.6823H27.5872L28.9034 30.8945H28.9335L30.2652 38.6823H32.176L34.2304 28.3457H32.5958L31.2495 36.423Z"
+      fill="white"
+    />
+    <path
+      d="M39.5413 33.0363L38.4278 32.6299C37.3277 32.2101 36.8778 31.7624 36.8778 30.8794C36.8778 29.7793 37.5582 29.3873 38.2675 29.3873C39.2952 29.3873 39.715 29.9374 39.715 30.8794V31.0966H41.3652V30.8638C41.3652 29.7938 41.0902 28.1436 38.4412 28.1436C36.5015 28.1436 35.2276 29.1858 35.2276 31.0687C35.2276 32.5452 35.8779 33.3258 37.3845 33.9048L38.5147 34.2968C39.4411 34.5707 39.9901 35.0495 39.9901 36.134C39.9901 36.9012 39.469 37.6417 38.4278 37.6417C37.2843 37.6417 36.7342 37.0048 36.7342 35.7454V35.4849H35.084V35.731C35.084 37.1796 35.6641 38.8866 38.2252 38.8866C40.3096 38.8866 41.6414 37.9758 41.6414 35.7744C41.6414 34.3536 41.0034 33.5552 39.5413 33.0363Z"
+      fill="white"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconActionHorizontal.vue b/frontend/src/components/icons/IconActionHorizontal.vue
new file mode 100644
index 000000000..d0e41026e
--- /dev/null
+++ b/frontend/src/components/icons/IconActionHorizontal.vue
@@ -0,0 +1,19 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
+    <path
+      d="M7 12C7 13.1046 6.10457 14 5 14C3.89543 14 3 13.1046 3 12C3 10.8954 3.89543 10 5 10C6.10457 10 7 10.8954 7 12Z"
+    />
+    <path
+      d="M14 12C14 13.1046 13.1046 14 12 14C10.8954 14 10 13.1046 10 12C10 10.8954 10.8954 10 12 10C13.1046 10 14 10.8954 14 12Z"
+    />
+    <path
+      d="M21 12C21 13.1046 20.1046 14 19 14C17.8954 14 17 13.1046 17 12C17 10.8954 17.8954 10 19 10C20.1046 10 21 10.8954 21 12Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconActionVertical.vue b/frontend/src/components/icons/IconActionVertical.vue
new file mode 100644
index 000000000..4762ed46f
--- /dev/null
+++ b/frontend/src/components/icons/IconActionVertical.vue
@@ -0,0 +1,23 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M12 7C10.8954 7 10 6.10457 10 5C10 3.89543 10.8954 3 12 3C13.1046 3 14 3.89543 14 5C14 6.10457 13.1046 7 12 7Z"
+    />
+    <path
+      d="M12 14C10.8954 14 10 13.1046 10 12C10 10.8954 10.8954 10 12 10C13.1046 10 14 10.8954 14 12C14 13.1046 13.1046 14 12 14Z"
+    />
+    <path
+      d="M12 21C10.8954 21 10 20.1046 10 19C10 17.8954 10.8954 17 12 17C13.1046 17 14 17.8954 14 19C14 20.1046 13.1046 21 12 21Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconArrowDown.vue b/frontend/src/components/icons/IconArrowDown.vue
new file mode 100644
index 000000000..852cc3e12
--- /dev/null
+++ b/frontend/src/components/icons/IconArrowDown.vue
@@ -0,0 +1,17 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M4.24106 7.7459C4.53326 7.44784 4.99051 7.42074 5.31272 7.66461L5.40503 7.7459L12 14.4734L18.595 7.7459C18.8872 7.44784 19.3444 7.42074 19.6666 7.66461L19.7589 7.7459C20.0511 8.04396 20.0777 8.51037 19.8386 8.83904L19.7589 8.93321L12.582 16.2541C12.2898 16.5522 11.8325 16.5793 11.5103 16.3354L11.418 16.2541L4.24106 8.93321C3.91965 8.60534 3.91965 8.07376 4.24106 7.7459Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconArrowLeft.vue b/frontend/src/components/icons/IconArrowLeft.vue
new file mode 100644
index 000000000..4b5c96627
--- /dev/null
+++ b/frontend/src/components/icons/IconArrowLeft.vue
@@ -0,0 +1,17 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M16.2543 4.24106C16.5524 4.53326 16.5795 4.99051 16.3356 5.31272L16.2543 5.40503L9.52683 12L16.2543 18.595C16.5524 18.8872 16.5795 19.3444 16.3356 19.6666L16.2543 19.7589C15.9563 20.0511 15.4899 20.0777 15.1612 19.8386L15.067 19.7589L7.74614 12.582C7.44808 12.2898 7.42099 11.8325 7.66485 11.5103L7.74614 11.418L15.067 4.24106C15.3949 3.91965 15.9265 3.91965 16.2543 4.24106Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconArrowRight.vue b/frontend/src/components/icons/IconArrowRight.vue
new file mode 100644
index 000000000..51fdf9834
--- /dev/null
+++ b/frontend/src/components/icons/IconArrowRight.vue
@@ -0,0 +1,17 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M7.74566 19.7589C7.4476 19.4667 7.4205 19.0095 7.66437 18.6873L7.74565 18.595L14.4732 12L7.74565 5.40503C7.44759 5.11283 7.4205 4.65558 7.66437 4.33337L7.74565 4.24106C8.04371 3.94886 8.51013 3.9223 8.8388 4.16137L8.93296 4.24106L16.2539 11.418C16.5519 11.7102 16.579 12.1675 16.3351 12.4897L16.2539 12.582L8.93296 19.7589C8.6051 20.0804 8.07352 20.0804 7.74566 19.7589Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconArrowRightSquare.vue b/frontend/src/components/icons/IconArrowRightSquare.vue
new file mode 100644
index 000000000..83cada970
--- /dev/null
+++ b/frontend/src/components/icons/IconArrowRightSquare.vue
@@ -0,0 +1,29 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M3.09467 3.09467C4.42914 1.7602 6.42603 1.25 9 1.25H15C17.574 1.25 19.5709 1.7602 20.9053 3.09467C22.2398 4.42914 22.75 6.42603 22.75 9V15C22.75 17.574 22.2398 19.5709 20.9053 20.9053C19.5709 22.2398 17.574 22.75 15 22.75H9C6.42603 22.75 4.42914 22.2398 3.09467 20.9053C1.7602 19.5709 1.25 17.574 1.25 15V9C1.25 6.42603 1.7602 4.42914 3.09467 3.09467ZM4.15533 4.15533C3.2398 5.07086 2.75 6.57397 2.75 9V15C2.75 17.426 3.2398 18.9291 4.15533 19.8447C5.07086 20.7602 6.57397 21.25 9 21.25H15C17.426 21.25 18.9291 20.7602 19.8447 19.8447C20.7602 18.9291 21.25 17.426 21.25 15V9C21.25 6.57397 20.7602 5.07086 19.8447 4.15533C18.9291 3.2398 17.426 2.75 15 2.75H9C6.57397 2.75 5.07086 3.2398 4.15533 4.15533Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M12.2107 7.93913C12.504 7.64666 12.9788 7.64733 13.2713 7.94064L16.7913 11.4706C17.0832 11.7634 17.0832 12.2371 16.7913 12.5298L13.2713 16.0598C12.9788 16.3531 12.504 16.3538 12.2107 16.0613C11.9173 15.7688 11.9167 15.2939 12.2092 15.0006L15.2011 12.0002L12.2092 8.99979C11.9167 8.70648 11.9173 8.23161 12.2107 7.93913Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M17 11.95C17 12.3642 16.6642 12.7 16.25 12.7L7.75 12.7C7.33579 12.7 7 12.3642 7 11.95C7 11.5358 7.33579 11.2 7.75 11.2L16.25 11.2C16.6642 11.2 17 11.5358 17 11.95Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconArrowUp.vue b/frontend/src/components/icons/IconArrowUp.vue
new file mode 100644
index 000000000..213b10aed
--- /dev/null
+++ b/frontend/src/components/icons/IconArrowUp.vue
@@ -0,0 +1,17 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M19.7589 16.2541C19.4667 16.5522 19.0095 16.5793 18.6873 16.3354L18.595 16.2541L12 9.52658L5.40503 16.2541C5.11283 16.5522 4.65558 16.5793 4.33337 16.3354L4.24106 16.2541C3.94886 15.956 3.9223 15.4896 4.16137 15.161L4.24106 15.0668L11.418 7.7459C11.7102 7.44784 12.1675 7.42074 12.4897 7.66461L12.582 7.7459L19.7589 15.0668C20.0804 15.3947 20.0804 15.9262 19.7589 16.2541Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconAttention.vue b/frontend/src/components/icons/IconAttention.vue
new file mode 100644
index 000000000..1d413d23f
--- /dev/null
+++ b/frontend/src/components/icons/IconAttention.vue
@@ -0,0 +1,21 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <circle cx="10.5" cy="10.5" r="10.5" />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M10.6233 14.0455C10.9904 14.0455 11.288 14.3431 11.288 14.7102C11.288 15.0774 10.9904 15.375 10.6233 15.375C10.2561 15.375 9.9585 15.0774 9.9585 14.7102C9.9585 14.3431 10.2561 14.0455 10.6233 14.0455Z"
+      fill="white"
+    />
+    <path
+      d="M9.9585 6.28977C9.9585 5.92263 10.2561 5.625 10.6233 5.625C10.9904 5.625 11.288 5.92263 11.288 6.28977V12.0511C11.288 12.4183 10.9904 12.7159 10.6233 12.7159C10.2561 12.7159 9.9585 12.4183 9.9585 12.0511V6.28977Z"
+      fill="white"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconBox.vue b/frontend/src/components/icons/IconBox.vue
new file mode 100644
index 000000000..84975ef0f
--- /dev/null
+++ b/frontend/src/components/icons/IconBox.vue
@@ -0,0 +1,19 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
+    <path
+      d="M12.0001 13.2999C11.8701 13.2999 11.7401 13.2699 11.6201 13.1999L2.79008 8.08986C2.44008 7.87986 2.31008 7.41986 2.52008 7.05986C2.73008 6.69986 3.19008 6.57986 3.55008 6.78986L12.0001 11.6799L20.4001 6.81986C20.7601 6.60986 21.2201 6.73986 21.4301 7.08986C21.6401 7.44986 21.5101 7.90986 21.1601 8.11986L12.3901 13.1999C12.2601 13.2599 12.1301 13.2999 12.0001 13.2999Z"
+    />
+    <path
+      d="M12 22.36C11.59 22.36 11.25 22.02 11.25 21.61V12.54C11.25 12.13 11.59 11.79 12 11.79C12.41 11.79 12.75 12.13 12.75 12.54V21.61C12.75 22.02 12.41 22.36 12 22.36Z"
+    />
+    <path
+      d="M11.9999 22.75C11.1199 22.75 10.2499 22.56 9.55989 22.18L4.21989 19.21C2.76989 18.41 1.63989 16.48 1.63989 14.82V9.17C1.63989 7.51 2.76989 5.59 4.21989 4.78L9.55989 1.82C10.9299 1.06 13.0699 1.06 14.4399 1.82L19.7799 4.79C21.2299 5.59 22.3599 7.52 22.3599 9.18V14.83C22.3599 16.49 21.2299 18.41 19.7799 19.22L14.4399 22.18C13.7499 22.56 12.8799 22.75 11.9999 22.75ZM11.9999 2.75C11.3699 2.75 10.7499 2.88 10.2899 3.13L4.94989 6.1C3.98989 6.63 3.13989 8.07 3.13989 9.17V14.82C3.13989 15.92 3.98989 17.36 4.94989 17.9L10.2899 20.87C11.1999 21.38 12.7999 21.38 13.7099 20.87L19.0499 17.9C20.0099 17.36 20.8599 15.93 20.8599 14.82V9.17C20.8599 8.07 20.0099 6.63 19.0499 6.09L13.7099 3.12C13.2499 2.88 12.6299 2.75 11.9999 2.75Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconChange.vue b/frontend/src/components/icons/IconChange.vue
new file mode 100644
index 000000000..adde817ba
--- /dev/null
+++ b/frontend/src/components/icons/IconChange.vue
@@ -0,0 +1,24 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.6264 0.530217C11.9193 0.237324 12.3942 0.237324 12.6871 0.530217L18.8438 6.68695C19.1367 6.97985 19.1367 7.45472 18.8438 7.74761C18.5509 8.04051 18.076 8.04051 17.7831 7.74761L12.1567 2.12121L6.53033 7.74761C6.23744 8.04051 5.76256 8.04051 5.46967 7.74761C5.17678 7.45472 5.17678 6.97985 5.46967 6.68695L11.6264 0.530217Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M12.6871 23.4698C12.3942 23.7627 11.9193 23.7627 11.6264 23.4698L5.46967 17.313C5.17678 17.0202 5.17678 16.5453 5.46967 16.2524C5.76256 15.9595 6.23744 15.9595 6.53033 16.2524L12.1567 21.8788L17.7831 16.2524C18.076 15.9595 18.5509 15.9595 18.8438 16.2524C19.1367 16.5453 19.1367 17.0202 18.8438 17.313L12.6871 23.4698Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconCheck.vue b/frontend/src/components/icons/IconCheck.vue
new file mode 100644
index 000000000..3876b964a
--- /dev/null
+++ b/frontend/src/components/icons/IconCheck.vue
@@ -0,0 +1,19 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M20.5303 5.46967C20.8232 5.76256 20.8232 6.23744 20.5303 6.53033L9.53033 17.5303C9.23744 17.8232 8.76256 17.8232 8.46967 17.5303L3.46967 12.5303C3.17678 12.2374 3.17678 11.7626 3.46967 11.4697C3.76256 11.1768 4.23744 11.1768 4.53033 11.4697L9 15.9393L19.4697 5.46967C19.7626 5.17678 20.2374 5.17678 20.5303 5.46967Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconCheckInCircle.vue b/frontend/src/components/icons/IconCheckInCircle.vue
new file mode 100644
index 000000000..bdf67ccc2
--- /dev/null
+++ b/frontend/src/components/icons/IconCheckInCircle.vue
@@ -0,0 +1,15 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M10.1969 4.01935C11.9178 3.63052 13.7184 3.80841 15.33 4.5265C15.7886 4.73085 16.326 4.52472 16.5304 4.06611C16.7347 3.6075 16.5286 3.07007 16.07 2.86572C14.1003 1.98806 11.8996 1.77063 9.79619 2.24587C7.69278 2.72111 5.79935 3.86354 4.39828 5.5028C2.99721 7.14205 2.16356 9.19029 2.02168 11.342C1.87979 13.4938 2.43727 15.6338 3.61096 17.4428C4.78465 19.2518 6.51168 20.633 8.53447 21.3803C10.5573 22.1276 12.7674 22.201 14.8354 21.5896C16.9033 20.9782 18.7182 19.7147 20.0093 17.9875C21.3005 16.2604 21.9988 14.1621 22 12.0057V12.0052V11.1688C22 10.6668 21.593 10.2597 21.0909 10.2597C20.5888 10.2597 20.1818 10.6668 20.1818 11.1688V12.0047C20.1808 13.769 19.6095 15.4858 18.5531 16.8989C17.4967 18.312 16.0118 19.3458 14.3198 19.8461C12.6279 20.3463 10.8196 20.2862 9.16457 19.6748C7.50956 19.0634 6.09654 17.9333 5.13624 16.4532C4.17595 14.9731 3.71983 13.2222 3.83592 11.4617C3.95201 9.70114 4.63408 8.02531 5.78041 6.68411C6.92674 5.3429 8.47591 4.40818 10.1969 4.01935ZM21.734 5.37499C22.0889 5.01979 22.0886 4.44419 21.7334 4.08934C21.3782 3.7345 20.8026 3.73479 20.4478 4.08999L11.9997 12.5465L9.91555 10.4624C9.56053 10.1074 8.98492 10.1074 8.6299 10.4624C8.27488 10.8174 8.27488 11.393 8.6299 11.748L11.3572 14.4753C11.5277 14.6459 11.759 14.7416 12.0002 14.7416C12.2414 14.7415 12.4727 14.6456 12.6431 14.475L21.734 5.37499Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconCheckInCircleClassic.vue b/frontend/src/components/icons/IconCheckInCircleClassic.vue
new file mode 100644
index 000000000..5263db438
--- /dev/null
+++ b/frontend/src/components/icons/IconCheckInCircleClassic.vue
@@ -0,0 +1,24 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M1.25 12C1.25 6.08579 6.08579 1.25 12 1.25C17.9142 1.25 22.75 6.08579 22.75 12C22.75 17.9142 17.9142 22.75 12 22.75C6.08579 22.75 1.25 17.9142 1.25 12ZM12 2.75C6.91421 2.75 2.75 6.91421 2.75 12C2.75 17.0858 6.91421 21.25 12 21.25C17.0858 21.25 21.25 17.0858 21.25 12C21.25 6.91421 17.0858 2.75 12 2.75Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M16.7808 8.64014C17.0734 8.93329 17.073 9.40816 16.7799 9.7008L11.1099 15.3608C10.8169 15.6532 10.3424 15.653 10.0497 15.3603L7.21967 12.5303C6.92678 12.2374 6.92678 11.7626 7.21967 11.4697C7.51256 11.1768 7.98744 11.1768 8.28033 11.4697L10.5805 13.7698L15.7201 8.6392C16.0133 8.34657 16.4882 8.34699 16.7808 8.64014Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconClose.vue b/frontend/src/components/icons/IconClose.vue
new file mode 100644
index 000000000..c69d28c00
--- /dev/null
+++ b/frontend/src/components/icons/IconClose.vue
@@ -0,0 +1,20 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M5.81282 5.81267C6.10571 5.51978 6.58058 5.51978 6.87348 5.81267L18.1872 17.1264C18.4801 17.4193 18.4801 17.8941 18.1872 18.187C17.8943 18.4799 17.4194 18.4799 17.1265 18.187L5.81282 6.87333C5.51992 6.58044 5.51992 6.10557 5.81282 5.81267Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M18.1872 5.81267C18.4801 6.10557 18.4801 6.58044 18.1872 6.87333L6.87348 18.187C6.58058 18.4799 6.10571 18.4799 5.81282 18.187C5.51992 17.8941 5.51992 17.4193 5.81282 17.1264L17.1265 5.81267C17.4194 5.51978 17.8943 5.51978 18.1872 5.81267Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconCloudConnection.vue b/frontend/src/components/icons/IconCloudConnection.vue
new file mode 100644
index 000000000..06aaba4f8
--- /dev/null
+++ b/frontend/src/components/icons/IconCloudConnection.vue
@@ -0,0 +1,39 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M17.3969 6.15408C16.9502 4.20437 15.9064 2.84038 14.5603 2.05117C13.1147 1.20368 11.3925 1.06097 9.84243 1.46704C8.29233 1.87312 6.86037 2.84211 6.01308 4.28925C5.27282 5.55358 5.01067 7.12893 5.44429 8.90397C1.31844 9.99093 1.63817 16.4148 6.31668 16.7482C6.33442 16.7494 6.3522 16.7501 6.36998 16.7501H16.0269C17.3863 16.7608 18.694 16.2502 19.6989 15.3401C22.8999 12.5346 21.4023 7.0997 17.3969 6.15408ZM6.39688 10.2602C6.48533 10.2617 6.57555 10.2475 6.66374 10.2158C7.05353 10.0757 7.2559 9.64611 7.11576 9.25632C6.48548 7.5033 6.69716 6.08963 7.30753 5.04714C7.92837 3.98677 9.00515 3.237 10.2226 2.91808C11.44 2.59915 12.7441 2.72518 13.8016 3.34519C14.8412 3.95467 15.7151 5.08355 16.0201 6.92276C16.0743 7.24963 16.3366 7.5022 16.6653 7.54404C19.796 7.94265 21.0776 12.1427 18.7064 14.2154L18.6958 14.2248C17.9622 14.891 17.0134 15.2584 16.0364 15.2501L6.39803 15.2501C3.27862 15.0036 3.29302 10.506 6.39688 10.2602Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M12 15.2501C12.4142 15.2501 12.75 15.5859 12.75 16.0001V19.0001C12.75 19.4143 12.4142 19.7501 12 19.7501C11.5858 19.7501 11.25 19.4143 11.25 19.0001V16.0001C11.25 15.5859 11.5858 15.2501 12 15.2501Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M12 19.7501C11.3096 19.7501 10.75 20.3097 10.75 21.0001C10.75 21.6904 11.3096 22.2501 12 22.2501C12.6903 22.2501 13.25 21.6904 13.25 21.0001C13.25 20.3097 12.6903 19.7501 12 19.7501ZM9.24998 21.0001C9.24998 19.4813 10.4812 18.2501 12 18.2501C13.5188 18.2501 14.75 19.4813 14.75 21.0001C14.75 22.5189 13.5188 23.7501 12 23.7501C10.4812 23.7501 9.24998 22.5189 9.24998 21.0001Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M13.25 21.0001C13.25 20.5859 13.5858 20.2501 14 20.2501H18C18.4142 20.2501 18.75 20.5859 18.75 21.0001C18.75 21.4143 18.4142 21.7501 18 21.7501H14C13.5858 21.7501 13.25 21.4143 13.25 21.0001Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M5.24998 21.0001C5.24998 20.5859 5.58577 20.2501 5.99998 20.2501H9.99998C10.4142 20.2501 10.75 20.5859 10.75 21.0001C10.75 21.4143 10.4142 21.7501 9.99998 21.7501H5.99998C5.58577 21.7501 5.24998 21.4143 5.24998 21.0001Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconClusters.vue b/frontend/src/components/icons/IconClusters.vue
new file mode 100644
index 000000000..49a105966
--- /dev/null
+++ b/frontend/src/components/icons/IconClusters.vue
@@ -0,0 +1,34 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M6.25 3.5C3.5 3.5 3.5 3.708 3.5 6.25V6.275C3.5 7.382 3.5 8.182 3.771 8.52C4.036 8.848 4.823 9 6.25 9C7.677 9 8.464 8.847 8.729 8.519C9 8.182 9 7.382 9 6.274C9 3.708 9 3.5 6.25 3.5ZM6.25 10.5C4.564 10.5 3.299 10.323 2.604 9.46C2 8.711 2 7.689 2 6.275L2.75 6.25H2C2 3.38 2.181 2 6.25 2C10.319 2 10.5 3.38 10.5 6.25C10.5 7.688 10.5 8.711 9.896 9.46C9.201 10.323 7.936 10.5 6.25 10.5Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M17.25 3.5C14.5 3.5 14.5 3.708 14.5 6.25V6.275C14.5 7.382 14.5 8.182 14.771 8.52C15.036 8.848 15.823 9 17.25 9C18.677 9 19.464 8.847 19.729 8.519C20 8.182 20 7.382 20 6.274C20 3.708 20 3.5 17.25 3.5ZM17.25 10.5C15.564 10.5 14.299 10.323 13.604 9.46C13 8.711 13 7.689 13 6.275L13.75 6.25H13C13 3.38 13.181 2 17.25 2C21.319 2 21.5 3.38 21.5 6.25C21.5 7.688 21.5 8.711 20.896 9.46C20.201 10.323 18.936 10.5 17.25 10.5Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M6.25 14.5C3.5 14.5 3.5 14.708 3.5 17.25V17.275C3.5 18.382 3.5 19.182 3.771 19.52C4.036 19.848 4.823 20 6.25 20C7.677 20 8.464 19.847 8.729 19.519C9 19.182 9 18.382 9 17.274C9 14.708 9 14.5 6.25 14.5ZM6.25 21.5C4.564 21.5 3.299 21.323 2.604 20.46C2 19.711 2 18.689 2 17.275L2.75 17.25H2C2 14.38 2.181 13 6.25 13C10.319 13 10.5 14.38 10.5 17.25C10.5 18.688 10.5 19.711 9.896 20.46C9.201 21.323 7.936 21.5 6.25 21.5Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M17.25 14.5C14.5 14.5 14.5 14.708 14.5 17.25V17.275C14.5 18.382 14.5 19.182 14.771 19.52C15.036 19.848 15.823 20 17.25 20C18.677 20 19.464 19.847 19.729 19.519C20 19.182 20 18.382 20 17.274C20 14.708 20 14.5 17.25 14.5ZM17.25 21.5C15.564 21.5 14.299 21.323 13.604 20.46C13 19.711 13 18.689 13 17.275L13.75 17.25H13C13 14.38 13.181 13 17.25 13C21.319 13 21.5 14.38 21.5 17.25C21.5 18.688 21.5 19.711 20.896 20.46C20.201 21.323 18.936 21.5 17.25 21.5Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconClustersBig.vue b/frontend/src/components/icons/IconClustersBig.vue
new file mode 100644
index 000000000..0a2512c0a
--- /dev/null
+++ b/frontend/src/components/icons/IconClustersBig.vue
@@ -0,0 +1,51 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    width="51"
+    height="50"
+    viewBox="0 0 51 50"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <rect
+      x="11.3164"
+      width="40"
+      height="40"
+      rx="4"
+      transform="rotate(12 11.3164 0)"
+      fill="#15161E"
+    />
+    <rect y="10" width="40" height="40" rx="4" fill="#191B24" />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M16.1673 24.333C14.334 24.333 14.334 24.4717 14.334 26.1663V26.183C14.334 26.921 14.334 27.4543 14.5147 27.6797C14.6913 27.8983 15.216 27.9997 16.1673 27.9997C17.1187 27.9997 17.6433 27.8977 17.82 27.679C18.0007 27.4543 18.0007 26.921 18.0007 26.1823C18.0007 24.4717 18.0007 24.333 16.1673 24.333ZM16.1673 28.9997C15.0433 28.9997 14.2 28.8817 13.7367 28.3063C13.334 27.807 13.334 27.1257 13.334 26.183L13.834 26.1663H13.334C13.334 24.253 13.4547 23.333 16.1673 23.333C18.88 23.333 19.0007 24.253 19.0007 26.1663C19.0007 27.125 19.0007 27.807 18.598 28.3063C18.1347 28.8817 17.2913 28.9997 16.1673 28.9997Z"
+      fill="#9FA1A6"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M23.5007 24.333C21.6673 24.333 21.6673 24.4717 21.6673 26.1663V26.183C21.6673 26.921 21.6673 27.4543 21.848 27.6797C22.0247 27.8983 22.5493 27.9997 23.5007 27.9997C24.452 27.9997 24.9767 27.8977 25.1533 27.679C25.334 27.4543 25.334 26.921 25.334 26.1823C25.334 24.4717 25.334 24.333 23.5007 24.333ZM23.5007 28.9997C22.3767 28.9997 21.5333 28.8817 21.07 28.3063C20.6673 27.807 20.6673 27.1257 20.6673 26.183L21.1673 26.1663H20.6673C20.6673 24.253 20.788 23.333 23.5007 23.333C26.2133 23.333 26.334 24.253 26.334 26.1663C26.334 27.125 26.334 27.807 25.9313 28.3063C25.468 28.8817 24.6247 28.9997 23.5007 28.9997Z"
+      fill="#9FA1A6"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M16.1673 31.6663C14.334 31.6663 14.334 31.805 14.334 33.4997V33.5163C14.334 34.2543 14.334 34.7877 14.5147 35.013C14.6913 35.2317 15.216 35.333 16.1673 35.333C17.1187 35.333 17.6433 35.231 17.82 35.0123C18.0007 34.7877 18.0007 34.2543 18.0007 33.5157C18.0007 31.805 18.0007 31.6663 16.1673 31.6663ZM16.1673 36.333C15.0433 36.333 14.2 36.215 13.7367 35.6397C13.334 35.1403 13.334 34.459 13.334 33.5163L13.834 33.4997H13.334C13.334 31.5863 13.4547 30.6663 16.1673 30.6663C18.88 30.6663 19.0007 31.5863 19.0007 33.4997C19.0007 34.4583 19.0007 35.1403 18.598 35.6397C18.1347 36.215 17.2913 36.333 16.1673 36.333Z"
+      fill="#9FA1A6"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M23.5007 31.6663C21.6673 31.6663 21.6673 31.805 21.6673 33.4997V33.5163C21.6673 34.2543 21.6673 34.7877 21.848 35.013C22.0247 35.2317 22.5493 35.333 23.5007 35.333C24.452 35.333 24.9767 35.231 25.1533 35.0123C25.334 34.7877 25.334 34.2543 25.334 33.5157C25.334 31.805 25.334 31.6663 23.5007 31.6663ZM23.5007 36.333C22.3767 36.333 21.5333 36.215 21.07 35.6397C20.6673 35.1403 20.6673 34.459 20.6673 33.5163L21.1673 33.4997H20.6673C20.6673 31.5863 20.788 30.6663 23.5007 30.6663C26.2133 30.6663 26.334 31.5863 26.334 33.4997C26.334 34.4583 26.334 35.1403 25.9313 35.6397C25.468 36.215 24.6247 36.333 23.5007 36.333Z"
+      fill="#9FA1A6"
+    />
+  </svg>
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconComplete.vue b/frontend/src/components/icons/IconComplete.vue
new file mode 100644
index 000000000..692714201
--- /dev/null
+++ b/frontend/src/components/icons/IconComplete.vue
@@ -0,0 +1,15 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">
+<circle cx="10.5" cy="10.5" r="10.5"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M15.1204 6.96274C15.2791 7.12139 15.2791 7.37861 15.1204 7.53726L9.1621 13.4956C9.00345 13.6542 8.74623 13.6542 8.58757 13.4956L5.87924 10.7873C5.72059 10.6286 5.72059 10.3714 5.87924 10.2127C6.03789 10.0541 6.29512 10.0541 6.45377 10.2127L8.87484 12.6338L14.5459 6.96274C14.7046 6.80409 14.9618 6.80409 15.1204 6.96274Z" fill="white"/>
+</svg>
+
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconCopy.vue b/frontend/src/components/icons/IconCopy.vue
new file mode 100644
index 000000000..e4089db4b
--- /dev/null
+++ b/frontend/src/components/icons/IconCopy.vue
@@ -0,0 +1,24 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M3.66783 9.66783C3.0898 10.2459 2.75 11.224 2.75 12.9V17.1C2.75 18.776 3.0898 19.7541 3.66783 20.3322C4.24586 20.9102 5.22397 21.25 6.9 21.25H11.1C12.776 21.25 13.7541 20.9102 14.3322 20.3322C14.9102 19.7541 15.25 18.776 15.25 17.1V12.9C15.25 11.224 14.9102 10.2459 14.3322 9.66783C13.7541 9.0898 12.776 8.75 11.1 8.75H6.9C5.22397 8.75 4.24586 9.0898 3.66783 9.66783ZM2.60717 8.60717C3.60414 7.6102 5.07603 7.25 6.9 7.25H11.1C12.924 7.25 14.3959 7.6102 15.3928 8.60717C16.3898 9.60414 16.75 11.076 16.75 12.9V17.1C16.75 18.924 16.3898 20.3959 15.3928 21.3928C14.3959 22.3898 12.924 22.75 11.1 22.75H6.9C5.07603 22.75 3.60414 22.3898 2.60717 21.3928C1.6102 20.3959 1.25 18.924 1.25 17.1V12.9C1.25 11.076 1.6102 9.60414 2.60717 8.60717Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M9.66783 3.66783C9.0898 4.24586 8.75 5.22397 8.75 6.9V7.25H11.1C12.924 7.25 14.3959 7.6102 15.3928 8.60717C16.3898 9.60414 16.75 11.076 16.75 12.9V15.25H17.1C18.776 15.25 19.7541 14.9102 20.3322 14.3322C20.9102 13.7541 21.25 12.776 21.25 11.1V6.9C21.25 5.22397 20.9102 4.24586 20.3322 3.66783C19.7541 3.0898 18.776 2.75 17.1 2.75H12.9C11.224 2.75 10.2459 3.0898 9.66783 3.66783ZM8.60717 2.60717C9.60414 1.6102 11.076 1.25 12.9 1.25H17.1C18.924 1.25 20.3959 1.6102 21.3928 2.60717C22.3898 3.60414 22.75 5.07603 22.75 6.9V11.1C22.75 12.924 22.3898 14.3959 21.3928 15.3928C20.3959 16.3898 18.924 16.75 17.1 16.75H16C15.5858 16.75 15.25 16.4142 15.25 16V12.9C15.25 11.224 14.9102 10.2459 14.3322 9.66783C13.7541 9.0898 12.776 8.75 11.1 8.75H8C7.58579 8.75 7.25 8.41421 7.25 8V6.9C7.25 5.07603 7.6102 3.60414 8.60717 2.60717Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconDashboard.vue b/frontend/src/components/icons/IconDashboard.vue
new file mode 100644
index 000000000..9e92840a6
--- /dev/null
+++ b/frontend/src/components/icons/IconDashboard.vue
@@ -0,0 +1,23 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M15 22.75H9C3.57 22.75 1.25 20.43 1.25 15V9C1.25 3.57 3.57 1.25 9 1.25H15C20.43 1.25 22.75 3.57 22.75 9V15C22.75 20.43 20.43 22.75 15 22.75ZM9 2.75C4.39 2.75 2.75 4.39 2.75 9V15C2.75 19.61 4.39 21.25 9 21.25H15C19.61 21.25 21.25 19.61 21.25 15V9C21.25 4.39 19.61 2.75 15 2.75H9Z"
+    />
+    <path
+      d="M15.5 19.25C13.98 19.25 12.75 18.02 12.75 16.5V7.5C12.75 5.98 13.98 4.75 15.5 4.75C17.02 4.75 18.25 5.98 18.25 7.5V16.5C18.25 18.02 17.02 19.25 15.5 19.25ZM15.5 6.25C14.81 6.25 14.25 6.81 14.25 7.5V16.5C14.25 17.19 14.81 17.75 15.5 17.75C16.19 17.75 16.75 17.19 16.75 16.5V7.5C16.75 6.81 16.19 6.25 15.5 6.25Z"
+    />
+    <path
+      d="M8.5 19.25C6.98 19.25 5.75 18.02 5.75 16.5V13C5.75 11.48 6.98 10.25 8.5 10.25C10.02 10.25 11.25 11.48 11.25 13V16.5C11.25 18.02 10.02 19.25 8.5 19.25ZM8.5 11.75C7.81 11.75 7.25 12.31 7.25 13V16.5C7.25 17.19 7.81 17.75 8.5 17.75C9.19 17.75 9.75 17.19 9.75 16.5V13C9.75 12.31 9.19 11.75 8.5 11.75Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconDelete.vue b/frontend/src/components/icons/IconDelete.vue
new file mode 100644
index 000000000..d3a6675c6
--- /dev/null
+++ b/frontend/src/components/icons/IconDelete.vue
@@ -0,0 +1,39 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M4.96578 5.03369C6.97033 4.83124 8.97512 4.73 10.9801 4.73C14.3454 4.73 17.7201 4.90129 21.074 5.23366C21.4862 5.2745 21.7872 5.64177 21.7464 6.05396C21.7055 6.46616 21.3383 6.76719 20.9261 6.72634C17.62 6.39871 14.2947 6.23 10.9801 6.23C9.02535 6.23 7.07051 6.32872 5.11543 6.5262L5.11323 6.52642L3.07323 6.72642C2.661 6.76684 2.29405 6.46542 2.25363 6.05318C2.21322 5.64094 2.51464 5.27399 2.92688 5.23358L4.96578 5.03369Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M9.45964 3.78456L9.2397 5.09421C9.17109 5.50271 8.78433 5.77824 8.37584 5.70964C7.96735 5.64104 7.69181 5.25428 7.76041 4.84578L7.98041 3.53579C7.98426 3.51297 7.98821 3.48908 7.99222 3.46487C8.06108 3.04899 8.16209 2.43887 8.56879 1.97769C9.04285 1.44012 9.76615 1.25 10.6901 1.25H13.3101C14.2452 1.25 14.9678 1.4554 15.439 1.99845C15.8463 2.46776 15.9448 3.08006 16.0105 3.48891C16.0137 3.5088 16.0168 3.52822 16.0199 3.54711L16.2395 4.84486C16.3087 5.25326 16.0336 5.64037 15.6252 5.70949C15.2168 5.7786 14.8297 5.50355 14.7606 5.09514L14.5398 3.79069C14.4562 3.27767 14.4033 3.09352 14.3061 2.98155C14.2523 2.9196 14.0649 2.75 13.3101 2.75H10.6901C9.92396 2.75 9.74226 2.91488 9.69382 2.96981C9.6017 3.07427 9.54972 3.24976 9.45964 3.78456Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M18.8984 8.39156C19.3117 8.41824 19.6252 8.77496 19.5985 9.18831L18.9482 19.2624L18.9469 19.2814C18.9205 19.6577 18.8916 20.0714 18.814 20.4564C18.7337 20.8555 18.592 21.2768 18.3049 21.6506C17.7037 22.4333 16.6806 22.75 15.2101 22.75H8.79005C7.31949 22.75 6.29643 22.4333 5.69526 21.6506C5.40815 21.2768 5.26646 20.8555 5.18607 20.4564C5.10854 20.0714 5.07957 19.6577 5.05322 19.2814L5.0516 19.2583L4.40161 9.18831C4.37493 8.77496 4.68839 8.41824 5.10174 8.39156C5.5151 8.36488 5.87182 8.67834 5.8985 9.09169L6.54822 19.1576L6.54836 19.1596C6.57659 19.5624 6.60047 19.8818 6.65654 20.1602C6.71115 20.4313 6.78696 20.6094 6.88485 20.7369C7.05368 20.9567 7.47062 21.25 8.79005 21.25H15.2101C16.5295 21.25 16.9464 20.9567 17.1153 20.7369C17.2132 20.6094 17.289 20.4313 17.3436 20.1602C17.3996 19.8818 17.4235 19.5624 17.4517 19.1596L17.4519 19.1576L18.1016 9.09169C18.1283 8.67834 18.485 8.36488 18.8984 8.39156Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M9.58005 16.5C9.58005 16.0858 9.91584 15.75 10.3301 15.75H13.6601C14.0743 15.75 14.4101 16.0858 14.4101 16.5C14.4101 16.9142 14.0743 17.25 13.6601 17.25H10.3301C9.91584 17.25 9.58005 16.9142 9.58005 16.5Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M8.75005 12.5C8.75005 12.0858 9.08584 11.75 9.50005 11.75H14.5001C14.9143 11.75 15.2501 12.0858 15.2501 12.5C15.2501 12.9142 14.9143 13.25 14.5001 13.25H9.50005C9.08584 13.25 8.75005 12.9142 8.75005 12.5Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconDot.vue b/frontend/src/components/icons/IconDot.vue
new file mode 100644
index 000000000..7ec9f50ab
--- /dev/null
+++ b/frontend/src/components/icons/IconDot.vue
@@ -0,0 +1,15 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <circle cx="12" cy="12" r="6" />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconDropRight.vue b/frontend/src/components/icons/IconDropRight.vue
new file mode 100644
index 000000000..e478754d7
--- /dev/null
+++ b/frontend/src/components/icons/IconDropRight.vue
@@ -0,0 +1,15 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg w viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M9.70703 14.8789C9.70703 15.7698 10.7842 16.2159 11.4141 15.586L13.9999 13.0002C14.3904 12.6096 14.3904 11.9765 13.9999 11.586L11.4141 9.00017C10.7842 8.37021 9.70703 8.81638 9.70703 9.70728L9.70703 14.8789Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconDropUp.vue b/frontend/src/components/icons/IconDropUp.vue
new file mode 100644
index 000000000..d97a7a561
--- /dev/null
+++ b/frontend/src/components/icons/IconDropUp.vue
@@ -0,0 +1,19 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M14.5856 14.5859C15.4765 14.5859 15.9227 13.5088 15.2927 12.8788L12.707 10.293C12.3164 9.90252 11.6833 9.90252 11.2927 10.293L8.70696 12.8788C8.077 13.5088 8.52316 14.5859 9.41407 14.5859L14.5856 14.5859Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconDropdown.vue b/frontend/src/components/icons/IconDropdown.vue
new file mode 100644
index 000000000..d356dfd8c
--- /dev/null
+++ b/frontend/src/components/icons/IconDropdown.vue
@@ -0,0 +1,19 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M9.41411 10C8.52321 10 8.07704 11.0771 8.70701 11.7071L11.2928 14.2929C11.6833 14.6834 12.3165 14.6834 12.707 14.2929L15.2928 11.7071C15.9228 11.0771 15.4766 10 14.5857 10H9.41411Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconEdit.vue b/frontend/src/components/icons/IconEdit.vue
new file mode 100644
index 000000000..2d2a8b6a1
--- /dev/null
+++ b/frontend/src/components/icons/IconEdit.vue
@@ -0,0 +1,23 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M5.53999 19.5201C4.92999 19.5201 4.35999 19.31 3.94999 18.92C3.42999 18.43 3.17999 17.69 3.26999 16.89L3.63999 13.65C3.70999 13.04 4.07999 12.23 4.50999 11.79L12.72 3.10005C14.77 0.930049 16.91 0.870049 19.08 2.92005C21.25 4.97005 21.31 7.11005 19.26 9.28005L11.05 17.97C10.63 18.42 9.84999 18.84 9.23999 18.9401L6.01999 19.49C5.84999 19.5 5.69999 19.5201 5.53999 19.5201ZM15.93 2.91005C15.16 2.91005 14.49 3.39005 13.81 4.11005L5.59999 12.8101C5.39999 13.0201 5.16999 13.5201 5.12999 13.8101L4.75999 17.05C4.71999 17.38 4.79999 17.65 4.97999 17.82C5.15999 17.99 5.42999 18.05 5.75999 18L8.97999 17.4501C9.26999 17.4001 9.74999 17.14 9.94999 16.93L18.16 8.24005C19.4 6.92005 19.85 5.70005 18.04 4.00005C17.24 3.23005 16.55 2.91005 15.93 2.91005Z"
+    />
+    <path
+      d="M17.34 10.9498C17.32 10.9498 17.29 10.9498 17.27 10.9498C14.15 10.6398 11.64 8.26985 11.16 5.16985C11.1 4.75985 11.38 4.37985 11.79 4.30985C12.2 4.24985 12.58 4.52985 12.65 4.93985C13.03 7.35985 14.99 9.21985 17.43 9.45985C17.84 9.49985 18.14 9.86985 18.1 10.2798C18.05 10.6598 17.72 10.9498 17.34 10.9498Z"
+    />
+    <path
+      d="M21 22.75H3C2.59 22.75 2.25 22.41 2.25 22C2.25 21.59 2.59 21.25 3 21.25H21C21.41 21.25 21.75 21.59 21.75 22C21.75 22.41 21.41 22.75 21 22.75Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconError.vue b/frontend/src/components/icons/IconError.vue
new file mode 100644
index 000000000..6fa35d861
--- /dev/null
+++ b/frontend/src/components/icons/IconError.vue
@@ -0,0 +1,29 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M1.25 12C1.25 6.08579 6.08579 1.25 12 1.25C17.9142 1.25 22.75 6.08579 22.75 12C22.75 17.9142 17.9142 22.75 12 22.75C6.08579 22.75 1.25 17.9142 1.25 12ZM12 2.75C6.91421 2.75 2.75 6.91421 2.75 12C2.75 17.0858 6.91421 21.25 12 21.25C17.0858 21.25 21.25 17.0858 21.25 12C21.25 6.91421 17.0858 2.75 12 2.75Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M15.3603 8.63967C15.6532 8.93256 15.6532 9.40744 15.3603 9.70033L9.70033 15.3603C9.40744 15.6532 8.93256 15.6532 8.63967 15.3603C8.34678 15.0674 8.34678 14.5926 8.63967 14.2997L14.2997 8.63967C14.5926 8.34678 15.0674 8.34678 15.3603 8.63967Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M8.63967 8.63967C8.93256 8.34678 9.40744 8.34678 9.70033 8.63967L15.3603 14.2997C15.6532 14.5926 15.6532 15.0674 15.3603 15.3603C15.0674 15.6532 14.5926 15.6532 14.2997 15.3603L8.63967 9.70033C8.34678 9.40744 8.34678 8.93256 8.63967 8.63967Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconExternalLink.vue b/frontend/src/components/icons/IconExternalLink.vue
new file mode 100644
index 000000000..68f6427e2
--- /dev/null
+++ b/frontend/src/components/icons/IconExternalLink.vue
@@ -0,0 +1,22 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg">
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M12.3595 3.63881C12.4533 3.73258 12.506 3.85975 12.506 3.99236L12.506 9.71521C12.506 9.99135 12.2821 10.2152 12.006 10.2152C11.7298 10.2152 11.506 9.99135 11.506 9.71521L11.506 4.49236L6.28311 4.49236C6.00696 4.49236 5.78311 4.2685 5.78311 3.99236C5.78311 3.71622 6.00696 3.49236 6.28311 3.49236L12.006 3.49236C12.1386 3.49236 12.2657 3.54504 12.3595 3.63881Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M12.2794 3.719C12.4746 3.91426 12.4746 4.23084 12.2794 4.42611L4.34565 12.3598C4.15038 12.5551 3.8338 12.5551 3.63854 12.3598C3.44328 12.1646 3.44328 11.848 3.63854 11.6527L11.5723 3.719C11.7675 3.52374 12.0841 3.52374 12.2794 3.719Z"
+    />
+  </svg>
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconFailAuth.vue b/frontend/src/components/icons/IconFailAuth.vue
new file mode 100644
index 000000000..b62a290b0
--- /dev/null
+++ b/frontend/src/components/icons/IconFailAuth.vue
@@ -0,0 +1,51 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    width="77"
+    height="77"
+    viewBox="0 0 77 77"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <rect
+      x="13.7676"
+      width="64"
+      height="64"
+      rx="4"
+      transform="rotate(11.5079 13.7676 0)"
+      fill="#15161E"
+    />
+    <rect y="13" width="64" height="64" rx="4" fill="#191B24" />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M29.7025 51.7975C29.4325 51.5276 29.4325 51.0899 29.7025 50.8199L33.2873 47.2352C33.5573 46.9653 33.995 46.9653 34.2649 47.2352C34.5349 47.5052 34.5349 47.9429 34.2649 48.2129L30.6802 51.7975C30.4102 52.0675 29.9725 52.0675 29.7025 51.7975Z"
+      fill="#9FA1A6"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M29.7351 47.2025C30.005 46.9325 30.4427 46.9325 30.7127 47.2025L34.2975 50.7871C34.5675 51.0571 34.5675 51.4948 34.2975 51.7648C34.0275 52.0347 33.5898 52.0347 33.3198 51.7648L29.7351 48.1801C29.4651 47.9101 29.4651 47.4724 29.7351 47.2025Z"
+      fill="#9FA1A6"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M27.7091 37.2292C27.0003 38.1091 26.75 39.3899 26.75 41V43C26.75 43.4142 26.4142 43.75 26 43.75C25.5858 43.75 25.25 43.4142 25.25 43V41C25.25 39.3001 25.4997 37.5809 26.5409 36.2883C27.6104 34.9606 29.3716 34.25 32 34.25C34.6284 34.25 36.3896 34.9606 37.4591 36.2883C38.5003 37.5809 38.75 39.3001 38.75 41V43C38.75 43.4142 38.4142 43.75 38 43.75C37.5858 43.75 37.25 43.4142 37.25 43V41C37.25 39.3899 36.9997 38.1091 36.2909 37.2292C35.6104 36.3844 34.3716 35.75 32 35.75C29.6284 35.75 28.3896 36.3844 27.7091 37.2292Z"
+      fill="#9FA1A6"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M23.5303 44.5303C23.0188 45.0418 22.75 45.9946 22.75 48V50C22.75 52.0054 23.0188 52.9582 23.5303 53.4697C24.0418 53.9812 24.9946 54.25 27 54.25H37C39.0054 54.25 39.9582 53.9812 40.4697 53.4697C40.9812 52.9582 41.25 52.0054 41.25 50V48C41.25 45.9946 40.9812 45.0418 40.4697 44.5303C39.9582 44.0188 39.0054 43.75 37 43.75H27C24.9946 43.75 24.0418 44.0188 23.5303 44.5303ZM22.4697 43.4697C23.4582 42.4812 25.0054 42.25 27 42.25H37C38.9946 42.25 40.5418 42.4812 41.5303 43.4697C42.5188 44.4582 42.75 46.0054 42.75 48V50C42.75 51.9946 42.5188 53.5418 41.5303 54.5303C40.5418 55.5188 38.9946 55.75 37 55.75H27C25.0054 55.75 23.4582 55.5188 22.4697 54.5303C21.4812 53.5418 21.25 51.9946 21.25 50V48C21.25 46.0054 21.4812 44.4582 22.4697 43.4697Z"
+      fill="#9FA1A6"
+    />
+  </svg>
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconGCP.vue b/frontend/src/components/icons/IconGCP.vue
new file mode 100644
index 000000000..3254fa624
--- /dev/null
+++ b/frontend/src/components/icons/IconGCP.vue
@@ -0,0 +1,34 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    width="60"
+    height="60"
+    viewBox="0 0 60 60"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M35.1106 23.2263H36.2694L39.5724 19.9233L39.7343 18.5205C33.5868 13.0938 24.2048 13.68 18.7781 19.8275C17.2704 21.5338 16.1777 23.5662 15.5801 25.7651C15.9473 25.6146 16.3556 25.5895 16.7389 25.6967L23.3448 24.6064C23.3448 24.6064 23.6802 24.0498 23.8558 24.084C26.7938 20.8563 31.7392 20.4799 35.1334 23.2263H35.1106Z"
+      fill="#EA4335"
+    />
+    <path
+      d="M44.2808 25.7652C43.5212 22.9686 41.9632 20.4548 39.7962 18.5342L35.1611 23.1693C37.1182 24.7683 38.2337 27.1794 38.1858 29.7068V30.5303C40.4646 30.5303 42.3122 32.378 42.3122 34.6568C42.3122 36.9355 40.4646 38.7832 38.1858 38.7832H29.9328L29.1094 39.6181V44.568L29.9328 45.3915H38.1858C44.112 45.4371 48.9547 40.6697 49.0003 34.7434C49.0277 31.1439 47.2553 27.7771 44.2808 25.7652Z"
+      fill="#4285F4"
+    />
+    <path
+      d="M21.6677 45.3381H29.9206V38.7322H21.6677C21.0792 38.7322 20.4998 38.6044 19.9637 38.3604L18.8049 38.7208L15.4791 42.0237L15.1895 43.1825C17.0531 44.5922 19.3296 45.3495 21.6677 45.3381Z"
+      fill="#34A853"
+    />
+    <path
+      d="M21.6687 23.9112C15.7402 23.9454 10.966 28.779 11.0002 34.7075C11.0207 38.0173 12.565 41.1333 15.1905 43.1498L19.9762 38.3641C17.9004 37.4266 16.9766 34.9812 17.9141 32.9055C18.8516 30.8297 21.2969 29.9059 23.3727 30.8434C24.2874 31.2563 25.0196 31.9908 25.4348 32.9055L30.2205 28.1198C28.1858 25.4555 25.0196 23.8975 21.6687 23.9112Z"
+      fill="#FBBC05"
+    />
+  </svg>
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconHeaderDropdownLoading.vue b/frontend/src/components/icons/IconHeaderDropdownLoading.vue
new file mode 100644
index 000000000..75d7f530a
--- /dev/null
+++ b/frontend/src/components/icons/IconHeaderDropdownLoading.vue
@@ -0,0 +1,65 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    class="icon"
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+    :active="active"
+  >
+    <path
+      d="M7 12C7 13.1046 6.10457 14 5 14C3.89543 14 3 13.1046 3 12C3 10.8954 3.89543 10 5 10C6.10457 10 7 10.8954 7 12Z"
+    />
+    <path
+      d="M14 12C14 13.1046 13.1046 14 12 14C10.8954 14 10 13.1046 10 12C10 10.8954 10.8954 10 12 10C13.1046 10 14 10.8954 14 12Z"
+    />
+    <path
+      d="M21 12C21 13.1046 20.1046 14 19 14C17.8954 14 17 13.1046 17 12C17 10.8954 17.8954 10 19 10C20.1046 10 21 10.8954 21 12Z"
+    />
+  </svg>
+</template>
+
+<script setup lang="ts">
+type Props = {
+  active: boolean;
+};
+
+defineProps<Props>();
+</script>
+
+<style scoped>
+.icon {
+  @apply flex justify-center items-center fill-current transition-transform;
+  width: 16px;
+  height: 16px;
+}
+
+.icon[active=true] path:nth-child(1) {
+  animation: loadingDots 2s ease-in-out infinite;
+  animation-delay: 0s;
+}
+.icon[active=true] path:nth-child(2) {
+  animation: loadingDots 2s ease-in-out infinite;
+  animation-delay: 0.2s;
+}
+.icon[active=true] path:nth-child(3) {
+  animation: loadingDots 2s ease-in-out infinite;
+  animation-delay: 0.4s;
+}
+@keyframes loadingDots {
+  0% {
+    transform: translateY(0);
+  }
+  15% {
+    transform: translateY(-5px);
+  }
+  35% {
+    transform: translateY(0);
+  }
+}
+</style>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconHeaderLogo.vue b/frontend/src/components/icons/IconHeaderLogo.vue
new file mode 100644
index 000000000..951228e65
--- /dev/null
+++ b/frontend/src/components/icons/IconHeaderLogo.vue
@@ -0,0 +1,42 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+<svg width="87" height="26" viewBox="0 0 87 26" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M38.8431 10.0654C38.4015 9.82397 37.9493 9.62452 37.4866 9.46707C37.0344 9.30961 36.6086 9.23088 36.209 9.23088C35.7147 9.23088 35.3256 9.3306 35.0417 9.53005C34.7578 9.72949 34.6158 10.0287 34.6158 10.4275C34.6158 10.7005 34.721 10.9472 34.9313 11.1676C35.1521 11.3775 35.4308 11.5665 35.7673 11.7344C36.1143 11.9024 36.4718 12.0546 36.8399 12.1911C37.2921 12.359 37.7285 12.5742 38.1491 12.8366C38.5697 13.0885 38.9168 13.4402 39.1902 13.8916C39.4636 14.3325 39.6003 14.9203 39.6003 15.6551C39.6003 16.2429 39.4478 16.7888 39.1428 17.2926C38.8379 17.7965 38.391 18.2059 37.8021 18.5208C37.2132 18.8252 36.4876 18.9774 35.6253 18.9774C34.9628 18.9774 34.2846 18.8777 33.5905 18.6782C32.907 18.4788 32.2603 18.1639 31.6504 17.7335L32.6599 15.9542C33.0595 16.2482 33.5169 16.4896 34.0322 16.6785C34.5475 16.8675 35.0102 16.962 35.4203 16.962C35.6937 16.962 35.9671 16.9252 36.2405 16.8517C36.5244 16.7678 36.7558 16.6313 36.9345 16.4424C37.1238 16.2534 37.2185 15.991 37.2185 15.6551C37.2185 15.3087 37.0502 15.0095 36.7137 14.7576C36.3877 14.4952 35.9934 14.2747 35.5307 14.0963C35.1732 13.9598 34.8051 13.8024 34.4265 13.6239C34.048 13.4454 33.6904 13.2303 33.3539 12.9783C33.0279 12.7159 32.7598 12.3957 32.5495 12.0179C32.3497 11.6295 32.2498 11.1571 32.2498 10.6007C32.2498 9.92894 32.397 9.34635 32.6914 8.85299C32.9964 8.35963 33.4223 7.97123 33.9691 7.68781C34.5159 7.3939 35.1469 7.23119 35.8619 7.1997C36.7978 7.1997 37.555 7.30992 38.1333 7.53036C38.7222 7.7508 39.248 8.01322 39.7107 8.31764L38.8431 10.0654ZM41.3467 7.26268H43.6339V18.8514H41.3467V7.26268ZM45.9747 18.8514V7.26268H48.6255C49.7927 7.26268 50.7865 7.43589 51.6068 7.78229C52.427 8.12869 53.0842 8.59056 53.5784 9.1679C54.0832 9.74524 54.4512 10.3908 54.6826 11.1046C54.9139 11.8184 55.0296 12.5375 55.0296 13.2618C55.0296 14.1225 54.8719 14.8993 54.5564 15.5921C54.2515 16.2744 53.8308 16.8622 53.2945 17.3556C52.7582 17.8385 52.1378 18.2111 51.4332 18.4735C50.7286 18.7255 49.982 18.8514 49.1933 18.8514H45.9747ZM48.2618 16.6471H48.799C49.9557 16.6471 50.8864 16.3479 51.591 15.7496C52.306 15.1512 52.6636 14.2695 52.6636 13.1043C52.6636 12.3485 52.5374 11.7344 52.285 11.2621C52.0432 10.7792 51.7382 10.4066 51.3701 10.1441C51.0126 9.8817 50.6445 9.70325 50.266 9.60878C49.8874 9.50381 49.5667 9.45132 49.3038 9.45132H48.2618V16.6471ZM56.8309 7.26268H63.6539V9.46707H59.1181V11.9391H63.0072V14.1435H59.1181V16.6471H63.8747V18.8514H56.8309V7.26268ZM69.0459 7.26268C70.5076 7.26268 71.6275 7.61958 72.4057 8.33338C73.1943 9.03669 73.5887 9.98142 73.5887 11.1676C73.5887 11.8289 73.4467 12.4797 73.1628 13.12C72.8894 13.7604 72.4214 14.2695 71.7589 14.6474L74.4562 18.8514H71.7905L69.3456 15.167H68.0346V18.8514H65.7475V7.26268H69.0459ZM69.4402 12.9626C69.9029 12.9626 70.2605 12.8681 70.5128 12.6792C70.7757 12.4797 70.9597 12.2488 71.0649 11.9864C71.1701 11.7134 71.2226 11.4668 71.2226 11.2463C71.2226 11.1204 71.2016 10.9629 71.1595 10.7739C71.128 10.5745 71.0544 10.3751 70.9387 10.1756C70.823 9.97617 70.6443 9.80822 70.4024 9.67176C70.1711 9.5353 69.8556 9.46707 69.456 9.46707H68.0346V12.9626H69.4402ZM75.067 13.0728C75.067 12.275 75.2195 11.5192 75.5245 10.8054C75.8294 10.0916 76.25 9.46182 76.7864 8.91597C77.3332 8.35963 77.9641 7.924 78.6792 7.60909C79.3942 7.29417 80.1619 7.13672 80.9821 7.13672C81.7918 7.13672 82.5542 7.29417 83.2693 7.60909C83.9844 7.924 84.6153 8.35963 85.1621 8.91597C85.7195 9.46182 86.1506 10.0916 86.4556 10.8054C86.771 11.5192 86.9288 12.275 86.9288 13.0728C86.9288 13.8916 86.771 14.6579 86.4556 15.3717C86.1506 16.0855 85.7195 16.7153 85.1621 17.2611C84.6153 17.7965 83.9844 18.2164 83.2693 18.5208C82.5542 18.8252 81.7918 18.9774 80.9821 18.9774C80.1619 18.9774 79.3942 18.8252 78.6792 18.5208C77.9641 18.2164 77.3332 17.7965 76.7864 17.2611C76.25 16.7153 75.8294 16.0855 75.5245 15.3717C75.2195 14.6579 75.067 13.8916 75.067 13.0728ZM77.4331 13.0728C77.4331 13.7551 77.5908 14.3797 77.9063 14.9465C78.2323 15.5029 78.6687 15.949 79.2155 16.2849C79.7623 16.6103 80.3775 16.773 81.061 16.773C81.7235 16.773 82.3176 16.6103 82.8434 16.2849C83.3797 15.949 83.8003 15.5029 84.1053 14.9465C84.4103 14.3797 84.5627 13.7551 84.5627 13.0728C84.5627 12.3695 84.405 11.7397 84.0895 11.1833C83.7741 10.6165 83.3482 10.1704 82.8119 9.84496C82.2756 9.50905 81.6709 9.3411 80.9979 9.3411C80.3249 9.3411 79.7202 9.50905 79.1839 9.84496C78.6476 10.1704 78.2217 10.6165 77.9063 11.1833C77.5908 11.7397 77.4331 12.3695 77.4331 13.0728Z" fill="white"/>
+<path d="M12.0513 0C11.6665 0 11.2866 0.0194641 10.9099 0.0519044L10.9099 25.9003C11.2866 25.9327 11.6665 25.9522 12.0513 25.9522C12.4361 25.9522 12.8161 25.9327 13.1928 25.9003L13.1928 0.0519044C12.8161 0.0194641 12.4361 0 12.0513 0Z" fill="url(#paint0_linear_590_7157)"/>
+<path d="M18.8869 1.9237C18.232 1.52339 17.5429 1.18144 16.8274 0.901838C16.697 1.26409 16.5654 1.63931 16.4328 2.02751C14.9326 6.43127 14.1711 10.1149 14.1711 12.9761C14.1711 16.8413 15.58 21.6019 16.8242 25.052C17.5407 24.7718 18.2309 24.4293 18.8869 24.0285C17.7259 20.7617 16.454 16.4083 16.454 12.9761C16.454 9.54391 17.7259 5.19044 18.8869 1.9237Z" fill="url(#paint1_linear_590_7157)"/>
+<path d="M9.93149 12.9761C9.93149 9.11084 8.52263 4.35023 7.27845 0.900217C6.56194 1.18035 5.87168 1.52284 5.21571 1.92371C6.37672 5.19044 7.64861 9.54391 7.64861 12.9761C7.64861 16.4083 6.37672 20.7617 5.21571 24.0285C5.8706 24.4288 6.55977 24.7707 7.27519 25.0503C7.40564 24.6892 7.53718 24.3139 7.66981 23.9247C9.16999 19.5209 9.93149 15.8373 9.93149 12.9761Z" fill="url(#paint2_linear_590_7157)"/>
+<path d="M23.3418 17.3701C20.0691 14.8868 19.7153 13.4708 19.7153 12.9761C19.7153 11.6298 21.7911 9.66556 24.1065 8.01273C23.8118 7.30882 23.4555 6.63201 23.0417 5.99009C22.6879 6.23663 22.3243 6.4994 21.959 6.77676C18.913 9.08326 17.4324 11.114 17.4324 12.9761C17.4324 14.8382 18.913 16.8689 21.959 19.1754C22.3243 19.4528 22.6879 19.7155 23.0417 19.9621C23.4601 19.3181 23.8202 18.6385 24.118 17.9313C23.8554 17.7529 23.5994 17.5648 23.3418 17.3701Z" fill="url(#paint3_linear_590_7157)"/>
+<path d="M6.67023 12.9761C6.67023 11.1254 5.21897 9.10111 2.23491 6.78974C1.84845 6.48967 1.46199 6.20582 1.09347 5.94305C0.675155 6.58333 0.314473 7.25909 0.015625 7.96246C2.31318 9.62826 4.38734 11.6201 4.38734 12.9761C4.38734 14.3321 2.31318 16.3239 0.015625 17.9897C0.313429 18.693 0.673018 19.3687 1.09021 20.0091C1.46199 19.7464 1.84845 19.4625 2.23165 19.1624C5.21897 16.8511 6.67023 14.8268 6.67023 12.9761Z" fill="url(#paint4_linear_590_7157)"/>
+<defs>
+<linearGradient id="paint0_linear_590_7157" x1="12.0766" y1="25.9625" x2="12.0766" y2="-0.0103325" gradientUnits="userSpaceOnUse">
+<stop stop-color="#E5152C"/>
+<stop offset="1" stop-color="#FFB200"/>
+</linearGradient>
+<linearGradient id="paint1_linear_590_7157" x1="12.0766" y1="25.9625" x2="12.0766" y2="-0.0103325" gradientUnits="userSpaceOnUse">
+<stop stop-color="#E5152C"/>
+<stop offset="1" stop-color="#FFB200"/>
+</linearGradient>
+<linearGradient id="paint2_linear_590_7157" x1="12.0766" y1="25.9625" x2="12.0766" y2="-0.0103325" gradientUnits="userSpaceOnUse">
+<stop stop-color="#E5152C"/>
+<stop offset="1" stop-color="#FFB200"/>
+</linearGradient>
+<linearGradient id="paint3_linear_590_7157" x1="12.0766" y1="25.9625" x2="12.0766" y2="-0.0103325" gradientUnits="userSpaceOnUse">
+<stop stop-color="#E5152C"/>
+<stop offset="1" stop-color="#FFB200"/>
+</linearGradient>
+<linearGradient id="paint4_linear_590_7157" x1="12.0766" y1="25.9625" x2="12.0766" y2="-0.0103325" gradientUnits="userSpaceOnUse">
+<stop stop-color="#E5152C"/>
+<stop offset="1" stop-color="#FFB200"/>
+</linearGradient>
+</defs>
+</svg>
+
+</template>
+
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconHome.vue b/frontend/src/components/icons/IconHome.vue
new file mode 100644
index 000000000..364b39fe3
--- /dev/null
+++ b/frontend/src/components/icons/IconHome.vue
@@ -0,0 +1,15 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+<svg viewBox="0 0 16 16" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
+<path d="M11.8607 15.1663H4.14065C2.31398 15.1663 0.833984 13.6797 0.833984 11.853V6.91299C0.833984 6.00632 1.39398 4.86632 2.11398 4.30632L5.70732 1.50632C6.78732 0.666324 8.51398 0.626324 9.63398 1.41299L13.754 4.29966C14.5473 4.85299 15.1673 6.03966 15.1673 7.00632V11.8597C15.1673 13.6797 13.6873 15.1663 11.8607 15.1663ZM6.32065 2.29299L2.72732 5.09299C2.25398 5.46632 1.83398 6.31299 1.83398 6.91299V11.853C1.83398 13.1263 2.86732 14.1663 4.14065 14.1663H11.8607C13.134 14.1663 14.1673 13.133 14.1673 11.8597V7.00632C14.1673 6.36632 13.7073 5.47966 13.1807 5.11966L9.06065 2.23299C8.30065 1.69966 7.04732 1.72632 6.32065 2.29299Z" />
+<path d="M8.00065 12.4997C7.72732 12.4997 7.50065 12.273 7.50065 11.9997V9.99967C7.50065 9.72634 7.72732 9.49967 8.00065 9.49967C8.27398 9.49967 8.50065 9.72634 8.50065 9.99967V11.9997C8.50065 12.273 8.27398 12.4997 8.00065 12.4997Z" />
+</svg>
+</template>
+
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconInProgress.vue b/frontend/src/components/icons/IconInProgress.vue
new file mode 100644
index 000000000..719feaaf4
--- /dev/null
+++ b/frontend/src/components/icons/IconInProgress.vue
@@ -0,0 +1,72 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    class="icon"
+    viewBox="0 0 21 21"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <circle cx="10.5" cy="10.5" r="10.5" />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M10.4732 5.08333C10.6976 5.08333 10.8794 5.26521 10.8794 5.48958V7.92708C10.8794 8.15144 10.6976 8.33333 10.4732 8.33333C10.2488 8.33333 10.0669 8.15144 10.0669 7.92708V5.48958C10.0669 5.26521 10.2488 5.08333 10.4732 5.08333Z"
+      fill="white"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M15.9168 10.3646C15.9168 10.5889 15.7349 10.7708 15.5106 10.7708H13.0731C12.8487 10.7708 12.6668 10.5889 12.6668 10.3646C12.6668 10.1402 12.8487 9.95833 13.0731 9.95833H15.5106C15.7349 9.95833 15.9168 10.1402 15.9168 10.3646Z"
+      fill="white"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M10.4732 12.6667C10.6976 12.6667 10.8794 12.8485 10.8794 13.0729V15.5104C10.8794 15.7348 10.6976 15.9167 10.4732 15.9167C10.2488 15.9167 10.0669 15.7348 10.0669 15.5104V13.0729C10.0669 12.8485 10.2488 12.6667 10.4732 12.6667Z"
+      fill="white"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M8.3335 10.3646C8.3335 10.5889 8.15161 10.7708 7.92725 10.7708H5.48975C5.26538 10.7708 5.0835 10.5889 5.0835 10.3646C5.0835 10.1402 5.26538 9.95833 5.48975 9.95833H7.92725C8.15161 9.95833 8.3335 10.1402 8.3335 10.3646Z"
+      fill="white"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M14.3112 6.65076C14.4699 6.80941 14.4699 7.06663 14.3112 7.22528L12.5877 8.94885C12.429 9.1075 12.1718 9.1075 12.0132 8.94885C11.8545 8.7902 11.8545 8.53298 12.0132 8.37433L13.7367 6.65076C13.8954 6.49211 14.1526 6.49211 14.3112 6.65076Z"
+      fill="white"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M14.4261 14.2344C14.2674 14.3931 14.0102 14.3931 13.8516 14.2344L12.128 12.5108C11.9693 12.3522 11.9693 12.095 12.128 11.9363C12.2866 11.7777 12.5439 11.7777 12.7025 11.9363L14.4261 13.6599C14.5847 13.8185 14.5847 14.0758 14.4261 14.2344Z"
+      fill="white"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M8.94902 12.013C9.10767 12.1716 9.10767 12.4289 8.94902 12.5875L7.22545 14.3111C7.0668 14.4697 6.80958 14.4697 6.65093 14.3111C6.49227 14.1524 6.49227 13.8952 6.65093 13.7366L8.3745 12.013C8.53315 11.8543 8.79037 11.8543 8.94902 12.013Z"
+      fill="white"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M9.06385 8.87218C8.9052 9.03083 8.64798 9.03083 8.48933 8.87218L6.76576 7.1486C6.60711 6.98995 6.60711 6.73273 6.76576 6.57408C6.92441 6.41543 7.18163 6.41543 7.34028 6.57408L9.06385 8.29765C9.2225 8.4563 9.2225 8.71353 9.06385 8.87218Z"
+      fill="white"
+    />
+  </svg>
+</template>
+
+<style scoped>
+.icon {
+  @apply origin-center;
+}
+</style>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconInfo.vue b/frontend/src/components/icons/IconInfo.vue
new file mode 100644
index 000000000..d6e1a60bf
--- /dev/null
+++ b/frontend/src/components/icons/IconInfo.vue
@@ -0,0 +1,29 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M1.25 12C1.25 6.08579 6.08579 1.25 12 1.25C17.9142 1.25 22.75 6.08579 22.75 12C22.75 17.9142 17.9142 22.75 12 22.75C6.08579 22.75 1.25 17.9142 1.25 12ZM12 2.75C6.91421 2.75 2.75 6.91421 2.75 12C2.75 17.0858 6.91421 21.25 12 21.25C17.0858 21.25 21.25 17.0858 21.25 12C21.25 6.91421 17.0858 2.75 12 2.75Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.998 16.75C11.5838 16.75 11.248 16.4142 11.248 16L11.248 11C11.248 10.5858 11.5838 10.25 11.998 10.25C12.4123 10.25 12.748 10.5858 12.748 11L12.748 16C12.748 16.4142 12.4123 16.75 11.998 16.75Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M13.0034 8C13.0034 8.55228 12.5557 9 12.0034 9H11.9944C11.4422 9 10.9944 8.55228 10.9944 8C10.9944 7.44772 11.4422 7 11.9944 7H12.0034C12.5557 7 13.0034 7.44772 13.0034 8Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconKey.vue b/frontend/src/components/icons/IconKey.vue
new file mode 100644
index 000000000..dced2b241
--- /dev/null
+++ b/frontend/src/components/icons/IconKey.vue
@@ -0,0 +1,30 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    width="14"
+    height="14"
+    viewBox="0 0 14 14"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M3.60581 13.271C3.54748 13.271 3.48331 13.2651 3.43081 13.2593L2.16498 13.0843C1.55831 13.0026 1.00998 12.4601 0.916646 11.8418L0.741646 10.5643C0.683312 10.156 0.858312 9.62512 1.14998 9.32762L3.71081 6.76678C3.29665 5.11012 3.77498 3.36012 4.99415 2.15262C6.88415 0.268451 9.95831 0.262618 11.8541 2.15262C12.77 3.06845 13.2716 4.28762 13.2716 5.58262C13.2716 6.87762 12.77 8.09678 11.8541 9.01262C10.6291 10.226 8.88498 10.7043 7.23998 10.2843L4.67331 12.8451C4.42831 13.1018 3.99081 13.271 3.60581 13.271ZM8.41831 1.61012C7.39748 1.61012 6.38248 1.99512 5.60664 2.77095C4.55665 3.81512 4.17748 5.34345 4.61498 6.76678C4.66165 6.92428 4.62081 7.08762 4.50415 7.20428L1.76248 9.94595C1.66331 10.0451 1.58165 10.3018 1.59915 10.436L1.77415 11.7135C1.80915 11.9351 2.04831 12.186 2.26998 12.2151L3.54165 12.3901C3.68165 12.4135 3.93831 12.3318 4.03748 12.2326L6.79081 9.48512C6.90748 9.36845 7.07665 9.33345 7.22831 9.38012C8.63415 9.82345 10.1683 9.44428 11.2183 8.39428C11.965 7.64762 12.3791 6.64428 12.3791 5.58262C12.3791 4.51512 11.965 3.51762 11.2183 2.77095C10.46 2.00095 9.43915 1.61012 8.41831 1.61012Z"
+      fill="#C3C3C7"
+    />
+    <path
+      d="M5.36161 11.9819C5.25078 11.9819 5.13994 11.9411 5.05244 11.8536L3.71078 10.5119C3.54161 10.3428 3.54161 10.0628 3.71078 9.8936C3.87994 9.72443 4.15994 9.72443 4.32911 9.8936L5.67078 11.2353C5.83994 11.4044 5.83994 11.6844 5.67078 11.8536C5.58328 11.9411 5.47244 11.9819 5.36161 11.9819Z"
+      fill="#C3C3C7"
+    />
+    <path
+      d="M8.45914 6.85433C7.7358 6.85433 7.14664 6.26516 7.14664 5.54183C7.14664 4.8185 7.7358 4.22933 8.45914 4.22933C9.18247 4.22933 9.77164 4.8185 9.77164 5.54183C9.77164 6.26516 9.18247 6.85433 8.45914 6.85433ZM8.45914 5.10433C8.21997 5.10433 8.02164 5.30266 8.02164 5.54183C8.02164 5.781 8.21997 5.97933 8.45914 5.97933C8.6983 5.97933 8.89664 5.781 8.89664 5.54183C8.89664 5.30266 8.6983 5.10433 8.45914 5.10433Z"
+      fill="#C3C3C7"
+    />
+  </svg>
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconKubeConfig.vue b/frontend/src/components/icons/IconKubeConfig.vue
new file mode 100644
index 000000000..f59b72ae7
--- /dev/null
+++ b/frontend/src/components/icons/IconKubeConfig.vue
@@ -0,0 +1,26 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M9 17.75C8.9 17.75 8.81 17.73 8.71 17.69C8.43 17.58 8.25 17.3 8.25 17V11C8.25 10.59 8.59 10.25 9 10.25C9.41 10.25 9.75 10.59 9.75 11V15.19L10.47 14.47C10.76 14.18 11.24 14.18 11.53 14.47C11.82 14.76 11.82 15.24 11.53 15.53L9.53 17.53C9.39 17.67 9.19 17.75 9 17.75Z"
+    />
+    <path
+      d="M9 17.75C8.81 17.75 8.61994 17.6799 8.46994 17.5299L6.46994 15.5299C6.17994 15.2399 6.17994 14.7599 6.46994 14.4699C6.75994 14.1799 7.23994 14.1799 7.52994 14.4699L9.52994 16.4699C9.81994 16.7599 9.82 17.24 9.53 17.53C9.38 17.68 9.19 17.75 9 17.75Z"
+    />
+    <path
+      d="M15 22.75H9C3.57 22.75 1.25 20.43 1.25 15V9C1.25 3.57 3.57 1.25 9 1.25H14C14.41 1.25 14.75 1.59 14.75 2C14.75 2.41 14.41 2.75 14 2.75H9C4.39 2.75 2.75 4.39 2.75 9V15C2.75 19.61 4.39 21.25 9 21.25H15C19.61 21.25 21.25 19.61 21.25 15V10C21.25 9.59 21.59 9.25 22 9.25C22.41 9.25 22.75 9.59 22.75 10V15C22.75 20.43 20.43 22.75 15 22.75Z"
+    />
+    <path
+      d="M22 10.75H18C14.58 10.75 13.25 9.41999 13.25 5.99999V1.99999C13.25 1.69999 13.43 1.41999 13.71 1.30999C13.99 1.18999 14.31 1.25999 14.53 1.46999L22.53 9.46999C22.74 9.67999 22.81 10.01 22.69 10.29C22.57 10.57 22.3 10.75 22 10.75ZM14.75 3.80999V5.99999C14.75 8.57999 15.42 9.24999 18 9.24999H20.19L14.75 3.80999Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconKubernetes.vue b/frontend/src/components/icons/IconKubernetes.vue
new file mode 100644
index 000000000..f8d4886f4
--- /dev/null
+++ b/frontend/src/components/icons/IconKubernetes.vue
@@ -0,0 +1,59 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.9999 10.25C11.0334 10.25 10.2499 11.0335 10.2499 12C10.2499 12.9665 11.0334 13.75 11.9999 13.75C12.9664 13.75 13.7499 12.9665 13.7499 12C13.7499 11.0335 12.9664 10.25 11.9999 10.25ZM8.7499 12C8.7499 10.2051 10.205 8.75 11.9999 8.75C13.7948 8.75 15.2499 10.2051 15.2499 12C15.2499 13.7949 13.7948 15.25 11.9999 15.25C10.205 15.25 8.7499 13.7949 8.7499 12Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.9999 5.25C8.27198 5.25 5.2499 8.27208 5.2499 12C5.2499 15.7279 8.27198 18.75 11.9999 18.75C15.7278 18.75 18.7499 15.7279 18.7499 12C18.7499 8.27208 15.7278 5.25 11.9999 5.25ZM3.7499 12C3.7499 7.44365 7.44355 3.75 11.9999 3.75C16.5563 3.75 20.2499 7.44365 20.2499 12C20.2499 16.5563 16.5563 20.25 11.9999 20.25C7.44355 20.25 3.7499 16.5563 3.7499 12Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.2499 9.75V1C11.2499 0.585786 11.5857 0.25 11.9999 0.25C12.4141 0.25 12.7499 0.585786 12.7499 1V9.75H11.2499Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M13.7917 9.42873L19.5064 4.43523C19.8183 4.16268 20.2921 4.19459 20.5647 4.5065C20.8372 4.81842 20.8053 5.29222 20.4934 5.56477L14.7787 10.5583L13.7917 9.42873Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M10.2081 9.42873L4.4934 4.43523C4.18148 4.16268 3.70768 4.19459 3.43513 4.5065C3.16258 4.81842 3.19449 5.29222 3.50641 5.56477L9.22108 10.5583L10.2081 9.42873Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M14.4615 11.7863L22.933 13.9766C23.334 14.0802 23.575 14.4894 23.4713 14.8904C23.3677 15.2914 22.9585 15.5325 22.5575 15.4288L14.086 13.2386L14.4615 11.7863Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M13.7219 13.9858L17.8278 21.7126C18.0221 22.0784 17.8832 22.5325 17.5174 22.7269C17.1516 22.9212 16.6975 22.7823 16.5032 22.4165L12.3973 14.6896L13.7219 13.9858Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M10.2896 13.9858L6.18375 21.7126C5.98938 22.0784 6.12834 22.5325 6.49412 22.7269C6.8599 22.9212 7.31398 22.7823 7.50835 22.4165L11.6142 14.6896L10.2896 13.9858Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M9.53829 11.7863L1.06684 13.9766C0.665816 14.0802 0.42477 14.4894 0.528452 14.8904C0.632134 15.2914 1.04128 15.5325 1.44231 15.4288L9.91376 13.2386L9.53829 11.7863Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconLinkDown.vue b/frontend/src/components/icons/IconLinkDown.vue
new file mode 100644
index 000000000..502304390
--- /dev/null
+++ b/frontend/src/components/icons/IconLinkDown.vue
@@ -0,0 +1,22 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg width="24" height="24" viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
+    <path fill-rule="evenodd" clip-rule="evenodd"
+      d="M16.5962 7.40362C16.4009 7.20836 16.4009 6.89178 16.5962 6.69652L19.0711 4.22164C19.2663 4.02638 19.5829 4.02638 19.7782 4.22164C19.9734 4.4169 19.9734 4.73349 19.7782 4.92875L17.3033 7.40362C17.108 7.59888 16.7914 7.59888 16.5962 7.40362Z"/>
+    <path fill-rule="evenodd" clip-rule="evenodd"
+      d="M4.22164 19.7782C4.02638 19.5829 4.02638 19.2663 4.22164 19.0711L6.69652 16.5962C6.89178 16.4009 7.20836 16.4009 7.40362 16.5962C7.59888 16.7914 7.59888 17.108 7.40362 17.3033L4.92875 19.7782C4.73349 19.9734 4.4169 19.9734 4.22164 19.7782Z"/>
+    <path fill-rule="evenodd" clip-rule="evenodd"
+      d="M14.1213 7.05007L12 9.17139L14.8284 11.9998L16.9497 9.8785C17.3403 9.48797 17.3403 8.85481 16.9497 8.46428L15.5355 7.05007C15.145 6.65954 14.5118 6.65954 14.1213 7.05007ZM10.5858 9.17139L14.8284 13.414L17.6568 10.5856C18.4379 9.80455 18.4379 8.53822 17.6568 7.75718L16.2426 6.34296C15.4616 5.56191 14.1953 5.56191 13.4142 6.34296L10.5858 9.17139Z"/>
+    <path fill-rule="evenodd" clip-rule="evenodd"
+      d="M9.17139 12L7.05007 14.1213C6.65954 14.5118 6.65954 15.145 7.05007 15.5355L8.46428 16.9497C8.85481 17.3403 9.48797 17.3403 9.8785 16.9497L11.9998 14.8284L9.17139 12ZM6.34296 13.4142C5.56191 14.1953 5.56191 15.4616 6.34296 16.2426L7.75718 17.6568C8.53822 18.4379 9.80455 18.4379 10.5856 17.6568L13.414 14.8284L9.17139 10.5858L6.34296 13.4142Z"/>
+    <path fill-rule="evenodd" clip-rule="evenodd"
+      d="M9.38352 12.2121L10.7977 10.7979L11.5048 11.505L10.0906 12.9192L9.38352 12.2121Z"/>
+    <path fill-rule="evenodd" clip-rule="evenodd"
+      d="M11.0806 13.9092L12.4948 12.495L13.2019 13.2021L11.7877 14.6163L11.0806 13.9092Z"/>
+  </svg>
+</template>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconLoading.vue b/frontend/src/components/icons/IconLoading.vue
new file mode 100644
index 000000000..8ffce7023
--- /dev/null
+++ b/frontend/src/components/icons/IconLoading.vue
@@ -0,0 +1,55 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+    class="animate-spin"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.9502 2C12.3644 2 12.7002 2.33579 12.7002 2.75V7.25C12.7002 7.66421 12.3644 8 11.9502 8C11.536 8 11.2002 7.66421 11.2002 7.25V2.75C11.2002 2.33579 11.536 2 11.9502 2Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M22 11.75C22 12.1642 21.6642 12.5 21.25 12.5H16.75C16.3358 12.5 16 12.1642 16 11.75C16 11.3358 16.3358 11 16.75 11H21.25C21.6642 11 22 11.3358 22 11.75Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.9502 16C12.3644 16 12.7002 16.3358 12.7002 16.75V21.25C12.7002 21.6642 12.3644 22 11.9502 22C11.536 22 11.2002 21.6642 11.2002 21.25V16.75C11.2002 16.3358 11.536 16 11.9502 16Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M8 11.75C8 12.1642 7.66421 12.5 7.25 12.5H2.75C2.33579 12.5 2 12.1642 2 11.75C2 11.3358 2.33579 11 2.75 11H7.25C7.66421 11 8 11.3358 8 11.75Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M19.0359 4.89371C19.3287 5.18661 19.3287 5.66148 19.0359 5.95438L15.8539 9.13636C15.561 9.42925 15.0861 9.42925 14.7932 9.13636C14.5003 8.84346 14.5003 8.36859 14.7932 8.0757L17.9752 4.89371C18.2681 4.60082 18.743 4.60082 19.0359 4.89371Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M19.2478 18.8943C18.955 19.1872 18.4801 19.1872 18.1872 18.8943L15.0052 15.7123C14.7123 15.4194 14.7123 14.9445 15.0052 14.6517C15.2981 14.3588 15.773 14.3588 16.0659 14.6517L19.2478 17.8336C19.5407 18.1265 19.5407 18.6014 19.2478 18.8943Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M9.13636 14.7932C9.42925 15.0861 9.42925 15.561 9.13636 15.8539L5.95438 19.0359C5.66148 19.3287 5.18661 19.3287 4.89371 19.0359C4.60082 18.743 4.60082 18.2681 4.89372 17.9752L8.0757 14.7932C8.36859 14.5003 8.84346 14.5003 9.13636 14.7932Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M9.34835 8.9948C9.05546 9.28769 8.58058 9.28769 8.28769 8.9948L5.10571 5.81282C4.81282 5.51992 4.81282 5.04505 5.10571 4.75216C5.3986 4.45926 5.87348 4.45926 6.16637 4.75216L9.34835 7.93414C9.64124 8.22703 9.64124 8.7019 9.34835 8.9948Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconLog.vue b/frontend/src/components/icons/IconLog.vue
new file mode 100644
index 000000000..8b8118c54
--- /dev/null
+++ b/frontend/src/components/icons/IconLog.vue
@@ -0,0 +1,26 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 16 16"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M10.0007 15.1663H6.00065C2.38065 15.1663 0.833984 13.6197 0.833984 9.99967V5.99967C0.833984 2.37967 2.38065 0.833008 6.00065 0.833008H9.33398C9.60732 0.833008 9.83398 1.05967 9.83398 1.33301C9.83398 1.60634 9.60732 1.83301 9.33398 1.83301H6.00065C2.92732 1.83301 1.83398 2.92634 1.83398 5.99967V9.99967C1.83398 13.073 2.92732 14.1663 6.00065 14.1663H10.0007C13.074 14.1663 14.1673 13.073 14.1673 9.99967V6.66634C14.1673 6.39301 14.394 6.16634 14.6673 6.16634C14.9407 6.16634 15.1673 6.39301 15.1673 6.66634V9.99967C15.1673 13.6197 13.6207 15.1663 10.0007 15.1663Z"
+    />
+    <path
+      d="M14.6673 7.16633H12.0007C9.72065 7.16633 8.83398 6.27967 8.83398 3.99967V1.333C8.83398 1.133 8.95398 0.946334 9.14065 0.873C9.32732 0.793 9.54065 0.839667 9.68732 0.979667L15.0207 6.313C15.1607 6.453 15.2073 6.673 15.1273 6.85967C15.0473 7.04633 14.8673 7.16633 14.6673 7.16633ZM9.83398 2.53967V3.99967C9.83398 5.71967 10.2807 6.16633 12.0007 6.16633H13.4607L9.83398 2.53967Z"
+    />
+    <path
+      d="M8.66732 9.16634H4.66732C4.39398 9.16634 4.16732 8.93967 4.16732 8.66634C4.16732 8.39301 4.39398 8.16634 4.66732 8.16634H8.66732C8.94065 8.16634 9.16732 8.39301 9.16732 8.66634C9.16732 8.93967 8.94065 9.16634 8.66732 9.16634Z"
+    />
+    <path
+      d="M7.33398 11.833H4.66732C4.39398 11.833 4.16732 11.6063 4.16732 11.333C4.16732 11.0597 4.39398 10.833 4.66732 10.833H7.33398C7.60732 10.833 7.83398 11.0597 7.83398 11.333C7.83398 11.6063 7.60732 11.833 7.33398 11.833Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconLogo.vue b/frontend/src/components/icons/IconLogo.vue
new file mode 100644
index 000000000..d9a6fc0fb
--- /dev/null
+++ b/frontend/src/components/icons/IconLogo.vue
@@ -0,0 +1,95 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    width="26"
+    height="26"
+    viewBox="0 0 26 26"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M12.0513 0C11.6665 0 11.2866 0.0194641 10.9099 0.0519044L10.9099 25.9003C11.2866 25.9327 11.6665 25.9522 12.0513 25.9522C12.4361 25.9522 12.8161 25.9327 13.1928 25.9003L13.1928 0.0519044C12.8161 0.0194641 12.4361 0 12.0513 0Z"
+      fill="url(#paint0_linear_590_7157)"
+    />
+    <path
+      d="M18.8869 1.9237C18.232 1.52339 17.5429 1.18144 16.8274 0.901838C16.697 1.26409 16.5654 1.63931 16.4328 2.02751C14.9326 6.43127 14.1711 10.1149 14.1711 12.9761C14.1711 16.8413 15.58 21.6019 16.8242 25.052C17.5407 24.7718 18.2309 24.4293 18.8869 24.0285C17.7259 20.7617 16.454 16.4083 16.454 12.9761C16.454 9.54391 17.7259 5.19044 18.8869 1.9237Z"
+      fill="url(#paint1_linear_590_7157)"
+    />
+    <path
+      d="M9.93149 12.9761C9.93149 9.11084 8.52263 4.35023 7.27845 0.900217C6.56194 1.18035 5.87168 1.52284 5.21571 1.92371C6.37672 5.19044 7.64861 9.54391 7.64861 12.9761C7.64861 16.4083 6.37672 20.7617 5.21571 24.0285C5.8706 24.4288 6.55977 24.7707 7.27519 25.0503C7.40564 24.6892 7.53718 24.3139 7.66981 23.9247C9.16999 19.5209 9.93149 15.8373 9.93149 12.9761Z"
+      fill="url(#paint2_linear_590_7157)"
+    />
+    <path
+      d="M23.3418 17.3701C20.0691 14.8868 19.7153 13.4708 19.7153 12.9761C19.7153 11.6298 21.7911 9.66556 24.1065 8.01273C23.8118 7.30882 23.4555 6.63201 23.0417 5.99009C22.6879 6.23663 22.3243 6.4994 21.959 6.77676C18.913 9.08326 17.4324 11.114 17.4324 12.9761C17.4324 14.8382 18.913 16.8689 21.959 19.1754C22.3243 19.4528 22.6879 19.7155 23.0417 19.9621C23.4601 19.3181 23.8202 18.6385 24.118 17.9313C23.8554 17.7529 23.5994 17.5648 23.3418 17.3701Z"
+      fill="url(#paint3_linear_590_7157)"
+    />
+    <path
+      d="M6.67023 12.9761C6.67023 11.1254 5.21897 9.10111 2.23491 6.78974C1.84845 6.48967 1.46199 6.20582 1.09347 5.94305C0.675155 6.58333 0.314473 7.25909 0.015625 7.96246C2.31318 9.62826 4.38734 11.6201 4.38734 12.9761C4.38734 14.3321 2.31318 16.3239 0.015625 17.9897C0.313429 18.693 0.673018 19.3687 1.09021 20.0091C1.46199 19.7464 1.84845 19.4625 2.23165 19.1624C5.21897 16.8511 6.67023 14.8268 6.67023 12.9761Z"
+      fill="url(#paint4_linear_590_7157)"
+    />
+    <defs>
+      <linearGradient
+        id="paint0_linear_590_7157"
+        x1="12.0766"
+        y1="25.9625"
+        x2="12.0766"
+        y2="-0.0103325"
+        gradientUnits="userSpaceOnUse"
+      >
+        <stop stop-color="#E5152C" />
+        <stop offset="1" stop-color="#FFB200" />
+      </linearGradient>
+      <linearGradient
+        id="paint1_linear_590_7157"
+        x1="12.0766"
+        y1="25.9625"
+        x2="12.0766"
+        y2="-0.0103325"
+        gradientUnits="userSpaceOnUse"
+      >
+        <stop stop-color="#E5152C" />
+        <stop offset="1" stop-color="#FFB200" />
+      </linearGradient>
+      <linearGradient
+        id="paint2_linear_590_7157"
+        x1="12.0766"
+        y1="25.9625"
+        x2="12.0766"
+        y2="-0.0103325"
+        gradientUnits="userSpaceOnUse"
+      >
+        <stop stop-color="#E5152C" />
+        <stop offset="1" stop-color="#FFB200" />
+      </linearGradient>
+      <linearGradient
+        id="paint3_linear_590_7157"
+        x1="12.0766"
+        y1="25.9625"
+        x2="12.0766"
+        y2="-0.0103325"
+        gradientUnits="userSpaceOnUse"
+      >
+        <stop stop-color="#E5152C" />
+        <stop offset="1" stop-color="#FFB200" />
+      </linearGradient>
+      <linearGradient
+        id="paint4_linear_590_7157"
+        x1="12.0766"
+        y1="25.9625"
+        x2="12.0766"
+        y2="-0.0103325"
+        gradientUnits="userSpaceOnUse"
+      >
+        <stop stop-color="#E5152C" />
+        <stop offset="1" stop-color="#FFB200" />
+      </linearGradient>
+    </defs>
+  </svg>
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconLongArrowDown.vue b/frontend/src/components/icons/IconLongArrowDown.vue
new file mode 100644
index 000000000..3e655e06a
--- /dev/null
+++ b/frontend/src/components/icons/IconLongArrowDown.vue
@@ -0,0 +1,24 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.9996 21.25C11.8007 21.25 11.6099 21.171 11.4692 21.0303L5.39925 14.9603C5.10636 14.6674 5.10636 14.1926 5.39925 13.8997C5.69214 13.6068 6.16702 13.6068 6.45991 13.8997L11.9996 19.4393L17.5393 13.8997C17.8321 13.6068 18.307 13.6068 18.5999 13.8997C18.8928 14.1926 18.8928 14.6674 18.5999 14.9603L12.5299 21.0303C12.3893 21.171 12.1985 21.25 11.9996 21.25Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.9995 21.08C11.5853 21.08 11.2495 20.7442 11.2495 20.33L11.2495 3.49996C11.2495 3.08574 11.5853 2.74996 11.9995 2.74996C12.4137 2.74996 12.7495 3.08574 12.7495 3.49996L12.7495 20.33C12.7495 20.7442 12.4137 21.08 11.9995 21.08Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconLongArrowLeft.vue b/frontend/src/components/icons/IconLongArrowLeft.vue
new file mode 100644
index 000000000..2dd29d7eb
--- /dev/null
+++ b/frontend/src/components/icons/IconLongArrowLeft.vue
@@ -0,0 +1,24 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M2.74976 11.9998C2.74976 11.8009 2.82877 11.6101 2.96943 11.4695L9.03942 5.39949C9.33232 5.1066 9.80719 5.1066 10.1001 5.39949C10.393 5.69239 10.393 6.16726 10.1001 6.46015L4.56042 11.9998L10.1001 17.5395C10.393 17.8324 10.393 18.3073 10.1001 18.6002C9.80719 18.893 9.33232 18.893 9.03943 18.6002L2.96943 12.5302C2.82877 12.3895 2.74976 12.1987 2.74976 11.9998Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M2.9198 11.9998C2.9198 11.5855 3.25559 11.2498 3.6698 11.2498L20.4998 11.2498C20.914 11.2498 21.2498 11.5855 21.2498 11.9998C21.2498 12.414 20.914 12.7498 20.4998 12.7498L3.6698 12.7498C3.25559 12.7498 2.9198 12.414 2.9198 11.9998Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconLongArrowRight.vue b/frontend/src/components/icons/IconLongArrowRight.vue
new file mode 100644
index 000000000..afc275beb
--- /dev/null
+++ b/frontend/src/components/icons/IconLongArrowRight.vue
@@ -0,0 +1,24 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M21.2498 12.0002C21.2498 12.1991 21.1707 12.3899 21.0301 12.5305L14.9601 18.6005C14.6672 18.8934 14.1923 18.8934 13.8994 18.6005C13.6065 18.3076 13.6065 17.8327 13.8994 17.5398L19.4391 12.0002L13.8994 6.46051C13.6065 6.16761 13.6065 5.69274 13.8994 5.39985C14.1923 5.10695 14.6672 5.10695 14.9601 5.39985L21.0301 11.4698C21.1707 11.6105 21.2498 11.8013 21.2498 12.0002Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M21.0797 12.0002C21.0797 12.4145 20.7439 12.7502 20.3297 12.7502L3.49971 12.7502C3.0855 12.7502 2.74971 12.4145 2.74971 12.0002C2.74971 11.586 3.0855 11.2502 3.49971 11.2502L20.3297 11.2502C20.7439 11.2502 21.0797 11.586 21.0797 12.0002Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconLongArrowTop.vue b/frontend/src/components/icons/IconLongArrowTop.vue
new file mode 100644
index 000000000..7a6c264c8
--- /dev/null
+++ b/frontend/src/components/icons/IconLongArrowTop.vue
@@ -0,0 +1,24 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.9999 2.75C12.1988 2.75 12.3896 2.82902 12.5303 2.96967L18.6003 9.03967C18.8932 9.33256 18.8932 9.80744 18.6003 10.1003C18.3074 10.3932 17.8325 10.3932 17.5396 10.1003L11.9999 4.56066L6.46026 10.1003C6.16737 10.3932 5.69249 10.3932 5.3996 10.1003C5.10671 9.80744 5.10671 9.33256 5.3996 9.03967L11.4696 2.96967C11.6103 2.82902 11.801 2.75 11.9999 2.75Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M12 2.92004C12.4142 2.92004 12.75 3.25583 12.75 3.67004V20.5C12.75 20.9143 12.4142 21.25 12 21.25C11.5858 21.25 11.25 20.9143 11.25 20.5V3.67004C11.25 3.25583 11.5858 2.92004 12 2.92004Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconMinus.vue b/frontend/src/components/icons/IconMinus.vue
new file mode 100644
index 000000000..143c322ef
--- /dev/null
+++ b/frontend/src/components/icons/IconMinus.vue
@@ -0,0 +1,15 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M3.25 12C3.25 11.5858 3.58579 11.25 4 11.25H20C20.4142 11.25 20.75 11.5858 20.75 12C20.75 12.4142 20.4142 12.75 20 12.75H4C3.58579 12.75 3.25 12.4142 3.25 12Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconNoConnection.vue b/frontend/src/components/icons/IconNoConnection.vue
new file mode 100644
index 000000000..172fdc41c
--- /dev/null
+++ b/frontend/src/components/icons/IconNoConnection.vue
@@ -0,0 +1,45 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    width="77"
+    height="77"
+    viewBox="0 0 77 77"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <rect
+      x="13.7676"
+      width="64"
+      height="64"
+      rx="4"
+      transform="rotate(11.5079 13.7676 0)"
+      fill="#15161E"
+    />
+    <rect y="13" width="64" height="64" rx="4" fill="#191B24" />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M37.3966 41.9051C36.95 39.9553 35.9062 38.5914 34.56 37.8021C33.1144 36.9547 31.3923 36.8119 29.8422 37.218C28.2921 37.6241 26.8601 38.5931 26.0128 40.0402C25.2726 41.3046 25.0104 42.8799 25.444 44.6549C21.3182 45.7419 21.6379 52.1658 26.3164 52.4991C26.3342 52.5004 26.352 52.501 26.3697 52.501H36.0267C37.3861 52.5118 38.6938 52.0012 39.6987 51.0911C42.8997 48.2856 41.4021 42.8507 37.3966 41.9051ZM26.3966 46.0111C26.4851 46.0127 26.5753 45.9985 26.6635 45.9668C27.0533 45.8267 27.2557 45.3971 27.1155 45.0073C26.4852 43.2543 26.6969 41.8406 27.3073 40.7981C27.9281 39.7377 29.0049 38.988 30.2223 38.6691C31.4397 38.3501 32.7438 38.4762 33.8014 39.0962C34.841 39.7056 35.7148 40.8345 36.0199 42.6737C36.0741 43.0006 36.3363 43.2532 36.665 43.295C39.7957 43.6936 41.0774 47.8937 38.7062 49.9664L38.6956 49.9758C37.962 50.642 37.0132 51.0094 36.0362 51.0011L26.3978 51.001C23.2784 50.7546 23.2928 46.257 26.3966 46.0111Z"
+      fill="#9FA1A6"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M29.7197 48.4745C29.4268 48.1816 29.4268 47.7067 29.7197 47.4138L33.6088 43.5247C33.9016 43.2318 34.3765 43.2318 34.6694 43.5247C34.9623 43.8176 34.9623 44.2925 34.6694 44.5854L30.7803 48.4745C30.4874 48.7674 30.0126 48.7674 29.7197 48.4745Z"
+      fill="#9FA1A6"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M29.755 43.4892C30.0479 43.1963 30.5228 43.1963 30.8157 43.4892L34.7048 47.3783C34.9976 47.6712 34.9976 48.1461 34.7048 48.4389C34.4119 48.7318 33.937 48.7318 33.6441 48.4389L29.755 44.5499C29.4621 44.257 29.4621 43.7821 29.755 43.4892Z"
+      fill="#9FA1A6"
+    />
+  </svg>
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconNodes.vue b/frontend/src/components/icons/IconNodes.vue
new file mode 100644
index 000000000..74e8c1867
--- /dev/null
+++ b/frontend/src/components/icons/IconNodes.vue
@@ -0,0 +1,54 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M4.69002 2.75977C3.63241 2.75977 2.76001 3.62581 2.76001 4.68977V7.31978C2.76001 8.37738 3.62604 9.24977 4.69002 9.24977H19.32C20.3758 9.24977 21.25 8.37557 21.25 7.31978V4.68977C21.25 3.63216 20.384 2.75977 19.32 2.75977H4.69002ZM1.26001 4.68977C1.26001 2.79374 2.80763 1.25977 4.69002 1.25977H19.32C21.2161 1.25977 22.75 2.80739 22.75 4.68977V7.31978C22.75 9.20399 21.2042 10.7498 19.32 10.7498H4.69002C2.79399 10.7498 1.26001 9.20218 1.26001 7.31978V4.68977Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M4.69002 14.7598C3.63241 14.7598 2.76001 15.6258 2.76001 16.6898V19.3198C2.76001 20.3774 3.62604 21.2498 4.69002 21.2498H19.32C20.3758 21.2498 21.25 20.3756 21.25 19.3198V16.6898C21.25 15.6322 20.384 14.7598 19.32 14.7598H4.69002ZM1.26001 16.6898C1.26001 14.7937 2.80763 13.2598 4.69002 13.2598H19.32C21.2161 13.2598 22.75 14.8074 22.75 16.6898V19.3198C22.75 21.204 21.2042 22.7498 19.32 22.7498H4.69002C2.79399 22.7498 1.26001 21.2022 1.26001 19.3198V16.6898Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M6.00002 4.24977C6.41423 4.24977 6.75002 4.58556 6.75002 4.99977V6.99977C6.75002 7.41398 6.41423 7.74977 6.00002 7.74977C5.5858 7.74977 5.25002 7.41398 5.25002 6.99977V4.99977C5.25002 4.58556 5.5858 4.24977 6.00002 4.24977Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M10 4.24977C10.4142 4.24977 10.75 4.58556 10.75 4.99977V6.99977C10.75 7.41398 10.4142 7.74977 10 7.74977C9.5858 7.74977 9.25002 7.41398 9.25002 6.99977V4.99977C9.25002 4.58556 9.5858 4.24977 10 4.24977Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M6.00002 16.2498C6.41423 16.2498 6.75002 16.5856 6.75002 16.9998V18.9998C6.75002 19.414 6.41423 19.7498 6.00002 19.7498C5.5858 19.7498 5.25002 19.414 5.25002 18.9998V16.9998C5.25002 16.5856 5.5858 16.2498 6.00002 16.2498Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M10 16.2498C10.4142 16.2498 10.75 16.5856 10.75 16.9998V18.9998C10.75 19.414 10.4142 19.7498 10 19.7498C9.5858 19.7498 9.25002 19.414 9.25002 18.9998V16.9998C9.25002 16.5856 9.5858 16.2498 10 16.2498Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M13.25 5.99977C13.25 5.58556 13.5858 5.24977 14 5.24977H18C18.4142 5.24977 18.75 5.58556 18.75 5.99977C18.75 6.41398 18.4142 6.74977 18 6.74977H14C13.5858 6.74977 13.25 6.41398 13.25 5.99977Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M13.25 17.9998C13.25 17.5856 13.5858 17.2498 14 17.2498H18C18.4142 17.2498 18.75 17.5856 18.75 17.9998C18.75 18.414 18.4142 18.7498 18 18.7498H14C13.5858 18.7498 13.25 18.414 13.25 17.9998Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconOngoingTasks.vue b/frontend/src/components/icons/IconOngoingTasks.vue
new file mode 100644
index 000000000..29c041897
--- /dev/null
+++ b/frontend/src/components/icons/IconOngoingTasks.vue
@@ -0,0 +1,26 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M15 12.9502H8C7.59 12.9502 7.25 12.6102 7.25 12.2002C7.25 11.7902 7.59 11.4502 8 11.4502H15C15.41 11.4502 15.75 11.7902 15.75 12.2002C15.75 12.6102 15.41 12.9502 15 12.9502Z"
+    />
+    <path
+      d="M12.38 16.9502H8C7.59 16.9502 7.25 16.6102 7.25 16.2002C7.25 15.7902 7.59 15.4502 8 15.4502H12.38C12.79 15.4502 13.13 15.7902 13.13 16.2002C13.13 16.6102 12.79 16.9502 12.38 16.9502Z"
+    />
+    <path
+      d="M14 6.75H10C9.04 6.75 7.25 6.75 7.25 4C7.25 1.25 9.04 1.25 10 1.25H14C14.96 1.25 16.75 1.25 16.75 4C16.75 4.96 16.75 6.75 14 6.75ZM10 2.75C9.01 2.75 8.75 2.75 8.75 4C8.75 5.25 9.01 5.25 10 5.25H14C15.25 5.25 15.25 4.99 15.25 4C15.25 2.75 14.99 2.75 14 2.75H10Z"
+    />
+    <path
+      d="M15 22.7499H9C3.38 22.7499 2.25 20.1699 2.25 15.9999V9.99993C2.25 5.43993 3.9 3.48993 7.96 3.27993C8.36 3.25993 8.73 3.56993 8.75 3.98993C8.77 4.40993 8.45 4.74993 8.04 4.76993C5.2 4.92993 3.75 5.77993 3.75 9.99993V15.9999C3.75 19.6999 4.48 21.2499 9 21.2499H15C19.52 21.2499 20.25 19.6999 20.25 15.9999V9.99993C20.25 5.77993 18.8 4.92993 15.96 4.76993C15.55 4.74993 15.23 4.38993 15.25 3.97993C15.27 3.56993 15.63 3.24993 16.04 3.26993C20.1 3.48993 21.75 5.43993 21.75 9.98993V15.9899C21.75 20.1699 20.62 22.7499 15 22.7499Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconOverview.vue b/frontend/src/components/icons/IconOverview.vue
new file mode 100644
index 000000000..ccf63a517
--- /dev/null
+++ b/frontend/src/components/icons/IconOverview.vue
@@ -0,0 +1,29 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M3.09467 3.09467C4.42914 1.7602 6.42603 1.25 9 1.25H15C15.7578 1.25 16.4605 1.29417 17.1083 1.38868C17.5182 1.44848 17.8019 1.82923 17.7421 2.2391C17.6823 2.64897 17.3016 2.93277 16.8917 2.87297C16.3297 2.79097 15.7011 2.75 15 2.75H9C6.57397 2.75 5.07086 3.2398 4.15533 4.15533C3.2398 5.07086 2.75 6.57397 2.75 9V15C2.75 17.426 3.2398 18.9291 4.15533 19.8447C5.07086 20.7602 6.57397 21.25 9 21.25H15C17.426 21.25 18.9291 20.7602 19.8447 19.8447C20.7602 18.9291 21.25 17.426 21.25 15V9C21.25 8.58579 21.5858 8.25 22 8.25C22.4142 8.25 22.75 8.58579 22.75 9V15C22.75 17.574 22.2398 19.5709 20.9053 20.9053C19.5709 22.2398 17.574 22.75 15 22.75H9C6.42603 22.75 4.42914 22.2398 3.09467 20.9053C1.7602 19.5709 1.25 17.574 1.25 15V9C1.25 6.42603 1.7602 4.42914 3.09467 3.09467Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M17.1295 8.91724C17.4569 9.17101 17.5165 9.64212 17.2628 9.96949L14.9483 12.9552C14.3535 13.7075 13.2566 13.8447 12.4914 13.2535L12.4862 13.2494L10.6596 11.8121C10.5468 11.7264 10.3894 11.7477 10.3037 11.8583L7.92418 14.9477C7.67143 15.2758 7.2005 15.3369 6.87234 15.0842C6.54419 14.8314 6.48306 14.3605 6.73582 14.0323L9.11654 10.9414C9.71045 10.1728 10.8117 10.0339 11.5786 10.6265L11.5838 10.6306L13.4104 12.0679C13.5244 12.1545 13.6851 12.1322 13.7702 12.0267L16.0772 9.05051C16.331 8.72314 16.8021 8.66347 17.1295 8.91724Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M21.5 5C22.0523 5 22.5 4.55228 22.5 4C22.5 3.44772 22.0523 3 21.5 3C20.9477 3 20.5 3.44772 20.5 4C20.5 4.55228 20.9477 5 21.5 5ZM21.5 6.5C22.8807 6.5 24 5.38071 24 4C24 2.61929 22.8807 1.5 21.5 1.5C20.1193 1.5 19 2.61929 19 4C19 5.38071 20.1193 6.5 21.5 6.5Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconPin.vue b/frontend/src/components/icons/IconPin.vue
new file mode 100644
index 000000000..92fa9388a
--- /dev/null
+++ b/frontend/src/components/icons/IconPin.vue
@@ -0,0 +1,34 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M4.92871 19.6567L10.5856 13.9998L11.6462 15.0605L5.98937 20.7173L4.75193 20.8941L4.92871 19.6567Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M16.7874 6.76661L9.36275 12.0699L13.9297 16.6368L19.233 9.21222L16.7874 6.76661ZM21.1922 9.05007L16.9495 4.80743L7.05003 11.8785L14.1211 18.9496L21.1922 9.05007Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M22.076 10.9946C21.7832 11.2875 21.3083 11.2875 21.0154 10.9946L15.005 4.98421C14.7121 4.69131 14.7121 4.21644 15.005 3.92355C15.2979 3.63065 15.7727 3.63065 16.0656 3.92355L22.076 9.93396C22.3689 10.2268 22.3689 10.7017 22.076 10.9946Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M16.0656 19.8334C15.7727 20.1263 15.2979 20.1263 15.005 19.8334L6.16614 10.9946C5.87325 10.7017 5.87325 10.2268 6.16614 9.93396C6.45904 9.64106 6.93391 9.64106 7.2268 9.93395L16.0656 18.7728C16.3585 19.0657 16.3585 19.5406 16.0656 19.8334Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconPlus.vue b/frontend/src/components/icons/IconPlus.vue
new file mode 100644
index 000000000..fad67ee09
--- /dev/null
+++ b/frontend/src/components/icons/IconPlus.vue
@@ -0,0 +1,20 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg viewBox="0 0 24 24" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M3.25 12C3.25 11.5858 3.58579 11.25 4 11.25H20C20.4142 11.25 20.75 11.5858 20.75 12C20.75 12.4142 20.4142 12.75 20 12.75H4C3.58579 12.75 3.25 12.4142 3.25 12Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M12 3.25C12.4142 3.25 12.75 3.58579 12.75 4V20C12.75 20.4142 12.4142 20.75 12 20.75C11.5858 20.75 11.25 20.4142 11.25 20V4C11.25 3.58579 11.5858 3.25 12 3.25Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconPodes.vue b/frontend/src/components/icons/IconPodes.vue
new file mode 100644
index 000000000..3e4efa999
--- /dev/null
+++ b/frontend/src/components/icons/IconPodes.vue
@@ -0,0 +1,29 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.4347 2.92072L11.4336 2.92129L4.9262 6.42992C4.82624 6.48385 4.75011 6.60029 4.75011 6.76484C4.75011 6.9294 4.82624 7.04584 4.9262 7.09977L11.4336 10.6084L11.4348 10.609C11.7932 10.8001 12.2069 10.8001 12.5654 10.609L12.5666 10.6084L19.074 7.09977C19.1739 7.0458 19.2501 6.92931 19.2501 6.76484C19.2501 6.60037 19.1741 6.48397 19.0742 6.43L12.5666 2.92129L12.5655 2.9207C12.207 2.72955 11.7932 2.72956 11.4347 2.92072ZM10.7266 1.5984C11.5275 1.17033 12.4727 1.17033 13.2736 1.5984L13.276 1.59968L19.786 5.10969C21.0713 5.80302 21.0714 7.72658 19.7862 8.41992L13.276 11.93L13.2736 11.9313C12.4727 12.3594 11.5275 12.3594 10.7266 11.9313L10.7242 11.93L4.21417 8.42C2.92896 7.72666 2.9288 5.80311 4.21401 5.10977L10.7266 1.5984Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M20.0547 9.45902C21.287 8.84285 22.7501 9.72524 22.7501 11.1198V16.8398C22.7501 17.9669 22.1073 18.9931 21.1091 19.4989L21.106 19.5005L15.056 22.5304C13.8236 23.1466 12.3601 22.2645 12.3601 20.8698V15.1498C12.3601 14.0228 13.003 12.9966 14.0011 12.4908L14.0043 12.4892L20.0547 9.45902ZM20.7255 10.8007L14.6777 13.8296C14.1767 14.0841 13.8601 14.5974 13.8601 15.1498V20.8698C13.8601 21.1351 14.1367 21.3126 14.3843 21.1892M14.3843 21.1892L20.4311 18.1608L20.4327 18.16C20.9336 17.9055 21.2501 17.3922 21.2501 16.8398V11.1198C21.2501 10.8545 20.9731 10.677 20.7255 10.8007"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M4.05552 9.45908C2.82318 8.84292 1.36011 9.7253 1.36011 11.1199V16.8399C1.36011 17.967 2.00296 18.9932 3.00113 19.4989L3.00425 19.5005L9.05425 22.5305C10.2866 23.1467 11.7501 22.2645 11.7501 20.8699V15.1499C11.7501 14.0229 11.1073 12.9966 10.1091 12.4909L10.106 12.4893L4.05552 9.45908ZM3.3847 10.8007L9.43252 13.8296C9.93355 14.0841 10.2501 14.5975 10.2501 15.1499V20.8699C10.2501 21.1351 9.97351 21.3127 9.72596 21.1893M9.72596 21.1893L3.67908 18.1609L3.67755 18.1601C3.17661 17.9056 2.86011 17.3923 2.86011 16.8399V11.1199C2.86011 10.8546 3.13709 10.6771 3.3847 10.8007"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconQuestion.vue b/frontend/src/components/icons/IconQuestion.vue
new file mode 100644
index 000000000..aa9766464
--- /dev/null
+++ b/frontend/src/components/icons/IconQuestion.vue
@@ -0,0 +1,27 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    width="14"
+    height="14"
+    viewBox="0 0 12 12"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M6 11.375C3.035 11.375 0.625 8.965 0.625 6C0.625 3.035 3.035 0.625 6 0.625C8.965 0.625 11.375 3.035 11.375 6C11.375 8.965 8.965 11.375 6 11.375ZM6 1.375C3.45 1.375 1.375 3.45 1.375 6C1.375 8.55 3.45 10.625 6 10.625C8.55 10.625 10.625 8.55 10.625 6C10.625 3.45 8.55 1.375 6 1.375Z"
+    />
+    <path
+      d="M6.42951 3.04945C5.22143 2.77434 4.14999 3.68484 4.15 4.84615C4.15 4.85988 4.15177 4.88688 4.15177 4.88688C4.17241 5.1226 4.37049 5.30769 4.61154 5.30769C4.86211 5.30769 5.06626 5.10768 5.07324 4.85868C5.07278 4.34914 5.48659 3.92314 5.99613 3.92314C6.50521 3.92314 6.91921 4.33714 6.91921 4.84622C6.91921 5.35483 6.50521 5.76929 5.99613 5.76929C5.7469 5.76929 5.5429 5.97283 5.53921 6.22483V7.15391C5.53921 7.40868 5.74598 7.61545 6.00075 7.61545C6.25598 7.61545 6.46228 7.40868 6.46228 7.15391V6.79345C6.46228 6.69329 6.52921 6.60929 6.62336 6.5756C7.46013 6.27283 8.01813 5.38945 7.79151 4.40683C7.63782 3.74083 7.09598 3.20083 6.42951 3.04945Z"
+    />
+    <path
+      d="M5.53459 8.53837C5.53459 8.79314 5.74136 8.99991 5.99613 8.99991C6.2509 8.99991 6.45767 8.79314 6.45767 8.53837C6.45767 8.28361 6.2509 8.07684 5.99613 8.07684C5.74136 8.07684 5.53459 8.28361 5.53459 8.53837Z"
+    />
+  </svg>
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconReboot.vue b/frontend/src/components/icons/IconReboot.vue
new file mode 100644
index 000000000..0bd05df1d
--- /dev/null
+++ b/frontend/src/components/icons/IconReboot.vue
@@ -0,0 +1,29 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M12 22.75C6.07 22.75 1.25 17.93 1.25 12C1.25 6.07 6.07 1.25 12 1.25C17.93 1.25 22.75 6.07 22.75 12C22.75 17.93 17.93 22.75 12 22.75ZM12 2.75C6.9 2.75 2.75 6.9 2.75 12C2.75 17.1 6.9 21.25 12 21.25C17.1 21.25 21.25 17.1 21.25 12C21.25 6.9 17.1 2.75 12 2.75Z"
+    />
+    <path
+      d="M11.9999 17.4701C10.5999 17.4701 9.19994 16.9401 8.12994 15.8701C7.84994 15.5901 7.59993 15.2801 7.36993 14.9101C7.14993 14.5601 7.25992 14.1001 7.60992 13.8801C7.95992 13.6601 8.41995 13.7701 8.63995 14.1201C8.80995 14.4001 8.98994 14.6201 9.18994 14.8201C10.7399 16.3701 13.2599 16.3701 14.8099 14.8201C15.4099 14.2201 15.79 13.4401 15.92 12.5701C15.98 12.1601 16.3599 11.8601 16.7699 11.9301C17.1799 11.9901 17.4599 12.3701 17.4099 12.7801C17.2399 13.9701 16.7099 15.0401 15.8799 15.8801C14.7999 16.9401 13.3999 17.4701 11.9999 17.4701Z"
+    />
+    <path
+      d="M7.3399 12.08C7.2999 12.08 7.26991 12.08 7.22991 12.07C6.81991 12.01 6.5299 11.6299 6.5899 11.2199C6.7599 10.0299 7.2899 8.95996 8.1199 8.11996C10.2499 5.98996 13.7199 5.98996 15.8599 8.11996C16.1399 8.39996 16.3899 8.70999 16.6199 9.08999C16.8399 9.43999 16.7299 9.89996 16.3799 10.12C16.0299 10.34 15.5699 10.23 15.3499 9.87997C15.1799 9.60997 14.9999 9.37996 14.7999 9.17996C13.2499 7.62996 10.7299 7.62996 9.17989 9.17996C8.57989 9.77996 8.19991 10.56 8.06991 11.43C8.02991 11.81 7.7099 12.08 7.3399 12.08Z"
+    />
+    <path
+      d="M7.82031 17.9297C7.41031 17.9297 7.07031 17.5897 7.07031 17.1797V14.5098C7.07031 14.0998 7.41031 13.7598 7.82031 13.7598H10.4903C10.9003 13.7598 11.2403 14.0998 11.2403 14.5098C11.2403 14.9198 10.9003 15.2598 10.4903 15.2598H8.57031V17.1797C8.57031 17.5897 8.24031 17.9297 7.82031 17.9297Z"
+    />
+    <path
+      d="M16.1797 10.2403H13.5098C13.0998 10.2403 12.7598 9.9003 12.7598 9.4903C12.7598 9.0803 13.0998 8.7403 13.5098 8.7403H15.4297V6.82031C15.4297 6.41031 15.7697 6.07031 16.1797 6.07031C16.5897 6.07031 16.9297 6.41031 16.9297 6.82031V9.4903C16.9297 9.9103 16.5897 10.2403 16.1797 10.2403Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconRefresh.vue b/frontend/src/components/icons/IconRefresh.vue
new file mode 100644
index 000000000..db329748f
--- /dev/null
+++ b/frontend/src/components/icons/IconRefresh.vue
@@ -0,0 +1,15 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg viewBox="0 0 12 12" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M6 1.69767C3.60752 1.69767 1.69767 3.62431 1.69767 6C1.69767 6.19266 1.54149 6.34884 1.34884 6.34884C1.15618 6.34884 1 6.19266 1 6C1 3.24081 3.22039 1 6 1C7.65474 1 8.89388 1.69116 9.71241 2.37399C9.94097 2.56466 10.1376 2.75528 10.3023 2.93117V1.6093C10.3023 1.41664 10.4585 1.26047 10.6512 1.26047C10.8438 1.26047 11 1.41664 11 1.6093V3.93488C11 4.12754 10.8438 4.28372 10.6512 4.28372H8.58605C8.39339 4.28372 8.23721 4.12754 8.23721 3.93488C8.23721 3.74223 8.39339 3.58605 8.58605 3.58605H9.95315C9.77954 3.38483 9.55021 3.14724 9.2655 2.90973C8.53403 2.29953 7.44759 1.69767 6 1.69767ZM10.6512 5.65116C10.8438 5.65116 11 5.80734 11 6C11 8.7601 8.7601 11 6 11C4.59514 11 3.48116 10.2929 2.73541 9.61653C2.53746 9.43698 2.36323 9.25766 2.21395 9.09091V10.3907C2.21395 10.5834 2.05777 10.7395 1.86512 10.7395C1.67246 10.7395 1.51628 10.5834 1.51628 10.3907V8.06512C1.51628 7.87246 1.67246 7.71628 1.86512 7.71628H3.96744C4.1601 7.71628 4.31628 7.87246 4.31628 8.06512C4.31628 8.25777 4.1601 8.41395 3.96744 8.41395H2.55214C2.71995 8.61796 2.9388 8.8591 3.20413 9.09975C3.88396 9.71637 4.83742 10.3023 6 10.3023C8.37478 10.3023 10.3023 8.37478 10.3023 6C10.3023 5.80734 10.4585 5.65116 10.6512 5.65116Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconReset.vue b/frontend/src/components/icons/IconReset.vue
new file mode 100644
index 000000000..1fbb5e533
--- /dev/null
+++ b/frontend/src/components/icons/IconReset.vue
@@ -0,0 +1,23 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M12.0001 22.7499C6.80008 22.7499 2.58008 18.5199 2.58008 13.3299C2.58008 8.1399 6.80008 3.8999 12.0001 3.8999C13.0701 3.8999 14.1101 4.0499 15.1101 4.3599C15.5101 4.4799 15.7301 4.8999 15.6101 5.2999C15.4901 5.6999 15.0701 5.9199 14.6701 5.7999C13.8201 5.5399 12.9201 5.3999 12.0001 5.3999C7.63008 5.3999 4.08008 8.9499 4.08008 13.3199C4.08008 17.6899 7.63008 21.2399 12.0001 21.2399C16.3701 21.2399 19.9201 17.6899 19.9201 13.3199C19.9201 11.7399 19.4601 10.2199 18.5901 8.9199C18.3601 8.5799 18.4501 8.1099 18.8001 7.8799C19.1401 7.6499 19.6101 7.7399 19.8401 8.0899C20.8801 9.6399 21.4301 11.4499 21.4301 13.3299C21.4201 18.5199 17.2001 22.7499 12.0001 22.7499Z"
+    />
+    <path
+      d="M16.13 6.07021C15.92 6.07021 15.71 5.98021 15.56 5.81021L12.67 2.49021C12.4 2.18021 12.43 1.70021 12.74 1.43021C13.05 1.16021 13.53 1.19021 13.8 1.50021L16.69 4.82021C16.96 5.13021 16.93 5.61021 16.62 5.88021C16.49 6.01021 16.31 6.07021 16.13 6.07021Z"
+    />
+    <path
+      d="M12.76 8.5302C12.53 8.5302 12.3 8.4202 12.15 8.2202C11.91 7.8902 11.98 7.4202 12.31 7.1702L15.68 4.7102C16.01 4.4602 16.48 4.5402 16.73 4.8702C16.98 5.2002 16.9 5.6702 16.57 5.9202L13.2 8.3902C13.07 8.4902 12.92 8.5302 12.76 8.5302Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconRollback.vue b/frontend/src/components/icons/IconRollback.vue
new file mode 100644
index 000000000..53eb9db8a
--- /dev/null
+++ b/frontend/src/components/icons/IconRollback.vue
@@ -0,0 +1,16 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg width="25" height="23" viewBox="0 0 25 22" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M12.38 5.51233C12.7942 5.51233 13.13 5.84811 13.13 6.26233V10.3623C13.13 10.5159 13.1886 10.7384 13.319 10.967C13.4494 11.1957 13.611 11.3593 13.7424 11.4371L13.7444 11.4383L16.8443 13.2883C17.2 13.5006 17.3163 13.961 17.104 14.3167C16.8918 14.6724 16.4314 14.7886 16.0757 14.5764L12.9777 12.7275L12.9766 12.7269C12.5684 12.4847 12.2404 12.1036 12.016 11.7101C11.7914 11.3162 11.63 10.8388 11.63 10.3623V6.26233C11.63 5.84811 11.9658 5.51233 12.38 5.51233Z" fill="currentColor"/>
+    <path d="M24.4318 10.7443C24.4318 4.81326 19.6259 2.57752e-07 13.7292 0C7.83249 -2.57752e-07 3.01516 4.81326 3.01516 10.7443C3.01516 11.9647 3.18558 13.1509 3.53779 14.2915C3.67413 14.7477 4.15132 14.9987 4.60578 14.8618C5.06025 14.7249 5.31021 14.2459 5.17387 13.7897C4.87846 12.8202 4.7194 11.7936 4.7194 10.7443C4.7194 5.75995 8.75278 1.71088 13.7178 1.71088C18.6828 1.71088 22.7162 5.75995 22.7162 10.7443C22.7162 15.7286 18.6828 19.7777 13.7178 19.7777C11.9227 19.7777 10.1957 19.2531 8.71869 18.2607C8.3324 17.9984 7.7984 18.1011 7.53708 18.5003C7.27577 18.8881 7.37802 19.4241 7.77568 19.6865C9.53673 20.8727 11.5932 21.5 13.7292 21.5C19.6259 21.4886 24.4318 16.6753 24.4318 10.7443Z" fill="currentColor"/>
+    <path d="M5.48098 15.4548C5.48098 15.2152 5.37872 14.9757 5.18558 14.8046L1.41352 11.5083C1.06131 11.2004 0.515948 11.2346 0.209184 11.5882C-0.0975796 11.9418 -0.0634947 12.4892 0.288716 12.7972L4.06077 16.0935C4.41299 16.4015 4.95834 16.3672 5.26511 16.0137C5.41281 15.8654 5.48098 15.6601 5.48098 15.4548Z" fill="currentColor"/>
+    <path d="M8.27593 11.611C8.27593 11.3487 8.15095 11.0863 7.92372 10.9153C7.54878 10.6415 7.01479 10.7214 6.73075 11.0978L3.93579 14.9415C3.65175 15.3179 3.74264 15.854 4.11757 16.1391C4.49251 16.4243 5.0265 16.333 5.31054 15.9566L8.11687 12.1129C8.23048 11.9646 8.27593 11.7935 8.27593 11.611Z" fill="currentColor"/>
+  </svg>
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconSearch.vue b/frontend/src/components/icons/IconSearch.vue
new file mode 100644
index 000000000..f47b914de
--- /dev/null
+++ b/frontend/src/components/icons/IconSearch.vue
@@ -0,0 +1,24 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.5 2.75C6.66751 2.75 2.75 6.66751 2.75 11.5C2.75 16.3325 6.66751 20.25 11.5 20.25C16.3325 20.25 20.25 16.3325 20.25 11.5C20.25 6.66751 16.3325 2.75 11.5 2.75ZM1.25 11.5C1.25 5.83908 5.83908 1.25 11.5 1.25C17.1609 1.25 21.75 5.83908 21.75 11.5C21.75 17.1609 17.1609 21.75 11.5 21.75C5.83908 21.75 1.25 17.1609 1.25 11.5Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M19.4697 19.4697C19.7626 19.1768 20.2374 19.1768 20.5303 19.4697L22.5303 21.4697C22.8232 21.7626 22.8232 22.2374 22.5303 22.5303C22.2374 22.8232 21.7626 22.8232 21.4697 22.5303L19.4697 20.5303C19.1768 20.2374 19.1768 19.7626 19.4697 19.4697Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconSettings.vue b/frontend/src/components/icons/IconSettings.vue
new file mode 100644
index 000000000..dd824b360
--- /dev/null
+++ b/frontend/src/components/icons/IconSettings.vue
@@ -0,0 +1,24 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M12 9.75013C10.7574 9.75013 9.75 10.7575 9.75 12.0001C9.75 13.2428 10.7574 14.2501 12 14.2501C13.2426 14.2501 14.25 13.2428 14.25 12.0001C14.25 10.7575 13.2426 9.75013 12 9.75013ZM8.25 12.0001C8.25 9.92907 9.92893 8.25013 12 8.25013C14.0711 8.25013 15.75 9.92907 15.75 12.0001C15.75 14.0712 14.0711 15.7501 12 15.7501C9.92893 15.7501 8.25 14.0712 8.25 12.0001Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M9.60347 3.7703C9.3358 3.32436 8.77209 3.18563 8.35347 3.43469L8.34256 3.44118L6.61251 4.43108C6.06514 4.74387 5.8763 5.45302 6.1894 5.99493L5.54 6.37013L6.18888 5.99403C6.72395 6.91716 6.86779 7.92895 6.38982 8.75836C5.91192 9.58765 4.96479 9.97013 3.9 9.97013C3.26678 9.97013 2.75 10.4918 2.75 11.1201V12.8801C2.75 13.5085 3.26678 14.0301 3.9 14.0301C4.96479 14.0301 5.91192 14.4126 6.38982 15.2419C6.86773 16.0712 6.72398 17.0828 6.18909 18.0059C5.87642 18.5477 6.06491 19.2563 6.6121 19.569L8.35352 20.5655C8.77214 20.8145 9.33578 20.6759 9.60345 20.23L9.71093 20.0444C10.2458 19.1215 11.052 18.4926 12.0087 18.4926C12.9662 18.4926 13.77 19.122 14.3 20.0459L14.3007 20.0471L14.4065 20.23C14.6742 20.6759 15.2379 20.8146 15.6565 20.5656L15.6674 20.5591L17.3975 19.5692C17.9434 19.2572 18.1351 18.5579 17.8198 18.0039C17.2858 17.0814 17.1426 16.0706 17.6202 15.2419C18.0981 14.4126 19.0452 14.0301 20.11 14.0301C20.7432 14.0301 21.26 13.5085 21.26 12.8801V11.1201C21.26 10.4869 20.7384 9.97013 20.11 9.97013C19.0452 9.97013 18.0981 9.58765 17.6202 8.75836C17.1423 7.92911 17.286 6.91756 17.8208 5.99457C18.1336 5.45271 17.9451 4.74403 17.3979 4.43132L15.6565 3.43478C15.2379 3.18572 14.6742 3.32436 14.4065 3.77031L14.2991 3.95591C13.7642 4.87872 12.958 5.50763 12.0012 5.50763C11.0439 5.50763 10.2402 4.87837 9.71021 3.95467L9.70933 3.95313L9.60347 3.7703ZM7.59248 2.14205C8.75191 1.45668 10.2226 1.87716 10.8946 3.00666L10.8991 3.01433L11.0091 3.20436L11.0107 3.20714C11.3807 3.85259 11.7666 4.00763 12.0012 4.00763C12.237 4.00763 12.6259 3.85128 13.0009 3.20435L13.1154 3.00664C13.7874 1.87713 15.2581 1.45668 16.4175 2.14206L18.1421 3.12895C19.4147 3.85617 19.8463 5.48725 19.1194 6.74534L19.1189 6.74624C18.7439 7.3931 18.8028 7.80632 18.9198 8.00941C19.0369 8.21262 19.3648 8.47013 20.11 8.47013C21.5616 8.47013 22.76 9.65335 22.76 11.1201V12.8801C22.76 14.3318 21.5768 15.5301 20.11 15.5301C19.3648 15.5301 19.0369 15.7877 18.9198 15.9909C18.8028 16.1939 18.7439 16.6072 19.1189 17.254L19.1212 17.258C19.8444 18.5236 19.4157 20.1432 18.1425 20.8711L16.4174 21.8583C15.258 22.5436 13.7874 22.1231 13.1154 20.9936L13.1109 20.9859L13.0009 20.7959L12.9993 20.7931C12.6293 20.1477 12.2434 19.9926 12.0087 19.9926C11.773 19.9926 11.3841 20.149 11.0091 20.7959L10.8946 20.9936C10.2226 22.1231 8.75199 22.5436 7.59257 21.8583L5.8679 20.8713C4.59558 20.144 4.16378 18.5129 4.8906 17.2549L4.89112 17.254C5.26606 16.6072 5.20721 16.1939 5.09018 15.9909C4.97308 15.7877 4.64521 15.5301 3.9 15.5301C2.43322 15.5301 1.25 14.3318 1.25 12.8801V11.1201C1.25 9.66849 2.43322 8.47013 3.9 8.47013C4.64521 8.47013 4.97308 8.21262 5.09018 8.00941C5.20721 7.80632 5.26606 7.3931 4.89112 6.74624L4.8906 6.74534C4.16378 5.48738 4.59518 3.85651 5.86749 3.12918L7.59248 2.14205Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconSettingsToggle.vue b/frontend/src/components/icons/IconSettingsToggle.vue
new file mode 100644
index 000000000..5458d67a2
--- /dev/null
+++ b/frontend/src/components/icons/IconSettingsToggle.vue
@@ -0,0 +1,17 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg viewBox="0 0 18 18" fill="currentColor" xmlns="http://www.w3.org/2000/svg">
+    <mask id="toggle">
+      <rect id="cover" x="-5%" y="-5%" width="110%" height="110%" fill="white"/> 
+      <circle cx="13" cy="3" r="4" fill="black"/>
+    </mask>
+    <path mask="url(#toggle)" d="M9 11.8125C7.4475 11.8125 6.1875 10.5525 6.1875 9C6.1875 7.4475 7.4475 6.1875 9 6.1875C10.5525 6.1875 11.8125 7.4475 11.8125 9C11.8125 10.5525 10.5525 11.8125 9 11.8125ZM9 7.3125C8.07 7.3125 7.3125 8.07 7.3125 9C7.3125 9.93 8.07 10.6875 9 10.6875C9.93 10.6875 10.6875 9.93 10.6875 9C10.6875 8.07 9.93 7.3125 9 7.3125Z"/>
+    <path mask="url(#toggle)" d="M11.4075 16.6425C11.25 16.6425 11.0925 16.62 10.935 16.5825C10.47 16.455 10.08 16.1625 9.8325 15.75L9.7425 15.6C9.3 14.835 8.6925 14.835 8.25 15.6L8.1675 15.7425C7.92 16.1625 7.53 16.4625 7.065 16.5825C6.5925 16.71 6.105 16.6425 5.6925 16.395L4.4025 15.6525C3.945 15.39 3.615 14.9625 3.4725 14.445C3.3375 13.9275 3.405 13.395 3.6675 12.9375C3.885 12.555 3.945 12.21 3.8175 11.9925C3.69 11.775 3.3675 11.6475 2.925 11.6475C1.83 11.6475 0.9375 10.755 0.9375 9.66V8.34C0.9375 7.245 1.83 6.3525 2.925 6.3525C3.3675 6.3525 3.69 6.225 3.8175 6.0075C3.945 5.79 3.8925 5.445 3.6675 5.0625C3.405 4.605 3.3375 4.065 3.4725 3.555C3.6075 3.0375 3.9375 2.61 4.4025 2.3475L5.7 1.605C6.5475 1.1025 7.665 1.395 8.175 2.2575L8.265 2.4075C8.7075 3.1725 9.315 3.1725 9.7575 2.4075L9.84 2.265C10.35 1.395 11.4675 1.1025 12.3225 1.6125L13.6125 2.355C14.07 2.6175 14.4 3.045 14.5425 3.5625C14.6775 4.08 14.61 4.6125 14.3475 5.07C14.13 5.4525 14.07 5.7975 14.1975 6.015C14.325 6.2325 14.6475 6.36 15.09 6.36C16.185 6.36 17.0775 7.2525 17.0775 8.3475V9.6675C17.0775 10.7625 16.185 11.655 15.09 11.655C14.6475 11.655 14.325 11.7825 14.1975 12C14.07 12.2175 14.1225 12.5625 14.3475 12.945C14.61 13.4025 14.685 13.9425 14.5425 14.4525C14.4075 14.97 14.0775 15.3975 13.6125 15.66L12.315 16.4025C12.03 16.56 11.7225 16.6425 11.4075 16.6425ZM9 13.8675C9.6675 13.8675 10.29 14.2875 10.7175 15.03L10.8 15.1725C10.89 15.33 11.04 15.4425 11.22 15.4875C11.4 15.5325 11.58 15.51 11.73 15.42L13.0275 14.67C13.2225 14.5575 13.3725 14.37 13.4325 14.145C13.4925 13.92 13.4625 13.6875 13.35 13.4925C12.9225 12.7575 12.87 12 13.2 11.4225C13.53 10.845 14.2125 10.515 15.0675 10.515C15.5475 10.515 15.93 10.1325 15.93 9.6525V8.3325C15.93 7.86 15.5475 7.47 15.0675 7.47C14.2125 7.47 13.53 7.14 13.2 6.5625C12.87 5.985 12.9225 5.2275 13.35 4.4925C13.4625 4.2975 13.4925 4.065 13.4325 3.84C13.3725 3.615 13.23 3.435 13.035 3.315L11.7375 2.5725C11.415 2.3775 10.9875 2.49 10.7925 2.82L10.71 2.9625C10.2825 3.705 9.66 4.125 8.9925 4.125C8.325 4.125 7.7025 3.705 7.275 2.9625L7.1925 2.8125C7.005 2.4975 6.585 2.385 6.2625 2.5725L4.965 3.3225C4.77 3.435 4.62 3.6225 4.56 3.8475C4.5 4.0725 4.53 4.305 4.6425 4.5C5.07 5.235 5.1225 5.9925 4.7925 6.57C4.4625 7.1475 3.78 7.4775 2.925 7.4775C2.445 7.4775 2.0625 7.86 2.0625 8.34V9.66C2.0625 10.1325 2.445 10.5225 2.925 10.5225C3.78 10.5225 4.4625 10.8525 4.7925 11.43C5.1225 12.0075 5.07 12.765 4.6425 13.5C4.53 13.695 4.5 13.9275 4.56 14.1525C4.62 14.3775 4.7625 14.5575 4.9575 14.6775L6.255 15.42C6.4125 15.5175 6.6 15.54 6.7725 15.495C6.9525 15.45 7.1025 15.33 7.2 15.1725L7.2825 15.03C7.71 14.295 8.3325 13.8675 9 13.8675Z"/>
+    <circle cx="13" cy="3" r="2.5" fill="#FF5F2A"/>
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconSidero.vue b/frontend/src/components/icons/IconSidero.vue
new file mode 100644
index 000000000..84f391e91
--- /dev/null
+++ b/frontend/src/components/icons/IconSidero.vue
@@ -0,0 +1,95 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    width="60"
+    height="60"
+    viewBox="0 0 60 60"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M29.9028 14C29.4317 14 28.9666 14.024 28.5054 14.0639V45.8773C28.9666 45.9172 29.4317 45.9411 29.9028 45.9411C30.374 45.9411 30.8391 45.9172 31.3003 45.8773L31.3003 14.0639C30.8391 14.024 30.374 14 29.9028 14Z"
+      fill="url(#paint0_linear_562_23508)"
+    />
+    <path
+      d="M38.2714 16.3676C37.4696 15.8749 36.6259 15.4541 35.7501 15.11C35.5903 15.5558 35.4293 16.0176 35.2669 16.4954C33.4303 21.9154 32.498 26.4491 32.498 29.9706C32.498 34.7278 34.2229 40.587 35.7461 44.8332C36.6233 44.4884 37.4683 44.0669 38.2714 43.5735C36.85 39.5529 35.2929 34.1948 35.2929 29.9706C35.2929 25.7464 36.85 20.3882 38.2714 16.3676Z"
+      fill="url(#paint1_linear_562_23508)"
+    />
+    <path
+      d="M27.3076 29.9706C27.3076 25.2133 25.5828 19.3541 24.0596 15.108C23.1824 15.4527 22.3373 15.8743 21.5342 16.3676C22.9556 20.3882 24.5128 25.7464 24.5128 29.9706C24.5128 34.1948 22.9556 39.5529 21.5342 43.5735C22.336 44.0662 23.1797 44.4871 24.0556 44.8312C24.2153 44.3867 24.3763 43.9249 24.5387 43.4457C26.3753 38.0257 27.3076 33.4921 27.3076 29.9706Z"
+      fill="url(#paint2_linear_562_23508)"
+    />
+    <path
+      d="M43.7253 35.3786C39.7187 32.3222 39.2855 30.5794 39.2855 29.9706C39.2855 28.3136 41.8268 25.8961 44.6616 23.8618C44.3008 22.9955 43.8645 22.1625 43.358 21.3724C42.9248 21.6759 42.4796 21.9993 42.0324 22.3406C38.3033 25.1794 36.4907 27.6788 36.4907 29.9706C36.4907 32.2623 38.3033 34.7617 42.0324 37.6005C42.4796 37.9419 42.9248 38.2653 43.358 38.5687C43.8702 37.7762 44.3111 36.9398 44.6756 36.0693C44.3542 35.8497 44.0407 35.6182 43.7253 35.3786Z"
+      fill="url(#paint3_linear_562_23508)"
+    />
+    <path
+      d="M23.315 29.9706C23.315 27.6928 21.5382 25.2014 17.885 22.3566C17.4118 21.9873 16.9387 21.6379 16.4875 21.3145C15.9754 22.1026 15.5338 22.9343 15.168 23.7999C17.9808 25.8502 20.5201 28.3016 20.5201 29.9706C20.5201 31.6395 17.9808 34.091 15.168 36.1412C15.5326 37.0068 15.9728 37.8384 16.4835 38.6266C16.9387 38.3032 17.4118 37.9539 17.881 37.5845C21.5382 34.7398 23.315 32.2484 23.315 29.9706Z"
+      fill="url(#paint4_linear_562_23508)"
+    />
+    <defs>
+      <linearGradient
+        id="paint0_linear_562_23508"
+        x1="29.9338"
+        y1="45.9539"
+        x2="29.9338"
+        y2="13.9873"
+        gradientUnits="userSpaceOnUse"
+      >
+        <stop stop-color="#E5152C" />
+        <stop offset="1" stop-color="#FFB200" />
+      </linearGradient>
+      <linearGradient
+        id="paint1_linear_562_23508"
+        x1="29.9338"
+        y1="45.9539"
+        x2="29.9338"
+        y2="13.9873"
+        gradientUnits="userSpaceOnUse"
+      >
+        <stop stop-color="#E5152C" />
+        <stop offset="1" stop-color="#FFB200" />
+      </linearGradient>
+      <linearGradient
+        id="paint2_linear_562_23508"
+        x1="29.9338"
+        y1="45.9539"
+        x2="29.9338"
+        y2="13.9873"
+        gradientUnits="userSpaceOnUse"
+      >
+        <stop stop-color="#E5152C" />
+        <stop offset="1" stop-color="#FFB200" />
+      </linearGradient>
+      <linearGradient
+        id="paint3_linear_562_23508"
+        x1="29.9338"
+        y1="45.9539"
+        x2="29.9338"
+        y2="13.9873"
+        gradientUnits="userSpaceOnUse"
+      >
+        <stop stop-color="#E5152C" />
+        <stop offset="1" stop-color="#FFB200" />
+      </linearGradient>
+      <linearGradient
+        id="paint4_linear_562_23508"
+        x1="29.9338"
+        y1="45.9539"
+        x2="29.9338"
+        y2="13.9873"
+        gradientUnits="userSpaceOnUse"
+      >
+        <stop stop-color="#E5152C" />
+        <stop offset="1" stop-color="#FFB200" />
+      </linearGradient>
+    </defs>
+  </svg>
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconSideroMonochrome.vue b/frontend/src/components/icons/IconSideroMonochrome.vue
new file mode 100644
index 000000000..fcfe67871
--- /dev/null
+++ b/frontend/src/components/icons/IconSideroMonochrome.vue
@@ -0,0 +1,38 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    width="26"
+    height="26"
+    viewBox="0 0 26 26"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M12.0513 0C11.6665 0 11.2866 0.0194641 10.9099 0.0519044L10.9099 25.9003C11.2866 25.9327 11.6665 25.9522 12.0513 25.9522C12.4361 25.9522 12.8161 25.9327 13.1928 25.9003L13.1928 0.0519044C12.8161 0.0194641 12.4361 0 12.0513 0Z"
+      fill="currentColor"
+    />
+    <path
+      d="M18.8869 1.9237C18.232 1.52339 17.5429 1.18144 16.8274 0.901838C16.697 1.26409 16.5654 1.63931 16.4328 2.02751C14.9326 6.43127 14.1711 10.1149 14.1711 12.9761C14.1711 16.8413 15.58 21.6019 16.8242 25.052C17.5407 24.7718 18.2309 24.4293 18.8869 24.0285C17.7259 20.7617 16.454 16.4083 16.454 12.9761C16.454 9.54391 17.7259 5.19044 18.8869 1.9237Z"
+      fill="currentColor"
+    />
+    <path
+      d="M9.93149 12.9761C9.93149 9.11084 8.52263 4.35023 7.27845 0.900217C6.56194 1.18035 5.87168 1.52284 5.21571 1.92371C6.37672 5.19044 7.64861 9.54391 7.64861 12.9761C7.64861 16.4083 6.37672 20.7617 5.21571 24.0285C5.8706 24.4288 6.55977 24.7707 7.27519 25.0503C7.40564 24.6892 7.53718 24.3139 7.66981 23.9247C9.16999 19.5209 9.93149 15.8373 9.93149 12.9761Z"
+      fill="currentColor"
+    />
+    <path
+      d="M23.3418 17.3701C20.0691 14.8868 19.7153 13.4708 19.7153 12.9761C19.7153 11.6298 21.7911 9.66556 24.1065 8.01273C23.8118 7.30882 23.4555 6.63201 23.0417 5.99009C22.6879 6.23663 22.3243 6.4994 21.959 6.77676C18.913 9.08326 17.4324 11.114 17.4324 12.9761C17.4324 14.8382 18.913 16.8689 21.959 19.1754C22.3243 19.4528 22.6879 19.7155 23.0417 19.9621C23.4601 19.3181 23.8202 18.6385 24.118 17.9313C23.8554 17.7529 23.5994 17.5648 23.3418 17.3701Z"
+      fill="currentColor"
+    />
+    <path
+      d="M6.67023 12.9761C6.67023 11.1254 5.21897 9.10111 2.23491 6.78974C1.84845 6.48967 1.46199 6.20582 1.09347 5.94305C0.675155 6.58333 0.314473 7.25909 0.015625 7.96246C2.31318 9.62826 4.38734 11.6201 4.38734 12.9761C4.38734 14.3321 2.31318 16.3239 0.015625 17.9897C0.313429 18.693 0.673018 19.3687 1.09021 20.0091C1.46199 19.7464 1.84845 19.4625 2.23165 19.1624C5.21897 16.8511 6.67023 14.8268 6.67023 12.9761Z"
+      fill="currentColor"
+    />
+  </svg>
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconTalosConfig.vue b/frontend/src/components/icons/IconTalosConfig.vue
new file mode 100644
index 000000000..ca4e037fa
--- /dev/null
+++ b/frontend/src/components/icons/IconTalosConfig.vue
@@ -0,0 +1,23 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="M6.88991 15.75C6.60991 15.75 6.34991 15.6 6.21991 15.34C6.02991 14.97 6.17991 14.52 6.55991 14.33C7.42991 13.9 8.16991 13.24 8.69991 12.44C8.87991 12.17 8.87991 11.83 8.69991 11.56C8.15991 10.76 7.41991 10.1 6.55991 9.67002C6.17991 9.49002 6.02991 9.04002 6.21991 8.66002C6.39991 8.29002 6.84991 8.14002 7.21991 8.33002C8.31991 8.88002 9.25991 9.71002 9.93991 10.73C10.4499 11.5 10.4499 12.5 9.93991 13.27C9.25991 14.29 8.31991 15.12 7.21991 15.67C7.11991 15.72 6.99991 15.75 6.88991 15.75Z"
+    />
+    <path
+      d="M17 15.75H13C12.59 15.75 12.25 15.41 12.25 15C12.25 14.59 12.59 14.25 13 14.25H17C17.41 14.25 17.75 14.59 17.75 15C17.75 15.41 17.41 15.75 17 15.75Z"
+    />
+    <path
+      d="M15 22.75H9C3.57 22.75 1.25 20.43 1.25 15V9C1.25 3.57 3.57 1.25 9 1.25H15C20.43 1.25 22.75 3.57 22.75 9V15C22.75 20.43 20.43 22.75 15 22.75ZM9 2.75C4.39 2.75 2.75 4.39 2.75 9V15C2.75 19.61 4.39 21.25 9 21.25H15C19.61 21.25 21.25 19.61 21.25 15V9C21.25 4.39 19.61 2.75 15 2.75H9Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconTask.vue b/frontend/src/components/icons/IconTask.vue
new file mode 100644
index 000000000..528350196
--- /dev/null
+++ b/frontend/src/components/icons/IconTask.vue
@@ -0,0 +1,20 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg viewBox="0 0 24 24" fill="currentColor" stroke-width="0.5" stroke="currentColor"
+    xmlns="http://www.w3.org/2000/svg">
+    <path stroke-linecap="round" stroke-linejoin="round" mask="url(#hole)"
+      d="M10.343 3.94c.09-.542.56-.94 1.11-.94h1.093c.55 0 1.02.398 1.11.94l.149.894c.07.424.384.764.78.93.398.164.855.142 1.205-.108l.737-.527a1.125 1.125 0 011.45.12l.773.774c.39.389.44 1.002.12 1.45l-.527.737c-.25.35-.272.806-.107 1.204.165.397.505.71.93.78l.893.15c.543.09.94.56.94 1.109v1.094c0 .55-.397 1.02-.94 1.11l-.893.149c-.425.07-.765.383-.93.78-.165.398-.143.854.107 1.204l.527.738c.32.447.269 1.06-.12 1.45l-.774.773a1.125 1.125 0 01-1.449.12l-.738-.527c-.35-.25-.806-.272-1.203-.107-.397.165-.71.505-.781.929l-.149.894c-.09.542-.56.94-1.11.94h-1.094c-.55 0-1.019-.398-1.11-.94l-.148-.894c-.071-.424-.384-.764-.781-.93-.398-.164-.854-.142-1.204.108l-.738.527c-.447.32-1.06.269-1.45-.12l-.773-.774a1.125 1.125 0 01-.12-1.45l.527-.737c.25-.35.273-.806.108-1.204-.165-.397-.505-.71-.93-.78l-.894-.15c-.542-.09-.94-.56-.94-1.109v-1.094c0-.55.398-1.02.94-1.11l.894-.149c.424-.07.765-.383.93-.78.165-.398.143-.854-.107-1.204l-.527-.738a1.125 1.125 0 01.12-1.45l.773-.773a1.125 1.125 0 011.45-.12l.737.527c.35.25.807.272 1.204.107.397-.165.71-.505.78-.929l.15-.894z" />
+    <defs>
+      <mask id="hole">
+        <rect width="100%" height="100%" fill="white"/>
+        <circle stroke-linecap="round" stroke-linejoin="round" cx="12" cy="12" r="5" fill="black"/>
+      </mask>
+    </defs>
+  </svg>
+</template>
+
diff --git a/frontend/src/components/icons/IconTerminal.vue b/frontend/src/components/icons/IconTerminal.vue
new file mode 100644
index 000000000..15a64e998
--- /dev/null
+++ b/frontend/src/components/icons/IconTerminal.vue
@@ -0,0 +1,24 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path
+      d="M6.00067 11.833C5.92733 11.833 5.84733 11.813 5.78067 11.7796C5.26733 11.5196 4.82733 11.133 4.50733 10.653C4.24067 10.253 4.24067 9.73962 4.50733 9.33962C4.82733 8.85962 5.26733 8.47296 5.78067 8.21962C6.02733 8.09296 6.32733 8.19962 6.454 8.44629C6.58067 8.69296 6.48067 8.99296 6.22733 9.11962C5.86733 9.29962 5.56067 9.57296 5.34067 9.90629C5.30067 9.96629 5.30067 10.0463 5.34067 10.113C5.56067 10.4463 5.86733 10.7196 6.22733 10.8996C6.474 11.0263 6.574 11.3263 6.454 11.573C6.36067 11.733 6.18067 11.833 6.00067 11.833Z"
+    />
+    <path
+      d="M10.1406 11.833C9.95397 11.833 9.78063 11.733 9.69397 11.5596C9.5673 11.313 9.6673 11.013 9.92063 10.8863C10.2806 10.7063 10.5873 10.433 10.8073 10.0996C10.8473 10.0396 10.8473 9.95962 10.8073 9.89296C10.5873 9.55962 10.2806 9.28629 9.92063 9.10629C9.67397 8.97962 9.57397 8.67962 9.69397 8.43296C9.82063 8.18629 10.1206 8.08629 10.3673 8.20629C10.8806 8.46629 11.3206 8.85296 11.6406 9.33296C11.9073 9.73296 11.9073 10.2463 11.6406 10.6463C11.3206 11.1263 10.8806 11.513 10.3673 11.7663C10.2873 11.813 10.214 11.833 10.1406 11.833Z"
+    />
+    <path
+      d="M10.0007 15.1663H6.00065C2.38065 15.1663 0.833984 13.6197 0.833984 9.99967V5.99967C0.833984 2.37967 2.38065 0.833008 6.00065 0.833008H10.0007C13.6207 0.833008 15.1673 2.37967 15.1673 5.99967V9.99967C15.1673 13.6197 13.6207 15.1663 10.0007 15.1663ZM6.00065 1.83301C2.92732 1.83301 1.83398 2.92634 1.83398 5.99967V9.99967C1.83398 13.073 2.92732 14.1663 6.00065 14.1663H10.0007C13.074 14.1663 14.1673 13.073 14.1673 9.99967V5.99967C14.1673 2.92634 13.074 1.83301 10.0007 1.83301H6.00065Z"
+    />
+    <path
+      d="M1.4873 5.83967C1.21397 5.83967 0.987305 5.61301 0.987305 5.33967C0.987305 5.06634 1.2073 4.83967 1.4873 4.83967L14.3006 4.83301C14.574 4.83301 14.8006 5.05967 14.8006 5.33301C14.8006 5.60634 14.5806 5.83301 14.3006 5.83301L1.4873 5.83967Z"
+    />
+  </svg>
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconTime.vue b/frontend/src/components/icons/IconTime.vue
new file mode 100644
index 000000000..74960cd30
--- /dev/null
+++ b/frontend/src/components/icons/IconTime.vue
@@ -0,0 +1,24 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M12 2.75C6.89421 2.75 2.75 6.89421 2.75 12C2.75 17.1058 6.89421 21.25 12 21.25C17.1058 21.25 21.25 17.1058 21.25 12C21.25 6.89421 17.1058 2.75 12 2.75ZM1.25 12C1.25 6.06579 6.06579 1.25 12 1.25C17.9342 1.25 22.75 6.06579 22.75 12C22.75 17.9342 17.9342 22.75 12 22.75C6.06579 22.75 1.25 17.9342 1.25 12Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.63 6.76001C12.0442 6.76001 12.38 7.0958 12.38 7.51001V11.61C12.38 11.7636 12.4386 11.9861 12.569 12.2147C12.6994 12.4434 12.861 12.607 12.9924 12.6848L12.9943 12.686L16.0943 14.536C16.45 14.7482 16.5663 15.2087 16.354 15.5644C16.1418 15.92 15.6814 16.0363 15.3257 15.824L12.2277 13.9752C12.2273 13.975 12.227 13.9748 12.2266 13.9746C11.8184 13.7324 11.4904 13.3513 11.266 12.9578C11.0414 12.5639 10.88 12.0865 10.88 11.61V7.51001C10.88 7.0958 11.2158 6.76001 11.63 6.76001Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconUnknown.vue b/frontend/src/components/icons/IconUnknown.vue
new file mode 100644
index 000000000..010e7f35c
--- /dev/null
+++ b/frontend/src/components/icons/IconUnknown.vue
@@ -0,0 +1,31 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 12 12"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M6 11.375C3.035 11.375 0.625 8.965 0.625 6C0.625 3.035 3.035 0.625 6 0.625C8.965 0.625 11.375 3.035 11.375 6C11.375 8.965 8.965 11.375 6 11.375ZM6 1.375C3.45 1.375 1.375 3.45 1.375 6C1.375 8.55 3.45 10.625 6 10.625C8.55 10.625 10.625 8.55 10.625 6C10.625 3.45 8.55 1.375 6 1.375Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M6.42951 3.04945C5.22143 2.77434 4.14999 3.68484 4.15 4.84615C4.15 4.85988 4.15177 4.88688 4.15177 4.88688C4.17241 5.1226 4.37049 5.30769 4.61154 5.30769C4.86211 5.30769 5.06626 5.10768 5.07324 4.85868C5.07278 4.34914 5.48659 3.92314 5.99613 3.92314C6.50521 3.92314 6.91921 4.33714 6.91921 4.84622C6.91921 5.35483 6.50521 5.76929 5.99613 5.76929C5.7469 5.76929 5.5429 5.97283 5.53921 6.22483V7.15391C5.53921 7.40868 5.74598 7.61545 6.00075 7.61545C6.25598 7.61545 6.46228 7.40868 6.46228 7.15391V6.79345C6.46228 6.69329 6.52921 6.60929 6.62336 6.5756C7.46013 6.27283 8.01813 5.38945 7.79151 4.40683C7.63782 3.74083 7.09598 3.20083 6.42951 3.04945Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M5.53459 8.53837C5.53459 8.79314 5.74136 8.99991 5.99613 8.99991C6.2509 8.99991 6.45767 8.79314 6.45767 8.53837C6.45767 8.28361 6.2509 8.07684 5.99613 8.07684C5.74136 8.07684 5.53459 8.28361 5.53459 8.53837Z"
+    />
+  </svg>
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconUnlink.vue b/frontend/src/components/icons/IconUnlink.vue
new file mode 100644
index 000000000..de159c794
--- /dev/null
+++ b/frontend/src/components/icons/IconUnlink.vue
@@ -0,0 +1,44 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M5.68737 13.4976C4.47774 14.6822 4.47774 16.6028 5.68737 17.7874C6.89699 18.972 8.85818 18.972 10.0678 17.7874L12.886 15.0275C13.1651 14.7541 13.6177 14.7541 13.8969 15.0275C14.176 15.3009 14.176 15.7441 13.8969 16.0175L11.0787 18.7774C9.31076 20.5087 6.44441 20.5087 4.67649 18.7774C2.90858 17.046 2.90858 14.2389 4.67649 12.5076L7.49468 9.74767C7.77383 9.4743 8.22641 9.4743 8.50555 9.74767C8.7847 10.021 8.7847 10.4643 8.50555 10.7376L5.68737 13.4976ZM9.94528 8.33772C9.66613 8.06435 9.66613 7.62112 9.94528 7.34775L12.7635 4.58784C14.5314 2.85648 17.3977 2.85649 19.1657 4.58784C20.9336 6.3192 20.9336 9.12628 19.1657 10.8576L16.3475 13.6175C16.0683 13.8909 15.6157 13.8909 15.3366 13.6175C15.0574 13.3442 15.0574 12.901 15.3366 12.6276L18.1548 9.86767C19.3644 8.68306 19.3644 6.76242 18.1548 5.57781C16.9452 4.3932 14.984 4.3932 13.7743 5.57781L10.9562 8.33772C10.677 8.61109 10.2244 8.61109 9.94528 8.33772Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M8.58506 15.0154C8.30592 14.742 8.30592 14.2988 8.58506 14.0254L14.3133 8.41559C14.5925 8.14222 15.0451 8.14222 15.3242 8.41559C15.6034 8.68896 15.6034 9.13218 15.3242 9.40556L9.59594 15.0154C9.31679 15.2887 8.86421 15.2887 8.58506 15.0154Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M19.2968 14.7813C19.3657 14.4007 19.7367 14.1468 20.1254 14.2143L23.4099 14.7846C23.7986 14.8521 24.0578 15.2154 23.9889 15.596C23.92 15.9767 23.549 16.2306 23.1603 16.1631L19.8758 15.5928C19.4871 15.5253 19.2279 15.162 19.2968 14.7813Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M9.41333 4.60595C9.80204 4.53846 10.0613 4.17515 9.99236 3.79449L9.41002 0.577924C9.34111 0.197255 8.97013 -0.0566251 8.58142 0.0108676C8.19271 0.0783603 7.93347 0.441667 8.00239 0.822337L8.58473 4.0389C8.65365 4.41957 9.02463 4.67345 9.41333 4.60595Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M14.5867 19.394C14.198 19.4615 13.9387 19.8248 14.0076 20.2055L14.59 23.4221C14.6589 23.8027 15.0299 24.0566 15.4186 23.9891C15.8073 23.9216 16.0665 23.5583 15.9976 23.1777L15.4153 19.9611C15.3464 19.5804 14.9754 19.3266 14.5867 19.394Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M4.70321 9.21867C4.63429 9.59934 4.26332 9.85322 3.87461 9.78573L0.590127 9.21543C0.20142 9.14794 -0.0578208 8.78463 0.0110971 8.40396C0.080015 8.02329 0.450994 7.76941 0.839701 7.83691L4.12418 8.4072C4.51289 8.4747 4.77213 8.838 4.70321 9.21867Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconUpgradeEmptyState.vue b/frontend/src/components/icons/IconUpgradeEmptyState.vue
new file mode 100644
index 000000000..22247c7de
--- /dev/null
+++ b/frontend/src/components/icons/IconUpgradeEmptyState.vue
@@ -0,0 +1,81 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    width="77"
+    height="77"
+    viewBox="0 0 77 77"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <rect
+      x="13.7676"
+      width="64"
+      height="64"
+      rx="4"
+      transform="rotate(11.5079 13.7676 0)"
+      fill="#15161E"
+    />
+    <rect y="13" width="64" height="64" rx="4" fill="#191B24" />
+    <mask
+      id="mask0_842_27334"
+      style="mask-type: alpha"
+      maskUnits="userSpaceOnUse"
+      x="22"
+      y="41"
+      width="20"
+      height="15"
+    >
+      <path
+        fill-rule="evenodd"
+        clip-rule="evenodd"
+        d="M22 41.7939H41.9996V55.5379H22V41.7939Z"
+        fill="white"
+      />
+    </mask>
+    <g mask="url(#mask0_842_27334)">
+      <path
+        fill-rule="evenodd"
+        clip-rule="evenodd"
+        d="M37.565 55.5379H26.435C23.99 55.5379 22 53.5489 22 51.1029V46.2279C22 43.7829 23.99 41.7939 26.435 41.7939H27.368C27.782 41.7939 28.118 42.1299 28.118 42.5439C28.118 42.9579 27.782 43.2939 27.368 43.2939H26.435C24.816 43.2939 23.5 44.6099 23.5 46.2279V51.1029C23.5 52.7219 24.816 54.0379 26.435 54.0379H37.565C39.183 54.0379 40.5 52.7219 40.5 51.1029V46.2189C40.5 44.6059 39.188 43.2939 37.576 43.2939H36.633C36.219 43.2939 35.883 42.9579 35.883 42.5439C35.883 42.1299 36.219 41.7939 36.633 41.7939H37.576C40.015 41.7939 42 43.7789 42 46.2189V51.1029C42 53.5489 40.01 55.5379 37.565 55.5379Z"
+        fill="#9FA1A6"
+      />
+    </g>
+    <mask
+      id="mask1_842_27334"
+      style="mask-type: alpha"
+      maskUnits="userSpaceOnUse"
+      x="31"
+      y="35"
+      width="2"
+      height="14"
+    >
+      <path
+        fill-rule="evenodd"
+        clip-rule="evenodd"
+        d="M31.25 35H32.75V48.5409H31.25V35Z"
+        fill="white"
+      />
+    </mask>
+    <g mask="url(#mask1_842_27334)">
+      <path
+        fill-rule="evenodd"
+        clip-rule="evenodd"
+        d="M32 48.541C31.586 48.541 31.25 48.205 31.25 47.791V35.75C31.25 35.336 31.586 35 32 35C32.414 35 32.75 35.336 32.75 35.75V47.791C32.75 48.205 32.414 48.541 32 48.541Z"
+        fill="#9FA1A6"
+      />
+    </g>
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M29.0847 39.429C28.8937 39.429 28.7017 39.356 28.5557 39.21C28.2627 38.918 28.2607 38.444 28.5537 38.15L31.4687 35.222C31.7497 34.939 32.2497 34.939 32.5307 35.222L35.4467 38.15C35.7387 38.444 35.7377 38.918 35.4447 39.21C35.1507 39.502 34.6767 39.502 34.3847 39.208L31.9997 36.814L29.6157 39.208C29.4697 39.356 29.2767 39.429 29.0847 39.429Z"
+      fill="#9FA1A6"
+    />
+  </svg>
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconUpload.vue b/frontend/src/components/icons/IconUpload.vue
new file mode 100644
index 000000000..ad7e7e48f
--- /dev/null
+++ b/frontend/src/components/icons/IconUpload.vue
@@ -0,0 +1,64 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <mask
+      id="mask0_314:124"
+      style="mask-type:alpha"
+      maskUnits="userSpaceOnUse"
+      x="2"
+      y="8"
+      width="20"
+      height="15"
+    >
+      <path
+        fill-rule="evenodd"
+        clip-rule="evenodd"
+        d="M2.00049 8.79395H22.0001V22.5379H2.00049V8.79395Z"
+        fill="white"
+      />
+    </mask>
+    <g mask="url(#mask0_314:124)">
+      <path
+        fill-rule="evenodd"
+        clip-rule="evenodd"
+        d="M17.5655 22.5379H6.43549C3.99049 22.5379 2.00049 20.5489 2.00049 18.1029V13.2279C2.00049 10.7829 3.99049 8.79395 6.43549 8.79395H7.36849C7.78249 8.79395 8.11849 9.12995 8.11849 9.54395C8.11849 9.95795 7.78249 10.2939 7.36849 10.2939H6.43549C4.81649 10.2939 3.50049 11.6099 3.50049 13.2279V18.1029C3.50049 19.7219 4.81649 21.0379 6.43549 21.0379H17.5655C19.1835 21.0379 20.5005 19.7219 20.5005 18.1029V13.2189C20.5005 11.6059 19.1885 10.2939 17.5765 10.2939H16.6335C16.2195 10.2939 15.8835 9.95795 15.8835 9.54395C15.8835 9.12995 16.2195 8.79395 16.6335 8.79395H17.5765C20.0155 8.79395 22.0005 10.7789 22.0005 13.2189V18.1029C22.0005 20.5489 20.0105 22.5379 17.5655 22.5379Z"
+        fill="currentColor"
+      />
+    </g>
+    <mask
+      id="mask1_314:124"
+      style="mask-type:alpha"
+      maskUnits="userSpaceOnUse"
+      x="11"
+      y="2"
+      width="2"
+      height="14"
+    >
+      <path
+        fill-rule="evenodd"
+        clip-rule="evenodd"
+        d="M11.25 2H12.75V15.5409H11.25V2Z"
+        fill="white"
+      />
+    </mask>
+    <g mask="url(#mask1_314:124)">
+      <path
+        fill-rule="evenodd"
+        clip-rule="evenodd"
+        d="M12 15.541C11.586 15.541 11.25 15.205 11.25 14.791V2.75C11.25 2.336 11.586 2 12 2C12.414 2 12.75 2.336 12.75 2.75V14.791C12.75 15.205 12.414 15.541 12 15.541Z"
+        fill="currentColor"
+      />
+    </g>
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M9.0852 6.42853C8.8942 6.42853 8.7022 6.35553 8.5562 6.20953C8.2632 5.91753 8.2612 5.44353 8.5542 5.14953L11.4692 2.22153C11.7502 1.93853 12.2502 1.93853 12.5312 2.22153L15.4472 5.14953C15.7392 5.44353 15.7382 5.91753 15.4452 6.20953C15.1512 6.50153 14.6772 6.50153 14.3852 6.20753L12.0002 3.81353L9.6162 6.20753C9.4702 6.35553 9.2772 6.42853 9.0852 6.42853Z"
+      fill="currentColor"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconWaiting.vue b/frontend/src/components/icons/IconWaiting.vue
new file mode 100644
index 000000000..49426bbd7
--- /dev/null
+++ b/frontend/src/components/icons/IconWaiting.vue
@@ -0,0 +1,16 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+<svg  viewBox="0 0 21 21" fill="none" xmlns="http://www.w3.org/2000/svg">
+<circle cx="10.5" cy="10.5" r="10.5" />
+<path fill-rule="evenodd" clip-rule="evenodd" d="M10.5002 5.48958C7.73453 5.48958 5.48975 7.73436 5.48975 10.5C5.48975 13.2656 7.73453 15.5104 10.5002 15.5104C13.2658 15.5104 15.5106 13.2656 15.5106 10.5C15.5106 7.73436 13.2658 5.48958 10.5002 5.48958ZM4.67725 10.5C4.67725 7.28563 7.2858 4.67708 10.5002 4.67708C13.7145 4.67708 16.3231 7.28563 16.3231 10.5C16.3231 13.7144 13.7145 16.3229 10.5002 16.3229C7.2858 16.3229 4.67725 13.7144 4.67725 10.5Z" fill="white"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M10.2997 7.66167C10.5241 7.66167 10.706 7.84355 10.706 8.06792V10.2888C10.706 10.3719 10.7378 10.4925 10.8084 10.6163C10.879 10.7402 10.9665 10.8288 11.0377 10.8709L11.0388 10.8716L12.7179 11.8736C12.9106 11.9886 12.9736 12.238 12.8586 12.4307C12.7436 12.6234 12.4942 12.6863 12.3016 12.5714L10.6235 11.5699C10.6233 11.5698 10.6231 11.5697 10.6229 11.5696C10.4018 11.4384 10.2241 11.232 10.1026 11.0188C9.98091 10.8054 9.8935 10.5468 9.8935 10.2888V8.06792C9.8935 7.84355 10.0754 7.66167 10.2997 7.66167Z" fill="white"/>
+</svg>
+
+</template>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/components/icons/IconWarning.vue b/frontend/src/components/icons/IconWarning.vue
new file mode 100644
index 000000000..34c705414
--- /dev/null
+++ b/frontend/src/components/icons/IconWarning.vue
@@ -0,0 +1,29 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.9999 8.24979C12.4141 8.24979 12.7499 8.58557 12.7499 8.99979V13.9998C12.7499 14.414 12.4141 14.7498 11.9999 14.7498C11.5856 14.7498 11.2499 14.414 11.2499 13.9998V8.99979C11.2499 8.58557 11.5856 8.24979 11.9999 8.24979Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M11.9999 3.34229C11.2 3.34229 10.2322 3.89118 9.41576 5.3635L3.35577 16.2635C2.59528 17.6351 2.6278 18.717 3.0354 19.4114C3.44259 20.1051 4.36961 20.6598 5.93985 20.6598H11.9999C12.0417 20.6598 12.0827 20.6632 12.1226 20.6698H18.0599C19.6243 20.6698 20.5522 20.1155 20.9609 19.4208C21.3697 18.7258 21.4039 17.644 20.6439 16.2735L14.5843 5.36412C13.7679 3.8918 12.7997 3.34229 11.9999 3.34229ZM11.8771 22.1598H5.93985C4.04009 22.1598 2.50711 21.4745 1.7418 20.1707C0.976903 18.8676 1.12442 17.1945 2.04393 15.5361L8.10394 4.63607C9.0675 2.89878 10.4499 1.84229 11.9999 1.84229C13.5498 1.84229 14.9319 2.89814 15.8954 4.63545L21.9556 15.5458C22.8757 17.2052 23.02 18.8787 22.2538 20.1813C21.4875 21.4841 19.9554 22.1698 18.0599 22.1698H11.9999C11.958 22.1698 11.917 22.1664 11.8771 22.1598Z"
+    />
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M10.9944 16.9998C10.9944 16.4475 11.4421 15.9998 11.9944 15.9998H12.0033C12.5556 15.9998 13.0033 16.4475 13.0033 16.9998C13.0033 17.5521 12.5556 17.9998 12.0033 17.9998H11.9944C11.4421 17.9998 10.9944 17.5521 10.9944 16.9998Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/components/icons/IconWarningClear.vue b/frontend/src/components/icons/IconWarningClear.vue
new file mode 100644
index 000000000..efbd4ae90
--- /dev/null
+++ b/frontend/src/components/icons/IconWarningClear.vue
@@ -0,0 +1,22 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <svg
+    viewBox="0 0 24 24"
+    fill="currentColor"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      fill-rule="evenodd"
+      clip-rule="evenodd"
+      d="M12.2273 18.5455C12.9051 18.5455 13.4545 19.0949 13.4545 19.7727C13.4545 20.4505 12.9051 21 12.2273 21C11.5495 21 11 20.4505 11 19.7727C11 19.0949 11.5495 18.5455 12.2273 18.5455Z"
+    />
+    <path
+      d="M11 4.22727C11 3.54947 11.5495 3 12.2273 3C12.9051 3 13.4545 3.54947 13.4545 4.22727V14.8636C13.4545 15.5414 12.9051 16.0909 12.2273 16.0909C11.5495 16.0909 11 15.5414 11 14.8636V4.22727Z"
+    />
+  </svg>
+</template>
diff --git a/frontend/src/constants/index.ts b/frontend/src/constants/index.ts
new file mode 100644
index 000000000..ab57779d3
--- /dev/null
+++ b/frontend/src/constants/index.ts
@@ -0,0 +1,57 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+export enum TPodsViewFilterOptions {
+  ALL = "All",
+  PENDING = "Pending",
+  RUNNING = "Running",
+  FAILED = "Failed",
+  SUCCEEDED = "Succeeded",
+  UNKNOWN = "Unknown"
+}
+
+export enum NodesViewFilterOptions {
+  ALL = "All",
+  READY = "Ready",
+  UNKNOWN = "Unknown",
+  NOT_READY = "Not Ready",
+}
+
+export enum TServersServersFilterOptions {
+  ALL = "All",
+  ON = "On",
+  OFF = "Off",
+}
+
+export enum TServersStatusesFilterOptions {
+  ALL = "All",
+  READY = "Ready",
+  NOT_ACCEPTED = "Not Accepted",
+  FAILED = "Failed",
+}
+
+export enum TCommonStatuses {
+  ALL = "All",
+  READY = "Ready",
+  NOT_READY = "Not Ready",
+  PENDING = "Pending",
+  RUNNING = "Running",
+  SUCCEEDED = "Succeeded",
+  COMPLETED = "Completed",
+  FAILED = "Failed",
+  ERROR = 'Error',
+  UNKNOWN = "Unknown",
+  HEALTH_UNKNOWN = "Health Unknown",
+  UNHEALTHY = "Unhealthy",
+  HEALTHY = "Healthy",
+  ON = 'On',
+  OFF = 'Off',
+  TRUE = 'True',
+  FALSE = 'False',
+  UP_TO_DATE = 'Up-to-Date',
+  OUTDATED = 'Outdated',
+  APPLIED = 'Applied',
+  LOADING = "Loading...",
+}
\ No newline at end of file
diff --git a/frontend/src/context.ts b/frontend/src/context.ts
new file mode 100644
index 000000000..f2f9ca232
--- /dev/null
+++ b/frontend/src/context.ts
@@ -0,0 +1,55 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { ref } from 'vue';
+import { useRoute } from 'vue-router';
+import { WatchContext } from '@/api/watch';
+
+export namespace context {
+  export const current:any = ref(localStorage.context ? JSON.parse(localStorage.context) : null);
+
+  export const capabilities = {
+    capi: ref(false),
+    sidero: ref(false),
+    packet: ref(false),
+  };
+}
+
+export function changeContext(c: Object) {
+  localStorage.context = JSON.stringify(c);
+
+  context.current.value = c;
+}
+
+export function getContext(route: any = null): WatchContext {
+  route = route || useRoute();
+
+  const cluster = clusterName();
+
+  const res: WatchContext = {
+    cluster: cluster || "",
+  };
+
+  const machine = route.params.machine ?? route.query.machine;
+  if (machine) {
+    res.nodes = [machine];
+  }
+
+  return res;
+}
+
+export function clusterName(): string | null {
+  const route = useRoute();
+
+  if (route && route.params.cluster) {
+    return route.params.cluster as string;
+  }
+
+  if (route && route.query.cluster) {
+    return route.query.cluster as string;
+  }
+
+  return context.current.value ? context.current.value.name : null;
+}
\ No newline at end of file
diff --git a/frontend/src/fonts.css b/frontend/src/fonts.css
new file mode 100644
index 000000000..c0e4a255c
--- /dev/null
+++ b/frontend/src/fonts.css
@@ -0,0 +1,583 @@
+/*
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+*/
+
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek-ext */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2) format('woff2');
+  unicode-range: U+1F00-1FFF;
+}
+/* greek */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2) format('woff2');
+  unicode-range: U+0370-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2) format('woff2');
+  unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmSU5fBBc4.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/KFOmCnqEu92Fr1Mu5mxKOzY.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek-ext */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/KFOmCnqEu92Fr1Mu7mxKOzY.woff2) format('woff2');
+  unicode-range: U+1F00-1FFF;
+}
+/* greek */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/KFOmCnqEu92Fr1Mu4WxKOzY.woff2) format('woff2');
+  unicode-range: U+0370-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/KFOmCnqEu92Fr1Mu7WxKOzY.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2');
+  unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/KFOmCnqEu92Fr1Mu4mxK.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek-ext */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2');
+  unicode-range: U+1F00-1FFF;
+}
+/* greek */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2) format('woff2');
+  unicode-range: U+0370-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2) format('woff2');
+  unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 700;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 700;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek-ext */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 700;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2) format('woff2');
+  unicode-range: U+1F00-1FFF;
+}
+/* greek */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 700;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2) format('woff2');
+  unicode-range: U+0370-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 700;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 700;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2) format('woff2');
+  unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Roboto';
+  font-style: normal;
+  font-weight: 700;
+  font-display: swap;
+  src: url(fonts/KFOlCnqEu92Fr1MmWUlfBBc4.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3CWWoKC.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3mWWoKC.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm36WWoKC.woff2) format('woff2');
+  unicode-range: U+0370-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3KWWoKC.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3OWWoKC.woff2) format('woff2');
+  unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm32WWg.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3CWWoKC.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3mWWoKC.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm36WWoKC.woff2) format('woff2');
+  unicode-range: U+0370-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3KWWoKC.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3OWWoKC.woff2) format('woff2');
+  unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm32WWg.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3CWWoKC.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3mWWoKC.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm36WWoKC.woff2) format('woff2');
+  unicode-range: U+0370-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3KWWoKC.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3OWWoKC.woff2) format('woff2');
+  unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: italic;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/L0x7DF4xlVMF-BfR8bXMIjhOm32WWg.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhGq3-OXg.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhPq3-OXg.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhIq3-OXg.woff2) format('woff2');
+  unicode-range: U+0370-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhEq3-OXg.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhFq3-OXg.woff2) format('woff2');
+  unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 300;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhLq38.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhGq3-OXg.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhPq3-OXg.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhIq3-OXg.woff2) format('woff2');
+  unicode-range: U+0370-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhEq3-OXg.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhFq3-OXg.woff2) format('woff2');
+  unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhLq38.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
+/* cyrillic-ext */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhGq3-OXg.woff2) format('woff2');
+  unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
+}
+/* cyrillic */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhPq3-OXg.woff2) format('woff2');
+  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
+}
+/* greek */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhIq3-OXg.woff2) format('woff2');
+  unicode-range: U+0370-03FF;
+}
+/* vietnamese */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhEq3-OXg.woff2) format('woff2');
+  unicode-range: U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301, U+0303-0304, U+0308-0309, U+0323, U+0329, U+1EA0-1EF9, U+20AB;
+}
+/* latin-ext */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhFq3-OXg.woff2) format('woff2');
+  unicode-range: U+0100-02AF, U+0304, U+0308, U+0329, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+/* latin */
+@font-face {
+  font-family: 'Roboto Mono';
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url(fonts/L0x5DF4xlVMF-BfR8bXMIjhLq38.woff2) format('woff2');
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
+}
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2
new file mode 100644
index 000000000..cb5834ff8
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
new file mode 100644
index 000000000..29342a8de
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fBBc4.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2
new file mode 100644
index 000000000..0933dfe87
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2
new file mode 100644
index 000000000..064e94b78
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2
new file mode 100644
index 000000000..8571683e5
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2
new file mode 100644
index 000000000..68f094cde
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2
new file mode 100644
index 000000000..6b0b4afef
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2
new file mode 100644
index 000000000..9d7fb7f87
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fBBc4.woff2
new file mode 100644
index 000000000..60681387e
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fBBc4.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2
new file mode 100644
index 000000000..b289f0029
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2
new file mode 100644
index 000000000..87711c048
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2
new file mode 100644
index 000000000..0f6e60b8e
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2
new file mode 100644
index 000000000..91231c9c4
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2
new file mode 100644
index 000000000..c00998785
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2
new file mode 100644
index 000000000..1bb7737cd
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfABc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
new file mode 100644
index 000000000..771fbeccc
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfBBc4.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2
new file mode 100644
index 000000000..cb9bfa71f
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfBxc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2
new file mode 100644
index 000000000..a0d68e2b4
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfCBc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2
new file mode 100644
index 000000000..639955285
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfCRc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2
new file mode 100644
index 000000000..94ab5fb01
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfChc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2 b/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2
new file mode 100644
index 000000000..3c4501118
Binary files /dev/null and b/frontend/src/fonts/KFOlCnqEu92Fr1MmWUlfCxc4EsA.woff2 differ
diff --git a/frontend/src/fonts/KFOmCnqEu92Fr1Mu4WxKOzY.woff2 b/frontend/src/fonts/KFOmCnqEu92Fr1Mu4WxKOzY.woff2
new file mode 100644
index 000000000..fc71d944a
Binary files /dev/null and b/frontend/src/fonts/KFOmCnqEu92Fr1Mu4WxKOzY.woff2 differ
diff --git a/frontend/src/fonts/KFOmCnqEu92Fr1Mu4mxK.woff2 b/frontend/src/fonts/KFOmCnqEu92Fr1Mu4mxK.woff2
new file mode 100644
index 000000000..020729ef8
Binary files /dev/null and b/frontend/src/fonts/KFOmCnqEu92Fr1Mu4mxK.woff2 differ
diff --git a/frontend/src/fonts/KFOmCnqEu92Fr1Mu5mxKOzY.woff2 b/frontend/src/fonts/KFOmCnqEu92Fr1Mu5mxKOzY.woff2
new file mode 100644
index 000000000..47da36299
Binary files /dev/null and b/frontend/src/fonts/KFOmCnqEu92Fr1Mu5mxKOzY.woff2 differ
diff --git a/frontend/src/fonts/KFOmCnqEu92Fr1Mu72xKOzY.woff2 b/frontend/src/fonts/KFOmCnqEu92Fr1Mu72xKOzY.woff2
new file mode 100644
index 000000000..22ddee9c9
Binary files /dev/null and b/frontend/src/fonts/KFOmCnqEu92Fr1Mu72xKOzY.woff2 differ
diff --git a/frontend/src/fonts/KFOmCnqEu92Fr1Mu7GxKOzY.woff2 b/frontend/src/fonts/KFOmCnqEu92Fr1Mu7GxKOzY.woff2
new file mode 100644
index 000000000..8a8de615e
Binary files /dev/null and b/frontend/src/fonts/KFOmCnqEu92Fr1Mu7GxKOzY.woff2 differ
diff --git a/frontend/src/fonts/KFOmCnqEu92Fr1Mu7WxKOzY.woff2 b/frontend/src/fonts/KFOmCnqEu92Fr1Mu7WxKOzY.woff2
new file mode 100644
index 000000000..6284d2e3b
Binary files /dev/null and b/frontend/src/fonts/KFOmCnqEu92Fr1Mu7WxKOzY.woff2 differ
diff --git a/frontend/src/fonts/KFOmCnqEu92Fr1Mu7mxKOzY.woff2 b/frontend/src/fonts/KFOmCnqEu92Fr1Mu7mxKOzY.woff2
new file mode 100644
index 000000000..72ce0e984
Binary files /dev/null and b/frontend/src/fonts/KFOmCnqEu92Fr1Mu7mxKOzY.woff2 differ
diff --git a/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhEq3-OXg.woff2 b/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhEq3-OXg.woff2
new file mode 100644
index 000000000..171e3b617
Binary files /dev/null and b/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhEq3-OXg.woff2 differ
diff --git a/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhFq3-OXg.woff2 b/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhFq3-OXg.woff2
new file mode 100644
index 000000000..4d97d1fbe
Binary files /dev/null and b/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhFq3-OXg.woff2 differ
diff --git a/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhGq3-OXg.woff2 b/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhGq3-OXg.woff2
new file mode 100644
index 000000000..0dceac8c8
Binary files /dev/null and b/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhGq3-OXg.woff2 differ
diff --git a/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhIq3-OXg.woff2 b/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhIq3-OXg.woff2
new file mode 100644
index 000000000..847843c71
Binary files /dev/null and b/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhIq3-OXg.woff2 differ
diff --git a/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhLq38.woff2 b/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhLq38.woff2
new file mode 100644
index 000000000..81c20671d
Binary files /dev/null and b/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhLq38.woff2 differ
diff --git a/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhPq3-OXg.woff2 b/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhPq3-OXg.woff2
new file mode 100644
index 000000000..551e74bb4
Binary files /dev/null and b/frontend/src/fonts/L0x5DF4xlVMF-BfR8bXMIjhPq3-OXg.woff2 differ
diff --git a/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm32WWg.woff2 b/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm32WWg.woff2
new file mode 100644
index 000000000..a6ab54bec
Binary files /dev/null and b/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm32WWg.woff2 differ
diff --git a/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm36WWoKC.woff2 b/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm36WWoKC.woff2
new file mode 100644
index 000000000..73d6c1b54
Binary files /dev/null and b/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm36WWoKC.woff2 differ
diff --git a/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3CWWoKC.woff2 b/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3CWWoKC.woff2
new file mode 100644
index 000000000..dc7aa80e0
Binary files /dev/null and b/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3CWWoKC.woff2 differ
diff --git a/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3KWWoKC.woff2 b/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3KWWoKC.woff2
new file mode 100644
index 000000000..c5e35ac30
Binary files /dev/null and b/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3KWWoKC.woff2 differ
diff --git a/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3OWWoKC.woff2 b/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3OWWoKC.woff2
new file mode 100644
index 000000000..3d8b441f6
Binary files /dev/null and b/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3OWWoKC.woff2 differ
diff --git a/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3mWWoKC.woff2 b/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3mWWoKC.woff2
new file mode 100644
index 000000000..77bdce6c0
Binary files /dev/null and b/frontend/src/fonts/L0x7DF4xlVMF-BfR8bXMIjhOm3mWWoKC.woff2 differ
diff --git a/frontend/src/index.css b/frontend/src/index.css
new file mode 100644
index 000000000..97eea8399
--- /dev/null
+++ b/frontend/src/index.css
@@ -0,0 +1,164 @@
+/*
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+*/
+
+/* ./src/index.css */
+@import url("fonts.css");
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+body {
+  font-family: "Roboto", sans-serif;
+}
+
+*:focus{
+  outline: none;
+}
+
+*::-webkit-scrollbar {
+  @apply w-1.5 h-1.5;
+  background-color: transparent;
+}
+
+*::-webkit-scrollbar-thumb {
+  @apply w-1.5 h-1.5 bg-naturals-N5 border border-naturals-N4 rounded;
+}
+
+body {
+  --tw-bg-opacity: 1;
+  background-color: rgba(16, 17, 24, var(--tw-bg-opacity));
+}
+
+.modal-window {
+  @apply rounded bg-naturals-N3 z-30 p-8 flex flex-col w-1/3;
+}
+
+.list-item-link {
+  @apply font-bold text-naturals-N14 hover:text-naturals-N9 transition;
+}
+
+@layer components {
+  .resource-label {
+    @apply rounded border px-2 py-0.5;
+    --background-alpha: 0.18;
+    --border-alpha: 0.3;
+    --lighten-by: 20;
+    color: hsl(var(--label-h), calc(var(--label-s) * 1%), calc((var(--label-l) + var(--lighten-by)) * 1%));
+    background-color: hsla(var(--label-h), calc(var(--label-s) * 1%), calc((var(--label-l) + var(--lighten-by)) * 1%), var(--background-alpha));
+    border-color: hsla(var(--label-h), calc(var(--label-s) * 1%), calc((var(--label-l) + var(--lighten-by)) * 1%), var(--border-alpha));
+  }
+}
+
+.label-green {
+  --label-h: 142;
+  --label-s: 100;
+  --label-l: 49;
+}
+
+.label-red {
+  --label-h: 359;
+  --label-s: 97;
+  --label-l: 36;
+}
+
+.label-orange {
+  --label-h: 15;
+  --label-s: 90;
+  --label-l: 44;
+}
+
+.label-violet {
+  --label-h: 313;
+  --label-s: 97;
+  --label-l: 58;
+}
+
+.label-yellow {
+  --label-h: 48;
+  --label-s: 96;
+  --label-l: 50;
+}
+
+.label-cyan {
+  --label-h: 185;
+  --label-s: 100;
+  --label-l: 22;
+}
+
+.label-blue1 {
+  --label-h: 211;
+  --label-s: 76;
+  --label-l: 48;
+}
+
+.label-blue2 {
+  --label-h: 215;
+  --label-s: 100;
+  --label-l: 40;
+}
+
+.label-blue3 {
+  --label-h: 256;
+  --label-s: 81;
+  --label-l: 50;
+}
+
+.label-light1 {
+  --label-h: 0;
+  --label-s: 65;
+  --label-l: 74;
+  --lighten-by: 0;
+}
+
+.label-light2 {
+  --label-h: 13;
+  --label-s: 81;
+  --label-l: 87;
+  --lighten-by: 0;
+}
+
+.label-light3 {
+  --label-h: 48;
+  --label-s: 96;
+  --label-l: 87;
+  --lighten-by: 0;
+}
+
+.label-light4 {
+  --label-h: 128;
+  --label-s: 32;
+  --label-l: 81;
+  --lighten-by: 0;
+}
+
+.label-light5 {
+  --label-h: 184;
+  --label-s: 29;
+  --label-l: 80;
+  --lighten-by: 0;
+}
+
+.label-light6 {
+  --label-h: 208;
+  --label-s: 70;
+  --label-l: 86;
+  --lighten-by: 0;
+}
+
+.label-light7 {
+  --label-h: 257;
+  --label-s: 81;
+  --label-l: 87;
+  --lighten-by: 0;
+}
+
+.label-grayed-out {
+  --label-h: 257;
+  --label-s: 81;
+  --label-l: 87;
+  --lighten-by: 100;
+}
diff --git a/frontend/src/main.ts b/frontend/src/main.ts
new file mode 100644
index 000000000..097931d9e
--- /dev/null
+++ b/frontend/src/main.ts
@@ -0,0 +1,86 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import "@stardazed/streams-polyfill";
+import { createApp } from 'vue';
+import '@/index.css';
+import App from '@/App.vue'
+import VueClipboard from 'vue3-clipboard';
+import AppUnavailable from '@/AppUnavailable.vue'
+import router from '@/router';
+
+import { initState, ResourceService, ResourceTyped } from "@/api/grpc";
+import { AuthConfigID, AuthConfigType, DefaultNamespace } from "@/api/resources";
+import { Runtime } from "@/api/common/omni.pb";
+import { AuthConfigSpec } from "@/api/omni/specs/auth.pb";
+import { AuthType, authType, suspended } from "@/methods";
+import { createAuth0 } from "@auth0/auth0-vue";
+import yaml from "js-yaml";
+import { withRuntime } from "./api/options";
+import vClickOutside from "click-outside-vue3"
+
+const setupApp = async () => {
+  let authConfigSpec: AuthConfigSpec | undefined = undefined
+
+  try {
+    const authConfig: ResourceTyped<AuthConfigSpec> = await ResourceService.Get({
+      namespace: DefaultNamespace,
+      type: AuthConfigType,
+      id: AuthConfigID,
+    }, withRuntime(Runtime.Omni));
+
+    authConfigSpec = authConfig?.spec as AuthConfigSpec | undefined;
+  } catch (e) {
+    console.error("failed to get auth parameters", e)
+    createApp(AppUnavailable).mount('#app');
+    return
+  }
+
+  suspended.value = authConfigSpec?.suspended ?? false;
+
+  if (authConfigSpec?.saml?.enabled) {
+    authType.value = AuthType.SAML;
+  } else if (authConfigSpec?.auth0?.enabled) {
+    authType.value = AuthType.Auth0;
+  }
+
+  let app = createApp(App)
+    .use(router)
+    .use(VueClipboard, {
+      autoSetContainer: true,
+      appendToBody: true,
+    })
+
+  if (authType.value === AuthType.Auth0) {
+    app = app.use(createAuth0({
+      domain: authConfigSpec!.auth0?.domain!,
+      client_id: authConfigSpec!.auth0?.client_id!,
+      redirect_uri: window.location.origin,
+    }))
+  }
+
+  app.use(vClickOutside);
+  app.mount('#app');
+}
+
+initState();
+
+setupApp()
+
+window["jsyaml"] = yaml;
+
+// noinspection JSUnusedGlobalSymbols
+window["MonacoEnvironment"] = {
+  getWorker(moduleId, label: string) {
+    switch (label) {
+      case "editorWorkerService":
+        return new Worker(new URL("monaco-editor/esm/vs/editor/editor.worker", import.meta.url))
+      case "yaml":
+        return new Worker(new URL("monaco-yaml/yaml.worker", import.meta.url));
+      default:
+        throw new Error(`Unknown label ${label}`);
+    }
+  },
+};
\ No newline at end of file
diff --git a/frontend/src/methods/auth.ts b/frontend/src/methods/auth.ts
new file mode 100644
index 000000000..47af99e60
--- /dev/null
+++ b/frontend/src/methods/auth.ts
@@ -0,0 +1,145 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import {
+  CurrentUserID,
+  CurrentUserType,
+  VirtualNamespace,
+  PermissionsType,
+  PermissionsID,
+  ClusterPermissionsType
+} from "@/api/resources";
+
+import { ResourceService, ResourceTyped } from "@/api/grpc";
+import { Runtime } from "@/api/common/omni.pb";
+import { CurrentUserSpec, PermissionsSpec } from "@/api/omni/specs/virtual.pb";
+import { computed, ComputedRef, onBeforeMount, ref, Ref, watch } from "vue";
+import { withRuntime } from "@/api/options";
+
+export const currentUser: Ref<ResourceTyped<CurrentUserSpec> | undefined> = ref();
+export const permissions: Ref<ResourceTyped<PermissionsSpec> | undefined> = ref();
+
+export const setupClusterPermissions = (cluster: {value: string}) => {
+  const result = {
+    canUpdateKubernetes: ref(false),
+    canUpdateTalos: ref(false),
+    canDownloadTalosconfig: ref(false),
+    canDownloadKubeconfig: ref(false),
+    canAddClusterMachines: ref(false),
+    canRemoveClusterMachines: ref(false),
+    canSyncKubernetesManifests: ref(false),
+    canReadConfigPatches: ref(false),
+    canManageConfigPatches: ref(false),
+    canRebootMachines: ref(false),
+    canRemoveMachines: ref(false),
+    canManageClusterFeatures: ref(false),
+  }
+
+  const updatePermissions = async () => {
+    const clusterPermissions = await ResourceService.Get({
+      namespace: VirtualNamespace,
+      type: ClusterPermissionsType,
+      id: cluster.value,
+    }, withRuntime(Runtime.Omni))
+
+    result.canUpdateKubernetes.value = clusterPermissions?.spec?.can_update_kubernetes || false;
+    result.canUpdateTalos.value = clusterPermissions?.spec?.can_update_talos || false;
+    result.canDownloadKubeconfig.value = clusterPermissions?.spec?.can_download_kubeconfig || false;
+    result.canDownloadTalosconfig.value = clusterPermissions?.spec?.can_download_talosconfig || false;
+    result.canAddClusterMachines.value = clusterPermissions?.spec?.can_add_machines || false;
+    result.canRemoveClusterMachines.value = clusterPermissions?.spec?.can_remove_machines || false;
+    result.canSyncKubernetesManifests.value = clusterPermissions?.spec?.can_sync_kubernetes_manifests || false;
+    result.canReadConfigPatches.value = clusterPermissions?.spec?.can_read_config_patches || false;
+    result.canManageConfigPatches.value = clusterPermissions?.spec?.can_manage_config_patches || false;
+    result.canRebootMachines.value = clusterPermissions?.spec?.can_reboot_machines || false;
+    result.canRemoveMachines.value = clusterPermissions?.spec?.can_remove_machines || false;
+    result.canManageClusterFeatures.value = clusterPermissions?.spec?.can_manage_cluster_features || false;
+  }
+
+  onBeforeMount(updatePermissions);
+  watch(cluster, updatePermissions);
+
+  return result
+};
+
+export const canManageUsers: ComputedRef<boolean> = computed(() => {
+  return permissions?.value?.spec?.can_manage_users ?? false;
+});
+
+export const canReadClusters: ComputedRef<boolean> = computed(() => {
+  return permissions?.value?.spec?.can_read_clusters ?? false;
+});
+
+export const canReadMachines: ComputedRef<boolean> = computed(() => {
+  return permissions?.value?.spec?.can_read_machines ?? false;
+});
+
+export const canCreateClusters: ComputedRef<boolean> = computed(() => {
+  return permissions?.value?.spec?.can_create_clusters ?? false;
+});
+
+export const canRemoveMachines: ComputedRef<boolean> = computed(() => {
+  return permissions?.value?.spec?.can_remove_machines ?? false;
+});
+
+export const canReadMachineLogs: ComputedRef<boolean> = computed(() => {
+  return permissions?.value?.spec?.can_read_machine_logs ?? false;
+});
+
+export const canReadMachineConfigPatches: ComputedRef<boolean> = computed(() => {
+  return permissions?.value?.spec?.can_read_machine_config_patches ?? false;
+});
+
+export const canManageMachineConfigPatches: ComputedRef<boolean> = computed(() => {
+  return permissions?.value?.spec?.can_manage_machine_config_patches ?? false;
+});
+
+export const canManageBackupStore: ComputedRef<boolean> = computed(() => {
+  return permissions?.value?.spec?.can_manage_backup_store ?? false;
+});
+
+export const loadCurrentUser = async () => {
+  if (!currentUser.value) {
+    await refreshCurrentUser();
+  }
+
+  if (!permissions.value) {
+    await refreshPermissions();
+  }
+}
+
+const refreshCurrentUser = async () => {
+  if (!window.localStorage.getItem("identity")) {
+    currentUser.value = undefined;
+    return;
+  }
+
+  try {
+    currentUser.value = await ResourceService.Get({
+      namespace: VirtualNamespace,
+      type: CurrentUserType,
+      id: CurrentUserID,
+    }, withRuntime(Runtime.Omni));
+  } catch (e) {
+    currentUser.value = undefined;
+  }
+}
+
+const refreshPermissions = async () => {
+  if (!currentUser.value) {
+    permissions.value = undefined;
+    return;
+  }
+
+  try {
+    permissions.value = await ResourceService.Get({
+      namespace: VirtualNamespace,
+      type: PermissionsType,
+      id: PermissionsID,
+    }, withRuntime(Runtime.Omni));
+  } catch (e) {
+    permissions.value = undefined;
+  }
+}
diff --git a/frontend/src/methods/cluster.ts b/frontend/src/methods/cluster.ts
new file mode 100644
index 000000000..d2b8dbf33
--- /dev/null
+++ b/frontend/src/methods/cluster.ts
@@ -0,0 +1,491 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import {
+  ClusterType,
+  ConfigPatchType,
+  DefaultNamespace,
+  EphemeralNamespace,
+  EtcdManualBackupType,
+  KubernetesUpgradeStatusType,
+  LabelCluster,
+  LabelMachine,
+  LabelMachineSet,
+  MachineSetNodeType,
+  MachineSetType,
+  TalosUpgradeStatusType
+} from "@/api/resources";
+import {
+  ClusterSpec,
+  EtcdManualBackupSpec,
+  KubernetesUpgradeStatusSpec,
+  MachineSetNodeSpec,
+  TalosUpgradeStatusSpec
+} from "@/api/omni/specs/omni.pb";
+import { Metadata } from "@/api/v1alpha1/resource.pb";
+import { Resource, ResourceService, ResourceTyped } from "@/api/grpc";
+import { Runtime } from "@/api/common/omni.pb";
+import { withRuntime, withSelectors, withTimeout } from "@/api/options";
+import { isEqual } from "lodash";
+
+import { Ref } from "vue";
+import { Code } from "@/api/google/rpc/code.pb";
+import { DeleteRequest } from "@/api/omni/resources/resources.pb";
+import { parseLabels } from "@/methods/labels";
+import { controlPlaneMachineSetId } from "@/methods/machineset";
+import { time } from "./time";
+
+export type MachineConfig = {
+  role?: string,
+  configPatch: string,
+  installDisk?: string,
+  id?: string,
+}
+
+type MachineSetNode = {
+  metadata: Metadata
+  spec: MachineSetNodeSpec
+}
+
+const createResources = async (resources: Resource[]) => {
+  for (const resource of resources) {
+    try {
+      await ResourceService.Create(
+        resource,
+        withRuntime(Runtime.Omni),
+      );
+    } catch (e) {
+      throw new ClusterCommandError(
+        `Failed to Create ${resource.metadata.type}(${resource.metadata.namespace}/${resource.metadata.id}})`,
+        `The resource creation failed with the error: ${e.message}`
+      );
+    }
+  }
+}
+
+const updateResource = async<T extends Resource> (metadata: Metadata, updater: (spec: T) => void) => {
+  const resource: T = await ResourceService.Get<T>({
+    type: metadata.type,
+    namespace: metadata.namespace,
+    id: metadata.id,
+  }, withRuntime(Runtime.Omni));
+
+  updater(resource);
+
+  await ResourceService.Update<T>(
+    resource,
+    resource.metadata.version,
+    withRuntime(Runtime.Omni),
+  );
+}
+
+const timeout = 10 * 60 * 1000; // 10 minutes
+
+export const destroyResources = async (resources: DeleteRequest[], phase?: Ref<string>) => {
+  for (const request of resources) {
+    try {
+      if (phase) {
+        phase.value = `Destroying resource ${request.type}(${request.namespace}/${request.id}`
+      }
+
+      await ResourceService.Delete(
+        request,
+        withRuntime(Runtime.Omni),
+        withTimeout(timeout),
+      );
+    } catch (e) {
+      if (e.code != Code.NOT_FOUND) {
+        throw e;
+      }
+    }
+  }
+}
+
+export class ClusterCommandError extends Error {
+  private title: string;
+
+  constructor(title: string, msg: string) {
+      super(msg);
+
+      this.title = title;
+
+      Object.setPrototypeOf(this, ClusterCommandError.prototype);
+  }
+
+  get errorNotification(): {title: string, details: string} {
+    return {
+      title: this.title,
+      details: this.message,
+    };
+  }
+}
+
+export const clusterSync = async (resources: Resource[], old?: Resource[]) => {
+  let toCreate = resources;
+  const toUpdate: Resource[] = [];
+  const toDestroy: DeleteRequest[] = [];
+
+  if (old) {
+    const resourcesMap: Record<string, Resource> = {};
+    old.forEach(item => {
+      resourcesMap[`${item.metadata.type}/${item.metadata.id}`] = item;
+    });
+
+    toCreate = [];
+    resources.forEach(item => {
+      const id = `${item.metadata.type}/${item.metadata.id}`;
+      const existing = resourcesMap[id];
+
+      delete resourcesMap[id];
+
+      if (!existing) {
+        toCreate.push(item);
+
+        return;
+      }
+
+      if (!isEqual(existing.metadata.labels ?? {}, item.metadata.labels ?? {})
+       || !isEqual(existing.metadata.annotations ?? {}, item.metadata.annotations ?? {})
+       || !isEqual(existing.spec, item.spec)) {
+        toUpdate.push(item);
+
+        return;
+      }
+    });
+
+    for (const key in resourcesMap) {
+      const md = resourcesMap[key].metadata;
+      toDestroy.push({
+        id: md.id,
+        namespace: md.namespace,
+        type: md.type,
+      });
+    }
+  }
+
+  await createResources(toCreate);
+
+  for (const res of toUpdate) {
+    await updateResource(res.metadata, (r: Resource) => {
+      r.metadata.annotations = res.metadata.annotations;
+      r.metadata.labels = res.metadata.labels;
+      r.spec = res.spec;
+    })
+  }
+
+  for (const res of toDestroy) {
+    try {
+      switch (res.type) {
+        case MachineSetType:
+        case ClusterType:
+          await ResourceService.Teardown(res, withRuntime(Runtime.Omni));
+
+          break;
+        default:
+          await ResourceService.Delete(res, withRuntime(Runtime.Omni));
+      }
+    } catch (e) {
+      if (e.code !== Code.NOT_FOUND) {
+        throw e;
+      }
+    }
+  }
+}
+
+export const getMachineConfigPatchesToDelete = async (machineID: string) => {
+  const resources: DeleteRequest[] = [];
+
+  try {
+    const patches: Resource[] = await ResourceService.List({
+      namespace: DefaultNamespace,
+      type: ConfigPatchType,
+    },
+    withRuntime(Runtime.Omni),
+    withSelectors([`${LabelMachine}=${machineID}`]));
+
+    for (const patch of patches) {
+      resources.push({
+        id: patch.metadata.id!,
+        namespace: patch.metadata.namespace!,
+        type: patch.metadata.type!,
+      });
+    }
+  } catch (e) {
+    throw new ClusterCommandError(
+      `Failed to Destroy Machine ${machineID}`,
+      "Failed to fetch machine patches for the node"
+    );
+  }
+
+  return resources;
+}
+
+export const destroyNodes = async (clusterName: string, ids: string[], ownerSkipHandler?: (s?: string) => boolean) => {
+  const machineSetNodes: Record<string, MachineSetNode> = {};
+  let controlPlanes = 0;
+
+  try {
+    const resp: Resource[] = await ResourceService.List({
+      namespace: DefaultNamespace,
+      type: MachineSetNodeType,
+    },
+    withRuntime(Runtime.Omni),
+    withSelectors([`${LabelCluster}=${clusterName}`]));
+
+    for (const item of resp) {
+      machineSetNodes[item.metadata.id!] = item;
+
+      if (!item.metadata.labels) {
+        item.metadata.labels = {};
+      }
+
+      if (item.metadata.labels[LabelMachineSet] === controlPlaneMachineSetId(clusterName)) {
+        controlPlanes++;
+      }
+    }
+  } catch (e) {
+    throw new ClusterCommandError(
+      "Failed to Destroy Node",
+      `Failed to fetch the machine set nodes: ${e.message}`
+    );
+  }
+
+  const resources: DeleteRequest[] = [];
+
+  for (const id of ids) {
+    if (ownerSkipHandler && ownerSkipHandler(machineSetNodes[id]?.metadata?.owner)) {
+      continue;
+    }
+
+    if ((machineSetNodes[id].metadata?.labels || {})[LabelMachineSet] === controlPlaneMachineSetId(clusterName) && controlPlanes === 1) {
+      throw new ClusterCommandError(
+        `Failed to Destroy Node ${id}`,
+        "The cluster should have at least one control plane running"
+      );
+    }
+
+    if (!machineSetNodes[id]?.metadata) {
+      throw new ClusterCommandError(
+        `Failed to Destroy Node ${id}`,
+        "The node with such id is not part of the cluster"
+      );
+    }
+
+    const md = machineSetNodes[id].metadata;
+
+    resources.push({
+      id: md.id!,
+      namespace: md.namespace!,
+      type: md.type!,
+    });
+  }
+
+  await destroyResources(resources);
+}
+
+export const restoreNode = async (clusterMachine: Resource) => {
+  const clusterName = clusterMachine.metadata.labels?.[LabelCluster];
+  const machineSetID = clusterMachine.metadata.labels?.[LabelMachineSet];
+
+  try {
+    if (!clusterName || !machineSetID) {
+      throw new ClusterCommandError(
+        "Failed To Rollback Machine Set Node",
+        "Corresponding cluster machine doesn't have cluster name or machine set labels",
+      )
+    }
+
+    await createResources([{
+      metadata: {
+        namespace: DefaultNamespace,
+        type: MachineSetNodeType,
+        id: clusterMachine.metadata.id,
+        labels: {
+          [LabelCluster]: clusterName,
+          [LabelMachineSet]: machineSetID
+        }
+      },
+      spec: {}
+    }])
+  } catch (e) {
+    throw new ClusterCommandError(
+      "Failed To Rollback Machine Set Node",
+      `Failed to restore machine set node ${clusterMachine.metadata.id} for ${clusterName}: ${e.message}`
+    );
+  }
+}
+
+export const clusterDestroy = async (clusterName: string) => {
+  await ResourceService.Teardown(
+    {
+      namespace: DefaultNamespace,
+      type: ClusterType,
+      id: clusterName,
+    },
+    withRuntime(Runtime.Omni),
+    withTimeout(timeout),
+  );
+}
+
+export const nextAvailableClusterName = async (prefix: string) => {
+  const clusters: ResourceTyped<ClusterSpec>[] = await ResourceService.List({
+    namespace: DefaultNamespace,
+    type: ClusterType,
+  }, withRuntime(Runtime.Omni));
+
+  const nameSet = new Set(clusters.map(item => item.metadata.id!));
+
+  if (!nameSet.has(prefix)) {
+    return prefix;
+  }
+
+  let lastNum = 0;
+
+  while (nameSet.has(`${prefix}-${lastNum + 1}`)) {
+    lastNum++;
+  }
+
+  return `${prefix}-${lastNum + 1}`;
+}
+
+export const upgradeKubernetes = async(clusterName: string, version: string) => {
+  await updateResource<Resource<ClusterSpec>>({
+    namespace: DefaultNamespace,
+    type: ClusterType,
+    id: clusterName,
+  }, (res: Resource<ClusterSpec>) => {
+    res.spec.kubernetes_version = version;
+  })
+}
+
+export const updateTalos = async(clusterName: string, version: string) => {
+  await updateResource<Resource<ClusterSpec>>({
+    namespace: DefaultNamespace,
+    type: ClusterType,
+    id: clusterName,
+  }, (res: Resource<ClusterSpec>) => {
+    res.spec.talos_version = version;
+  })
+}
+
+export const revertKubernetesUpgrade = async(clusterName: string) => {
+  const upgradeStatus: ResourceTyped<TalosUpgradeStatusSpec | KubernetesUpgradeStatusSpec> = await ResourceService.Get({
+      namespace: DefaultNamespace,
+      type: KubernetesUpgradeStatusType,
+      id: clusterName,
+    }, withRuntime(Runtime.Omni))
+
+  await upgradeKubernetes(clusterName, upgradeStatus.spec.last_upgrade_version!);
+}
+
+export const revertTalosUpgrade = async(clusterName: string) => {
+  const upgradeStatus: ResourceTyped<TalosUpgradeStatusSpec | KubernetesUpgradeStatusSpec> = await ResourceService.Get({
+      namespace: DefaultNamespace,
+      type: TalosUpgradeStatusType,
+      id: clusterName,
+    }, withRuntime(Runtime.Omni))
+
+  await updateTalos(clusterName, upgradeStatus.spec.last_upgrade_version!);
+}
+
+export const addClusterLabels = async (clusterID: string, ...labels: string[]) => {
+  const resource: ResourceTyped<ClusterSpec> = await ResourceService.Get({
+    type: ClusterType,
+    namespace: DefaultNamespace,
+    id: clusterID
+  }, withRuntime(Runtime.Omni));
+
+  resource.metadata.labels = {
+    ...parseLabels(...labels),
+    ...resource.metadata.labels
+  };
+
+  await ResourceService.Update(resource, resource.metadata.version, withRuntime(Runtime.Omni));
+};
+
+export const removeClusterLabels = async (clusterID: string, ...keys: string[]) => {
+  const resource: ResourceTyped<ClusterSpec> = await ResourceService.Get({
+    type: ClusterType,
+    namespace: DefaultNamespace,
+    id: clusterID
+  }, withRuntime(Runtime.Omni));
+
+  if (!resource.metadata.labels) {
+    return;
+  }
+
+  for (const key of keys) {
+    delete (resource.metadata.labels[key]);
+  }
+
+  await ResourceService.Update(resource, undefined, withRuntime(Runtime.Omni));
+}
+
+export const setClusterWorkloadProxy = async (clusterID: string, enabled: boolean) => {
+  const resource: ResourceTyped<ClusterSpec> = await ResourceService.Get({
+    type: ClusterType,
+    namespace: DefaultNamespace,
+    id: clusterID
+  }, withRuntime(Runtime.Omni));
+
+  if (!resource.spec.features) {
+    resource.spec.features = {}
+  }
+
+  resource.spec.features.enable_workload_proxy = enabled;
+
+  await ResourceService.Update(resource, resource.metadata.version, withRuntime(Runtime.Omni));
+};
+
+export const setClusterEtcdBackupsConfig = async (clusterID: string, spec: ClusterSpec) => {
+  const resource: ResourceTyped<ClusterSpec> = await ResourceService.Get({
+    type: ClusterType,
+    namespace: DefaultNamespace,
+    id: clusterID
+  }, withRuntime(Runtime.Omni));
+
+  if (isEqual(resource.spec.backup_configuration, spec.backup_configuration)) {
+    return;
+  }
+
+  resource.spec.backup_configuration = spec.backup_configuration;
+
+
+  await ResourceService.Update(resource, resource.metadata.version, withRuntime(Runtime.Omni));
+}
+
+export const triggerEtcdBackup = async (clusterID: string) => {
+  const metadata = {
+    type: EtcdManualBackupType,
+    namespace: EphemeralNamespace,
+    id: clusterID,
+  };
+
+  let exists = false;
+
+  let manualBackup: ResourceTyped<EtcdManualBackupSpec>;
+  try {
+    manualBackup = await ResourceService.Get(metadata, withRuntime(Runtime.Omni));
+
+    exists = true;
+  } catch (e) {
+    if (e.code !== Code.NOT_FOUND) {
+      throw e;
+    }
+
+    manualBackup = {
+      metadata,
+      spec: {},
+    }
+  }
+
+  manualBackup.spec.backup_at = time.isoNow();
+
+  if (!exists) {
+    return await ResourceService.Create(manualBackup, withRuntime(Runtime.Omni));
+  }
+
+  return await ResourceService.Update(manualBackup, undefined, withRuntime(Runtime.Omni));
+}
diff --git a/frontend/src/methods/features.ts b/frontend/src/methods/features.ts
new file mode 100644
index 000000000..961c5d204
--- /dev/null
+++ b/frontend/src/methods/features.ts
@@ -0,0 +1,28 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { computed, Ref, ref } from "vue";
+import { ResourceTyped } from "@/api/grpc";
+import { FeaturesConfigSpec } from "@/api/omni/specs/omni.pb";
+import Watch from "@/api/watch";
+import { Runtime } from "@/api/common/omni.pb";
+import { FeaturesConfigType, DefaultNamespace, FeaturesConfigID } from "@/api/resources";
+
+export const setupWorkloadProxyingEnabledFeatureWatch = (): Ref<boolean> => {
+  const featuresConfig: Ref<ResourceTyped<FeaturesConfigSpec> | undefined> = ref();
+  const featuresConfigWatch = new Watch(featuresConfig);
+  featuresConfigWatch.setup({
+    resource: {
+      type: FeaturesConfigType,
+      namespace: DefaultNamespace,
+      id: FeaturesConfigID,
+    },
+    runtime: Runtime.Omni,
+  });
+
+  return computed(() => {
+    return featuresConfig?.value?.spec?.enable_workload_proxying ?? false;
+  });
+}
diff --git a/frontend/src/methods/index.ts b/frontend/src/methods/index.ts
new file mode 100644
index 000000000..042b0db3c
--- /dev/null
+++ b/frontend/src/methods/index.ts
@@ -0,0 +1,204 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { ManagementService } from "@/api/omni/management/management.pb";
+import { NodesViewFilterOptions, TCommonStatuses } from "@/constants";
+import { showError } from "@/notification";
+import { ComputedRef, Ref, computed, ref } from "vue";
+import { DefaultNamespace, DefaultTalosVersion, EtcdBackupOverallStatusID, EtcdBackupOverallStatusType } from "@/api/resources";
+import { withContext } from "@/api/options";
+import { fetchOption } from "@/api/fetch.pb";
+import { Node } from "kubernetes-types/core/v1";
+import { Resource } from "@/api/grpc";
+import { EtcdBackupOverallStatusSpec } from "@/api/omni/specs/omni.pb";
+import Watch from "@/api/watch";
+import { Runtime } from "@/api/common/omni.pb";
+
+export const getStatus = (item: Node) => {
+  const conditions = item?.status?.conditions;
+  if (!conditions) return TCommonStatuses.LOADING;
+
+  for (const c of conditions) {
+    if (c.type === NodesViewFilterOptions.READY && c.status === "True")
+      return NodesViewFilterOptions.READY;
+  }
+
+  return NodesViewFilterOptions.NOT_READY;
+};
+
+export const getServiceHealthStatus = (service) => {
+  return service?.spec?.unknown
+    ? TCommonStatuses.HEALTH_UNKNOWN
+    : service?.spec?.healthy
+    ? TCommonStatuses.READY
+    : TCommonStatuses.UNHEALTHY;
+};
+
+export const cpuParser = (input)=> {
+  const milliMatch = input.match(/^([0-9]+)m$/);
+  if (milliMatch) {
+    return milliMatch[1] / 1000;
+  }
+
+  return parseFloat(input);
+}
+
+const memoryMultipliers = {
+  k: 1000,
+  M: 1000 ** 2,
+  G: 1000 ** 3,
+  T: 1000 ** 4,
+  P: 1000 ** 5,
+  E: 1000 ** 6,
+  Ki: 1024,
+  Mi: 1024 ** 2,
+  Gi: 1024 ** 3,
+  Ti: 1024 ** 4,
+  Pi: 1024 ** 5,
+  Ei: 1024 ** 6,
+};
+
+export const memoryParser = (input) => {
+  const unitMatch = input.match(/^([0-9]+)([A-Za-z]{1,2})$/);
+  if (unitMatch) {
+    return parseInt(unitMatch[1], 10) * memoryMultipliers[unitMatch[2]];
+  }
+
+  return parseInt(input, 10);
+}
+
+export const formatBytes = (bytes, decimals = 2) => {
+  if (!bytes) return '0 Bytes';
+
+  const k = 1024;
+  const dm = decimals < 0 ? 0 : decimals;
+  const sizes = ['Bytes', 'KB', 'MB', 'GB', 'TB', 'PB', 'EB', 'ZB', 'YB'];
+
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+
+  return (bytes / Math.pow(k, i)).toFixed(dm) + ' ' + sizes[i];
+}
+
+export const downloadKubeconfig = async (cluster: string) => {
+  const link = document.createElement("a");
+  try {
+    const response = await ManagementService.Kubeconfig(
+      {},
+      withContext({cluster}),
+    );
+
+    link.href = `data:application/octet-stream;charset=utf-16le;base64,${response.kubeconfig}`;
+    link.download = `${cluster}-kubeconfig.yaml`;
+    link.click();
+  } catch (e) {
+    showError("Failed to download Kubeconfig", e.message || e.toString());
+  }
+};
+
+export const downloadTalosconfig = async (cluster?: string) => {
+  const link = document.createElement("a");
+  const opts: fetchOption[] = [];
+
+  if (cluster) {
+    opts.push(withContext({cluster}));
+  }
+
+  try {
+    const response = await ManagementService.Talosconfig(
+      {},
+      ...opts,
+    );
+
+    link.href = `data:application/octet-stream;charset=utf-16le;base64,${response.talosconfig}`;
+    link.download = cluster ? `${cluster}-talosconfig.yaml` : "talosconfig.yaml";
+    link.click();
+  } catch (e) {
+    showError("Failed to download Talosconfig", e.message || e.toString());
+  }
+};
+
+export const downloadOmniconfig = async () => {
+  const link = document.createElement("a");
+  try {
+    const response = await ManagementService.Omniconfig(
+      {},
+    );
+
+    link.href = `data:application/octet-stream;charset=utf-16le;base64,${response.omniconfig}`;
+    link.download = "omniconfig.yaml";
+    link.click();
+  } catch (e) {
+    showError("Failed to download omniconfig", e.message || e.toString());
+  }
+};
+
+export const downloadTalosctl = async () => {
+  const link = document.createElement("a");
+
+  try {
+    link.href = `https://github.com/siderolabs/talos/releases/v${DefaultTalosVersion}`;
+    link.target = "_blank";
+    link.click();
+  } catch (e) {
+    showError("Failed to download talosctl", e.message || e.toString());
+  }
+};
+
+export const suspended = ref(false);
+
+export enum AuthType {
+  None = 0,
+  Auth0 = 1,
+  SAML = 2,
+}
+
+export const authType: Ref<AuthType> = ref(AuthType.None);
+
+export type BackupsStatus = {
+  enabled: boolean
+  error?: string
+  configurable?: boolean
+  store?: string
+};
+
+const capitalize = (w: string) => {
+  return `${w.charAt(0).toUpperCase()}${w.slice(1)}`
+}
+
+export const setupBackupStatus = (): { status: ComputedRef<BackupsStatus>, watch: Watch<Resource<EtcdBackupOverallStatusSpec>> } => {
+  const res = ref<Resource<EtcdBackupOverallStatusSpec>>();
+
+  const watch = new Watch(res);
+
+  watch.setup({
+    resource: {
+      id: EtcdBackupOverallStatusID,
+      namespace: DefaultNamespace,
+      type: EtcdBackupOverallStatusType,
+    },
+    runtime: Runtime.Omni,
+  });
+  return {
+    status: computed(() => {
+      const configurable = res.value?.spec.configuration_name === 's3';
+
+      if (res.value?.spec.configuration_error) {
+        return {
+          error: `${capitalize(res.value.spec.configuration_name!)} ${res.value.spec.configuration_error}`,
+          enabled: false,
+          configurable,
+          store: res.value.spec.configuration_name,
+        };
+      }
+
+      return {
+        enabled: true,
+        configurable,
+        store: res.value?.spec.configuration_name,
+      }
+    }),
+    watch
+  };
+}
diff --git a/frontend/src/methods/key.ts b/frontend/src/methods/key.ts
new file mode 100644
index 000000000..0289ffdce
--- /dev/null
+++ b/frontend/src/methods/key.ts
@@ -0,0 +1,334 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import {
+  createMessage,
+  enums,
+  generateKey,
+  Key,
+  PrivateKey,
+  readKey,
+  readPrivateKey,
+  sign
+} from 'openpgp/lightweight';
+import { AuthService } from '@/api/omni/auth/auth.pb';
+import * as fetchIntercept from 'fetch-intercept';
+import {
+  authHeader,
+  PayloadHeaderKey,
+  SignatureHeaderKey,
+  TimestampHeaderKey,
+  SignatureVersionV1,
+  workloadProxyPublicKeyIdCookie,
+  workloadProxyPublicKeyIdSignatureBase64Cookie,
+} from '@/api/resources';
+import { Buffer } from "buffer";
+import { ref } from 'vue';
+
+let interceptorsRegistered = false;
+let keysReloadTimeout: NodeJS.Timeout;
+
+export let keys: {
+  privateKey: PrivateKey,
+  publicKey: Key,
+  identity: string,
+} | null;
+
+export class KeysInvalidError extends Error {
+  constructor(msg: string) {
+    super(msg);
+
+    // Set the prototype explicitly.
+    Object.setPrototypeOf(this, KeysInvalidError.prototype);
+  }
+}
+
+export const authorized = ref(false);
+
+export const isAuthorized = async (): Promise<boolean> => {
+  if (!keys) {
+    try {
+      await loadKeys();
+    } catch (e) {
+      return false;
+    }
+  }
+
+  const keyExpirationTime = await keys?.privateKey.getExpirationTime();
+
+  if (!keyExpirationTime || new Date() > keyExpirationTime) {
+    return false;
+  }
+
+  return true;
+}
+
+export const loadKeys = async (): Promise<{privateKey: PrivateKey, publicKey: Key}> => {
+  if (!keys) {
+    const privateKeyArmored = window.localStorage.getItem("privateKey");
+    const publicKeyArmored = window.localStorage.getItem("publicKey");
+    const identity = window.localStorage.getItem("identity");
+
+    if (!privateKeyArmored || !publicKeyArmored || !identity) {
+      throw new KeysInvalidError(`failed to load keys: keys not initialized`);
+    }
+
+    keys = {
+      privateKey: await readPrivateKey({ armoredKey: privateKeyArmored }),
+      publicKey: await readKey({ armoredKey: publicKeyArmored }),
+      identity: identity.toLowerCase(),
+    }
+  }
+
+  const now = new Date();
+
+  const keyExpirationTime = await keys.privateKey.getExpirationTime();
+
+  if (!keyExpirationTime || now > keyExpirationTime) {
+    throw new KeysInvalidError(`failed to load keys: the key is expired`);
+  }
+
+  registerInterceptors();
+
+  clearTimeout(keysReloadTimeout)
+  keysReloadTimeout = setTimeout(() => {
+    location.reload();
+  }, (keyExpirationTime as Date).getTime() - now.getTime() + 1000);
+
+  authorized.value = true;
+
+  return keys;
+}
+
+export const createKeys = async (email: string): Promise<{privateKey: string, publicKey: string, publicKeyId: string}> => {
+  email = email.toLowerCase();
+
+  const res = await genKey(email);
+
+  const enc = new TextEncoder();
+
+  const response = await AuthService.RegisterPublicKey({
+    public_key: {
+      pgp_data: enc.encode(res.publicKey),
+    },
+    identity: {
+      email: email,
+    },
+  });
+
+  return {
+    publicKeyId: response.public_key_id!,
+    ...res,
+  };
+}
+
+export const signDetached = async (data: string): Promise<string> => {
+  const keys = await loadKeys();
+
+  const stream = await sign({
+    message: await createMessage({ text: data }),
+    detached: true,
+    signingKeys: keys.privateKey,
+    format: 'binary',
+  });
+
+  return Buffer.from(stream as Uint8Array).toString('base64');
+}
+
+export const saveKeys = async (user: {email: string, picture: string, fullname: string}, privateKey: string, publicKey: string, publicKeyId: string) => {
+  keys = null;
+
+  window.localStorage.setItem("publicKey", publicKey);
+  window.localStorage.setItem("privateKey", privateKey);
+  window.localStorage.setItem("identity", user.email.toLowerCase());
+  window.localStorage.setItem("avatar", user.picture);
+  window.localStorage.setItem("fullname", user.fullname);
+
+  const loadedKeys = await loadKeys();
+
+  const expirationTime = await loadedKeys.privateKey.getExpirationTime();
+
+  if (!(expirationTime instanceof Date)) {
+    throw new KeysInvalidError("failed to save keys: invalid expiration time");
+  }
+
+  await saveAuthCookies(publicKeyId, expirationTime);
+}
+
+export const resetKeys = () => {
+  keys = null;
+
+  window.localStorage.removeItem("publicKey");
+  window.localStorage.removeItem("privateKey");
+  window.localStorage.removeItem("identity");
+  window.localStorage.removeItem("avatar");
+  window.localStorage.removeItem("fullname");
+
+  removeAuthCookies();
+
+  authorized.value = false;
+}
+
+const genKey = async (email: string): Promise<{publicKey: string, privateKey: string}> => {
+  const { privateKey, publicKey } = await generateKey({
+    type: 'ecc',
+    curve: 'ed25519',
+    userIDs: [{ name: process.env.npm_package_version, email: email.toLowerCase() }, ],
+    keyExpirationTime: 7 * 60 * 60 + 50 * 60, // 7 hours 50 minutes
+    config: {
+      preferredCompressionAlgorithm: enums.compression.zlib,
+      preferredSymmetricAlgorithm: enums.symmetric.aes256,
+      preferredHashAlgorithm: enums.hash.sha256,
+    }
+  });
+
+  return {
+    publicKey: publicKey, privateKey: privateKey
+  };
+}
+
+const includedHeaders = [
+  "nodes",
+  "selectors",
+  "fieldSelectors",
+  "runtime",
+  "context",
+  "cluster",
+  "namespace",
+  "uid",
+  TimestampHeaderKey,
+  authHeader,
+];
+
+const buildPayload = (url: string, config: {headers?: Headers }): {headers: Record<string, string[]>, method: string} => {
+  const headers: Record<string, string[]> = {};
+
+  if (config.headers) {
+    for (const header of includedHeaders) {
+      const key = `Grpc-Metadata-${header}`;
+      const value = config.headers.get(key);
+
+      if (value) {
+        if (!headers[header]) {
+          headers[header] = [value];
+        } else {
+          headers[header].push(value);
+        }
+      }
+    }
+  }
+
+  return {
+    headers: headers,
+    method: url.replace(/^\/api/, ""),
+  }
+};
+
+const registerInterceptors = () => {
+  if (interceptorsRegistered) {
+    return;
+  }
+
+  fetchIntercept.register({
+    request: async (url, config?: {headers?: Headers, method?: string}) => {
+      url = encodeURI(url);
+
+      if (!/^\/(api|image)/.test(url) || url.indexOf("/api/auth.") != -1) {
+        return [url, config];
+      }
+
+      if (!config) {
+        config = {};
+      }
+
+      if (!config.headers) {
+        config.headers = new Headers();
+      }
+
+      const ts = (new Date().getTime() / 1000).toFixed(0);
+
+      try {
+        if (url.indexOf("/api") == 0) {
+          config.headers.set(`Grpc-Metadata-${TimestampHeaderKey}`, ts);
+
+          const payload = JSON.stringify(buildPayload(url, config));
+          const signature = await signDetached(payload);
+          const fingerprint = keys?.publicKey.getFingerprint();
+
+          config.headers.set(`Grpc-Metadata-${PayloadHeaderKey}`, payload);
+          config.headers.set(`Grpc-Metadata-${SignatureHeaderKey}`, `${SignatureVersionV1} ${keys?.identity} ${fingerprint} ${signature}`);
+        } else if (url.indexOf("/image/") == 0) {
+          config.headers.set(TimestampHeaderKey, ts);
+
+          const sha256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+          const payload = [config.method ?? "GET", url, ts, sha256].join("\n");
+          const signature = await signDetached(payload);
+          const fingerprint = keys?.publicKey.getFingerprint();
+
+          config.headers.set(SignatureHeaderKey, `${SignatureVersionV1} ${keys?.identity} ${fingerprint} ${signature}`);
+        }
+      } catch (e) {
+        // reload the page to make the key Authenticator regenerate the key
+        location.reload();
+      }
+
+      return [url, config];
+    },
+  });
+
+  interceptorsRegistered = true;
+}
+
+export const getParentDomain = () => {
+  const domainParts = window.location.hostname.split('.');
+  if (domainParts.length < 2) {
+    console.error("there is no parent domain for the current hostname, returning the current hostname");
+
+    return window.location.hostname;
+  }
+
+  return domainParts.slice(1).join('.')
+}
+
+export const getAuthCookies = (): {publicKeyId: string, publicKeyIdSignatureBase64: string} | undefined => {
+  const getCookie = (name: string): string | undefined => {
+    const value = `; ${document.cookie}`;
+    const parts = value.split(`; ${name}=`);
+
+    if (parts.length !== 2) {
+      return undefined;
+    }
+
+    return parts.pop()!.split(';').shift();
+  }
+
+  const publicKeyIdCookie = getCookie(workloadProxyPublicKeyIdCookie);
+  const publicKeyIdSignatureBase64Cookie = getCookie(workloadProxyPublicKeyIdSignatureBase64Cookie);
+
+  if (!publicKeyIdCookie || !publicKeyIdSignatureBase64Cookie) {
+    return undefined;
+  }
+
+  return {
+    publicKeyId: publicKeyIdCookie,
+    publicKeyIdSignatureBase64: publicKeyIdSignatureBase64Cookie,
+  }
+}
+
+const saveAuthCookies = async (publicKeyId: string, expirationTime: Date) => {
+  const publicKeyIdSignatureBase64 = await signDetached(publicKeyId);
+
+  const parentDomain = getParentDomain()
+
+  window.document.cookie = `${workloadProxyPublicKeyIdCookie}=${publicKeyId}; path=/; expires=${expirationTime.toUTCString()}; domain=.${parentDomain}`;
+  window.document.cookie = `${workloadProxyPublicKeyIdSignatureBase64Cookie}=${publicKeyIdSignatureBase64}; path=/; expires=${expirationTime.toUTCString()}; domain=.${parentDomain}`;
+}
+
+const removeAuthCookies = () => {
+  const parentDomain = getParentDomain()
+
+  window.document.cookie = `${workloadProxyPublicKeyIdCookie}=; path=/; expires=Thu, 01 Jan 1970 00:00:00 UTC; domain=.${parentDomain}`;
+  window.document.cookie = `${workloadProxyPublicKeyIdSignatureBase64Cookie}=; path=/; expires=Thu, 01 Jan 1970 00:00:00 UTC; domain=.${parentDomain}`;
+}
diff --git a/frontend/src/methods/labels.ts b/frontend/src/methods/labels.ts
new file mode 100644
index 000000000..2f451cbbf
--- /dev/null
+++ b/frontend/src/methods/labels.ts
@@ -0,0 +1,16 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+export const parseLabels = (...labels: string[]): Record<string, string> => {
+    const labelsMap: Record<string, string> = {};
+
+    for (const label of labels) {
+        const parts = label.split(":", 2);
+
+        labelsMap[parts[0].trim()] = (parts[1] ?? "").trim();
+    }
+
+    return labelsMap;
+}
diff --git a/frontend/src/methods/logs.ts b/frontend/src/methods/logs.ts
new file mode 100644
index 000000000..c407c0e82
--- /dev/null
+++ b/frontend/src/methods/logs.ts
@@ -0,0 +1,138 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { Data } from "@/api/common/common.pb";
+import { subscribe, StreamingRequest, Stream } from "@/api/grpc";
+import { isRef, onMounted, onUnmounted, ref, Ref, ComputedRef, watch } from "vue";
+import { fetchOption } from "@/api/fetch.pb";
+
+export type LogLine = {
+  date?: string
+  msg: string
+}
+
+export interface LogParser {
+  parse: (chunk: string) => LogLine[]
+  reset: () => void
+}
+
+export class DefaultLogParser {
+  private parseLine: (chunk: string) => LogLine
+
+  constructor(parseLine: (chunk: string) => LogLine) {
+    this.parseLine = parseLine;
+  }
+
+  parse(chunk: string): LogLine[] {
+    return [
+      this.parseLine(chunk)
+    ];
+  }
+
+  reset() {
+    //noop
+  }
+}
+
+export class LineDelimitedLogParser {
+  private parseLine: (chunk: string) => LogLine
+  private buffer: string = "";
+
+  constructor(parseLine: (chunk: string) => LogLine) {
+    this.parseLine = parseLine;
+  }
+
+  public setLineParser(parseLine: (chunk: string) => LogLine) {
+    this.parseLine = parseLine;
+  }
+
+  parse(chunk: string): LogLine[] {
+    this.buffer += chunk;
+    const splitPoint = this.buffer.lastIndexOf("\n");
+
+    if (splitPoint === -1) {
+      return [];
+    }
+
+    const logs: LogLine[] = [];
+    for (const l of this.buffer.slice(0, splitPoint).split("\n")) {
+      if (!l.trim()) {
+        continue;
+      }
+
+      logs.push(this.parseLine(l));
+    }
+
+    this.buffer = this.buffer.slice(splitPoint+1, this.buffer.length);
+
+    return logs;
+  }
+
+  reset() {
+    this.buffer = "";
+  }
+}
+
+export const setupLogStream = <R extends Data, T>(logs: Ref<LogLine[]>, method: StreamingRequest<R, T>, params: T | ComputedRef<T> | Ref<T>, logParser: LogParser = new DefaultLogParser((l: string): LogLine => { return {msg: l} }), ...options: fetchOption[]): Ref<Stream<R, T> | undefined> => {
+  const stream: Ref<Stream<R, T> | undefined> = ref();
+  let buffer: LogLine[] = [];
+  let flush: NodeJS.Timeout | undefined;
+
+  const reset = () => {
+    logs.value = [];
+    logParser.reset();
+    clearTimeout(flush);
+  };
+
+  const init = () => {
+    if (stream.value) {
+      stream.value.shutdown();
+    }
+
+    reset();
+
+    let clearLogs = false;
+
+    const p = isRef(params) ? params.value : params;
+
+    stream.value = subscribe(
+      method,
+      p,
+      (resp: Data & { error?: string }) => {
+        clearTimeout(flush);
+
+        if (resp.error) {
+          clearLogs = true;
+          return;
+        }
+
+        if (clearLogs) reset();
+
+        clearLogs = false;
+
+        buffer.push(...logParser.parse(window.atob(resp.bytes?.toString()!)));
+
+        // accumulate frequent updates and then flush them in a single call
+        flush = setTimeout(() => {
+          logs.value = logs.value.concat(buffer);
+          buffer = [];
+        }, 50);
+      },
+      options,
+    );
+  };
+
+  onMounted(init);
+
+  onUnmounted(() => {
+    if (stream.value) stream.value.shutdown();
+  });
+
+  if (isRef(params)) {
+    watch(params, init)
+  }
+
+  return stream;
+}
diff --git a/frontend/src/methods/machine.ts b/frontend/src/methods/machine.ts
new file mode 100644
index 000000000..5845556eb
--- /dev/null
+++ b/frontend/src/methods/machine.ts
@@ -0,0 +1,157 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { Runtime } from "@/api/common/omni.pb";
+import { Code } from "@/api/google/rpc/code.pb";
+
+import { Resource, ResourceService, ResourceTyped } from "@/api/grpc";
+import { MachineLabelsSpec } from "@/api/omni/specs/omni.pb";
+import { withRuntime } from "@/api/options";
+import { DefaultNamespace, MachineLabelsType, MachineLocked, MachineSetNodeType, MachineStatusType, SiderolinkResourceType, SystemLabelPrefix } from "@/api/resources";
+import { destroyNodes, destroyResources, getMachineConfigPatchesToDelete } from "@/methods/cluster";
+import { parseLabels } from "@/methods/labels";
+
+export const addMachineLabels = async (machineID: string, ...labels: string[]) => {
+  let resource: Resource = {
+    metadata: {
+      type: MachineLabelsType,
+      namespace: DefaultNamespace,
+      id: machineID
+    },
+    spec: {},
+  };
+
+  let exists = true;
+  try {
+    resource = await ResourceService.Get(resource.metadata,
+      withRuntime(Runtime.Omni),
+    );
+  } catch (e) {
+    if (e.code !== Code.NOT_FOUND) {
+      throw e;
+    }
+
+    exists = false;
+  }
+
+  resource.metadata.labels = {
+    ...resource.metadata.labels,
+    ...parseLabels(...labels)
+  };
+
+  if (exists) {
+    await ResourceService.Update(resource, resource.metadata.version, withRuntime(
+      Runtime.Omni,
+    ));
+  } else {
+    const machine = await ResourceService.Get({
+      type: MachineStatusType,
+      namespace: DefaultNamespace,
+      id: machineID,
+    }, withRuntime(Runtime.Omni))
+
+    copyUserLabels(machine, resource);
+
+    await ResourceService.Create(resource, withRuntime(Runtime.Omni));
+  }
+};
+
+export const removeMachineLabels = async (machineID: string, ...keys: string[]) => {
+  let resource: ResourceTyped<MachineLabelsSpec>;
+  const metadata = {
+    id: machineID,
+    type: MachineLabelsType,
+    namespace: DefaultNamespace,
+  };
+
+  try {
+    resource = await ResourceService.Get(metadata, withRuntime(Runtime.Omni));
+  } catch (e) {
+    if (e.code !== Code.NOT_FOUND) {
+      throw e;
+    }
+
+    resource = {
+      metadata,
+      spec: {},
+    }
+
+    const machineStatus = await ResourceService.Get({...metadata, type: MachineStatusType}, withRuntime(Runtime.Omni));
+    copyUserLabels(machineStatus, resource);
+
+    await ResourceService.Create(resource, withRuntime(Runtime.Omni));
+  }
+
+  if (!resource.metadata.labels) {
+    return;
+  }
+
+  for (const key of keys) {
+    delete (resource.metadata.labels[key]);
+  }
+
+  if (Object.keys(resource.metadata.labels).length === 0) {
+    await ResourceService.Delete({
+      id: resource.metadata.id,
+      type: resource.metadata.type,
+      namespace: resource.metadata.namespace,
+    }, withRuntime(Runtime.Omni));
+  } else {
+    await ResourceService.Update(resource, undefined, withRuntime(Runtime.Omni));
+  }
+}
+
+export const removeMachine = async (id: string, cluster?: string) => {
+  await ResourceService.Teardown({
+    namespace: DefaultNamespace,
+    type: SiderolinkResourceType,
+    id: id,
+  }, withRuntime(Runtime.Omni));
+
+  // remove the machine from the cluster
+  if (cluster) {
+    await destroyNodes(cluster, [id], owner => owner !== "");
+  }
+
+  await ResourceService.Delete({
+    namespace: DefaultNamespace,
+    type: SiderolinkResourceType,
+    id: id,
+  }, withRuntime(Runtime.Omni));
+
+  const patches = await getMachineConfigPatchesToDelete(id);
+  await destroyResources(patches);
+}
+
+export const updateMachineLock = async (id: string, locked: boolean) => {
+  const machine = await ResourceService.Get({
+    namespace: DefaultNamespace,
+    type: MachineSetNodeType,
+    id: id,
+  }, withRuntime(Runtime.Omni));
+
+  if (!machine.metadata.annotations)
+    machine.metadata.annotations = {}
+
+  locked ? machine.metadata.annotations[MachineLocked] = "" : delete machine.metadata.annotations[MachineLocked];
+
+  await ResourceService.Update(machine, undefined, withRuntime(Runtime.Omni));
+}
+
+const copyUserLabels = (src: Resource, dst: Resource) => {
+  if (src.metadata.labels) {
+    for (const key in src.metadata.labels) {
+      if (key.indexOf(SystemLabelPrefix) === 0) {
+        continue;
+      }
+
+      if (!dst.metadata.labels) {
+        dst.metadata.labels = {};
+      }
+
+      dst.metadata.labels[key] = src.metadata.labels[key];
+    }
+  }
+}
diff --git a/frontend/src/methods/machineset.ts b/frontend/src/methods/machineset.ts
new file mode 100644
index 000000000..a2c66c163
--- /dev/null
+++ b/frontend/src/methods/machineset.ts
@@ -0,0 +1,108 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { Runtime } from "@/api/common/omni.pb";
+import { ResourceService } from "@/api/grpc";
+import { MachineSetSpecMachineClassAllocationType } from "@/api/omni/specs/omni.pb";
+import { withRuntime } from "@/api/options";
+import { ControlPlanesIDSuffix, DefaultNamespace, DefaultWorkersIDSuffix, MachineSetType } from "@/api/resources";
+
+export const controlPlaneTitle = "Control Plane";
+export const workersTitlePrefix = "Workers: ";
+export const defaultWorkersTitle = `${workersTitlePrefix}default`;
+
+export const controlPlaneMachineSetId = (clusterId: string) => `${clusterId}-${ControlPlanesIDSuffix}`;
+
+export const defaultWorkersMachineSetId = (clusterId: string) => `${clusterId}-${DefaultWorkersIDSuffix}`;
+
+// sortMachineSetIds sorts the given machine set ids in the following order:
+// 1. Control Plane
+// 2. Default Workers - machine set which follows the form of "<cluster id>-workers"
+// 3-n. Other Workers - machine sets which follow the form of "<cluster id>-<name>", sorted alphabetically by id.
+export const sortMachineSetIds = (clusterId: string | undefined, ids: string[]) : string[] => {
+  if (!clusterId) {
+    return ids;
+  }
+
+  const idsCopy = ids.concat();
+  return idsCopy.sort((a, b) => {
+    const nameA = machineSetName(clusterId, a);
+    const nameB = machineSetName(clusterId, b);
+
+    if (nameA == ControlPlanesIDSuffix) {
+      return -1;
+    }
+
+    if (nameB == ControlPlanesIDSuffix) {
+      return 1;
+    }
+
+    if (nameA == DefaultWorkersIDSuffix) {
+      return -1;
+    }
+
+    if (nameB == DefaultWorkersIDSuffix) {
+      return 1;
+    }
+
+    return nameA.localeCompare(nameB);
+  });
+}
+
+// machineSetTitle strips the cluster id prefix from the machine set id and returns a human-readable
+// representation of the machine set id, such as "Control Plane", "Workers", "Workers: additional", etc.
+export const machineSetTitle = (clusterId?: string, id?: string) => {
+  const name = machineSetName(clusterId, id);
+  if (!name) {
+    return "";
+  }
+
+  if (name == ControlPlanesIDSuffix) {
+    return controlPlaneTitle;
+  }
+
+  if (name == DefaultWorkersIDSuffix) {
+    return defaultWorkersTitle;
+  }
+
+  return `${workersTitlePrefix}${name}`;
+}
+
+const machineSetName = (clusterId?: string, id?: string) => {
+  if (!clusterId || !id) {
+    return "";
+  }
+
+  if (!id.startsWith(clusterId + "-")) {
+    return id;
+  }
+
+  return id.substring(clusterId.length + 1);
+}
+
+export const scaleMachineSet = async (id: string, machineCount: number, allocationType: MachineSetSpecMachineClassAllocationType) => {
+  if (machineCount < 0) {
+    throw new Error("machine set count can not be negative");
+  }
+
+  const ms = await ResourceService.Get({
+    id: id,
+    type: MachineSetType,
+    namespace: DefaultNamespace,
+  }, withRuntime(Runtime.Omni));
+
+  if (!ms.spec.machine_class.name) {
+    throw new Error("machine set does not use machine classes");
+  }
+
+  if (allocationType !== MachineSetSpecMachineClassAllocationType.Static) {
+    machineCount = 0;
+  }
+
+  ms.spec.machine_class.machine_count = machineCount;
+  ms.spec.machine_class.allocation_type = allocationType;
+
+  await ResourceService.Update(ms, ms.metadata.version, withRuntime(Runtime.Omni));
+}
diff --git a/frontend/src/methods/node.ts b/frontend/src/methods/node.ts
new file mode 100644
index 000000000..d256f7120
--- /dev/null
+++ b/frontend/src/methods/node.ts
@@ -0,0 +1,30 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { Runtime } from "@/api/common/omni.pb";
+import { ResourceTyped } from "@/api/grpc";
+import { ClusterMachineStatusLabelNodeName, ClusterMachineStatusType, DefaultNamespace, } from "@/api/resources";
+import { ClusterMachineStatusSpec } from "@/api/omni/specs/omni.pb";
+import { computed, ref, Ref } from "vue";
+import Watch from "@/api/watch";
+
+export const setupNodenameWatch = (id: string | string[]): Ref<string> => {
+  const res: Ref<ResourceTyped<ClusterMachineStatusSpec> | undefined> = ref();
+
+  const w = new Watch(res)
+
+  w.setup({
+    resource: {
+      type: ClusterMachineStatusType,
+      namespace: DefaultNamespace,
+      id: id as string,
+    },
+    runtime: Runtime.Omni,
+  });
+
+  return computed(() => {
+    return (res.value?.metadata?.labels ?? {})[ClusterMachineStatusLabelNodeName] ?? "";
+  });
+}
diff --git a/frontend/src/methods/storage.ts b/frontend/src/methods/storage.ts
new file mode 100644
index 000000000..068757d22
--- /dev/null
+++ b/frontend/src/methods/storage.ts
@@ -0,0 +1,27 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { customRef } from 'vue';
+
+export default <T>(storage: Storage, key: string, defaultValue: T) => {
+    return customRef<T>((track, trigger) => ({
+        get: () => {
+            track()
+
+            const value = storage.getItem(key)
+
+            return value ? JSON.parse(value) : defaultValue
+        },
+        set: value => {
+            if (value === null) {
+                storage.removeItem(key)
+            } else {
+                storage.setItem(key, JSON.stringify(value))
+            }
+
+            trigger()
+        },
+    }))
+}
diff --git a/frontend/src/methods/time.ts b/frontend/src/methods/time.ts
new file mode 100644
index 000000000..5c210f256
--- /dev/null
+++ b/frontend/src/methods/time.ts
@@ -0,0 +1,92 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { DateTime, Duration, DurationLikeObject } from "luxon"
+
+export namespace time {
+  export const relativeISO = (input: string): string => {
+    return parseISO(input).toRelative()!;
+  }
+
+  export const formatISO = (input: string, format?: string): string => {
+    if (!format) {
+      format = "dd/MM/yyyy HH:mm:ss";
+    }
+
+    return parseISO(input).toFormat(format);
+  }
+
+  export const isoNow = (): string => {
+    const date = DateTime.now();
+
+    return date.setLocale("en-US").toUTC().toISO();
+  }
+
+  export const parseDuration = (input: string): Duration => {
+    const units: Record<"h" | "m" | "s", keyof DurationLikeObject> = {
+      "h": "hours",
+      "m": "minutes",
+      "s": "seconds",
+    };
+
+    let buffer = "";
+
+    const duration: DurationLikeObject = {};
+
+    for (const s of input) {
+      if (units[s]) {
+        if (duration[units[s]] !== undefined) {
+          throw new Error(`failed to parse duration ${input}`);
+        }
+
+        const value = +buffer;
+
+        if (buffer === null || buffer === '' || isNaN(value)) {
+          throw new Error(`failed to parse duration ${input}`);
+        }
+
+        buffer = "";
+
+        duration[units[s]] = value;
+
+        continue;
+      }
+      
+      buffer += s;
+    }
+
+    if (buffer !== "") {
+      throw new Error(`failed to parse duration ${input}`);
+    }
+
+    return Duration.fromDurationLike(duration);
+  }
+
+  export const formatDuration = (duration: Duration): string => {
+    let res = "";
+
+    duration = duration.shiftTo("seconds");
+
+    for (const units of [["seconds", "s"]]) {
+      const key = units[0];
+      const suffix = units[1];
+
+      const value = duration.get(key as keyof DurationLikeObject);
+      if (value > 0) {
+        res += `${value}${suffix}`;
+      }
+    }
+
+    if (res === "") {
+      res = "0";
+    }
+
+    return res;
+  };
+
+  const parseISO = (input: string): DateTime => {
+    return DateTime.fromISO(input).setLocale("en-US").toLocal();
+  }
+}
\ No newline at end of file
diff --git a/frontend/src/methods/title.ts b/frontend/src/methods/title.ts
new file mode 100644
index 000000000..7bd52eee2
--- /dev/null
+++ b/frontend/src/methods/title.ts
@@ -0,0 +1,38 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import {ResourceService, ResourceTyped} from "@/api/grpc";
+import {EphemeralNamespace, SysVersionID, SysVersionType} from "@/api/resources";
+import {Runtime} from "@/api/common/omni.pb";
+import {SysVersionSpec} from "@/api/omni/specs/system.pb";
+import {Code} from "@/api/google/rpc/code.pb";
+import { withRuntime } from "@/api/options";
+
+let title: string | undefined = undefined
+
+export const refreshTitle = async () => {
+    if (title) {
+        document.title = title
+        return
+    }
+
+    try {
+        const sysVersion: ResourceTyped<SysVersionSpec> = await ResourceService.Get({
+            namespace: EphemeralNamespace,
+            type: SysVersionType,
+            id: SysVersionID,
+        }, withRuntime(Runtime.Omni));
+
+        if (sysVersion?.spec?.instance_name) {
+            title = "Omni - " + sysVersion?.spec?.instance_name;
+
+            document.title = title
+        }
+    } catch (e) {
+        if (e?.code != Code.UNAUTHENTICATED) {
+            console.log("failed to get sysversion resource", e)
+        }
+    }
+}
diff --git a/frontend/src/methods/user.ts b/frontend/src/methods/user.ts
new file mode 100644
index 000000000..b5892cd37
--- /dev/null
+++ b/frontend/src/methods/user.ts
@@ -0,0 +1,81 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import {
+  DefaultNamespace,
+  UserType,
+  IdentityType,
+  LabelIdentityUserID,
+} from "@/api/resources";
+import { ResourceTyped, ResourceService } from "@/api/grpc";
+import { UserSpec } from "@/api/omni/specs/auth.pb";
+import { v4 as uuidv4 } from 'uuid';
+import { IdentitySpec } from "@/api/omni/specs/auth.pb";
+import { Runtime } from "@/api/common/omni.pb";
+import { Code } from "@/api/google/rpc/code.pb";
+import { withRuntime } from "@/api/options";
+
+export const createUser = async (email: string, role: string) => {
+  const user: ResourceTyped<UserSpec> = {
+    metadata: {
+      id: uuidv4(),
+      namespace: DefaultNamespace,
+      type: UserType,
+    },
+    spec: {
+      role: role
+    }
+  };
+
+  const identity: ResourceTyped<IdentitySpec> = {
+    metadata: {
+      id: email.toLowerCase(),
+      namespace: DefaultNamespace,
+      type: IdentityType,
+      labels: {
+        [LabelIdentityUserID]: user.metadata.id as string,
+      }
+    },
+    spec: {
+      user_id: user.metadata.id as string,
+    }
+  }
+
+  let identityExists = true;
+  try {
+    await ResourceService.Get({
+      id: identity.metadata.id,
+      namespace: DefaultNamespace,
+      type: identity.metadata.type
+    }, withRuntime(Runtime.Omni));
+  } catch (e) {
+    if (e.code !== Code.NOT_FOUND) {
+      throw e;
+    }
+
+    identityExists = false;
+  }
+
+  if (identityExists) {
+    throw new Error(`The email ${identity.metadata.id} is already in use`);
+  }
+
+  await ResourceService.Create(user, withRuntime(Runtime.Omni));
+
+  await ResourceService.Create(identity, withRuntime(Runtime.Omni));
+};
+
+export const updateRole = async (userID: string, role: string) => {
+  const user = await ResourceService.Get({
+    id: userID,
+    namespace: DefaultNamespace,
+    type: UserType
+  }, withRuntime(Runtime.Omni));
+
+  user.spec.role = role;
+
+  await ResourceService.Update(user, undefined, withRuntime(Runtime.Omni));
+};
+
diff --git a/frontend/src/modal.ts b/frontend/src/modal.ts
new file mode 100644
index 000000000..7c0d52db4
--- /dev/null
+++ b/frontend/src/modal.ts
@@ -0,0 +1,24 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { Ref, Component, shallowRef } from 'vue';
+
+export type Modal = {
+  component: Component,
+  props?: Object,
+};
+
+export const modal: Ref<{component: Component, props: any} | null> = shallowRef(null);
+
+export const showModal = (component: Component, props: any) => {
+  modal.value = {
+    component: component,
+    props: props,
+  }
+};
+
+export const closeModal = () => {
+  modal.value = null;
+};
\ No newline at end of file
diff --git a/frontend/src/notification.ts b/frontend/src/notification.ts
new file mode 100644
index 000000000..d7ce44091
--- /dev/null
+++ b/frontend/src/notification.ts
@@ -0,0 +1,40 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { Ref, shallowRef } from 'vue';
+
+export type Notification = {
+  props?: any,
+};
+
+export const notification: Ref<Notification | null> = shallowRef(null);
+
+export const showError = (title: string, body?: string) => {
+  console.error(`error occurred: title: ${title}, body: ${body}`)
+
+  notification.value = {
+    props: {
+      title: title,
+      body: body,
+      type: "error",
+      close: () => {
+        notification.value = null;
+      }
+    }
+  }
+};
+
+export const showSuccess = (title: string, body?: string) => {
+  notification.value = {
+    props: {
+      title: title,
+      body: body,
+      type: "success",
+      close: () => {
+        notification.value = null;
+      }
+    }
+  }
+};
diff --git a/frontend/src/router/index.ts b/frontend/src/router/index.ts
new file mode 100644
index 000000000..2b5e79d36
--- /dev/null
+++ b/frontend/src/router/index.ts
@@ -0,0 +1,401 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { createWebHistory, createRouter, RouteLocation, RouteRecordRaw, RouteLocationRaw } from "vue-router";
+
+// Root level routes
+import OmniOverview from "@/views/omni/Overview/Overview.vue";
+import OmniClusters from "@/views/omni/Clusters/Clusters.vue";
+import OmniClusterCreate from "@/views/omni/Clusters/Management/ClusterCreate.vue";
+import OmniClusterScale from "@/views/omni/Clusters/Management/ClusterScale.vue";
+import OmniMachines from "@/views/omni/Machines/Machines.vue";
+import OmniMachineLogs from "@/views/omni/Machines/MachineLogs.vue";
+import OmniUsers from "@/views/omni/Users/Users.vue";
+import Authenticate from "@/views/omni/Auth/Authenticate.vue";
+import OmniMachineClasses from "@/views/omni/MachineClasses/MachineClasses.vue";
+import OmniMachineClass from "@/views/omni/MachineClasses/MachineClass.vue";
+import OmniBackupStorageSettings from "@/views/omni/Settings/BackupStorage.vue";
+import OIDC from "@/views/omni/Auth/OIDC.vue";
+
+// Cluster level routes
+import ClusterScoped from "@/views/cluster/ClusterScoped.vue";
+import NodesList from "@/views/cluster/Nodes/NodesList.vue";
+import TPods from "@/views/cluster/Pods/TPods.vue";
+import ClusterOverview from "@/views/cluster/Overview/Overview.vue";
+import NodeOverview from "@/views/cluster/Nodes/NodeOverview.vue";
+import NodeMonitor from "@/views/cluster/Nodes/NodeMonitor.vue";
+import NodeLogs from "@/views/cluster/Nodes/NodeLogs.vue";
+import NodeConfig from "@/views/cluster/Nodes/NodeConfig.vue";
+import NodeMounts from "@/views/cluster/Nodes/NodeMounts.vue";
+import ConfigPatches from "@/views/cluster/Config/Patches.vue";
+import PatchEdit from "@/views/cluster/Config/PatchEdit.vue";
+import KubernetesManifestSync from "@/views/cluster/Manifest/Sync.vue";
+import NodeDetails from "@/views/cluster/Nodes/NodeDetails.vue";
+import ExposedService from "@/views/cluster/ExposedService/ExposedService.vue";
+import ClusterBackups from "@/views/cluster/Backups/Backups.vue";
+
+import PageNotFound from "@/views/common/PageNotFound.vue";
+import Forbidden from "@/views/common/Forbidden.vue";
+
+// sidebars
+import OmniSidebar from "@/views/omni/SideBar.vue";
+import ClusterSidebar from "@/views/cluster/SideBar.vue";
+import ClusterSidebarNode from "@/views/cluster/SideBarNode.vue";
+
+// modal windows
+import NodeReboot from "@/views/omni/Modals/NodeReboot.vue";
+import NodeShutdown from "@/views/omni/Modals/NodeShutdown.vue";
+import ClusterDestroy from "@/views/omni/Modals/ClusterDestroy.vue";
+import MachineSetDestroy from "@/views/omni/Modals/MachineSetDestroy.vue";
+import ConfigPatchDestroy from "@/views/omni/Modals/ConfigPatchDestroy.vue";
+import NodeDestroy from "@/views/omni/Modals/NodeDestroy.vue";
+import MachineRemove from "@/views/omni/Modals/MachineRemove.vue";
+import MachineClassDestroy from "@/views/omni/Modals/MachineClassDestroy.vue";
+import NodeDestroyCancel from "@/views/omni/Modals/NodeDestroyCancel.vue";
+import DownloadInstallationMedia from "@/views/omni/Modals/DownloadInstallationMedia.vue";
+import DownloadOmnictl from "@/views/omni/Modals/DownloadOmnictl.vue";
+import DownloadTalosctl from "@/views/omni/Modals/DownloadTalosctl.vue";
+import UserDestroy from "@/views/omni/Modals/UserDestroy.vue";
+import UpdateKubernetes from "@/views/omni/Modals/UpdateKubernetes.vue";
+import UpdateTalos from "@/views/omni/Modals/UpdateTalos.vue";
+import UserCreate from "@/views/omni/Modals/UserCreate.vue";
+import UserEdit from "@/views/omni/Modals/UserEdit.vue";
+
+import { context } from "@/context";
+import { authGuard } from "@auth0/auth0-vue";
+import { AuthType, authType } from "@/methods";
+import { getAuthCookies, isAuthorized } from "@/methods/key";
+import { refreshTitle } from "@/methods/title";
+import { loadCurrentUser } from "@/methods/auth";
+
+export const FrontendAuthFlow = "frontend";
+
+const withPrefix = (prefix: string, routes: RouteRecordRaw[], meta?: Record<string, any>) =>
+  routes.map((route) => {
+    if (meta && !route.meta) {
+      route.meta = meta;
+    }
+
+    if (!route.beforeEnter) {
+      route.beforeEnter = (to: RouteLocation) => {
+        return checkAuthorized(to)
+      }
+    }
+
+    route.path = prefix + route.path;
+    return route;
+  }
+);
+
+export const checkAuthorized =  async (to: RouteLocation, requireCookies?: boolean): Promise<RouteLocationRaw | boolean> => {
+  let authorized = await isAuthorized();
+
+  if (requireCookies && !getAuthCookies()) {
+    authorized = false;
+  }
+
+  if (authorized) {
+    await loadCurrentUser()
+  }
+
+  if (authorized) {
+    await refreshTitle()
+
+    return true;
+  }
+
+  return { name: "Authenticate", query: { flow: FrontendAuthFlow, redirect: to.fullPath } };
+}
+
+export function getBreadcrumbs(route: RouteLocation) {
+  const crumbs: {text: string, to?: { name: string, query: any}}[] = [];
+
+  if (route.params.machine) {
+    if (route.params.cluster) {
+      crumbs.push(
+        {
+          text: `All Nodes`,
+          to: { name: "Nodes", query: route.query },
+        },
+        {
+          text: `${route.params.machine}`,
+          to: { name: "NodeOverview", query: route.query },
+        }
+      );
+    } else {
+      crumbs.push(
+        {
+          text: "Machines",
+          to: { name: "Machines", query: route.query },
+        },
+      )
+    }
+  }
+
+  if (route.params.service) {
+    crumbs.push({
+      text: `${route.params.service} Logs`,
+      to: { name: "NodeLogs", query: route.query },
+    });
+  }
+
+  return crumbs;
+}
+
+export function getSidebar(route) {
+  if (route.meta.sidebar) {
+    return route.meta.sidebar
+  }
+
+  return null
+}
+
+const beforeEnter = async (to: RouteLocation) => {
+  if (authType.value === AuthType.Auth0) {
+    return await authGuard(to);
+  }
+
+  return true;
+}
+
+const routes: RouteRecordRaw[] = [
+  { path: '/', redirect: '/omni/' },
+  { path: "/forbidden", component: Forbidden },
+  ...withPrefix("/omni", [
+    {
+      path: "/authenticate",
+      name: "Authenticate",
+      component: Authenticate,
+      beforeEnter: beforeEnter,
+    },
+    {
+      path: "/oidc-login/:authRequestId",
+      name: "OIDC Login",
+      component: OIDC,
+    },
+  ]),
+  ...withPrefix("/omni", [
+    {
+      path: "/",
+      name: "Overview",
+      component: OmniOverview,
+    },
+    {
+      path: "/clusters",
+      name: "Clusters",
+      component:  OmniClusters,
+    },
+    {
+      path: "/cluster/create",
+      name: "ClusterCreate",
+      component: OmniClusterCreate,
+    },
+    {
+      path: "/machines",
+      name: "Machines",
+      component:  OmniMachines,
+    },
+    {
+      path: "/users",
+      name: "Users",
+      component: OmniUsers,
+    },
+    {
+      path: "/machine-classes",
+      name: "MachineClasses",
+      component: OmniMachineClasses,
+    },
+    {
+      path: "/machine-classes/create",
+      name: "MachineClassCreate",
+      component: OmniMachineClass,
+    },
+    {
+      path: "/machine-classes/:classname",
+      name: "MachineClassEdit",
+      component: OmniMachineClass,
+      props: {
+        edit: true,
+      }
+    },
+    {
+      path: "/backups",
+      name: "BackupStorage",
+      component: OmniBackupStorageSettings,
+    },
+    {
+      path: "/machine/:machine/logs",
+      name: "MachineLogs",
+      component:  OmniMachineLogs,
+    },
+    {
+      path: "/machine/:machine/patches",
+      name: "MachineConfigPatches",
+      component: ConfigPatches,
+    },
+    {
+      path: "/machine/:machine/patches/:patch",
+      name: "MachinePatchEdit",
+      component:  PatchEdit,
+    },
+  ], { sidebar: OmniSidebar }),
+  ...withPrefix("/cluster/:cluster", [
+    {
+      path: "/nodes",
+      name: "Nodes",
+      component: ClusterScoped,
+      props: {
+        inner: NodesList,
+      }
+    },
+    {
+      path: "/scale",
+      name: "ClusterScale",
+      component: ClusterScoped,
+      props: {
+        inner: OmniClusterScale,
+      },
+    },
+    {
+      path: "/pods",
+      name: "Pods",
+      component: ClusterScoped,
+      props: {
+        inner: TPods,
+      },
+    },
+    {
+      path: "/overview",
+      name: "ClusterOverview",
+      component: ClusterScoped,
+      props: {
+        inner: ClusterOverview,
+      },
+    },
+    {
+      path: "/patches",
+      name: "ClusterConfigPatches",
+      component: ClusterScoped,
+      props: {
+        inner: ConfigPatches,
+      },
+    },
+    {
+      path: "/patches/:patch",
+      name: "ClusterPatchEdit",
+      component: ClusterScoped,
+      props: {
+        inner: PatchEdit,
+      },
+    },
+    {
+      path: "/manifests",
+      name: "KubernetesManifestSync",
+      component: ClusterScoped,
+      props: {
+        inner: KubernetesManifestSync,
+      },
+    },
+    {
+      path: "/services/:service",
+      name: "ExposedService",
+      component: ClusterScoped,
+      props: {
+        inner: ExposedService,
+      },
+    },
+    {
+      path: "/backups",
+      name: "Backups",
+      component: ClusterBackups,
+    },
+    ...withPrefix("/machine/:machine", [
+      {
+        path: "/",
+        name: "NodeDetails",
+        component: ClusterScoped,
+        props: {
+          inner: NodeDetails,
+        },
+        children: [
+          {
+            path: "overview",
+            name: "NodeOverview",
+            components: {
+              nodeDetails: NodeOverview,
+            },
+          },
+          {
+            path: "monitor",
+            name: "NodeMonitor",
+            components: {
+              nodeDetails: NodeMonitor,
+            },
+          },
+          {
+            path: "logs/:service",
+            name: "NodeLogs",
+            components: {
+              nodeDetails: NodeLogs,
+            },
+          },
+          {
+            path: "config",
+            name: "NodeConfig",
+            components: {
+              nodeDetails: NodeConfig,
+            },
+          },
+          {
+            path: "mounts",
+            name: "NodeMounts",
+            components: {
+              nodeDetails: NodeMounts,
+            },
+          },
+        ]
+      },
+    ], { sidebar: ClusterSidebarNode }),
+  ], { sidebar: ClusterSidebar }),
+  { path: "/:catchAll(.*)", component: PageNotFound },
+];
+
+const router = createRouter({
+  history: createWebHistory(),
+  routes,
+});
+
+router.beforeEach(to => {
+  if (!to.params.cluster) {
+    return true;
+  }
+
+  context.current.value = to.params.cluster;
+
+  return true;
+})
+
+const modals = {
+  reboot: NodeReboot,
+  shutdown: NodeShutdown,
+  clusterDestroy: ClusterDestroy,
+  machineRemove: MachineRemove,
+  machineClassDestroy: MachineClassDestroy,
+  machineSetDestroy: MachineSetDestroy,
+  downloadInstallationMedia: DownloadInstallationMedia,
+  downloadOmnictlBinaries: DownloadOmnictl,
+  downloadTalosctlBinaries: DownloadTalosctl,
+  nodeDestroy: NodeDestroy,
+  nodeDestroyCancel: NodeDestroyCancel,
+  updateKubernetes: UpdateKubernetes,
+  updateTalos: UpdateTalos,
+  configPatchDestroy: ConfigPatchDestroy,
+  userDestroy: UserDestroy,
+  userCreate: UserCreate,
+  userEdit: UserEdit,
+};
+
+export { modals };
+export default router;
diff --git a/frontend/src/schemas/config.schema.json b/frontend/src/schemas/config.schema.json
new file mode 100644
index 000000000..803491328
--- /dev/null
+++ b/frontend/src/schemas/config.schema.json
@@ -0,0 +1,3212 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://talos.dev/v1.6/schemas/config.schema.json",
+  "$defs": {
+    "network.DefaultActionConfigV1Alpha1": {
+      "properties": {
+        "apiVersion": {
+          "enum": [
+            "v1alpha1"
+          ],
+          "title": "apiVersion",
+          "description": "apiVersion is the API version of the resource.\n",
+          "markdownDescription": "apiVersion is the API version of the resource.",
+          "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n"
+        },
+        "kind": {
+          "enum": [
+            "NetworkDefaultActionConfig"
+          ],
+          "title": "kind",
+          "description": "kind is the kind of the resource.\n",
+          "markdownDescription": "kind is the kind of the resource.",
+          "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n"
+        },
+        "ingress": {
+          "enum": [
+            "accept",
+            "block"
+          ],
+          "title": "ingress",
+          "description": "Default action for all not explicitly configured ingress traffic: accept or block.\n",
+          "markdownDescription": "Default action for all not explicitly configured ingress traffic: accept or block.",
+          "x-intellij-html-description": "\u003cp\u003eDefault action for all not explicitly configured ingress traffic: accept or block.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "apiVersion",
+        "kind"
+      ]
+    },
+    "network.IngressRule": {
+      "properties": {
+        "subnet": {
+          "type": "string",
+          "pattern": "^[0-9a-f.:]+/\\d{1,3}$",
+          "title": "subnet",
+          "description": "Subnet defines a source subnet.\n",
+          "markdownDescription": "Subnet defines a source subnet.",
+          "x-intellij-html-description": "\u003cp\u003eSubnet defines a source subnet.\u003c/p\u003e\n"
+        },
+        "except": {
+          "type": "string",
+          "pattern": "^[0-9a-f.:]+/\\d{1,3}$",
+          "title": "except",
+          "description": "Except defines a source subnet to exclude from the rule, it gets excluded from the subnet.\n",
+          "markdownDescription": "Except defines a source subnet to exclude from the rule, it gets excluded from the `subnet`.",
+          "x-intellij-html-description": "\u003cp\u003eExcept defines a source subnet to exclude from the rule, it gets excluded from the \u003ccode\u003esubnet\u003c/code\u003e.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "network.RuleConfigV1Alpha1": {
+      "properties": {
+        "apiVersion": {
+          "enum": [
+            "v1alpha1"
+          ],
+          "title": "apiVersion",
+          "description": "apiVersion is the API version of the resource.\n",
+          "markdownDescription": "apiVersion is the API version of the resource.",
+          "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n"
+        },
+        "kind": {
+          "enum": [
+            "NetworkRuleConfig"
+          ],
+          "title": "kind",
+          "description": "kind is the kind of the resource.\n",
+          "markdownDescription": "kind is the kind of the resource.",
+          "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n"
+        },
+        "name": {
+          "type": "string",
+          "title": "name",
+          "description": "Name of the config document.\n",
+          "markdownDescription": "Name of the config document.",
+          "x-intellij-html-description": "\u003cp\u003eName of the config document.\u003c/p\u003e\n"
+        },
+        "portSelector": {
+          "$ref": "#/$defs/network.RulePortSelector",
+          "title": "portSelector",
+          "description": "Port selector defines which ports and protocols on the host are affected by the rule.\n",
+          "markdownDescription": "Port selector defines which ports and protocols on the host are affected by the rule.",
+          "x-intellij-html-description": "\u003cp\u003ePort selector defines which ports and protocols on the host are affected by the rule.\u003c/p\u003e\n"
+        },
+        "ingress": {
+          "items": {
+            "$ref": "#/$defs/network.IngressRule"
+          },
+          "type": "array",
+          "title": "ingress",
+          "description": "Ingress defines which source subnets are allowed to access the host ports/protocols defined by the portSelector.\n",
+          "markdownDescription": "Ingress defines which source subnets are allowed to access the host ports/protocols defined by the `portSelector`.",
+          "x-intellij-html-description": "\u003cp\u003eIngress defines which source subnets are allowed to access the host ports/protocols defined by the \u003ccode\u003eportSelector\u003c/code\u003e.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "apiVersion",
+        "kind",
+        "name"
+      ]
+    },
+    "network.RulePortSelector": {
+      "properties": {
+        "ports": {
+          "items": {
+            "oneOf": [
+              {
+                "type": "integer"
+              },
+              {
+                "type": "string"
+              }
+            ]
+          },
+          "type": "array",
+          "title": "ports",
+          "description": "Ports defines a list of port ranges or single ports.\nThe port ranges are inclusive, and should not overlap.\n",
+          "markdownDescription": "Ports defines a list of port ranges or single ports.\nThe port ranges are inclusive, and should not overlap.",
+          "x-intellij-html-description": "\u003cp\u003ePorts defines a list of port ranges or single ports.\nThe port ranges are inclusive, and should not overlap.\u003c/p\u003e\n"
+        },
+        "protocol": {
+          "enum": [
+            "tcp",
+            "udp",
+            "icmp",
+            "icmpv6"
+          ],
+          "title": "protocol",
+          "description": "Protocol defines traffic protocol (e.g. TCP or UDP).\n",
+          "markdownDescription": "Protocol defines traffic protocol (e.g. TCP or UDP).",
+          "x-intellij-html-description": "\u003cp\u003eProtocol defines traffic protocol (e.g. TCP or UDP).\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "runtime.EventSinkV1Alpha1": {
+      "properties": {
+        "apiVersion": {
+          "enum": [
+            "v1alpha1"
+          ],
+          "title": "apiVersion",
+          "description": "apiVersion is the API version of the resource.\n",
+          "markdownDescription": "apiVersion is the API version of the resource.",
+          "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n"
+        },
+        "kind": {
+          "enum": [
+            "EventSinkConfig"
+          ],
+          "title": "kind",
+          "description": "kind is the kind of the resource.\n",
+          "markdownDescription": "kind is the kind of the resource.",
+          "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n"
+        },
+        "endpoint": {
+          "type": "string",
+          "title": "endpoint",
+          "description": "The endpoint for the event sink as ‘host:port’.\n",
+          "markdownDescription": "The endpoint for the event sink as 'host:port'.",
+          "x-intellij-html-description": "\u003cp\u003eThe endpoint for the event sink as \u0026lsquo;host:port\u0026rsquo;.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "apiVersion",
+        "kind"
+      ]
+    },
+    "runtime.KmsgLogV1Alpha1": {
+      "properties": {
+        "apiVersion": {
+          "enum": [
+            "v1alpha1"
+          ],
+          "title": "apiVersion",
+          "description": "apiVersion is the API version of the resource.\n",
+          "markdownDescription": "apiVersion is the API version of the resource.",
+          "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n"
+        },
+        "kind": {
+          "enum": [
+            "KmsgLogConfig"
+          ],
+          "title": "kind",
+          "description": "kind is the kind of the resource.\n",
+          "markdownDescription": "kind is the kind of the resource.",
+          "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n"
+        },
+        "name": {
+          "type": "string",
+          "title": "name",
+          "description": "Name of the config document.\n",
+          "markdownDescription": "Name of the config document.",
+          "x-intellij-html-description": "\u003cp\u003eName of the config document.\u003c/p\u003e\n"
+        },
+        "url": {
+          "type": "string",
+          "pattern": "^(tcp|udp)://",
+          "title": "url",
+          "description": "The URL encodes the log destination.\nThe scheme must be tcp:// or udp://.\nThe path must be empty.\nThe port is required.\n",
+          "markdownDescription": "The URL encodes the log destination.\nThe scheme must be tcp:// or udp://.\nThe path must be empty.\nThe port is required.",
+          "x-intellij-html-description": "\u003cp\u003eThe URL encodes the log destination.\nThe scheme must be tcp:// or udp://.\nThe path must be empty.\nThe port is required.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "apiVersion",
+        "kind"
+      ]
+    },
+    "siderolink.ConfigV1Alpha1": {
+      "properties": {
+        "apiVersion": {
+          "enum": [
+            "v1alpha1"
+          ],
+          "title": "apiVersion",
+          "description": "apiVersion is the API version of the resource.\n",
+          "markdownDescription": "apiVersion is the API version of the resource.",
+          "x-intellij-html-description": "\u003cp\u003eapiVersion is the API version of the resource.\u003c/p\u003e\n"
+        },
+        "kind": {
+          "enum": [
+            "SideroLinkConfig"
+          ],
+          "title": "kind",
+          "description": "kind is the kind of the resource.\n",
+          "markdownDescription": "kind is the kind of the resource.",
+          "x-intellij-html-description": "\u003cp\u003ekind is the kind of the resource.\u003c/p\u003e\n"
+        },
+        "apiUrl": {
+          "type": "string",
+          "pattern": "^(https|grpc)://",
+          "title": "apiUrl",
+          "description": "SideroLink API URL to connect to.\n",
+          "markdownDescription": "SideroLink API URL to connect to.",
+          "x-intellij-html-description": "\u003cp\u003eSideroLink API URL to connect to.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object",
+      "required": [
+        "apiVersion",
+        "kind"
+      ]
+    },
+    "v1alpha1.APIServerConfig": {
+      "properties": {
+        "image": {
+          "type": "string",
+          "title": "image",
+          "description": "The container image used in the API server manifest.\n",
+          "markdownDescription": "The container image used in the API server manifest.",
+          "x-intellij-html-description": "\u003cp\u003eThe container image used in the API server manifest.\u003c/p\u003e\n"
+        },
+        "extraArgs": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "extraArgs",
+          "description": "Extra arguments to supply to the API server.\n",
+          "markdownDescription": "Extra arguments to supply to the API server.",
+          "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to the API server.\u003c/p\u003e\n"
+        },
+        "extraVolumes": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.VolumeMountConfig"
+          },
+          "type": "array",
+          "title": "extraVolumes",
+          "description": "Extra volumes to mount to the API server static pod.\n",
+          "markdownDescription": "Extra volumes to mount to the API server static pod.",
+          "x-intellij-html-description": "\u003cp\u003eExtra volumes to mount to the API server static pod.\u003c/p\u003e\n"
+        },
+        "env": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "env",
+          "description": "The env field allows for the addition of environment variables for the control plane component.\n",
+          "markdownDescription": "The `env` field allows for the addition of environment variables for the control plane component.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables for the control plane component.\u003c/p\u003e\n"
+        },
+        "certSANs": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "certSANs",
+          "description": "Extra certificate subject alternative names for the API server’s certificate.\n",
+          "markdownDescription": "Extra certificate subject alternative names for the API server's certificate.",
+          "x-intellij-html-description": "\u003cp\u003eExtra certificate subject alternative names for the API server\u0026rsquo;s certificate.\u003c/p\u003e\n"
+        },
+        "disablePodSecurityPolicy": {
+          "type": "boolean",
+          "title": "disablePodSecurityPolicy",
+          "description": "Disable PodSecurityPolicy in the API server and default manifests.\n",
+          "markdownDescription": "Disable PodSecurityPolicy in the API server and default manifests.",
+          "x-intellij-html-description": "\u003cp\u003eDisable PodSecurityPolicy in the API server and default manifests.\u003c/p\u003e\n"
+        },
+        "admissionControl": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.AdmissionPluginConfig"
+          },
+          "type": "array",
+          "title": "admissionControl",
+          "description": "Configure the API server admission plugins.\n",
+          "markdownDescription": "Configure the API server admission plugins.",
+          "x-intellij-html-description": "\u003cp\u003eConfigure the API server admission plugins.\u003c/p\u003e\n"
+        },
+        "auditPolicy": {
+          "type": "object",
+          "title": "auditPolicy",
+          "description": "Configure the API server audit policy.\n",
+          "markdownDescription": "Configure the API server audit policy.",
+          "x-intellij-html-description": "\u003cp\u003eConfigure the API server audit policy.\u003c/p\u003e\n"
+        },
+        "resources": {
+          "type": "object",
+          "title": "resources",
+          "description": "Configure the API server resources.\n",
+          "markdownDescription": "Configure the API server resources.",
+          "x-intellij-html-description": "\u003cp\u003eConfigure the API server resources.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.AdminKubeconfigConfig": {
+      "properties": {
+        "certLifetime": {
+          "type": "string",
+          "pattern": "^[-+]?(((\\d+(\\.\\d*)?|\\d*(\\.\\d+)+)([nuµm]?s|m|h))|0)+$",
+          "title": "certLifetime",
+          "description": "Admin kubeconfig certificate lifetime (default is 1 year).\nField format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).\n",
+          "markdownDescription": "Admin kubeconfig certificate lifetime (default is 1 year).\nField format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).",
+          "x-intellij-html-description": "\u003cp\u003eAdmin kubeconfig certificate lifetime (default is 1 year).\nField format accepts any Go time.Duration format (\u0026lsquo;1h\u0026rsquo; for one hour, \u0026lsquo;10m\u0026rsquo; for ten minutes).\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.AdmissionPluginConfig": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "title": "name",
+          "description": "Name is the name of the admission controller.\nIt must match the registered admission plugin name.\n",
+          "markdownDescription": "Name is the name of the admission controller.\nIt must match the registered admission plugin name.",
+          "x-intellij-html-description": "\u003cp\u003eName is the name of the admission controller.\nIt must match the registered admission plugin name.\u003c/p\u003e\n"
+        },
+        "configuration": {
+          "type": "object",
+          "title": "configuration",
+          "description": "Configuration is an embedded configuration object to be used as the plugin’s\nconfiguration.\n",
+          "markdownDescription": "Configuration is an embedded configuration object to be used as the plugin's\nconfiguration.",
+          "x-intellij-html-description": "\u003cp\u003eConfiguration is an embedded configuration object to be used as the plugin\u0026rsquo;s\nconfiguration.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.Bond": {
+      "properties": {
+        "interfaces": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "interfaces",
+          "description": "The interfaces that make up the bond.\n",
+          "markdownDescription": "The interfaces that make up the bond.",
+          "x-intellij-html-description": "\u003cp\u003eThe interfaces that make up the bond.\u003c/p\u003e\n"
+        },
+        "deviceSelectors": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.NetworkDeviceSelector"
+          },
+          "type": "array",
+          "title": "deviceSelectors",
+          "description": "Picks a network device using the selector.\nMutually exclusive with interfaces.\nSupports partial match using wildcard syntax.\n",
+          "markdownDescription": "Picks a network device using the selector.\nMutually exclusive with `interfaces`.\nSupports partial match using wildcard syntax.",
+          "x-intellij-html-description": "\u003cp\u003ePicks a network device using the selector.\nMutually exclusive with \u003ccode\u003einterfaces\u003c/code\u003e.\nSupports partial match using wildcard syntax.\u003c/p\u003e\n"
+        },
+        "arpIPTarget": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "arpIPTarget",
+          "description": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\u003c/p\u003e\n"
+        },
+        "mode": {
+          "type": "string",
+          "title": "mode",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "xmitHashPolicy": {
+          "type": "string",
+          "title": "xmitHashPolicy",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "lacpRate": {
+          "type": "string",
+          "title": "lacpRate",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "adActorSystem": {
+          "type": "string",
+          "title": "adActorSystem",
+          "description": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\nNot supported at the moment.\u003c/p\u003e\n"
+        },
+        "arpValidate": {
+          "type": "string",
+          "title": "arpValidate",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "arpAllTargets": {
+          "type": "string",
+          "title": "arpAllTargets",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "primary": {
+          "type": "string",
+          "title": "primary",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "primaryReselect": {
+          "type": "string",
+          "title": "primaryReselect",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "failOverMac": {
+          "type": "string",
+          "title": "failOverMac",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "adSelect": {
+          "type": "string",
+          "title": "adSelect",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "miimon": {
+          "type": "integer",
+          "title": "miimon",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "updelay": {
+          "type": "integer",
+          "title": "updelay",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "downdelay": {
+          "type": "integer",
+          "title": "downdelay",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "arpInterval": {
+          "type": "integer",
+          "title": "arpInterval",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "resendIgmp": {
+          "type": "integer",
+          "title": "resendIgmp",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "minLinks": {
+          "type": "integer",
+          "title": "minLinks",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "lpInterval": {
+          "type": "integer",
+          "title": "lpInterval",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "packetsPerSlave": {
+          "type": "integer",
+          "title": "packetsPerSlave",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "numPeerNotif": {
+          "type": "integer",
+          "title": "numPeerNotif",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "tlbDynamicLb": {
+          "type": "integer",
+          "title": "tlbDynamicLb",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "allSlavesActive": {
+          "type": "integer",
+          "title": "allSlavesActive",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "useCarrier": {
+          "type": "boolean",
+          "title": "useCarrier",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "adActorSysPrio": {
+          "type": "integer",
+          "title": "adActorSysPrio",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "adUserPortKey": {
+          "type": "integer",
+          "title": "adUserPortKey",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        },
+        "peerNotifyDelay": {
+          "type": "integer",
+          "title": "peerNotifyDelay",
+          "description": "A bond option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bond option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bond option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.Bridge": {
+      "properties": {
+        "interfaces": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "interfaces",
+          "description": "The interfaces that make up the bridge.\n",
+          "markdownDescription": "The interfaces that make up the bridge.",
+          "x-intellij-html-description": "\u003cp\u003eThe interfaces that make up the bridge.\u003c/p\u003e\n"
+        },
+        "stp": {
+          "$ref": "#/$defs/v1alpha1.STP",
+          "title": "stp",
+          "description": "A bridge option.\nPlease see the official kernel documentation.\n",
+          "markdownDescription": "A bridge option.\nPlease see the official kernel documentation.",
+          "x-intellij-html-description": "\u003cp\u003eA bridge option.\nPlease see the official kernel documentation.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.CNIConfig": {
+      "properties": {
+        "name": {
+          "enum": [
+            "flannel",
+            "custom",
+            "none"
+          ],
+          "title": "name",
+          "description": "Name of CNI to use.\n",
+          "markdownDescription": "Name of CNI to use.",
+          "x-intellij-html-description": "\u003cp\u003eName of CNI to use.\u003c/p\u003e\n"
+        },
+        "urls": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "urls",
+          "description": "URLs containing manifests to apply for the CNI.\nShould be present for “custom”, must be empty for “flannel” and “none”.\n",
+          "markdownDescription": "URLs containing manifests to apply for the CNI.\nShould be present for \"custom\", must be empty for \"flannel\" and \"none\".",
+          "x-intellij-html-description": "\u003cp\u003eURLs containing manifests to apply for the CNI.\nShould be present for \u0026ldquo;custom\u0026rdquo;, must be empty for \u0026ldquo;flannel\u0026rdquo; and \u0026ldquo;none\u0026rdquo;.\u003c/p\u003e\n"
+        },
+        "flannel": {
+          "$ref": "#/$defs/v1alpha1.FlannelCNIConfig",
+          "title": "flannel",
+          "description": "description: |\nFlannel configuration options.\n",
+          "markdownDescription": "description: |\nFlannel configuration options.",
+          "x-intellij-html-description": "\u003cp\u003edescription: |\nFlannel configuration options.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.ClusterConfig": {
+      "properties": {
+        "id": {
+          "type": "string",
+          "title": "id",
+          "description": "Globally unique identifier for this cluster (base64 encoded random 32 bytes).\n",
+          "markdownDescription": "Globally unique identifier for this cluster (base64 encoded random 32 bytes).",
+          "x-intellij-html-description": "\u003cp\u003eGlobally unique identifier for this cluster (base64 encoded random 32 bytes).\u003c/p\u003e\n"
+        },
+        "secret": {
+          "type": "string",
+          "title": "secret",
+          "description": "Shared secret of cluster (base64 encoded random 32 bytes).\nThis secret is shared among cluster members but should never be sent over the network.\n",
+          "markdownDescription": "Shared secret of cluster (base64 encoded random 32 bytes).\nThis secret is shared among cluster members but should never be sent over the network.",
+          "x-intellij-html-description": "\u003cp\u003eShared secret of cluster (base64 encoded random 32 bytes).\nThis secret is shared among cluster members but should never be sent over the network.\u003c/p\u003e\n"
+        },
+        "controlPlane": {
+          "$ref": "#/$defs/v1alpha1.ControlPlaneConfig",
+          "title": "controlPlane",
+          "description": "Provides control plane specific configuration options.\n",
+          "markdownDescription": "Provides control plane specific configuration options.",
+          "x-intellij-html-description": "\u003cp\u003eProvides control plane specific configuration options.\u003c/p\u003e\n"
+        },
+        "clusterName": {
+          "type": "string",
+          "title": "clusterName",
+          "description": "Configures the cluster’s name.\n",
+          "markdownDescription": "Configures the cluster's name.",
+          "x-intellij-html-description": "\u003cp\u003eConfigures the cluster\u0026rsquo;s name.\u003c/p\u003e\n"
+        },
+        "network": {
+          "$ref": "#/$defs/v1alpha1.ClusterNetworkConfig",
+          "title": "network",
+          "description": "Provides cluster specific network configuration options.\n",
+          "markdownDescription": "Provides cluster specific network configuration options.",
+          "x-intellij-html-description": "\u003cp\u003eProvides cluster specific network configuration options.\u003c/p\u003e\n"
+        },
+        "token": {
+          "type": "string",
+          "title": "token",
+          "description": "The bootstrap token used to join the cluster.\n",
+          "markdownDescription": "The [bootstrap token](https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/) used to join the cluster.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ca href=\"https://kubernetes.io/docs/reference/access-authn-authz/bootstrap-tokens/\" target=\"_blank\"\u003ebootstrap token\u003c/a\u003e used to join the cluster.\u003c/p\u003e\n"
+        },
+        "aescbcEncryptionSecret": {
+          "type": "string",
+          "title": "aescbcEncryptionSecret",
+          "description": "A key used for the encryption of secret data at rest.\nEnables encryption with AESCBC.\n",
+          "markdownDescription": "A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).\nEnables encryption with AESCBC.",
+          "x-intellij-html-description": "\u003cp\u003eA key used for the \u003ca href=\"https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/\" target=\"_blank\"\u003eencryption of secret data at rest\u003c/a\u003e.\nEnables encryption with AESCBC.\u003c/p\u003e\n"
+        },
+        "secretboxEncryptionSecret": {
+          "type": "string",
+          "title": "secretboxEncryptionSecret",
+          "description": "A key used for the encryption of secret data at rest.\nEnables encryption with secretbox.\nSecretbox has precedence over AESCBC.\n",
+          "markdownDescription": "A key used for the [encryption of secret data at rest](https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/).\nEnables encryption with secretbox.\nSecretbox has precedence over AESCBC.",
+          "x-intellij-html-description": "\u003cp\u003eA key used for the \u003ca href=\"https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/\" target=\"_blank\"\u003eencryption of secret data at rest\u003c/a\u003e.\nEnables encryption with secretbox.\nSecretbox has precedence over AESCBC.\u003c/p\u003e\n"
+        },
+        "ca": {
+          "properties": {
+            "crt": {
+              "type": "string"
+            },
+            "key": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": false,
+          "type": "object",
+          "title": "ca",
+          "description": "The base64 encoded root certificate authority used by Kubernetes.\n",
+          "markdownDescription": "The base64 encoded root certificate authority used by Kubernetes.",
+          "x-intellij-html-description": "\u003cp\u003eThe base64 encoded root certificate authority used by Kubernetes.\u003c/p\u003e\n"
+        },
+        "aggregatorCA": {
+          "properties": {
+            "crt": {
+              "type": "string"
+            },
+            "key": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": false,
+          "type": "object",
+          "title": "aggregatorCA",
+          "description": "The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.\n\nThis CA can be self-signed.\n",
+          "markdownDescription": "The base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.\n\nThis CA can be self-signed.",
+          "x-intellij-html-description": "\u003cp\u003eThe base64 encoded aggregator certificate authority used by Kubernetes for front-proxy certificate generation.\u003c/p\u003e\n\n\u003cp\u003eThis CA can be self-signed.\u003c/p\u003e\n"
+        },
+        "serviceAccount": {
+          "properties": {
+            "key": {
+              "additionalProperties": false,
+              "type": "string"
+            }
+          },
+          "additionalProperties": false,
+          "type": "object",
+          "title": "serviceAccount",
+          "description": "The base64 encoded private key for service account token generation.\n",
+          "markdownDescription": "The base64 encoded private key for service account token generation.",
+          "x-intellij-html-description": "\u003cp\u003eThe base64 encoded private key for service account token generation.\u003c/p\u003e\n"
+        },
+        "apiServer": {
+          "$ref": "#/$defs/v1alpha1.APIServerConfig",
+          "title": "apiServer",
+          "description": "API server specific configuration options.\n",
+          "markdownDescription": "API server specific configuration options.",
+          "x-intellij-html-description": "\u003cp\u003eAPI server specific configuration options.\u003c/p\u003e\n"
+        },
+        "controllerManager": {
+          "$ref": "#/$defs/v1alpha1.ControllerManagerConfig",
+          "title": "controllerManager",
+          "description": "Controller manager server specific configuration options.\n",
+          "markdownDescription": "Controller manager server specific configuration options.",
+          "x-intellij-html-description": "\u003cp\u003eController manager server specific configuration options.\u003c/p\u003e\n"
+        },
+        "proxy": {
+          "$ref": "#/$defs/v1alpha1.ProxyConfig",
+          "title": "proxy",
+          "description": "Kube-proxy server-specific configuration options\n",
+          "markdownDescription": "Kube-proxy server-specific configuration options",
+          "x-intellij-html-description": "\u003cp\u003eKube-proxy server-specific configuration options\u003c/p\u003e\n"
+        },
+        "scheduler": {
+          "$ref": "#/$defs/v1alpha1.SchedulerConfig",
+          "title": "scheduler",
+          "description": "Scheduler server specific configuration options.\n",
+          "markdownDescription": "Scheduler server specific configuration options.",
+          "x-intellij-html-description": "\u003cp\u003eScheduler server specific configuration options.\u003c/p\u003e\n"
+        },
+        "discovery": {
+          "$ref": "#/$defs/v1alpha1.ClusterDiscoveryConfig",
+          "title": "discovery",
+          "description": "Configures cluster member discovery.\n",
+          "markdownDescription": "Configures cluster member discovery.",
+          "x-intellij-html-description": "\u003cp\u003eConfigures cluster member discovery.\u003c/p\u003e\n"
+        },
+        "etcd": {
+          "$ref": "#/$defs/v1alpha1.EtcdConfig",
+          "title": "etcd",
+          "description": "Etcd specific configuration options.\n",
+          "markdownDescription": "Etcd specific configuration options.",
+          "x-intellij-html-description": "\u003cp\u003eEtcd specific configuration options.\u003c/p\u003e\n"
+        },
+        "coreDNS": {
+          "$ref": "#/$defs/v1alpha1.CoreDNS",
+          "title": "coreDNS",
+          "description": "Core DNS specific configuration options.\n",
+          "markdownDescription": "Core DNS specific configuration options.",
+          "x-intellij-html-description": "\u003cp\u003eCore DNS specific configuration options.\u003c/p\u003e\n"
+        },
+        "externalCloudProvider": {
+          "$ref": "#/$defs/v1alpha1.ExternalCloudProviderConfig",
+          "title": "externalCloudProvider",
+          "description": "External cloud provider configuration.\n",
+          "markdownDescription": "External cloud provider configuration.",
+          "x-intellij-html-description": "\u003cp\u003eExternal cloud provider configuration.\u003c/p\u003e\n"
+        },
+        "extraManifests": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "extraManifests",
+          "description": "A list of urls that point to additional manifests.\nThese will get automatically deployed as part of the bootstrap.\n",
+          "markdownDescription": "A list of urls that point to additional manifests.\nThese will get automatically deployed as part of the bootstrap.",
+          "x-intellij-html-description": "\u003cp\u003eA list of urls that point to additional manifests.\nThese will get automatically deployed as part of the bootstrap.\u003c/p\u003e\n"
+        },
+        "extraManifestHeaders": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "extraManifestHeaders",
+          "description": "A map of key value pairs that will be added while fetching the extraManifests.\n",
+          "markdownDescription": "A map of key value pairs that will be added while fetching the extraManifests.",
+          "x-intellij-html-description": "\u003cp\u003eA map of key value pairs that will be added while fetching the extraManifests.\u003c/p\u003e\n"
+        },
+        "inlineManifests": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.ClusterInlineManifest"
+          },
+          "type": "array",
+          "title": "inlineManifests",
+          "description": "A list of inline Kubernetes manifests.\nThese will get automatically deployed as part of the bootstrap.\n",
+          "markdownDescription": "A list of inline Kubernetes manifests.\nThese will get automatically deployed as part of the bootstrap.",
+          "x-intellij-html-description": "\u003cp\u003eA list of inline Kubernetes manifests.\nThese will get automatically deployed as part of the bootstrap.\u003c/p\u003e\n"
+        },
+        "adminKubeconfig": {
+          "$ref": "#/$defs/v1alpha1.AdminKubeconfigConfig",
+          "title": "adminKubeconfig",
+          "description": "Settings for admin kubeconfig generation.\nCertificate lifetime can be configured.\n",
+          "markdownDescription": "Settings for admin kubeconfig generation.\nCertificate lifetime can be configured.",
+          "x-intellij-html-description": "\u003cp\u003eSettings for admin kubeconfig generation.\nCertificate lifetime can be configured.\u003c/p\u003e\n"
+        },
+        "allowSchedulingOnControlPlanes": {
+          "type": "boolean",
+          "title": "allowSchedulingOnControlPlanes",
+          "description": "Allows running workload on control-plane nodes.\n",
+          "markdownDescription": "Allows running workload on control-plane nodes.",
+          "x-intellij-html-description": "\u003cp\u003eAllows running workload on control-plane nodes.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.ClusterDiscoveryConfig": {
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "title": "enabled",
+          "description": "Enable the cluster membership discovery feature.\nCluster discovery is based on individual registries which are configured under the registries field.\n",
+          "markdownDescription": "Enable the cluster membership discovery feature.\nCluster discovery is based on individual registries which are configured under the registries field.",
+          "x-intellij-html-description": "\u003cp\u003eEnable the cluster membership discovery feature.\nCluster discovery is based on individual registries which are configured under the registries field.\u003c/p\u003e\n"
+        },
+        "registries": {
+          "$ref": "#/$defs/v1alpha1.DiscoveryRegistriesConfig",
+          "title": "registries",
+          "description": "Configure registries used for cluster member discovery.\n",
+          "markdownDescription": "Configure registries used for cluster member discovery.",
+          "x-intellij-html-description": "\u003cp\u003eConfigure registries used for cluster member discovery.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.ClusterInlineManifest": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "title": "name",
+          "description": "Name of the manifest.\nName should be unique.\n",
+          "markdownDescription": "Name of the manifest.\nName should be unique.",
+          "x-intellij-html-description": "\u003cp\u003eName of the manifest.\nName should be unique.\u003c/p\u003e\n"
+        },
+        "contents": {
+          "type": "string",
+          "title": "contents",
+          "description": "Manifest contents as a string.\n",
+          "markdownDescription": "Manifest contents as a string.",
+          "x-intellij-html-description": "\u003cp\u003eManifest contents as a string.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.ClusterNetworkConfig": {
+      "properties": {
+        "cni": {
+          "$ref": "#/$defs/v1alpha1.CNIConfig",
+          "title": "cni",
+          "description": "The CNI used.\nComposed of “name” and “urls”.\nThe “name” key supports the following options: “flannel”, “custom”, and “none”.\n“flannel” uses Talos-managed Flannel CNI, and that’s the default option.\n“custom” uses custom manifests that should be provided in “urls”.\n“none” indicates that Talos will not manage any CNI installation.\n",
+          "markdownDescription": "The CNI used.\nComposed of \"name\" and \"urls\".\nThe \"name\" key supports the following options: \"flannel\", \"custom\", and \"none\".\n\"flannel\" uses Talos-managed Flannel CNI, and that's the default option.\n\"custom\" uses custom manifests that should be provided in \"urls\".\n\"none\" indicates that Talos will not manage any CNI installation.",
+          "x-intellij-html-description": "\u003cp\u003eThe CNI used.\nComposed of \u0026ldquo;name\u0026rdquo; and \u0026ldquo;urls\u0026rdquo;.\nThe \u0026ldquo;name\u0026rdquo; key supports the following options: \u0026ldquo;flannel\u0026rdquo;, \u0026ldquo;custom\u0026rdquo;, and \u0026ldquo;none\u0026rdquo;.\n\u0026ldquo;flannel\u0026rdquo; uses Talos-managed Flannel CNI, and that\u0026rsquo;s the default option.\n\u0026ldquo;custom\u0026rdquo; uses custom manifests that should be provided in \u0026ldquo;urls\u0026rdquo;.\n\u0026ldquo;none\u0026rdquo; indicates that Talos will not manage any CNI installation.\u003c/p\u003e\n"
+        },
+        "dnsDomain": {
+          "type": "string",
+          "title": "dnsDomain",
+          "description": "The domain used by Kubernetes DNS.\nThe default is cluster.local\n",
+          "markdownDescription": "The domain used by Kubernetes DNS.\nThe default is `cluster.local`",
+          "x-intellij-html-description": "\u003cp\u003eThe domain used by Kubernetes DNS.\nThe default is \u003ccode\u003ecluster.local\u003c/code\u003e\u003c/p\u003e\n"
+        },
+        "podSubnets": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "podSubnets",
+          "description": "The pod subnet CIDR.\n",
+          "markdownDescription": "The pod subnet CIDR.",
+          "x-intellij-html-description": "\u003cp\u003eThe pod subnet CIDR.\u003c/p\u003e\n"
+        },
+        "serviceSubnets": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "serviceSubnets",
+          "description": "The service subnet CIDR.\n",
+          "markdownDescription": "The service subnet CIDR.",
+          "x-intellij-html-description": "\u003cp\u003eThe service subnet CIDR.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.Config": {
+      "properties": {
+        "version": {
+          "enum": [
+            "v1alpha1"
+          ],
+          "title": "version",
+          "description": "Indicates the schema used to decode the contents.\n",
+          "markdownDescription": "Indicates the schema used to decode the contents.",
+          "x-intellij-html-description": "\u003cp\u003eIndicates the schema used to decode the contents.\u003c/p\u003e\n"
+        },
+        "debug": {
+          "type": "boolean",
+          "title": "debug",
+          "description": "Enable verbose logging to the console.\nAll system containers logs will flow into serial console.\n\nNote: To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.\n",
+          "markdownDescription": "Enable verbose logging to the console.\nAll system containers logs will flow into serial console.\n\n**Note:** To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.",
+          "x-intellij-html-description": "\u003cp\u003eEnable verbose logging to the console.\nAll system containers logs will flow into serial console.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e To avoid breaking Talos bootstrap flow enable this option only if serial console can handle high message throughput.\u003c/p\u003e\n"
+        },
+        "machine": {
+          "$ref": "#/$defs/v1alpha1.MachineConfig",
+          "title": "machine",
+          "description": "Provides machine specific configuration options.\n",
+          "markdownDescription": "Provides machine specific configuration options.",
+          "x-intellij-html-description": "\u003cp\u003eProvides machine specific configuration options.\u003c/p\u003e\n"
+        },
+        "cluster": {
+          "$ref": "#/$defs/v1alpha1.ClusterConfig",
+          "title": "cluster",
+          "description": "Provides cluster specific configuration options.\n",
+          "markdownDescription": "Provides cluster specific configuration options.",
+          "x-intellij-html-description": "\u003cp\u003eProvides cluster specific configuration options.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.ControlPlaneConfig": {
+      "properties": {
+        "endpoint": {
+          "type": "string",
+          "pattern": "^https://",
+          "format": "uri",
+          "title": "endpoint",
+          "description": "Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.\nIt is single-valued, and may optionally include a port number.\n",
+          "markdownDescription": "Endpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.\nIt is single-valued, and may optionally include a port number.",
+          "x-intellij-html-description": "\u003cp\u003eEndpoint is the canonical controlplane endpoint, which can be an IP address or a DNS hostname.\nIt is single-valued, and may optionally include a port number.\u003c/p\u003e\n"
+        },
+        "localAPIServerPort": {
+          "type": "integer",
+          "title": "localAPIServerPort",
+          "description": "The port that the API server listens on internally.\nThis may be different than the port portion listed in the endpoint field above.\nThe default is 6443.\n",
+          "markdownDescription": "The port that the API server listens on internally.\nThis may be different than the port portion listed in the endpoint field above.\nThe default is `6443`.",
+          "x-intellij-html-description": "\u003cp\u003eThe port that the API server listens on internally.\nThis may be different than the port portion listed in the endpoint field above.\nThe default is \u003ccode\u003e6443\u003c/code\u003e.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.ControllerManagerConfig": {
+      "properties": {
+        "image": {
+          "type": "string",
+          "title": "image",
+          "description": "The container image used in the controller manager manifest.\n",
+          "markdownDescription": "The container image used in the controller manager manifest.",
+          "x-intellij-html-description": "\u003cp\u003eThe container image used in the controller manager manifest.\u003c/p\u003e\n"
+        },
+        "extraArgs": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "extraArgs",
+          "description": "Extra arguments to supply to the controller manager.\n",
+          "markdownDescription": "Extra arguments to supply to the controller manager.",
+          "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to the controller manager.\u003c/p\u003e\n"
+        },
+        "extraVolumes": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.VolumeMountConfig"
+          },
+          "type": "array",
+          "title": "extraVolumes",
+          "description": "Extra volumes to mount to the controller manager static pod.\n",
+          "markdownDescription": "Extra volumes to mount to the controller manager static pod.",
+          "x-intellij-html-description": "\u003cp\u003eExtra volumes to mount to the controller manager static pod.\u003c/p\u003e\n"
+        },
+        "env": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "env",
+          "description": "The env field allows for the addition of environment variables for the control plane component.\n",
+          "markdownDescription": "The `env` field allows for the addition of environment variables for the control plane component.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables for the control plane component.\u003c/p\u003e\n"
+        },
+        "resources": {
+          "type": "object",
+          "title": "resources",
+          "description": "Configure the controller manager resources.\n",
+          "markdownDescription": "Configure the controller manager resources.",
+          "x-intellij-html-description": "\u003cp\u003eConfigure the controller manager resources.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.CoreDNS": {
+      "properties": {
+        "disabled": {
+          "type": "boolean",
+          "title": "disabled",
+          "description": "Disable coredns deployment on cluster bootstrap.\n",
+          "markdownDescription": "Disable coredns deployment on cluster bootstrap.",
+          "x-intellij-html-description": "\u003cp\u003eDisable coredns deployment on cluster bootstrap.\u003c/p\u003e\n"
+        },
+        "image": {
+          "type": "string",
+          "title": "image",
+          "description": "The image field is an override to the default coredns image.\n",
+          "markdownDescription": "The `image` field is an override to the default coredns image.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eimage\u003c/code\u003e field is an override to the default coredns image.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.DHCPOptions": {
+      "properties": {
+        "routeMetric": {
+          "type": "integer",
+          "title": "routeMetric",
+          "description": "The priority of all routes received via DHCP.\n",
+          "markdownDescription": "The priority of all routes received via DHCP.",
+          "x-intellij-html-description": "\u003cp\u003eThe priority of all routes received via DHCP.\u003c/p\u003e\n"
+        },
+        "ipv4": {
+          "type": "boolean",
+          "title": "ipv4",
+          "description": "Enables DHCPv4 protocol for the interface (default is enabled).\n",
+          "markdownDescription": "Enables DHCPv4 protocol for the interface (default is enabled).",
+          "x-intellij-html-description": "\u003cp\u003eEnables DHCPv4 protocol for the interface (default is enabled).\u003c/p\u003e\n"
+        },
+        "ipv6": {
+          "type": "boolean",
+          "title": "ipv6",
+          "description": "Enables DHCPv6 protocol for the interface (default is disabled).\n",
+          "markdownDescription": "Enables DHCPv6 protocol for the interface (default is disabled).",
+          "x-intellij-html-description": "\u003cp\u003eEnables DHCPv6 protocol for the interface (default is disabled).\u003c/p\u003e\n"
+        },
+        "duidv6": {
+          "type": "string",
+          "title": "duidv6",
+          "description": "Set client DUID (hex string).\n",
+          "markdownDescription": "Set client DUID (hex string).",
+          "x-intellij-html-description": "\u003cp\u003eSet client DUID (hex string).\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.Device": {
+      "properties": {
+        "interface": {
+          "type": "string",
+          "title": "interface",
+          "description": "The interface name.\nMutually exclusive with deviceSelector.\n",
+          "markdownDescription": "The interface name.\nMutually exclusive with `deviceSelector`.",
+          "x-intellij-html-description": "\u003cp\u003eThe interface name.\nMutually exclusive with \u003ccode\u003edeviceSelector\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "deviceSelector": {
+          "$ref": "#/$defs/v1alpha1.NetworkDeviceSelector",
+          "title": "deviceSelector",
+          "description": "Picks a network device using the selector.\nMutually exclusive with interface.\nSupports partial match using wildcard syntax.\n",
+          "markdownDescription": "Picks a network device using the selector.\nMutually exclusive with `interface`.\nSupports partial match using wildcard syntax.",
+          "x-intellij-html-description": "\u003cp\u003ePicks a network device using the selector.\nMutually exclusive with \u003ccode\u003einterface\u003c/code\u003e.\nSupports partial match using wildcard syntax.\u003c/p\u003e\n"
+        },
+        "addresses": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "addresses",
+          "description": "Assigns static IP addresses to the interface.\nAn address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).\n",
+          "markdownDescription": "Assigns static IP addresses to the interface.\nAn address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).",
+          "x-intellij-html-description": "\u003cp\u003eAssigns static IP addresses to the interface.\nAn address can be specified either in proper CIDR notation or as a standalone address (netmask of all ones is assumed).\u003c/p\u003e\n"
+        },
+        "routes": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.Route"
+          },
+          "type": "array",
+          "title": "routes",
+          "description": "A list of routes associated with the interface.\nIf used in combination with DHCP, these routes will be appended to routes returned by DHCP server.\n",
+          "markdownDescription": "A list of routes associated with the interface.\nIf used in combination with DHCP, these routes will be appended to routes returned by DHCP server.",
+          "x-intellij-html-description": "\u003cp\u003eA list of routes associated with the interface.\nIf used in combination with DHCP, these routes will be appended to routes returned by DHCP server.\u003c/p\u003e\n"
+        },
+        "bond": {
+          "$ref": "#/$defs/v1alpha1.Bond",
+          "title": "bond",
+          "description": "Bond specific options.\n",
+          "markdownDescription": "Bond specific options.",
+          "x-intellij-html-description": "\u003cp\u003eBond specific options.\u003c/p\u003e\n"
+        },
+        "bridge": {
+          "$ref": "#/$defs/v1alpha1.Bridge",
+          "title": "bridge",
+          "description": "Bridge specific options.\n",
+          "markdownDescription": "Bridge specific options.",
+          "x-intellij-html-description": "\u003cp\u003eBridge specific options.\u003c/p\u003e\n"
+        },
+        "vlans": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.Vlan"
+          },
+          "type": "array",
+          "title": "vlans",
+          "description": "VLAN specific options.\n",
+          "markdownDescription": "VLAN specific options.",
+          "x-intellij-html-description": "\u003cp\u003eVLAN specific options.\u003c/p\u003e\n"
+        },
+        "mtu": {
+          "type": "integer",
+          "title": "mtu",
+          "description": "The interface’s MTU.\nIf used in combination with DHCP, this will override any MTU settings returned from DHCP server.\n",
+          "markdownDescription": "The interface's MTU.\nIf used in combination with DHCP, this will override any MTU settings returned from DHCP server.",
+          "x-intellij-html-description": "\u003cp\u003eThe interface\u0026rsquo;s MTU.\nIf used in combination with DHCP, this will override any MTU settings returned from DHCP server.\u003c/p\u003e\n"
+        },
+        "dhcp": {
+          "type": "boolean",
+          "title": "dhcp",
+          "description": "Indicates if DHCP should be used to configure the interface.\nThe following DHCP options are supported:\n\n\nOptionClasslessStaticRoute\nOptionDomainNameServer\nOptionDNSDomainSearchList\nOptionHostName\n\n",
+          "markdownDescription": "Indicates if DHCP should be used to configure the interface.\nThe following DHCP options are supported:\n\n- `OptionClasslessStaticRoute`\n- `OptionDomainNameServer`\n- `OptionDNSDomainSearchList`\n- `OptionHostName`",
+          "x-intellij-html-description": "\u003cp\u003eIndicates if DHCP should be used to configure the interface.\nThe following DHCP options are supported:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eOptionClasslessStaticRoute\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eOptionDomainNameServer\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eOptionDNSDomainSearchList\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eOptionHostName\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n"
+        },
+        "ignore": {
+          "type": "boolean",
+          "title": "ignore",
+          "description": "Indicates if the interface should be ignored (skips configuration).\n",
+          "markdownDescription": "Indicates if the interface should be ignored (skips configuration).",
+          "x-intellij-html-description": "\u003cp\u003eIndicates if the interface should be ignored (skips configuration).\u003c/p\u003e\n"
+        },
+        "dummy": {
+          "type": "boolean",
+          "title": "dummy",
+          "description": "Indicates if the interface is a dummy interface.\ndummy is used to specify that this interface should be a virtual-only, dummy interface.\n",
+          "markdownDescription": "Indicates if the interface is a dummy interface.\n`dummy` is used to specify that this interface should be a virtual-only, dummy interface.",
+          "x-intellij-html-description": "\u003cp\u003eIndicates if the interface is a dummy interface.\n\u003ccode\u003edummy\u003c/code\u003e is used to specify that this interface should be a virtual-only, dummy interface.\u003c/p\u003e\n"
+        },
+        "dhcpOptions": {
+          "$ref": "#/$defs/v1alpha1.DHCPOptions",
+          "title": "dhcpOptions",
+          "description": "DHCP specific options.\ndhcp must be set to true for these to take effect.\n",
+          "markdownDescription": "DHCP specific options.\n`dhcp` *must* be set to true for these to take effect.",
+          "x-intellij-html-description": "\u003cp\u003eDHCP specific options.\n\u003ccode\u003edhcp\u003c/code\u003e \u003cem\u003emust\u003c/em\u003e be set to true for these to take effect.\u003c/p\u003e\n"
+        },
+        "wireguard": {
+          "$ref": "#/$defs/v1alpha1.DeviceWireguardConfig",
+          "title": "wireguard",
+          "description": "Wireguard specific configuration.\nIncludes things like private key, listen port, peers.\n",
+          "markdownDescription": "Wireguard specific configuration.\nIncludes things like private key, listen port, peers.",
+          "x-intellij-html-description": "\u003cp\u003eWireguard specific configuration.\nIncludes things like private key, listen port, peers.\u003c/p\u003e\n"
+        },
+        "vip": {
+          "$ref": "#/$defs/v1alpha1.DeviceVIPConfig",
+          "title": "vip",
+          "description": "Virtual (shared) IP address configuration.\n",
+          "markdownDescription": "Virtual (shared) IP address configuration.",
+          "x-intellij-html-description": "\u003cp\u003eVirtual (shared) IP address configuration.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.DeviceVIPConfig": {
+      "properties": {
+        "ip": {
+          "type": "string",
+          "title": "ip",
+          "description": "Specifies the IP address to be used.\n",
+          "markdownDescription": "Specifies the IP address to be used.",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies the IP address to be used.\u003c/p\u003e\n"
+        },
+        "equinixMetal": {
+          "$ref": "#/$defs/v1alpha1.VIPEquinixMetalConfig",
+          "title": "equinixMetal",
+          "description": "Specifies the Equinix Metal API settings to assign VIP to the node.\n",
+          "markdownDescription": "Specifies the Equinix Metal API settings to assign VIP to the node.",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies the Equinix Metal API settings to assign VIP to the node.\u003c/p\u003e\n"
+        },
+        "hcloud": {
+          "$ref": "#/$defs/v1alpha1.VIPHCloudConfig",
+          "title": "hcloud",
+          "description": "Specifies the Hetzner Cloud API settings to assign VIP to the node.\n",
+          "markdownDescription": "Specifies the Hetzner Cloud API settings to assign VIP to the node.",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies the Hetzner Cloud API settings to assign VIP to the node.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.DeviceWireguardConfig": {
+      "properties": {
+        "privateKey": {
+          "type": "string",
+          "title": "privateKey",
+          "description": "Specifies a private key configuration (base64 encoded).\nCan be generated by wg genkey.\n",
+          "markdownDescription": "Specifies a private key configuration (base64 encoded).\nCan be generated by `wg genkey`.",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies a private key configuration (base64 encoded).\nCan be generated by \u003ccode\u003ewg genkey\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "listenPort": {
+          "type": "integer",
+          "title": "listenPort",
+          "description": "Specifies a device’s listening port.\n",
+          "markdownDescription": "Specifies a device's listening port.",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies a device\u0026rsquo;s listening port.\u003c/p\u003e\n"
+        },
+        "firewallMark": {
+          "type": "integer",
+          "title": "firewallMark",
+          "description": "Specifies a device’s firewall mark.\n",
+          "markdownDescription": "Specifies a device's firewall mark.",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies a device\u0026rsquo;s firewall mark.\u003c/p\u003e\n"
+        },
+        "peers": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.DeviceWireguardPeer"
+          },
+          "type": "array",
+          "title": "peers",
+          "description": "Specifies a list of peer configurations to apply to a device.\n",
+          "markdownDescription": "Specifies a list of peer configurations to apply to a device.",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies a list of peer configurations to apply to a device.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.DeviceWireguardPeer": {
+      "properties": {
+        "publicKey": {
+          "type": "string",
+          "title": "publicKey",
+          "description": "Specifies the public key of this peer.\nCan be extracted from private key by running wg pubkey \u0026lt; private.key \u0026gt; public.key \u0026amp;\u0026amp; cat public.key.\n",
+          "markdownDescription": "Specifies the public key of this peer.\nCan be extracted from private key by running `wg pubkey \u003c private.key \u003e public.key \u0026\u0026 cat public.key`.",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies the public key of this peer.\nCan be extracted from private key by running \u003ccode\u003ewg pubkey \u0026lt; private.key \u0026gt; public.key \u0026amp;\u0026amp; cat public.key\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "endpoint": {
+          "type": "string",
+          "title": "endpoint",
+          "description": "Specifies the endpoint of this peer entry.\n",
+          "markdownDescription": "Specifies the endpoint of this peer entry.",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies the endpoint of this peer entry.\u003c/p\u003e\n"
+        },
+        "persistentKeepaliveInterval": {
+          "type": "string",
+          "pattern": "^[-+]?(((\\d+(\\.\\d*)?|\\d*(\\.\\d+)+)([nuµm]?s|m|h))|0)+$",
+          "title": "persistentKeepaliveInterval",
+          "description": "Specifies the persistent keepalive interval for this peer.\nField format accepts any Go time.Duration format (‘1h’ for one hour, ‘10m’ for ten minutes).\n",
+          "markdownDescription": "Specifies the persistent keepalive interval for this peer.\nField format accepts any Go time.Duration format ('1h' for one hour, '10m' for ten minutes).",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies the persistent keepalive interval for this peer.\nField format accepts any Go time.Duration format (\u0026lsquo;1h\u0026rsquo; for one hour, \u0026lsquo;10m\u0026rsquo; for ten minutes).\u003c/p\u003e\n"
+        },
+        "allowedIPs": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "allowedIPs",
+          "description": "AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.\n",
+          "markdownDescription": "AllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.",
+          "x-intellij-html-description": "\u003cp\u003eAllowedIPs specifies a list of allowed IP addresses in CIDR notation for this peer.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.DiscoveryRegistriesConfig": {
+      "properties": {
+        "kubernetes": {
+          "$ref": "#/$defs/v1alpha1.RegistryKubernetesConfig",
+          "title": "kubernetes",
+          "description": "Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information\nas annotations on the Node resources.\n",
+          "markdownDescription": "Kubernetes registry uses Kubernetes API server to discover cluster members and stores additional information\nas annotations on the Node resources.",
+          "x-intellij-html-description": "\u003cp\u003eKubernetes registry uses Kubernetes API server to discover cluster members and stores additional information\nas annotations on the Node resources.\u003c/p\u003e\n"
+        },
+        "service": {
+          "$ref": "#/$defs/v1alpha1.RegistryServiceConfig",
+          "title": "service",
+          "description": "Service registry is using an external service to push and pull information about cluster members.\n",
+          "markdownDescription": "Service registry is using an external service to push and pull information about cluster members.",
+          "x-intellij-html-description": "\u003cp\u003eService registry is using an external service to push and pull information about cluster members.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.DiskPartition": {
+      "properties": {
+        "size": {
+          "type": "integer",
+          "title": "size",
+          "description": "The size of partition: either bytes or human readable representation. If size: is omitted, the partition is sized to occupy the full disk.\n",
+          "markdownDescription": "The size of partition: either bytes or human readable representation. If `size:` is omitted, the partition is sized to occupy the full disk.",
+          "x-intellij-html-description": "\u003cp\u003eThe size of partition: either bytes or human readable representation. If \u003ccode\u003esize:\u003c/code\u003e is omitted, the partition is sized to occupy the full disk.\u003c/p\u003e\n"
+        },
+        "mountpoint": {
+          "type": "string",
+          "title": "mountpoint",
+          "description": "Where to mount the partition.\n",
+          "markdownDescription": "Where to mount the partition.",
+          "x-intellij-html-description": "\u003cp\u003eWhere to mount the partition.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.EncryptionConfig": {
+      "properties": {
+        "provider": {
+          "type": "string",
+          "title": "provider",
+          "description": "Encryption provider to use for the encryption.\n",
+          "markdownDescription": "Encryption provider to use for the encryption.",
+          "x-intellij-html-description": "\u003cp\u003eEncryption provider to use for the encryption.\u003c/p\u003e\n"
+        },
+        "keys": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.EncryptionKey"
+          },
+          "type": "array",
+          "title": "keys",
+          "description": "Defines the encryption keys generation and storage method.\n",
+          "markdownDescription": "Defines the encryption keys generation and storage method.",
+          "x-intellij-html-description": "\u003cp\u003eDefines the encryption keys generation and storage method.\u003c/p\u003e\n"
+        },
+        "cipher": {
+          "enum": [
+            "aes-xts-plain64",
+            "xchacha12,aes-adiantum-plain64",
+            "xchacha20,aes-adiantum-plain64"
+          ],
+          "title": "cipher",
+          "description": "Cipher kind to use for the encryption. Depends on the encryption provider.\n",
+          "markdownDescription": "Cipher kind to use for the encryption. Depends on the encryption provider.",
+          "x-intellij-html-description": "\u003cp\u003eCipher kind to use for the encryption. Depends on the encryption provider.\u003c/p\u003e\n"
+        },
+        "keySize": {
+          "type": "integer",
+          "title": "keySize",
+          "description": "Defines the encryption key length.\n",
+          "markdownDescription": "Defines the encryption key length.",
+          "x-intellij-html-description": "\u003cp\u003eDefines the encryption key length.\u003c/p\u003e\n"
+        },
+        "blockSize": {
+          "type": "integer",
+          "title": "blockSize",
+          "description": "Defines the encryption sector size.\n",
+          "markdownDescription": "Defines the encryption sector size.",
+          "x-intellij-html-description": "\u003cp\u003eDefines the encryption sector size.\u003c/p\u003e\n"
+        },
+        "options": {
+          "enum": [
+            "no_read_workqueue",
+            "no_write_workqueue",
+            "same_cpu_crypt"
+          ],
+          "title": "options",
+          "description": "Additional –perf parameters for the LUKS2 encryption.\n",
+          "markdownDescription": "Additional --perf parameters for the LUKS2 encryption.",
+          "x-intellij-html-description": "\u003cp\u003eAdditional \u0026ndash;perf parameters for the LUKS2 encryption.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.EncryptionKey": {
+      "properties": {
+        "static": {
+          "$ref": "#/$defs/v1alpha1.EncryptionKeyStatic",
+          "title": "static",
+          "description": "Key which value is stored in the configuration file.\n",
+          "markdownDescription": "Key which value is stored in the configuration file.",
+          "x-intellij-html-description": "\u003cp\u003eKey which value is stored in the configuration file.\u003c/p\u003e\n"
+        },
+        "nodeID": {
+          "$ref": "#/$defs/v1alpha1.EncryptionKeyNodeID",
+          "title": "nodeID",
+          "description": "Deterministically generated key from the node UUID and PartitionLabel.\n",
+          "markdownDescription": "Deterministically generated key from the node UUID and PartitionLabel.",
+          "x-intellij-html-description": "\u003cp\u003eDeterministically generated key from the node UUID and PartitionLabel.\u003c/p\u003e\n"
+        },
+        "kms": {
+          "$ref": "#/$defs/v1alpha1.EncryptionKeyKMS",
+          "title": "kms",
+          "description": "KMS managed encryption key.\n",
+          "markdownDescription": "KMS managed encryption key.",
+          "x-intellij-html-description": "\u003cp\u003eKMS managed encryption key.\u003c/p\u003e\n"
+        },
+        "slot": {
+          "type": "integer",
+          "title": "slot",
+          "description": "Key slot number for LUKS2 encryption.\n",
+          "markdownDescription": "Key slot number for LUKS2 encryption.",
+          "x-intellij-html-description": "\u003cp\u003eKey slot number for LUKS2 encryption.\u003c/p\u003e\n"
+        },
+        "tpm": {
+          "$ref": "#/$defs/v1alpha1.EncryptionKeyTPM",
+          "title": "tpm",
+          "description": "Enable TPM based disk encryption.\n",
+          "markdownDescription": "Enable TPM based disk encryption.",
+          "x-intellij-html-description": "\u003cp\u003eEnable TPM based disk encryption.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.EncryptionKeyKMS": {
+      "properties": {
+        "endpoint": {
+          "type": "string",
+          "title": "endpoint",
+          "description": "KMS endpoint to Seal/Unseal the key.\n",
+          "markdownDescription": "KMS endpoint to Seal/Unseal the key.",
+          "x-intellij-html-description": "\u003cp\u003eKMS endpoint to Seal/Unseal the key.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.EncryptionKeyNodeID": {
+      "properties": {},
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.EncryptionKeyStatic": {
+      "properties": {
+        "passphrase": {
+          "type": "string",
+          "title": "passphrase",
+          "description": "Defines the static passphrase value.\n",
+          "markdownDescription": "Defines the static passphrase value.",
+          "x-intellij-html-description": "\u003cp\u003eDefines the static passphrase value.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.EncryptionKeyTPM": {
+      "properties": {},
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.Endpoint": {
+      "properties": {},
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.EtcdConfig": {
+      "properties": {
+        "image": {
+          "type": "string",
+          "title": "image",
+          "description": "The container image used to create the etcd service.\n",
+          "markdownDescription": "The container image used to create the etcd service.",
+          "x-intellij-html-description": "\u003cp\u003eThe container image used to create the etcd service.\u003c/p\u003e\n"
+        },
+        "ca": {
+          "properties": {
+            "crt": {
+              "type": "string"
+            },
+            "key": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": false,
+          "type": "object",
+          "title": "ca",
+          "description": "The ca is the root certificate authority of the PKI.\nIt is composed of a base64 encoded crt and key.\n",
+          "markdownDescription": "The `ca` is the root certificate authority of the PKI.\nIt is composed of a base64 encoded `crt` and `key`.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eca\u003c/code\u003e is the root certificate authority of the PKI.\nIt is composed of a base64 encoded \u003ccode\u003ecrt\u003c/code\u003e and \u003ccode\u003ekey\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "extraArgs": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "extraArgs",
+          "description": "Extra arguments to supply to etcd.\nNote that the following args are not allowed:\n\n\nname\ndata-dir\ninitial-cluster-state\nlisten-peer-urls\nlisten-client-urls\ncert-file\nkey-file\ntrusted-ca-file\npeer-client-cert-auth\npeer-cert-file\npeer-trusted-ca-file\npeer-key-file\n\n",
+          "markdownDescription": "Extra arguments to supply to etcd.\nNote that the following args are not allowed:\n\n- `name`\n- `data-dir`\n- `initial-cluster-state`\n- `listen-peer-urls`\n- `listen-client-urls`\n- `cert-file`\n- `key-file`\n- `trusted-ca-file`\n- `peer-client-cert-auth`\n- `peer-cert-file`\n- `peer-trusted-ca-file`\n- `peer-key-file`",
+          "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to etcd.\nNote that the following args are not allowed:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003ename\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003edata-dir\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003einitial-cluster-state\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003elisten-peer-urls\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003elisten-client-urls\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ecert-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ekey-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etrusted-ca-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-client-cert-auth\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-cert-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-trusted-ca-file\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epeer-key-file\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n"
+        },
+        "advertisedSubnets": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "advertisedSubnets",
+          "description": "The advertisedSubnets field configures the networks to pick etcd advertised IP from.\n\nIPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\n",
+          "markdownDescription": "The `advertisedSubnets` field configures the networks to pick etcd advertised IP from.\n\nIPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eadvertisedSubnets\u003c/code\u003e field configures the networks to pick etcd advertised IP from.\u003c/p\u003e\n\n\u003cp\u003eIPs can be excluded from the list by using negative match with \u003ccode\u003e!\u003c/code\u003e, e.g \u003ccode\u003e!10.0.0.0/8\u003c/code\u003e.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\u003c/p\u003e\n"
+        },
+        "listenSubnets": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "listenSubnets",
+          "description": "The listenSubnets field configures the networks for the etcd to listen for peer and client connections.\n\nIf listenSubnets is not set, but advertisedSubnets is set, listenSubnets defaults to\nadvertisedSubnets.\n\nIf neither advertisedSubnets nor listenSubnets is set, listenSubnets defaults to listen on all addresses.\n\nIPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\n",
+          "markdownDescription": "The `listenSubnets` field configures the networks for the etcd to listen for peer and client connections.\n\nIf `listenSubnets` is not set, but `advertisedSubnets` is set, `listenSubnets` defaults to\n`advertisedSubnets`.\n\nIf neither `advertisedSubnets` nor `listenSubnets` is set, `listenSubnets` defaults to listen on all addresses.\n\nIPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003elistenSubnets\u003c/code\u003e field configures the networks for the etcd to listen for peer and client connections.\u003c/p\u003e\n\n\u003cp\u003eIf \u003ccode\u003elistenSubnets\u003c/code\u003e is not set, but \u003ccode\u003eadvertisedSubnets\u003c/code\u003e is set, \u003ccode\u003elistenSubnets\u003c/code\u003e defaults to\n\u003ccode\u003eadvertisedSubnets\u003c/code\u003e.\u003c/p\u003e\n\n\u003cp\u003eIf neither \u003ccode\u003eadvertisedSubnets\u003c/code\u003e nor \u003ccode\u003elistenSubnets\u003c/code\u003e is set, \u003ccode\u003elistenSubnets\u003c/code\u003e defaults to listen on all addresses.\u003c/p\u003e\n\n\u003cp\u003eIPs can be excluded from the list by using negative match with \u003ccode\u003e!\u003c/code\u003e, e.g \u003ccode\u003e!10.0.0.0/8\u003c/code\u003e.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, advertised IP is selected as the first routable address of the node.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.ExternalCloudProviderConfig": {
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "title": "enabled",
+          "description": "Enable external cloud provider.\n",
+          "markdownDescription": "Enable external cloud provider.",
+          "x-intellij-html-description": "\u003cp\u003eEnable external cloud provider.\u003c/p\u003e\n"
+        },
+        "manifests": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "manifests",
+          "description": "A list of urls that point to additional manifests for an external cloud provider.\nThese will get automatically deployed as part of the bootstrap.\n",
+          "markdownDescription": "A list of urls that point to additional manifests for an external cloud provider.\nThese will get automatically deployed as part of the bootstrap.",
+          "x-intellij-html-description": "\u003cp\u003eA list of urls that point to additional manifests for an external cloud provider.\nThese will get automatically deployed as part of the bootstrap.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.ExtraHost": {
+      "properties": {
+        "ip": {
+          "type": "string",
+          "title": "ip",
+          "description": "The IP of the host.\n",
+          "markdownDescription": "The IP of the host.",
+          "x-intellij-html-description": "\u003cp\u003eThe IP of the host.\u003c/p\u003e\n"
+        },
+        "aliases": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "aliases",
+          "description": "The host alias.\n",
+          "markdownDescription": "The host alias.",
+          "x-intellij-html-description": "\u003cp\u003eThe host alias.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.ExtraMount": {
+      "properties": {
+        "destination": {
+          "type": "string",
+          "title": "destination",
+          "description": "Destination is the absolute path where the mount will be placed in the container.\n",
+          "markdownDescription": "Destination is the absolute path where the mount will be placed in the container.",
+          "x-intellij-html-description": "\u003cp\u003eDestination is the absolute path where the mount will be placed in the container.\u003c/p\u003e\n"
+        },
+        "type": {
+          "type": "string",
+          "title": "type",
+          "description": "Type specifies the mount kind.\n",
+          "markdownDescription": "Type specifies the mount kind.",
+          "x-intellij-html-description": "\u003cp\u003eType specifies the mount kind.\u003c/p\u003e\n"
+        },
+        "source": {
+          "type": "string",
+          "title": "source",
+          "description": "Source specifies the source path of the mount.\n",
+          "markdownDescription": "Source specifies the source path of the mount.",
+          "x-intellij-html-description": "\u003cp\u003eSource specifies the source path of the mount.\u003c/p\u003e\n"
+        },
+        "options": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "options",
+          "description": "Options are fstab style mount options.\n",
+          "markdownDescription": "Options are fstab style mount options.",
+          "x-intellij-html-description": "\u003cp\u003eOptions are fstab style mount options.\u003c/p\u003e\n"
+        },
+        "uidMappings": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.LinuxIDMapping"
+          },
+          "type": "array",
+          "title": "uidMappings",
+          "description": "UID/GID mappings used for changing file owners w/o calling chown, fs should support it.\n\nEvery mount point could have its own mapping.\n",
+          "markdownDescription": "UID/GID mappings used for changing file owners w/o calling chown, fs should support it.\n\nEvery mount point could have its own mapping.",
+          "x-intellij-html-description": "\u003cp\u003eUID/GID mappings used for changing file owners w/o calling chown, fs should support it.\u003c/p\u003e\n\n\u003cp\u003eEvery mount point could have its own mapping.\u003c/p\u003e\n"
+        },
+        "gidMappings": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.LinuxIDMapping"
+          },
+          "type": "array",
+          "title": "gidMappings",
+          "description": "UID/GID mappings used for changing file owners w/o calling chown, fs should support it.\n\nEvery mount point could have its own mapping.\n",
+          "markdownDescription": "UID/GID mappings used for changing file owners w/o calling chown, fs should support it.\n\nEvery mount point could have its own mapping.",
+          "x-intellij-html-description": "\u003cp\u003eUID/GID mappings used for changing file owners w/o calling chown, fs should support it.\u003c/p\u003e\n\n\u003cp\u003eEvery mount point could have its own mapping.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.FeaturesConfig": {
+      "properties": {
+        "rbac": {
+          "type": "boolean",
+          "title": "rbac",
+          "description": "Enable role-based access control (RBAC).\n",
+          "markdownDescription": "Enable role-based access control (RBAC).",
+          "x-intellij-html-description": "\u003cp\u003eEnable role-based access control (RBAC).\u003c/p\u003e\n"
+        },
+        "stableHostname": {
+          "type": "boolean",
+          "title": "stableHostname",
+          "description": "Enable stable default hostname.\n",
+          "markdownDescription": "Enable stable default hostname.",
+          "x-intellij-html-description": "\u003cp\u003eEnable stable default hostname.\u003c/p\u003e\n"
+        },
+        "kubernetesTalosAPIAccess": {
+          "$ref": "#/$defs/v1alpha1.KubernetesTalosAPIAccessConfig",
+          "title": "kubernetesTalosAPIAccess",
+          "description": "Configure Talos API access from Kubernetes pods.\n\nThis feature is disabled if the feature config is not specified.\n",
+          "markdownDescription": "Configure Talos API access from Kubernetes pods.\n\nThis feature is disabled if the feature config is not specified.",
+          "x-intellij-html-description": "\u003cp\u003eConfigure Talos API access from Kubernetes pods.\u003c/p\u003e\n\n\u003cp\u003eThis feature is disabled if the feature config is not specified.\u003c/p\u003e\n"
+        },
+        "apidCheckExtKeyUsage": {
+          "type": "boolean",
+          "title": "apidCheckExtKeyUsage",
+          "description": "Enable checks for extended key usage of client certificates in apid.\n",
+          "markdownDescription": "Enable checks for extended key usage of client certificates in apid.",
+          "x-intellij-html-description": "\u003cp\u003eEnable checks for extended key usage of client certificates in apid.\u003c/p\u003e\n"
+        },
+        "diskQuotaSupport": {
+          "type": "boolean",
+          "title": "diskQuotaSupport",
+          "description": "Enable XFS project quota support for EPHEMERAL partition and user disks.\nAlso enables kubelet tracking of ephemeral disk usage in the kubelet via quota.\n",
+          "markdownDescription": "Enable XFS project quota support for EPHEMERAL partition and user disks.\nAlso enables kubelet tracking of ephemeral disk usage in the kubelet via quota.",
+          "x-intellij-html-description": "\u003cp\u003eEnable XFS project quota support for EPHEMERAL partition and user disks.\nAlso enables kubelet tracking of ephemeral disk usage in the kubelet via quota.\u003c/p\u003e\n"
+        },
+        "kubePrism": {
+          "$ref": "#/$defs/v1alpha1.KubePrism",
+          "title": "kubePrism",
+          "description": "KubePrism - local proxy/load balancer on defined port that will distribute\nrequests to all API servers in the cluster.\n",
+          "markdownDescription": "KubePrism - local proxy/load balancer on defined port that will distribute\nrequests to all API servers in the cluster.",
+          "x-intellij-html-description": "\u003cp\u003eKubePrism - local proxy/load balancer on defined port that will distribute\nrequests to all API servers in the cluster.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.FlannelCNIConfig": {
+      "properties": {
+        "extraArgs": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "extraArgs",
+          "description": "Extra arguments for ‘flanneld’.\n",
+          "markdownDescription": "Extra arguments for 'flanneld'.",
+          "x-intellij-html-description": "\u003cp\u003eExtra arguments for \u0026lsquo;flanneld\u0026rsquo;.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.InstallConfig": {
+      "properties": {
+        "disk": {
+          "type": "string",
+          "title": "disk",
+          "description": "The disk used for installations.\n",
+          "markdownDescription": "The disk used for installations.",
+          "x-intellij-html-description": "\u003cp\u003eThe disk used for installations.\u003c/p\u003e\n"
+        },
+        "diskSelector": {
+          "$ref": "#/$defs/v1alpha1.InstallDiskSelector",
+          "title": "diskSelector",
+          "description": "Look up disk using disk attributes like model, size, serial and others.\nAlways has priority over disk.\n",
+          "markdownDescription": "Look up disk using disk attributes like model, size, serial and others.\nAlways has priority over `disk`.",
+          "x-intellij-html-description": "\u003cp\u003eLook up disk using disk attributes like model, size, serial and others.\nAlways has priority over \u003ccode\u003edisk\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "extraKernelArgs": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "extraKernelArgs",
+          "description": "Allows for supplying extra kernel args via the bootloader.\nExisting kernel args can be removed by prefixing the argument with a -.\nFor example -console removes all console=\u0026lt;value\u0026gt; arguments, whereas -console=tty0 removes the console=tty0 default argument.\n",
+          "markdownDescription": "Allows for supplying extra kernel args via the bootloader.\nExisting kernel args can be removed by prefixing the argument with a `-`.\nFor example `-console` removes all `console=\u003cvalue\u003e` arguments, whereas `-console=tty0` removes the `console=tty0` default argument.",
+          "x-intellij-html-description": "\u003cp\u003eAllows for supplying extra kernel args via the bootloader.\nExisting kernel args can be removed by prefixing the argument with a \u003ccode\u003e-\u003c/code\u003e.\nFor example \u003ccode\u003e-console\u003c/code\u003e removes all \u003ccode\u003econsole=\u0026lt;value\u0026gt;\u003c/code\u003e arguments, whereas \u003ccode\u003e-console=tty0\u003c/code\u003e removes the \u003ccode\u003econsole=tty0\u003c/code\u003e default argument.\u003c/p\u003e\n"
+        },
+        "image": {
+          "type": "string",
+          "title": "image",
+          "description": "Allows for supplying the image used to perform the installation.\nImage reference for each Talos release can be found on\nGitHub releases page.\n",
+          "markdownDescription": "Allows for supplying the image used to perform the installation.\nImage reference for each Talos release can be found on\n[GitHub releases page](https://github.com/siderolabs/talos/releases).",
+          "x-intellij-html-description": "\u003cp\u003eAllows for supplying the image used to perform the installation.\nImage reference for each Talos release can be found on\n\u003ca href=\"https://github.com/siderolabs/talos/releases\" target=\"_blank\"\u003eGitHub releases page\u003c/a\u003e.\u003c/p\u003e\n"
+        },
+        "extensions": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.InstallExtensionConfig"
+          },
+          "type": "array",
+          "title": "extensions",
+          "description": "Allows for supplying additional system extension images to install on top of base Talos image.\n",
+          "markdownDescription": "Allows for supplying additional system extension images to install on top of base Talos image.",
+          "x-intellij-html-description": "\u003cp\u003eAllows for supplying additional system extension images to install on top of base Talos image.\u003c/p\u003e\n"
+        },
+        "wipe": {
+          "type": "boolean",
+          "title": "wipe",
+          "description": "Indicates if the installation disk should be wiped at installation time.\nDefaults to true.\n",
+          "markdownDescription": "Indicates if the installation disk should be wiped at installation time.\nDefaults to `true`.",
+          "x-intellij-html-description": "\u003cp\u003eIndicates if the installation disk should be wiped at installation time.\nDefaults to \u003ccode\u003etrue\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "legacyBIOSSupport": {
+          "type": "boolean",
+          "title": "legacyBIOSSupport",
+          "description": "Indicates if MBR partition should be marked as bootable (active).\nShould be enabled only for the systems with legacy BIOS that doesn’t support GPT partitioning scheme.\n",
+          "markdownDescription": "Indicates if MBR partition should be marked as bootable (active).\nShould be enabled only for the systems with legacy BIOS that doesn't support GPT partitioning scheme.",
+          "x-intellij-html-description": "\u003cp\u003eIndicates if MBR partition should be marked as bootable (active).\nShould be enabled only for the systems with legacy BIOS that doesn\u0026rsquo;t support GPT partitioning scheme.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.InstallDiskSelector": {
+      "properties": {
+        "size": {
+          "type": "string",
+          "title": "size",
+          "description": "Disk size.\n",
+          "markdownDescription": "Disk size.",
+          "x-intellij-html-description": "\u003cp\u003eDisk size.\u003c/p\u003e\n"
+        },
+        "name": {
+          "type": "string",
+          "title": "name",
+          "description": "Disk name /sys/block/\u0026lt;dev\u0026gt;/device/name.\n",
+          "markdownDescription": "Disk name `/sys/block/\u003cdev\u003e/device/name`.",
+          "x-intellij-html-description": "\u003cp\u003eDisk name \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/device/name\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "model": {
+          "type": "string",
+          "title": "model",
+          "description": "Disk model /sys/block/\u0026lt;dev\u0026gt;/device/model.\n",
+          "markdownDescription": "Disk model `/sys/block/\u003cdev\u003e/device/model`.",
+          "x-intellij-html-description": "\u003cp\u003eDisk model \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/device/model\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "serial": {
+          "type": "string",
+          "title": "serial",
+          "description": "Disk serial number /sys/block/\u0026lt;dev\u0026gt;/serial.\n",
+          "markdownDescription": "Disk serial number `/sys/block/\u003cdev\u003e/serial`.",
+          "x-intellij-html-description": "\u003cp\u003eDisk serial number \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/serial\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "modalias": {
+          "type": "string",
+          "title": "modalias",
+          "description": "Disk modalias /sys/block/\u0026lt;dev\u0026gt;/device/modalias.\n",
+          "markdownDescription": "Disk modalias `/sys/block/\u003cdev\u003e/device/modalias`.",
+          "x-intellij-html-description": "\u003cp\u003eDisk modalias \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/device/modalias\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "uuid": {
+          "type": "string",
+          "title": "uuid",
+          "description": "Disk UUID /sys/block/\u0026lt;dev\u0026gt;/uuid.\n",
+          "markdownDescription": "Disk UUID `/sys/block/\u003cdev\u003e/uuid`.",
+          "x-intellij-html-description": "\u003cp\u003eDisk UUID \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/uuid\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "wwid": {
+          "type": "string",
+          "title": "wwid",
+          "description": "Disk WWID /sys/block/\u0026lt;dev\u0026gt;/wwid.\n",
+          "markdownDescription": "Disk WWID `/sys/block/\u003cdev\u003e/wwid`.",
+          "x-intellij-html-description": "\u003cp\u003eDisk WWID \u003ccode\u003e/sys/block/\u0026lt;dev\u0026gt;/wwid\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "type": {
+          "enum": [
+            "ssd",
+            "hdd",
+            "nvme",
+            "sd"
+          ],
+          "title": "type",
+          "description": "Disk Type.\n",
+          "markdownDescription": "Disk Type.",
+          "x-intellij-html-description": "\u003cp\u003eDisk Type.\u003c/p\u003e\n"
+        },
+        "busPath": {
+          "type": "string",
+          "title": "busPath",
+          "description": "Disk bus path.\n",
+          "markdownDescription": "Disk bus path.",
+          "x-intellij-html-description": "\u003cp\u003eDisk bus path.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.InstallExtensionConfig": {
+      "properties": {
+        "image": {
+          "type": "string",
+          "title": "image",
+          "description": "System extension image.\n",
+          "markdownDescription": "System extension image.",
+          "x-intellij-html-description": "\u003cp\u003eSystem extension image.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.KernelConfig": {
+      "properties": {
+        "modules": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.KernelModuleConfig"
+          },
+          "type": "array",
+          "title": "modules",
+          "description": "Kernel modules to load.\n",
+          "markdownDescription": "Kernel modules to load.",
+          "x-intellij-html-description": "\u003cp\u003eKernel modules to load.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.KernelModuleConfig": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "title": "name",
+          "description": "Module name.\n",
+          "markdownDescription": "Module name.",
+          "x-intellij-html-description": "\u003cp\u003eModule name.\u003c/p\u003e\n"
+        },
+        "parameters": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "parameters",
+          "description": "Module parameters, changes applied after reboot.\n",
+          "markdownDescription": "Module parameters, changes applied after reboot.",
+          "x-intellij-html-description": "\u003cp\u003eModule parameters, changes applied after reboot.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.KubePrism": {
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "title": "enabled",
+          "description": "Enable KubePrism support - will start local load balacing proxy.\n",
+          "markdownDescription": "Enable KubePrism support - will start local load balacing proxy.",
+          "x-intellij-html-description": "\u003cp\u003eEnable KubePrism support - will start local load balacing proxy.\u003c/p\u003e\n"
+        },
+        "port": {
+          "type": "integer",
+          "title": "port",
+          "description": "KubePrism port.\n",
+          "markdownDescription": "KubePrism port.",
+          "x-intellij-html-description": "\u003cp\u003eKubePrism port.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.KubeSpanFilters": {
+      "properties": {
+        "endpoints": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "endpoints",
+          "description": "Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.\n\nBy default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.\n\nDefault value: no filtering.\n",
+          "markdownDescription": "Filter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.\n\nBy default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.\n\nDefault value: no filtering.",
+          "x-intellij-html-description": "\u003cp\u003eFilter node addresses which will be advertised as KubeSpan endpoints for peer-to-peer Wireguard connections.\u003c/p\u003e\n\n\u003cp\u003eBy default, all addresses are advertised, and KubeSpan cycles through all endpoints until it finds one that works.\u003c/p\u003e\n\n\u003cp\u003eDefault value: no filtering.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.KubeletConfig": {
+      "properties": {
+        "image": {
+          "type": "string",
+          "title": "image",
+          "description": "The image field is an optional reference to an alternative kubelet image.\n",
+          "markdownDescription": "The `image` field is an optional reference to an alternative kubelet image.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eimage\u003c/code\u003e field is an optional reference to an alternative kubelet image.\u003c/p\u003e\n"
+        },
+        "clusterDNS": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "clusterDNS",
+          "description": "The ClusterDNS field is an optional reference to an alternative kubelet clusterDNS ip list.\n",
+          "markdownDescription": "The `ClusterDNS` field is an optional reference to an alternative kubelet clusterDNS ip list.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eClusterDNS\u003c/code\u003e field is an optional reference to an alternative kubelet clusterDNS ip list.\u003c/p\u003e\n"
+        },
+        "extraArgs": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "extraArgs",
+          "description": "The extraArgs field is used to provide additional flags to the kubelet.\n",
+          "markdownDescription": "The `extraArgs` field is used to provide additional flags to the kubelet.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eextraArgs\u003c/code\u003e field is used to provide additional flags to the kubelet.\u003c/p\u003e\n"
+        },
+        "extraMounts": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.ExtraMount"
+          },
+          "type": "array",
+          "title": "extraMounts",
+          "description": "The extraMounts field is used to add additional mounts to the kubelet container.\nNote that either bind or rbind are required in the options.\n",
+          "markdownDescription": "The `extraMounts` field is used to add additional mounts to the kubelet container.\nNote that either `bind` or `rbind` are required in the `options`.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eextraMounts\u003c/code\u003e field is used to add additional mounts to the kubelet container.\nNote that either \u003ccode\u003ebind\u003c/code\u003e or \u003ccode\u003erbind\u003c/code\u003e are required in the \u003ccode\u003eoptions\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "extraConfig": {
+          "type": "object",
+          "title": "extraConfig",
+          "description": "The extraConfig field is used to provide kubelet configuration overrides.\n\nSome fields are not allowed to be overridden: authentication and authorization, cgroups\nconfiguration, ports, etc.\n",
+          "markdownDescription": "The `extraConfig` field is used to provide kubelet configuration overrides.\n\nSome fields are not allowed to be overridden: authentication and authorization, cgroups\nconfiguration, ports, etc.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eextraConfig\u003c/code\u003e field is used to provide kubelet configuration overrides.\u003c/p\u003e\n\n\u003cp\u003eSome fields are not allowed to be overridden: authentication and authorization, cgroups\nconfiguration, ports, etc.\u003c/p\u003e\n"
+        },
+        "credentialProviderConfig": {
+          "type": "object",
+          "title": "credentialProviderConfig",
+          "description": "The KubeletCredentialProviderConfig field is used to provide kubelet credential configuration.\n",
+          "markdownDescription": "The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eKubeletCredentialProviderConfig\u003c/code\u003e field is used to provide kubelet credential configuration.\u003c/p\u003e\n"
+        },
+        "defaultRuntimeSeccompProfileEnabled": {
+          "type": "boolean",
+          "title": "defaultRuntimeSeccompProfileEnabled",
+          "description": "Enable container runtime default Seccomp profile.\n",
+          "markdownDescription": "Enable container runtime default Seccomp profile.",
+          "x-intellij-html-description": "\u003cp\u003eEnable container runtime default Seccomp profile.\u003c/p\u003e\n"
+        },
+        "registerWithFQDN": {
+          "type": "boolean",
+          "title": "registerWithFQDN",
+          "description": "The registerWithFQDN field is used to force kubelet to use the node FQDN for registration.\nThis is required in clouds like AWS.\n",
+          "markdownDescription": "The `registerWithFQDN` field is used to force kubelet to use the node FQDN for registration.\nThis is required in clouds like AWS.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eregisterWithFQDN\u003c/code\u003e field is used to force kubelet to use the node FQDN for registration.\nThis is required in clouds like AWS.\u003c/p\u003e\n"
+        },
+        "nodeIP": {
+          "$ref": "#/$defs/v1alpha1.KubeletNodeIPConfig",
+          "title": "nodeIP",
+          "description": "The nodeIP field is used to configure --node-ip flag for the kubelet.\nThis is used when a node has multiple addresses to choose from.\n",
+          "markdownDescription": "The `nodeIP` field is used to configure `--node-ip` flag for the kubelet.\nThis is used when a node has multiple addresses to choose from.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003enodeIP\u003c/code\u003e field is used to configure \u003ccode\u003e--node-ip\u003c/code\u003e flag for the kubelet.\nThis is used when a node has multiple addresses to choose from.\u003c/p\u003e\n"
+        },
+        "skipNodeRegistration": {
+          "type": "boolean",
+          "title": "skipNodeRegistration",
+          "description": "The skipNodeRegistration is used to run the kubelet without registering with the apiserver.\nThis runs kubelet as standalone and only runs static pods.\n",
+          "markdownDescription": "The `skipNodeRegistration` is used to run the kubelet without registering with the apiserver.\nThis runs kubelet as standalone and only runs static pods.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eskipNodeRegistration\u003c/code\u003e is used to run the kubelet without registering with the apiserver.\nThis runs kubelet as standalone and only runs static pods.\u003c/p\u003e\n"
+        },
+        "disableManifestsDirectory": {
+          "type": "boolean",
+          "title": "disableManifestsDirectory",
+          "description": "The disableManifestsDirectory field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.\nIt’s recommended to configure static pods with the “pods” key instead.\n",
+          "markdownDescription": "The `disableManifestsDirectory` field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.\nIt's recommended to configure static pods with the \"pods\" key instead.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003edisableManifestsDirectory\u003c/code\u003e field configures the kubelet to get static pod manifests from the /etc/kubernetes/manifests directory.\nIt\u0026rsquo;s recommended to configure static pods with the \u0026ldquo;pods\u0026rdquo; key instead.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.KubeletNodeIPConfig": {
+      "properties": {
+        "validSubnets": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "validSubnets",
+          "description": "The validSubnets field configures the networks to pick kubelet node IP from.\nFor dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.\nIPs can be excluded from the list by using negative match with !, e.g !10.0.0.0/8.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.\n",
+          "markdownDescription": "The `validSubnets` field configures the networks to pick kubelet node IP from.\nFor dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.\nIPs can be excluded from the list by using negative match with `!`, e.g `!10.0.0.0/8`.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003evalidSubnets\u003c/code\u003e field configures the networks to pick kubelet node IP from.\nFor dual stack configuration, there should be two subnets: one for IPv4, another for IPv6.\nIPs can be excluded from the list by using negative match with \u003ccode\u003e!\u003c/code\u003e, e.g \u003ccode\u003e!10.0.0.0/8\u003c/code\u003e.\nNegative subnet matches should be specified last to filter out IPs picked by positive matches.\nIf not specified, node IP is picked based on cluster podCIDRs: IPv4/IPv6 address or both.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.KubernetesTalosAPIAccessConfig": {
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "title": "enabled",
+          "description": "Enable Talos API access from Kubernetes pods.\n",
+          "markdownDescription": "Enable Talos API access from Kubernetes pods.",
+          "x-intellij-html-description": "\u003cp\u003eEnable Talos API access from Kubernetes pods.\u003c/p\u003e\n"
+        },
+        "allowedRoles": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "allowedRoles",
+          "description": "The list of Talos API roles which can be granted for access from Kubernetes pods.\n\nEmpty list means that no roles can be granted, so access is blocked.\n",
+          "markdownDescription": "The list of Talos API roles which can be granted for access from Kubernetes pods.\n\nEmpty list means that no roles can be granted, so access is blocked.",
+          "x-intellij-html-description": "\u003cp\u003eThe list of Talos API roles which can be granted for access from Kubernetes pods.\u003c/p\u003e\n\n\u003cp\u003eEmpty list means that no roles can be granted, so access is blocked.\u003c/p\u003e\n"
+        },
+        "allowedKubernetesNamespaces": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "allowedKubernetesNamespaces",
+          "description": "The list of Kubernetes namespaces Talos API access is available from.\n",
+          "markdownDescription": "The list of Kubernetes namespaces Talos API access is available from.",
+          "x-intellij-html-description": "\u003cp\u003eThe list of Kubernetes namespaces Talos API access is available from.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.LinuxIDMapping": {
+      "properties": {
+        "containerID": {
+          "type": "integer",
+          "title": "containerID",
+          "description": "ContainerID is the starting UID/GID in the container.\n",
+          "markdownDescription": "ContainerID is the starting UID/GID in the container.",
+          "x-intellij-html-description": "\u003cp\u003eContainerID is the starting UID/GID in the container.\u003c/p\u003e\n"
+        },
+        "hostID": {
+          "type": "integer",
+          "title": "hostID",
+          "description": "HostID is the starting UID/GID on the host to be mapped to ‘ContainerID’.\n",
+          "markdownDescription": "HostID is the starting UID/GID on the host to be mapped to 'ContainerID'.",
+          "x-intellij-html-description": "\u003cp\u003eHostID is the starting UID/GID on the host to be mapped to \u0026lsquo;ContainerID\u0026rsquo;.\u003c/p\u003e\n"
+        },
+        "size": {
+          "type": "integer",
+          "title": "size",
+          "description": "Size is the number of IDs to be mapped.\n",
+          "markdownDescription": "Size is the number of IDs to be mapped.",
+          "x-intellij-html-description": "\u003cp\u003eSize is the number of IDs to be mapped.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.LoggingConfig": {
+      "properties": {
+        "destinations": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.LoggingDestination"
+          },
+          "type": "array",
+          "title": "destinations",
+          "description": "Logging destination.\n",
+          "markdownDescription": "Logging destination.",
+          "x-intellij-html-description": "\u003cp\u003eLogging destination.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.LoggingDestination": {
+      "properties": {
+        "endpoint": {
+          "$ref": "#/$defs/v1alpha1.Endpoint",
+          "title": "endpoint",
+          "description": "Where to send logs. Supported protocols are “tcp” and “udp”.\n",
+          "markdownDescription": "Where to send logs. Supported protocols are \"tcp\" and \"udp\".",
+          "x-intellij-html-description": "\u003cp\u003eWhere to send logs. Supported protocols are \u0026ldquo;tcp\u0026rdquo; and \u0026ldquo;udp\u0026rdquo;.\u003c/p\u003e\n"
+        },
+        "format": {
+          "enum": [
+            "json_lines"
+          ],
+          "title": "format",
+          "description": "Logs format.\n",
+          "markdownDescription": "Logs format.",
+          "x-intellij-html-description": "\u003cp\u003eLogs format.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.MachineConfig": {
+      "properties": {
+        "type": {
+          "enum": [
+            "controlplane",
+            "worker"
+          ],
+          "title": "type",
+          "description": "Defines the role of the machine within the cluster.\n\nControl Plane\n\nControl Plane node type designates the node as a control plane member.\nThis means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.\n\nWorker\n\nWorker node type designates the node as a worker node.\nThis means it will be an available compute node for scheduling workloads.\n\nThis node type was previously known as “join”; that value is still supported but deprecated.\n",
+          "markdownDescription": "Defines the role of the machine within the cluster.\n\n**Control Plane**\n\nControl Plane node type designates the node as a control plane member.\nThis means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.\n\n**Worker**\n\nWorker node type designates the node as a worker node.\nThis means it will be an available compute node for scheduling workloads.\n\nThis node type was previously known as \"join\"; that value is still supported but deprecated.",
+          "x-intellij-html-description": "\u003cp\u003eDefines the role of the machine within the cluster.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eControl Plane\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eControl Plane node type designates the node as a control plane member.\nThis means it will host etcd along with the Kubernetes controlplane components such as API Server, Controller Manager, Scheduler.\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eWorker\u003c/strong\u003e\u003c/p\u003e\n\n\u003cp\u003eWorker node type designates the node as a worker node.\nThis means it will be an available compute node for scheduling workloads.\u003c/p\u003e\n\n\u003cp\u003eThis node type was previously known as \u0026ldquo;join\u0026rdquo;; that value is still supported but deprecated.\u003c/p\u003e\n"
+        },
+        "token": {
+          "type": "string",
+          "title": "token",
+          "description": "The token is used by a machine to join the PKI of the cluster.\nUsing this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its’ identity.\n",
+          "markdownDescription": "The `token` is used by a machine to join the PKI of the cluster.\nUsing this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its' identity.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003etoken\u003c/code\u003e is used by a machine to join the PKI of the cluster.\nUsing this token, a machine will create a certificate signing request (CSR), and request a certificate that will be used as its\u0026rsquo; identity.\u003c/p\u003e\n"
+        },
+        "ca": {
+          "properties": {
+            "crt": {
+              "type": "string"
+            },
+            "key": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": false,
+          "type": "object",
+          "title": "ca",
+          "description": "The root certificate authority of the PKI.\nIt is composed of a base64 encoded crt and key.\n",
+          "markdownDescription": "The root certificate authority of the PKI.\nIt is composed of a base64 encoded `crt` and `key`.",
+          "x-intellij-html-description": "\u003cp\u003eThe root certificate authority of the PKI.\nIt is composed of a base64 encoded \u003ccode\u003ecrt\u003c/code\u003e and \u003ccode\u003ekey\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "certSANs": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "certSANs",
+          "description": "Extra certificate subject alternative names for the machine’s certificate.\nBy default, all non-loopback interface IPs are automatically added to the certificate’s SANs.\n",
+          "markdownDescription": "Extra certificate subject alternative names for the machine's certificate.\nBy default, all non-loopback interface IPs are automatically added to the certificate's SANs.",
+          "x-intellij-html-description": "\u003cp\u003eExtra certificate subject alternative names for the machine\u0026rsquo;s certificate.\nBy default, all non-loopback interface IPs are automatically added to the certificate\u0026rsquo;s SANs.\u003c/p\u003e\n"
+        },
+        "controlPlane": {
+          "$ref": "#/$defs/v1alpha1.MachineControlPlaneConfig",
+          "title": "controlPlane",
+          "description": "Provides machine specific control plane configuration options.\n",
+          "markdownDescription": "Provides machine specific control plane configuration options.",
+          "x-intellij-html-description": "\u003cp\u003eProvides machine specific control plane configuration options.\u003c/p\u003e\n"
+        },
+        "kubelet": {
+          "$ref": "#/$defs/v1alpha1.KubeletConfig",
+          "title": "kubelet",
+          "description": "Used to provide additional options to the kubelet.\n",
+          "markdownDescription": "Used to provide additional options to the kubelet.",
+          "x-intellij-html-description": "\u003cp\u003eUsed to provide additional options to the kubelet.\u003c/p\u003e\n"
+        },
+        "pods": {
+          "items": {
+            "type": "object"
+          },
+          "type": "array",
+          "title": "pods",
+          "description": "Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.\n\nStatic pods can be used to run components which should be started before the Kubernetes control plane is up.\nTalos doesn’t validate the pod definition.\nUpdates to this field can be applied without a reboot.\n\nSee https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/.\n",
+          "markdownDescription": "Used to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.\n\nStatic pods can be used to run components which should be started before the Kubernetes control plane is up.\nTalos doesn't validate the pod definition.\nUpdates to this field can be applied without a reboot.\n\nSee https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/.",
+          "x-intellij-html-description": "\u003cp\u003eUsed to provide static pod definitions to be run by the kubelet directly bypassing the kube-apiserver.\u003c/p\u003e\n\n\u003cp\u003eStatic pods can be used to run components which should be started before the Kubernetes control plane is up.\nTalos doesn\u0026rsquo;t validate the pod definition.\nUpdates to this field can be applied without a reboot.\u003c/p\u003e\n\n\u003cp\u003eSee \u003ca href=\"https://kubernetes.io/docs/tasks/configure-pod-container/static-pod/\" target=\"_blank\"\u003ehttps://kubernetes.io/docs/tasks/configure-pod-container/static-pod/\u003c/a\u003e.\u003c/p\u003e\n"
+        },
+        "network": {
+          "$ref": "#/$defs/v1alpha1.NetworkConfig",
+          "title": "network",
+          "description": "Provides machine specific network configuration options.\n",
+          "markdownDescription": "Provides machine specific network configuration options.",
+          "x-intellij-html-description": "\u003cp\u003eProvides machine specific network configuration options.\u003c/p\u003e\n"
+        },
+        "disks": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.MachineDisk"
+          },
+          "type": "array",
+          "title": "disks",
+          "description": "Used to partition, format and mount additional disks.\nSince the rootfs is read only with the exception of /var, mounts are only valid if they are under /var.\nNote that the partitioning and formatting is done only once, if and only if no existing XFS partitions are found.\nIf size: is omitted, the partition is sized to occupy the full disk.\n",
+          "markdownDescription": "Used to partition, format and mount additional disks.\nSince the rootfs is read only with the exception of `/var`, mounts are only valid if they are under `/var`.\nNote that the partitioning and formatting is done only once, if and only if no existing XFS partitions are found.\nIf `size:` is omitted, the partition is sized to occupy the full disk.",
+          "x-intellij-html-description": "\u003cp\u003eUsed to partition, format and mount additional disks.\nSince the rootfs is read only with the exception of \u003ccode\u003e/var\u003c/code\u003e, mounts are only valid if they are under \u003ccode\u003e/var\u003c/code\u003e.\nNote that the partitioning and formatting is done only once, if and only if no existing XFS partitions are found.\nIf \u003ccode\u003esize:\u003c/code\u003e is omitted, the partition is sized to occupy the full disk.\u003c/p\u003e\n"
+        },
+        "install": {
+          "$ref": "#/$defs/v1alpha1.InstallConfig",
+          "title": "install",
+          "description": "Used to provide instructions for installations.\n\nNote that this configuration section gets silently ignored by Talos images that are considered pre-installed.\nTo make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.\n",
+          "markdownDescription": "Used to provide instructions for installations.\n\nNote that this configuration section gets silently ignored by Talos images that are considered pre-installed.\nTo make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.",
+          "x-intellij-html-description": "\u003cp\u003eUsed to provide instructions for installations.\u003c/p\u003e\n\n\u003cp\u003eNote that this configuration section gets silently ignored by Talos images that are considered pre-installed.\nTo make sure Talos installs according to the provided configuration, Talos should be booted with ISO or PXE-booted.\u003c/p\u003e\n"
+        },
+        "files": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.MachineFile"
+          },
+          "type": "array",
+          "title": "files",
+          "description": "Allows the addition of user specified files.\nThe value of op can be create, overwrite, or append.\nIn the case of create, path must not exist.\nIn the case of overwrite, and append, path must be a valid file.\nIf an op value of append is used, the existing file will be appended.\nNote that the file contents are not required to be base64 encoded.\n",
+          "markdownDescription": "Allows the addition of user specified files.\nThe value of `op` can be `create`, `overwrite`, or `append`.\nIn the case of `create`, `path` must not exist.\nIn the case of `overwrite`, and `append`, `path` must be a valid file.\nIf an `op` value of `append` is used, the existing file will be appended.\nNote that the file contents are not required to be base64 encoded.",
+          "x-intellij-html-description": "\u003cp\u003eAllows the addition of user specified files.\nThe value of \u003ccode\u003eop\u003c/code\u003e can be \u003ccode\u003ecreate\u003c/code\u003e, \u003ccode\u003eoverwrite\u003c/code\u003e, or \u003ccode\u003eappend\u003c/code\u003e.\nIn the case of \u003ccode\u003ecreate\u003c/code\u003e, \u003ccode\u003epath\u003c/code\u003e must not exist.\nIn the case of \u003ccode\u003eoverwrite\u003c/code\u003e, and \u003ccode\u003eappend\u003c/code\u003e, \u003ccode\u003epath\u003c/code\u003e must be a valid file.\nIf an \u003ccode\u003eop\u003c/code\u003e value of \u003ccode\u003eappend\u003c/code\u003e is used, the existing file will be appended.\nNote that the file contents are not required to be base64 encoded.\u003c/p\u003e\n"
+        },
+        "env": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "env",
+          "description": "The env field allows for the addition of environment variables.\nAll environment variables are set on PID 1 in addition to every service.\n",
+          "markdownDescription": "The `env` field allows for the addition of environment variables.\nAll environment variables are set on PID 1 in addition to every service.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables.\nAll environment variables are set on PID 1 in addition to every service.\u003c/p\u003e\n"
+        },
+        "time": {
+          "$ref": "#/$defs/v1alpha1.TimeConfig",
+          "title": "time",
+          "description": "Used to configure the machine’s time settings.\n",
+          "markdownDescription": "Used to configure the machine's time settings.",
+          "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s time settings.\u003c/p\u003e\n"
+        },
+        "sysctls": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "sysctls",
+          "description": "Used to configure the machine’s sysctls.\n",
+          "markdownDescription": "Used to configure the machine's sysctls.",
+          "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s sysctls.\u003c/p\u003e\n"
+        },
+        "sysfs": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "sysfs",
+          "description": "Used to configure the machine’s sysfs.\n",
+          "markdownDescription": "Used to configure the machine's sysfs.",
+          "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s sysfs.\u003c/p\u003e\n"
+        },
+        "registries": {
+          "$ref": "#/$defs/v1alpha1.RegistriesConfig",
+          "title": "registries",
+          "description": "Used to configure the machine’s container image registry mirrors.\n\nAutomatically generates matching CRI configuration for registry mirrors.\n\nThe mirrors section allows to redirect requests for images to a non-default registry,\nwhich might be a local registry or a caching mirror.\n\nThe config section provides a way to authenticate to the registry with TLS client\nidentity, provide registry CA, or authentication information.\nAuthentication information has same meaning with the corresponding field in .docker/config.json.\n\nSee also matching configuration for CRI containerd plugin.\n",
+          "markdownDescription": "Used to configure the machine's container image registry mirrors.\n\nAutomatically generates matching CRI configuration for registry mirrors.\n\nThe `mirrors` section allows to redirect requests for images to a non-default registry,\nwhich might be a local registry or a caching mirror.\n\nThe `config` section provides a way to authenticate to the registry with TLS client\nidentity, provide registry CA, or authentication information.\nAuthentication information has same meaning with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).\n\nSee also matching configuration for [CRI containerd plugin](https://github.com/containerd/cri/blob/master/docs/registry.md).",
+          "x-intellij-html-description": "\u003cp\u003eUsed to configure the machine\u0026rsquo;s container image registry mirrors.\u003c/p\u003e\n\n\u003cp\u003eAutomatically generates matching CRI configuration for registry mirrors.\u003c/p\u003e\n\n\u003cp\u003eThe \u003ccode\u003emirrors\u003c/code\u003e section allows to redirect requests for images to a non-default registry,\nwhich might be a local registry or a caching mirror.\u003c/p\u003e\n\n\u003cp\u003eThe \u003ccode\u003econfig\u003c/code\u003e section provides a way to authenticate to the registry with TLS client\nidentity, provide registry CA, or authentication information.\nAuthentication information has same meaning with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n\n\u003cp\u003eSee also matching configuration for \u003ca href=\"https://github.com/containerd/cri/blob/master/docs/registry.md\" target=\"_blank\"\u003eCRI containerd plugin\u003c/a\u003e.\u003c/p\u003e\n"
+        },
+        "systemDiskEncryption": {
+          "$ref": "#/$defs/v1alpha1.SystemDiskEncryptionConfig",
+          "title": "systemDiskEncryption",
+          "description": "Machine system disk encryption configuration.\nDefines each system partition encryption parameters.\n",
+          "markdownDescription": "Machine system disk encryption configuration.\nDefines each system partition encryption parameters.",
+          "x-intellij-html-description": "\u003cp\u003eMachine system disk encryption configuration.\nDefines each system partition encryption parameters.\u003c/p\u003e\n"
+        },
+        "features": {
+          "$ref": "#/$defs/v1alpha1.FeaturesConfig",
+          "title": "features",
+          "description": "Features describe individual Talos features that can be switched on or off.\n",
+          "markdownDescription": "Features describe individual Talos features that can be switched on or off.",
+          "x-intellij-html-description": "\u003cp\u003eFeatures describe individual Talos features that can be switched on or off.\u003c/p\u003e\n"
+        },
+        "udev": {
+          "$ref": "#/$defs/v1alpha1.UdevConfig",
+          "title": "udev",
+          "description": "Configures the udev system.\n",
+          "markdownDescription": "Configures the udev system.",
+          "x-intellij-html-description": "\u003cp\u003eConfigures the udev system.\u003c/p\u003e\n"
+        },
+        "logging": {
+          "$ref": "#/$defs/v1alpha1.LoggingConfig",
+          "title": "logging",
+          "description": "Configures the logging system.\n",
+          "markdownDescription": "Configures the logging system.",
+          "x-intellij-html-description": "\u003cp\u003eConfigures the logging system.\u003c/p\u003e\n"
+        },
+        "kernel": {
+          "$ref": "#/$defs/v1alpha1.KernelConfig",
+          "title": "kernel",
+          "description": "Configures the kernel.\n",
+          "markdownDescription": "Configures the kernel.",
+          "x-intellij-html-description": "\u003cp\u003eConfigures the kernel.\u003c/p\u003e\n"
+        },
+        "seccompProfiles": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.MachineSeccompProfile"
+          },
+          "type": "array",
+          "title": "seccompProfiles",
+          "description": "Configures the seccomp profiles for the machine.\n",
+          "markdownDescription": "Configures the seccomp profiles for the machine.",
+          "x-intellij-html-description": "\u003cp\u003eConfigures the seccomp profiles for the machine.\u003c/p\u003e\n"
+        },
+        "nodeLabels": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "nodeLabels",
+          "description": "Configures the node labels for the machine.\n",
+          "markdownDescription": "Configures the node labels for the machine.",
+          "x-intellij-html-description": "\u003cp\u003eConfigures the node labels for the machine.\u003c/p\u003e\n"
+        },
+        "nodeTaints": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "nodeTaints",
+          "description": "Configures the node taints for the machine. Effect is optional.\n",
+          "markdownDescription": "Configures the node taints for the machine. Effect is optional.",
+          "x-intellij-html-description": "\u003cp\u003eConfigures the node taints for the machine. Effect is optional.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.MachineControlPlaneConfig": {
+      "properties": {
+        "controllerManager": {
+          "$ref": "#/$defs/v1alpha1.MachineControllerManagerConfig",
+          "title": "controllerManager",
+          "description": "Controller manager machine specific configuration options.\n",
+          "markdownDescription": "Controller manager machine specific configuration options.",
+          "x-intellij-html-description": "\u003cp\u003eController manager machine specific configuration options.\u003c/p\u003e\n"
+        },
+        "scheduler": {
+          "$ref": "#/$defs/v1alpha1.MachineSchedulerConfig",
+          "title": "scheduler",
+          "description": "Scheduler machine specific configuration options.\n",
+          "markdownDescription": "Scheduler machine specific configuration options.",
+          "x-intellij-html-description": "\u003cp\u003eScheduler machine specific configuration options.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.MachineControllerManagerConfig": {
+      "properties": {
+        "disabled": {
+          "type": "boolean",
+          "title": "disabled",
+          "description": "Disable kube-controller-manager on the node.\n",
+          "markdownDescription": "Disable kube-controller-manager on the node.",
+          "x-intellij-html-description": "\u003cp\u003eDisable kube-controller-manager on the node.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.MachineDisk": {
+      "properties": {
+        "device": {
+          "type": "string",
+          "title": "device",
+          "description": "The name of the disk to use.\n",
+          "markdownDescription": "The name of the disk to use.",
+          "x-intellij-html-description": "\u003cp\u003eThe name of the disk to use.\u003c/p\u003e\n"
+        },
+        "partitions": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.DiskPartition"
+          },
+          "type": "array",
+          "title": "partitions",
+          "description": "A list of partitions to create on the disk.\n",
+          "markdownDescription": "A list of partitions to create on the disk.",
+          "x-intellij-html-description": "\u003cp\u003eA list of partitions to create on the disk.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.MachineFile": {
+      "properties": {
+        "content": {
+          "type": "string",
+          "title": "content",
+          "description": "The contents of the file.\n",
+          "markdownDescription": "The contents of the file.",
+          "x-intellij-html-description": "\u003cp\u003eThe contents of the file.\u003c/p\u003e\n"
+        },
+        "permissions": {
+          "type": "integer",
+          "title": "permissions",
+          "description": "The file’s permissions in octal.\n",
+          "markdownDescription": "The file's permissions in octal.",
+          "x-intellij-html-description": "\u003cp\u003eThe file\u0026rsquo;s permissions in octal.\u003c/p\u003e\n"
+        },
+        "path": {
+          "type": "string",
+          "title": "path",
+          "description": "The path of the file.\n",
+          "markdownDescription": "The path of the file.",
+          "x-intellij-html-description": "\u003cp\u003eThe path of the file.\u003c/p\u003e\n"
+        },
+        "op": {
+          "enum": [
+            "create",
+            "append",
+            "overwrite"
+          ],
+          "title": "op",
+          "description": "The operation to use\n",
+          "markdownDescription": "The operation to use",
+          "x-intellij-html-description": "\u003cp\u003eThe operation to use\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.MachineSchedulerConfig": {
+      "properties": {
+        "disabled": {
+          "type": "boolean",
+          "title": "disabled",
+          "description": "Disable kube-scheduler on the node.\n",
+          "markdownDescription": "Disable kube-scheduler on the node.",
+          "x-intellij-html-description": "\u003cp\u003eDisable kube-scheduler on the node.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.MachineSeccompProfile": {
+      "properties": {
+        "name": {
+          "type": "string",
+          "title": "name",
+          "description": "The name field is used to provide the file name of the seccomp profile.\n",
+          "markdownDescription": "The `name` field is used to provide the file name of the seccomp profile.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003ename\u003c/code\u003e field is used to provide the file name of the seccomp profile.\u003c/p\u003e\n"
+        },
+        "value": {
+          "type": "object",
+          "title": "value",
+          "description": "The value field is used to provide the seccomp profile.\n",
+          "markdownDescription": "The `value` field is used to provide the seccomp profile.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003evalue\u003c/code\u003e field is used to provide the seccomp profile.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.NetworkConfig": {
+      "properties": {
+        "hostname": {
+          "type": "string",
+          "title": "hostname",
+          "description": "Used to statically set the hostname for the machine.\n",
+          "markdownDescription": "Used to statically set the hostname for the machine.",
+          "x-intellij-html-description": "\u003cp\u003eUsed to statically set the hostname for the machine.\u003c/p\u003e\n"
+        },
+        "interfaces": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.Device"
+          },
+          "type": "array",
+          "title": "interfaces",
+          "description": "interfaces is used to define the network interface configuration.\nBy default all network interfaces will attempt a DHCP discovery.\nThis can be further tuned through this configuration parameter.\n",
+          "markdownDescription": "`interfaces` is used to define the network interface configuration.\nBy default all network interfaces will attempt a DHCP discovery.\nThis can be further tuned through this configuration parameter.",
+          "x-intellij-html-description": "\u003cp\u003e\u003ccode\u003einterfaces\u003c/code\u003e is used to define the network interface configuration.\nBy default all network interfaces will attempt a DHCP discovery.\nThis can be further tuned through this configuration parameter.\u003c/p\u003e\n"
+        },
+        "nameservers": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "nameservers",
+          "description": "Used to statically set the nameservers for the machine.\nDefaults to 1.1.1.1 and 8.8.8.8\n",
+          "markdownDescription": "Used to statically set the nameservers for the machine.\nDefaults to `1.1.1.1` and `8.8.8.8`",
+          "x-intellij-html-description": "\u003cp\u003eUsed to statically set the nameservers for the machine.\nDefaults to \u003ccode\u003e1.1.1.1\u003c/code\u003e and \u003ccode\u003e8.8.8.8\u003c/code\u003e\u003c/p\u003e\n"
+        },
+        "extraHostEntries": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.ExtraHost"
+          },
+          "type": "array",
+          "title": "extraHostEntries",
+          "description": "Allows for extra entries to be added to the /etc/hosts file\n",
+          "markdownDescription": "Allows for extra entries to be added to the `/etc/hosts` file",
+          "x-intellij-html-description": "\u003cp\u003eAllows for extra entries to be added to the \u003ccode\u003e/etc/hosts\u003c/code\u003e file\u003c/p\u003e\n"
+        },
+        "kubespan": {
+          "$ref": "#/$defs/v1alpha1.NetworkKubeSpan",
+          "title": "kubespan",
+          "description": "Configures KubeSpan feature.\n",
+          "markdownDescription": "Configures KubeSpan feature.",
+          "x-intellij-html-description": "\u003cp\u003eConfigures KubeSpan feature.\u003c/p\u003e\n"
+        },
+        "disableSearchDomain": {
+          "type": "boolean",
+          "title": "disableSearchDomain",
+          "description": "Disable generating a default search domain in /etc/resolv.conf\nbased on the machine hostname.\nDefaults to false.\n",
+          "markdownDescription": "Disable generating a default search domain in /etc/resolv.conf\nbased on the machine hostname.\nDefaults to `false`.",
+          "x-intellij-html-description": "\u003cp\u003eDisable generating a default search domain in /etc/resolv.conf\nbased on the machine hostname.\nDefaults to \u003ccode\u003efalse\u003c/code\u003e.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.NetworkDeviceSelector": {
+      "properties": {
+        "busPath": {
+          "type": "string",
+          "title": "busPath",
+          "description": "PCI, USB bus prefix, supports matching by wildcard.\n",
+          "markdownDescription": "PCI, USB bus prefix, supports matching by wildcard.",
+          "x-intellij-html-description": "\u003cp\u003ePCI, USB bus prefix, supports matching by wildcard.\u003c/p\u003e\n"
+        },
+        "hardwareAddr": {
+          "type": "string",
+          "title": "hardwareAddr",
+          "description": "Device hardware address, supports matching by wildcard.\n",
+          "markdownDescription": "Device hardware address, supports matching by wildcard.",
+          "x-intellij-html-description": "\u003cp\u003eDevice hardware address, supports matching by wildcard.\u003c/p\u003e\n"
+        },
+        "pciID": {
+          "type": "string",
+          "title": "pciID",
+          "description": "PCI ID (vendor ID, product ID), supports matching by wildcard.\n",
+          "markdownDescription": "PCI ID (vendor ID, product ID), supports matching by wildcard.",
+          "x-intellij-html-description": "\u003cp\u003ePCI ID (vendor ID, product ID), supports matching by wildcard.\u003c/p\u003e\n"
+        },
+        "driver": {
+          "type": "string",
+          "title": "driver",
+          "description": "Kernel driver, supports matching by wildcard.\n",
+          "markdownDescription": "Kernel driver, supports matching by wildcard.",
+          "x-intellij-html-description": "\u003cp\u003eKernel driver, supports matching by wildcard.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.NetworkKubeSpan": {
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "title": "enabled",
+          "description": "Enable the KubeSpan feature.\nCluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.\n",
+          "markdownDescription": "Enable the KubeSpan feature.\nCluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.",
+          "x-intellij-html-description": "\u003cp\u003eEnable the KubeSpan feature.\nCluster discovery should be enabled with .cluster.discovery.enabled for KubeSpan to be enabled.\u003c/p\u003e\n"
+        },
+        "advertiseKubernetesNetworks": {
+          "type": "boolean",
+          "title": "advertiseKubernetesNetworks",
+          "description": "Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.\nIf disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,\nand KubeSpan handles the node-to-node traffic.\nIf enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.\nWhen enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which\nis not always the case with CNIs not relying on Kubernetes for IPAM.\n",
+          "markdownDescription": "Control whether Kubernetes pod CIDRs are announced over KubeSpan from the node.\nIf disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,\nand KubeSpan handles the node-to-node traffic.\nIf enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.\nWhen enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which\nis not always the case with CNIs not relying on Kubernetes for IPAM.",
+          "x-intellij-html-description": "\u003cp\u003eControl whether Kubernetes pod CIDRs are announced over KubeSpan from the node.\nIf disabled, CNI handles encapsulating pod-to-pod traffic into some node-to-node tunnel,\nand KubeSpan handles the node-to-node traffic.\nIf enabled, KubeSpan will take over pod-to-pod traffic and send it over KubeSpan directly.\nWhen enabled, KubeSpan should have a way to detect complete pod CIDRs of the node which\nis not always the case with CNIs not relying on Kubernetes for IPAM.\u003c/p\u003e\n"
+        },
+        "allowDownPeerBypass": {
+          "type": "boolean",
+          "title": "allowDownPeerBypass",
+          "description": "Skip sending traffic via KubeSpan if the peer connection state is not up.\nThis provides configurable choice between connectivity and security: either traffic is always\nforced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly\nto the peer if Wireguard connection can’t be established.\n",
+          "markdownDescription": "Skip sending traffic via KubeSpan if the peer connection state is not up.\nThis provides configurable choice between connectivity and security: either traffic is always\nforced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly\nto the peer if Wireguard connection can't be established.",
+          "x-intellij-html-description": "\u003cp\u003eSkip sending traffic via KubeSpan if the peer connection state is not up.\nThis provides configurable choice between connectivity and security: either traffic is always\nforced to go via KubeSpan (even if Wireguard peer connection is not up), or traffic can go directly\nto the peer if Wireguard connection can\u0026rsquo;t be established.\u003c/p\u003e\n"
+        },
+        "harvestExtraEndpoints": {
+          "type": "boolean",
+          "title": "harvestExtraEndpoints",
+          "description": "KubeSpan can collect and publish extra endpoints for each member of the cluster\nbased on Wireguard endpoint information for each peer.\nThis feature is enabled by default to help discover additional endpoints,\nbut with high number of peers (\u0026gt;50) in the KubeSpan network it can cause performance issues.\n",
+          "markdownDescription": "KubeSpan can collect and publish extra endpoints for each member of the cluster\nbased on Wireguard endpoint information for each peer.\nThis feature is enabled by default to help discover additional endpoints,\nbut with high number of peers (\u003e50) in the KubeSpan network it can cause performance issues.",
+          "x-intellij-html-description": "\u003cp\u003eKubeSpan can collect and publish extra endpoints for each member of the cluster\nbased on Wireguard endpoint information for each peer.\nThis feature is enabled by default to help discover additional endpoints,\nbut with high number of peers (\u0026gt;50) in the KubeSpan network it can cause performance issues.\u003c/p\u003e\n"
+        },
+        "mtu": {
+          "type": "integer",
+          "title": "mtu",
+          "description": "KubeSpan link MTU size.\nDefault value is 1420.\n",
+          "markdownDescription": "KubeSpan link MTU size.\nDefault value is 1420.",
+          "x-intellij-html-description": "\u003cp\u003eKubeSpan link MTU size.\nDefault value is 1420.\u003c/p\u003e\n"
+        },
+        "filters": {
+          "$ref": "#/$defs/v1alpha1.KubeSpanFilters",
+          "title": "filters",
+          "description": "KubeSpan advanced filtering of network addresses .\n\nSettings in this section are optional, and settings apply only to the node.\n",
+          "markdownDescription": "KubeSpan advanced filtering of network addresses .\n\nSettings in this section are optional, and settings apply only to the node.",
+          "x-intellij-html-description": "\u003cp\u003eKubeSpan advanced filtering of network addresses .\u003c/p\u003e\n\n\u003cp\u003eSettings in this section are optional, and settings apply only to the node.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.ProxyConfig": {
+      "properties": {
+        "disabled": {
+          "type": "boolean",
+          "title": "disabled",
+          "description": "Disable kube-proxy deployment on cluster bootstrap.\n",
+          "markdownDescription": "Disable kube-proxy deployment on cluster bootstrap.",
+          "x-intellij-html-description": "\u003cp\u003eDisable kube-proxy deployment on cluster bootstrap.\u003c/p\u003e\n"
+        },
+        "image": {
+          "type": "string",
+          "title": "image",
+          "description": "The container image used in the kube-proxy manifest.\n",
+          "markdownDescription": "The container image used in the kube-proxy manifest.",
+          "x-intellij-html-description": "\u003cp\u003eThe container image used in the kube-proxy manifest.\u003c/p\u003e\n"
+        },
+        "mode": {
+          "type": "string",
+          "title": "mode",
+          "description": "proxy mode of kube-proxy.\nThe default is ‘iptables’.\n",
+          "markdownDescription": "proxy mode of kube-proxy.\nThe default is 'iptables'.",
+          "x-intellij-html-description": "\u003cp\u003eproxy mode of kube-proxy.\nThe default is \u0026lsquo;iptables\u0026rsquo;.\u003c/p\u003e\n"
+        },
+        "extraArgs": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "extraArgs",
+          "description": "Extra arguments to supply to kube-proxy.\n",
+          "markdownDescription": "Extra arguments to supply to kube-proxy.",
+          "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to kube-proxy.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.RegistriesConfig": {
+      "properties": {
+        "mirrors": {
+          "patternProperties": {
+            ".*": {
+              "$ref": "#/$defs/v1alpha1.RegistryMirrorConfig"
+            }
+          },
+          "type": "object",
+          "title": "mirrors",
+          "description": "Specifies mirror configuration for each registry host namespace.\nThis setting allows to configure local pull-through caching registires,\nair-gapped installations, etc.\n\nFor example, when pulling an image with the reference example.com:123/image:v1,\nthe example.com:123 key will be used to lookup the mirror configuration.\n\nOptionally the * key can be used to configure a fallback mirror.\n\nRegistry name is the first segment of image identifier, with ‘docker.io’\nbeing default one.\n",
+          "markdownDescription": "Specifies mirror configuration for each registry host namespace.\nThis setting allows to configure local pull-through caching registires,\nair-gapped installations, etc.\n\nFor example, when pulling an image with the reference `example.com:123/image:v1`,\nthe `example.com:123` key will be used to lookup the mirror configuration.\n\nOptionally the `*` key can be used to configure a fallback mirror.\n\nRegistry name is the first segment of image identifier, with 'docker.io'\nbeing default one.",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies mirror configuration for each registry host namespace.\nThis setting allows to configure local pull-through caching registires,\nair-gapped installations, etc.\u003c/p\u003e\n\n\u003cp\u003eFor example, when pulling an image with the reference \u003ccode\u003eexample.com:123/image:v1\u003c/code\u003e,\nthe \u003ccode\u003eexample.com:123\u003c/code\u003e key will be used to lookup the mirror configuration.\u003c/p\u003e\n\n\u003cp\u003eOptionally the \u003ccode\u003e*\u003c/code\u003e key can be used to configure a fallback mirror.\u003c/p\u003e\n\n\u003cp\u003eRegistry name is the first segment of image identifier, with \u0026lsquo;docker.io\u0026rsquo;\nbeing default one.\u003c/p\u003e\n"
+        },
+        "config": {
+          "patternProperties": {
+            ".*": {
+              "$ref": "#/$defs/v1alpha1.RegistryConfig"
+            }
+          },
+          "type": "object",
+          "title": "config",
+          "description": "Specifies TLS \u0026amp; auth configuration for HTTPS image registries.\nMutual TLS can be enabled with ‘clientIdentity’ option.\n\nThe full hostname and port (if not using a default port 443)\nshould be used as the key.\nThe fallback key * can’t be used for TLS configuration.\n\nTLS configuration can be skipped if registry has trusted\nserver certificate.\n",
+          "markdownDescription": "Specifies TLS \u0026 auth configuration for HTTPS image registries.\nMutual TLS can be enabled with 'clientIdentity' option.\n\nThe full hostname and port (if not using a default port 443)\nshould be used as the key.\nThe fallback key `*` can't be used for TLS configuration.\n\nTLS configuration can be skipped if registry has trusted\nserver certificate.",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies TLS \u0026amp; auth configuration for HTTPS image registries.\nMutual TLS can be enabled with \u0026lsquo;clientIdentity\u0026rsquo; option.\u003c/p\u003e\n\n\u003cp\u003eThe full hostname and port (if not using a default port 443)\nshould be used as the key.\nThe fallback key \u003ccode\u003e*\u003c/code\u003e can\u0026rsquo;t be used for TLS configuration.\u003c/p\u003e\n\n\u003cp\u003eTLS configuration can be skipped if registry has trusted\nserver certificate.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.RegistryAuthConfig": {
+      "properties": {
+        "username": {
+          "type": "string",
+          "title": "username",
+          "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n",
+          "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).",
+          "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n"
+        },
+        "password": {
+          "type": "string",
+          "title": "password",
+          "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n",
+          "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).",
+          "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n"
+        },
+        "auth": {
+          "type": "string",
+          "title": "auth",
+          "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n",
+          "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).",
+          "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n"
+        },
+        "identityToken": {
+          "type": "string",
+          "title": "identityToken",
+          "description": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in .docker/config.json.\n",
+          "markdownDescription": "Optional registry authentication.\nThe meaning of each field is the same with the corresponding field in [`.docker/config.json`](https://docs.docker.com/engine/api/v1.41/#section/Authentication).",
+          "x-intellij-html-description": "\u003cp\u003eOptional registry authentication.\nThe meaning of each field is the same with the corresponding field in \u003ca href=\"https://docs.docker.com/engine/api/v1.41/#section/Authentication\" target=\"_blank\"\u003e\u003ccode\u003e.docker/config.json\u003c/code\u003e\u003c/a\u003e.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.RegistryConfig": {
+      "properties": {
+        "tls": {
+          "$ref": "#/$defs/v1alpha1.RegistryTLSConfig",
+          "title": "tls",
+          "description": "The TLS configuration for the registry.\n",
+          "markdownDescription": "The TLS configuration for the registry.",
+          "x-intellij-html-description": "\u003cp\u003eThe TLS configuration for the registry.\u003c/p\u003e\n"
+        },
+        "auth": {
+          "$ref": "#/$defs/v1alpha1.RegistryAuthConfig",
+          "title": "auth",
+          "description": "The auth configuration for this registry.\nNote: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.\n",
+          "markdownDescription": "The auth configuration for this registry.\nNote: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.",
+          "x-intellij-html-description": "\u003cp\u003eThe auth configuration for this registry.\nNote: changes to the registry auth will not be picked up by the CRI containerd plugin without a reboot.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.RegistryKubernetesConfig": {
+      "properties": {
+        "disabled": {
+          "type": "boolean",
+          "title": "disabled",
+          "description": "Disable Kubernetes discovery registry.\n",
+          "markdownDescription": "Disable Kubernetes discovery registry.",
+          "x-intellij-html-description": "\u003cp\u003eDisable Kubernetes discovery registry.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.RegistryMirrorConfig": {
+      "properties": {
+        "endpoints": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "endpoints",
+          "description": "List of endpoints (URLs) for registry mirrors to use.\nEndpoint configures HTTP/HTTPS access mode, host name,\nport and path (if path is not set, it defaults to /v2).\n",
+          "markdownDescription": "List of endpoints (URLs) for registry mirrors to use.\nEndpoint configures HTTP/HTTPS access mode, host name,\nport and path (if path is not set, it defaults to `/v2`).",
+          "x-intellij-html-description": "\u003cp\u003eList of endpoints (URLs) for registry mirrors to use.\nEndpoint configures HTTP/HTTPS access mode, host name,\nport and path (if path is not set, it defaults to \u003ccode\u003e/v2\u003c/code\u003e).\u003c/p\u003e\n"
+        },
+        "overridePath": {
+          "type": "boolean",
+          "title": "overridePath",
+          "description": "Use the exact path specified for the endpoint (don’t append /v2/).\nThis setting is often required for setting up multiple mirrors\non a single instance of a registry.\n",
+          "markdownDescription": "Use the exact path specified for the endpoint (don't append /v2/).\nThis setting is often required for setting up multiple mirrors\non a single instance of a registry.",
+          "x-intellij-html-description": "\u003cp\u003eUse the exact path specified for the endpoint (don\u0026rsquo;t append /v2/).\nThis setting is often required for setting up multiple mirrors\non a single instance of a registry.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.RegistryServiceConfig": {
+      "properties": {
+        "disabled": {
+          "type": "boolean",
+          "title": "disabled",
+          "description": "Disable external service discovery registry.\n",
+          "markdownDescription": "Disable external service discovery registry.",
+          "x-intellij-html-description": "\u003cp\u003eDisable external service discovery registry.\u003c/p\u003e\n"
+        },
+        "endpoint": {
+          "type": "string",
+          "title": "endpoint",
+          "description": "External service endpoint.\n",
+          "markdownDescription": "External service endpoint.",
+          "x-intellij-html-description": "\u003cp\u003eExternal service endpoint.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.RegistryTLSConfig": {
+      "properties": {
+        "clientIdentity": {
+          "properties": {
+            "crt": {
+              "type": "string"
+            },
+            "key": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": false,
+          "type": "object",
+          "title": "clientIdentity",
+          "description": "Enable mutual TLS authentication with the registry.\nClient certificate and key should be base64-encoded.\n",
+          "markdownDescription": "Enable mutual TLS authentication with the registry.\nClient certificate and key should be base64-encoded.",
+          "x-intellij-html-description": "\u003cp\u003eEnable mutual TLS authentication with the registry.\nClient certificate and key should be base64-encoded.\u003c/p\u003e\n"
+        },
+        "ca": {
+          "type": "string",
+          "title": "ca",
+          "description": "CA registry certificate to add the list of trusted certificates.\nCertificate should be base64-encoded.\n",
+          "markdownDescription": "CA registry certificate to add the list of trusted certificates.\nCertificate should be base64-encoded.",
+          "x-intellij-html-description": "\u003cp\u003eCA registry certificate to add the list of trusted certificates.\nCertificate should be base64-encoded.\u003c/p\u003e\n"
+        },
+        "insecureSkipVerify": {
+          "type": "boolean",
+          "title": "insecureSkipVerify",
+          "description": "Skip TLS server certificate verification (not recommended).\n",
+          "markdownDescription": "Skip TLS server certificate verification (not recommended).",
+          "x-intellij-html-description": "\u003cp\u003eSkip TLS server certificate verification (not recommended).\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.ResourcesConfig": {
+      "properties": {
+        "requests": {
+          "type": "object",
+          "title": "requests",
+          "description": "Requests configures the reserved cpu/memory resources.\n",
+          "markdownDescription": "Requests configures the reserved cpu/memory resources.",
+          "x-intellij-html-description": "\u003cp\u003eRequests configures the reserved cpu/memory resources.\u003c/p\u003e\n"
+        },
+        "limits": {
+          "type": "object",
+          "title": "limits",
+          "description": "Limits configures the maximum cpu/memory resources a container can use.\n",
+          "markdownDescription": "Limits configures the maximum cpu/memory resources a container can use.",
+          "x-intellij-html-description": "\u003cp\u003eLimits configures the maximum cpu/memory resources a container can use.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.Route": {
+      "properties": {
+        "network": {
+          "type": "string",
+          "title": "network",
+          "description": "The route’s network (destination).\n",
+          "markdownDescription": "The route's network (destination).",
+          "x-intellij-html-description": "\u003cp\u003eThe route\u0026rsquo;s network (destination).\u003c/p\u003e\n"
+        },
+        "gateway": {
+          "type": "string",
+          "title": "gateway",
+          "description": "The route’s gateway (if empty, creates link scope route).\n",
+          "markdownDescription": "The route's gateway (if empty, creates link scope route).",
+          "x-intellij-html-description": "\u003cp\u003eThe route\u0026rsquo;s gateway (if empty, creates link scope route).\u003c/p\u003e\n"
+        },
+        "source": {
+          "type": "string",
+          "title": "source",
+          "description": "The route’s source address (optional).\n",
+          "markdownDescription": "The route's source address (optional).",
+          "x-intellij-html-description": "\u003cp\u003eThe route\u0026rsquo;s source address (optional).\u003c/p\u003e\n"
+        },
+        "metric": {
+          "type": "integer",
+          "title": "metric",
+          "description": "The optional metric for the route.\n",
+          "markdownDescription": "The optional metric for the route.",
+          "x-intellij-html-description": "\u003cp\u003eThe optional metric for the route.\u003c/p\u003e\n"
+        },
+        "mtu": {
+          "type": "integer",
+          "title": "mtu",
+          "description": "The optional MTU for the route.\n",
+          "markdownDescription": "The optional MTU for the route.",
+          "x-intellij-html-description": "\u003cp\u003eThe optional MTU for the route.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.STP": {
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "title": "enabled",
+          "description": "Whether Spanning Tree Protocol (STP) is enabled.\n",
+          "markdownDescription": "Whether Spanning Tree Protocol (STP) is enabled.",
+          "x-intellij-html-description": "\u003cp\u003eWhether Spanning Tree Protocol (STP) is enabled.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.SchedulerConfig": {
+      "properties": {
+        "image": {
+          "type": "string",
+          "title": "image",
+          "description": "The container image used in the scheduler manifest.\n",
+          "markdownDescription": "The container image used in the scheduler manifest.",
+          "x-intellij-html-description": "\u003cp\u003eThe container image used in the scheduler manifest.\u003c/p\u003e\n"
+        },
+        "extraArgs": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "extraArgs",
+          "description": "Extra arguments to supply to the scheduler.\n",
+          "markdownDescription": "Extra arguments to supply to the scheduler.",
+          "x-intellij-html-description": "\u003cp\u003eExtra arguments to supply to the scheduler.\u003c/p\u003e\n"
+        },
+        "extraVolumes": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.VolumeMountConfig"
+          },
+          "type": "array",
+          "title": "extraVolumes",
+          "description": "Extra volumes to mount to the scheduler static pod.\n",
+          "markdownDescription": "Extra volumes to mount to the scheduler static pod.",
+          "x-intellij-html-description": "\u003cp\u003eExtra volumes to mount to the scheduler static pod.\u003c/p\u003e\n"
+        },
+        "env": {
+          "patternProperties": {
+            ".*": {
+              "type": "string"
+            }
+          },
+          "type": "object",
+          "title": "env",
+          "description": "The env field allows for the addition of environment variables for the control plane component.\n",
+          "markdownDescription": "The `env` field allows for the addition of environment variables for the control plane component.",
+          "x-intellij-html-description": "\u003cp\u003eThe \u003ccode\u003eenv\u003c/code\u003e field allows for the addition of environment variables for the control plane component.\u003c/p\u003e\n"
+        },
+        "resources": {
+          "type": "object",
+          "title": "resources",
+          "description": "Configure the scheduler resources.\n",
+          "markdownDescription": "Configure the scheduler resources.",
+          "x-intellij-html-description": "\u003cp\u003eConfigure the scheduler resources.\u003c/p\u003e\n"
+        },
+        "config": {
+          "type": "object",
+          "title": "config",
+          "description": "Specify custom kube-scheduler configuration.\n",
+          "markdownDescription": "Specify custom kube-scheduler configuration.",
+          "x-intellij-html-description": "\u003cp\u003eSpecify custom kube-scheduler configuration.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.SystemDiskEncryptionConfig": {
+      "properties": {
+        "state": {
+          "$ref": "#/$defs/v1alpha1.EncryptionConfig",
+          "title": "state",
+          "description": "State partition encryption.\n",
+          "markdownDescription": "State partition encryption.",
+          "x-intellij-html-description": "\u003cp\u003eState partition encryption.\u003c/p\u003e\n"
+        },
+        "ephemeral": {
+          "$ref": "#/$defs/v1alpha1.EncryptionConfig",
+          "title": "ephemeral",
+          "description": "Ephemeral partition encryption.\n",
+          "markdownDescription": "Ephemeral partition encryption.",
+          "x-intellij-html-description": "\u003cp\u003eEphemeral partition encryption.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.TimeConfig": {
+      "properties": {
+        "disabled": {
+          "type": "boolean",
+          "title": "disabled",
+          "description": "Indicates if the time service is disabled for the machine.\nDefaults to false.\n",
+          "markdownDescription": "Indicates if the time service is disabled for the machine.\nDefaults to `false`.",
+          "x-intellij-html-description": "\u003cp\u003eIndicates if the time service is disabled for the machine.\nDefaults to \u003ccode\u003efalse\u003c/code\u003e.\u003c/p\u003e\n"
+        },
+        "servers": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "servers",
+          "description": "Specifies time (NTP) servers to use for setting the system time.\nDefaults to pool.ntp.org\n",
+          "markdownDescription": "Specifies time (NTP) servers to use for setting the system time.\nDefaults to `pool.ntp.org`",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies time (NTP) servers to use for setting the system time.\nDefaults to \u003ccode\u003epool.ntp.org\u003c/code\u003e\u003c/p\u003e\n"
+        },
+        "bootTimeout": {
+          "type": "string",
+          "pattern": "^[-+]?(((\\d+(\\.\\d*)?|\\d*(\\.\\d+)+)([nuµm]?s|m|h))|0)+$",
+          "title": "bootTimeout",
+          "description": "Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.\nNTP sync will be still running in the background.\nDefaults to “infinity” (waiting forever for time sync)\n",
+          "markdownDescription": "Specifies the timeout when the node time is considered to be in sync unlocking the boot sequence.\nNTP sync will be still running in the background.\nDefaults to \"infinity\" (waiting forever for time sync)",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies the timeout when the node time is considered to be in sync unlocking the boot sequence.\nNTP sync will be still running in the background.\nDefaults to \u0026ldquo;infinity\u0026rdquo; (waiting forever for time sync)\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.UdevConfig": {
+      "properties": {
+        "rules": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "rules",
+          "description": "List of udev rules to apply to the udev system\n",
+          "markdownDescription": "List of udev rules to apply to the udev system",
+          "x-intellij-html-description": "\u003cp\u003eList of udev rules to apply to the udev system\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.VIPEquinixMetalConfig": {
+      "properties": {
+        "apiToken": {
+          "type": "string",
+          "title": "apiToken",
+          "description": "Specifies the Equinix Metal API Token.\n",
+          "markdownDescription": "Specifies the Equinix Metal API Token.",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies the Equinix Metal API Token.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.VIPHCloudConfig": {
+      "properties": {
+        "apiToken": {
+          "type": "string",
+          "title": "apiToken",
+          "description": "Specifies the Hetzner Cloud API Token.\n",
+          "markdownDescription": "Specifies the Hetzner Cloud API Token.",
+          "x-intellij-html-description": "\u003cp\u003eSpecifies the Hetzner Cloud API Token.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.Vlan": {
+      "properties": {
+        "addresses": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array",
+          "title": "addresses",
+          "description": "The addresses in CIDR notation or as plain IPs to use.\n",
+          "markdownDescription": "The addresses in CIDR notation or as plain IPs to use.",
+          "x-intellij-html-description": "\u003cp\u003eThe addresses in CIDR notation or as plain IPs to use.\u003c/p\u003e\n"
+        },
+        "routes": {
+          "items": {
+            "$ref": "#/$defs/v1alpha1.Route"
+          },
+          "type": "array",
+          "title": "routes",
+          "description": "A list of routes associated with the VLAN.\n",
+          "markdownDescription": "A list of routes associated with the VLAN.",
+          "x-intellij-html-description": "\u003cp\u003eA list of routes associated with the VLAN.\u003c/p\u003e\n"
+        },
+        "dhcp": {
+          "type": "boolean",
+          "title": "dhcp",
+          "description": "Indicates if DHCP should be used.\n",
+          "markdownDescription": "Indicates if DHCP should be used.",
+          "x-intellij-html-description": "\u003cp\u003eIndicates if DHCP should be used.\u003c/p\u003e\n"
+        },
+        "vlanId": {
+          "type": "integer",
+          "title": "vlanId",
+          "description": "The VLAN’s ID.\n",
+          "markdownDescription": "The VLAN's ID.",
+          "x-intellij-html-description": "\u003cp\u003eThe VLAN\u0026rsquo;s ID.\u003c/p\u003e\n"
+        },
+        "mtu": {
+          "type": "integer",
+          "title": "mtu",
+          "description": "The VLAN’s MTU.\n",
+          "markdownDescription": "The VLAN's MTU.",
+          "x-intellij-html-description": "\u003cp\u003eThe VLAN\u0026rsquo;s MTU.\u003c/p\u003e\n"
+        },
+        "vip": {
+          "$ref": "#/$defs/v1alpha1.DeviceVIPConfig",
+          "title": "vip",
+          "description": "The VLAN’s virtual IP address configuration.\n",
+          "markdownDescription": "The VLAN's virtual IP address configuration.",
+          "x-intellij-html-description": "\u003cp\u003eThe VLAN\u0026rsquo;s virtual IP address configuration.\u003c/p\u003e\n"
+        },
+        "dhcpOptions": {
+          "$ref": "#/$defs/v1alpha1.DHCPOptions",
+          "title": "dhcpOptions",
+          "description": "DHCP specific options.\ndhcp must be set to true for these to take effect.\n",
+          "markdownDescription": "DHCP specific options.\n`dhcp` *must* be set to true for these to take effect.",
+          "x-intellij-html-description": "\u003cp\u003eDHCP specific options.\n\u003ccode\u003edhcp\u003c/code\u003e \u003cem\u003emust\u003c/em\u003e be set to true for these to take effect.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    },
+    "v1alpha1.VolumeMountConfig": {
+      "properties": {
+        "hostPath": {
+          "type": "string",
+          "title": "hostPath",
+          "description": "Path on the host.\n",
+          "markdownDescription": "Path on the host.",
+          "x-intellij-html-description": "\u003cp\u003ePath on the host.\u003c/p\u003e\n"
+        },
+        "mountPath": {
+          "type": "string",
+          "title": "mountPath",
+          "description": "Path in the container.\n",
+          "markdownDescription": "Path in the container.",
+          "x-intellij-html-description": "\u003cp\u003ePath in the container.\u003c/p\u003e\n"
+        },
+        "readonly": {
+          "type": "boolean",
+          "title": "readonly",
+          "description": "Mount the volume read only.\n",
+          "markdownDescription": "Mount the volume read only.",
+          "x-intellij-html-description": "\u003cp\u003eMount the volume read only.\u003c/p\u003e\n"
+        }
+      },
+      "additionalProperties": false,
+      "type": "object"
+    }
+  },
+  "oneOf": [
+    {
+      "$ref": "#/$defs/network.DefaultActionConfigV1Alpha1"
+    },
+    {
+      "$ref": "#/$defs/network.RuleConfigV1Alpha1"
+    },
+    {
+      "$ref": "#/$defs/runtime.EventSinkV1Alpha1"
+    },
+    {
+      "$ref": "#/$defs/runtime.KmsgLogV1Alpha1"
+    },
+    {
+      "$ref": "#/$defs/siderolink.ConfigV1Alpha1"
+    },
+    {
+      "$ref": "#/$defs/v1alpha1.Config"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/frontend/src/shims-vue.d.ts b/frontend/src/shims-vue.d.ts
new file mode 100644
index 000000000..2996e380d
--- /dev/null
+++ b/frontend/src/shims-vue.d.ts
@@ -0,0 +1,11 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+/* eslint-disable */
+declare module '*.vue' {
+  import type { DefineComponent } from 'vue'
+  const component: DefineComponent<{}, {}, any>
+  export default component
+}
diff --git a/frontend/src/states/cluster-management/index.ts b/frontend/src/states/cluster-management/index.ts
new file mode 100644
index 000000000..8c83fae7b
--- /dev/null
+++ b/frontend/src/states/cluster-management/index.ts
@@ -0,0 +1,689 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// MachineSet is the state used in cluster creation flow.
+
+import { Resource, ResourceService } from "@/api/grpc"
+import { ClusterSpec, ConfigPatchSpec, MachineSetSpecBootstrapSpec, MachineSetSpecUpdateStrategy, EtcdBackupConf } from "@/api/omni/specs/omni.pb"
+
+import { MachineSetNodeSpec, MachineSetSpec, MachineSetSpecMachineClassAllocationType } from "@/api/omni/specs/omni.pb";
+import {
+  ClusterType, ConfigPatchName,
+  ConfigPatchType,
+  DefaultKubernetesVersion,
+  DefaultNamespace,
+  DefaultTalosVersion,
+  LabelCluster,
+  LabelClusterMachine,
+  LabelControlPlaneRole,
+  LabelMachineSet,
+  LabelSystemPatch,
+  LabelWorkerRole,
+  MachineSetNodeType,
+  MachineSetType,
+  PatchBaseWeightCluster,
+  PatchBaseWeightClusterMachine,
+  PatchBaseWeightMachineSet
+} from "@/api/resources";
+import { controlPlaneMachineSetId, defaultWorkersMachineSetId } from "@/methods/machineset";
+import { ref } from "vue";
+import { parseLabels } from "@/methods/labels";
+import yaml from "js-yaml";
+import { withRuntime, withSelectors } from "@/api/options";
+import { Runtime } from "@/api/common/omni.pb";
+
+const dec2hex = (dec: number) => {
+  return dec.toString(16).padStart(2, "0");
+}
+
+const generateID = (len: number) => {
+  const arr = new Uint8Array((len || 40) / 2);
+  window.crypto.getRandomValues(arr);
+
+  return Array.from(arr, dec2hex).join("");
+}
+
+export const unlimited = "unlimited";
+
+export enum PatchID {
+  Default = "",
+  Untaint = "untaint",
+  InstallDisk = "install-disk"
+}
+
+const colors = [
+  "red",
+  "orange",
+  "violet",
+  "yellow",
+  "cyan",
+  "blue1",
+  "blue2",
+  "blue3",
+  "light1",
+  "light2",
+  "light3",
+  "light4",
+  "light5",
+  "light6",
+  "light7",
+];
+
+// Keeps the configuration for the machine set.
+export interface MachineSet {
+  id: string
+  name: string
+  role: string
+  color: string
+  machineClass?: {
+    name: string
+    size: number | "unlimited"
+  }
+  machines: Record<string, MachineSetNode>
+  patches: Record<string, ConfigPatch>
+  bootstrapSpec?: MachineSetSpecBootstrapSpec
+  idFunc: (cluster: string) => string
+}
+
+export interface MachineSetNode {
+  patches: Record<string, ConfigPatch>
+}
+
+export type Cluster = {
+  labels?: Record<string, string>
+  annotations?: Record<string, string>
+  name?: string
+  talosVersion?: string
+  kubernetesVersion?: string
+  features: {
+    encryptDisks?: boolean
+    enableWorkloadProxy?: boolean
+  }
+  etcdBackupConfig?: EtcdBackupConf,
+  patches: Record<string, ConfigPatch>
+}
+
+export type ConfigPatch = {
+  data: string
+  weight: number
+  systemPatch?: boolean
+  nameAnnotation?: string
+}
+
+export class State {
+  public machineSets: MachineSet[] = [];
+
+  public cluster: Cluster = {
+    talosVersion: DefaultTalosVersion,
+    kubernetesVersion: DefaultKubernetesVersion,
+    patches: {},
+    features: {},
+  };
+
+  public index: number = 1;
+
+  public baseResources?: Resource[];
+
+  constructor() {
+    this.machineSets = [
+      {
+        id: "CP",
+        name: "control planes",
+        role: LabelControlPlaneRole,
+        color: "green",
+        machines: {},
+        idFunc: controlPlaneMachineSetId,
+        patches: {},
+      },
+      {
+        id: "W0",
+        name: "main worker pool",
+        role: LabelWorkerRole,
+        color: "red",
+        machines: {},
+        idFunc: defaultWorkersMachineSetId,
+        patches: {},
+      },
+    ];
+  }
+
+  public get controlPlanesCount() {
+    return this.machinesOfKind(LabelControlPlaneRole);
+  }
+
+  public get workersCount() {
+    return this.machinesOfKind(LabelWorkerRole);
+  }
+
+  setClusterName(name: string) {
+    this.cluster.name = name;
+  }
+
+  addClusterLabels(labels: string[]) {
+    this.cluster.labels = {
+      ...this.cluster.labels,
+      ...parseLabels(...labels),
+    }
+  }
+
+  removeClusterLabels(keys: string[]) {
+    if (!this.cluster.labels) {
+      return;
+    }
+
+    for (const key of keys) {
+      delete this.cluster.labels[key];
+    }
+  }
+
+  addMachineSet(role: string): MachineSet {
+    const id = generateID(6);
+
+    this.machineSets.push({
+      id: `W${this.index}`,
+      name: `workers-${id}`,
+      role: role,
+      color: colors[this.index % colors.length],
+      machines: {},
+      patches: {},
+      idFunc: (cluster: string) => `${cluster}-w${id}`
+    });
+
+    this.index++;
+
+    return this.machineSets[this.machineSets.length - 1];
+  }
+
+  removeMachineSet(index: number) {
+    if (index < 2) {
+      throw new Error("removing primary machine sets is not allowed");
+    }
+
+    this.machineSets.splice(index, 1);
+  }
+
+  setMachine(index: number, id: string, machineSetNode: MachineSetNode) {
+    this.machineSets[index].machines[id] = machineSetNode;
+  }
+
+  removeMachine(index: number, id: string) {
+    if (index < this.machineSets.length) {
+      delete(this.machineSets[index].machines[id]);
+    }
+  }
+
+  untaintSingleNode(): boolean {
+    let nodes = 0;
+
+    for (const ms of this.machineSets) {
+      if (ms.machineClass?.size === "unlimited") {
+        return false;
+      }
+
+      const machineSetSize = (ms.machineClass?.size ?? NaN) as number;
+
+      nodes += !isNaN(machineSetSize) ? machineSetSize : Object.keys(ms.machines).length;
+    }
+
+    // not a single node cluster
+    if (nodes != 1) {
+      return false;
+    }
+
+    // get all patches for cluster, control plane machine set and control plane machines
+    const cp = this.controlPlanes();
+    const patches = [
+      ...Object.values(this.cluster.patches),
+      ...Object.values(cp.patches),
+      ...Object.values(cp.machines[Object.keys(cp.machines)[0]]?.patches ?? {}),
+    ]
+
+    // already enabled in one of the config patches
+    for (const patch of patches) {
+      if (this.checkSchedulingEnabled(patch.data)) {
+        return false;
+      }
+    }
+
+    return true;
+  }
+
+  machineSetID(index: number): string {
+    if (!this.cluster.name || index > this.machineSets.length) {
+      throw new Error(`can not get the id of the machine set at index ${index}`)
+    }
+
+    return this.machineSets[index].idFunc(this.cluster.name);
+  }
+
+  controlPlanes(): MachineSet {
+    return this.machineSets[0];
+  }
+
+  resources(): Resource[] {
+    if (!this.cluster.name) {
+      throw new Error("cluster name is not set");
+    }
+
+    const cluster: Resource<ClusterSpec> = {
+      metadata: {
+        namespace: DefaultNamespace,
+        type: ClusterType,
+        id: this.cluster.name,
+        labels: this.cluster.labels,
+        annotations: this.cluster.annotations,
+      },
+      spec: {
+        talos_version: this.cluster.talosVersion,
+        kubernetes_version: this.cluster.kubernetesVersion,
+        features: {},
+      }
+    };
+
+    if (this.cluster.features.enableWorkloadProxy) {
+      cluster.spec.features = {
+        ...cluster.spec.features,
+        enable_workload_proxy: this.cluster.features?.enableWorkloadProxy,
+      }
+    }
+
+    if (this.cluster.features.encryptDisks) {
+      cluster.spec.features = {
+        ...cluster.spec.features,
+        disk_encryption: this.cluster.features?.encryptDisks,
+      }
+    }
+
+    if (this.cluster.etcdBackupConfig && this.cluster.etcdBackupConfig.enabled && this.cluster.etcdBackupConfig.interval) {
+      cluster.spec.backup_configuration = {
+        enabled: this.cluster.etcdBackupConfig.enabled,
+        interval: this.cluster.etcdBackupConfig.interval,
+      }
+    } else {
+      cluster.spec.backup_configuration = undefined;
+    }
+
+    const resources: Resource[] = [
+      cluster,
+    ];
+
+    resources.push(...this.getPatches(this.cluster.patches, {
+      [LabelCluster]: this.cluster.name,
+    }, this.cluster.name));
+
+    const machineSets = [...this.machineSets].sort((a: MachineSet, b: MachineSet) => {
+      if (a.machineClass && !b.machineClass) {
+        return 1;
+      }
+
+      if (b.machineClass && !a.machineClass) {
+        return -1;
+      }
+
+      return 0;
+    });
+
+    for (const machineSet of machineSets) {
+      const machineSetID = machineSet.idFunc(this.cluster.name);
+
+      const ms: Resource<MachineSetSpec> = {
+        metadata: {
+          id: machineSetID,
+          namespace: DefaultNamespace,
+          type: MachineSetType,
+          labels: {
+            [LabelCluster]: this.cluster.name,
+            [machineSet.role]: "",
+          },
+        },
+        spec: {
+          update_strategy: MachineSetSpecUpdateStrategy.Rolling,
+        }
+      };
+
+      // preserve the bootstrap spec as-is if it was originally set, as it is immutable after creation
+      ms.spec.bootstrap_spec = machineSet.bootstrapSpec;
+
+      if (machineSet.machineClass) {
+        ms.spec.machine_class = {
+          name: machineSet.machineClass.name,
+        }
+
+        switch (machineSet.machineClass.size) {
+        case unlimited:
+          ms.spec.machine_class.allocation_type = MachineSetSpecMachineClassAllocationType.Unlimited;
+
+          break;
+        default:
+          ms.spec.machine_class.machine_count = machineSet.machineClass.size as number;
+
+          break;
+        }
+      } else {
+        ms.spec.machine_class = undefined;
+      }
+
+      for (const id in machineSet.machines) {
+        const msn: Resource<MachineSetNodeSpec> = {
+          metadata: {
+            id: id,
+            namespace: DefaultNamespace,
+            type: MachineSetNodeType,
+            labels: {
+              [LabelCluster]: this.cluster.name,
+              [machineSet.role]: "",
+              [LabelMachineSet]: machineSetID,
+            }
+          },
+          spec: {}
+        }
+
+        if (!machineSet.machineClass)
+          resources.push(msn);
+
+        resources.push(...this.getPatches(machineSet.machines[id].patches, {
+          [LabelCluster]: this.cluster.name,
+          [LabelClusterMachine]: msn.metadata.id!,
+        }));
+      }
+
+      resources.push(ms);
+
+      resources.push(...this.getPatches(machineSet.patches, {
+        [LabelCluster]: this.cluster.name,
+        [LabelMachineSet]: ms.metadata.id!,
+      }, ms.metadata.id));
+    }
+
+    if (!this.baseResources) {
+      return resources;
+    }
+
+    const baseResources: Record<string, Record<string, Resource>> = {};
+
+    for (const r of this.baseResources) {
+      baseResources[r.metadata.type!] = baseResources[r.metadata.type!] || {};
+
+      baseResources[r.metadata.type!][r.metadata.id!] = r;
+    }
+
+    return resources.map(res => {
+      const base = baseResources[res.metadata.type!]?.[res.metadata.id!];
+      if (!base) return res;
+
+      return {
+        metadata: {
+          ...base.metadata,
+          ...res.metadata,
+        },
+        spec: {
+          ...base.spec,
+          ...res.spec,
+        }
+      }
+    });
+  }
+
+  private getPatches(patches: Record<string, ConfigPatch>, labels: Record<string, string>, prefix?: string): Resource<ConfigPatchSpec>[] {
+    const res: Resource<ConfigPatchSpec>[] = [];
+
+    for (const key in patches) {
+      const systemLabels = {};
+      const patch = patches[key];
+
+      if (patch.systemPatch) {
+        systemLabels[LabelSystemPatch] = "";
+      }
+
+      const parts: string[] = [];
+      if (prefix) {
+        parts.push(prefix);
+      }
+
+      if (key != "") {
+        parts.push(key);
+      }
+
+      const id = formatPatchID(parts.join("-"), patch.weight);
+
+      const patchResource: Resource<ConfigPatchSpec> = {
+        metadata: {
+          id: id,
+          type: ConfigPatchType,
+          labels: {
+            ...systemLabels,
+            ...labels,
+          },
+          namespace: DefaultNamespace,
+        },
+        spec: {
+          data: patch.data,
+        }
+      };
+
+      if (patch.nameAnnotation) {
+        patchResource.metadata.annotations = {
+          [ConfigPatchName]: patch.nameAnnotation,
+        }
+      }
+
+      res.push(patchResource);
+    }
+
+    return res;
+  }
+
+  private checkSchedulingEnabled(data: string) {
+    const loaded = yaml.load(data);
+
+    return loaded?.cluster?.allowSchedulingOnControlPlanes;
+  }
+
+  private machinesOfKind(kind: string): number | string {
+    let count = 0;
+
+    for (const ms of this.machineSets) {
+      if (ms.role != kind) {
+        continue;
+      }
+
+      if (ms.machineClass) {
+        if (ms.machineClass.size === "unlimited") {
+          return `All From Class "${ms.machineClass.name}"`;
+        }
+
+        count += ms.machineClass.size as number;
+      } else {
+        count += Object.keys(ms.machines).length;
+      }
+    }
+
+    return count;
+  }
+}
+
+export const state = ref<State>(new State());
+
+export const initState = () => {
+  state.value = new State();
+
+  return state;
+};
+
+const formatPatchID = (key: string, weight: number) => `${weight.toString().padStart(3, "0")}-${key}`;
+
+export const populateExisting = async (clusterName: string) => {
+  initState();
+
+  const resources: Resource[] = [];
+
+  // list all cluster config patches
+  const patches: Resource<ConfigPatch>[] = await ResourceService.List({
+    type: ConfigPatchType,
+    namespace: DefaultNamespace,
+  }, withRuntime(Runtime.Omni), withSelectors([`${LabelCluster}=${clusterName}`]));
+
+  const patchesByID: Record<string, Resource<ConfigPatchSpec>> = {};
+
+  for (const patch of patches) {
+    patchesByID[patch.metadata.id!] = patch;
+  }
+
+  // get cluster
+  const cluster: Resource<ClusterSpec> = await ResourceService.Get({
+    type: ClusterType,
+    namespace: DefaultNamespace,
+    id: clusterName,
+  }, withRuntime(Runtime.Omni));
+
+  resources.push(cluster);
+
+  state.value.cluster = {
+    name: clusterName,
+    kubernetesVersion: cluster.spec.kubernetes_version,
+    talosVersion: cluster.spec.talos_version,
+    labels: cluster.metadata.labels ?? {},
+    annotations: cluster.metadata.annotations ?? {},
+    patches: {},
+    features: {
+      enableWorkloadProxy: cluster.spec.features?.enable_workload_proxy,
+      encryptDisks: cluster.spec.features?.disk_encryption,
+    },
+    etcdBackupConfig: {
+      enabled: cluster.spec.backup_configuration?.enabled,
+      interval: cluster.spec.backup_configuration?.interval,
+    }
+  }
+
+  const clusterPatch = patchesByID[formatPatchID(clusterName, PatchBaseWeightCluster)];
+
+  if (clusterPatch) {
+    state.value.cluster.patches[PatchID.Default] = {
+      data: clusterPatch.spec.data!,
+      weight: PatchBaseWeightCluster,
+    }
+
+    resources.push(clusterPatch);
+  }
+
+  // list machine sets
+  const machineSets: Resource<MachineSetSpec>[] = await ResourceService.List({
+    type: MachineSetType,
+    namespace: DefaultNamespace
+  }, withRuntime(Runtime.Omni), withSelectors([`${LabelCluster}=${clusterName}`]));
+
+  state.value.index = 0;
+
+  const machineSetList: MachineSet[] = [];
+
+  const machineSetsByID: Record<string, MachineSet> = {};
+
+  machineSets.sort((a, b) => {
+    if (a.metadata.id === controlPlaneMachineSetId(clusterName)) {
+      return -1;
+    }
+
+    if (a.metadata.id == defaultWorkersMachineSetId(clusterName) && b.metadata.id != controlPlaneMachineSetId(clusterName)) {
+      return -1;
+    }
+
+    return 0;
+  });
+
+  for (let i = 0; i < machineSets.length; i++) {
+    const ms = machineSets[i];
+    if (ms.metadata.phase === "tearingDown") {
+      continue;
+    }
+
+    const isCP = ms.metadata.labels?.[LabelControlPlaneRole] !== undefined;
+
+    const machineSet: MachineSet = {
+      color: isCP ? "green" : colors[state.value.index % colors.length],
+      id: isCP ? "CP" : `W${state.value.index}`,
+      name: ms.metadata.id!,
+      idFunc: () => ms.metadata.id!,
+      role: isCP ? LabelControlPlaneRole : LabelWorkerRole,
+      bootstrapSpec: ms.spec.bootstrap_spec,
+      machines: {},
+      patches: {},
+    };
+
+    if (ms.spec.machine_class) {
+      machineSet.machineClass = {
+        name: ms.spec.machine_class.name!,
+        size: ms.spec.machine_class.allocation_type === MachineSetSpecMachineClassAllocationType.Unlimited ? "unlimited" : ms.spec.machine_class.machine_count ?? 0,
+      }
+    }
+
+    const configPatch = patchesByID[formatPatchID(ms.metadata.id!, PatchBaseWeightMachineSet)];
+    if (configPatch) {
+      machineSet.patches[PatchID.Default] = {
+        data: configPatch.spec.data!,
+        weight: PatchBaseWeightMachineSet
+      }
+
+      resources.push(configPatch);
+    }
+
+    machineSetsByID[ms.metadata.id!] = machineSet;
+
+    machineSetList.push(machineSet);
+
+    if (!isCP) {
+      state.value.index++;
+    }
+
+    resources.push(ms);
+  }
+
+  // get machine set nodes
+  const machineSetNodes: Resource<MachineSetNode>[] = await ResourceService.List({
+    type: MachineSetNodeType,
+    namespace: DefaultNamespace,
+  }, withRuntime(Runtime.Omni), withSelectors([`${LabelCluster}=${clusterName}`]));
+
+  const machinesByID: Record<string, MachineSetNode> = {};
+
+  for (const msn of machineSetNodes) {
+    const msName = msn.metadata.labels?.[LabelMachineSet];
+    if (!msName) {
+      continue;
+    }
+
+    const machineSetNode = {
+      patches: {},
+    };
+
+    if (!machineSetsByID[msName]) {
+      continue;
+    }
+
+    machineSetsByID[msName].machines[msn.metadata.id!] = machineSetNode;
+    machinesByID[msn.metadata.id!] = machineSetNode;
+
+    const key = `cm-${msn.metadata.id!}`;
+    const id = formatPatchID(key, PatchBaseWeightClusterMachine);
+
+    const configPatch = patchesByID[id];
+    if (configPatch) {
+      machineSetNode.patches[key] = {
+        data: configPatch.spec.data!,
+        weight: PatchBaseWeightMachineSet
+      }
+
+      resources.push(configPatch);
+    }
+
+    if (!msn.metadata.owner) {
+      resources.push(msn);
+    }
+  }
+
+  state.value.machineSets = machineSetList;
+  state.value.baseResources = resources;
+
+  return resources;
+}
diff --git a/frontend/src/theme.ts b/frontend/src/theme.ts
new file mode 100644
index 000000000..ea2890f05
--- /dev/null
+++ b/frontend/src/theme.ts
@@ -0,0 +1,42 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { ref, watch } from "vue";
+
+const systemTheme = ref(window.matchMedia('(prefers-color-scheme: dark)').matches ? "dark" : "light");
+const theme = ref(localStorage.theme || "system");
+
+const match = window.matchMedia('(prefers-color-scheme: dark)');
+
+if (match.addEventListener) {
+  match.addEventListener('change', e => {
+    systemTheme.value = e.matches ? "dark" : "light";
+  });
+}
+
+watch(
+  theme,
+  (v) => {
+    localStorage.theme = v;
+  }
+)
+
+export function isDark(mode: string): boolean {
+  for(let i = 0; i < 2; i++) {
+    switch(mode) {
+      case "system":
+        mode = systemTheme.value;
+        break;
+      case "dark":
+        return true;
+      case "light":
+        return false;
+    }
+  }
+
+  return false;
+}
+
+export { theme, systemTheme };
diff --git a/frontend/src/vars/colors.js b/frontend/src/vars/colors.js
new file mode 100644
index 000000000..ef67fea38
--- /dev/null
+++ b/frontend/src/vars/colors.js
@@ -0,0 +1,53 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+module.exports = {
+  naturals: {
+    N0: "#101118",
+    N1: "#13141C",
+    N2: "#15161E",
+    N3: "#191B24",
+    N4: "#1F222E",
+    N5: "#272932",
+    N6: "#2C2E38",
+    N7: "#3A3B45",
+    N8: "#5B5C64",
+    N9: "#7D7D85",
+    N10: "#878990",
+    N11: "#9FA1A6",
+    N12: "#C3C3C7",
+    N13: "#E8E8E9",
+    N14: "#FFFFFF",
+  },
+  primary: {
+    P1: "#FFBEA9",
+    P2: "#FE9E74",
+    P3: "#FF8B59",
+    P4: "#FF5F2A",
+    P5: "#CE5027",
+    P6: "#342321",
+  },
+  green: {
+    G1: "#69C297",
+    G2: "#2D9663",
+    G3: "#141F21",
+  },
+  red: {
+    R1: "#FF5C56",
+    R2: "#6E2F30",
+    R3: "#311C20",
+    RLogo: "#F62D2C",
+  },
+  yellow: {
+    Y1: "#FFB200",
+    Y2: "#C68A00",
+    Y3: "#A97809",
+    Y4: "#252115",
+  },
+  blue: {
+    BLogo: "#281D48",
+    B1: "#0C6EE7",
+  },
+};
diff --git a/frontend/src/views/cluster/Backups/Backups.vue b/frontend/src/views/cluster/Backups/Backups.vue
new file mode 100644
index 000000000..29610841c
--- /dev/null
+++ b/frontend/src/views/cluster/Backups/Backups.vue
@@ -0,0 +1,66 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col">
+    <div class="flex gap-1 items-start">
+      <page-header title="Control Plane Backups" class="flex-1"/>
+      <div class="flex gap-1 items-center text-xs">
+        Cluster UUID:
+        <div>{{ clusterUUID }}</div>
+        <icon-button icon="copy" @click="() => copyText(clusterUUID, undefined, () => {})"/>
+        <t-button type="highlighted" class="ml-2" @click="runEtcdBackup" :disabled="startingEtcdBackup || !backupStatus.enabled">Trigger Etcd Backup</t-button>
+      </div>
+    </div>
+    <backups-list class="mb-6"/>
+  </div>
+</template>
+
+<script setup lang="ts">
+import PageHeader from "@/components/common/PageHeader.vue";
+import { triggerEtcdBackup } from "@/methods/cluster";
+import { showError } from "@/notification";
+import { onMounted, ref } from "vue";
+import { useRoute } from "vue-router";
+import { Resource, ResourceService } from "@/api/grpc";
+import { withRuntime } from "@/api/options";
+import { Runtime } from "@/api/common/omni.pb";
+import { ClusterUUIDType, DefaultNamespace } from "@/api/resources";
+import { ClusterUUID } from "@/api/omni/specs/omni.pb";
+import { copyText } from "vue3-clipboard";
+
+import BackupsList from "@/views/cluster/Backups/BackupsList.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import IconButton from "@/components/common/Button/IconButton.vue";
+import { setupBackupStatus } from "@/methods";
+
+const startingEtcdBackup = ref(false);
+const route = useRoute();
+const clusterUUID = ref("loading...");
+const { status: backupStatus } = setupBackupStatus();
+
+onMounted(async () => {
+  const resp: Resource<ClusterUUID> = await ResourceService.Get({
+    id: route.params.cluster as string,
+    namespace: DefaultNamespace,
+    type: ClusterUUIDType,
+  }, withRuntime(Runtime.Omni))
+
+  clusterUUID.value = resp.spec.uuid!;
+});
+
+const runEtcdBackup = async () => {
+  startingEtcdBackup.value = true;
+
+  try {
+    await triggerEtcdBackup(route.params.cluster as string);
+  } catch (e) {
+    showError("Failed to Trigger Manual Etcd Backup", e.message);
+  }
+
+  startingEtcdBackup.value = false;
+}
+</script>
diff --git a/frontend/src/views/cluster/Backups/BackupsList.vue b/frontend/src/views/cluster/Backups/BackupsList.vue
new file mode 100644
index 000000000..8d7e8998f
--- /dev/null
+++ b/frontend/src/views/cluster/Backups/BackupsList.vue
@@ -0,0 +1,127 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <watch :opts="watchOverallStatusOpts" spinner noRecordsAlert errorsAlert>
+    <template #default="overallStatus">
+      <t-alert v-if="overallStatus.items[0]?.spec?.configuration_error" type="warn"
+        :title="`The backups storage is not properly configured: ${overallStatus.items[0]?.spec?.configuration_error}`">
+        <div class="flex gap-1">Check the <t-button type="subtle" @click="openDocs">documentation</t-button> on how to configure s3 backups using CLI.</div>
+        <div class="flex gap-1" v-if="canManageBackupStore">Or<t-button @click="$router.push({name: 'BackupStorage'})" type="subtle">configure backups in the UI.</t-button></div>
+      </t-alert>
+      <watch v-else :opts="watchStatusOpts" spinner noRecordsAlert errorsAlert>
+        <template #default="status">
+          <t-list :opts="watchOpts" search :sortOptions="sortOptions" :key="status.items[0]?.metadata?.updated">
+            <template #default="{ items, searchQuery }">
+              <div class="header">
+                <div class="list-grid">
+                  <div>ID</div>
+                  <div>Creation Date</div>
+                  <div>Size</div>
+                  <div>Snapshot ID</div>
+                </div>
+              </div>
+              <t-list-item v-for="item in items" :key="item.metadata.id!">
+                <div class="text-naturals-N12 relative pr-3" :class="{ 'pl-7': !item.spec.description }">
+                  <div class="list-grid">
+                    <WordHighlighter
+                        :query="searchQuery"
+                        :textToHighlight="item.metadata.id"
+                        highlightClass="bg-naturals-N14"
+                    />
+                    <div class="text-naturals-N14">{{ time.formatISO(item.spec.created_at as string, dateFormat) }}</div>
+                    <div class="text-naturals-N14">{{ formatBytes(parseInt(item.spec.size ?? '0')) }}</div>
+                    <div class="text-naturals-N14 flex gap-2 items-center">
+                      {{ item.spec.snapshot }}
+                      <icon-button icon="copy" @click="copyText(item.spec.snapshot, undefined, () => {})"/>
+                    </div>
+                  </div>
+                </div>
+              </t-list-item>
+            </template>
+          </t-list>
+        </template>
+      </watch>
+    </template>
+  </watch>
+</template>
+
+<script setup lang="ts">
+import { Runtime } from "@/api/common/omni.pb";
+import { ExternalNamespace, EtcdBackupType, LabelCluster, EtcdBackupStatusType, DefaultNamespace, EtcdBackupOverallStatusID, EtcdBackupOverallStatusType } from "@/api/resources";
+import { WatchOptions } from "@/api/watch";
+import { computed } from "vue";
+import { time } from "@/methods/time";
+import { useRoute } from "vue-router";
+import { copyText } from "vue3-clipboard";
+import { formatBytes } from "@/methods";
+
+import TList from "@/components/common/List/TList.vue";
+import TListItem from "@/components/common/List/TListItem.vue";
+import TAlert from "@/components/TAlert.vue";
+import WordHighlighter from "vue-word-highlighter";
+import IconButton from "@/components/common/Button/IconButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import Watch from "@/components/common/Watch/Watch.vue";
+import { canManageBackupStore } from "@/methods/auth";
+
+const dateFormat = "HH:mm MMM d y";
+const route = useRoute();
+
+const sortOptions = [
+  {id: 'id', desc: 'Creation Time ⬇', descending: true},
+  {id: 'id', desc: 'Creation Time ⬆'},
+];
+
+const watchStatusOpts = computed((): WatchOptions => {
+  return {
+    resource: {
+      namespace: DefaultNamespace,
+      type: EtcdBackupStatusType,
+      id: route.params.cluster as string
+    },
+    runtime: Runtime.Omni,
+  }
+});
+
+const watchOverallStatusOpts = computed((): WatchOptions => {
+  return {
+    resource: {
+      namespace: DefaultNamespace,
+      type: EtcdBackupOverallStatusType,
+      id: EtcdBackupOverallStatusID
+    },
+    runtime: Runtime.Omni,
+  }
+});
+
+const watchOpts = computed((): WatchOptions => {
+  return {
+    resource: {
+      namespace: ExternalNamespace,
+      type: EtcdBackupType,
+    },
+    runtime: Runtime.Omni,
+    selectors: [
+      `${LabelCluster}=${route.params.cluster}`
+    ]
+  }
+});
+
+const openDocs = () => {
+  window.open("https://omni.siderolabs.com/docs/how-to-guides/how-to-create-etcd-backups/#s3-configuration", "_blank")?.focus();
+}
+</script>
+
+<style scoped>
+.header {
+  @apply bg-naturals-N2 mb-1 py-2 px-6 text-xs pl-10;
+}
+
+.list-grid {
+  @apply grid grid-cols-4 items-center justify-center pr-12 gap-1;
+}
+</style>
diff --git a/frontend/src/views/cluster/ClusterMachines/ClusterMachine.vue b/frontend/src/views/cluster/ClusterMachines/ClusterMachine.vue
new file mode 100644
index 000000000..f66c6b47d
--- /dev/null
+++ b/frontend/src/views/cluster/ClusterMachines/ClusterMachine.vue
@@ -0,0 +1,76 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex items-center h-3 gap-1 hover:bg-naturals-N3 cursor-pointer text-xs py-6 pl-3 pr-4 text-naturals-N14">
+    <div class="w-5 pointer-events-none"/>
+    <div class="flex-1 grid grid-cols-4 -mr-7" @click="openNodeInfo">
+      <div class="col-span-2">
+        <router-link :to="{ name: 'NodeOverview', params: { cluster: clusterName, machine: machine.metadata.id }}" class="list-item-link">
+          {{ nodeName }}
+        </router-link>
+      </div>
+      <cluster-machine-phase :machine="machine" />
+    </div>
+    <tooltip
+      v-if="machineSet.spec.machine_class == undefined && machine?.metadata?.labels?.[LabelWorkerRole] !== undefined"
+      description="Lock machine config. Pause Kubernetes and Talos updates on the machine.">
+      <icon-button :icon="locked ? 'locked' : 'unlocked'" class="w-4 h-4 ml-1" @click="updateLock"/>
+    </tooltip>
+    <div class="w-7" v-else/>
+    <node-context-menu :cluster-machine-status="machine" :cluster-name="clusterName" :delete-disabled="deleteDisabled!"/>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { LabelHostname, LabelCluster, MachineLocked, LabelWorkerRole } from "@/api/resources";
+import { useRouter } from "vue-router";
+import { computed, toRefs } from "vue";
+import { Resource } from "@/api/grpc";
+import { ClusterMachineStatusLabelNodeName } from "@/api/resources";
+import { ClusterMachineStatusSpec, MachineSetStatusSpec } from "@/api/omni/specs/omni.pb";
+import { updateMachineLock } from "@/methods/machine";
+import { showError } from "@/notification";
+
+import ClusterMachinePhase from "./ClusterMachinePhase.vue";
+import NodeContextMenu from "@/views/common/NodeContextMenu.vue";
+import IconButton from "@/components/common/Button/IconButton.vue";
+import Tooltip from "@/components/common/Tooltip/Tooltip.vue";
+
+const props = defineProps<{
+  machineSet: Resource<MachineSetStatusSpec>,
+  machine: Resource<ClusterMachineStatusSpec>,
+  deleteDisabled?: boolean,
+}>();
+
+const { machine } = toRefs(props);
+
+const locked = computed(() => {
+  return machine.value?.metadata?.annotations?.[MachineLocked] !== undefined;
+});
+
+const router = useRouter();
+
+const hostname = computed(() => ((props.machine?.metadata?.labels || {})[LabelHostname] ?? props.machine?.metadata.id))
+const nodeName = computed(() => (props.machine?.metadata?.labels || {})[ClusterMachineStatusLabelNodeName] || hostname.value);
+const clusterName = computed(() => (props.machine?.metadata?.labels || {})[LabelCluster]);
+
+const openNodeInfo = async () => {
+  router.push({ name: "NodeOverview", params: { cluster: clusterName.value, machine: props.machine.metadata.id } });
+};
+
+const updateLock = async () => {
+  if (!props.machine.metadata.id) {
+    return;
+  }
+
+  try {
+    await updateMachineLock(props.machine.metadata.id, !locked.value);
+  } catch (e) {
+    showError("Failed To Update Machine Lock", e.message);
+  }
+}
+</script>
diff --git a/frontend/src/views/cluster/ClusterMachines/ClusterMachinePhase.vue b/frontend/src/views/cluster/ClusterMachines/ClusterMachinePhase.vue
new file mode 100644
index 000000000..c67a52c21
--- /dev/null
+++ b/frontend/src/views/cluster/ClusterMachines/ClusterMachinePhase.vue
@@ -0,0 +1,134 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div
+    v-bind:style="'color: ' + stageColor(machine)"
+    v-bind:class="'cluster-stage-box' + (connected(machine) ? '' : ' brightness-50')"
+  >
+    <popper v-if="!connected(machine)" hover placement="right" offsetDistance="4">
+      <template #content>
+        <div class="px-2 py-1 rounded bg-naturals-N4 drop-shadow text-naturals-N12">
+          The machine is unreachable. The last known state is shown.
+        </div>
+      </template>
+      <t-icon class="w-4 h-4" icon="unknown"/>
+    </popper>
+    <t-icon v-else :icon="stageIcon(machine)" class="h-4" />
+    <div class="cluster-stage-name">
+      {{ stageName(machine) || "" }}
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ClusterMachineStatusSpecStage, ClusterMachineStatusSpec } from "@/api/omni/specs/omni.pb";
+import { MachineStatusLabelConnected } from "@/api/resources";
+import { ResourceTyped } from "@/api/grpc";
+
+import TIcon, { IconType } from "@/components/common/Icon/TIcon.vue";
+import Popper from "vue3-popper";
+
+const connected = (machine: ResourceTyped<ClusterMachineStatusSpec>): boolean => {
+  return machine?.metadata.labels?.[MachineStatusLabelConnected] === "";
+};
+
+const stageName = (machine: ResourceTyped<ClusterMachineStatusSpec>): string => {
+  switch (machine?.spec.stage) {
+    case ClusterMachineStatusSpecStage.BOOTING:
+      return "Booting";
+    case ClusterMachineStatusSpecStage.INSTALLING:
+      return "Installing";
+    case ClusterMachineStatusSpecStage.UPGRADING:
+      return "Upgrading";
+    case ClusterMachineStatusSpecStage.CONFIGURING:
+      return "Configuring";
+    case ClusterMachineStatusSpecStage.RUNNING:
+      if (machine?.spec.ready || !connected(machine)) {
+        return "Running";
+      } else {
+        return "Not Ready";
+      }
+    case ClusterMachineStatusSpecStage.REBOOTING:
+      return "Rebooting";
+    case ClusterMachineStatusSpecStage.SHUTTING_DOWN:
+      return "Shutting Down";
+    case ClusterMachineStatusSpecStage.DESTROYING:
+      return "Destroying";
+    case ClusterMachineStatusSpecStage.BEFORE_DESTROY:
+      return "Preparing to Destroy"
+    default:
+      return "Unknown";
+  }
+};
+
+const stageIcon = (machine: ResourceTyped<ClusterMachineStatusSpec>): IconType => {
+  switch (machine?.spec.stage) {
+    case ClusterMachineStatusSpecStage.BOOTING:
+    case ClusterMachineStatusSpecStage.INSTALLING:
+    case ClusterMachineStatusSpecStage.UPGRADING:
+    case ClusterMachineStatusSpecStage.CONFIGURING:
+    case ClusterMachineStatusSpecStage.REBOOTING:
+    case ClusterMachineStatusSpecStage.SHUTTING_DOWN:
+      return "loading";
+    case ClusterMachineStatusSpecStage.RUNNING:
+    if (machine?.spec.ready) {
+        return "check-in-circle";
+      } else {
+        return "error";
+      }
+    case ClusterMachineStatusSpecStage.BEFORE_DESTROY:
+      return "loading";
+    case ClusterMachineStatusSpecStage.DESTROYING:
+      return "delete";
+    default:
+      return "unknown";
+  }
+};
+
+const stageColor = (machine: ResourceTyped<ClusterMachineStatusSpec>): string => {
+  const Y1 = "#FFB200";
+
+  switch (machine?.spec.stage) {
+    case ClusterMachineStatusSpecStage.BOOTING:
+    case ClusterMachineStatusSpecStage.INSTALLING:
+    case ClusterMachineStatusSpecStage.UPGRADING:
+    case ClusterMachineStatusSpecStage.CONFIGURING:
+    case ClusterMachineStatusSpecStage.REBOOTING:
+      return Y1;
+    case ClusterMachineStatusSpecStage.RUNNING:
+      if (machine?.spec.ready || !connected(machine)) {
+        return "#69C297";
+      } else {
+        return "#FF5F2A";
+      }
+    case ClusterMachineStatusSpecStage.SHUTTING_DOWN:
+    case ClusterMachineStatusSpecStage.BEFORE_DESTROY:
+    case ClusterMachineStatusSpecStage.DESTROYING:
+      return "#FF5F2A";
+    default:
+      return Y1;
+  }
+};
+
+type Props = {
+  machine: ResourceTyped<ClusterMachineStatusSpec>;
+};
+
+defineProps<Props>();
+
+</script>
+
+<style>
+.cluster-stage-box {
+  display: flex;
+  align-items: center;
+}
+
+.cluster-stage-name {
+  margin-left: 5px;
+}
+</style>
diff --git a/frontend/src/views/cluster/ClusterMachines/ClusterMachines.vue b/frontend/src/views/cluster/ClusterMachines/ClusterMachines.vue
new file mode 100644
index 000000000..1098dd2c2
--- /dev/null
+++ b/frontend/src/views/cluster/ClusterMachines/ClusterMachines.vue
@@ -0,0 +1,74 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div>
+    <watch v-for="id in watches" :opts="{
+      resource: { namespace: DefaultNamespace, type: MachineSetStatusType, id: id },
+      runtime: Runtime.Omni,
+    }" spinner :key="id">
+      <template #default="{ items }">
+        <machine-set v-for="item in items" :key="itemID(item)" :machineSet="item" :id="item.metadata.id"/>
+      </template>
+    </watch>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { toRefs, ref, computed, Ref } from "vue";
+import {
+  DefaultNamespace,
+  MachineSetStatusType,
+  LabelCluster,
+  LabelControlPlaneRole,
+  MachineSetNodeType, MachineSetType,
+} from "@/api/resources";
+import { Runtime } from "@/api/common/omni.pb";
+import WatchResource, { itemID } from "@/api/watch";
+import { Resource, ResourceTyped } from "@/api/grpc";
+import { MachineSetSpec } from "@/api/omni/specs/omni.pb";
+import { sortMachineSetIds } from "@/methods/machineset";
+
+import Watch from "@/components/common/Watch/Watch.vue";
+import MachineSet from "./MachineSet.vue";
+
+const props = defineProps<{
+  clusterID: string,
+}>();
+
+const { clusterID } = toRefs(props);
+
+const machineSets: Ref<ResourceTyped<MachineSetSpec>[]> = ref([]);
+const machineSetsWatch = new WatchResource(machineSets);
+machineSetsWatch.setup(computed(() => {
+  return {
+    resource: {
+      type: MachineSetType,
+      namespace: DefaultNamespace,
+    },
+    runtime: Runtime.Omni,
+    selectors: [`${LabelCluster}=${clusterID.value}`]
+  };
+}))
+
+const watches = computed(() => sortMachineSetIds(clusterID.value, machineSets.value.map(machineSet => machineSet?.metadata?.id ?? "")));
+
+const controlPlaneNodes = ref<Resource[]>([]);
+
+const machineNodesWatch = new WatchResource(controlPlaneNodes);
+machineNodesWatch.setup(computed(() => {
+  return {
+    resource: {
+      type: MachineSetNodeType,
+      namespace: DefaultNamespace,
+    },
+    runtime: Runtime.Omni,
+    selectors: [
+      `${LabelControlPlaneRole}`
+    ]
+  };
+}));
+</script>
diff --git a/frontend/src/views/cluster/ClusterMachines/MachineSet.vue b/frontend/src/views/cluster/ClusterMachines/MachineSet.vue
new file mode 100644
index 000000000..39fc98888
--- /dev/null
+++ b/frontend/src/views/cluster/ClusterMachines/MachineSet.vue
@@ -0,0 +1,154 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="border-t-8 border-naturals-N4" v-if="machines.length > 0">
+    <div class="flex items-center border-naturals-N4 border-b pr-4 pl-9 text-naturals-N14">
+      <div class="py-3 clusters-grid flex-1 items-center">
+        <div
+          class="flex-none text-xs text-center items-center justify-center px-3 py-1 bg-naturals-N4 w-40 rounded truncate">
+          {{ machineSetTitle(clusterID, machineSet?.metadata?.id) }}
+        </div>
+        <t-spinner class="w-4 h-4" v-if="scaling"/>
+        <div class="flex items-center gap-1" v-else-if="!editingMachinesCount">
+          {{ machineSet?.spec?.machines?.healthy || 0 }}/{{ machineSet?.spec?.machines?.requested || 0 }}
+          <icon-button icon="edit" v-if="machineSet.spec.machine_class?.name" @click="editingMachinesCount = !editingMachinesCount"/>
+        </div>
+        <div v-else class="flex items-center gap-1">
+          <div class="w-12">
+            <t-input :min="0" class="h-6" compact type="number" v-model="machineCount" @keydown.enter="() => updateMachineCount()"/>
+          </div>
+          <icon-button icon="check" @click="() => updateMachineCount()"/>
+          <t-button type="subtle" @click="() => updateMachineCount(MachineSetSpecMachineClassAllocationType.Unlimited)">
+            Use All
+          </t-button>
+        </div>
+        <machine-set-phase :item="machineSet"/>
+        <div v-if="machineSet.spec?.machine_class?.name" class="rounded bg-naturals-N4 px-3 py-1 max-w-min">
+          Machine Class: {{ machineSet.spec?.machine_class?.name }} ({{ machineClassMachineCount }})
+        </div>
+      </div>
+      <t-actions-box style="height: 24px" v-if="canRemoveMachineSet" @click.stop>
+        <t-actions-box-item icon="delete" danger
+          @click="() => openMachineSetDestroy(machineSet)">Destroy Machine Set</t-actions-box-item>
+      </t-actions-box>
+      <div v-else class="w-6"/>
+    </div>
+    <cluster-machine :id="machine.metadata.id" :machine-set="machineSet" :class="{ 'border-b': index != machines.length - 1 }"
+      class="border-naturals-N4" v-for="(machine, index) in machines" :key="itemID(machine)" :machine="machine"
+      :deleteDisabled="!canRemoveMachine" />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Resource } from "@/api/grpc";
+import { MachineSetStatusSpec, ClusterMachineStatusSpec, MachineSetSpecMachineClassAllocationType } from "@/api/omni/specs/omni.pb";
+import { ClusterMachineStatusType, DefaultNamespace, LabelCluster, LabelControlPlaneRole, LabelMachineSet } from "@/api/resources";
+import { computed, ref, toRefs } from "vue";
+import { useRouter } from "vue-router";
+import { setupClusterPermissions } from "@/methods/auth";
+import Watch, { itemID } from "@/api/watch";
+import { Runtime } from "@/api/common/omni.pb";
+import { machineSetTitle, scaleMachineSet } from "@/methods/machineset";
+import { controlPlaneMachineSetId, defaultWorkersMachineSetId } from "@/methods/machineset";
+import { showError } from "@/notification";
+import pluralize from 'pluralize';
+
+import TActionsBox from "@/components/common/ActionsBox/TActionsBox.vue";
+import TActionsBoxItem from "@/components/common/ActionsBox/TActionsBoxItem.vue";
+import ClusterMachine from "./ClusterMachine.vue"
+import MachineSetPhase from "./MachineSetPhase.vue";
+import IconButton from "@/components/common/Button/IconButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import TInput from "@/components/common/TInput/TInput.vue";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+
+const props = defineProps<{
+  machineSet: Resource<MachineSetStatusSpec>
+}>();
+
+const { machineSet } = toRefs(props);
+
+const machines = ref<Resource<ClusterMachineStatusSpec>[]>([]);
+const machinesWatch = new Watch(machines);
+const clusterID = computed(() => machineSet.value.metadata.labels?.[LabelCluster] ?? "");
+const editingMachinesCount = ref(false);
+const machineCount = ref(machineSet.value.spec.machine_class?.machine_count ?? 1);
+const scaling = ref(false);
+
+machinesWatch.setup(computed(() => {
+  return {
+    resource: {
+      namespace: DefaultNamespace,
+      type: ClusterMachineStatusType,
+    },
+    runtime: Runtime.Omni,
+    selectors: [
+      `${LabelCluster}=${clusterID.value}`,
+      `${LabelMachineSet}=${machineSet.value.metadata.id!}`
+    ],
+  }
+}));
+
+const router = useRouter();
+
+const openMachineSetDestroy = (machineSet: Resource) => {
+  router.push({
+    query: { modal: "machineSetDestroy", machineSet: machineSet.metadata.id },
+  });
+};
+
+const { canRemoveClusterMachines } = setupClusterPermissions(clusterID);
+
+const canRemoveMachine = computed(() => {
+  if (!canRemoveClusterMachines.value) {
+    return false;
+  }
+
+  // don't allow destroying machines if the machine set is using machine class
+  if (machineSet.value.spec.machine_class?.name) {
+    return false;
+  }
+
+  if (machineSet.value.metadata.labels?.[LabelControlPlaneRole] === undefined) {
+    return true;
+  }
+
+  return machines.value.length > 1;
+});
+
+const canRemoveMachineSet = computed(() => {
+  if (!canRemoveClusterMachines.value) {
+    return false;
+  }
+
+  const deleteProtected = new Set<string>([controlPlaneMachineSetId(clusterID.value), defaultWorkersMachineSetId(clusterID.value)]);
+
+  return !deleteProtected.has(machineSet.value.metadata.id!)
+});
+
+const updateMachineCount = async (allocationType: MachineSetSpecMachineClassAllocationType = MachineSetSpecMachineClassAllocationType.Static) => {
+  scaling.value = true;
+
+  try {
+    await scaleMachineSet(machineSet.value.metadata.id!, machineCount.value, allocationType);
+  } catch (e) {
+    showError(`Failed to Scale Machine Set ${machineSet.value.metadata.id}`, `Error: ${e.message}`);
+  }
+
+  scaling.value = false;
+
+  editingMachinesCount.value = false;
+};
+
+const machineClassMachineCount = computed(() => {
+  if (machineSet.value.spec?.machine_class?.allocation_type === MachineSetSpecMachineClassAllocationType.Unlimited) {
+    return "All Machines";
+  }
+
+  return pluralize('Machine', machineSet.value.spec?.machine_class?.machine_count ?? 0, true)
+});
+</script>
diff --git a/frontend/src/views/cluster/ClusterMachines/MachineSetPhase.vue b/frontend/src/views/cluster/ClusterMachines/MachineSetPhase.vue
new file mode 100644
index 000000000..ea65f87f9
--- /dev/null
+++ b/frontend/src/views/cluster/ClusterMachines/MachineSetPhase.vue
@@ -0,0 +1,105 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div
+    v-bind:style="'color: ' + phaseColor(item)"
+    class="cluster-phase-box"
+  >
+    <t-icon :icon="phaseIcon(item)" class="h-4" />
+    <div class="cluster-phase-name">{{ phaseName(item) || "" }}</div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import TIcon, { IconType } from "@/components/common/Icon/TIcon.vue";
+import { MachineSetPhase, MachineSetStatusSpec } from "@/api/omni/specs/omni.pb";
+import { ResourceTyped } from "@/api/grpc";
+
+const phaseName = (machineset: ResourceTyped<MachineSetStatusSpec>): string => {
+  switch (machineset?.spec.phase) {
+    case MachineSetPhase.ScalingUp:
+      return "Scaling Up";
+    case MachineSetPhase.ScalingDown:
+      return "Scaling Down";
+    case MachineSetPhase.Running:
+      if (machineset?.spec.ready) {
+        return "Running";
+      } else {
+        return "Not Ready";
+      }
+    case MachineSetPhase.Destroying:
+      return "Destroying";
+    case MachineSetPhase.Failed:
+      return "Failed";
+    case MachineSetPhase.Reconfiguring:
+      return "Reconfiguring";
+    default:
+      return "Unknown";
+  }
+};
+
+const phaseIcon = (machineset: ResourceTyped<MachineSetStatusSpec>): IconType => {
+  switch (machineset?.spec.phase) {
+    case MachineSetPhase.ScalingUp:
+    case MachineSetPhase.ScalingDown:
+    case MachineSetPhase.Reconfiguring:
+      return "loading";
+    case MachineSetPhase.Running:
+      if (machineset?.spec.ready) {
+        return "check-in-circle";
+      } else {
+        return "error";
+      }
+    case MachineSetPhase.Destroying:
+      return "delete";
+    case MachineSetPhase.Failed:
+      return "error";
+    default:
+      return "unknown";
+  }
+};
+
+const phaseColor = (machineset): string => {
+  const Y1 = "#FFB200";
+
+  switch (machineset?.spec.phase) {
+    case MachineSetPhase.ScalingUp:
+    case MachineSetPhase.ScalingDown:
+    case MachineSetPhase.Reconfiguring:
+      return Y1;
+    case MachineSetPhase.Running:
+      if (machineset?.spec.ready) {
+        return "#69C297";
+      } else {
+        return "#FF5F2A";
+      }
+    case MachineSetPhase.Failed:
+    case MachineSetPhase.Destroying:
+      return "#FF5F2A";
+    default:
+      return Y1;
+  }
+};
+
+type Props = {
+  item: ResourceTyped<MachineSetStatusSpec>;
+};
+
+defineProps<Props>();
+
+</script>
+
+<style>
+.cluster-phase-box {
+  display: flex;
+  align-items: center;
+}
+
+.cluster-phase-name {
+  margin-left: 5px;
+}
+</style>
diff --git a/frontend/src/views/cluster/ClusterScoped.vue b/frontend/src/views/cluster/ClusterScoped.vue
new file mode 100644
index 000000000..6c14a9b03
--- /dev/null
+++ b/frontend/src/views/cluster/ClusterScoped.vue
@@ -0,0 +1,57 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <component v-if="cluster" :is="inner" :currentCluster="cluster" />
+  <div v-else-if="bootstrapped" class="flex-1 font-sm">
+    <t-alert title="Cluster Not Found" type="error">
+      Cluster {{ route.params.cluster as string }} does not exist.
+    </t-alert>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Component, computed, ref, Ref } from "vue";
+import { ResourceTyped } from "@/api/grpc";
+import { ClusterSpec } from "@/api/omni/specs/omni.pb";
+import Watch from "@/api/watch";
+import { getContext } from "@/context";
+import { Runtime } from "@/api/common/omni.pb";
+import { ClusterType, DefaultNamespace } from "@/api/resources";
+import { useRoute } from "vue-router";
+import TAlert from "@/components/TAlert.vue";
+import { EventType } from "@/api/omni/resources/resources.pb";
+
+const bootstrapped = ref(false);
+const cluster: Ref<ResourceTyped<ClusterSpec> | undefined> = ref();
+
+const watch = new Watch(cluster, message => {
+  if (message.event?.event_type === EventType.BOOTSTRAPPED) {
+    bootstrapped.value = true;
+  }
+});
+
+const route = useRoute();
+const context = getContext(route);
+
+watch.setup(computed(() => {
+  return {
+    runtime: Runtime.Omni,
+    resource: {
+      type: ClusterType,
+      namespace: DefaultNamespace,
+      id: route.params.cluster as string,
+    },
+    context
+  };
+}));
+
+type Props = {
+  inner: Component,
+};
+
+defineProps<Props>();
+</script>
diff --git a/frontend/src/views/cluster/Config/PatchEdit.vue b/frontend/src/views/cluster/Config/PatchEdit.vue
new file mode 100644
index 000000000..d3c508e8e
--- /dev/null
+++ b/frontend/src/views/cluster/Config/PatchEdit.vue
@@ -0,0 +1,622 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex-1 flex flex-col overflow-hidden -mb-6 -mx-6 relative" :style="{width: 'auto'}">
+    <div class="overflow-hidden flex-1 flex flex-col px-6 pb-16">
+      <page-header :title="title" :subtitle="subtitle as string" :notes="notes" />
+      <managed-by-templates-warning :cluster="currentCluster"/>
+      <div v-if="state === State.NotExists" class="flex items-center gap-3 mb-4">
+        <t-input
+          v-model="patchName"
+          title="Name"
+        />
+        <t-input
+          class="flex-1"
+          v-model="patchDescription"
+          title="Description"
+        />
+        <t-select-list
+          @checkedValue="setPatchType"
+          v-if="$route.params.cluster"
+          title="Patch Target"
+          :defaultValue="patchTypeCluster"
+          :values="[patchTypeCluster].concat(machineSetTitles).concat(machines)"
+        />
+        <popper :show="weight < 100 || weight > 900" placement="bottom-start">
+          <t-input type="number"
+            v-model="weight"
+            title="Weight"
+            class="w-28"
+          />
+          <template #content>
+            <div class="rounded bg-naturals-N3 p-2 flex items-center gap-2 text-xs">
+              <t-icon icon="warning" class="w-5 h-5 fill-current text-yellow-Y1"/>
+              Weight should be in range of 100-900.
+            </div>
+          </template>
+        </popper>
+      </div>
+      <div class="font-sm flex-1 overflow-y-hidden rounded bg-naturals-N1 py-3 px-2 mb-7">
+        <div v-if="!ready" class="flex items-center justify-center w-full h-full">
+          <t-spinner class="w-6 h-6"/>
+        </div>
+
+        <CodeEditor
+            v-else
+            v-model:value="config"
+            @editorDidMount="editorDidMount"
+            :options="{ readOnly: !canManageConfigPatches }"
+            :validators="[checkEncryption]"
+        />
+
+      </div>
+    </div>
+    <div
+      class="absolute bg-naturals-N1 border-t border-naturals-N4 h-16 gap-4 flex items-center py-3 px-5 bottom-0 left-0 right-0">
+      <t-button class="secondary" @click="() => $router.push({name: patchListPage })">Back</t-button>
+      <div class="flex-1"/>
+      <t-button type="highlighted" @click="saveConfig" :disabled="!canManageConfigPatches || saving">
+        <t-spinner v-if="saving" class="w-5 h-5"/>
+        <span v-else>
+          Save
+        </span>
+      </t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, onMounted, ref, Ref, watch } from "vue";
+import { useRoute, useRouter } from "vue-router";
+
+import PageHeader from "@/components/common/PageHeader.vue";
+import { Runtime } from "@/api/common/omni.pb";
+import { ResourceService, Resource, ResourceTyped } from "@/api/grpc";
+import { ClusterSpec, ConfigPatchSpec, MachineSetSpec } from "@/api/omni/specs/omni.pb";
+import {
+  ConfigPatchType,
+  ClusterMachineStatusType,
+  DefaultNamespace,
+  LabelCluster,
+  LabelHostname,
+  LabelMachineSet,
+  LabelMachine,
+  LabelClusterMachine,
+  VirtualNamespace,
+  ClusterPermissionsType,
+  ConfigPatchName,
+  ConfigPatchDescription,
+  MachineSetType,
+} from "@/api/resources";
+import { controlPlaneMachineSetId } from "@/methods/cluster";
+import { showError } from "@/notification";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import Watch from "../../../api/watch";
+import TButton from "@/components/common/Button/TButton.vue";
+import TInput from "@/components/common/TInput/TInput.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import TSelectList from "@/components/common/SelectList/TSelectList.vue";
+import Popper from "vue3-popper";
+
+import { Code } from "@/api/google/rpc/code.pb";
+import { EventType, WatchResponse } from "@/api/omni/resources/resources.pb";
+
+import CodeEditor from "@/components/common/CodeEditor/CodeEditor.vue";
+import * as monaco from 'monaco-editor/esm/vs/editor/editor.api';
+import { withRuntime } from "@/api/options";
+import { canManageMachineConfigPatches, canReadMachineConfigPatches } from "@/methods/auth";
+import { machineSetTitle, sortMachineSetIds } from "@/methods/machineset";
+import ManagedByTemplatesWarning from "@/views/cluster/ManagedByTemplatesWarning.vue";
+
+type Props = {
+  currentCluster?: ResourceTyped<ClusterSpec>,
+};
+
+defineProps<Props>();
+
+const route = useRoute();
+
+const bootstrapped = ref(false);
+const patch:Ref<ResourceTyped<ConfigPatchSpec> | undefined> = ref();
+const patchWatch = new Watch(patch, (e: WatchResponse) => {
+  if (e.event?.event_type === EventType.BOOTSTRAPPED) {
+    bootstrapped.value = true;
+  }
+});
+
+const patchListPage = route.params.cluster ? "ClusterConfigPatches" : "MachineConfigPatches";
+const config = ref("");
+
+const weight = ref(0);
+const patchName = ref("User defined patch");
+const patchDescription = ref("");
+
+const patchTypeCluster = "Cluster";
+
+let codeEditor: monaco.editor.IStandaloneCodeEditor | undefined;
+
+const editorDidMount = (editor: monaco.editor.IStandaloneCodeEditor) => {
+  codeEditor = editor;
+};
+
+const nodeIDMap: Record<string, string> = {};
+const machineSetIDMap: Record<string, string> = {};
+const patchToCreate: ResourceTyped<ConfigPatchSpec> = {
+  metadata: {
+    namespace: DefaultNamespace,
+    type: ConfigPatchType,
+    labels: {},
+    annotations: {
+      [ConfigPatchName]: patchName.value,
+    }
+  },
+  spec: {
+    data: "",
+  }
+};
+
+const checkEncryption = (model: monaco.editor.ITextModel, tokens: monaco.Token[]) => {
+  const markers: monaco.editor.IMarkerData[] = [];
+  if (!cluster.value?.spec?.features?.disk_encryption) {
+    return markers;
+  }
+
+  if (tokens.length === 0) {
+    return markers;
+  }
+
+  let offset = 0;
+
+  for (const token of tokens) {
+    const pos = model.getPositionAt(offset);
+    const word = model.getWordAtPosition(pos);
+    offset += token.offset;
+
+    if (token.type !== "type.yaml") {
+      continue;
+    }
+
+    if (word?.word === "systemDiskEncryption") {
+      markers.push({
+        startColumn: word.startColumn,
+        endColumn: word.endColumn,
+        message: "Will have no effect: KMS encryption is enabled.\nKMS encryption config patch always has a higher priority.",
+        severity: monaco.MarkerSeverity.Info,
+        endLineNumber: pos.lineNumber,
+        startLineNumber: pos.lineNumber,
+        tags: [
+          monaco.MarkerTag.Unnecessary
+        ]
+      });
+
+      break;
+    }
+  }
+
+  return markers;
+}
+
+const setPatchType = (value: string) => {
+  const machineID = nodeIDMap[value];
+  const machineSetID = machineSetIDMap[value];
+
+  patchToCreate.metadata.labels = {};
+
+  if (value == patchTypeCluster) {
+    patchToCreate.metadata.labels[LabelMachineSet] = controlPlaneMachineSetId(route.params.cluster as string);
+
+    return;
+  }
+
+  if (machineSetID) {
+    patchToCreate.metadata.labels[LabelMachineSet] = machineSetID;
+
+    return;
+  }
+
+  patchToCreate.metadata.labels[LabelClusterMachine] = machineID;
+};
+
+const machineSets: Ref<ResourceTyped<MachineSetSpec>[]> = ref([]);
+const machineSetsWatch = new Watch(machineSets);
+const machineSetTitles = computed(() => {
+  const sorted = sortMachineSetIds(route.params.cluster as string, machineSets.value.map(value => value.metadata.id!));
+
+  return sorted.map(machineSetId => {
+    const title = machineSetTitle(route.params.cluster as string, machineSetId);
+    machineSetIDMap[title] = machineSetId ?? "";
+    return title
+  });
+});
+
+const clusterMachines = ref([]);
+const machines = computed(() => {
+  return clusterMachines.value.map((item: Resource) => {
+    const name = `Node: ${(item.metadata?.labels ?? {})[LabelHostname] || item.metadata.id}`;
+
+    nodeIDMap[name] = item.metadata.id!;
+
+    return name;
+  });
+});
+
+const clusterMachinesWatch = new Watch(clusterMachines);
+
+const cluster: Ref<Resource | undefined> = ref();
+
+const clusterWatch = new Watch(cluster);
+
+const router = useRouter();
+
+watch(weight, (value: number) => {
+  if (value < 100 || value > 900) {
+    return;
+  }
+
+  let id = route.params.patch as string;
+  const match = /^\d+-(.+)/.exec(id);
+  if (match) {
+    id = match[1];
+  }
+
+  router.replace({ params: { patch: `${value}-${id}` } });
+});
+
+watch(patchName, () => {
+  if (patchName.value) {
+    patchToCreate.metadata.annotations![ConfigPatchName] = patchName.value;
+  } else {
+    delete patchToCreate.metadata.annotations![ConfigPatchName];
+  }
+});
+
+watch(patchDescription, () => {
+  if (patchName.value) {
+    patchToCreate.metadata.annotations![ConfigPatchDescription] = patchDescription.value;
+  } else {
+    delete patchToCreate.metadata.annotations![ConfigPatchDescription];
+  }
+});
+
+const loadPatch = () => {
+  const match = /^(\d+)-.+/.exec(route.params.patch as string);
+
+  if (match) {
+    weight.value = Math.min(
+      999,
+      Math.max(0, parseInt(match[1]))
+    );
+  } else {
+    weight.value = 500;
+  }
+
+  if (patch.value?.spec?.data) {
+    config.value = patch.value.spec.data;
+  }
+}
+
+patchWatch.setup(computed(() => {
+  return {
+    runtime: Runtime.Omni,
+    resource: {
+      namespace: DefaultNamespace,
+      type: ConfigPatchType,
+      id: route.params.patch as string,
+    }
+  }
+}));
+
+const patchWatchOptions = ref();
+
+const updatePatchWatchOptions = () => {
+  patchWatchOptions.value = {
+    runtime: Runtime.Omni,
+    resource: {
+      namespace: DefaultNamespace,
+      type: ConfigPatchType,
+      id: route.params.patch as string,
+    },
+  }
+};
+
+updatePatchWatchOptions();
+watch(() => route.params.patch, updatePatchWatchOptions);
+
+loadPatch();
+watch(patch, loadPatch);
+
+enum State {
+  Unknown = 0,
+  Exists = 1,
+  NotExists = 2
+}
+
+const state = computed(() => {
+  if (!bootstrapped.value) {
+    return State.Unknown;
+  }
+
+  return patch.value ? State.Exists : State.NotExists;
+});
+
+const title = computed(() => {
+  if (!canReadConfigPatches.value) {
+    return "View Patch"
+  }
+
+  if (state.value === State.NotExists) {
+    return "Create Patch";
+  }
+
+  if (state.value === State.Exists) {
+    return "Edit Patch";
+  }
+
+  return "Loading...";
+})
+
+const subtitle = computed(() => {
+  if (state.value === State.Unknown) {
+    return "";
+  }
+
+  return "Patch ID: " + route.params.patch as string;
+});
+
+const notes = computed(() => {
+  if (state.value === State.Exists || state.value === State.NotExists) {
+    return "Note: Patches are applied immediately on creation/modification, and may result in graceful reboots."
+  }
+
+  return "";
+});
+
+patchWatch.setup({
+  runtime: Runtime.Omni,
+  resource: {
+    namespace: DefaultNamespace,
+    type: ConfigPatchType,
+    id: route.params.patch as string,
+  }
+});
+
+if (route.params.cluster) {
+  machineSetsWatch.setup({
+    runtime: Runtime.Omni,
+    resource: {
+      namespace: DefaultNamespace,
+      type: MachineSetType,
+    },
+    selectors: [`${LabelCluster}=${route.params.cluster}`]
+  });
+
+  clusterMachinesWatch.setup({
+    runtime: Runtime.Omni,
+    resource: {
+      namespace: DefaultNamespace,
+      type: ClusterMachineStatusType,
+    },
+    selectors: [`${LabelCluster}=${route.params.cluster}`]
+  });
+
+  clusterWatch.setup({
+    runtime: Runtime.Omni,
+    resource: {
+      namespace: DefaultNamespace,
+      type: ClusterMachineStatusType,
+      id: route.params.cluster as string,
+    },
+  });
+}
+
+const ready = computed(() => {
+  return permissionsLoaded.value && !patchWatch.loading.value;
+});
+
+const saving = ref(false);
+
+const saveConfig = async () => {
+  const create = (state.value === State.NotExists);
+
+  if (codeEditor) {
+    config.value = codeEditor.getValue();
+  }
+
+  let currentPatch: ResourceTyped<ConfigPatchSpec> | undefined = patch.value;
+
+  if (create) {
+    patchToCreate.metadata.id = route.params.patch as string;
+    patchToCreate.spec.data = config.value;
+
+    currentPatch = patchToCreate;
+
+    if (!currentPatch.metadata.labels) {
+        currentPatch.metadata.labels = {};
+    }
+
+    if (route.params.cluster) {
+        currentPatch.metadata.labels[LabelCluster] = route.params.cluster as string;
+    } else if (route.params.machine) {
+        currentPatch.metadata.labels[LabelMachine] = route.params.machine as string;
+    } else {
+      throw new Error("failed to determine the owner of the patch from the URI");
+    }
+  }
+
+  if (!currentPatch) {
+    return;
+  }
+
+  saving.value = true;
+
+  currentPatch.spec.data = config.value;
+
+  try {
+    if (!create) {
+      await ResourceService.Update(currentPatch, undefined, withRuntime(Runtime.Omni));
+    } else {
+      if (weight.value < 100 || weight.value > 900) {
+        throw new Error(
+          "User patch weight must be in range 100-900",
+        );
+      }
+
+      await ResourceService.Create(currentPatch, withRuntime(Runtime.Omni));
+    }
+
+    patch.value = currentPatch
+    router.push({ name: patchListPage })
+  } catch (e) {
+    if (e.code === Code.INVALID_ARGUMENT) {
+      showError(
+          "The Config is Invalid",
+          e.message?.replace("failed to validate: ", ""),
+      );
+    } else {
+      showError(
+          "Failed to Update the Config",
+          e.message,
+      );
+    }
+  } finally {
+    saving.value = false;
+  }
+};
+
+const permissionsLoaded = ref(false);
+const canReadConfigPatches = ref(false);
+const canManageConfigPatches = ref(false);
+
+const updatePermissions = async () => {
+  if (route.params.cluster) {
+    const clusterPermissions = await ResourceService.Get({
+      namespace: VirtualNamespace,
+      type: ClusterPermissionsType,
+      id: route.params.cluster as string,
+    }, withRuntime(Runtime.Omni));
+
+    canReadConfigPatches.value = clusterPermissions?.spec?.can_read_config_patches || false;
+    canManageConfigPatches.value = clusterPermissions?.spec?.can_manage_config_patches || false;
+  } else if (route.params.machine) {
+    canReadConfigPatches.value = canReadMachineConfigPatches.value;
+    canManageConfigPatches.value = canManageMachineConfigPatches.value;
+  } else {
+    throw new Error("failed to determine the owner of the patch from the URI");
+  }
+
+  permissionsLoaded.value = true;
+};
+
+watch(() => route.params,  async () => {
+  await updatePermissions();
+});
+
+onMounted(async () => {
+  await updatePermissions();
+});
+</script>
+
+<style>
+.CodeMirror {
+  font-size: 14px;
+  background-color: #00000000 !important;
+}
+
+.CodeMirror-gutters, .CodeMirror-scrollbar-filler {
+  background-color: #13141C !important;
+}
+
+.CodeMirror * {
+  font-family: "Roboto Mono", "consolas", sans-serif;
+}
+
+.CodeMirror-lint-tooltip * {
+  font-size: 12px;
+  font-family: "Roboto Mono", "consolas", sans-serif;
+}
+
+/* The lint marker gutter */
+.CodeMirror-lint-tooltip {
+  @apply
+    p-4
+    bg-naturals-N3
+    text-naturals-N10
+    rounded-md
+    overflow-hidden
+    drop-shadow
+    fixed
+    whitespace-pre
+    whitespace-pre-wrap;
+
+  z-index: 100;
+  max-width: 600px;
+}
+
+.CodeMirror-lint-markers {
+  width: 16px;
+}
+
+.CodeMirror-lint-mark {
+  background-position: left bottom;
+  background-repeat: repeat-x;
+}
+
+.CodeMirror-lint-mark-warning {
+  @apply bg-yellow-Y1;
+  mask-repeat: no-repeat;
+  mask-image: url('data:image/svg+xml;utf8,<svg viewBox="0 0 24 24" fill="currentCollor" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M11.9999 8.24979C12.4141 8.24979 12.7499 8.58557 12.7499 8.99979V13.9998C12.7499 14.414 12.4141 14.7498 11.9999 14.7498C11.5856 14.7498 11.2499 14.414 11.2499 13.9998V8.99979C11.2499 8.58557 11.5856 8.24979 11.9999 8.24979Z"/><path fill-rule="evenodd" clip-rule="evenodd" d="M11.9999 3.34229C11.2 3.34229 10.2322 3.89118 9.41576 5.3635L3.35577 16.2635C2.59528 17.6351 2.6278 18.717 3.0354 19.4114C3.44259 20.1051 4.36961 20.6598 5.93985 20.6598H11.9999C12.0417 20.6598 12.0827 20.6632 12.1226 20.6698H18.0599C19.6243 20.6698 20.5522 20.1155 20.9609 19.4208C21.3697 18.7258 21.4039 17.644 20.6439 16.2735L14.5843 5.36412C13.7679 3.8918 12.7997 3.34229 11.9999 3.34229ZM11.8771 22.1598H5.93985C4.04009 22.1598 2.50711 21.4745 1.7418 20.1707C0.976903 18.8676 1.12442 17.1945 2.04393 15.5361L8.10394 4.63607C9.0675 2.89878 10.4499 1.84229 11.9999 1.84229C13.5498 1.84229 14.9319 2.89814 15.8954 4.63545L21.9556 15.5458C22.8757 17.2052 23.02 18.8787 22.2538 20.1813C21.4875 21.4841 19.9554 22.1698 18.0599 22.1698H11.9999C11.958 22.1698 11.917 22.1664 11.8771 22.1598Z"/><path fill-rule="evenodd" clip-rule="evenodd" d="M10.9944 16.9998C10.9944 16.4475 11.4421 15.9998 11.9944 15.9998H12.0033C12.5556 15.9998 13.0033 16.4475 13.0033 16.9998C13.0033 17.5521 12.5556 17.9998 12.0033 17.9998H11.9944C11.4421 17.9998 10.9944 17.5521 10.9944 16.9998Z" /></svg>');
+}
+
+.CodeMirror-lint-mark-error {
+  @apply bg-red-R1;
+  mask-repeat: no-repeat;
+  mask-image: url('data:image/svg+xml;utf8,<svg width="15" height="15" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M1.25 12C1.25 6.08579 6.08579 1.25 12 1.25C17.9142 1.25 22.75 6.08579 22.75 12C22.75 17.9142 17.9142 22.75 12 22.75C6.08579 22.75 1.25 17.9142 1.25 12ZM12 2.75C6.91421 2.75 2.75 6.91421 2.75 12C2.75 17.0858 6.91421 21.25 12 21.25C17.0858 21.25 21.25 17.0858 21.25 12C21.25 6.91421 17.0858 2.75 12 2.75Z"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.3603 8.63967C15.6532 8.93256 15.6532 9.40744 15.3603 9.70033L9.70033 15.3603C9.40744 15.6532 8.93256 15.6532 8.63967 15.3603C8.34678 15.0674 8.34678 14.5926 8.63967 14.2997L14.2997 8.63967C14.5926 8.34678 15.0674 8.34678 15.3603 8.63967Z" /> <path fill-rule="evenodd" clip-rule="evenodd" d="M8.63967 8.63967C8.93256 8.34678 9.40744 8.34678 9.70033 8.63967L15.3603 14.2997C15.6532 14.5926 15.6532 15.0674 15.3603 15.3603C15.0674 15.6532 14.5926 15.6532 14.2997 15.3603L8.63967 9.70033C8.34678 9.40744 8.34678 8.93256 8.63967 8.63967Z"/></svg>');
+}
+
+.CodeMirror-lint-marker {
+  background-position: center center;
+  background-repeat: no-repeat;
+  cursor: pointer;
+  display: inline-block;
+  height: 16px;
+  width: 16px;
+  vertical-align: middle;
+  position: relative;
+}
+
+.CodeMirror-lint-message {
+  background-position: top left;
+  background-repeat: no-repeat;
+}
+
+.CodeMirror-lint-marker-warning {
+  @apply bg-yellow-Y1;
+  mask-repeat: no-repeat;
+  mask-image: url('data:image/svg+xml;utf8,<svg viewBox="0 0 24 24" fill="currentCollor" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M11.9999 8.24979C12.4141 8.24979 12.7499 8.58557 12.7499 8.99979V13.9998C12.7499 14.414 12.4141 14.7498 11.9999 14.7498C11.5856 14.7498 11.2499 14.414 11.2499 13.9998V8.99979C11.2499 8.58557 11.5856 8.24979 11.9999 8.24979Z"/><path fill-rule="evenodd" clip-rule="evenodd" d="M11.9999 3.34229C11.2 3.34229 10.2322 3.89118 9.41576 5.3635L3.35577 16.2635C2.59528 17.6351 2.6278 18.717 3.0354 19.4114C3.44259 20.1051 4.36961 20.6598 5.93985 20.6598H11.9999C12.0417 20.6598 12.0827 20.6632 12.1226 20.6698H18.0599C19.6243 20.6698 20.5522 20.1155 20.9609 19.4208C21.3697 18.7258 21.4039 17.644 20.6439 16.2735L14.5843 5.36412C13.7679 3.8918 12.7997 3.34229 11.9999 3.34229ZM11.8771 22.1598H5.93985C4.04009 22.1598 2.50711 21.4745 1.7418 20.1707C0.976903 18.8676 1.12442 17.1945 2.04393 15.5361L8.10394 4.63607C9.0675 2.89878 10.4499 1.84229 11.9999 1.84229C13.5498 1.84229 14.9319 2.89814 15.8954 4.63545L21.9556 15.5458C22.8757 17.2052 23.02 18.8787 22.2538 20.1813C21.4875 21.4841 19.9554 22.1698 18.0599 22.1698H11.9999C11.958 22.1698 11.917 22.1664 11.8771 22.1598Z"/><path fill-rule="evenodd" clip-rule="evenodd" d="M10.9944 16.9998C10.9944 16.4475 11.4421 15.9998 11.9944 15.9998H12.0033C12.5556 15.9998 13.0033 16.4475 13.0033 16.9998C13.0033 17.5521 12.5556 17.9998 12.0033 17.9998H11.9944C11.4421 17.9998 10.9944 17.5521 10.9944 16.9998Z" /></svg>');
+}
+
+.CodeMirror-lint-marker-error {
+  @apply bg-red-R1;
+  mask-repeat: no-repeat;
+  mask-image: url('data:image/svg+xml;utf8,<svg width="15" height="15" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M1.25 12C1.25 6.08579 6.08579 1.25 12 1.25C17.9142 1.25 22.75 6.08579 22.75 12C22.75 17.9142 17.9142 22.75 12 22.75C6.08579 22.75 1.25 17.9142 1.25 12ZM12 2.75C6.91421 2.75 2.75 6.91421 2.75 12C2.75 17.0858 6.91421 21.25 12 21.25C17.0858 21.25 21.25 17.0858 21.25 12C21.25 6.91421 17.0858 2.75 12 2.75Z"/><path fill-rule="evenodd" clip-rule="evenodd" d="M15.3603 8.63967C15.6532 8.93256 15.6532 9.40744 15.3603 9.70033L9.70033 15.3603C9.40744 15.6532 8.93256 15.6532 8.63967 15.3603C8.34678 15.0674 8.34678 14.5926 8.63967 14.2997L14.2997 8.63967C14.5926 8.34678 15.0674 8.34678 15.3603 8.63967Z" /> <path fill-rule="evenodd" clip-rule="evenodd" d="M8.63967 8.63967C8.93256 8.34678 9.40744 8.34678 9.70033 8.63967L15.3603 14.2997C15.6532 14.5926 15.6532 15.0674 15.3603 15.3603C15.0674 15.6532 14.5926 15.6532 14.2997 15.3603L8.63967 9.70033C8.34678 9.40744 8.34678 8.93256 8.63967 8.63967Z"/></svg>');
+}
+
+.CodeMirror-lint-marker-multiple {
+  background-image: url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAcAAAAHCAMAAADzjKfhAAAACVBMVEUAAAAAAAC/v7914kyHAAAAAXRSTlMAQObYZgAAACNJREFUeNo1ioEJAAAIwmz/H90iFFSGJgFMe3gaLZ0od+9/AQZ0ADosbYraAAAAAElFTkSuQmCC");
+  background-repeat: no-repeat;
+  background-position: right bottom;
+  width: 100%; height: 100%;
+}
+
+.CodeMirror-lint-line-error {
+  background-color: rgba(183, 76, 81, 0.08);
+}
+
+.CodeMirror-lint-line-warning {
+  background-color: rgba(255, 211, 0, 0.1);
+}
+</style>
diff --git a/frontend/src/views/cluster/Config/Patches.vue b/frontend/src/views/cluster/Config/Patches.vue
new file mode 100644
index 000000000..d3de5e3ae
--- /dev/null
+++ b/frontend/src/views/cluster/Config/Patches.vue
@@ -0,0 +1,312 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col gap-2 overflow-y-auto">
+    <div class="flex items-start">
+      <page-header class="flex-1" :title="title"/>
+      <t-button type="highlighted" @click="openPatchCreate" :disabled="!canManageConfigPatches">Create Patch</t-button>
+    </div>
+    <managed-by-templates-warning :cluster="currentCluster"/>
+    <t-input
+      secondary
+      placeholder="Search..."
+      v-model="filter"
+    />
+    <div class="flex-1 font-sm">
+      <div v-if="loading" class="w-full h-full flex items-center justify-center">
+        <t-spinner class="w-6 h-6"/>
+      </div>
+      <t-alert v-else-if="patches.length === 0"
+        title="No Config Patches"
+        type="info"
+      >
+        There are no config patches {{
+          $route.params.machine ? `associated with machine ${$route.params.machine}` :
+            $route.params.cluster ? `associated with cluster ${$route.params.cluster}` : `on the account`}}
+      </t-alert>
+      <disclosure v-else as="div" :defaultOpen="true" v-for="group in routes" :key="group.name">
+        <template v-slot="{ open }">
+          <disclosure-button as="div" class="disclosure">
+            <t-icon icon="arrow-up" class="w-4 h-4 absolute top-0 bottom-0 m-auto right-4" :class="{'rotate-180': open}"/>
+            <div class="grid grid-cols-4">
+              <word-highlighter :text-to-highlight="group.name" :query="filter" highlight-class="bg-naturals-N14"/>
+              <div>ID</div>
+              <div class="col-span-2">Description</div>
+            </div>
+          </disclosure-button>
+          <disclosure-panel>
+            <div v-for="item in group.items" :key="item.name"
+            @click.self="() => $router.push(item.route)"
+            class="grid grid-cols-4 relative items-center gap-2 w-full text-xs px-4 py-2 my-2 cursor-pointer hover:text-naturals-N12 hover:bg-naturals-N3 transition-colors duration-200">
+              <icon-button @click="() => { $router.push({ query: { modal: 'configPatchDestroy', id: item.id } }); }" :disabled="!canManageConfigPatches" icon="delete" class="w-4 h-4 absolute top-0 bottom-0 m-auto right-3"/>
+              <div class="pointer-events-none flex items-center gap-4">
+                <document-icon class="w-4 h-4"/>
+                <word-highlighter :text-to-highlight="item.name" :query="filter" highlight-class="bg-naturals-N14"/>
+              </div>
+              <word-highlighter :text-to-highlight="item.id" :query="filter" highlight-class="pointer-events-none bg-naturals-N14"/>
+              <div class="pointer-events-none col-span-2 truncate">
+                {{ item.description }}
+              </div>
+            </div>
+          </disclosure-panel>
+        </template>
+      </disclosure>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import {
+  ConfigPatchType,
+  ClusterMachineStatusType,
+  DefaultNamespace,
+  LabelCluster,
+  LabelMachineSet,
+  LabelClusterMachine,
+  LabelMachine,
+  LabelHostname,
+  VirtualNamespace,
+  ClusterPermissionsType,
+  ConfigPatchDescription,
+  ConfigPatchName,
+} from "@/api/resources";
+import { Resource, ResourceService, ResourceTyped } from "@/api/grpc";
+import { RouteLocationRaw, useRoute, useRouter } from "vue-router";
+import { ref, computed, Ref, watch, onMounted } from "vue";
+import { v4 as uuidv4 } from "uuid";
+import { ClusterSpec, ConfigPatchSpec } from "@/api/omni/specs/omni.pb";
+import Watch from "@/api/watch";
+
+import TAlert from "@/components/TAlert.vue";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import { Disclosure, DisclosureButton, DisclosurePanel } from "@headlessui/vue";
+import PageHeader from "@/components/common/PageHeader.vue";
+import TInput from "@/components/common/TInput/TInput.vue";
+import { DocumentIcon } from "@heroicons/vue/24/solid";
+import WordHighlighter from "vue-word-highlighter";
+import IconButton from "@/components/common/Button/IconButton.vue";
+import { Runtime } from "@/api/common/omni.pb";
+import { LabelSystemPatch } from "@/api/resources";
+import { withRuntime } from "@/api/options";
+import { canManageMachineConfigPatches, canReadMachineConfigPatches } from "@/methods/auth";
+import { controlPlaneTitle, machineSetTitle, defaultWorkersTitle, workersTitlePrefix } from "@/methods/machineset";
+import ManagedByTemplatesWarning from "@/views/cluster/ManagedByTemplatesWarning.vue";
+
+const route = useRoute();
+const router = useRouter();
+const filter = ref("");
+const patchListSelectors:Ref<string[]> = ref([]);
+const machineStatuses: Ref<Resource[]> = ref([]);
+const machineStatusesWatch = new Watch(machineStatuses);
+
+type Props = {
+  currentCluster?: ResourceTyped<ClusterSpec>,
+};
+
+const props = defineProps<Props>();
+
+  console.log("PATCHES currentCluster", props.currentCluster);
+
+
+const updateSelectors = () => {
+  patchListSelectors.value = [`!${LabelSystemPatch}`];
+
+  if (route.params.cluster) {
+    patchListSelectors.value.push(`${LabelCluster}=${route.params.cluster}`);
+  } else if (route.params.machine) {
+    patchListSelectors.value.push(`${LabelMachine}=${route.params.machine}`);
+  }
+}
+
+watch(() => route.params, updateSelectors);
+
+const patches: Ref<ResourceTyped<ConfigPatchSpec>[]> = ref([]);
+const patchesWatch = new Watch(patches);
+const loading = computed(() => {
+  return patchesWatch.loading.value || machineStatusesWatch.loading.value;
+});
+
+updateSelectors();
+
+patchesWatch.setup(computed(() => {
+  return {
+    runtime: Runtime.Omni,
+    resource: { type: ConfigPatchType, namespace: DefaultNamespace },
+    selectors: patchListSelectors.value
+  }
+}));
+
+machineStatusesWatch.setup({
+    runtime: Runtime.Omni,
+    resource: { type: ClusterMachineStatusType, namespace: DefaultNamespace }
+});
+
+const includes = (filter: string, values: string[]) => {
+  for (const value of values) {
+    if (!value) {
+      continue;
+    }
+
+    if (value.indexOf(filter) !== -1) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+type item = {name: string, route: RouteLocationRaw, id: string, description?: string};
+
+const openPatchCreate = () => {
+  router.push({
+    name: route.params.cluster ? "ClusterPatchEdit" : "MachinePatchEdit",
+    params: {
+      patch: `500-${uuidv4()}`,
+    }
+  })
+};
+
+const title = computed(() => {
+  if (route.params.cluster) {
+    return `Cluster ${route.params.cluster} Config Patches`;
+  } else if (route.params.machine) {
+    return `Machine ${route.params.machine} Config Patches`;
+  }
+
+  return '';
+});
+
+const patchTypeCluster = "Cluster";
+
+const routes = computed(() => {
+  const hostnames: Record<string, string> = {};
+
+  machineStatuses.value.forEach((item: Resource) => {
+    hostnames[item.metadata.id!] = item.metadata.labels![LabelHostname];
+  });
+
+  const groups: Record<string, item[]> = {};
+
+  const addToGroup = (name: string, r: item) => {
+    groups[name] = (groups[name] ?? []).concat([r]);
+  }
+
+  patches.value.forEach((item: Resource) => {
+    const searchValues: string[] = [
+      item.metadata.id!,
+      (item.metadata.annotations || {})[ConfigPatchName],
+      hostnames[(item.metadata.labels || {})[LabelClusterMachine]],
+    ];
+
+    if (filter.value != "" && !includes(filter.value, searchValues)) {
+      return;
+    }
+
+    const r = {
+      name: (item.metadata.annotations || {})[ConfigPatchName] || item.metadata.id!,
+      icon: "document",
+      route: { name: route.params.machine ? "MachinePatchEdit" : "ClusterPatchEdit", params: { patch: item.metadata.id! } },
+      id: item.metadata.id!,
+      description: item.metadata.annotations?.[ConfigPatchDescription],
+    };
+
+    const labels = item.metadata.labels || {};
+    const machineID = labels[LabelMachine];
+    if (machineID) {
+      addToGroup(`Machine: ${machineID}`, r);
+    } else if (labels[LabelClusterMachine]) {
+      const id = labels[LabelClusterMachine];
+      addToGroup(`Cluster Machine: ${hostnames[id] || id}`, r);
+    } else if (labels[LabelMachineSet]) {
+      const id = labels[LabelMachineSet];
+
+      const title = machineSetTitle(route.params.cluster as string, id);
+
+      addToGroup(`${title}`, r);
+    } else if (labels[LabelCluster]) {
+      addToGroup(`${patchTypeCluster}: ${labels[LabelCluster]}`, r);
+    }
+  });
+
+  const result: {name: string, items: item[]}[] = [];
+  for (const key in groups) {
+    result.push({name: key, items: groups[key]});
+  }
+
+  const clusterPrefix = `${patchTypeCluster}: `;
+
+  const categoryIndex = (name: string) => {
+    if (name.startsWith(clusterPrefix)) {
+      return 0;
+    }
+
+    if (name === controlPlaneTitle) {
+      return 1;
+    }
+
+    if (name === defaultWorkersTitle) {
+      return 2;
+    }
+
+    if (name.startsWith(workersTitlePrefix)) {
+      return 3;
+    }
+
+    return 4;
+  }
+
+  result.sort((a, b): number => {
+    const categoryA = categoryIndex(a.name);
+    const categoryB = categoryIndex(b.name);
+
+    if (categoryA !== categoryB) {
+      return categoryA - categoryB;
+    }
+
+    return a.name.localeCompare(b.name);
+  });
+
+  return result;
+});
+
+const canReadConfigPatches = ref(false);
+const canManageConfigPatches = ref(false);
+
+const updatePermissions = async () => {
+  if (route.params.cluster) {
+    const clusterPermissions = await ResourceService.Get({
+      namespace: VirtualNamespace,
+      type: ClusterPermissionsType,
+      id: route.params.cluster as string,
+    }, withRuntime(Runtime.Omni))
+
+    canReadConfigPatches.value = clusterPermissions?.spec?.can_read_config_patches || false;
+    canManageConfigPatches.value = clusterPermissions?.spec?.can_manage_config_patches || false;
+  } else if (route.params.machine) {
+    canReadConfigPatches.value = canReadMachineConfigPatches.value;
+    canManageConfigPatches.value = canManageMachineConfigPatches.value;
+  }else {
+    throw new Error("failed to determine the owner of the patch from the URI");
+  }
+};
+
+watch(() => route.params,  async () => {
+  await updatePermissions();
+});
+
+onMounted(async () => {
+  await updatePermissions();
+});
+</script>
+
+<style scoped>
+.disclosure {
+  @apply relative text-xs text-naturals-N11 bg-naturals-N1 font-bold py-3 px-4 cursor-pointer hover:text-naturals-N14 transition-colors duration-200 select-none;
+}
+</style>
diff --git a/frontend/src/views/cluster/ExposedService/ExposedService.vue b/frontend/src/views/cluster/ExposedService/ExposedService.vue
new file mode 100644
index 000000000..f39b36852
--- /dev/null
+++ b/frontend/src/views/cluster/ExposedService/ExposedService.vue
@@ -0,0 +1,65 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <iframe
+    :src="exposedServiceUrl"
+    class="w-full h-full"
+  />
+</template>
+
+<script setup lang="ts">
+import { RouteLocationRaw, useRoute, useRouter } from "vue-router";
+import { ResourceService, ResourceTyped } from "@/api/grpc";
+import { ExposedServiceSpec } from "@/api/omni/specs/omni.pb";
+import {
+  DefaultNamespace,
+  ExposedServiceType,
+  LabelCluster,
+  LabelExposedServiceAlias,
+  workloadProxyHostPrefix
+} from "@/api/resources";
+import { computed, onMounted, ref, Ref, watch } from "vue";
+import { withRuntime, withSelectors } from "@/api/options";
+import { Runtime } from "@/api/common/omni.pb";
+import { checkAuthorized } from "@/router";
+
+const router = useRouter();
+const route = useRoute();
+
+const exposedService: Ref<ResourceTyped<ExposedServiceSpec> | undefined> = ref();
+
+const exposedServiceUrl = computed(() => {
+  if (!exposedService.value) {
+    return "";
+  }
+
+  const alias = exposedService.value?.metadata.labels?.[LabelExposedServiceAlias];
+
+  return `${window.location.protocol}//${workloadProxyHostPrefix}-${alias}-${window.location.hostname}`
+})
+
+const reloadExposedService = async () => {
+  const destRoute = await checkAuthorized(route, true);
+  if (destRoute !== true) {
+    await router.replace(destRoute as RouteLocationRaw)
+  }
+
+  const list = await ResourceService.List({
+    type: ExposedServiceType,
+    namespace: DefaultNamespace,
+  }, withSelectors([
+    `${LabelCluster}=${route.params.cluster}`,
+    `${LabelExposedServiceAlias}=${route.params.service}`
+  ]), withRuntime(Runtime.Omni));
+
+  exposedService.value = list.length > 0 ? list[0] : undefined;
+}
+
+watch([() => route.params.cluster, () => route.params.service], reloadExposedService);
+
+onMounted(reloadExposedService)
+</script>
diff --git a/frontend/src/views/cluster/ExposedService/ExposedServiceSideBar.vue b/frontend/src/views/cluster/ExposedService/ExposedServiceSideBar.vue
new file mode 100644
index 000000000..281a8132b
--- /dev/null
+++ b/frontend/src/views/cluster/ExposedService/ExposedServiceSideBar.vue
@@ -0,0 +1,96 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <disclosure as="div" class="border-t border-naturals-N4" :defaultOpen="true">
+    <template v-slot="{ open }">
+      <disclosure-button as="div" class="disclosure">
+        <div class="title">
+          <p class="title__name truncate">Exposed Services</p>
+          <t-icon icon="arrow-up" class="title__icon" :class="{'rotate-180': open}"/>
+        </div>
+      </disclosure-button>
+      <disclosure-panel>
+        <template v-if="exposedServices.length > 0">
+          <t-menu-item
+              v-for="service in exposedServices"
+              :key="service.metadata.id"
+              :route="'/cluster/' + route.params.cluster +  '/services/' + service.metadata.labels?.[LabelExposedServiceAlias]"
+              :name="service.spec.label"
+              :icon-svg-base64="service.spec.icon_base64"
+              icon="exposed-service"
+          />
+        </template>
+        <template v-else>
+          <p class="text-xs text-naturals-N7 justify-start items-center py-1.5 my-1 px-6">No exposed services</p>
+        </template>
+      </disclosure-panel>
+    </template>
+  </disclosure>
+</template>
+
+<script setup lang="ts">
+import { ref, Ref } from "vue";
+import { useRoute } from "vue-router";
+
+import { ResourceTyped } from "@/api/grpc";
+import Watch from "@/api/watch";
+import { ExposedServiceSpec } from "@/api/omni/specs/omni.pb";
+import { DefaultNamespace, LabelCluster, ExposedServiceType, LabelExposedServiceAlias } from "@/api/resources";
+import { Runtime } from "@/api/common/omni.pb";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import { Disclosure, DisclosureButton, DisclosurePanel } from "@headlessui/vue";
+import TMenuItem from "@/components/common/MenuItem/TMenuItem.vue";
+
+const route = useRoute();
+
+const exposedServices: Ref<ResourceTyped<ExposedServiceSpec>[]> = ref([]);
+const exposedServicesWatch = new Watch(exposedServices);
+exposedServicesWatch.setup({
+  runtime: Runtime.Omni,
+  resource: {
+    namespace: DefaultNamespace,
+    type: ExposedServiceType,
+  },
+  selectors: [`${LabelCluster}=${route.params.cluster}`]
+});
+</script>
+
+<style scoped>
+.title {
+  @apply flex gap-4 border-l-2 border-transparent justify-start items-center py-1.5 my-1 px-6 transition-all duration-200 hover:bg-naturals-N4;
+}
+
+.title:hover .title__icon {
+  @apply text-naturals-N12;
+}
+
+.title:hover .title__name {
+  @apply text-naturals-N12;
+}
+
+.title__active .title {
+  @apply border-primary-P3;
+}
+
+.title__active .title__icon {
+  @apply text-naturals-N10;
+}
+
+.title__active .title__name {
+  @apply text-naturals-N10;
+}
+
+.title__icon {
+  @apply text-naturals-N10 transition-all duration-200;
+  width: 16px;
+  height: 16px;
+}
+
+.title__name {
+  @apply text-xs text-naturals-N10 transition-all duration-200 flex-1;
+}
+</style>
diff --git a/frontend/src/views/cluster/ManagedByTemplatesWarning.vue b/frontend/src/views/cluster/ManagedByTemplatesWarning.vue
new file mode 100644
index 000000000..0a1039a90
--- /dev/null
+++ b/frontend/src/views/cluster/ManagedByTemplatesWarning.vue
@@ -0,0 +1,71 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <template v-if="clusterIsManagedByTemplates">
+    <div v-if="warningStyle === 'alert'" class="pb-5">
+      <t-alert type="warn" title="This cluster is managed using cluster templates.">
+        It is recommended to manage it using its template and not through this UI.
+      </t-alert>
+    </div>
+    <div v-else-if="warningStyle == 'popup'" class="text-xs pb-5">
+      <p class="text-primary-P3 py-2">This cluster is managed using cluster templates.</p>
+      <p class="text-primary-P3 py-2 font-bold">It is recommended to manage it using its template and not through this UI.</p>
+    </div>
+    <div v-else class="text-xs">
+      <p class="text-primary-P3 py-2">Managed using cluster templates</p>
+    </div>
+  </template>
+</template>
+
+<script setup lang="ts">
+import { useRoute } from "vue-router";
+import { computed, ref, Ref } from "vue";
+import { Resource, ResourceTyped } from "@/api/grpc";
+import { ClusterSpec } from "@/api/omni/specs/omni.pb";
+import Watch from "@/api/watch";
+import { ClusterType, DefaultNamespace, ResourceManagedByClusterTemplates } from "@/api/resources";
+import { Runtime } from "@/api/common/omni.pb";
+import TAlert from "@/components/TAlert.vue";
+
+export type WarningStyle = "alert" | "popup" | "short";
+
+type Props = {
+  cluster?: Resource<ClusterSpec>,
+  warningStyle?: WarningStyle,
+};
+
+const props = withDefaults(defineProps<Props>(), {
+  warningStyle: "alert",
+});
+
+const cluster: Ref<ResourceTyped<ClusterSpec> | undefined> = ref(props.cluster);
+
+// If the cluster is not passed explicitly, watch it from the route, if cluster exists in the route params.
+if (!props.cluster) {
+  const route = useRoute();
+  const clusterWatch = new Watch(cluster);
+
+  clusterWatch.setup(computed(() => {
+    if (!route.params.cluster) {
+      return undefined;
+    }
+
+    return {
+      resource: {
+        type: ClusterType,
+        namespace: DefaultNamespace,
+        id: route.params.cluster as string,
+      },
+      runtime: Runtime.Omni,
+    };
+  }));
+}
+
+const clusterIsManagedByTemplates = computed(() => {
+  return cluster.value?.metadata?.annotations?.[ResourceManagedByClusterTemplates] !== undefined;
+});
+</script>
diff --git a/frontend/src/views/cluster/Manifest/Sync.vue b/frontend/src/views/cluster/Manifest/Sync.vue
new file mode 100644
index 000000000..0688e8bad
--- /dev/null
+++ b/frontend/src/views/cluster/Manifest/Sync.vue
@@ -0,0 +1,267 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col gap-2">
+    <div class="flex items-start">
+      <page-header class="flex-1" :title="title" />
+      <t-button
+        type="highlighted"
+        @click="applyChanges"
+        :disabled="applyChangesDisabled"
+        >Apply Changes ({{ numChanges }})</t-button
+      >
+    </div>
+    <div class="flex-1 font-sm overflow-y-auto" ref="resultsComponent">
+      <div
+        v-if="loading"
+        class="w-full h-full flex items-center justify-center"
+      >
+        <t-spinner class="w-6 h-6" />
+      </div>
+      <t-list-item
+        v-for="item in syncResults"
+        :key="itemID(item)"
+        :isDefaultOpened="itemImportant(item)"
+      >
+        <template #default>
+          <span class="label">
+            {{ itemLabel(item) }}
+          </span>
+          <span
+            :class="{
+              'text-primary-P3': item.diff && syncParams.dry_run && item.response_type !== KubernetesSyncManifestResponseResponseType.UNKNOWN,
+              'text-green-G1': item.diff && !syncParams.dry_run && item.response_type !== KubernetesSyncManifestResponseResponseType.UNKNOWN,
+              'text-red-R1': item.response_type === KubernetesSyncManifestResponseResponseType.UNKNOWN,
+            }"
+            >{{ item.path }}</span
+          >
+          <span v-if="!item.diff" class="text-naturals-N9"> (No changes) </span>
+          <span v-if="item.diff && !syncParams.dry_run" class="text-green-G1">
+            (Updated)
+          </span>
+        </template>
+        <template
+          #details
+          v-if="
+          [KubernetesSyncManifestResponseResponseType.MANIFEST, KubernetesSyncManifestResponseResponseType.UNKNOWN].includes(item.response_type!)
+          "
+        >
+          <div class="diff bottom-line" v-if="item.diff">
+            <div
+              v-for="diff in item.diff.split('\n')"
+              :key="diff"
+              :class="highlightDiff(diff)"
+            >
+              {{ diff }}
+            </div>
+          </div>
+          <div class="diff" v-if="item.object">
+            {{
+              Buffer.from(item.object as unknown as string, "base64").toString(
+                "utf8"
+              )
+            }}
+          </div>
+        </template>
+      </t-list-item>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import {
+  computed,
+  ref,
+  Ref,
+  onMounted,
+  onUnmounted,
+  nextTick,
+  watch,
+} from "vue";
+import { useRoute } from "vue-router";
+import { Buffer } from "buffer";
+
+import PageHeader from "@/components/common/PageHeader.vue";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import TListItem from "@/components/common/List/TListItem.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import { showSuccess } from "@/notification";
+
+import {
+  KubernetesSyncManifestRequest,
+  KubernetesSyncManifestResponse,
+  ManagementService,
+  KubernetesSyncManifestResponseResponseType,
+} from "@/api/omni/management/management.pb";
+import { subscribe, Stream } from "@/api/grpc";
+import { withContext, withRuntime } from "@/api/options";
+import { Runtime } from "@/api/common/omni.pb";
+import { getContext } from "@/context";
+
+const route = useRoute();
+const context = getContext();
+
+const loading = ref(true);
+const loaded = ref(false);
+
+const resultsComponent: Ref<HTMLDivElement | undefined> = ref();
+
+const title = computed(() => {
+  return `Bootstrap Manifest Sync for ${route.params.cluster}`;
+});
+
+const syncParams: Ref<KubernetesSyncManifestRequest> = ref({
+  dry_run: true,
+});
+
+const applyChangesDisabled = computed(() => {
+  return (
+    !loaded.value ||
+    loading.value ||
+    !syncParams.value.dry_run ||
+    numChanges.value === 0
+  );
+});
+
+const numChanges = computed(() => {
+  return syncResults.value.filter(
+    (item) => item.diff !== undefined && item.diff !== ""
+  ).length;
+});
+
+const applyChanges = () => {
+  syncParams.value.dry_run = false;
+};
+
+const syncResults: Ref<KubernetesSyncManifestResponse[]> = ref([]);
+
+const itemID = (item: KubernetesSyncManifestResponse) => {
+  return `${item.response_type}-${item.path}`;
+};
+
+const itemImportant = (item: KubernetesSyncManifestResponse) => {
+  return (
+    item.response_type === KubernetesSyncManifestResponseResponseType.UNKNOWN ||
+    (item.response_type ===
+      KubernetesSyncManifestResponseResponseType.MANIFEST &&
+      item.diff !== undefined &&
+      item.diff !== "" &&
+      syncParams.value.dry_run)
+  );
+};
+
+const itemLabel = (item: KubernetesSyncManifestResponse) => {
+  switch (item.response_type) {
+    case KubernetesSyncManifestResponseResponseType.UNKNOWN:
+      return "ERROR";
+    case KubernetesSyncManifestResponseResponseType.MANIFEST:
+      return "Manifest";
+    case KubernetesSyncManifestResponseResponseType.ROLLOUT:
+      return "Rollout";
+    default:
+      return "Unknown";
+  }
+}
+
+const highlightDiff = (line: string) => {
+  if (line.startsWith("@@")) {
+    return "text-talos-gray-500";
+  }
+
+  if (line.startsWith("- ")) {
+    return "text-red-500";
+  }
+
+  if (line.startsWith("+ ")) {
+    return "text-green-500";
+  }
+
+  return "";
+};
+
+const setupSyncStream = () => {
+  const stream: Ref<
+    | Stream<KubernetesSyncManifestRequest, KubernetesSyncManifestResponse>
+    | undefined
+  > = ref();
+
+  const reset = () => {
+    syncResults.value = [];
+    loaded.value = false;
+  };
+
+  const processItem = (resp: KubernetesSyncManifestResponse) => {
+    loading.value = false;
+
+    syncResults.value = syncResults.value.concat(resp);
+
+    nextTick(() => {
+      if (resultsComponent.value && !loaded.value) {
+        // scroll to the bottom
+        resultsComponent.value.scrollTop = resultsComponent.value.scrollHeight;
+      }
+    });
+  };
+
+  const init = () => {
+    if (stream.value) {
+      stream.value.shutdown();
+      loading.value = true;
+    }
+
+    reset();
+
+    stream.value = subscribe(
+      ManagementService.KubernetesSyncManifests,
+      syncParams.value,
+      processItem,
+      [withRuntime(Runtime.Talos), withContext(context)],
+      undefined,
+      (e: Error) => {
+        processItem({
+          response_type: KubernetesSyncManifestResponseResponseType.UNKNOWN,
+          path: "Manifest Sync Error",
+          diff: e.message,
+        });
+      },
+      () => {
+        loaded.value = true;
+
+        if (!syncParams.value.dry_run) {
+          showSuccess("Bootstrap manifests updated successfully");
+        }
+      }
+    );
+  };
+
+  onMounted(init);
+
+  onUnmounted(() => {
+    if (stream.value) stream.value.shutdown();
+  });
+
+  watch(syncParams.value, init);
+
+  return stream;
+};
+
+setupSyncStream();
+</script>
+
+<style scoped>
+.diff {
+  @apply font-roboto whitespace-pre p-4;
+}
+
+.bottom-line {
+  border-bottom: 1px solid rgba(39, 41, 50);
+  border-radius: 4px 4px 0 0;
+}
+.label {
+  @apply uppercase font-bold text-xs bg-naturals-N3 text-naturals-N9 px-2 py-1 rounded-full mr-2;
+}
+</style>
diff --git a/frontend/src/views/cluster/Nodes/NodeConfig.vue b/frontend/src/views/cluster/Nodes/NodeConfig.vue
new file mode 100644
index 000000000..6eddce738
--- /dev/null
+++ b/frontend/src/views/cluster/Nodes/NodeConfig.vue
@@ -0,0 +1,51 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <CodeEditor v-model:value="config" :options="{ readOnly: true }" />
+</template>
+
+<script setup lang="ts">
+import { computed, Ref, ref } from "vue";
+import { ResourceTyped } from "@/api/grpc";
+import { RedactedClusterMachineConfigSpec } from "@/api/omni/specs/omni.pb";
+import Watch from "@/api/watch";
+import { Runtime } from "@/api/common/omni.pb";
+import { DefaultNamespace, RedactedClusterMachineConfigType } from "@/api/resources";
+import { useRoute } from "vue-router";
+import { getContext } from "@/context";
+
+import CodeEditor from "@/components/common/CodeEditor/CodeEditor.vue";
+
+const route = useRoute();
+
+const configs: Ref<ResourceTyped<RedactedClusterMachineConfigSpec>[]> = ref([]);
+const watch = new Watch(configs);
+
+const config = computed(() => {
+  return configs.value?.[0]?.spec?.data || "";
+});
+
+const context = getContext(route);
+
+watch.setup(computed(() => {
+  return {
+    runtime: Runtime.Omni,
+    resource: {
+      type: RedactedClusterMachineConfigType,
+      namespace: DefaultNamespace,
+      id: route.params.machine as string,
+    },
+    context
+  };
+}));
+</script>
+
+<style>
+.monaco-editor-vue3 h4 {
+  @apply font-bold;
+}
+</style>
diff --git a/frontend/src/views/cluster/Nodes/NodeDetails.vue b/frontend/src/views/cluster/Nodes/NodeDetails.vue
new file mode 100644
index 000000000..c0bbbc968
--- /dev/null
+++ b/frontend/src/views/cluster/Nodes/NodeDetails.vue
@@ -0,0 +1,21 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col">
+    <nodes-header/>
+    <node-details-tabs
+      :machine="$route.params.machine as string"
+      class="mb-4"
+    />
+    <router-view name="nodeDetails"/>
+  </div>
+</template>
+
+<script setup lang="ts">
+import NodesHeader from "@/views/cluster/Nodes/NodesHeader.vue";
+import NodeDetailsTabs from "@/views/cluster/Nodes/components/NodeDetailsTabs.vue";
+</script>
diff --git a/frontend/src/views/cluster/Nodes/NodeLogs.vue b/frontend/src/views/cluster/Nodes/NodeLogs.vue
new file mode 100644
index 000000000..a0ac5c0d4
--- /dev/null
+++ b/frontend/src/views/cluster/Nodes/NodeLogs.vue
@@ -0,0 +1,156 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="logs">
+    <machine-logs-container
+        v-if="$route.params.service === 'machine'" :machineId="route.params.machine as string"
+        class="logs-container"
+    />
+    <div v-else class="logs-container">
+      <div class="w-1/4 mb-4">
+        <t-input
+          placeholder="Search..."
+          v-model="inputValue"
+          icon="search"
+        />
+      </div>
+      <t-alert
+        v-if="err"
+        :title="logs ? 'Disconnected' : 'Failed to Fetch Logs'"
+        type="error"
+        class="mb-2"
+      >
+        {{ err }}
+      </t-alert>
+      <log-viewer :logs="logs" :searchOption="inputValue" class="flex-1" :with-date="parsers[$route.params.service as string] !== undefined"/>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, Ref, watch } from "vue";
+import { useRoute } from "vue-router";
+import { LogsRequest, MachineService } from "@/api/talos/machine/machine.pb";
+import { Runtime } from "@/api/common/omni.pb";
+import { getContext } from "@/context";
+import { setupLogStream, LogLine, LineDelimitedLogParser } from "@/methods/logs";
+import { withContext, withRuntime } from "@/api/options";
+import { DateTime } from "luxon";
+
+import TInput from "@/components/common/TInput/TInput.vue";
+import TAlert from "@/components/TAlert.vue";
+import LogViewer from "@/components/common/LogViewer/LogViewer.vue";
+import MachineLogsContainer from "@/views/omni/Machines/MachineLogsContainer.vue";
+
+const route = useRoute();
+const inputValue = ref("");
+const logs: Ref<LogLine[]> = ref([]);
+const context = getContext();
+const service = ref(route.params.service as string);
+
+const formatLoggingContext = (logRecord: Record<string, string>, ...exceptFields: string[]) => {
+  const res: string[] = [];
+
+  for (const key in logRecord) {
+    if (exceptFields.includes(key)) {
+      continue;
+    }
+
+    res.push(`${key}=${logRecord[key]}`);
+  }
+
+  return res.join(" ");
+}
+
+const parsers = {
+  containerd: (line: string): LogLine => {
+    const parsed = JSON.parse(line);
+
+    return {
+      date: parsed.time,
+      msg: `[${parsed.level ?? 'info'}] ${parsed.msg} ${formatLoggingContext(parsed, "msg", "ts", "level")}`,
+    }
+  },
+  cri: (line: string): LogLine => {
+    const parsed = JSON.parse(line);
+
+    return {
+      date: parsed.time,
+      msg: `[${parsed.level ?? 'info'}] ${parsed.msg} ${formatLoggingContext(parsed, "msg", "ts", "level")}`,
+    }
+  },
+  etcd: (line: string): LogLine => {
+    const parsed = JSON.parse(line);
+
+    return {
+      date: parsed.ts,
+      msg: `[${parsed.level ?? 'info'}] ${parsed.msg} ${formatLoggingContext(parsed, "msg", "ts", "level")}`,
+    }
+  },
+  kubelet: (line: string): LogLine => {
+    const parsed = JSON.parse(line);
+    const date = DateTime.fromSeconds(parseFloat(parsed.ts) / 1000);
+
+    return {
+      date: date.toISO(),
+      msg: `[${parsed.level ?? 'info'}] ${parsed.msg} ${formatLoggingContext(parsed, "msg", "ts", "level")}`,
+    }
+  },
+};
+
+const plainText = (line: string) => {
+  return {
+    msg: line
+  };
+}
+
+const params = computed<LogsRequest>(() => {
+  return {
+    namespace: "system",
+    id: service.value,
+    follow: true,
+    tail_lines: -1,
+  };
+});
+
+const getLineParser = (svc: string) => {
+  return parsers[svc] ? (line: string): LogLine => {
+    try {
+      return parsers[svc](line);
+    } catch {
+      return plainText(line);
+    }
+  } : plainText;
+}
+
+const logParser = new LineDelimitedLogParser(getLineParser(service.value));
+
+watch(() => route.params.service, () => {
+  const svc = route.params.service as string;
+
+  logParser.setLineParser(getLineParser(svc));
+  service.value = svc;
+})
+
+const stream = setupLogStream(logs, MachineService.Logs, params, logParser, withRuntime(Runtime.Talos), withContext(context));
+
+const err = computed(() => {
+  return stream.value?.err;
+});
+</script>
+
+<style scoped>
+.logs {
+  @apply flex flex-col h-full;
+  max-height: calc(100vh - 150px);
+  overflow: hidden;
+}
+.logs-container {
+  @apply flex flex-col;
+  flex-grow: 1;
+}
+</style>
diff --git a/frontend/src/views/cluster/Nodes/NodeMonitor.vue b/frontend/src/views/cluster/Nodes/NodeMonitor.vue
new file mode 100644
index 000000000..a5a9a6ff9
--- /dev/null
+++ b/frontend/src/views/cluster/Nodes/NodeMonitor.vue
@@ -0,0 +1,377 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="monitor">
+    <div class="monitor-charts-box">
+      <div class="monitor-charts-wrapper">
+        <div class="monitor-chart">
+          <nodes-monitor-chart
+            class="h-full"
+            name="cpu"
+            title="CPU usage"
+            type="area"
+            :colors="['#FFB103', '#FF8B59']"
+            :runtime="Runtime.Talos"
+            :resource="{
+              type: TalosCPUType,
+              namespace: TalosPerfNamespace,
+              id: TalosCPUID,
+            }"
+            :context="context"
+            :point-fn="handleCPU"
+            :total-fn="handleTotalCPU"
+            :min-fn="() => 0"
+            :max-fn="() => 100"
+          />
+        </div>
+        <div class="monitor-chart">
+          <nodes-monitor-chart
+            class="h-full"
+            name="mem"
+            title="Memory"
+            type="area"
+            :stroke="{ curve: 'smooth', width: [2, 0.5, 0.5], dashArray: [0, 2, 2]}"
+            :colors="['#FF8B59', '#AAAAAA', '#AAAAAA']"
+            :runtime="Runtime.Talos"
+            :resource="{
+              type: TalosMemoryType,
+              namespace: TalosPerfNamespace,
+              id: TalosMemoryID,
+            }"
+            stacked
+            :context="context"
+            :point-fn="handleMem"
+            :total-fn="handleTotalMem"
+            :min-fn="() => 0"
+            :max-fn="handleMaxMem"
+            :formatter="(input: number) => { return formatBytes(input * 1024) }"
+          />
+        </div>
+      </div>
+      <div class="monitor-charts-wrapper">
+        <div class="monitor-chart monitor-chart-wide">
+          <nodes-monitor-chart
+            class="h-full"
+            name="procs"
+            title="Processes"
+            type="area"
+            :colors="['#5DA8D1', '#69C197', '#FFB103']"
+            :runtime="Runtime.Talos"
+            :resource="{
+              type: TalosCPUType,
+              namespace: TalosPerfNamespace,
+              id: TalosCPUID,
+            }"
+            :context="context"
+            :point-fn="handleProcs"
+          />
+        </div>
+      </div>
+    </div>
+    <div class="monitor-data-wrapper">
+      <div class="grid grid-cols-12 uppercase font-bold select-none">
+        <div
+          v-for="h in headers"
+          @click="() => sortBy(h.id)"
+          :key="h.id"
+          class="flex flex-row items-center text-center cursor-pointer gap-1 text-xs capitalize hover:text-naturals-N10 transition-colors"
+        >
+          <span>{{ h.header || h.id }}</span>
+          <arrow-down-icon
+            class="w-3 h-3"
+            :class="{ transform: sortReverse, 'rotate-180': sortReverse }"
+            v-if="sort === h.id"
+          />
+        </div>
+      </div>
+      <div class="monitor-data-box">
+        <div
+          class="grid grid-cols-12 text-xs text-naturals-N12 py-2"
+          v-for="process in sortedProcesses"
+          :key="process.pid"
+          :title="process.command + ' ' + process.args"
+        >
+          <div>
+            {{ process.pid }}
+          </div>
+          <div>
+            {{ process.state }}
+          </div>
+          <div>
+            {{ process.threads }}
+          </div>
+          <div>
+            {{ process.cpu.toFixed(1) }}
+          </div>
+          <div>
+            {{ process.mem.toFixed(1) }}
+          </div>
+          <div>
+            {{ formatBytes(process.virtualMemory) }}
+          </div>
+          <div>
+            {{ formatBytes(process.residentMemory) }}
+          </div>
+          <div>
+            {{ process.cpuTime }}
+          </div>
+          <div class="col-span-4 truncate">
+            {{ process.command }} {{ process.args }}
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { getContext } from '@/context';
+import { ref, onMounted, onUnmounted, computed, Ref } from 'vue';
+import { MachineService } from '@/api/talos/machine/machine.pb';
+import { Runtime } from "@/api/common/omni.pb";
+import { ArrowDownIcon, } from '@heroicons/vue/24/solid';
+import { formatBytes } from "@/methods";
+import { TalosCPUType, TalosMemoryType, TalosPerfNamespace, TalosCPUID, TalosMemoryID } from '@/api/resources';
+import { withContext, withRuntime } from '@/api/options';
+
+import NodesMonitorChart from '@/views/cluster/Nodes/components/NodesMonitorChart.vue';
+
+function diff(a, b) {
+  const result = {};
+
+  for (const key in a) {
+    const left = a[key];
+    const right = b[key];
+
+    const tleft = typeof left;
+    const tright = typeof right;
+
+    if (tleft !== tright) {
+      continue;
+    }
+
+    if (tleft === "object")
+      result[key] = diff(left, right);
+    else
+      result[key] = left - right;
+  }1024
+
+  return result;
+}
+
+const processes: Ref<Record<string, any>[]> = ref([]);
+const context = getContext();
+const headers = [
+  { id: "pid" },
+  { id: "state" },
+  { id: "threads" },
+  { id: "cpu", header: "CPU %" },
+  { id: "mem", header: "Memory %" },
+  { id: "virtualMemory", header: "Virt Memory" },
+  { id: "residentMemory", header: "Res Memory" },
+  { id: "cpuTime", header: "Time+" },
+  { id: "command" },
+];
+const sort = ref("cpu");
+const sortReverse = ref(true);
+
+let memTotal = 0;
+let interval;
+
+const sum = (obj, ...args) => {
+  let res = 0;
+  for (const k of args) {
+    res += obj[k] || 0;
+  }
+
+  return res;
+};
+
+const getCPUTotal = (stat) => {
+  const idle = sum(stat, "idle", "iowait");
+  const nonIdle = sum(stat, "user", "nice", "system", "irq", "steal", "softIrq");
+
+  return idle + nonIdle;
+};
+
+const prevProcs = {};
+let prevCPU = 0;
+
+const loadProcs = async () => {
+  if (memTotal === 0)
+    return;
+
+  const options = [
+    withRuntime(Runtime.Talos),
+    withContext(context),
+  ];
+
+  const resp = await MachineService.Processes({}, ...options);
+
+  const procs: Record<string, {}>[] = [];
+
+  const r = await MachineService.SystemStat({}, ...options)
+
+  const systemStat = r.messages![0];
+  const cpuTotal = getCPUTotal(systemStat.cpu_total) / systemStat.cpu!.length;
+
+  const total = memTotal * 1024;
+
+  for (const message of resp.messages!) {
+    for (const proc of message.processes!) {
+      let cpuDiff = 0;
+
+      if (prevProcs[proc.pid!] && proc.cpu_time) {
+        cpuDiff = proc.cpu_time! - prevProcs[proc.pid!].cpu_time;
+      }
+
+      procs.push({
+        mem: parseInt(proc.resident_memory || '0') / total * 100,
+        cpu: cpuDiff / (cpuTotal - prevCPU) * 100,
+        threads: proc.threads!,
+        pid: proc.pid!,
+        state: proc.state!,
+        virtualMemory: parseInt(proc.virtual_memory || '0'),
+        residentMemory: parseInt(proc.resident_memory || '0'),
+        command: proc.command!,
+        cpuTime: proc.cpu_time || 0,
+        args: proc.args!,
+      });
+
+      prevProcs[proc.pid!] = proc;
+    }
+  }
+
+  prevCPU = cpuTotal;
+
+  processes.value = procs;
+}
+
+onMounted(() => {
+  loadProcs();
+  interval = setInterval(loadProcs, 5000);
+});
+
+onUnmounted(() => {
+  clearInterval(interval);
+});
+
+const handleCPU = (oldObj, newObj) => {
+  const delta = diff(oldObj, newObj);
+  const stat = delta["cpuTotal"];
+  const total = getCPUTotal(stat);
+
+  return {
+    system: stat["system"] / total * 100,
+    user: stat["user"] / total * 100,
+  };
+};
+
+const handleTotalCPU = (oldObj, newObj) => {
+  const point = handleCPU(oldObj, newObj);
+
+  return `${(point.user + point.system).toFixed(1)} %`;
+};
+
+const handleMem = (_, m: { used: number, cached: number, buffers: number, total: number }) => {
+  const used = m.used - m.cached - m.buffers
+
+  const memoryInitialized = memTotal === 0;
+
+  memTotal = m.total;
+
+  if (memoryInitialized) {
+    loadProcs();
+  }
+
+  return {
+    used: used,
+    cached: m.cached,
+    buffers: m.buffers,
+  }
+};
+
+const handleTotalMem = (_, m) => {
+  const used = m["used"] - m["cached"] - m["buffers"];
+
+  return `${formatBytes(used * 1024)} / ${formatBytes(m["total"] * 1024)}`;
+};
+
+const handleMaxMem = (_, m): number => {
+  return m["total"];
+};
+
+const handleProcs = (oldObj, newObj) => {
+  const delta = diff(oldObj, newObj);
+
+  return {
+    created: delta["processCreated"],
+    running: newObj["processRunning"],
+    blocked: newObj["processBlocked"],
+  }
+};
+
+const sortedProcesses = computed<Record<string, any>[]>(() => {
+  return [...processes.value].sort((a, b) => {
+    let res = 0;
+    if (a[sort.value] > b[sort.value]) {
+      res = 1;
+    } else if (a[sort.value] < b[sort.value]) {
+      res = -1;
+    }
+
+    return sortReverse.value ? -1 * res : res;
+  });
+});
+
+const sortBy = (id: string) => {
+  if (id === sort.value)
+    sortReverse.value = !sortReverse.value
+  else
+    sortReverse.value = true;
+
+  sort.value = id;
+};
+</script>
+
+<style scoped>
+.monitor {
+  @apply flex flex-col justify-start pb-5;
+}
+.monitor-charts-box {
+  @apply flex flex-col overflow-hidden;
+  padding-bottom: 0 !important;
+}
+.monitor-charts-wrapper {
+  @apply flex flex-1 gap-2 mb-6;
+}
+.monitor-charts-wrapper:last-of-type {
+  @apply mb-0;
+}
+.monitor-chart {
+  @apply flex-1 bg-naturals-N2 rounded p-3 pt-4;
+  min-height: 220px;
+}
+.monitor-chart:nth-child(1) {
+  @apply mr-3;
+}
+.monitor-chart:nth-child(2) {
+  @apply ml-3;
+}
+.monitor-chart-wide {
+  @apply border-b border-naturals-N5;
+  margin-right: 0 !important;
+  padding-bottom: 29px;
+  border-radius: 4px 4px 0 0;
+}
+.monitor-data-wrapper {
+  @apply px-2 lg:px-8 pt-5 text-xs text-naturals-N13 flex-1 flex flex-col overflow-hidden w-full bg-naturals-N2;
+}
+.monitor-data-box {
+  @apply flex-1 overflow-x-auto py-3 bg-naturals-N2;
+}
+</style>
diff --git a/frontend/src/views/cluster/Nodes/NodeMounts.vue b/frontend/src/views/cluster/Nodes/NodeMounts.vue
new file mode 100644
index 000000000..55768e044
--- /dev/null
+++ b/frontend/src/views/cluster/Nodes/NodeMounts.vue
@@ -0,0 +1,95 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <t-list :opts="watchOpts">
+    <template #default="{ items }">
+      <div class="header list-grid">
+        <div>Partition</div>
+        <div>Filesystem</div>
+        <div>Src</div>
+        <div>Target</div>
+        <div>Encryption</div>
+      </div>
+      <t-list-item v-for="item in items" :key="item.metadata.id!">
+        <div class="px-3 list-grid text-naturals-N12">
+          <div class="text-naturals-N14">{{ item.metadata.id }}</div>
+          <div>{{ item.spec.filesystemType }}</div>
+          <div>{{ item.spec.source }}</div>
+          <div>{{ item.spec.target }}</div>
+          <div class="flex">
+            <div class="flex gap-1 items-center rounded bg-naturals-N4 px-2 py-1" :style="{ color: encryptionColor(item) }">
+              <LockClosedIcon v-if="isEncrypted(item) === Encryption.Enabled" class="w-3 h-3"/>
+              <LockOpenIcon v-else-if="isEncrypted(item) === Encryption.Disabled" class="w-3 h-3"/>
+              <QuestionMarkCircleIcon v-else-if="isEncrypted(item) === Encryption.Unknown" class="w-4 h-4"/>
+              {{ isEncrypted(item) }}
+            </div>
+          </div>
+        </div>
+      </t-list-item>
+    </template>
+  </t-list>
+</template>
+
+<script setup lang="ts">
+import { Runtime } from "@/api/common/omni.pb";
+import { Resource } from "@/api/grpc";
+import { TalosMountStatusType, TalosRuntimeNamespace } from "@/api/resources";
+import { WatchOptions } from "@/api/watch";
+import TList from "@/components/common/List/TList.vue";
+import TListItem from "@/components/common/List/TListItem.vue";
+import { getContext } from "@/context";
+import { QuestionMarkCircleIcon } from "@heroicons/vue/24/outline";
+import { LockClosedIcon, LockOpenIcon } from "@heroicons/vue/24/solid";
+import { computed } from "vue";
+import { red, green, yellow } from "@/vars/colors";
+
+enum Encryption {
+  Unknown = "unknown",
+  Enabled = "enabled",
+  Disabled = "disabled"
+}
+
+const watchOpts = computed((): WatchOptions => {
+  return {
+    resource: {
+      namespace: TalosRuntimeNamespace,
+      type: TalosMountStatusType,
+    },
+    runtime: Runtime.Talos,
+    context: getContext(),
+  }
+});
+
+const isEncrypted = (item: Resource<{encrypted?: boolean}>) => {
+  if (item.spec.encrypted === undefined) {
+    return Encryption.Unknown;
+  }
+
+  return item.spec.encrypted ? Encryption.Enabled : Encryption.Disabled;
+};
+
+const encryptionColor = (item: Resource) => {
+  switch (isEncrypted(item)) {
+    case Encryption.Disabled:
+      return red.R1;
+    case Encryption.Enabled:
+      return green.G1;
+    case Encryption.Unknown:
+      return yellow.Y1;
+  }
+}
+</script>
+
+<style scoped>
+.list-grid {
+  @apply grid grid-cols-5 items-center justify-center;
+}
+
+.header {
+  @apply bg-naturals-N2 mb-1 py-2 px-6 text-xs;
+}
+</style>
\ No newline at end of file
diff --git a/frontend/src/views/cluster/Nodes/NodeOverview.vue b/frontend/src/views/cluster/Nodes/NodeOverview.vue
new file mode 100644
index 000000000..ea2846bba
--- /dev/null
+++ b/frontend/src/views/cluster/Nodes/NodeOverview.vue
@@ -0,0 +1,408 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="overview">
+    <t-alert :dismiss="{name: 'Dismiss', action: () => alertDismissed = true}" class="mb-4" v-if="clusterMachineStatus?.spec?.last_config_error && !alertDismissed" title="Configuration Error" type="error">
+      {{ clusterMachineStatus?.spec?.last_config_error }}
+    </t-alert>
+    <ul class="overview-data-list">
+      <li class="overview-data-item">
+        <h4 class="overview-data-heading">Kubernetes</h4>
+        <div class="overview-data-row">
+          <p class="overview-data-name">Hostname</p>
+          <p class="overview-data">{{ nodename?.spec?.nodename }}</p>
+        </div>
+        <div class="overview-data-row">
+          <p class="overview-data-name">Kubelet Version</p>
+          <p class="overview-data">
+            {{ node?.status?.nodeInfo?.kubeletVersion }}
+          </p>
+        </div>
+        <div class="overview-data-row">
+          <p class="overview-data-name">OS</p>
+          <p class="overview-data">
+            {{ node?.status?.nodeInfo?.operatingSystem }}
+          </p>
+        </div>
+        <div class="overview-data-row">
+          <p class="overview-data-name">Roles</p>
+          <div class="overview-data-roles">
+            <t-tag
+              class="overview-data-role"
+              v-for="role in roles"
+              :key="role"
+              :name="role"
+            />
+          </div>
+        </div>
+        <div class="overview-data-row">
+          <p class="overview-data-name">Status</p>
+          <div class="overview-data">
+            <t-status :title="status" />
+          </div>
+        </div>
+      </li>
+      <li class="overview-data-item">
+        <h4 class="overview-data-heading">Node</h4>
+        <div class="overview-data-row">
+          <p class="overview-data-name">Addresses</p>
+          <p class="overview-data">{{ nodeaddress?.spec.addresses.join(", ") }}</p>
+        </div>
+        <div class="overview-data-row">
+          <p class="overview-data-name">OS</p>
+          <p class="overview-data">{{ node?.status?.nodeInfo?.osImage }}</p>
+        </div>
+        <div class="overview-data-row">
+          <p class="overview-data-name">Architecture</p>
+          <p class="overview-data">
+            {{ node?.status?.nodeInfo?.architecture }}
+          </p>
+        </div>
+        <div class="overview-data-row">
+          <p class="overview-data-name">Kernel Version</p>
+          <p class="overview-data">
+            {{ node?.status?.nodeInfo?.kernelVersion }}
+          </p>
+        </div>
+        <div class="overview-data-row">
+          <p class="overview-data-name">Container Runtime Version</p>
+          <p class="overview-data">
+            {{ node?.status?.nodeInfo?.containerRuntimeVersion }}
+          </p>
+        </div>
+        <div class="overview-data-row">
+          <p class="overview-data-name">Config Status</p>
+          <t-status :title="configApplyStatusToConfigApplyStatusName(clusterMachineStatus?.spec?.config_apply_status)" />
+        </div>
+
+      </li>
+    </ul>
+    <watch
+      :opts="{
+        resource: { type: TalosServiceType, namespace: TalosRuntimeNamespace },
+        runtime: Runtime.Talos,
+        context: getContext(),
+      }"
+      errorsAlert
+      noRecordsAlert
+      spinner
+    >
+      <template #default="services">
+        <div class="overview-services">
+          <div class="overview-services-heading">
+            <span class="overview-services-title">Services</span>
+            <span class="overview-services-amount">{{
+              services.items.length
+            }}</span>
+          </div>
+          <ul class="overview-table-header">
+            <li class="overview-table-name overview-table-name-id">ID</li>
+            <li class="overview-table-name overview-table-name-running">
+              Running
+            </li>
+            <li class="overview-table-name overview-table-name-health">
+              Health
+            </li>
+          </ul>
+          <t-group-animation>
+            <ul
+              v-for="service in services.items"
+              :key="service?.metadata?.id"
+              class="overview-table-item"
+            >
+              <li class="overview-item-value overview-item-value-id">
+                <router-link :to="{
+                        name: 'NodeLogs',
+                        query: {
+                          cluster: $route.query.cluster,
+                          namespace: $route.query.namespace,
+                          uid: $route.query.uid,
+                        },
+                        params: {
+                          machine: $route.params.machine,
+                          service: service.metadata.id,
+                        },
+                      }" class="list-item-link" :id="service.metadata.id!">
+                  {{ service?.metadata?.id }}
+                </router-link>
+              </li>
+              <li class="overview-item-value overview-item-value-running">
+                <t-status
+                  class="overview-status"
+                  :title="service?.spec?.running ? 'Running' : 'Not Running'"
+                />
+              </li>
+              <li class="overview-item-value overview-item-value-health">
+                <t-status
+                  class="overview-status"
+                  :title="getServiceHealthStatus(service)"
+                />
+              </li>
+            </ul>
+          </t-group-animation>
+        </div>
+      </template>
+    </watch>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, Ref, ref } from "vue";
+import { getContext } from "@/context";
+import { getServiceHealthStatus, getStatus } from "@/methods";
+import {
+  kubernetes,
+  ClusterMachineStatusType,
+  DefaultNamespace,
+  TalosAddressRoutedNoK8s,
+  TalosNodeAddressType,
+  TalosNetworkNamespace,
+  TalosServiceType,
+  TalosRuntimeNamespace,
+  TalosK8sNamespace,
+  TalosNodenameID,
+  TalosNodenameType,
+} from "@/api/resources";
+import { Runtime } from "@/api/common/omni.pb";
+import WatchResource, { WatchOptions } from "@/api/watch";
+import { NodeSpec } from "kubernetes-types/core/v1";
+import { ResourceTyped } from "@/api/grpc";
+import { ClusterMachineStatusSpec, ConfigApplyStatus } from "@/api/omni/specs/omni.pb";
+import { useRoute } from "vue-router";
+
+import TAlert from "@/components/TAlert.vue";
+import TGroupAnimation from "@/components/common/Animation/TGroupAnimation.vue";
+import TTag from "@/components/common/Tag/TTag.vue";
+import TStatus from "@/components/common/Status/TStatus.vue";
+import Watch from "@/components/common/Watch/Watch.vue";
+
+type Nodename = {
+  nodename: string,
+};
+
+type NodeAddress = {
+  addresses: Array<string>;
+};
+
+const configApplyStatusToConfigApplyStatusName = (status?: ConfigApplyStatus): string => {
+  switch (status) {
+    case ConfigApplyStatus.APPLIED:
+      return "Applied";
+    case ConfigApplyStatus.FAILED:
+      return "Failed";
+    case ConfigApplyStatus.PENDING:
+      return "Pending";
+    default:
+      return "Unknown";
+  }
+}
+
+const alertDismissed = ref(false);
+const node: Ref<ResourceTyped<NodeSpec> | undefined> = ref();
+const nodename: Ref<ResourceTyped<Nodename> | undefined> = ref();
+const nodeaddress: Ref<ResourceTyped<NodeAddress> | undefined> = ref();
+const clusterMachineStatus: Ref<ResourceTyped<ClusterMachineStatusSpec> | undefined> = ref();
+
+const nodeWatch = new WatchResource(node);
+const nodenameWatch = new WatchResource(nodename);
+const nodeaddressWatch = new WatchResource(nodeaddress);
+const clusterMachineStatusesWatch = new WatchResource(clusterMachineStatus);
+
+const route = useRoute();
+const context = getContext();
+
+nodeWatch.setup(computed(() => {
+  const id = nodename.value?.spec?.nodename;
+  if (!id) {
+    return;
+  }
+
+  return {
+    runtime: Runtime.Kubernetes,
+    resource: {
+      id: id,
+      type: kubernetes.node,
+    },
+    context,
+  };
+}));
+
+nodenameWatch.setup({
+  runtime: Runtime.Talos,
+  resource: {
+    id: TalosNodenameID,
+    type: TalosNodenameType,
+    namespace: TalosK8sNamespace,
+  },
+  context,
+});
+
+nodeaddressWatch.setup({
+  runtime: Runtime.Talos,
+  resource: {
+    id: TalosAddressRoutedNoK8s,
+    type: TalosNodeAddressType,
+    namespace: TalosNetworkNamespace,
+  },
+  context,
+});
+
+const clusterMachineStatusWatchOpts: Ref<WatchOptions | undefined> = computed(() => {
+  return {
+    runtime: Runtime.Omni,
+    resource: {
+      type: ClusterMachineStatusType,
+      namespace: DefaultNamespace,
+      id: route.params.machine as string,
+    },
+  }
+});
+
+clusterMachineStatusesWatch.setup(clusterMachineStatusWatchOpts);
+
+const roles = computed(() => {
+  const roles: any = [];
+  for (const label in node.value?.metadata?.labels) {
+    if (label.indexOf("node-role.kubernetes.io/") != -1) {
+      roles.push(label.split("/")[1]);
+    }
+  }
+  return roles;
+});
+
+const status = computed(() => getStatus(node.value));
+</script>
+
+<style scoped>
+.overview {
+  @apply w-full;
+}
+.overview-heading {
+  @apply flex justify-between items-start mb-7 flex-wrap;
+}
+.overview-breadcrumbs {
+  @apply xl:mb-0 mb-3;
+}
+.overview-heading-buttons {
+  @apply flex justify-end;
+}
+.overview-heading-button {
+  @apply text-naturals-N13;
+}
+.overview-heading-button:nth-child(1) {
+  border-radius: 4px 0 0 4px;
+}
+.overview-heading-button:nth-child(2) {
+  border-radius: 0 4px 4px 0;
+}
+.overview-content-types {
+  @apply mb-6;
+}
+.overview-data-list {
+  @apply flex flex-col justify-start items-stretch xl:flex-row xl:justify-between xl:items-start mb-10;
+}
+.overview-data-item {
+  @apply bg-naturals-N2 w-full rounded mb-6;
+  align-self: stretch;
+  max-width: 100%;
+}
+@media screen and (min-width: 1280px) {
+  .overview-data-item {
+    max-width: 49%;
+    @apply mb-0;
+  }
+}
+.overview-data-heading {
+  @apply px-4 py-3 border-b border-naturals-N4 w-full text-xs text-naturals-N13;
+  font-size: 13px;
+}
+.overview-data-row {
+  @apply w-full flex justify-between items-center;
+  padding: 14px 16px 10px 16px;
+}
+.overview-data-row:last-of-type {
+  padding-bottom: 12px;
+}
+.overview-data-name {
+  @apply text-xs text-naturals-N11;
+}
+.overview-data {
+  @apply text-xs text-naturals-N13;
+}
+.overview-data-roles {
+  @apply flex;
+}
+.overview-data-role:not(:last-of-type) {
+  margin-right: 6px;
+}
+.overview-services-heading {
+  @apply mb-4;
+}
+.overview-services-title {
+  @apply text-base text-naturals-N13 mr-2;
+}
+.overview-services-amount {
+  @apply text-xs text-naturals-N12 bg-naturals-N5;
+  border-radius: 30px;
+  padding: 3px 7px;
+}
+.overview-table-header {
+  @apply flex bg-naturals-N2 rounded-sm;
+  padding: 10px 16px;
+}
+.overview-table-name {
+  @apply text-xs text-naturals-N13 w-full;
+}
+.overview-table-name-id {
+  width: 100%;
+  max-width: 55%;
+}
+.overview-table-name-running {
+  width: 18%;
+}
+.overview-table-name-health {
+  width: 18%;
+}
+.overview-table-item {
+  @apply flex items-center border-b border-naturals-N4;
+  padding: 19px 16px;
+}
+.overview-item-value {
+  @apply text-xs text-naturals-N14 w-full;
+}
+.overview-item-value-id {
+  width: 100%;
+  max-width: 55%;
+}
+.overview-item-value-running {
+  width: 18%;
+}
+.overview-item-value-health {
+  width: 18%;
+}
+@media screen and (max-width: 1280px) {
+  .overview-table-name-running {
+    width: 50%;
+  }
+  .overview-table-name-health {
+    width: 73%;
+  }
+  .overview-item-value-running {
+    width: 50%;
+  }
+  .overview-item-value-health {
+    width: 50%;
+  }
+}
+.overview-item-value-logs {
+  @apply flex justify-end;
+  width: auto;
+}
+.overview-item-button {
+  @apply min-w-max;
+}
+</style>
diff --git a/frontend/src/views/cluster/Nodes/NodesHeader.vue b/frontend/src/views/cluster/Nodes/NodesHeader.vue
new file mode 100644
index 000000000..0a8b93107
--- /dev/null
+++ b/frontend/src/views/cluster/Nodes/NodesHeader.vue
@@ -0,0 +1,142 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex justify-between items-start flex-wrap mb-7">
+    <t-breadcrumbs :nodeName="$route.params.machine as string"/>
+    <div class="flex">
+      <t-button
+        class="header-button"
+        icon="power"
+        iconPosition="left"
+        type="secondary"
+        @click="shutdownNode"
+        :disabled="!canRebootMachines"
+        >Shutdown</t-button
+      >
+      <t-button
+        class="header-button"
+        icon="reboot"
+        iconPosition="left"
+        type="secondary"
+        @click="rebootNode"
+        :disabled="!canRebootMachines"
+        >Reboot</t-button
+      >
+      <t-button v-if="machineSetNode"
+        class="header-button delete-button"
+        icon="delete"
+        iconPosition="left"
+        type="secondary"
+        @click="destroyNode"
+        :disabled="!canRemoveMachines"
+        >Destroy</t-button
+      >
+      <t-button v-else-if="!loading"
+        class="header-button"
+        icon="rollback"
+        iconPosition="left"
+        type="secondary"
+        @click="restoreNode"
+        :disabled="!canAddClusterMachines"
+        >Cancel Destroy</t-button
+      >
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useRoute, useRouter } from "vue-router";
+import { computed, ref, Ref } from "vue";
+import { setupClusterPermissions } from "@/methods/auth";
+
+import TBreadcrumbs from "@/components/TBreadcrumbs.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import Watch from "@/api/watch";
+import { Resource } from "@/api/grpc";
+import { DefaultNamespace, MachineSetNodeType } from "@/api/resources";
+import { Runtime } from "@/api/common/omni.pb";
+
+const route = useRoute();
+const router = useRouter();
+
+const shutdownNode = () => {
+  router.push({
+    query: {
+      modal: "shutdown",
+      machine: route.params.machine,
+      ...route.query,
+    },
+  });
+};
+
+const rebootNode = () => {
+  router.push({
+    query: {
+      modal: "reboot",
+      machine: route.params.machine,
+      ...route.query,
+    },
+  });
+};
+
+const machineSetNode: Ref<Resource | undefined> = ref();
+const watch = new Watch(machineSetNode);
+watch.setup({
+  resource: {
+    type: MachineSetNodeType,
+    id: route.params.machine as string,
+    namespace: DefaultNamespace,
+  },
+  runtime: Runtime.Omni,
+});
+
+const loading = watch.loading;
+
+const destroyNode = async () => {
+  router.push({
+    query: {
+      modal: "nodeDestroy",
+      machine: route.params.machine,
+      cluster: route.params.cluster,
+    }
+  });
+};
+
+const restoreNode = async () => {
+  router.push({
+    query: {
+      modal: "nodeDestroyCancel",
+      machine: route.params.machine,
+      cluster: route.params.cluster,
+    }
+  });
+};
+
+const { canRebootMachines, canRemoveMachines, canAddClusterMachines } = setupClusterPermissions(computed(() => route.params.cluster as string))
+</script>
+
+<style scoped>
+.header-button:first-child {
+  border-radius: 4px 0 0 4px;
+}
+
+.header-button:not(:last-child) {
+  border-right: none;
+}
+
+.header-button:last-child {
+  border-radius: 0 4px 4px 0;
+}
+
+.header-button:not(:first-child):not(:last-child) {
+  border-radius: 0;
+}
+
+.delete-button {
+  @apply text-red-R1 hover:text-red-R1 active:text-red-R1;
+}
+</style>
diff --git a/frontend/src/views/cluster/Nodes/NodesList.vue b/frontend/src/views/cluster/Nodes/NodesList.vue
new file mode 100644
index 000000000..74bdeb79d
--- /dev/null
+++ b/frontend/src/views/cluster/Nodes/NodesList.vue
@@ -0,0 +1,156 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col w-full gap-4">
+    <page-header title="All Nodes"/>
+    <div class="flex gap-2">
+      <t-input
+        primary
+        class="flex-1"
+        placeholder="Search..."
+        v-model="searchOption"
+      />
+      <t-select-list
+        title="Status"
+        :defaultValue="NodesViewFilterOptions.ALL"
+        :values="filterOptions"
+        @checkedValue="setFilterOption"
+      />
+    </div>
+    <watch :opts="opts" spinner noRecordsAlert errorsAlert>
+      <template #default="{ items }">
+        <div class="nodes-list">
+          <div class="nodes-list-heading">
+            <p>Name</p>
+            <p>IP</p>
+            <p>OS</p>
+            <p>Roles</p>
+            <p>Status</p>
+          </div>
+          <t-group-animation>
+            <nodes-item
+              v-for="item in filterItems(items)"
+              :key="item.metadata.id!"
+              :item="item"
+              :searchOption="searchOption"
+            />
+          </t-group-animation>
+        </div>
+      </template>
+    </watch>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { getContext } from "@/context";
+import { kubernetes, ClusterMachineStatusType, LabelCluster, ClusterMachineStatusLabelNodeName, TalosMemberType, TalosClusterNamespace } from "@/api/resources";
+import { Runtime } from "@/api/common/omni.pb";
+import { Resource, ResourceTyped } from "@/api/grpc";
+import { ClusterMachineStatusSpec } from "@/api/omni/specs/omni.pb";
+import { useRoute } from "vue-router";
+import { DefaultNamespace } from "@/api/resources";
+import { Node, NodeSpec, NodeStatus } from "kubernetes-types/core/v1";
+import { NodesViewFilterOptions } from "@/constants";
+import { ref } from "vue";
+import { getStatus } from "@/methods";
+
+import Watch from "@/components/common/Watch/Watch.vue";
+import PageHeader from "@/components/common/PageHeader.vue";
+import NodesItem from "@/views/cluster/Nodes/components/NodesItem.vue";
+import TGroupAnimation from "@/components/common/Animation/TGroupAnimation.vue";
+import TInput from "@/components/common/TInput/TInput.vue";
+import TSelectList from "@/components/common/SelectList/TSelectList.vue";
+
+const filterOption = ref("All");
+const searchOption  = ref("");
+const setFilterOption = (data: string) => {
+  filterOption.value = data;
+};
+
+const filterOptions = Object.keys(NodesViewFilterOptions).map(key => NodesViewFilterOptions[key]);
+
+const route = useRoute();
+const context = getContext();
+
+const opts = [
+{
+  runtime: Runtime.Omni,
+  resource: {
+    type: ClusterMachineStatusType,
+    namespace: DefaultNamespace,
+  },
+  selectors: [
+    `${LabelCluster}=${route.params.cluster}`
+  ],
+  idFunc: (item: ResourceTyped<ClusterMachineStatusSpec>): string => {
+    return (item?.metadata?.labels ?? {})[ClusterMachineStatusLabelNodeName] ?? item.metadata.id;
+  }
+},
+{
+  runtime: Runtime.Kubernetes,
+  resource: {
+    type: kubernetes.node,
+  },
+  context,
+  idFunc: (item: Node): string => {
+    return item.metadata!.name!;
+  }
+},
+{
+  runtime: Runtime.Talos,
+  resource: {
+    type: TalosMemberType,
+    namespace: TalosClusterNamespace,
+  },
+  context,
+  idFunc: (item: any): string => {
+    return item.metadata.id;
+  }
+}];
+
+type MemberSpec = {
+  operatingSystem: string,
+  addresses: string[],
+}
+
+const filterItems = (items: Resource<ClusterMachineStatusSpec & NodeSpec & MemberSpec, NodeStatus>[]) => {
+  return items.filter((elem: any) => {
+    const searchFields = [
+      (elem?.metadata.labels || {})[ClusterMachineStatusLabelNodeName],
+      elem?.metadata.id,
+      elem?.spec.operatingSystem,
+      (elem?.spec?.addresses ?? {})[0] ?? ""
+    ];
+
+    if (getStatus(elem) !== filterOption?.value && filterOption?.value !== NodesViewFilterOptions.ALL) {
+      return false;
+    }
+
+    if (searchOption?.value === "") {
+      return true;
+    }
+
+    for (const value of searchFields) {
+      if (value.includes(searchOption?.value)) {
+        return true;
+      }
+    }
+
+    return false;
+  })
+};
+</script>
+
+<style scoped>
+.nodes-list-heading {
+  @apply flex items-center bg-naturals-N2;
+  padding: 10px 16px;
+}
+.nodes-list-heading > p {
+  @apply text-xs text-naturals-N13 w-1/5;
+}
+</style>
diff --git a/frontend/src/views/cluster/Nodes/components/NodeDetailsTabs.vue b/frontend/src/views/cluster/Nodes/components/NodeDetailsTabs.vue
new file mode 100644
index 000000000..b4d3dd3a5
--- /dev/null
+++ b/frontend/src/views/cluster/Nodes/components/NodeDetailsTabs.vue
@@ -0,0 +1,75 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <tabs-header class="border-b border-naturals-N4 pb-3.5">
+    <tab-button is="router-link"
+      v-for="route in routes"
+      :key="route.name"
+      :to="route.to"
+      :selected="$route.name === route.to"
+    >
+      {{ route.name }}
+    </tab-button>
+  </tabs-header>
+</template>
+
+<script setup lang="ts">
+import { computed, toRefs } from 'vue';
+import { RouteLocationRaw } from 'vue-router';
+
+import TabButton from "@/components/common/Tabs/TabButton.vue"
+import TabsHeader from "@/components/common/Tabs/TabsHeader.vue"
+
+const props = defineProps<{
+  machine: string,
+}>();
+
+const { machine } = toRefs(props);
+
+const routes = computed((): {name: string, to: RouteLocationRaw }[] => {
+  return [
+    {
+      name: "Overview",
+      to: { name: "NodeOverview", params: { machine: machine.value } },
+    },
+    {
+      name: "Monitor",
+      to: { name: "NodeMonitor", params: { machine: machine.value } },
+    },
+    {
+      name: "Console Logs",
+      to: { name: "NodeLogs", params: { machine: machine.value, service: "machine" } },
+    },
+    {
+      name: "Config",
+      to: { name: "NodeConfig", params: { machine: machine.value } },
+    },
+    {
+      name: "Mounts",
+      to: { name: "NodeMounts", params: { machine: machine.value } },
+    },
+  ];
+})
+
+</script>
+
+<style scoped>
+.content {
+  @apply w-full border-b border-naturals-N4 flex;
+}
+
+.router-link-active {
+  @apply text-naturals-N13 relative;
+}
+
+.router-link-active::before {
+  @apply block absolute bg-primary-P3 w-full animate-fadein;
+  content: "";
+  height: 2px;
+  bottom: -15px;
+}
+</style>
diff --git a/frontend/src/views/cluster/Nodes/components/NodesItem.vue b/frontend/src/views/cluster/Nodes/components/NodesItem.vue
new file mode 100644
index 000000000..9b7d042e2
--- /dev/null
+++ b/frontend/src/views/cluster/Nodes/components/NodesItem.vue
@@ -0,0 +1,120 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="nodes-list-item">
+    <p class="node-name">
+      <router-link
+        :to="{ name: 'NodeOverview', params: { machine: item.metadata.id } }"
+      >
+        <WordHighlighter
+          :query="searchOption"
+          :textToHighlight="nodeName"
+          highlightClass="bg-naturals-N14"
+        />
+      </router-link>
+    </p>
+
+    <p>
+      <WordHighlighter
+        :query="searchOption"
+        :textToHighlight="ip"
+        highlightClass="bg-naturals-N14"
+      />
+    </p>
+    <p>
+      <WordHighlighter
+        :query="searchOption"
+        :textToHighlight="os"
+        highlightClass="bg-naturals-N14"
+      />
+    </p>
+    <p class="flex flex-wrap">
+      <t-tag
+        class="nodes-list-item-role"
+        v-for="role in roles"
+        :key="role"
+        :name="role"
+      />
+    </p>
+    <p>
+      <t-status :title="status"/>
+    </p>
+    <div class="nodes-list-item-menu -ml-6">
+      <node-context-menu :cluster-machine-status="item" :cluster-name="route.params.cluster as string"/>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, toRefs } from "vue";
+import { useRoute } from "vue-router";
+import { getStatus } from "@/methods";
+import { ClusterMachineStatusLabelNodeName } from "@/api/resources";
+import { Resource } from "@/api/grpc";
+import { ClusterMachineStatusSpec } from "@/api/omni/specs/omni.pb";
+import { NodeSpec, NodeStatus } from "kubernetes-types/core/v1";
+
+import TStatus from "@/components/common/Status/TStatus.vue";
+import TTag from "@/components/common/Tag/TTag.vue";
+import WordHighlighter from "vue-word-highlighter";
+import NodeContextMenu from "@/views/common/NodeContextMenu.vue";
+
+type MemberSpec = {
+  operatingSystem: string,
+  addresses: string[],
+  nodeId?: string,
+}
+
+const props = defineProps<{
+  item: Resource<ClusterMachineStatusSpec & NodeSpec & MemberSpec, NodeStatus>
+  searchOption?: string,
+}>();
+
+const { item } = toRefs(props);
+
+const os = computed(() => {
+  return item.value.spec.operatingSystem || "unknown";
+});
+
+const nodeName = computed(() => {
+  return (item.value.metadata.labels || {})[ClusterMachineStatusLabelNodeName] ?? item.value.spec.nodeId ?? item.value.metadata.id;
+});
+
+const status = computed(() => getStatus(item.value));
+
+const ip = computed(() => {
+  return (item.value?.spec?.addresses ?? {})[0] ?? "";
+});
+
+const roles = computed(() => {
+  const roles: any = [];
+
+  for (const label in item.value?.metadata.labels) {
+    if (label.indexOf("node-role.kubernetes.io/") != -1) {
+      roles.push(label.split("/")[1]);
+    }
+  }
+
+  return roles;
+});
+
+const route = useRoute();
+</script>
+
+<style scoped>
+.nodes-list-item {
+  @apply flex items-center border-b border-naturals-N4 px-4 py-4;
+}
+
+.nodes-list-item > p {
+  @apply text-xs overflow-hidden whitespace-nowrap overflow-ellipsis w-1/5;
+}
+
+.nodes-list-item > .node-name {
+  @apply text-xs text-naturals-N14 font-medium hover:text-naturals-N10 transition;
+}
+</style>
diff --git a/frontend/src/views/cluster/Nodes/components/NodesMonitorChart.vue b/frontend/src/views/cluster/Nodes/components/NodesMonitorChart.vue
new file mode 100644
index 000000000..32a2e7fd9
--- /dev/null
+++ b/frontend/src/views/cluster/Nodes/components/NodesMonitorChart.vue
@@ -0,0 +1,299 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col">
+    <div class="flex justify-between">
+      <div v-if="title" class="w-full text-left text-naturals-N13 pl-3 text-xs">
+        {{ title }}
+      </div>
+      <div
+        v-if="total"
+        class="w-full text-right pr-3 text-xs"
+      >
+        {{ total }}
+      </div>
+    </div>
+    <div id="chartContainer" class="flex-1">
+      <div
+        v-if="err || loading"
+        class="flex flex-row justify-center items-center w-full h-full"
+      >
+        <div
+          v-if="err"
+          class="flex justify-center items-center w-1/2 gap-4 text-talos-gray-500 text-sm"
+        >
+          <div class="flex-0">
+            <exclamation-circle-icon class="w-6 h-6" />
+          </div>
+          <div>{{ err }}</div>
+        </div>
+        <t-spinner v-else class="w-5 h-5"/>
+      </div>
+      <apex-chart
+        v-else
+        width="100%"
+        height="100%"
+        :type="type"
+        :options="options"
+        :series="series ?? []"
+      />
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, toRefs, computed, Ref } from "vue";
+
+import { WatchContext } from "@/api/watch";
+import ApexChart from "vue3-apexcharts";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import { ExclamationCircleIcon } from "@heroicons/vue/24/outline";
+import { DateTime } from "luxon";
+import { WatchResponse, EventType } from "@/api/omni/resources/resources.pb";
+import { WatchEventSpec, WatchFunc } from "@/api/watch";
+import { Metadata } from '@/api/v1alpha1/resource.pb';
+import { Runtime } from "@/api/common/omni.pb";
+
+type Props<T> = {
+  name: string,
+  type: string,
+  title: string,
+  resource: Metadata,
+  runtime: Runtime,
+  pointFn: (spec: T, old: T) => Record<string, number>,
+  animations?: boolean,
+  legend?: boolean,
+  dataLabels?: boolean,
+  stacked?: boolean,
+  stroke?: { curve: string, width: number | number[], dashArray?: number | number[] },
+  colors?: string[],
+  tailEvents?: number,
+  context?: WatchContext,
+  totalFn?: (spec: T, old: T) => string,
+  minFn?: (spec: T, old: T) => number,
+  maxFn?: (spec: T, old: T) => number,
+  formatter?: (value: number) => string,
+}
+
+const props = withDefaults(defineProps<Props<any>>(), {
+  stroke: () => { return { curve: "smooth", width: 2, dashArray: 0 } },
+  colors: () => ["#FFB103", '#FF8B59'],
+  tailEvents: () => 25,
+});
+
+const { name, resource, runtime, context, animations, legend, dataLabels, stroke, pointFn, colors, totalFn, tailEvents, minFn, maxFn, stacked, formatter } =
+  toRefs(props);
+
+const series: Ref<Record<string, any>[]> = ref([]);
+const seriesMap = {};
+let points = {};
+let flush = {};
+const total = ref();
+
+const min: Ref<number | undefined> = ref(undefined);
+const max: Ref<number | undefined> = ref(undefined);
+
+const handlePoint = (message: WatchResponse, spec: WatchEventSpec) => {
+  if (message.event?.event_type != EventType.UPDATED) {
+    return;
+  }
+
+  const resource = spec.res;
+  const old = spec.old;
+
+  const data = pointFn.value(resource?.spec, old?.spec);
+
+  if (totalFn?.value) {
+    total.value = totalFn.value(resource?.spec, old?.spec);
+  }
+
+  if (minFn?.value) {
+    min.value = minFn.value(resource?.spec, old?.spec);
+  }
+
+  if (maxFn?.value) {
+    max.value = maxFn.value(resource?.spec, old?.spec);
+  }
+
+  for (const key in data) {
+    if (!(key in seriesMap)) {
+      series.value.push({
+        name: key,
+        data: [],
+      });
+
+      seriesMap[key] = {
+        index: series.value.length - 1,
+        version: 0,
+      };
+    }
+
+    const version = resource?.metadata?.version || "";
+    const meta = seriesMap[key];
+    if (version <= meta.version) {
+      continue;
+    }
+
+    let point: number | number[] = data[key];
+    const updated = resource?.metadata?.updated;
+    if (updated) {
+      point = [DateTime.fromISO(updated.toString()).toMillis(), point];
+    }
+
+    clearTimeout(flush[meta.index]);
+
+    if (!points[meta.index]) points[meta.index] = [];
+
+    points[meta.index].push(point);
+    meta.version = version;
+
+    flush[meta.index] = setTimeout(() => {
+      let dst = series.value[meta.index].data;
+
+      dst = dst.concat(points[meta.index]);
+
+      if (dst.length >= tailEvents.value) {
+        dst.splice(0, dst.length - tailEvents.value + 1);
+      }
+
+      series.value[meta.index].data = dst;
+      points[meta.index] = [];
+    }, 50);
+  }
+};
+
+const w = new WatchFunc(handlePoint);
+
+w.setup({
+  resource: resource.value,
+  runtime: runtime.value,
+  tailEvents: tailEvents.value,
+  context: context?.value,
+});
+
+const options = computed(() => {
+  return {
+    chart: {
+      type: props.type,
+      background: "#00000000",
+      id: name.value,
+      zoom: {
+        enabled: false,
+      },
+      animations: {
+        enabled: animations?.value,
+      },
+      toolbar: {
+        show: false,
+      },
+      stacked: stacked?.value
+    },
+    legend: {
+      show: legend?.value,
+      formatter: formatter?.value,
+    },
+    dataLabels: {
+      enabled: dataLabels?.value,
+    },
+    stroke: stroke.value,
+    tooltip: {
+      theme: 'dark',
+      x: {
+        format: "HH:mm:ss",
+      },
+      style: {
+        fontSize: '12px',
+        fontFamily: 'Roboto',
+      },
+    },
+    colors: colors.value,
+    fill: {
+      type: "gradient",
+      gradient: {
+        shadeIntensity: 1,
+        opacityFrom: 0.4,
+        opacityTo: 0.1,
+        stops: [0, 90, 100],
+      },
+    },
+    grid: {
+      borderColor: "#272932",
+      strokeDashArray: 10,
+      xaxis: {
+        lines: {
+          show: true,
+        },
+      },
+      yaxis: {
+        lines: {
+          show: true,
+        },
+      },
+    },
+    xaxis: {
+      type: "datetime",
+      labels: {
+        datetimeFormatter: {
+          year: "yyyy",
+          month: "MMM 'yy",
+          day: "dd MMM",
+          hour: "HH:mm",
+        },
+        style: {
+          colors: '#5B5C64',
+          fontSize: '10px',
+          fontFamily: 'Roboto',
+          fontWeight: 500,
+        },
+      },
+      axisBorder: {
+        show: false,
+      },
+      axisTicks: {
+        show: false,
+      },
+    },
+    yaxis: {
+      forceNiceScale: false,
+      decimalsInFloat: 1,
+      tickAmount: 4,
+      min: min.value,
+      max: max.value,
+      labels: {
+        formatter: formatter?.value,
+        style: {
+          colors: '#5B5C64',
+          fontSize: '10px',
+          fontFamily: 'Roboto',
+          fontWeight: 500,
+        },
+      },
+    },
+  };
+});
+
+const err = w.err;
+const loading = w.loading;
+</script>
+
+<style>
+#chartContainer .apexcharts-tooltip {
+  padding: 10px 12px;
+  color: #ffff;
+  background-color: #191b24;
+}
+#chartContainer .apexcharts-tooltip-title {
+  color: #ffff;
+  background-color: #191b24;
+}
+#chartContainer .apexcharts-xaxistooltip-bottom {
+  display: none;
+}
+#chartContainer .apexcharts-tooltip .apexcharts-tooltip-series-group.active {
+  background-color: #191b24;
+}
+</style>
diff --git a/frontend/src/views/cluster/Overview/Overview.vue b/frontend/src/views/cluster/Overview/Overview.vue
new file mode 100644
index 000000000..c86e2be98
--- /dev/null
+++ b/frontend/src/views/cluster/Overview/Overview.vue
@@ -0,0 +1,25 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div>
+    <page-header :title="$route.params.cluster as string"/>
+    <overview-content :currentCluster="currentCluster" />
+  </div>
+</template>
+
+<script setup lang="ts">
+import OverviewContent from "@/views/cluster/Overview/components/OverviewContent.vue";
+import PageHeader from "@/components/common/PageHeader.vue";
+import { ResourceTyped } from "@/api/grpc";
+import { ClusterSpec } from "@/api/omni/specs/omni.pb";
+
+type Props = {
+    currentCluster: ResourceTyped<ClusterSpec>,
+};
+
+defineProps<Props>()
+</script>
diff --git a/frontend/src/views/cluster/Overview/components/OverviewCircleChart/OverviewCircleChart.vue b/frontend/src/views/cluster/Overview/components/OverviewCircleChart/OverviewCircleChart.vue
new file mode 100644
index 000000000..60933b521
--- /dev/null
+++ b/frontend/src/views/cluster/Overview/components/OverviewCircleChart/OverviewCircleChart.vue
@@ -0,0 +1,74 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="chart-wrapper">
+    <apex-chart
+      :height="200"
+      :width="200"
+      type="radialBar"
+      :options="options"
+      :series="[percentage]"
+    />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, toRefs } from "vue";
+import ApexChart from "vue3-apexcharts";
+import { primary, naturals } from "@/vars/colors";
+
+const props = defineProps<{ chartFillPercents:  number | string }>();
+
+const { chartFillPercents } = toRefs(props);
+const options = {
+  chart: {
+    dropShadow: {
+      enabled: true,
+      top: 0,
+      left: 0,
+      blur: 5,
+      color: primary.P3,
+      opacity: 0.2,
+    },
+  },
+  plotOptions: {
+    radialBar: {
+      hollow: {
+        margin: 0,
+        size: 60,
+      },
+      track: {
+        background: naturals.N0
+      },
+      dataLabels: {
+        show: false,
+      },
+    },
+  },
+  fill: {
+    colors: primary.P3,
+  },
+  stroke: {
+    lineCap: "round"
+  },
+  states: {
+    hover: {
+      filter: {
+        type: 'none',
+      }
+    },
+  }
+}
+
+const percentage = computed(() => chartFillPercents.value ?? 0);
+</script>
+
+<style scoped>
+.chart-wrapper {
+  @apply flex items-center justify-start z-0;
+}
+</style>
diff --git a/frontend/src/views/cluster/Overview/components/OverviewCircleChart/OverviewCircleChartItem.vue b/frontend/src/views/cluster/Overview/components/OverviewCircleChart/OverviewCircleChartItem.vue
new file mode 100644
index 000000000..835571fe7
--- /dev/null
+++ b/frontend/src/views/cluster/Overview/components/OverviewCircleChart/OverviewCircleChartItem.vue
@@ -0,0 +1,55 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="item">
+    <h4 class="item__name">{{ name }}</h4>
+    <overview-circle-chart :chartFillPercents="chartFillPercents" />
+    <p class="item__use">
+      {{ usageName }}
+      <span class="item__use-percents">{{ usagePercents }}%</span>
+    </p>
+    <p class="item__total">{{ usageTotal }} {{ totalLegend }}</p>
+  </div>
+</template>
+
+<script setup lang="ts">
+import OverviewCircleChart from "@/views/cluster/Overview/components/OverviewCircleChart/OverviewCircleChart.vue";
+import { toRefs } from "vue";
+
+type Props = {
+  name: string;
+  usageName: string;
+  totalLegend?: string;
+  usagePercents: number | string;
+  usageTotal: number | string;
+  chartFillPercents: number | string;
+};
+
+const props = withDefaults(defineProps<Props>(), {
+  totalLegend: "Total",
+});
+
+const { name, usageName, totalLegend, usagePercents, usageTotal, chartFillPercents } = toRefs(props);
+</script>
+
+<style scoped>
+.item {
+  @apply flex flex-col items-center justify-start mb-10 2xl:mb-0;
+}
+.item__name {
+  @apply text-xs font-medium text-naturals-N13;
+}
+.item__use {
+  @apply text-xs font-medium text-naturals-N13 mb-4;
+}
+.item__use-percents {
+  @apply text-xs font-medium text-naturals-N10 pl-2;
+}
+.item__total {
+  @apply text-xs font-medium text-naturals-N10;
+}
+</style>
diff --git a/frontend/src/views/cluster/Overview/components/OverviewContent.vue b/frontend/src/views/cluster/Overview/components/OverviewContent.vue
new file mode 100644
index 000000000..3d605065d
--- /dev/null
+++ b/frontend/src/views/cluster/Overview/components/OverviewContent.vue
@@ -0,0 +1,351 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div>
+    <div class="overview">
+      <div class="overview-container">
+        <div class="overview-charts-box relative">
+          <div class="flex flex-wrap justify-around w-full items-stretch gap-2">
+            <radial-bar
+              name="CPU"
+              :total="getNumber(usage?.spec?.cpu?.capacity)"
+              :labels="[
+                'Requests',
+                'Limits',
+              ]"
+              :series="[
+                getNumber(usage?.spec?.cpu?.requests),
+                getNumber(usage?.spec?.cpu?.limits)
+              ]"
+            />
+            <radial-bar
+              name="Pods"
+              :total="getNumber(usage?.spec?.pods?.capacity)"
+              :labels="[
+                'Requests',
+              ]"
+              :series="[
+                getNumber(usage?.spec?.pods?.count)
+              ]"
+              :formatter="(value: number) => value.toFixed(0)"
+            />
+            <radial-bar
+              name="Memory"
+              :total="getNumber(usage?.spec?.mem?.capacity)"
+              :labels="[
+                'Requests',
+                'Limits',
+              ]"
+              :series="[
+                getNumber(usage?.spec?.mem?.requests),
+                getNumber(usage?.spec?.mem?.limits)
+              ]"
+              :formatter="formatBytes"
+            />
+            <radial-bar
+              name="Ephemeral Storage"
+              :total="getNumber(usage?.spec?.storage?.capacity)"
+              :labels="[
+                'Requests',
+                'Limits',
+              ]"
+              :series="[
+                getNumber(usage?.spec?.storage?.requests),
+                getNumber(usage?.spec?.storage?.limits)
+              ]"
+              :formatter="formatBytes"
+            />
+          </div>
+        </div>
+        <div
+          class="overview-upgrade-progress"
+          v-if="kubernetesUpgradeStatus && kubernetesUpgradeStatus.spec.step"
+        >
+          <div class="overview-box-header flex items-center gap-1">
+            <span class="overview-box-title flex-1">Kubernetes Update</span>
+            <template v-if="kubernetesUpgradeStatus.spec.current_upgrade_version">
+              <span class="overview-upgrade-version">
+                {{ kubernetesUpgradeStatus.spec.last_upgrade_version }}
+              </span>
+              <span>⇾</span>
+              <span class="overview-upgrade-version">
+                {{ kubernetesUpgradeStatus.spec.current_upgrade_version }}
+              </span>
+            </template>
+            <template v-else>
+              <span class="overview-box-title">
+                Reverting back to
+              </span>
+              <span class="overview-upgrade-version">
+                {{ kubernetesUpgradeStatus.spec.last_upgrade_version }}
+              </span>
+            </template>
+          </div>
+          <div class="border-t-8 border-naturals-N4 p-4 text-xs flex items-center gap-2">
+            <t-icon icon="loading" class="animate-spin w-6 h-6 text-yellow-Y1"/>
+            <div class="flex-1">
+              {{ kubernetesUpgradeStatus.spec.step }}
+              <template v-if="kubernetesUpgradeStatus.spec.status">
+                - {{ kubernetesUpgradeStatus.spec.status }}
+              </template>
+            </div>
+            <t-button
+              v-if="kubernetesUpgradeStatus.spec.phase === KubernetesUpgradeStatusSpecPhase.Upgrading"
+              type="secondary"
+              class="place-self-end"
+              icon="close"
+              @click="revertKubernetesUpgrade(context.cluster)"
+              >Cancel</t-button
+            >
+          </div>
+        </div>
+        <div
+          class="overview-upgrade-progress"
+          v-if="talosUpgradeStatus && talosUpgradeStatus.spec.status"
+        >
+          <div class="overview-box-header flex gap-1 items-center">
+            <span class="overview-box-title flex-1">Talos Update</span>
+            <template v-if="talosUpgradeStatus.spec.current_upgrade_version">
+              <span class="overview-upgrade-version">
+                {{ talosUpgradeStatus.spec.last_upgrade_version }}
+              </span>
+              <span>⇾</span>
+              <span class="overview-upgrade-version">
+                {{ talosUpgradeStatus.spec.current_upgrade_version }}
+              </span>
+            </template>
+            <template v-else-if="talosUpgradeStatus.spec.phase === TalosUpgradeStatusSpecPhase.Reverting">
+              <span class="overview-box-title">
+                Reverting back to
+              </span>
+              <span class="overview-upgrade-version">
+                {{ talosUpgradeStatus.spec.last_upgrade_version }}
+              </span>
+            </template>
+            <template v-else>
+              <span class="overview-box-title">
+                Installing Extensions
+              </span>
+            </template>
+          </div>
+          <div class="border-t-8 border-naturals-N4 p-4 text-xs flex items-center gap-2">
+            <t-icon icon="loading" class="animate-spin w-6 h-6 text-yellow-Y1"/>
+            <div class="flex-1">
+              {{ talosUpgradeStatus.spec.status }}
+              <template v-if="talosUpgradeStatus.spec.status">
+                - {{ talosUpgradeStatus.spec.step }}
+              </template>
+            </div>
+            <t-button
+              v-if="talosUpgradeStatus.spec.phase === TalosUpgradeStatusSpecPhase.Upgrading"
+              type="secondary"
+              class="place-self-end"
+              icon="close"
+              @click="revertTalosUpgrade(context.cluster)"
+              >Cancel</t-button
+            >
+          </div>
+        </div>
+        <div class="flex gap-5">
+          <div class="overview-card flex-1 mb-5 px-6" v-if="workloadProxyingEnabled">
+            <div class="mb-3">
+              <span class="overview-box-title">Features</span>
+            </div>
+            <div class="flex flex-col gap-2">
+              <cluster-workload-proxying-checkbox :checked="enableWorkloadProxy" @click="setClusterWorkloadProxy(context.cluster, !enableWorkloadProxy)" :disabled="!canManageClusterFeatures"/>
+              <cluster-etcd-backup-checkbox :backup-status="backupStatus" @update:cluster="(spec) => setClusterEtcdBackupsConfig(context.cluster, spec)" :cluster="currentCluster.spec"/>
+            </div>
+          </div>
+          <div class="overview-card flex-1 mb-5 px-6">
+            <div class="mb-3">
+              <span class="overview-box-title">Labels</span>
+            </div>
+            <item-labels :resource="currentCluster" :add-label-func="addClusterLabels"
+              :remove-label-func="removeClusterLabels"/>
+          </div>
+        </div>
+        <div class="overview-machines-list">
+          <div class="overview-box-header">
+            <span class="overview-box-title">Machines</span>
+          </div>
+          <cluster-machines :clusterID="context.cluster"/>
+        </div>
+      </div>
+      <overview-right-panel
+        :kubernetes-upgrade-status="kubernetesUpgradeStatus"
+        :talos-upgrade-status="talosUpgradeStatus"
+        :etcd-backups="backupStatus"
+      />
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, Ref, toRefs, watch } from "vue";
+import { getContext } from "@/context";
+import { formatBytes, setupBackupStatus } from "@/methods";
+import { KubernetesUsageType, VirtualNamespace, TalosUpgradeStatusType } from "@/api/resources";
+import { Resource } from "@/api/grpc";
+import Watch from "@/api/watch";
+import { Runtime } from "@/api/common/omni.pb";
+import {
+  addClusterLabels,
+  removeClusterLabels,
+  revertKubernetesUpgrade,
+  revertTalosUpgrade,
+  setClusterWorkloadProxy,
+  setClusterEtcdBackupsConfig,
+} from "@/methods/cluster";
+import {
+  ClusterSpec,
+  KubernetesUpgradeStatusSpec,
+  KubernetesUpgradeStatusSpecPhase,
+  KubernetesUsageSpec,
+  TalosUpgradeStatusSpec,
+  TalosUpgradeStatusSpecPhase
+} from "@/api/omni/specs/omni.pb";
+import { KubernetesUpgradeStatusType, DefaultNamespace } from "@/api/resources";
+
+import ClusterMachines from "@/views/cluster/ClusterMachines/ClusterMachines.vue";
+import OverviewRightPanel from "@/views/cluster/Overview/components/OverviewRightPanel/OverviewRightPanel.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import ItemLabels from "@/views/omni/ItemLabels/ItemLabels.vue";
+import RadialBar from "@/components/common/Charts/RadialBar.vue";
+import { setupClusterPermissions } from "@/methods/auth";
+
+import { setupWorkloadProxyingEnabledFeatureWatch } from "@/methods/features";
+import ClusterWorkloadProxyingCheckbox from "@/views/omni/Clusters/ClusterWorkloadProxyingCheckbox.vue";
+import ClusterEtcdBackupCheckbox from "@/views/omni/Clusters/ClusterEtcdBackupCheckbox.vue";
+
+type Props = {
+  currentCluster: Resource<ClusterSpec>,
+};
+
+const props = defineProps<Props>()
+const { currentCluster } = toRefs(props);
+
+const enableWorkloadProxy = ref(currentCluster.value.spec.features?.enable_workload_proxy || false);
+
+watch(currentCluster, (cluster) => {
+  enableWorkloadProxy.value = cluster.spec.features?.enable_workload_proxy || false;
+});
+
+const { status: backupStatus } = setupBackupStatus();
+
+const context = getContext();
+
+const kubernetesUpgradeStatus: Ref<
+  Resource<KubernetesUpgradeStatusSpec> | undefined
+> = ref();
+const kubernetesUpgradeStatusWatch = new Watch(kubernetesUpgradeStatus);
+
+kubernetesUpgradeStatusWatch.setup({
+  runtime: Runtime.Omni,
+  resource: {
+    namespace: DefaultNamespace,
+    type: KubernetesUpgradeStatusType,
+    id: context.cluster,
+  },
+});
+
+const usage: Ref<Resource<KubernetesUsageSpec> | undefined> = ref();
+
+const usageWatch = new Watch(usage);
+
+usageWatch.setup({
+  runtime: Runtime.Omni,
+  resource: {
+    namespace: VirtualNamespace,
+    type: KubernetesUsageType,
+    id: context.cluster,
+  },
+});
+
+const getNumber = (value?: number): number => {
+  return value ?? 0;
+}
+
+const talosUpgradeStatus: Ref<
+  Resource<TalosUpgradeStatusSpec> | undefined
+> = ref();
+const talosUpgradeStatusWatch = new Watch(talosUpgradeStatus);
+
+talosUpgradeStatusWatch.setup({
+  runtime: Runtime.Omni,
+  resource: {
+    namespace: DefaultNamespace,
+    type: TalosUpgradeStatusType,
+    id: context.cluster,
+  },
+});
+
+const { canManageClusterFeatures } = setupClusterPermissions(computed(() => currentCluster.value.metadata.id as string));
+
+const workloadProxyingEnabled = setupWorkloadProxyingEnabledFeatureWatch();
+</script>
+
+<style scoped>
+.overview-card {
+    @apply py-5 bg-naturals-N2 rounded;
+}
+.divider {
+  @apply w-full bg-naturals-N4;
+  height: 1px;
+}
+.overview {
+  @apply w-full flex justify-start items-start;
+}
+.overview-container {
+  @apply w-full mr-6;
+  max-width: 80%;
+}
+@media screen and (max-width: 1050px) {
+  .overview-container {
+    @apply w-full mr-2;
+  }
+}
+.overview-title-box {
+  @apply flex items-center;
+  margin-bottom: 35px;
+}
+.overview-title {
+  @apply text-xl text-naturals-N14 mr-2;
+}
+.overview-icon {
+  @apply fill-current text-naturals-N14 w-5 h-5 cursor-pointer;
+}
+.overview-machines-list {
+  @apply flex-col overview-card;
+  padding-bottom: 0;
+}
+.overview-kubernetes-upgrade {
+  @apply mb-5 py-5 bg-naturals-N2 pb-0 rounded;
+}
+.overview-upgrade-progress {
+  @apply mb-5 py-5 bg-naturals-N2 pb-0 rounded;
+}
+.overview-box-header {
+  @apply flex pb-4 px-6;
+}
+.overview-box-title {
+  @apply text-sm text-naturals-N13;
+}
+.overview-usage-subtitle {
+  @apply text-xs text-naturals-N10;
+}
+.overview-status-box {
+  @apply w-full bg-naturals-N2 py-5 rounded flex-col pb-0;
+}
+.overview-charts-box {
+  @apply p-5 bg-naturals-N2 mb-6;
+  min-height: 100px;
+}
+.overview-upgrade-version {
+  @apply rounded bg-naturals-N4 px-2 text-sm text-naturals-N13 font-bold;
+}
+</style>
diff --git a/frontend/src/views/cluster/Overview/components/OverviewRightPanel/OverviewRightPanel.vue b/frontend/src/views/cluster/Overview/components/OverviewRightPanel/OverviewRightPanel.vue
new file mode 100644
index 000000000..ed047582c
--- /dev/null
+++ b/frontend/src/views/cluster/Overview/components/OverviewRightPanel/OverviewRightPanel.vue
@@ -0,0 +1,409 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="overview-right-box">
+    <div class="overview-right-box-wrapper">
+      <h3 class="overview-details-title">Cluster Details</h3>
+      <managed-by-templates-warning warning-style="short"/>
+      <overview-right-panel-item
+        v-if="currentCluster?.metadata?.created"
+        name="Created"
+        :value="time.formatISO(currentCluster?.metadata?.created as string, 'yyyy-LL-dd HH:mm:ss')"
+      />
+      <overview-right-panel-item name="Status" v-if="currentCluster">
+        <t-cluster-status :cluster="currentCluster" />
+      </overview-right-panel-item>
+      <overview-right-panel-item
+        name="Machines Healthy"
+        v-if="currentCluster?.spec?.machines?.total"
+        :value="`${currentCluster?.spec?.machines?.healthy ?? 0}/${currentCluster?.spec?.machines?.total}`"
+      />
+      <overview-right-panel-item
+        v-if="talosUpgradeStatus"
+        name="Talos Version"
+        @click="openClusterUpdate(Update.Talos)"
+      >
+        {{ talosVersion }}
+        <tooltip v-if="newTalosVersionsAvailable?.length" :description="`Newer Talos versions are avalable: ${newTalosVersionsAvailable.join(', ')}`">
+          <t-icon class="text-yellow-Y1 w-4 h-4 cursor-pointer" icon="arrow-up-tray" v-if="newTalosVersionsAvailable"/>
+        </tooltip>
+      </overview-right-panel-item>
+      <overview-right-panel-item
+        v-if="kubernetesUpgradeStatus"
+        name="Kubernetes Version"
+        @click="openClusterUpdate(Update.Kubernetes)"
+      >
+        {{ kubernetesVersion }}
+        <tooltip v-if="newKubernetesVersionsAvailable?.length" :description="`Newer Kubernetes versions are avalable: ${newKubernetesVersionsAvailable.join(', ')}`">
+          <t-icon class="text-yellow-Y1 w-4 h-4 cursor-pointer" icon="arrow-up-tray"/>
+        </tooltip>
+      </overview-right-panel-item>
+    </div>
+    <template v-if="currentCluster?.spec">
+      <div class="divider"/>
+      <div class="overview-right-box-wrapper overview-right-box-wrapper-moved">
+        <h3 class="overview-details-title">Control Plane</h3>
+        <overview-right-panel-item
+          name="Ready">
+          <span v-bind:class="currentCluster?.spec?.controlplaneReady ? '' : 'text-red-R1'">
+            {{ currentCluster?.spec?.controlplaneReady ? 'Yes' : 'No'  }}
+          </span>
+        </overview-right-panel-item>
+          <overview-right-panel-item
+            v-if="currentCluster?.metadata?.created"
+            name="Last Backup"
+          >
+            <div class="flex gap-1" v-if="startingEtcdBackup">
+              Starting...
+              <t-spinner class="w-4 h-4"/>
+            </div>
+            <template v-else>
+              <tooltip v-if="lastBackupError">
+                <template #description>
+                  <div class="max-w-lg break-words">{{ lastBackupError }}</div>
+                </template>
+                <t-icon class="text-yellow-Y1 w-4 h-4" icon="warning"/>
+              </tooltip>
+              {{ backupTime }}
+              <tooltip description="Trigger Etcd Backup" v-if="etcdBackups?.enabled">
+                <t-icon class="text-green-G1 w-4 h-4 cursor-pointer" icon="play-circle" @click="runEtcdBackup"/>
+              </tooltip>
+            </template>
+          </overview-right-panel-item>
+        <overview-right-panel-condition
+          v-for="condition in controlPlaneStatus?.spec.conditions"
+          :key="condition.type?.toString()"
+          :condition="condition" />
+      </div>
+      <div class="divider" />
+      <div class="overview-right-box-wrapper overview-right-box-wrapper-moved">
+        <h3 class="overview-details-title">Kubernetes</h3>
+        <overview-right-panel-item
+          name="API Available"
+          :value="currentCluster?.spec.kubernetesAPIReady ? 'Yes' : 'No'"
+        />
+        <overview-right-panel-item
+          v-if="kubernetesStatus && kubernetesStatus.spec.nodes"
+          name="Nodes"
+          :value="kubernetesStatus.spec.nodes.length ?? 0"
+        />
+      </div>
+      <div class="divider"/>
+      <div class="overview-right-box-wrapper overview-right-box-wrapper-moved">
+        <div class="overview-details-item">
+          <t-button
+            @click="() => downloadKubeconfig(currentCluster!.metadata.id!)"
+            :disabled="!canDownloadKubeconfig"
+            class="overview-item-button w-full"
+            type="primary"
+            icon="kube-config"
+            iconPosition="left"
+            >Download <code>kubeconfig</code></t-button
+          >
+        </div>
+        <div class="overview-details-item">
+          <t-button
+            @click="() => downloadTalosconfig(currentCluster!.metadata.id!)"
+            :disabled="!canDownloadTalosconfig"
+            class="overview-item-button w-full"
+            type="primary"
+            icon="talos-config"
+            iconPosition="left"
+            >Download <code>talosconfig</code></t-button
+          >
+        </div>
+      </div>
+      <div class="divider"/>
+      <div class="overview-right-box-wrapper overview-right-box-wrapper-moved">
+        <div class="overview-details-item">
+          <t-button
+            @click="() => $router.push({ name: 'ClusterScale', params: { cluster: currentCluster?.metadata?.id } })"
+            class="overview-item-button w-full"
+            type="highlighted"
+            icon="nodes"
+            iconPosition="left"
+            :disabled="!canAddClusterMachines"
+            >Cluster Scaling</t-button
+          >
+        </div>
+        <div class="overview-details-item">
+          <t-button
+            @click="openClusterUpdate(Update.Kubernetes)"
+            class="overview-item-button w-full"
+            type="primary"
+            icon="kubernetes"
+            iconPosition="left"
+            :disabled="!canUpdateKubernetes || !kubernetesUpgradeAvailable()"
+            >Update Kubernetes</t-button
+          >
+        </div>
+        <div class="overview-details-item">
+          <t-button
+            @click="openClusterUpdate(Update.Talos)"
+            class="overview-item-button w-full"
+            type="primary"
+            icon="sidero-monochrome"
+            iconPosition="left"
+            :disabled="!canUpdateTalos || !talosUpdateAvailable()"
+            >Update Talos</t-button
+          >
+        </div>
+        <div class="overview-details-item">
+          <t-button
+            @click="() => $router.push({ name: 'ClusterConfigPatches', params: { cluster: currentCluster?.metadata?.id } })"
+            class="overview-item-button w-full"
+            type="primary"
+            icon="settings"
+            iconPosition="left"
+            >Config Patches</t-button
+          >
+        </div>
+        <div class="overview-details-item">
+          <t-button
+            class="overview-item-button-red w-full"
+            type="secondary"
+            icon="delete"
+            iconPosition="left"
+            @click="() => $router.push({query: { modal: 'clusterDestroy', cluster: currentCluster?.metadata?.id }})"
+            :disabled="!canRemoveClusterMachines"
+            >Destroy Cluster</t-button
+          >
+        </div>
+      </div>
+    </template>
+    <div v-else class="flex items-center justify-center p-4">
+      <t-spinner class="w-6 h-6"/>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useRoute, useRouter } from "vue-router";
+import { computed, Ref, ref, toRefs } from "vue";
+import { time } from "@/methods/time";
+import { Resource } from "@/api/grpc";
+import Watch from "@/api/watch";
+import {
+  ClusterStatusSpec,
+  ControlPlaneStatusSpec,
+  KubernetesStatusSpec,
+  KubernetesUpgradeStatusSpec,
+  TalosUpgradeStatusSpec,
+  EtcdBackupStatusSpec,
+} from "@/api/omni/specs/omni.pb";
+import { Runtime } from "@/api/common/omni.pb";
+import {
+  ClusterStatusType,
+  ControlPlaneStatusType,
+  KubernetesStatusType,
+  DefaultNamespace,
+  EtcdBackupStatusType,
+} from "@/api/resources";
+import { BackupsStatus, downloadKubeconfig, downloadTalosconfig } from "@/methods";
+import { controlPlaneMachineSetId } from "@/methods/machineset";
+import * as semver from "semver";
+
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import TClusterStatus from "@/views/omni/Clusters/ClusterStatus.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import OverviewRightPanelItem
+  from "@/views/cluster/Overview/components/OverviewRightPanel/OverviewRightPanelItem.vue";
+import OverviewRightPanelCondition
+  from "@/views/cluster/Overview/components/OverviewRightPanel/OverviewRightPanelCondition.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import Tooltip from "@/components/common/Tooltip/Tooltip.vue";
+import { setupClusterPermissions } from "@/methods/auth";
+import { triggerEtcdBackup } from "@/methods/cluster";
+import { showError } from "@/notification";
+import ManagedByTemplatesWarning from "@/views/cluster/ManagedByTemplatesWarning.vue";
+
+const route = useRoute();
+const router = useRouter();
+
+const currentCluster: Ref<Resource<ClusterStatusSpec> | undefined> = ref();
+const currentClusterWatch = new Watch(currentCluster);
+
+const backupStatus: Ref<Resource<EtcdBackupStatusSpec> | undefined> = ref();
+const backupStatusWatch = new Watch(backupStatus);
+
+const controlPlaneStatus: Ref<Resource<ControlPlaneStatusSpec> | undefined> = ref();
+const controlPlaneStatusWatch = new Watch(controlPlaneStatus);
+
+const kubernetesStatus: Ref<Resource<KubernetesStatusSpec> | undefined> = ref();
+const kubernetesStatusWatch = new Watch(kubernetesStatus);
+
+const props = defineProps<{
+  kubernetesUpgradeStatus: Resource<KubernetesUpgradeStatusSpec> | undefined,
+  talosUpgradeStatus: Resource<TalosUpgradeStatusSpec> | undefined,
+  etcdBackups: BackupsStatus | undefined,
+}>();
+
+enum Update {
+  Talos,
+  Kubernetes
+}
+
+const { kubernetesUpgradeStatus, talosUpgradeStatus } = toRefs(props);
+
+currentClusterWatch.setup({
+  runtime: Runtime.Omni,
+  resource: {
+    namespace: DefaultNamespace,
+    type: ClusterStatusType,
+    id: route.params.cluster as string,
+  },
+});
+
+controlPlaneStatusWatch.setup({
+  runtime: Runtime.Omni,
+  resource: {
+    namespace: DefaultNamespace,
+    type: ControlPlaneStatusType,
+    id: controlPlaneMachineSetId(route.params.cluster as string),
+  },
+});
+
+kubernetesStatusWatch.setup({
+  runtime: Runtime.Omni,
+  resource: {
+    namespace: DefaultNamespace,
+    type: KubernetesStatusType,
+    id: route.params.cluster as string,
+  },
+});
+
+backupStatusWatch.setup({
+  runtime: Runtime.Omni,
+  resource: {
+    namespace: DefaultNamespace,
+    type: EtcdBackupStatusType,
+    id: route.params.cluster as string,
+  }
+});
+
+const lastBackupError = computed(() => {
+  return backupStatus.value?.spec.error;
+})
+
+const backupTime = computed(() => {
+  const t = backupStatus?.value?.spec?.last_backup_time!;
+
+  if (!t) {
+    return "Never";
+  }
+
+  return time.formatISO(t, 'yyyy-LL-dd HH:mm:ss');
+});
+
+const startingEtcdBackup = ref(false);
+
+const runEtcdBackup = async () => {
+  startingEtcdBackup.value = true;
+
+  try {
+    await triggerEtcdBackup(route.params.cluster as string);
+  } catch (e) {
+    showError("Failed to Trigger Manual Etcd Backup", e.message);
+  }
+
+  startingEtcdBackup.value = false;
+}
+
+const kubernetesUpgradeAvailable = () => {
+  return (kubernetesUpgradeStatus?.value?.spec?.upgrade_versions?.length ?? 0) > 0
+}
+
+const talosUpdateAvailable = () => {
+  return (talosUpgradeStatus?.value?.spec?.upgrade_versions?.length ?? 0) > 0
+}
+
+const getUpgradeAvailable = (spec: {last_upgrade_version?: string, current_upgrade_version?: string, upgrade_versions?: string[]}) => {
+  if (spec.current_upgrade_version || !spec.upgrade_versions || !spec.last_upgrade_version) {
+    return [];
+  }
+
+  return spec.upgrade_versions.filter((version: string) => {
+    return semver.compare(spec.last_upgrade_version, version) == -1;
+  });
+}
+
+const kubernetesVersion = computed(() => {
+  return getVersion(kubernetesUpgradeStatus.value!.spec);
+});
+
+const talosVersion = computed(() => {
+  return getVersion(talosUpgradeStatus.value!.spec);
+});
+
+const newKubernetesVersionsAvailable = computed(() => {
+  return getUpgradeAvailable(kubernetesUpgradeStatus.value!.spec);
+});
+
+const newTalosVersionsAvailable = computed(() => {
+  return getUpgradeAvailable(talosUpgradeStatus.value!.spec);
+});
+
+const getVersion = (spec: {last_upgrade_version?: string, current_upgrade_version?: string}) => {
+  if (spec.current_upgrade_version && spec.last_upgrade_version) {
+    return `${spec.last_upgrade_version} ⇾ ${spec.current_upgrade_version}`
+  }
+
+  return spec.last_upgrade_version;
+}
+
+const openClusterUpdate = (type: Update) => {
+  if (type === Update.Kubernetes && !canUpdateKubernetes.value) {
+    return;
+  }
+
+  if (type === Update.Talos && !canUpdateTalos.value) {
+    return;
+  }
+
+  const modal = type === Update.Talos ? "updateTalos" : "updateKubernetes";
+
+  router.push({ query: { modal: modal, cluster: currentCluster?.value?.metadata?.id } });
+}
+
+const {
+  canUpdateKubernetes,
+  canUpdateTalos,
+  canDownloadKubeconfig,
+  canDownloadTalosconfig,
+  canAddClusterMachines,
+  canRemoveClusterMachines,
+} = setupClusterPermissions(computed(() => route.params.cluster as string))
+</script>
+
+<style scoped>
+.divider {
+  @apply w-full bg-naturals-N4 my-3;
+  height: 1px;
+}
+
+.overview-right-box {
+  @apply py-5 bg-naturals-N2 w-full h-auto rounded mb-4;
+  max-width: 20%;
+  min-width: 270px;
+}
+
+.overview-right-box-wrapper {
+  @apply flex flex-col lg:px-6 px-2 gap-4;
+}
+
+.overview-details-title {
+  @apply text-sm text-naturals-N13;
+}
+
+.overview-item-button-red {
+  @apply text-red-R1;
+}
+
+.overview-details-item {
+  @apply flex justify-between items-center;
+}
+</style>
diff --git a/frontend/src/views/cluster/Overview/components/OverviewRightPanel/OverviewRightPanelCondition.vue b/frontend/src/views/cluster/Overview/components/OverviewRightPanel/OverviewRightPanelCondition.vue
new file mode 100644
index 000000000..a3948a928
--- /dev/null
+++ b/frontend/src/views/cluster/Overview/components/OverviewRightPanel/OverviewRightPanelCondition.vue
@@ -0,0 +1,46 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <overview-right-panel-item
+    :name="getConditionName(condition?.type)">
+      <tooltip :description="condition.reason" placement="left">
+        <span v-bind:class="condition.status === ControlPlaneStatusSpecConditionStatus.Ready ? '' : 'text-red-R1'">
+          {{ condition.status === ControlPlaneStatusSpecConditionStatus.Ready ? 'OK' : 'Not Ready' }}
+        </span>
+      </tooltip>
+  </overview-right-panel-item>
+</template>
+
+<script setup lang="ts">
+import {
+ConditionType,
+  ControlPlaneStatusSpecCondition,
+  ControlPlaneStatusSpecConditionStatus,
+} from "@/api/omni/specs/omni.pb";
+
+import OverviewRightPanelItem from "@/views/cluster/Overview/components/OverviewRightPanel/OverviewRightPanelItem.vue";
+import Tooltip from "@/components/common/Tooltip/Tooltip.vue";
+
+const mapping: Record<ConditionType | number, string> = {};
+for (const key of Object.keys(ConditionType)) {
+  mapping[ConditionType[key]] = key;
+}
+
+const getConditionName = (t?: ConditionType) => {
+  if (t === undefined) {
+    return "Unknown condition";
+  }
+
+  return mapping[t];
+}
+
+type Props = {
+  condition: ControlPlaneStatusSpecCondition;
+};
+
+defineProps<Props>();
+</script>
diff --git a/frontend/src/views/cluster/Overview/components/OverviewRightPanel/OverviewRightPanelItem.vue b/frontend/src/views/cluster/Overview/components/OverviewRightPanel/OverviewRightPanelItem.vue
new file mode 100644
index 000000000..5d709d2f5
--- /dev/null
+++ b/frontend/src/views/cluster/Overview/components/OverviewRightPanel/OverviewRightPanelItem.vue
@@ -0,0 +1,45 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="overview-details-item">
+    <div class="overview-item-name">{{ name }}</div>
+    <div class="overview-item-value">
+      <span class="overview-item-text" v-if="value">{{ value }}</span> <slot />
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+defineProps<{
+  name: string
+  value?: string | number | boolean
+}>();
+</script>
+
+<style scoped>
+.overview-details-item {
+  @apply w-full flex justify-between;
+  align-items: flex-start !important;
+}
+.overview-item-name {
+  @apply text-xs text-naturals-N11;
+  min-width: 40px;
+}
+.overview-item-value {
+  @apply text-xs text-naturals-N13 flex items-center gap-1;
+}
+.overview-item-text {
+  margin-right: 2px;
+  text-align: right;
+  word-break: break-all;
+}
+.overview-item-text svg {
+  margin-right: 2px;
+  text-align: right;
+  word-break: break-all;
+}
+</style>
diff --git a/frontend/src/views/cluster/Pods/TPods.vue b/frontend/src/views/cluster/Pods/TPods.vue
new file mode 100644
index 000000000..f44f29fdb
--- /dev/null
+++ b/frontend/src/views/cluster/Pods/TPods.vue
@@ -0,0 +1,93 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col">
+    <page-header title="All Pods"/>
+    <watch :opts="{ resource: { type: kubernetes.pod }, runtime: Runtime.Kubernetes, context }" class="flex-1" noRecordsAlert errorsAlert spinner>
+      <template #default="{ items }">
+        <div class="pods">
+          <div class="pods__search-box">
+            <t-input
+              secondary
+              placeholder="Search..."
+              v-model="inputValue"
+            />
+            <t-select-list
+              @checkedValue="setFilterOption"
+              title="Phase"
+              :defaultValue="TPodsViewFilterOptions.ALL"
+              :values="filterOptions"
+            />
+          </div>
+          <ul class="pods__table-heading">
+            <li class="pods__row-name">Namespace</li>
+            <li class="pods__row-name">Name</li>
+            <li class="pods__row-name">Phase</li>
+            <li class="pods__row-name">Node</li>
+          </ul>
+          <t-pods-list
+            :items="items"
+            :filterOption="filterOption"
+            :searchOption="inputValue"
+          />
+        </div>
+      </template>
+    </watch>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { getContext } from "@/context";
+import { kubernetes } from "@/api/resources";
+import { ref } from "vue";
+import { TPodsViewFilterOptions } from "@/constants";
+import { Runtime } from "@/api/common/omni.pb";
+
+import TInput from "@/components/common/TInput/TInput.vue";
+import Watch from "@/components/common/Watch/Watch.vue";
+import TPodsList from "@/views/cluster/Pods/components/TPodsList.vue";
+import TSelectList from "@/components/common/SelectList/TSelectList.vue";
+import PageHeader from "@/components/common/PageHeader.vue";
+
+const context = getContext();
+const filterOption = ref(TPodsViewFilterOptions.ALL);
+const inputValue = ref("");
+
+const setFilterOption = (data: TPodsViewFilterOptions) => {
+  filterOption.value = data;
+};
+
+const filterOptions = Object.keys(TPodsViewFilterOptions).map(key => TPodsViewFilterOptions[key]);
+</script>
+
+<style scoped>
+.pods {
+  @apply flex flex-col h-full pt-2;
+}
+.pods__search-box {
+  @apply flex justify-between mb-3;
+}
+.pods__table-heading {
+  @apply w-full rounded bg-naturals-N2 flex justify-between items-center mb-1;
+  padding: 10px 33px;
+}
+.pods__row-name {
+  @apply text-xs text-naturals-N13;
+}
+.pods__row-name:nth-child(1) {
+  width: 17%;
+}
+.pods__row-name:nth-child(2) {
+  width: 33%;
+}
+.pods__row-name:nth-child(3) {
+  width: 17%;
+}
+.pods__row-name:nth-child(4) {
+  width: 33%;
+}
+</style>
diff --git a/frontend/src/views/cluster/Pods/components/TPodsItem.vue b/frontend/src/views/cluster/Pods/components/TPodsItem.vue
new file mode 100644
index 000000000..d10ab7de6
--- /dev/null
+++ b/frontend/src/views/cluster/Pods/components/TPodsItem.vue
@@ -0,0 +1,242 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="row" :class="{ opened: isDropdownOpened }">
+    <t-slide-down-wrapper :isSliderOpened="isDropdownOpened">
+      <template v-slot:head
+        ><ul class="row-wrapper">
+          <li class="row-item">
+            <t-icon
+              @click="() => (isDropdownOpened = !isDropdownOpened)"
+              class="row-arrow"
+              :class="{ 'row-arrow-right--pushed': isDropdownOpened }"
+              icon="drop-up"
+            />
+            <span>
+              <WordHighlighter
+                :query="searchOption"
+                :textToHighlight="item.metadata?.namespace"
+                highlightClass="bg-naturals-N14"
+              />
+            </span>
+          </li>
+          <li class="row-item">
+            <WordHighlighter
+              :query="searchOption"
+              :textToHighlight="item.metadata?.name"
+              highlightClass="bg-naturals-N14"
+            />
+          </li>
+          <li class="row-item">
+            <t-status :title="item.status?.phase" />
+          </li>
+          <li class="row-item row-item--spaced">
+            <span>
+              <WordHighlighter
+                :query="searchOption"
+                :textToHighlight="item.spec?.nodeName"
+                highlightClass="bg-naturals-N14"
+            /></span>
+          </li>
+        </ul>
+      </template>
+      <template v-slot:body>
+        <div class="row-info-box">
+          <div class="row-info-item">
+            <p class="row-info-title">Restarts</p>
+            <p class="row-info-value">{{ restartCount }}</p>
+          </div>
+          <div class="row-info-item">
+            <p class="row-info-title">Ready Containers</p>
+            <p class="row-info-value">{{ readyContainers?.length }}</p>
+          </div>
+          <div class="row-info-item">
+            <p class="row-info-title">Age</p>
+            <p class="row-info-value">{{ item.status?.startTime ? getAge(item.status?.startTime) : "" }}</p>
+          </div>
+          <div class="row-info-item">
+            <p class="row-info-title">Pod IP</p>
+            <p class="row-info-value">{{ item.status?.podIP }}</p>
+          </div>
+        </div>
+        <div class="flex flex-col gap-2 px-7 mt-5">
+          <div class="row-info-title font-bold">
+            Containers
+          </div>
+          <div class="flex flex-wrap gap-2">
+            <div class="text-xs text-naturals-N12 rounded bg-naturals-N4 p-1 px-2" v-for="container in item.spec?.containers" :key="container.name">
+              {{ container.image }}
+            </div>
+          </div>
+        </div>
+      </template>
+    </t-slide-down-wrapper>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, toRefs } from "vue";
+import { DateTime } from "luxon";
+import { Pod } from "kubernetes-types/core/v1";
+
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import TStatus from "@/components/common/Status/TStatus.vue";
+import TSlideDownWrapper from "@/components/common/SlideDownWrapper/TSlideDownWrapper.vue";
+import WordHighlighter from "vue-word-highlighter";
+
+type Props = {
+  searchOption: string;
+  item: Pod,
+};
+
+const props = defineProps<Props>()
+
+const { item } = toRefs(props);
+
+const isDropdownOpened = ref(false);
+
+const readyContainers = computed(() =>
+  item.value?.status?.containerStatuses?.filter((item: any) => item?.ready === true)
+);
+
+const restartCount = computed(() =>
+  item.value?.status?.containerStatuses?.reduce((amount, reducer: any) => {
+    return amount + reducer.restartCount;
+  }, 0)
+);
+
+const getAge = (age: string) => {
+  const currentDate = DateTime.now();
+  const currentAge = DateTime.fromISO(age);
+
+  return currentDate
+    .diff(currentAge, ["days", "hours", "minutes"])
+    .toFormat("dd'd' hh'h' mm'm'");
+};
+</script>
+
+<style scoped>
+.row {
+  @apply relative w-full border border-transparent  flex flex-col items-center mb-1 transition-all duration-500;
+  min-width: 450px;
+  padding: 19px 14px 19px 8px;
+  border-bottom: 1px solid rgba(39, 41, 50, var(--tw-border-opacity));
+  border-radius: 4px 4px 0 0;
+}
+
+.row:last-of-type {
+  border-bottom: transparent;
+}
+.opened {
+  @apply rounded border-naturals-N5;
+}
+
+.opened:last-of-type {
+  border-bottom: 1px solid rgba(44, 46, 56, var(--tw-border-opacity));
+}
+.row-wrapper {
+  @apply w-full flex justify-start items-center;
+}
+
+.row-item {
+  @apply text-xs text-naturals-N13 flex items-center;
+}
+.row-item:nth-child(1) {
+  width: 18.1%;
+}
+.row-item:nth-child(2) {
+  width: 32.1%;
+}
+.row-item:nth-child(3) {
+  width: 16.5%;
+}
+.row-item:nth-child(4) {
+  width: 33%;
+}
+.row-item--spaced {
+  @apply flex justify-between;
+}
+.row-arrow {
+  @apply fill-current text-naturals-N11 hover:bg-naturals-N7 transition-all rounded duration-300 cursor-pointer mr-1;
+  transform: rotate(-180deg);
+  width: 24px;
+  height: 24px;
+}
+.row-arrow-right--pushed {
+  transform: rotate(0deg);
+}
+.row-action-box {
+  @apply absolute right-4;
+}
+.row-box-actions-item {
+  @apply flex items-center cursor-pointer w-full;
+  padding: 17px 14px;
+}
+.row-box-actions-item:first-of-type {
+  padding: 17px 14px 6.5px 14px;
+}
+.row-box-actions-item:last-of-type {
+  @apply border-t border-naturals-N4;
+}
+.row-actions-item-icon {
+  @apply w-4 h-4 fill-current transition-colors;
+  margin-right: 6px;
+}
+.row-actions-item-icon--delete {
+  @apply text-red-R1;
+}
+.row-actions-item-text {
+  @apply text-xs transition-colors;
+}
+.row-actions-item-text--delete {
+  @apply text-red-R1;
+}
+
+.row-box-actions-item:hover .row-actions-item-icon {
+  @apply text-naturals-N12;
+}
+.row-box-actions-item:hover .row-actions-item-text {
+  @apply text-naturals-N12;
+}
+.row-box-actions-item:hover .row-actions-item-icon--delete {
+  @apply text-red-600;
+}
+.row-box-actions-item:hover .row-actions-item-text--delete {
+  @apply text-red-600;
+}
+.row-info-box {
+  @apply flex items-center;
+  padding-top: 26px;
+}
+.row-info-item {
+  @apply text-xs text-naturals-N13 flex flex-col;
+}
+.row-info-item:nth-child(1) {
+  width: 18.1%;
+  padding-left: 28px;
+}
+.row-info-item:nth-child(2) {
+  width: 32.1%;
+}
+.row-info-item:nth-child(3) {
+  width: 16.5%;
+}
+.row-info-item:nth-child(4) {
+  width: 33%;
+}
+.row-info-title {
+  @apply text-xs text-naturals-N12;
+  margin-bottom: 7px;
+}
+.row-info-value {
+  @apply text-xs;
+}
+.box-actions-list {
+  @apply bg-naturals-N3 rounded border border-naturals-N4 flex justify-center flex-col items-start z-20;
+  min-width: 161px;
+}
+</style>
diff --git a/frontend/src/views/cluster/Pods/components/TPodsList.vue b/frontend/src/views/cluster/Pods/components/TPodsList.vue
new file mode 100644
index 000000000..1d0b2ae70
--- /dev/null
+++ b/frontend/src/views/cluster/Pods/components/TPodsList.vue
@@ -0,0 +1,86 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="list__wrapper">
+    <t-pagination
+      :items="filteredItems"
+      :perPage="PAGINATION_PER_PAGE"
+      :searchOption="searchOption"
+    >
+      <template #default="{ paginatedItems }">
+        <div class="list">
+          <t-pods-item
+            :searchOption="searchOption"
+            :item="item"
+            v-for="(item, idx) in paginatedItems"
+            :key="item?.metadata?.namespace + '/' + item?.metadata?.name || idx"
+          />
+        </div>
+      </template>
+    </t-pagination>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, toRefs } from "vue";
+import { TPodsViewFilterOptions } from "@/constants";
+import { Pod } from "kubernetes-types/core/v1";
+
+import TPodsItem from "@/views/cluster/Pods/components/TPodsItem.vue";
+import TPagination from "@/components/common/Pagination/TPagination.vue";
+
+type Props = {
+  items: any;
+  filterOption: string;
+  searchOption: string;
+};
+
+const props = defineProps<Props>();
+
+const PAGINATION_PER_PAGE = 9;
+const { items, filterOption, searchOption } = toRefs(props);
+
+const filteredItems = computed(() => {
+  if (filterOption.value === TPodsViewFilterOptions.ALL && searchOption.value === "") {
+    return items?.value;
+  }
+
+  return items?.value?.filter((elem: Pod) => {
+    if (filterOption.value !== TPodsViewFilterOptions.ALL && elem?.status?.phase !== filterOption.value) {
+      return false;
+    }
+
+    if (searchOption.value === "") {
+      return true;
+    }
+
+    const searchOptions = [
+      elem?.metadata?.name,
+      elem?.metadata?.namespace,
+      elem?.spec?.nodeName,
+    ];
+
+    for (const value of searchOptions) {
+      if (value?.includes(searchOption.value)) {
+        return true;
+      }
+    }
+
+    return false;
+  })
+});
+</script>
+
+<style scoped>
+.list {
+  overflow: visible;
+  flex-grow: 1;
+}
+.list__wrapper {
+  @apply flex flex-col h-full;
+}
+</style>
diff --git a/frontend/src/views/cluster/SideBar.vue b/frontend/src/views/cluster/SideBar.vue
new file mode 100644
index 000000000..f5596cd5b
--- /dev/null
+++ b/frontend/src/views/cluster/SideBar.vue
@@ -0,0 +1,125 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex-1">
+    <omni-side-bar class="border-b border-naturals-N4" />
+    <p class="text-xs text-naturals-N8 mt-5 mb-2 px-6">Cluster</p>
+    <p class="text-xs text-naturals-N13 px-6 truncate">
+      {{ $route.params.cluster }}
+    </p>
+    <t-sidebar-list :items="items" />
+
+    <exposed-service-side-bar v-if="workloadProxyingEnabled && cluster?.spec?.features?.enable_workload_proxy" />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, Ref } from "vue";
+import { useRoute } from "vue-router";
+
+import {
+  default as TSidebarList,
+  SideBarItem,
+} from "@/components/SideBar/TSideBarList.vue";
+import OmniSideBar from "@/views/omni/SideBar.vue";
+import { ResourceTyped } from "@/api/grpc";
+import Watch from "@/api/watch";
+import { ClusterSpec, KubernetesUpgradeManifestStatusSpec } from "@/api/omni/specs/omni.pb";
+import { KubernetesUpgradeManifestStatusType, DefaultNamespace, ClusterType } from "@/api/resources";
+import { Runtime } from "@/api/common/omni.pb";
+import { setupClusterPermissions } from "@/methods/auth";
+import ExposedServiceSideBar from "@/views/cluster/ExposedService/ExposedServiceSideBar.vue";
+import { setupWorkloadProxyingEnabledFeatureWatch } from "@/methods/features";
+
+const route = useRoute();
+
+const getRoute = (name: string, path: string) => {
+  return `/cluster/${route.params.cluster}${path}`;
+};
+
+const kubernetesUpgradeManifestStatus: Ref<
+  ResourceTyped<KubernetesUpgradeManifestStatusSpec> | undefined
+> = ref();
+const kubernetesUpgradeManifestStatusWatch = new Watch(
+  kubernetesUpgradeManifestStatus
+);
+
+kubernetesUpgradeManifestStatusWatch.setup({
+  runtime: Runtime.Omni,
+  resource: {
+    namespace: DefaultNamespace,
+    type: KubernetesUpgradeManifestStatusType,
+    id: route.params.cluster as string,
+  },
+});
+
+const pendingManifests = computed(() => {
+  const pending = kubernetesUpgradeManifestStatus?.value?.spec.last_fatal_error ? "!" : kubernetesUpgradeManifestStatus?.value?.spec.out_of_sync;
+
+  return pending === undefined || pending === 0 ? undefined : pending;
+});
+
+const { canSyncKubernetesManifests, canManageClusterFeatures } = setupClusterPermissions(computed(() => route.params.cluster as string));
+
+const cluster: Ref<ResourceTyped<ClusterSpec> | undefined> = ref();
+const clusterWatch = new Watch(cluster);
+clusterWatch.setup({
+  runtime: Runtime.Omni,
+  resource: {
+    namespace: DefaultNamespace,
+    type: ClusterType,
+    id: route.params.cluster as string,
+  }
+});
+
+const items = computed(() => {
+  const result: SideBarItem[] = [
+    {
+      name: "Overview",
+      route: getRoute("Overview", "/overview"),
+      icon: "overview",
+    },
+    {
+      name: "Nodes",
+      route: getRoute("Nodes", "/nodes"),
+      icon: "nodes",
+    },
+    {
+      name: "Pods",
+      route: getRoute("Pods", "/pods"),
+      icon: "podes",
+    },
+    {
+      name: "Config Patches",
+      route: getRoute("ClusterConfigPatches", "/patches"),
+      icon: "settings",
+    },
+  ];
+
+  if (canSyncKubernetesManifests.value) {
+    result.push({
+      name: "Bootstrap Manifests",
+      route: getRoute("KubernetesManifestSync", "/manifests"),
+      icon: "bootstrap-manifests",
+      label: pendingManifests.value,
+      labelColor: pendingManifests.value === "!" ? "red-R1" : undefined,
+    });
+  }
+
+  if (canManageClusterFeatures.value) {
+    result.push({
+      name: "Backups",
+      route: getRoute("EtcdBackups", "/backups"),
+      icon: "rollback",
+    });
+  }
+
+  return result;
+});
+
+const workloadProxyingEnabled = setupWorkloadProxyingEnabledFeatureWatch();
+</script>
diff --git a/frontend/src/views/cluster/SideBarNode.vue b/frontend/src/views/cluster/SideBarNode.vue
new file mode 100644
index 000000000..a8a108052
--- /dev/null
+++ b/frontend/src/views/cluster/SideBarNode.vue
@@ -0,0 +1,71 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div>
+    <div class="border-b border-naturals-N4">
+      <cluster-side-bar/>
+    </div>
+    <p class="text-xs text-naturals-N8 mt-5 mb-2 px-6">Node</p>
+    <p class="text-xs text-naturals-N13 px-6 truncate">{{ node }}</p>
+    <t-sidebar-list :items="items"/>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, onMounted, Ref } from "vue";
+import { useRoute } from "vue-router";
+import { getContext } from "@/context";
+import { ResourceService, ResourceTyped, Resource } from "@/api/grpc";
+import { Runtime } from "@/api/common/omni.pb";
+import { TalosK8sNamespace, TalosNodenameID, TalosNodenameType, TalosRuntimeNamespace, TalosServiceType } from "@/api/resources"
+import { withContext, withRuntime } from "@/api/options";
+
+import TSidebarList, { SideBarItem } from "@/components/SideBar/TSideBarList.vue";
+import ClusterSideBar from "@/views/cluster/SideBar.vue";
+
+const items: Ref<SideBarItem[]> = ref([]);
+const node = ref();
+const context = getContext();
+const route = useRoute();
+
+onMounted(async () => {
+  const response: Resource[] = await ResourceService.List(
+    {
+      type: TalosServiceType,
+      namespace: TalosRuntimeNamespace,
+    },
+    withRuntime(Runtime.Talos),
+    withContext(context),
+  );
+
+  const nodename: ResourceTyped<{ nodename: string }> = await ResourceService.Get(
+    {
+      type: TalosNodenameType,
+      id: TalosNodenameID,
+      namespace: TalosK8sNamespace,
+    },
+    withRuntime(Runtime.Talos),
+    withContext(context),
+  );
+  node.value = nodename.spec.nodename;
+
+  items.value = [];
+
+  for (const service of response) {
+    items.value.push({
+      name: service.metadata.id!,
+      route: {
+        name: "NodeLogs",
+        params: {
+          machine: route.params.machine as string,
+          service: service.metadata.id!
+        },
+      },
+    })
+  }
+});
+</script>
diff --git a/frontend/src/views/common/Forbidden.vue b/frontend/src/views/common/Forbidden.vue
new file mode 100644
index 000000000..5e8663a0d
--- /dev/null
+++ b/frontend/src/views/common/Forbidden.vue
@@ -0,0 +1,24 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex items-center justify-center">
+    <div class="flex flex-col items-center">
+      <div class="code">403</div>
+      <div class="text-xl text-center">Access Denied</div>
+    </div>
+  </div>
+</template>
+
+<style scoped>
+.code {
+  @apply font-bold text-naturals-N2;
+  font-size: 300px;
+  line-height: 300px;
+}
+</style>
+<script setup lang="ts">
+</script>
\ No newline at end of file
diff --git a/frontend/src/views/common/NodeContextMenu.vue b/frontend/src/views/common/NodeContextMenu.vue
new file mode 100644
index 000000000..ae0a71527
--- /dev/null
+++ b/frontend/src/views/common/NodeContextMenu.vue
@@ -0,0 +1,99 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <t-actions-box style="height: 24px">
+    <t-actions-box-item
+      icon="log"
+      @click.stop="$router.push({ name: 'MachineLogs', params: { machine: clusterMachineStatus.metadata.id! } })"
+    >
+      Logs
+    </t-actions-box-item>
+    <t-actions-box-item
+      icon="power"
+      @click="shutdownNode"
+    >Shutdown</t-actions-box-item>
+    <t-actions-box-item
+      icon="reboot"
+      @click="rebootNode"
+    >Reboot</t-actions-box-item>
+    <t-actions-box-item
+      v-if="clusterMachineStatus.spec.stage === ClusterMachineStatusSpecStage.BEFORE_DESTROY"
+      icon="rollback"
+      @click.stop="restoreNode"
+    >
+      Cancel Destroy
+    </t-actions-box-item>
+    <t-actions-box-item
+      v-else-if="!deleteDisabled"
+      icon="delete"
+      danger
+      @click.stop="deleteNode"
+    >
+      Destroy
+    </t-actions-box-item>
+  </t-actions-box>
+</template>
+
+<script setup lang="ts">
+import { useRouter } from 'vue-router';
+import { Resource } from "@/api/grpc";
+import { ClusterMachineStatusSpec, ClusterMachineStatusSpecStage } from "@/api/omni/specs/omni.pb";
+
+import TActionsBox from "@/components/common/ActionsBox/TActionsBox.vue";
+import TActionsBoxItem from "@/components/common/ActionsBox/TActionsBoxItem.vue";
+
+const router = useRouter();
+const props = defineProps<{
+  clusterName: string,
+  deleteDisabled?: boolean,
+  clusterMachineStatus: Resource<ClusterMachineStatusSpec>
+}>();
+
+const deleteNode = () => {
+  router.push({
+    query: {
+      modal: "nodeDestroy",
+      cluster: props.clusterName,
+      machine: props.clusterMachineStatus.metadata.id,
+      goback: "true",
+    },
+  });
+};
+
+const shutdownNode = () => {
+  router.push({
+    query: {
+      modal: "shutdown",
+      cluster: props.clusterName,
+      machine: props.clusterMachineStatus.metadata.id,
+      goback: "true",
+    },
+  });
+};
+
+const rebootNode = () => {
+  router.push({
+    query: {
+      modal: "reboot",
+      cluster: props.clusterName,
+      machine: props.clusterMachineStatus.metadata.id,
+      goback: "true",
+    },
+  });
+};
+
+const restoreNode = () => {
+  router.push({
+    query: {
+      modal: "nodeDestroyCancel",
+      cluster: props.clusterName,
+      machine: props.clusterMachineStatus.metadata.id,
+      goback: "true",
+    },
+  });
+};
+</script>
\ No newline at end of file
diff --git a/frontend/src/views/common/PageNotFound.vue b/frontend/src/views/common/PageNotFound.vue
new file mode 100644
index 000000000..eb25d520c
--- /dev/null
+++ b/frontend/src/views/common/PageNotFound.vue
@@ -0,0 +1,27 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex items-center justify-center">
+    <div class="flex flex-col items-center">
+      <div class="code">404</div>
+      <div class="text-xl text-center">Page not found</div>
+      <t-button class="mt-4" @click="() => $router.push({ path: '/' })">Go Back</t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import TButton from "@/components/common/Button/TButton.vue";
+</script>
+
+<style scoped>
+.code {
+  @apply font-bold text-naturals-N2;
+  font-size: 300px;
+  line-height: 300px;
+}
+</style>
diff --git a/frontend/src/views/omni/Auth/Authenticate.vue b/frontend/src/views/omni/Auth/Authenticate.vue
new file mode 100644
index 000000000..4a53192ec
--- /dev/null
+++ b/frontend/src/views/omni/Auth/Authenticate.vue
@@ -0,0 +1,238 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex items-center justify-center">
+    <div class="bg-naturals-N3 drop-shadow-md px-8 py-8 rounded-md flex flex-col gap-2">
+      <div class="flex gap-4 items-center">
+        <t-icon icon="key" class="fill-color w-6 h-6"/>
+        <div class="text-xl font-bold text-naturals-N13">
+          <div v-if="$route.query[AuthFlowQueryParam] === Auth.CLI">Authenticate CLI Access</div>
+          <div v-else-if="$route.query[AuthFlowQueryParam] === Auth.Frontend">Authenticate UI Access</div>
+          <div v-else-if="$route.query[AuthFlowQueryParam] === Auth.WorkloadProxy">Authenticate Workload Proxy Access</div>
+        </div>
+      </div>
+
+      <div v-if="!publicKeyId && $route.query[AuthFlowQueryParam] === Auth.CLI" class="mx-12">
+        Public key ID parameter is missing...
+      </div>
+      <template v-else>
+        <div v-if="!authenticated">
+          Redirecting to the authentication provider...
+        </div>
+        <div v-else-if="!identity">
+          Could not get user's email address from the authentication provider...
+        </div>
+        <template v-else>
+          <div v-if="confirmed">
+            Successfully logged in as {{identity}}, you can return to the application...
+          </div>
+          <div v-else class="w-full flex flex-col gap-4">
+            <div>The keys are going to be issued for the user:</div>
+            <user-info user="user" class="user-info"/>
+            <div class="w-full flex flex-col gap-3">
+              <t-button type="secondary" class="w-full"  @click="switchUser">Switch User</t-button>
+              <t-button v-if="$route.query[AuthFlowQueryParam] === Auth.CLI" class="w-full" type="highlighted" @click="confirmPublicKey">Grant Access</t-button>
+              <t-button v-else class="w-full" type="highlighted" @click="generatePublicKey">Log In</t-button>
+            </div>
+          </div>
+        </template>
+      </template>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useAuth0 } from "@auth0/auth0-vue";
+import { computed, onMounted, ref } from "vue";
+import { AuthService } from "@/api/omni/auth/auth.pb";
+import { showError } from "@/notification";
+import { AuthType, authType } from "@/methods";
+import { useRoute, useRouter } from "vue-router";
+import { User } from '@auth0/auth0-spa-js';
+import {
+  authBearerHeaderPrefix,
+  samlSessionHeader,
+  authHeader,
+  authPublicKeyIDQueryParam,
+  CLIAuthFlow,
+  AuthFlowQueryParam, WorkloadProxyAuthFlow, RedirectQueryParam
+} from "@/api/resources";
+import { FrontendAuthFlow } from "@/router";
+import { createKeys, saveKeys } from "@/methods/key";
+
+import TButton from "@/components/common/Button/TButton.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import UserInfo from "@/components/common/UserInfo/UserInfo.vue";
+import { withMetadata } from "@/api/options";
+import { fetchOption } from "@/api/fetch.pb";
+
+const user = ref<User | undefined>(undefined);
+let idToken = "";
+let logout: (value: any) => void;
+
+/** @description Redirect the user's top-most window to the given URL.
+ *
+ * This makes sure that the redirect works correctly when the call comes from inside an iframe.
+ *
+ * @param url The URL to redirect to.
+ */
+const redirectToURL = (url: string) => {
+  if (window.top) {
+    window.top.location.href = url;
+  } else {
+    window.location.href = url;
+  }
+}
+
+onMounted(() => {
+  if (authType.value === AuthType.Auth0) {
+    const auth0 = useAuth0();
+
+    user.value = auth0.user.value;
+    idToken = auth0.idTokenClaims.value.__raw;
+
+    logout = auth0.logout;
+  } else {
+    const navigateToLogin = () => {
+      const query: string[] = [];
+      for (const key in route.query) {
+        query.push(`${key}=${route.query[key]}`)
+      }
+
+      redirectToURL(`/login?${query.join("&")}`);
+    }
+
+    if (!identity.value) {
+      navigateToLogin();
+    }
+
+    logout = () => navigateToLogin();
+  }
+});
+
+const authenticated = computed(() => {
+  return identity.value;
+});
+
+const identity = computed(() => {
+  if (authType.value === AuthType.Auth0) {
+    return user.value?.email;
+  }
+
+  if (authType.value === AuthType.SAML) {
+    return route.query.identity as string;
+  }
+
+  return undefined;
+});
+
+const name = computed(() => {
+  if (authType.value === AuthType.Auth0) {
+    return user.value?.name;
+  }
+
+  if (authType.value === AuthType.SAML) {
+    return (route.query.fullname ?? route.query.identity) as string;
+  }
+
+  return "";
+});
+
+const picture = computed(() => {
+  return user?.value?.picture;
+});
+
+const route = useRoute();
+const router = useRouter();
+
+let publicKeyId = route.query[authPublicKeyIDQueryParam] as string;
+
+const confirmed = ref(false);
+const redirect: string = route.query[RedirectQueryParam] as string;
+
+const generatePublicKey = async () => {
+  if (!identity.value) {
+    return;
+  }
+
+  const res = await createKeys(identity.value);
+
+  publicKeyId = res.publicKeyId;
+
+  try {
+    await confirmPublicKey();
+  } catch (e) {
+    return;
+  }
+
+  try {
+    await saveKeys({
+      email: identity.value,
+      fullname: name.value ?? "",
+      picture: picture.value ?? "",
+    }, res.privateKey, res.publicKey, publicKeyId);
+  } catch (e) {
+    showError("Failed to save the key", e.message);
+
+    return;
+  }
+
+  if (!redirect) {
+    return;
+  }
+
+  if (redirect.indexOf('http://') === 0 || redirect.indexOf('https://') === 0) {
+    redirectToURL(redirect)
+
+    return;
+  }
+
+  await router.replace({ path: redirect });
+}
+
+const confirmPublicKey = async () => {
+  try {
+    const options: fetchOption[] = [];
+
+    if (authType.value === AuthType.Auth0) {
+      options.push(withMetadata({[authHeader]: authBearerHeaderPrefix + idToken}));
+    } else if (authType.value === AuthType.SAML) {
+      if (!route.query.session) {
+        throw new Error("no session");
+      }
+
+      options.push(withMetadata({[samlSessionHeader]: route.query.session as string}));
+    }
+
+    await AuthService.ConfirmPublicKey({
+      public_key_id: publicKeyId,
+    }, ...options);
+      
+    confirmed.value = true
+  } catch (e) {
+    showError("Failed to confirm public key", e.message);
+
+    throw e;
+  }
+}
+
+const switchUser = () => {
+  logout({ returnTo: window.location.origin });
+};
+
+const Auth = {
+  CLI: CLIAuthFlow,
+  Frontend: FrontendAuthFlow,
+  WorkloadProxy: WorkloadProxyAuthFlow,
+}
+</script>
+
+<style scoped>
+.user-info {
+  @apply px-6 py-2 rounded-md bg-naturals-N6;
+}
+</style>
diff --git a/frontend/src/views/omni/Auth/OIDC.vue b/frontend/src/views/omni/Auth/OIDC.vue
new file mode 100644
index 000000000..39cecf67b
--- /dev/null
+++ b/frontend/src/views/omni/Auth/OIDC.vue
@@ -0,0 +1,65 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex items-center justify-center">
+    <div class="bg-naturals-N3 drop-shadow-md px-8 py-8 rounded-md flex flex-col gap-2">
+      <div class="flex gap-4 items-center">
+        <t-icon icon="kubernetes" class="fill-color w-6 h-6"/>
+        <div class="text-xl font-bold text-naturals-N13">
+          <div>Authenticate Kubernetes Access</div>
+        </div>
+      </div>
+
+      <div v-if="!authRequestId" class="mx-12">
+        Public key ID parameter is missing...
+      </div>
+      <template v-else>
+        <div class="w-full flex flex-col gap-4">
+          <div>The Kubernetes access is going to be granted for the user:</div>
+          <user-info user="user" class="user-info"/>
+          <div class="w-full flex flex-col gap-3">
+            <t-button class="w-full" type="highlighted" @click="confirmOIDCRequest">Grant Access</t-button>
+          </div>
+        </div>
+      </template>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { showError } from "@/notification";
+import { useRoute } from "vue-router";
+import { OIDCService } from "@/api/omni/oidc/oidc.pb";
+
+import TButton from "@/components/common/Button/TButton.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import UserInfo from "@/components/common/UserInfo/UserInfo.vue";
+
+const route = useRoute();
+
+let authRequestId = route.params.authRequestId as string
+
+const confirmOIDCRequest = async () => {
+  try {
+    const response = await OIDCService.Authenticate({
+      auth_request_id: authRequestId,
+    });
+
+    window.location.href = response.redirect_url!;
+  } catch (e) {
+    showError("Failed to confirm authenticate request", e.message);
+
+    throw e;
+  }
+}
+</script>
+
+<style scoped>
+.user-info {
+  @apply px-6 py-2 rounded-md bg-naturals-N6;
+}
+</style>
diff --git a/frontend/src/views/omni/Clusters/ClusterBottomMenu.vue b/frontend/src/views/omni/Clusters/ClusterBottomMenu.vue
new file mode 100644
index 000000000..65dd95b6d
--- /dev/null
+++ b/frontend/src/views/omni/Clusters/ClusterBottomMenu.vue
@@ -0,0 +1,64 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <t-animation>
+    <div class="menu flex items-center">
+      <div class="flex flex-col">
+        <div class="menu__amount-box flex-1">
+          <span class="menu__amount-box--light">{{ controlPlanes }}</span>
+          <span class="menu__amount-box--light">Control {{ pluralize('Plane', controlPlanes, false) }},</span>
+          <span class="menu__amount-box--light">{{ workers }}</span>
+          <span class="menu__amount-box--light">{{ pluralize('Worker', workers, false) }}</span> selected
+        </div>
+        <div v-if="warning" class="text-red-R1">{{ warning }}</div>
+      </div>
+      <t-button iconPosition="left" @click="onSubmit">
+        {{ action }}
+      </t-button>
+      <t-icon class="menu__exit-button" icon="close" @click="onReset"/>
+    </div>
+  </t-animation>
+</template>
+
+<script setup lang="ts">
+import pluralize from "pluralize";
+
+import TAnimation from "@/components/common/Animation/TAnimation.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+
+defineProps<{
+  action: string,
+  controlPlanes?: number,
+  workers?: number,
+  onSubmit: () => void,
+  onReset?: () => void,
+  warning?: string
+}>();
+</script>
+
+<style scoped>
+.menu {
+  @apply bg-naturals-N3 p-5 fixed rounded z-20 flex w-full gap-4;
+  width: 452px;
+  min-height: 56px;
+  bottom: 32px;
+  left: calc(50% - 240px);
+}
+.menu__amount-box {
+  @apply text-xs text-naturals-N8 flex items-center;
+}
+.menu__amount-box--light {
+  @apply text-naturals-N13 mr-1;
+}
+.menu__buttons-box {
+  @apply flex items-center;
+}
+.menu__exit-button {
+  @apply fill-current text-naturals-N7 cursor-pointer transition-colors hover:text-naturals-N8 w-6 h-6;
+}
+</style>
diff --git a/frontend/src/views/omni/Clusters/ClusterEtcdBackupCheckbox.vue b/frontend/src/views/omni/Clusters/ClusterEtcdBackupCheckbox.vue
new file mode 100644
index 000000000..3bbcdb4f6
--- /dev/null
+++ b/frontend/src/views/omni/Clusters/ClusterEtcdBackupCheckbox.vue
@@ -0,0 +1,124 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex gap-1 items-center h-6">
+    <t-checkbox :checked="enabled"
+        @click="toggleBackupsEnabled"
+        label="Control Plane Backups"
+        class="flex-1"
+        :disabled="!backupStatus.enabled"
+      />
+    <div v-if="!backupStatus.enabled && backupStatus.configurable" class="text-xs flex gap-1 items-center">
+      <t-button v-if="canManageBackupStore" type="subtle-xs" @click="$router.push({name: 'BackupStorage'})" icon="settings" icon-position="left" class="text-xs">Configure Storage</t-button>
+      <div v-else class="truncate flex-1">Backup Storage Disabled</div>
+    </div>
+    <div class="flex text-xs items-center gap-2 h-6" v-else-if="enabled">
+      <span>Interval:</span>
+      <template v-if="!editingBackupConfig">
+        <span class="text-naturals-N13">{{ interval?.toHuman() }}</span>
+        <icon-button v-if="!editingBackupConfig" @click="startEditingBackupInterval" icon="edit"/>
+      </template>
+      <template v-else>
+        <div class="w-12">
+          <t-input
+            @keydown.escape="editingBackupConfig = false"
+            @keydown.enter="updateBackupInterval"
+            v-click-outside="() => editingBackupConfig = false"
+            type="number"
+            v-model="backupIntervalPreview"
+            compact
+            focus
+            :min="1"
+            :max="24"
+            />
+        </div>
+        <div class="text-naturals-N13">{{ pluralize('hour', backupIntervalPreview) }}</div>
+        <icon-button @click="updateBackupInterval" icon="check"/>
+      </template>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, toRefs } from "vue";
+import { Duration as GoogleProtobufDuration } from "@/api/google/protobuf/duration.pb";
+
+import TCheckbox from "@/components/common/Checkbox/TCheckbox.vue";
+import IconButton from "@/components/common/Button/IconButton.vue";
+import { time } from "@/methods/time";
+import pluralize from "pluralize";
+import { Duration } from "luxon";
+import TInput from "@/components/common/TInput/TInput.vue";
+import { BackupsStatus } from "@/methods";
+import TButton from "@/components/common/Button/TButton.vue";
+import { canManageBackupStore } from "@/methods/auth";
+
+const editingBackupConfig = ref(false);
+
+const props = defineProps<{
+  cluster: { backup_configuration?: { interval?: GoogleProtobufDuration, enabled?: boolean } },
+  backupStatus: BackupsStatus
+}>();
+
+const { cluster } = toRefs(props);
+
+const emit = defineEmits(['update:cluster']);
+
+const enabled = computed(() => {
+  return cluster.value.backup_configuration?.enabled === true;
+});
+
+const interval = computed(() => {
+  const value = cluster.value.backup_configuration?.interval;
+
+  if (!value) {
+    return undefined;
+  }
+
+  return time.parseDuration(value).shiftTo("hours");
+});
+
+const backupIntervalPreview = ref(interval.value?.hours ?? 1);
+const backupIntervalHours = ref(backupIntervalPreview.value);
+
+const toggleBackupsEnabled = () => {
+  const c = {...cluster.value};
+
+  if (!c.backup_configuration) {
+    c.backup_configuration = {};
+  }
+
+  c.backup_configuration.enabled = !c.backup_configuration.enabled;
+
+  if (!c.backup_configuration.interval) {
+    c.backup_configuration.interval = `${60 * 60}s`;
+  }
+
+  emit("update:cluster", c);
+}
+
+const startEditingBackupInterval = () => {
+  backupIntervalPreview.value = interval.value?.hours ?? 1;
+  backupIntervalHours.value = backupIntervalPreview.value;
+  editingBackupConfig.value = true;
+}
+
+const updateBackupInterval = () => {
+  backupIntervalHours.value = backupIntervalPreview.value;
+  editingBackupConfig.value = false;
+
+  const c = {...cluster.value};
+
+  if (!c.backup_configuration) {
+    c.backup_configuration = {};
+  }
+
+  c.backup_configuration.interval = time.formatDuration(Duration.fromDurationLike({ hours: backupIntervalHours.value }));
+
+  emit("update:cluster", c);
+};
+</script>
diff --git a/frontend/src/views/omni/Clusters/ClusterItem.vue b/frontend/src/views/omni/Clusters/ClusterItem.vue
new file mode 100644
index 000000000..d9d8332f3
--- /dev/null
+++ b/frontend/src/views/omni/Clusters/ClusterItem.vue
@@ -0,0 +1,183 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="clusters-box">
+    <t-slide-down-wrapper :isSliderOpened="!collapsed">
+      <template #head>
+        <div
+          @click="() => { collapsed = !collapsed }"
+          class="flex items-center bg-naturals-N1 pl-2 pr-4 py-4 hover:bg-naturals-N3 cursor-pointer"
+        >
+          <span>
+            <t-icon
+              class="collapse-button"
+              :class="{ 'collapse-button-pushed': collapsed }"
+              icon="drop-up"
+            />
+          </span>
+          <div class="clusters-grid flex-1">
+            <div class="list-item-link">
+              <router-link :to="{ name: 'ClusterOverview', params: { cluster: item?.metadata.id }}">
+                <word-highlighter
+                  :query="(searchQuery ?? '')"
+                  :textToHighlight="item.metadata.id"
+                  split-by-space
+                  highlightClass="bg-naturals-N14"
+                />
+              </router-link>
+            </div>
+            <div class="ml-1.5" id="machine-count">{{ item?.spec?.machines?.healthy ?? 0 }}/{{ item?.spec?.machines?.total ?? 0 }}</div>
+            <div/>
+            <item-labels v-if="item" :resource="item" :add-label-func="addClusterLabels"
+              :remove-label-func="removeClusterLabels"
+              @filter-label="(e) => $emit('filterLabels', e)"/>
+          </div>
+          <tooltip description="Open Cluster Dashboard" class="h-11">
+            <icon-button icon="dashboard" @click.stop="() => $router.push({ path: '/cluster/' + item?.metadata.id + '/overview' })"/>
+          </tooltip>
+          <t-actions-box style="height: 24px" @click.stop>
+            <t-actions-box-item
+              icon="nodes"
+              @click="() => $router.push({ name: 'ClusterScale', params: { cluster: item?.metadata?.id } })"
+              v-if="canAddClusterMachines"
+            >Cluster Scaling
+            </t-actions-box-item>
+            <t-actions-box-item
+              icon="settings"
+              @click="() => $router.push({ name: 'ClusterConfigPatches', params: { cluster: item?.metadata?.id } })"
+            >Config Patches
+            </t-actions-box-item>
+            <t-actions-box-item
+              icon="dashboard"
+              @click="() => $router.push({ name: 'ClusterOverview', params: { cluster: item?.metadata?.id } })"
+            >Open Dashboard
+            </t-actions-box-item>
+            <t-actions-box-item
+              icon="kube-config"
+              @click="() => downloadKubeconfig(item?.metadata?.id as string)"
+              v-if="canDownloadKubeconfig"
+            >Download <code>kubeconfig</code></t-actions-box-item>
+            <t-actions-box-item
+              icon="talos-config"
+              @click="() => downloadTalosconfig(item?.metadata?.id)"
+              v-if="canDownloadTalosconfig"
+            >Download <code>talosconfig</code></t-actions-box-item>
+            <t-actions-box-item icon="delete" danger @click="openClusterDestroy" v-if="canRemoveClusterMachines">Destroy Cluster</t-actions-box-item>
+          </t-actions-box>
+        </div>
+      </template>
+      <template #body v-if="!collapsed">
+        <cluster-machines :clusterID="item.metadata.id!"/>
+      </template>
+    </t-slide-down-wrapper>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, toRefs, ref, Ref } from "vue";
+import {
+  DefaultNamespace,
+  LabelCluster,
+  LabelMachineSet,
+  MachineSetNodeType, MachineSetType,
+} from "@/api/resources";
+import { downloadKubeconfig, downloadTalosconfig } from "@/methods";
+import { useRouter } from "vue-router";
+import { addClusterLabels, removeClusterLabels } from "@/methods/cluster";
+import { controlPlaneMachineSetId } from "@/methods/machineset";
+import { Resource, ResourceTyped } from "@/api/grpc";
+import { ClusterStatusSpec, MachineSetSpec } from "@/api/omni/specs/omni.pb";
+import { Runtime } from "@/api/common/omni.pb";
+import storageRef from "@/methods/storage";
+import WatchResource from "@/api/watch";
+
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import TActionsBox from "@/components/common/ActionsBox/TActionsBox.vue";
+import TActionsBoxItem from "@/components/common/ActionsBox/TActionsBoxItem.vue";
+import TSlideDownWrapper from "@/components/common/SlideDownWrapper/TSlideDownWrapper.vue";
+import ClusterMachines from "@/views/cluster/ClusterMachines/ClusterMachines.vue";
+import IconButton from "@/components/common/Button/IconButton.vue";
+import Tooltip from "@/components/common/Tooltip/Tooltip.vue";
+import WordHighlighter from "vue-word-highlighter";
+import ItemLabels from "@/views/omni/ItemLabels/ItemLabels.vue";
+import { setupClusterPermissions } from "@/methods/auth";
+
+const props = defineProps<{
+  item: Resource<ClusterStatusSpec>,
+  defaultOpen?: boolean,
+  searchQuery?: string
+}>();
+
+defineEmits(["filterLabels"]);
+
+const { item } = toRefs(props);
+
+const router = useRouter();
+const collapsed = storageRef(sessionStorage, `cluster-collapsed-${item?.value?.metadata?.id}`, !props.defaultOpen);
+
+const openClusterDestroy = () => {
+  router.push({
+    query: { modal: "clusterDestroy", cluster: item.value.metadata.id },
+  });
+};
+
+const machineSets: Ref<ResourceTyped<MachineSetSpec>[]> = ref([]);
+const machineSetsWatch = new WatchResource(machineSets);
+machineSetsWatch.setup(computed(() => {
+  return {
+    resource: {
+      type: MachineSetType,
+      namespace: DefaultNamespace,
+    },
+    runtime: Runtime.Omni,
+    selectors: [`${LabelCluster}=${item.value.metadata.id!}`]
+  };
+}))
+
+const { canDownloadKubeconfig, canDownloadTalosconfig, canAddClusterMachines, canRemoveClusterMachines } = setupClusterPermissions(computed(() => item.value.metadata.id!))
+
+const controlPlaneNodes = ref<Resource[]>([]);
+
+const machineNodesWatch = new WatchResource(controlPlaneNodes);
+machineNodesWatch.setup(computed(() => {
+  return {
+    resource: {
+      type: MachineSetNodeType,
+      namespace: DefaultNamespace,
+    },
+    runtime: Runtime.Omni,
+    selectors: [
+      `${LabelMachineSet}=${controlPlaneMachineSetId(item.value.metadata.id!)}`
+    ]
+  };
+}))
+</script>
+
+<style>
+.clusters-grid {
+  @apply items-center grid grid-cols-4 pr-2;
+}
+
+.clusters-grid > * {
+  @apply text-xs truncate;
+}
+
+.clusters-box {
+  @apply border border-naturals-N5 rounded overflow-hidden;
+}
+
+.collapse-button {
+  @apply fill-current text-naturals-N11 hover:bg-naturals-N7 transition-all rounded duration-300 cursor-pointer mr-1;
+  transform: rotate(-180deg);
+  width: 24px;
+  height: 24px;
+}
+
+.collapse-button-pushed {
+  transform: rotate(0);
+}
+</style>
diff --git a/frontend/src/views/omni/Clusters/ClusterMenu.vue b/frontend/src/views/omni/Clusters/ClusterMenu.vue
new file mode 100644
index 000000000..1be031f2a
--- /dev/null
+++ b/frontend/src/views/omni/Clusters/ClusterMenu.vue
@@ -0,0 +1,81 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="menu flex items-center">
+    <div class="flex flex-1 flex-col">
+      <div class="menu-amount-box flex-1">
+        <span class="menu-amount-box-light">{{ controlPlaneCount }},</span>
+        <span class="menu-amount-box-light">{{ workersCount }}</span> selected
+      </div>
+      <div v-if="warning" class="text-yellow-Y1 text-xs">{{ warning }}</div>
+    </div>
+    <t-button v-if="onReset" @click="onReset" type="secondary">
+      Cancel
+    </t-button>
+    <t-button iconPosition="left" @click="onSubmit" type="highlighted" :disabled="disabled">
+      {{ action }}
+    </t-button>
+  </div>
+</template>
+
+<script setup lang="ts">
+import pluralize from "pluralize";
+import { computed, toRefs } from "vue";
+
+import TButton from "@/components/common/Button/TButton.vue";
+
+type Props = {
+  action: string,
+  controlPlanes?: number | string,
+  workers?: number | string,
+  onSubmit: () => void,
+  onReset?: () => void,
+  warning?: string
+  disabled?: boolean
+}
+
+
+const props = withDefaults(defineProps<Props>(), {
+  disabled: false
+});
+
+const { controlPlanes, workers } = toRefs(props);
+
+const controlPlaneCount = computed(() => {
+  if (typeof controlPlanes?.value === "number") {
+    return `${controlPlanes.value} Control ${pluralize("Plane", controlPlanes.value as number, false)}`;
+  }
+
+  return `Control Planes: ${controlPlanes?.value}`;
+});
+
+const workersCount = computed(() => {
+  if (typeof workers?.value === "number") {
+    return `${workers.value} ${pluralize("Worker", workers.value as number, false)}`;
+  }
+
+  return `Workers: ${workers?.value}`;
+});
+</script>
+
+<style scoped>
+.menu {
+  @apply flex gap-4;
+}
+.menu-amount-box {
+  @apply text-xs text-naturals-N8 flex items-center;
+}
+.menu-amount-box-light {
+  @apply text-naturals-N13 mr-1;
+}
+.menu-buttons-box {
+  @apply flex items-center;
+}
+.menu-exit-button {
+  @apply fill-current text-naturals-N7 cursor-pointer transition-colors hover:text-naturals-N8 w-6 h-6;
+}
+</style>
diff --git a/frontend/src/views/omni/Clusters/ClusterStatus.vue b/frontend/src/views/omni/Clusters/ClusterStatus.vue
new file mode 100644
index 000000000..9a6801ab1
--- /dev/null
+++ b/frontend/src/views/omni/Clusters/ClusterStatus.vue
@@ -0,0 +1,96 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+    <div
+      v-bind:style="'color: ' + phaseColor(cluster)"
+      class="cluster-status-box"
+    >
+      <t-icon v-bind:icon="phaseIcon(cluster)" class="h-4" />
+      <div class="cluster-status-name">{{ phaseName(cluster) || "" }}</div>
+    </div>
+</template>
+
+<script setup lang="ts">
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import { ClusterStatusSpec, ClusterStatusSpecPhase } from "@/api/omni/specs/omni.pb";
+import { ResourceTyped } from "@/api/grpc";
+
+type Props = {
+  cluster?: ResourceTyped<ClusterStatusSpec>;
+};
+
+defineProps<Props>();
+
+const phaseName = (cluster?: ResourceTyped<ClusterStatusSpec>): string => {
+  switch (cluster?.spec.phase) {
+    case ClusterStatusSpecPhase.SCALING_UP:
+      return "Scaling Up";
+    case ClusterStatusSpecPhase.SCALING_DOWN:
+      return "Scaling Down";
+    case ClusterStatusSpecPhase.RUNNING:
+      if (cluster?.spec.ready) {
+        return "Running";
+      } else {
+        return "Not Ready";
+      }
+    case ClusterStatusSpecPhase.DESTROYING:
+      return "Destroying";
+    default:
+      return "Unknown";
+  }
+};
+
+const phaseIcon = (cluster?: ResourceTyped<ClusterStatusSpec>): string => {
+  switch (cluster?.spec.phase) {
+    case ClusterStatusSpecPhase.SCALING_UP:
+    case ClusterStatusSpecPhase.SCALING_DOWN:
+      return "loading";
+    case ClusterStatusSpecPhase.RUNNING:
+      if (cluster?.spec.ready) {
+        return "check-in-circle";
+      } else {
+        return "error";
+      }
+    case ClusterStatusSpecPhase.DESTROYING:
+      return "delete";
+    default:
+      return "unknown";
+  }
+};
+
+const phaseColor = (cluster?: ResourceTyped<ClusterStatusSpec>): string => {
+  const Y1 = "#FFB200";
+
+  switch (cluster?.spec.phase) {
+    case ClusterStatusSpecPhase.SCALING_UP:
+    case ClusterStatusSpecPhase.SCALING_DOWN:
+      return Y1;
+    case ClusterStatusSpecPhase.RUNNING:
+      if (cluster?.spec.ready) {
+        return "#69C297";
+      } else {
+        return "#FF5F2A";
+      }
+    case ClusterStatusSpecPhase.DESTROYING:
+      return "#FF5F2A";
+    default:
+      return Y1;
+  }
+};
+
+</script>
+
+<style>
+  .cluster-status-box {
+    display: flex;
+    align-items: center;
+  }
+
+  .cluster-status-name {
+    margin-left: 5px;
+  }
+</style>
diff --git a/frontend/src/views/omni/Clusters/ClusterWorkloadProxyingCheckbox.vue b/frontend/src/views/omni/Clusters/ClusterWorkloadProxyingCheckbox.vue
new file mode 100644
index 000000000..2835110a2
--- /dev/null
+++ b/frontend/src/views/omni/Clusters/ClusterWorkloadProxyingCheckbox.vue
@@ -0,0 +1,40 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <tooltip placement="bottom" v-if="workloadProxyingEnabled">
+    <template #description>
+      <div class="flex flex-col gap-1 p-2">
+        <p>Enable HTTP proxying to the Services in the cluster through Omni.</p>
+        <p>When enabled, the Services annotated with the following annotations</p>
+        <p>will be listed and accessible from the Omni Web interface:</p>
+        <div class="bg-naturals-N5 rounded px-2 py-1">
+          <p class="font-roboto">{{ ServicePortAnnotationKey }} (required)</p>
+          <p class="font-roboto">{{ ServiceLabelAnnotationKey }} (optional)</p>
+          <p class="font-roboto">{{ ServiceIconAnnotationKey }} (optional)</p>
+        </div>
+        <p>If the icon is specified, it must be a valid base64 of either a gzipped or uncompressed svg image.</p>
+      </div>
+    </template>
+    <t-checkbox :checked="checked" label="Workload Service Proxying" :disabled="disabled"/>
+  </tooltip>
+</template>
+
+<script setup lang="ts">
+import { setupWorkloadProxyingEnabledFeatureWatch } from "@/methods/features";
+import TCheckbox from "@/components/common/Checkbox/TCheckbox.vue";
+import Tooltip from "@/components/common/Tooltip/Tooltip.vue";
+import { ServiceIconAnnotationKey, ServiceLabelAnnotationKey, ServicePortAnnotationKey } from "@/api/resources";
+
+type Props = {
+  checked?: boolean;
+  disabled?: boolean;
+};
+
+defineProps<Props>();
+
+const workloadProxyingEnabled = setupWorkloadProxyingEnabledFeatureWatch();
+</script>
diff --git a/frontend/src/views/omni/Clusters/Clusters.vue b/frontend/src/views/omni/Clusters/Clusters.vue
new file mode 100644
index 000000000..a3b67dbff
--- /dev/null
+++ b/frontend/src/views/omni/Clusters/Clusters.vue
@@ -0,0 +1,93 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div>
+    <div class="flex gap-1 items-start">
+      <page-header title="Clusters" class="flex-1"/>
+      <t-button :disabled="!canCreateClusters" @click="openClusterCreate" type="highlighted">Create Cluster</t-button>
+    </div>
+    <t-list
+      :opts="{
+        resource: resource,
+        runtime: Runtime.Omni,
+        sortByField: 'created'
+      }"
+      search
+      noRecordsAlert
+      pagination
+      errorsAlert
+      ref="list"
+    >
+      <template #default="{ items, searchQuery }">
+        <div class="flex flex-col gap-2">
+          <div class="clusters-header">
+            <div class="clusters-grid">
+              <div class="pl-6">Name</div>
+              <div>Machines Healthy</div>
+              <div>Phase</div>
+              <div>Labels</div>
+            </div>
+            <div>Actions</div>
+          </div>
+          <cluster-item v-for="(item, index) in items"
+            :key="itemID(item)"
+            :defaultOpen="index === 0"
+            :search-query="searchQuery"
+            @filterLabels="filterByLabel"
+            :item="item"/>
+        </div>
+      </template>
+    </t-list>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useRouter } from "vue-router";
+import { DefaultNamespace, ClusterStatusType } from "@/api/resources";
+import { Runtime } from "@/api/common/omni.pb";
+import { itemID } from "@/api/watch";
+
+import TList from "@/components/common/List/TList.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import ClusterItem from "@/views/omni/Clusters/ClusterItem.vue";
+import PageHeader from "@/components/common/PageHeader.vue";
+import {ref, Ref} from "vue";
+import { canCreateClusters } from "@/methods/auth";
+
+const router = useRouter();
+
+const resource = {
+  namespace: DefaultNamespace,
+  type: ClusterStatusType,
+};
+
+const openClusterCreate = () => {
+  router.push({ name: "ClusterCreate" })
+};
+
+const list: Ref<{addFilterLabel: (label: {key: string, value?: string}) => void} | null> = ref(null);
+
+const filterByLabel = (e: {key: string, value?: string}) => {
+    if (list.value) {
+        list.value.addFilterLabel(e);
+    }
+}
+</script>
+
+<style scoped>
+.clusters-grid {
+  @apply flex-1 grid grid-cols-4 pr-2;
+}
+
+.clusters-header {
+  @apply flex items-center bg-naturals-N2 mb-1 px-3 py-2.5;
+}
+
+.clusters-header > * {
+  @apply text-xs;
+}
+</style>
diff --git a/frontend/src/views/omni/Clusters/Management/ClusterCreate.vue b/frontend/src/views/omni/Clusters/Management/ClusterCreate.vue
new file mode 100644
index 000000000..6e7052feb
--- /dev/null
+++ b/frontend/src/views/omni/Clusters/Management/ClusterCreate.vue
@@ -0,0 +1,365 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col">
+    <div class="flex gap-1 items-start">
+      <page-header title="Clusters" class="flex-1"/>
+    </div>
+    <div class="flex flex-col items-stretch gap-4 flex-1">
+      <div class="flex w-full gap-2 h-9">
+        <t-input
+          title="Cluster Name"
+          class="flex-1 h-full"
+          placeholder="..."
+          :model-value="state.cluster.name ?? ''"
+          @update:model-value="value => state.cluster.name = value"
+        />
+        <t-select-list
+          class="h-full"
+          title="Talos Version"
+          :values="talosVersions"
+          :defaultValue="state.cluster.talosVersion"
+          @checkedValue="(value) => (state.cluster.talosVersion = value)"
+        />
+        <t-select-list
+          class="h-full"
+          title="Kubernetes Version"
+          :values="kubernetesVersions"
+          :defaultValue="state.cluster.kubernetesVersion"
+          @checkedValue="(value) => (state.cluster.kubernetesVersion = value)"
+          ref="kubernetesVersionSelector"
+        />
+        <t-button
+          type="primary"
+          :icon="hasConfigs ? 'settings-toggle' : 'settings'"
+          @click="openPatchConfig"
+        >
+          Config Patches
+        </t-button>
+      </div>
+      <div class="text-naturals-N13">Cluster Labels</div>
+      <item-labels :resource="labelContainer" :add-label-func="addLabels" :remove-label-func="removeLabels"/>
+      <div class="text-naturals-N13">Cluster Features</div>
+      <div class="flex flex-col gap-3 max-w-sm">
+        <tooltip placement="bottom">
+          <template #description>
+            <div class="flex flex-col gap-1 p-2">
+              <p>Encrypt machine disks using Omni as a key management server.</p>
+              <p>Once cluster is created it is not possible to update encryption settings.</p>
+              <p class="text-primary-P2">This feature is only available for Talos >= 1.5.0.</p>
+            </div>
+          </template>
+          <t-checkbox :checked="state.cluster.features?.encryptDisks" label="Encrypt Disks" @click="state.cluster.features.encryptDisks = !state.cluster.features.encryptDisks && supportsEncryption" :disabled="!supportsEncryption"/>
+        </tooltip>
+        <cluster-workload-proxying-checkbox :checked="state.cluster.features.enableWorkloadProxy" @click="() => (state.cluster.features.enableWorkloadProxy = !state.cluster.features.enableWorkloadProxy)" class="h-8"/>
+        <cluster-etcd-backup-checkbox :backup-status="backupStatus" @update:cluster="(spec) => {
+          state.cluster.etcdBackupConfig = spec.backup_configuration
+        }" :cluster="{
+          backup_configuration: state.cluster.etcdBackupConfig
+        }"/>
+      </div>
+      <div class="text-naturals-N13">Machine Sets</div>
+      <MachineSets/>
+      <div class="text-naturals-N13">Available Machines</div>
+      <t-list
+        :opts="[{
+          resource: resource,
+          runtime: Runtime.Omni,
+          selectors: [
+            `${MachineStatusLabelAvailable}`,
+            `${MachineStatusLabelConnected}`,
+            `!${MachineStatusLabelInvalidState}`,
+            `${MachineStatusLabelReportingEvents}`,
+          ],
+          sortByField: 'created'
+        },
+        {
+          resource: {
+            type: MachineConfigGenOptionsType,
+            namespace: DefaultNamespace,
+          },
+          runtime: Runtime.Omni,
+        }]"
+        search
+        pagination
+        class="flex-1"
+        ref="list"
+      >
+        <template #norecords>
+          <t-alert v-if="!$slots.norecords" type="info" title="No Machines Available"
+            >Machine is available when it is connected, not allocated and is reporting Talos
+            events.</t-alert
+          >
+        </template>
+        <template #default="{ items, searchQuery }">
+          <cluster-machine-item
+            v-for="item in items"
+            :key="itemID(item)"
+            :reset="reset"
+            :item="item"
+            :search-query="searchQuery"
+            @filter-label="filterByLabel"
+          />
+        </template>
+      </t-list>
+      <div
+        v-if="state.controlPlanesCount != 0"
+        class="bg-naturals-N1 border-t border-naturals-N4 -mb-6 -mx-6 h-16 flex items-center py-3 px-5"
+      >
+        <cluster-menu
+          class="w-full"
+          :controlPlanes="state.controlPlanesCount"
+          :workers="state.workersCount"
+          :onSubmit="createCluster"
+          :onReset="() => reset++"
+          :disabled="!canCreateClusters"
+          action="Create Cluster"
+        />
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Ref, ref, onMounted, computed, watch } from "vue";
+import { Runtime } from "@/api/common/omni.pb";
+import {
+  DefaultNamespace,
+  MachineStatusType,
+  MachineStatusLabelAvailable,
+  MachineStatusLabelConnected,
+  MachineStatusLabelInvalidState,
+  MachineStatusLabelReportingEvents,
+  MachineConfigGenOptionsType,
+  TalosVersionType,
+  DefaultKubernetesVersion,
+PatchBaseWeightMachineSet,
+PatchBaseWeightCluster,
+} from "@/api/resources";
+import { TalosVersionSpec } from "@/api/omni/specs/omni.pb";
+import WatchResource, { itemID } from "@/api/watch";
+import { showError, showSuccess } from "@/notification";
+import { Resource, ResourceTyped } from "@/api/grpc";
+import { clusterSync, nextAvailableClusterName } from "@/methods/cluster";
+import { useRouter } from "vue-router";
+import { showModal } from "@/modal";
+import * as semver from "semver";
+import yaml from "js-yaml";
+
+import TButton from "@/components/common/Button/TButton.vue";
+import TInput from "@/components/common/TInput/TInput.vue";
+import TAlert from "@/components/TAlert.vue";
+import TSelectList from "@/components/common/SelectList/TSelectList.vue";
+import ClusterMachineItem from "@/views/omni/Clusters/Management/ClusterMachineItem.vue";
+import ConfigPatchEdit from "@/views/omni/Modals/ConfigPatchEdit.vue";
+import ClusterMenu from "@/views/omni/Clusters/ClusterMenu.vue";
+import PageHeader from "@/components/common/PageHeader.vue";
+import TList from "@/components/common/List/TList.vue";
+import ItemLabels from "@/views/omni/ItemLabels/ItemLabels.vue";
+import { canCreateClusters } from "@/methods/auth";
+import TCheckbox from "@/components/common/Checkbox/TCheckbox.vue";
+import Tooltip from "@/components/common/Tooltip/Tooltip.vue";
+import ClusterWorkloadProxyingCheckbox from "@/views/omni/Clusters/ClusterWorkloadProxyingCheckbox.vue";
+import ClusterEtcdBackupCheckbox from "@/views/omni/Clusters/ClusterEtcdBackupCheckbox.vue";
+import UntaintSingleNode from "@/views/omni/Modals/UntaintSingleNode.vue";
+import MachineSets from "./MachineSets.vue";
+import { initState, PatchID } from "@/states/cluster-management";
+import { setupBackupStatus } from "@/methods";
+
+const labelContainer: Ref<Resource> = computed(() => {
+  return {
+    metadata: {
+        id: "label-container",
+        labels: state.value.cluster.labels ?? {},
+    },
+    spec: {}
+  };
+});
+
+const { status: backupStatus } = setupBackupStatus();
+
+const state = initState();
+
+const addLabels = (id: string, ...labels: string[]) => {
+  state.value.addClusterLabels(labels);
+}
+
+const removeLabels = (id: string, ...keys: string[]) => {
+  state.value.removeClusterLabels(keys);
+}
+
+const supportsEncryption = computed(() => {
+  return semver.compare(state.value.cluster.talosVersion, "v1.5.0") >= 0;
+});
+
+const router = useRouter();
+
+const kubernetesVersionSelector: Ref<{ selectItem: (s: string) => void } | undefined> = ref();
+
+const talosVersionsList: Ref<ResourceTyped<TalosVersionSpec>[]> = ref([]);
+const talosVersionsWatch = new WatchResource(talosVersionsList);
+const reset = ref(0);
+
+const kubernetesVersions: Ref<string[]> = computed(() => {
+  for (const version of talosVersionsList.value) {
+    if (version.spec.version == state.value.cluster.talosVersion) {
+      return version.spec.compatible_kubernetes_versions ?? [];
+    }
+  }
+
+  return [];
+});
+
+watch(kubernetesVersions, k8sVersions => {
+  if (k8sVersions.length == 0) {
+    kubernetesVersionSelector?.value?.selectItem("")
+    return
+  }
+
+  const k8sVersionSet = new Set(k8sVersions)
+
+  if (!state.value.cluster.kubernetesVersion) {
+    kubernetesVersionSelector?.value?.selectItem(DefaultKubernetesVersion)
+
+    return
+  }
+
+  // If currently selected Kubernetes version is not supported by the chosen Talos version
+  if (!k8sVersionSet.has(state.value.cluster.kubernetesVersion)) {
+    // if the default Kubernetes version is supported by the chosen Talos version, select it
+    if (k8sVersionSet.has(DefaultKubernetesVersion)) {
+      kubernetesVersionSelector?.value?.selectItem(DefaultKubernetesVersion)
+      return
+    }
+
+    // select the latest supported Kubernetes version by the chosen Talos version (k8sVersions are sorted on backend)
+    kubernetesVersionSelector?.value?.selectItem(k8sVersions[k8sVersions.length - 1])
+  }
+});
+
+talosVersionsWatch.setup({
+  runtime: Runtime.Omni,
+  resource: {
+    type: TalosVersionType,
+    namespace: DefaultNamespace,
+  },
+});
+
+onMounted(async () => {
+  state.value.cluster.name = await nextAvailableClusterName(state.value.cluster.name ?? "talos-default");
+});
+
+const createCluster = async () => {
+  if (state.value.untaintSingleNode()) {
+    showModal(UntaintSingleNode, { onContinue: createCluster_ })
+  } else {
+    await createCluster_(false);
+  }
+};
+
+const createCluster_ = async (untaint: boolean) => {
+  if (typeof state.value.controlPlanesCount === 'number' && (state.value.controlPlanesCount - 1) % 2 !== 0) {
+    showError(
+      "Invalid Number of Control Planes",
+      "The total number of control plane nodes must be an odd number to ensure etcd stability. (Three control plane nodes are required for a highly available control plane.)"
+    )
+
+    return;
+  }
+
+  if (untaint) {
+    state.value.controlPlanes().patches[PatchID.Untaint] = {
+      data: yaml.dump({
+        cluster: {
+          allowSchedulingOnControlPlanes: true
+        }
+      }),
+      weight: PatchBaseWeightMachineSet,
+      systemPatch: true,
+    }
+  }
+
+  try {
+    await clusterSync(state.value.resources());
+  } catch (e) {
+    if (e.message && e.message.indexOf("already exists") >= 0) {
+      state.value.cluster.name = await nextAvailableClusterName("talos-default");
+    }
+
+    if (e.errorNotification) {
+      showError(e.errorNotification.title, e.errorNotification.details);
+
+      return;
+    }
+
+    showError("Failed to Create the Cluster", e.message);
+
+    return;
+  }
+
+  showSuccess(
+    "Succesfully Created Cluster",
+    `Cluster name: ${state.value.cluster.name}, control planes: ${state.value.controlPlanesCount}, workers: ${state.value.workersCount}`
+  );
+
+  const clusterName = state.value.cluster.name;
+
+  initState();
+
+  router.push({ name: "ClusterOverview", params: { cluster: clusterName } });
+}
+
+const resource = {
+  namespace: DefaultNamespace,
+  type: MachineStatusType,
+};
+
+const talosVersions = computed(() => {
+  const res: string[] = [];
+
+  for (const version of talosVersionsList.value) {
+    res.push(version.spec.version!);
+  }
+
+  return res;
+});
+
+const hasConfigs = computed(() => {
+  return Object.keys(state.value.cluster.patches).length > 0;
+});
+
+const openPatchConfig = () => {
+  showModal(ConfigPatchEdit, {
+    tabs: [
+      {
+        id: "Cluster",
+        config: state.value.cluster.patches[PatchID.Default]?.data ?? "",
+      },
+    ],
+    onSave: async (config: string) => {
+      if (config == "") {
+        delete state.value.cluster.patches[PatchID.Default];
+
+        return;
+      }
+
+      state.value.cluster.patches[PatchID.Default] = {
+        data: config,
+        weight: PatchBaseWeightCluster,
+      }
+    },
+  });
+};
+
+const list: Ref<{ addFilterLabel: (label: { key: string, value?: string }) => void } | null> = ref(null);
+
+const filterByLabel = (e: { key: string, value?: string }) => {
+  if (list.value) {
+    list.value.addFilterLabel(e);
+  }
+}
+</script>
diff --git a/frontend/src/views/omni/Clusters/Management/ClusterMachineItem.vue b/frontend/src/views/omni/Clusters/Management/ClusterMachineItem.vue
new file mode 100644
index 000000000..aefd6e496
--- /dev/null
+++ b/frontend/src/views/omni/Clusters/Management/ClusterMachineItem.vue
@@ -0,0 +1,278 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <t-list-item>
+    <template #default>
+        <div class="flex items-center text-naturals-N13">
+          <div class="truncate flex-1 flex items-center gap-2">
+            <span class="font-bold pr-2">
+              <word-highlighter
+                  :query="(searchQuery ?? '')"
+                  :textToHighlight="item?.spec?.network?.hostname ?? item?.metadata?.id"
+                  split-by-space
+                  highlightClass="bg-naturals-N14"/>
+            </span>
+            <machine-item-labels :resource="item" :add-label-func="addMachineLabels" :remove-label-func="removeMachineLabels" @filter-label="e => $emit('filterLabel', e)"/>
+          </div>
+          <div class="flex justify-end flex-initial w-128 gap-4 items-center">
+            <template v-if="machineSetIndex !== undefined">
+              <div v-if="systemDiskPath" class="pr-8 pl-3 py-1.5 text-naturals-N11 rounded border border-naturals-N6 cursor-not-allowed">
+                Install Disk: {{ systemDiskPath }}
+              </div>
+              <div v-else>
+                <t-select-list
+                  class="h-7"
+                  title="Install Disk"
+                  @checkedValue="setInstallDisk"
+                  :values="disks"
+                  :defaultValue="disks[0]"/>
+              </div>
+            </template>
+            <div>
+              <machine-set-picker :options="options" :machine-set-index="machineSetIndex" @update:machineSetIndex="value => machineSetIndex = value"/>
+            </div>
+            <div class="flex items-center">
+              <icon-button
+                class="text-naturals-N14 my-auto"
+                @click="openPatchConfig"
+                :id="machineSetIndex !== undefined ? options?.[machineSetIndex]?.id : undefined"
+                :disabled="machineSetIndex === undefined || options?.[machineSetIndex]?.disabled"
+                :icon="machineSetNode.patches[machinePatchID] && machineSetIndex ? 'settings-toggle': 'settings'"/>
+            </div>
+          </div>
+        </div>
+    </template>
+    <template #details>
+      <div class="pl-6 grid grid-cols-5">
+        <div class="mb-2 mt-4">Processors</div>
+        <div class="mb-2 mt-4">Memory</div>
+        <div class="mb-2 mt-4">Block Devices</div>
+        <div class="mb-2 mt-4">Addresses</div>
+        <div class="mb-2 mt-4">Network Interfaces</div>
+        <div>
+          <div v-for="(processor, index) in item?.spec?.hardware?.processors" :key="index">
+            {{ processor.frequency / 1000 }} GHz, {{ processor.core_count }} {{ pluralize("core", processor.core_count) }}, {{ processor.description }}
+          </div>
+        </div>
+        <div>
+          <div v-for="(mem, index) in memoryModules" :key="index">
+            {{ formatBytes((mem?.size_mb || 0) * 1024 * 1024) }} {{ mem.description }}
+          </div>
+        </div>
+        <div>
+          <div v-for="(dev, index) in item?.spec?.hardware?.blockdevices" :key="index">
+            {{ dev.linux_name }} {{ formatBytes(dev.size) }} {{ dev.type }}
+          </div>
+        </div>
+        <div>
+          <div>
+            {{ item.spec?.network?.addresses?.join(", ") }}
+          </div>
+        </div>
+        <div>
+          <div v-for="(link, index) in item?.spec?.network?.network_links" :key="index">
+            {{ link.linux_name }} {{ link.hardware_address }} {{ link.link_up ? 'UP' : 'DOWN' }}
+          </div>
+        </div>
+      </div>
+    </template>
+  </t-list-item>
+</template>
+
+<script setup lang="ts">
+import { computed, Ref, ref, toRefs, watch } from "vue";
+import { formatBytes } from "@/methods";
+import {
+  LabelControlPlaneRole, PatchBaseWeightClusterMachine, PatchWeightInstallDisk,
+} from "@/api/resources";
+import pluralize from 'pluralize';
+import { showModal } from "@/modal";
+import {
+  MachineStatusSpec,
+  MachineStatusSpecHardwareStatusBlockDevice,
+  MachineConfigGenOptionsSpec,
+} from "@/api/omni/specs/omni.pb";
+import { SiderolinkSpec } from "@/api/omni/specs/siderolink.pb";
+import { ResourceTyped } from "@/api/grpc";
+
+import TListItem from "@/components/common/List/TListItem.vue";
+import TSelectList from "@/components/common/SelectList/TSelectList.vue";
+import IconButton from "@/components/common/Button/IconButton.vue";
+import ConfigPatchEdit from "@/views/omni/Modals/ConfigPatchEdit.vue";
+import MachineItemLabels from "@/views/omni/ItemLabels/ItemLabels.vue";
+import WordHighlighter from "vue-word-highlighter";
+import {addMachineLabels, removeMachineLabels} from "@/methods/machine";
+import { MachineSet, MachineSetNode, state, PatchID } from "@/states/cluster-management";
+import MachineSetPicker, { PickerOption } from "./MachineSetPicker.vue";
+
+import yaml from "js-yaml";
+
+type MemModule = {
+  size_mb?: number,
+  description?: string
+}
+
+defineEmits(['filterLabel']);
+
+const props = defineProps<{
+  item: ResourceTyped<MachineStatusSpec & SiderolinkSpec & MachineConfigGenOptionsSpec>,
+  reset?: number,
+  searchQuery?: string
+}>();
+
+const { item, reset } = toRefs(props);
+
+const machineSetNode = ref<MachineSetNode>({
+  patches: {},
+});
+const machineSetIndex = ref<number | undefined>();
+const systemDiskPath: Ref<string | undefined> = ref();
+const disks: Ref<string[]> = ref([]);
+
+const computeDisks = () => {
+  const bds: MachineStatusSpecHardwareStatusBlockDevice[] = item?.value?.spec?.hardware?.blockdevices || [];
+  const diskPaths: string[] = [];
+
+  const index = bds?.findIndex((device: MachineStatusSpecHardwareStatusBlockDevice) => device.system_disk);
+  if (index >= 0) {
+    systemDiskPath.value = bds[index].linux_name;
+  }
+
+  for (const device of bds) {
+    diskPaths.push(device.linux_name!);
+  }
+
+  disks.value = diskPaths;
+}
+
+computeDisks();
+
+watch(item, computeDisks);
+
+watch(machineSetIndex, (val?: number, old?: number) => {
+  if (val !== undefined) {
+    state.value.setMachine(val, item.value.metadata.id!, machineSetNode.value);
+  }
+
+  if (old !== undefined) {
+    state.value.removeMachine(old, item.value.metadata.id!);
+  }
+});
+
+if (reset) {
+  watch(reset, () => {
+    machineSetIndex.value = undefined;
+  });
+}
+
+watch(machineSetNode, () => {
+  if (!machineSetIndex.value) {
+    return;
+  }
+
+  state.value.setMachine(machineSetIndex.value, item.value.metadata.id!, machineSetNode.value);
+});
+
+const filterValid = (modules: MemModule[]): MemModule[] => {
+  return modules.filter((mem) => mem.size_mb);
+};
+
+const memoryModules = computed(() => {
+  return filterValid(item?.value?.spec?.hardware?.memory_modules || []);
+});
+
+const options: Ref<PickerOption[]> = computed(() => {
+  let memoryCapacity = 0;
+  for (const mem of memoryModules.value) {
+    memoryCapacity += mem.size_mb ?? 0;
+  }
+
+  const cpMemoryThreshold = 2 * 1024;
+  const workerMemoryTheshold = 1024;
+
+  const canUseAsControlPlane = memoryCapacity == 0 || memoryCapacity >= cpMemoryThreshold;
+  const canUseAsWorker = memoryCapacity == 0 || memoryCapacity >= workerMemoryTheshold;
+
+  return state.value.machineSets.map((ms: MachineSet) => {
+    let disabled = ms.role === LabelControlPlaneRole ? !canUseAsControlPlane : !canUseAsWorker;
+    let tooltip: string | undefined;
+
+    if (disabled) {
+      if (ms.role === LabelControlPlaneRole) {
+        tooltip = `The node must have more than ${formatBytes(cpMemoryThreshold * 1024 * 1024)} of RAM to be used as a control plane`;
+      } else {
+        tooltip = `The node must have more than ${formatBytes(workerMemoryTheshold * 1024 * 1024)} of RAM to be used as a worker`;
+      }
+    }
+
+    if (ms.machineClass) {
+      disabled = true;
+      tooltip = `The machine class ${ms.id} is using machine class so no manual allocation is possible`
+    }
+
+    return {
+      id: ms.id,
+      disabled: disabled,
+      tooltip: tooltip,
+      color: ms.color,
+    }
+  });
+});
+
+const machinePatchID = `cm-${item.value.metadata.id!}`;
+const installDiskPatchID = `cm-${item.value.metadata.id!}-${PatchID.InstallDisk}`;
+
+const setInstallDisk = (value: string) => {
+  machineSetNode.value.patches[installDiskPatchID] = {
+    data: yaml.dump({
+      machine: {
+        install: {
+          disk: value,
+        }
+      }
+    }),
+    systemPatch: true,
+    weight: PatchWeightInstallDisk,
+    nameAnnotation: PatchID.InstallDisk,
+  };
+};
+
+const openPatchConfig = () => {
+  showModal(
+    ConfigPatchEdit,
+    {
+      tabs: [
+        {
+          config: machineSetNode.value.patches[machinePatchID]?.data ?? `# Machine config patch for node "${item.value.metadata.id}"
+
+# You can write partial Talos machine config here which will override the default
+# Talos machine config for this machine generated by Omni.
+
+# example (changing the node hostname):
+machine:
+  network:
+    hostname: "${item.value.metadata.id}"
+`,
+          id: `Node ${item.value.metadata.id}`,
+        }
+      ],
+      onSave(config: string) {
+        if (!config) {
+          delete machineSetNode.value.patches[machinePatchID];
+
+          return;
+        }
+
+        machineSetNode.value.patches[machinePatchID] = {
+          data: config,
+          weight: PatchBaseWeightClusterMachine,
+        };
+      }
+    },
+  )
+};
+</script>
diff --git a/frontend/src/views/omni/Clusters/Management/ClusterScale.vue b/frontend/src/views/omni/Clusters/Management/ClusterScale.vue
new file mode 100644
index 000000000..1680e4617
--- /dev/null
+++ b/frontend/src/views/omni/Clusters/Management/ClusterScale.vue
@@ -0,0 +1,163 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col gap-3">
+    <page-header :title="`Add Machines to Cluster ${$route.params.cluster}`"/>
+    <managed-by-templates-warning :cluster="currentCluster"/>
+    <template v-if="existingResources.length > 0">
+      <div class="text-naturals-N13">Machine Sets</div>
+      <machine-sets/>
+      <div class="text-naturals-N13">Available Machines</div>
+      <watch
+        class="flex-1"
+        :opts="[{
+          resource: resource,
+          selectors: [
+            `${MachineStatusLabelAvailable}`,
+            `${MachineStatusLabelConnected}`,
+            `!${MachineStatusLabelInvalidState}`,
+            `${MachineStatusLabelReportingEvents}`
+          ],
+          runtime: Runtime.Omni,
+          sortByField: 'created',
+        },
+        {
+          resource: {
+            type: MachineConfigGenOptionsType,
+            namespace: DefaultNamespace,
+          },
+          runtime: Runtime.Omni,
+        }]"
+        errorsAlert
+        noRecordsAlert
+        spinner
+      >
+        <template #norecords>
+          <t-alert
+            v-if="!$slots.norecords"
+            type="info"
+            title="No Machines Available"
+            >Machine is available when it is connected, not allocated and is reporting Talos events.</t-alert
+          >
+        </template>
+        <template #default="{ items }">
+          <cluster-machine-item
+            v-for="item in items"
+            :key="itemID(item)"
+            :item="item"
+          />
+        </template>
+      </watch>
+      <div
+        class="bg-naturals-N1 border-t border-naturals-N4 -mb-6 -mx-6 h-16 flex items-center py-3 px-5">
+        <cluster-menu
+          class="w-full"
+          :controlPlanes="state.controlPlanesCount"
+          :workers="state.workersCount"
+          :onSubmit="scaleCluster"
+          action="Update"
+          :warning="quorumWarning"
+        />
+      </div>
+    </template>
+    <div v-else class="flex-1 flex items-center justify-center">
+      <t-spinner class="w-6 h-6"/>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, computed, onMounted } from "vue";
+import {
+  DefaultNamespace,
+  MachineStatusType,
+  MachineConfigGenOptionsType,
+  MachineStatusLabelAvailable,
+  MachineStatusLabelConnected,
+  MachineStatusLabelInvalidState,
+  MachineStatusLabelReportingEvents,
+} from "@/api/resources";
+import { showError, showSuccess } from "@/notification";
+import { useRoute, useRouter } from "vue-router";
+import { Runtime } from "@/api/common/omni.pb";
+import { Resource, ResourceTyped } from "@/api/grpc";
+import { itemID } from "@/api/watch";
+import { clusterSync } from "@/methods/cluster";
+import pluralize from "pluralize";
+import { populateExisting, state } from "@/states/cluster-management";
+
+import TAlert from "@/components/TAlert.vue";
+import Watch from "@/components/common/Watch/Watch.vue";
+import ClusterMachineItem from "@/views/omni/Clusters/Management/ClusterMachineItem.vue";
+import ClusterMenu from "@/views/omni/Clusters/ClusterMenu.vue";
+import PageHeader from "@/components/common/PageHeader.vue";
+import MachineSets from "@/views/omni/Clusters/Management/MachineSets.vue";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import ManagedByTemplatesWarning from "@/views/cluster/ManagedByTemplatesWarning.vue";
+import { ClusterSpec } from "@/api/omni/specs/omni.pb";
+
+type Props = {
+  currentCluster: ResourceTyped<ClusterSpec>,
+};
+
+defineProps<Props>();
+
+const route = useRoute();
+const router = useRouter();
+
+const quorumWarning = computed(() => {
+  if (typeof state.value.controlPlanesCount === 'string') {
+    return undefined;
+  }
+
+  const totalMachines = state.value.controlPlanesCount as number;
+
+  if ((totalMachines + 1) % 2 === 0) {
+    return undefined;
+  }
+
+  return `${pluralize("Control Plane", totalMachines, true)} will not provide fault-tolerance with etcd quorum requirements. The total number of control plane machines must be an odd number to ensure etcd stability. Please add one more machine or remove one.`;
+});
+
+const clusterName = route.params.cluster;
+
+const scaleCluster = async () => {
+  try {
+    await clusterSync(state.value.resources(), existingResources.value);
+  } catch (e) {
+    if (e.errorNotification) {
+      showError(
+        e.errorNotification.title,
+        e.errorNotification.details,
+      )
+
+      return;
+    }
+
+    showError("Failed to Scale the Cluster", e.message);
+
+    return;
+  }
+
+  await router.push({ name: 'ClusterOverview', params: { cluster: clusterName as string } });
+
+  showSuccess(
+    "Updated Cluster Configuration",
+    `Cluster name: ${clusterName}, control planes: ${state.value.controlPlanesCount}, workers: ${state.value.workersCount}`
+  );
+};
+
+const resource = {
+  namespace: DefaultNamespace,
+  type: MachineStatusType,
+};
+
+const existingResources = ref<Resource[]>([]);
+onMounted(async () => {
+  existingResources.value = await populateExisting(clusterName as string);
+});
+</script>
diff --git a/frontend/src/views/omni/Clusters/Management/MachineSetConfig.vue b/frontend/src/views/omni/Clusters/Management/MachineSetConfig.vue
new file mode 100644
index 000000000..74d761294
--- /dev/null
+++ b/frontend/src/views/omni/Clusters/Management/MachineSetConfig.vue
@@ -0,0 +1,138 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="text-xs px-2 py-2 border rounded my-1 border-naturals-N5 bg-naturals-N3 text-naturals-N13 flex gap-2 items-center">
+    <machine-set-label :color="modelValue.color" class="w-10" :machine-set-id="modelValue.id"/>
+    <div class="flex-1 flex flex-wrap items-center gap-x-4 gap-y-1">
+      <div class="w-32 truncate" :title="modelValue.name">
+        {{ modelValue.name }}
+      </div>
+      <tooltip :description="machineClasses?.length === 0 ? 'No machine classes available' : undefined">
+        <t-checkbox :checked="useMachineClasses" label="Use Machine Classes" @click="useMachineClasses = !useMachineClasses" class="h-6" :disabled="machineClasses?.length === 0"/>
+      </tooltip>
+      <template v-if="useMachineClasses">
+        <t-select-list v-if="machineClasses"
+            class="h-6 w-48"
+            @checkedValue="(value: string) => { machineClass = value }"
+            title="Machine Class"
+            :defaultValue="machineClass ?? machineClassOptions[0]"
+            :values="machineClassOptions"
+          />
+        <t-spinner v-else class="h-4 w-4"/>
+      </template>
+      <t-checkbox v-if="useMachineClasses" :checked="unlimited" label="Use All Available Machines" @click="unlimited = !unlimited" class="h-6"/>
+      <div class="w-32" v-if="!unlimited">
+        <t-input class="h-6" title="Size" v-if="useMachineClasses" type="number" :min="0" v-model="machineCount" compact/>
+        <div v-else>{{ pluralize('Machines', Object.keys(modelValue.machines).length, true) }}</div>
+      </div>
+    </div>
+    <div class="w-24 flex justify-end items-center gap-2">
+      <t-button v-if="!noRemove" class="h-6" type="compact" @click="onRemove">Remove</t-button>
+      <div class="flex flex-col justify-center">
+        <icon-button
+          @click="openPatchConfig"
+          :icon="patches[PatchID.Default] ? 'settings-toggle' : 'settings'"/>
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, toRefs, watch, Ref } from "vue";
+import { Resource } from "@/api/grpc";
+import { MachineSet, PatchID, ConfigPatch } from "@/states/cluster-management";
+import { showModal } from "@/modal";
+
+import MachineSetLabel from "@/views/omni/Clusters/Management/MachineSetLabel.vue";
+import TCheckbox from "@/components/common/Checkbox/TCheckbox.vue";
+import TSelectList from "@/components/common/SelectList/TSelectList.vue";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import TInput from "@/components/common/TInput/TInput.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import ConfigPatchEdit from "@/views/omni/Modals/ConfigPatchEdit.vue";
+import IconButton from "@/components/common/Button/IconButton.vue";
+
+import pluralize from "pluralize";
+import { PatchBaseWeightMachineSet } from "@/api/resources";
+import Tooltip from "@/components/common/Tooltip/Tooltip.vue";
+
+const emit = defineEmits(["update:modelValue"]);
+
+const props = defineProps<{
+  noRemove?: boolean,
+  onRemove?: () => void,
+  machineClasses?: Resource[],
+  modelValue: MachineSet
+}>();
+
+const { machineClasses, modelValue } = toRefs(props);
+
+const machineClassOptions = computed(() => {
+  return machineClasses?.value?.map((r: Resource) => r.metadata.id!) || [];
+});
+
+const useMachineClasses = ref(modelValue.value.machineClass !== undefined);
+const machineClass = ref(modelValue.value.machineClass?.name);
+const machineCount = ref(modelValue.value.machineClass?.size ?? 1);
+const patches: Ref<Record<string, ConfigPatch>> = ref(modelValue.value.patches);
+const unlimited = ref(modelValue.value.machineClass?.size === "unlimited");
+
+watch(modelValue, () => {
+  machineClass.value = modelValue.value.machineClass?.name;
+  machineCount.value = typeof modelValue.value.machineClass?.size === 'number' ? modelValue.value.machineClass?.size : 1;
+  patches.value = modelValue.value.patches;
+  useMachineClasses.value = modelValue.value.machineClass !== undefined;
+});
+
+watch([machineClass, machineCount, useMachineClasses, patches, unlimited], () => {
+  if (useMachineClasses.value && !machineClass.value && machineClassOptions.value.length > 0) {
+    machineClass.value = machineClassOptions.value[0];
+  }
+
+  const mc = useMachineClasses.value && machineClass.value !== undefined ? {
+    name: machineClass.value,
+    size: unlimited.value ? 'unlimited' : machineCount.value,
+  } : undefined;
+
+  const machineSet: MachineSet = {
+    ...modelValue.value,
+    machineClass: mc,
+    patches: patches.value,
+  }
+
+  emit("update:modelValue", machineSet);
+});
+
+const openPatchConfig = () => {
+  showModal(
+    ConfigPatchEdit,
+    {
+      tabs: [
+        {
+          config: patches.value[PatchID.Default]?.data ?? "",
+          id: `Machine Set ${modelValue.value.name}`,
+        }
+      ],
+      onSave(config: string) {
+        if (!config) {
+          delete patches.value[PatchID.Default];
+
+          return;
+        }
+
+        patches.value = {
+          [PatchID.Default]: {
+            data: config,
+            weight: PatchBaseWeightMachineSet,
+          },
+          ...patches.value
+        }
+      }
+    },
+  )
+};
+</script>
diff --git a/frontend/src/views/omni/Clusters/Management/MachineSetLabel.vue b/frontend/src/views/omni/Clusters/Management/MachineSetLabel.vue
new file mode 100644
index 000000000..366aab4d2
--- /dev/null
+++ b/frontend/src/views/omni/Clusters/Management/MachineSetLabel.vue
@@ -0,0 +1,15 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex items-center text-center select-none" :class="{ 'cursor-pointer': !disabled, 'cursor-not-allowed': disabled }">
+    <div class="font-roboto rounded font-bold px-1 py-0.5 resource-label" :class="{[`label-${color}`]: true, 'label-grayed-out': disabled, 'opacity-50': disabled }">{{ machineSetId }}</div>
+  </div>
+</template>
+
+<script setup lang="ts">
+defineProps<{machineSetId: string, color: string, disabled?: boolean}>();
+</script>
\ No newline at end of file
diff --git a/frontend/src/views/omni/Clusters/Management/MachineSetPicker.vue b/frontend/src/views/omni/Clusters/Management/MachineSetPicker.vue
new file mode 100644
index 000000000..b7a343fa3
--- /dev/null
+++ b/frontend/src/views/omni/Clusters/Management/MachineSetPicker.vue
@@ -0,0 +1,144 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div>
+    <radio-group v-if="options.length < 8" :modelValue="machineSetIndex" @update:modelValue="value => emit('update:machineSetIndex', value)" class="flex p-1 bg-naturals-N3 rounded gap-0.5 t-button-group">
+      <radio-group-option v-for="(option, index) in options" :key="index" v-slot="{ checked }" :value="index" as="template"
+        :disabled="option.disabled">
+        <div @click="() => onSelect(checked)">
+          <popper :disabled="!option.tooltip" hover placement="left" :interactive="false" offsetDistance="10">
+            <template #content>
+              <div class="rounded px-4 py-2 text-naturals-N10 bg-naturals-N4 drop-shadow w-48">
+                {{ option.tooltip }}
+              </div>
+            </template>
+            <div class="relative">
+              <machine-set-label class="opacity-75 hover:opacity-100 transition-opacity machine-set-label"
+                :color="option.color" :class="{ 'opacity-100': checked && !option.disabled, disabled: option?.disabled }"
+                :id="option.id"
+                :machine-set-id="option.id" :disabled="option?.disabled"/>
+              <div v-if="checked"
+                class="absolute top-0 left-0 right-0 bottom-0 bg-naturals-N12 pointer-events-none mix-blend-overlay rounded border-white border"/>
+            </div>
+          </popper>
+        </div>
+      </radio-group-option>
+    </radio-group>
+
+    <div v-else class="flex items-center justify-center bg-naturals-N3 rounded relative h-8">
+      <popper :show="showPicker" placement="left"
+              v-click-outside="() => showPicker = false">
+        <template #content>
+          <div class="bg-naturals-N3 p-1 rounded gap-1 flex flex-col items-center">
+            <icon-button icon="arrow-up" @click="optionsView.$el.scrollBy({top: -24, behavior: 'smooth'})"/>
+            <radio-group :modelValue="machineSetIndex" @update:modelValue="value => emit('update:machineSetIndex', value)"
+              @scroll.stop
+              ref="optionsView"
+              class="no-scrollbar picker">
+              <radio-group-option v-for="(option, index) in options" :key="index" v-slot="{ checked }" :value="index" as="template"
+                :disabled="option.disabled">
+                <div @click="() => onSelect(checked)">
+                  <popper :disabled="!option.tooltip" hover placement="left" :interactive="false" offsetDistance="10">
+                    <template #content>
+                      <div class="rounded px-4 py-2 text-naturals-N10 bg-naturals-N4 drop-shadow w-48">
+                        {{ option.tooltip }}
+                      </div>
+                    </template>
+                    <div class="relative">
+                      <machine-set-label class="opacity-75 hover:opacity-100 transition-opacity machine-set-label"
+                        :color="option.color" :class="{ 'opacity-100': checked && !option.disabled, disabled: option?.disabled }"
+                        :machine-set-id="option.id" :disabled="option?.disabled" />
+                      <div v-if="checked"
+                        class="absolute top-0 left-0 right-0 bottom-0 bg-naturals-N12 pointer-events-none mix-blend-overlay rounded border-white border"/>
+                    </div>
+                  </popper>
+                </div>
+              </radio-group-option>
+            </radio-group>
+            <icon-button icon="arrow-down" @click="optionsView.$el.scrollBy({top: 24, behavior: 'smooth'})"/>
+          </div>
+        </template>
+        <div class="h-6 px-1 flex gap-1 items-center" @click="() => showPicker = !showPicker" @mouseover="menuHovered = true" @mouseout="menuHovered = false">
+          <t-icon icon="arrow-left" class="w-3 mx-1 h-3 text-naturals-N7 transition-all" :class="{'text-white': menuHovered, 'scale-125': menuHovered}"/>
+          <template v-if="pickedOption">
+            <machine-set-label :machine-set-id="pickedOption?.id" :color="pickedOption?.color"/>
+            <icon-button icon="close" @click.stop="() => emit('update:machineSetIndex', undefined)"/>
+          </template>
+          <icon-button v-else icon="action-horizontal"/>
+        </div>
+      </popper>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { RadioGroup, RadioGroupOption } from "@headlessui/vue";
+import { computed, ref, toRefs, watch } from "vue";
+
+import IconButton from "@/components/common/Button/IconButton.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+
+import Popper from 'vue3-popper';
+import MachineSetLabel from "./MachineSetLabel.vue";
+
+export type PickerOption = {
+  id: string,
+  color: string,
+  tooltip?: string,
+  name?: string,
+  disabled?: boolean
+};
+
+const emit = defineEmits(["update:machineSetIndex"]);
+const showPicker = ref(false);
+const optionsView = ref();
+
+const props = defineProps<{
+  machineSetIndex?: number,
+  options: PickerOption[]
+}>();
+
+const { options, machineSetIndex } = toRefs(props);
+
+watch(options, () => {
+  if (options.value.length < 8) {
+    showPicker.value = false;
+  }
+});
+
+const pickedOption = computed(() => {
+  return machineSetIndex?.value !== undefined ? options.value[machineSetIndex.value] : undefined;
+});
+
+const onSelect = (checked: boolean) => {
+  if (checked)
+    emit('update:machineSetIndex', undefined);
+
+  showPicker.value = false;
+}
+
+const menuHovered = ref(false);
+</script>
+
+<style>
+.no-scrollbar::-webkit-scrollbar {
+  display: none;
+}
+
+/* Hide scrollbar for IE, Edge and Firefox */
+.no-scrollbar {
+  -ms-overflow-style: none;  /* IE and Edge */
+  scrollbar-width: none;  /* Firefox */
+}
+</style>
+
+<style>
+.picker {
+  @apply flex flex-col items-center gap-0.5 overflow-y-auto;
+  height: 120px;
+}
+</style>
\ No newline at end of file
diff --git a/frontend/src/views/omni/Clusters/Management/MachineSets.vue b/frontend/src/views/omni/Clusters/Management/MachineSets.vue
new file mode 100644
index 000000000..dd4ab8dd1
--- /dev/null
+++ b/frontend/src/views/omni/Clusters/Management/MachineSets.vue
@@ -0,0 +1,48 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div>
+    <t-button icon="plus" class="h-8" @click="addWorkers" type="compact">
+      Add Worker Machine Sets
+    </t-button>
+    <machine-set-config
+      v-for="(machineSet, index) in state.machineSets"
+      :machine-classes="machineClasses"
+      :model-value="machineSet"
+      :key="machineSet.name"
+      @update:model-value="(value) => state.machineSets[index] = value"
+      :no-remove="index < 2"
+      :onRemove="() => {
+        state.removeMachineSet(index)
+      }"/>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Runtime } from '@/api/common/omni.pb';
+import { Resource } from '@/api/grpc';
+import { DefaultNamespace, LabelWorkerRole, MachineClassType } from '@/api/resources';
+import Watch from '@/api/watch';
+import { ref } from 'vue';
+import MachineSetConfig from './MachineSetConfig.vue';
+import TButton from '@/components/common/Button/TButton.vue';
+import { state } from "@/states/cluster-management";
+
+const machineClasses = ref<Resource[]>([]);
+const machineClassesWatch = new Watch(machineClasses);
+machineClassesWatch.setup({
+  resource: {
+    type: MachineClassType,
+    namespace: DefaultNamespace,
+  },
+  runtime: Runtime.Omni
+});
+
+const addWorkers = () => {
+  state.value.addMachineSet(LabelWorkerRole);
+}
+</script>
\ No newline at end of file
diff --git a/frontend/src/views/omni/ItemLabels/ItemLabel.vue b/frontend/src/views/omni/ItemLabels/ItemLabel.vue
new file mode 100644
index 000000000..a6d86bc66
--- /dev/null
+++ b/frontend/src/views/omni/ItemLabels/ItemLabel.vue
@@ -0,0 +1,147 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <component :is="label.description ? Tooltip : 'div'" :description="label.description" placement="bottom-start">
+    <span class="flex items-center cursor-pointer transition-all" v-bind:class="`resource-label label-${label.color}`"
+      @click.stop="() => $emit('filterLabel', label)">
+      <template v-if="label.value">
+        {{ label.id }}:<span class="font-semibold">{{ label.value }}</span>
+      </template>
+      <span v-else class="font-semibold">
+        {{ label.id }}
+      </span>
+      <t-icon v-if="label.user && destroyUserLabel" icon="close" class="destroy-label-button"
+        @click.stop="() => destroyUserLabel?.(label.key)" />
+    </span>
+  </component>
+</template>
+
+<script setup lang="ts">
+import Tooltip from "@/components/common/Tooltip/Tooltip.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+
+defineProps<{
+  label: {
+    key: string,
+    id: string,
+    value: string,
+    color: string,
+    description?: string,
+    user?: boolean,
+  },
+  destroyUserLabel?: (key :string) => Promise<void>
+}>();
+</script>
+
+<style scoped>
+.label-green {
+  --label-h: 142;
+  --label-s: 100;
+  --label-l: 49;
+}
+
+.label-red {
+  --label-h: 359;
+  --label-s: 97;
+  --label-l: 36;
+}
+
+.label-orange {
+  --label-h: 15;
+  --label-s: 90;
+  --label-l: 44;
+}
+
+.label-violet {
+  --label-h: 313;
+  --label-s: 97;
+  --label-l: 58;
+}
+
+.label-yellow {
+  --label-h: 48;
+  --label-s: 96;
+  --label-l: 50;
+}
+
+.label-cyan {
+  --label-h: 185;
+  --label-s: 100;
+  --label-l: 22;
+}
+
+.label-blue1 {
+  --label-h: 211;
+  --label-s: 76;
+  --label-l: 48;
+}
+
+.label-blue2 {
+  --label-h: 215;
+  --label-s: 100;
+  --label-l: 40;
+}
+
+.label-blue3 {
+  --label-h: 256;
+  --label-s: 81;
+  --label-l: 50;
+}
+
+.label-light1 {
+  --label-h: 0;
+  --label-s: 65;
+  --label-l: 74;
+  --lighten-by: 0;
+}
+
+.label-light2 {
+  --label-h: 13;
+  --label-s: 81;
+  --label-l: 87;
+  --lighten-by: 0;
+}
+
+.label-light3 {
+  --label-h: 48;
+  --label-s: 96;
+  --label-l: 87;
+  --lighten-by: 0;
+}
+
+.label-light4 {
+  --label-h: 128;
+  --label-s: 32;
+  --label-l: 81;
+  --lighten-by: 0;
+}
+
+.label-light5 {
+  --label-h: 184;
+  --label-s: 29;
+  --label-l: 80;
+  --lighten-by: 0;
+}
+
+.label-light6 {
+  --label-h: 208;
+  --label-s: 70;
+  --label-l: 86;
+  --lighten-by: 0;
+}
+
+.label-light7 {
+  --label-h: 257;
+  --label-s: 81;
+  --label-l: 87;
+  --lighten-by: 0;
+}
+
+.destroy-label-button {
+  @apply w-3 h-3 -mr-1 ml-1 inline-block hover:text-naturals-N1 cursor-pointer hover:bg-naturals-N14 transition-all rounded-full;
+}
+</style>
\ No newline at end of file
diff --git a/frontend/src/views/omni/ItemLabels/ItemLabels.vue b/frontend/src/views/omni/ItemLabels/ItemLabels.vue
new file mode 100644
index 000000000..d61987be2
--- /dev/null
+++ b/frontend/src/views/omni/ItemLabels/ItemLabels.vue
@@ -0,0 +1,174 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-wrap gap-1.5 items-center text-xs">
+    <item-label
+      @filterLabel="(label) => $emit('filterLabel', label)"
+      v-for="label in labels" :label="label" :key="label.key" :destroy-user-label="removeLabelFunc ? destroyUserLabel : undefined"/>
+    <t-input @keydown.enter="addUserLabel" v-model="currentLabel" compact @click.stop @blur="addingLabel = false" :focus="addingLabel" v-if="addingLabel" class="w-24 h-6"/>
+    <t-button icon="tag" type="compact" @click.stop="editLabels" v-else-if="addLabelFunc">new label</t-button>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, toRefs } from "vue";
+import {Resource} from "@/api/grpc";
+
+import ItemLabel from "./ItemLabel.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import TInput from "@/components/common/TInput/TInput.vue";
+import { showError } from "@/notification";
+import { SystemLabelPrefix } from "@/api/resources";
+
+const props = defineProps<{
+  resource: Resource
+  addLabelFunc?: (resourceID: string, ...labels: string[]) => Promise<void> | void
+  removeLabelFunc?: (resourceID: string, ...labels: string[]) => Promise<void> | void
+}>();
+
+const { resource } = toRefs(props);
+
+type Label = {
+  key: string;
+  id: string,
+  value: string;
+  color: string;
+  user?: boolean;
+  description?: string,
+}
+
+defineEmits(['filterLabel']);
+
+const labelOrder = {
+  "reporting-events": -1,
+  "invalid-state": 0,
+  "cluster": 0,
+  "available": 5,
+  "connected": 10,
+  "disconnected": 10,
+  "platform": 20,
+  "cores": 30,
+  "mem": 40,
+  "storage": 50,
+  "net": 60,
+  "cpu": 70,
+  "arch": 80,
+  "region": 100,
+  "zone": 110,
+  "instance": 120,
+}
+
+const getLabelOrder = (l: Label) => {
+  if (l.user) {
+    return 1000;
+  }
+
+  return labelOrder[l.key];
+}
+
+const labelDescriptions = {
+  "invalid-state": "The machine is expected to be unallocated, but still has the configuration of a cluster.\nIt might be required to wipe the machine bypassing Omni."
+};
+
+const labelColors = {
+  "cluster": "light1",
+  "available": "yellow",
+  "invalid-state": "red",
+  "connected": "green",
+  "disconnected": "red",
+  "platform": "blue1",
+  "cores": "cyan",
+  "mem": "blue2",
+  "storage": "violet",
+  "net": "blue3",
+  "cpu": "orange",
+  "arch": "light2",
+  "region": "light3",
+  "zone": "light4",
+  "instance": "light5",
+}
+
+const labels = computed((): Array<Label> => {
+  const labels = resource.value.metadata?.labels || {};
+
+  let labelsArray: Array<Label> = [];
+
+  for (const key in labels) {
+    const isUser = key.indexOf(SystemLabelPrefix) !== 0;
+    const strippedKey = key.replace(new RegExp(`^${SystemLabelPrefix}`), "");
+
+    if (labelOrder[strippedKey] === -1) {
+      continue;
+    }
+
+    labelsArray.push({
+      key: key,
+      id: strippedKey,
+      value: labels[key],
+      color: labelColors[strippedKey] ?? "light6",
+      user: isUser,
+      description: labelDescriptions[strippedKey],
+    })
+  }
+
+  labelsArray.sort((a, b) => {
+    return getLabelOrder(a) - getLabelOrder(b);
+  });
+
+  return labelsArray
+});
+
+const addingLabel = ref(false);
+const currentLabel = ref("");
+let addPending = false;
+
+const editLabels = () => {
+  addingLabel.value = true;
+};
+
+const addUserLabel = async () => {
+  if (!addingLabel.value || !currentLabel.value || !resource.value.metadata.id || addPending || !props.addLabelFunc) {
+    return;
+  }
+
+  try {
+    addPending = true;
+    await props.addLabelFunc(resource.value.metadata.id, currentLabel.value);
+  } catch (e) {
+    showError(`Failed to Add Label ${currentLabel.value}`, e.message);
+  }
+
+  addingLabel.value = false;
+
+  currentLabel.value = "";
+  addPending = false;
+}
+
+const destroyUserLabel = async (key: string) => {
+  if (!resource.value.metadata.id || !props.removeLabelFunc) {
+    return;
+  }
+
+  if (key.startsWith(SystemLabelPrefix)) {
+    showError(
+        `Failed to Remove Label ${key}`,
+        `Label ${key} is not a user label and cannot be removed.`)
+
+    return;
+  }
+
+  try {
+    await props.removeLabelFunc(resource.value.metadata.id, key);
+  } catch (e) {
+    showError(`Failed to Remove Label ${key}`, e.message);
+  }
+
+  addingLabel.value = false;
+
+  currentLabel.value = "";
+};
+</script>
\ No newline at end of file
diff --git a/frontend/src/views/omni/MachineClasses/MachineClass.vue b/frontend/src/views/omni/MachineClasses/MachineClass.vue
new file mode 100644
index 000000000..29a043b68
--- /dev/null
+++ b/frontend/src/views/omni/MachineClasses/MachineClass.vue
@@ -0,0 +1,373 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col gap-4">
+    <div class="flex gap-1 items-start">
+      <page-header :title="`${edit ? 'Edit Machine Class' : 'Create Machine Class'}`" class="flex-1" :subtitle="edit ? 'name: '+ $route.params.classname as string : ''"/>
+    </div>
+    <div class="flex-1 flex items-center justify-center" v-if="loading">
+      <t-spinner class="w-6 h-6"/>
+    </div>
+    <t-alert title="Not Found" type="error" v-else-if="notFound">
+      The <code>MachineClass</code> {{$route.params.classname}} does not exist
+    </t-alert>
+    <template v-else>
+      <div class="flex flex-col gap-2">
+        <t-input v-if="!edit" title="Machine Class Name" v-model="machineClassName"/>
+        <div class="text-naturals-N13">Conditions</div>
+        <div class="flex flex-wrap items-center gap-2">
+          <template v-for="_, i in conditions" :key="i">
+            <div class="flex gap-0.5 condition">
+              <div
+                @click="deleteCondition(i)"
+                class="rounded-l-md flex items-center bg-naturals-N3 px-2 transition-colors hover:bg-naturals-N7 hover:text-naturals-N14 cursor-pointer">
+                <t-icon icon="delete" class="w-4 h-4"/>
+              </div>
+              <span role="textbox" ref="conditionElements" style="min-width: 28px"
+                @focus="lastFocused = i"
+                spellcheck="false"
+                class="text-sm font-roboto text-naturals-N14 px-2 py-1 whitespace-pre rounded-r-md bg-naturals-N3"
+                contenteditable
+                @keyup="(event: KeyboardEvent) => updateContent(i, event)"
+                @keydown.enter.prevent="addCondition"
+                @keydown.backspace="(event: KeyboardEvent) => handleBackspace(event, i)">
+                {{ conditions[i] }}
+              </span>
+            </div>
+            <div v-if="i != conditions.length - 1">OR</div>
+          </template>
+          <icon-button icon="plus" class="h-full" @click="addCondition"/>
+        </div>
+        <div class="text-xs flex flex-col gap-1">
+          <p>Using <code>,</code> in a single condition will match them using <code>AND</code> operator.</p>
+          <p>Separate conditions are matched using <code>OR</code>.</p>
+          <p>Allowed binary operators are
+            <code>&gt;</code>,
+            <code>&gt;=</code>,
+            <code>&lt;</code>,
+            <code>&lt;=</code>,
+            <code>=</code>,
+            <code>==</code>,
+            <code>!=</code>,
+            <code>in</code>,
+            <code>notin</code>.
+          </p>
+          <p>Excluding a label can be done by prepending <code>!</code> to the label key, example: <code>!omni.sidero.dev/available</code>.</p>
+        </div>
+      </div>
+      <div class="flex flex-col flex-1">
+        <div class="text-naturals-N13">Matches</div>
+        <Watch :opts="watchOpts" spinner no-records-alert errors-alert>
+          <template #default="{ items }">
+            <machine-match-item v-for="item in items" :key="itemID(item)" :machine="item" @filter-labels="copyLabel"/>
+          </template>
+        </Watch>
+      </div>
+      <div class="sticky -bottom-6 -my-6 -mx-6 bg-naturals-N1 border-t border-naturals-N5 h-16 flex items-center gap-2 px-12 py-6 text-xs justify-end">
+        <t-button type="highlighted" :disabled="nonEmptyConditions.length === 0 || machineClassName === ''" @click="submit">
+          {{ edit ? 'Update Machine Class' : 'Create Machine Class' }}
+        </t-button>
+      </div>
+    </template>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ResourceTyped, ResourceService } from "@/api/grpc";
+import { withRuntime } from "@/api/options";
+import { Runtime } from "@/api/common/omni.pb";
+import { MachineClassSpec } from "@/api/omni/specs/omni.pb";
+import { DefaultNamespace, MachineStatusType, MachineClassType } from "@/api/resources";
+import ItemWatch, { itemID } from "@/api/watch";
+import { computed, ref, nextTick, Ref, watch } from "vue";
+import { useRoute, useRouter } from "vue-router";
+import { showError } from "@/notification";
+
+import TAlert from "@/components/TAlert.vue";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import PageHeader from "@/components/common/PageHeader.vue";
+import Watch from "@/components/common/Watch/Watch.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import TInput from "@/components/common/TInput/TInput.vue";
+import MachineMatchItem from "./MachineMatchItem.vue";
+import IconButton from "@/components/common/Button/IconButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+
+const conditions = ref([""]);
+const machineClassName = ref("");
+
+const props = defineProps<{edit: boolean}>();
+const router = useRouter();
+const lastFocused = ref(0);
+
+let loading = ref(false);
+let notFound = ref(false);
+let resourceVersion: string | undefined;
+
+type Caret = {
+  pos: number
+  done?: boolean
+}
+
+// get the cursor position from element start
+const getCursorPosition = (parent: Node, node: Node | null, offset: number, stat: Caret) => {
+  if (stat.done) return stat;
+
+  let currentNode: Node | undefined;
+  if (parent.childNodes.length == 0) {
+    stat.pos += parent.textContent?.length ?? 0;
+
+    return stat;
+  }
+
+  for (let i = 0; i < parent.childNodes.length && !stat.done; i++) {
+    currentNode = parent.childNodes[i];
+
+    if (currentNode === node) {
+      stat.pos += offset;
+      stat.done = true;
+
+      return stat;
+    }
+
+    getCursorPosition(currentNode, node, offset, stat);
+  }
+
+  return stat;
+}
+
+// find the child node and relative position and set it on range
+const setCursorPosition = (parent: Node, range: Range, stat: Caret) => {
+  if (stat.done) return range;
+
+  if (parent.childNodes.length == 0) {
+    if ((parent.textContent?.length ?? 0) >= stat.pos) {
+      range.setStart(parent, stat.pos);
+      stat.done = true;
+    } else {
+      stat.pos = stat.pos - (parent.textContent?.length ?? 0);
+    }
+
+    return range;
+  }
+
+  for (let i = 0; i < parent.childNodes.length && !stat.done; i++) {
+    const currentNode = parent.childNodes[i];
+
+    setCursorPosition(currentNode, range, stat);
+  }
+
+  return range;
+}
+
+// contains FF workaround: editable spans are losing caret position after getting vue reactive updates
+// it has to save current element caret index before applying the change
+// then apply the change and return caret position back
+const updateContent = (i: number, event: KeyboardEvent) => {
+  if (conditions.value[i] == event.target!['textContent']) {
+    return;
+  }
+
+  const sel = window.getSelection?.();
+  let caret: Caret | undefined;
+
+  if (sel) {
+    const node = sel.focusNode;
+    const offset = sel.focusOffset;
+
+    caret = getCursorPosition(event.target as Element, node, offset, { pos: 0, done: false });
+  }
+
+  conditions.value[i] = event.target!['textContent']
+
+  nextTick(() => {
+    if (sel && caret) {
+      sel.removeAllRanges();
+
+      const range = setCursorPosition(event.target as Node, document.createRange(), {
+        pos: caret.pos,
+        done: false,
+      });
+
+      range.collapse(true);
+      sel.addRange(range);
+    }
+  })
+}
+
+if (props.edit) {
+  const machineClass: Ref<ResourceTyped<MachineClassSpec> | undefined> = ref();
+  const machineClassWatch = new ItemWatch(machineClass);
+  const route = useRoute();
+
+  loading = computed(() => {
+    return machineClassWatch.loading.value;
+  });
+
+  notFound = computed(() => {
+    return machineClass.value === undefined;
+  });
+
+  machineClassName.value = route.params.classname as string;
+  watch(() => route.params.classname, () => {
+    machineClassName.value = route.params.classname as string;
+  });
+
+  machineClassWatch.setup(computed(() => {
+    return {
+      resource: {
+        id: route.params.classname as string,
+        namespace: DefaultNamespace,
+        type: MachineClassType,
+      },
+      runtime: Runtime.Omni,
+    }
+  }));
+
+  watch(machineClass, () => {
+    const matchLabels = machineClass.value?.spec?.match_labels;
+    if (!matchLabels) {
+      return;
+    }
+
+    conditions.value = matchLabels;
+    resourceVersion = machineClass.value?.metadata.version;
+  });
+}
+
+const placeCaretAtEnd = (el: any) => {
+  if (typeof window.getSelection != "undefined"
+    && typeof document.createRange != "undefined") {
+    const range = document.createRange();
+    range.selectNodeContents(el);
+    range.collapse(false);
+    const sel = window.getSelection();
+    sel?.removeAllRanges();
+    sel?.addRange(range);
+  } else if (typeof document.body['createTextRange'] != "undefined") {
+    const textRange = document.body['createTextRange']();
+    textRange.moveToElementText(el);
+    textRange.collapse(false);
+    textRange.select();
+  }
+}
+
+const watchOpts = computed(() => {
+  return {
+    resource: {
+      namespace: DefaultNamespace,
+      type: MachineStatusType,
+    },
+    selectors: nonEmptyConditions.value,
+    selectUsingOR: true,
+    runtime: Runtime.Omni,
+  };
+});
+
+const conditionElements: Ref<Node & { focus: () => void, textContent: string}[] | null> = ref(null);
+
+const updateFocus = () => {
+  nextTick(() => {
+    const node = conditionElements.value?.[conditions.value.length - 1];
+    if (!node) {
+      return;
+    }
+
+    node?.focus();
+    placeCaretAtEnd(node);
+  });
+};
+
+const addCondition = () => {
+  conditions.value.push("");
+  updateFocus();
+}
+
+const deleteCondition = (i: number) => {
+  if (conditions.value.length === 1) {
+    conditions.value[0] = '';
+
+    return;
+  }
+
+  conditions.value.splice(i, 1);
+}
+
+const handleBackspace = (event: KeyboardEvent, i: number) => {
+  if (conditions.value[i] !== "" || conditions.value.length < 2) {
+    return;
+  }
+
+  event.preventDefault();
+  conditions.value.splice(i, 1);
+  updateFocus();
+}
+
+const copyLabel = (label: {key: string, value: string}) => {
+  const block = `${label.key}${label.value ? ' = ' + label.value : '' }`;
+
+  if (lastFocused.value >= conditions.value.length) {
+    lastFocused.value = conditions.value.length - 1;
+  }
+
+  if (conditions.value[lastFocused.value].trim() === '') {
+    conditions.value[lastFocused.value] = block;
+
+    return;
+  }
+
+  conditions.value[lastFocused.value] += ", " + block;
+};
+
+const nonEmptyConditions = computed(() => {
+  return conditions.value.filter(value => value.trim());
+});
+
+const submit = async () => {
+  const machineClass: ResourceTyped<MachineClassSpec> = {
+    metadata: {
+      id: machineClassName.value,
+      namespace: DefaultNamespace,
+      type: MachineClassType,
+      version: resourceVersion,
+    },
+    spec: {
+      match_labels: nonEmptyConditions.value,
+    }
+  };
+
+  try {
+    if (props.edit) {
+      await ResourceService.Update(machineClass, resourceVersion, withRuntime(Runtime.Omni));
+    } else {
+      await ResourceService.Create(machineClass, withRuntime(Runtime.Omni));
+    }
+  } catch (e) {
+    showError("Failed to Create Machine Class", e.message);
+
+    return;
+  }
+
+  router.push({
+    name: "MachineClasses"
+  });
+};
+</script>
+
+<style scoped>
+.condition {
+  @apply border border-opacity-0 rounded-md border-transparent;
+}
+
+.condition:focus-within {
+  @apply border-naturals-N8;
+}
+
+code {
+  @apply font-roboto rounded bg-naturals-N6 px-1 py-0.5 text-naturals-N13;
+}
+</style>
diff --git a/frontend/src/views/omni/MachineClasses/MachineClasses.vue b/frontend/src/views/omni/MachineClasses/MachineClasses.vue
new file mode 100644
index 000000000..50a46071d
--- /dev/null
+++ b/frontend/src/views/omni/MachineClasses/MachineClasses.vue
@@ -0,0 +1,30 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col">
+    <div class="flex gap-1 items-start">
+      <page-header title="Machine Classes" class="flex-1"/>
+      <t-button :disabled="!canRemoveMachines" @click="openMachineClassCreate" type="highlighted">Create Machine Class</t-button>
+    </div>
+    <machine-classes-list class="mb-6"/>
+  </div>
+</template>
+
+<script setup lang="ts">
+import PageHeader from "@/components/common/PageHeader.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import MachineClassesList from "@/views/omni/MachineClasses/MachineClassesList.vue";
+
+import { canRemoveMachines } from "@/methods/auth";
+import { useRouter } from "vue-router";
+
+const router = useRouter();
+
+const openMachineClassCreate = () => {
+  router.push({ name: "MachineClassCreate" })
+};
+</script>
\ No newline at end of file
diff --git a/frontend/src/views/omni/MachineClasses/MachineClassesList.vue b/frontend/src/views/omni/MachineClasses/MachineClassesList.vue
new file mode 100644
index 000000000..07144746a
--- /dev/null
+++ b/frontend/src/views/omni/MachineClasses/MachineClassesList.vue
@@ -0,0 +1,75 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <t-list :opts="watchOpts" search pagination>
+    <template #default="{ items, searchQuery }">
+      <div class="header">
+        <div class="list-grid">
+          <div>Name</div>
+        </div>
+      </div>
+      <t-list-item v-for="item in items" :key="item.metadata.id!">
+        <div class="text-naturals-N12 relative pr-3" :class="{ 'pl-7': !item.spec.description }">
+          <icon-button icon="delete" @click="() => openMachineClassDestroy(item.metadata.id!)" class="absolute right-0 my-auto top-0 bottom-0"/>
+          <div class="list-grid">
+            <div>
+              <router-link
+                :to="{ name: 'MachineClassEdit', params: { classname: item.metadata.id } }"
+                class="list-item-link">
+                <WordHighlighter
+                  highlight-class="bg-naturals-N14"
+                  :query="searchQuery">
+                    {{ item.metadata.id }}
+                </WordHighlighter>
+              </router-link>
+            </div>
+          </div>
+        </div>
+      </t-list-item>
+    </template>
+  </t-list>
+</template>
+
+<script setup lang="ts">
+import { Runtime } from "@/api/common/omni.pb";
+import { DefaultNamespace, MachineClassType } from "@/api/resources";
+import { WatchOptions } from "@/api/watch";
+import { computed } from "vue";
+import { useRouter } from "vue-router";
+
+import WordHighlighter from "vue-word-highlighter";
+import TList from "@/components/common/List/TList.vue";
+import TListItem from "@/components/common/List/TListItem.vue";
+import IconButton from "@/components/common/Button/IconButton.vue";
+
+const watchOpts = computed((): WatchOptions => {
+  return {
+    resource: {
+      namespace: DefaultNamespace,
+      type: MachineClassType,
+    },
+    runtime: Runtime.Omni,
+  }
+});
+
+const router = useRouter();
+
+const openMachineClassDestroy = (id: string) => {
+  router.push({ query: { modal: 'machineClassDestroy', classname: id } })
+}
+
+</script>
+
+<style scoped>
+.header {
+  @apply bg-naturals-N2 mb-1 py-2 px-6 text-xs pl-10;
+}
+
+.list-grid {
+  @apply grid grid-cols-1 items-center justify-center pr-12 gap-1;
+}
+</style>
\ No newline at end of file
diff --git a/frontend/src/views/omni/MachineClasses/MachineMatchItem.vue b/frontend/src/views/omni/MachineClasses/MachineMatchItem.vue
new file mode 100644
index 000000000..e2fcf5914
--- /dev/null
+++ b/frontend/src/views/omni/MachineClasses/MachineMatchItem.vue
@@ -0,0 +1,51 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <t-list-item>
+    <template #default>
+      <div class="flex text-naturals-N13 text-xs items-center">
+        <div class="flex-1 flex gap-2 items-center">
+          <router-link :to="{ name: 'MachineLogs', params: { machine: machine?.metadata?.id } }" class="list-item-link pr-2">
+            <word-highlighter
+              :query="(searchQuery ?? '')"
+              split-by-space
+              :textToHighlight="machineName"
+              highlightClass="bg-naturals-N14"/>
+          </router-link>
+          <item-labels :resource="machine" @filter-label="(e) => $emit('filterLabels', e)"/>
+        </div>
+        <div class="flex-initial w-8">
+          <div class="flex justify-end"/>
+        </div>
+      </div>
+    </template>
+  </t-list-item>
+</template>
+
+<script setup lang="ts">
+import { computed, toRefs } from "vue";
+
+import { ResourceTyped } from "@/api/grpc";
+import { MachineStatusSpec } from "@/api/omni/specs/omni.pb";
+
+import TListItem from "@/components/common/List/TListItem.vue";
+import ItemLabels from "@/views/omni/ItemLabels/ItemLabels.vue";
+import WordHighlighter from "vue-word-highlighter";
+
+const props = defineProps<{
+  machine: ResourceTyped<MachineStatusSpec>
+  searchQuery?: string
+}>();
+
+defineEmits(["filterLabels"]);
+
+const { machine } = toRefs(props);
+
+const machineName = computed(() => {
+  return machine?.value?.spec?.network?.hostname ?? machine?.value?.metadata?.id
+});
+</script>
diff --git a/frontend/src/views/omni/Machines/MachineItem.vue b/frontend/src/views/omni/Machines/MachineItem.vue
new file mode 100644
index 000000000..dc7efd54e
--- /dev/null
+++ b/frontend/src/views/omni/Machines/MachineItem.vue
@@ -0,0 +1,211 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <t-list-item>
+    <template #default>
+      <div class="flex text-naturals-N13 text-xs items-center">
+        <div class="flex-1 flex gap-2 items-center">
+          <router-link :to="{ name: 'MachineLogs', params: { machine: machine?.metadata?.id } }" class="list-item-link pr-2">
+            <word-highlighter
+              :query="(searchQuery ?? '')"
+              split-by-space
+              :textToHighlight="machineName"
+              highlightClass="bg-naturals-N14"/>
+          </router-link>
+          <item-labels :resource="machine" :add-label-func="addMachineLabels" :remove-label-func="removeMachineLabels" @filter-label="(e) => $emit('filterLabels', e)"/>
+        </div>
+        <div class="flex-initial w-8">
+          <div class="flex justify-end">
+            <t-actions-box style="height: 24px">
+              <t-actions-box-item icon="settings" @click.stop="openConfigPatches">Config Patches</t-actions-box-item>
+              <t-actions-box-item icon="log" @click.stop="machineLogs" v-if="canReadMachineLogs">Logs</t-actions-box-item>
+              <t-actions-box-item icon="overview" @click.stop="showCluster" v-if="clusterName && canReadClusters">Show Cluster</t-actions-box-item>
+              <t-actions-box-item icon="delete" danger @click.stop="removeMachine" v-if="canRemoveMachines">Remove Machine</t-actions-box-item>
+            </t-actions-box>
+          </div>
+        </div>
+      </div>
+    </template>
+    <template #details>
+      <div class="pl-6 grid grid-cols-5 gap-1">
+        <div class="mb-2 mt-4">Processors</div>
+        <div class="mb-2 mt-4">Memory</div>
+        <div class="mb-2 mt-4">Block Devices</div>
+        <div class="mb-2 mt-4">Addresses</div>
+        <div class="mb-2 mt-4">Network Interfaces</div>
+        <div>
+          <template v-if="processors.length > 0">
+            <div v-for="(processor, index) in processors" :key="index">
+              {{ processor }}
+            </div>
+          </template>
+          <template v-else>
+            <div>No processors detected</div>
+          </template>
+        </div>
+        <div>
+          <template v-if="memorymodules.length > 0">
+            <div v-for="(memorymodule, index) in memorymodules" :key="index">
+              {{ memorymodule }}
+            </div>
+          </template>
+          <template v-else>
+            <div>No memory modules detected</div>
+          </template>
+        </div>
+        <div>
+          <div v-for="(dev, index) in machine?.spec?.message_status?.hardware?.blockdevices" :key="index">
+            {{ dev.linux_name }} {{ formatBytes(dev.size) }} {{ dev.type }}
+          </div>
+        </div>
+        <div>
+          <div>
+            {{ machine.spec?.message_status?.network?.addresses?.join(", ") }}
+          </div>
+        </div>
+        <div>
+          <div v-for="(link, index) in machine?.spec?.message_status?.network?.network_links" :key="index">
+            {{ link.linux_name }} {{ link.hardware_address }} {{ link.link_up ? 'UP' : 'DOWN' }}
+          </div>
+        </div>
+        <div class="mb-2 mt-4">Talos Version</div>
+        <div class="mb-2 mt-4">UUID</div>
+        <div class="mb-2 mt-4">Bytes Received</div>
+        <div class="mb-2 mt-4">Bytes Sent</div>
+        <div class="mb-2 mt-4">Cluster</div>
+        <div>
+          <div>{{ machine?.spec?.message_status?.talos_version }}</div>
+        </div>
+        <word-highlighter
+          :query="(searchQuery ?? '')"
+          split-by-space
+          :textToHighlight="machine?.metadata?.id"
+          highlightClass="bg-naturals-N14"/>
+        <div>
+          <div>{{ machine.spec.siderolink_counter?.bytes_received ? formatBytes(machine.spec.siderolink_counter.bytes_received) : '0B' }}</div>
+        </div>
+        <div>
+          <div>{{ machine.spec.siderolink_counter?.bytes_sent ? formatBytes(machine.spec.siderolink_counter.bytes_sent) : '0B' }}</div>
+        </div>
+        <div>
+          <router-link :to="{ name: 'ClusterOverview', params: { cluster: clusterName }}" v-if="clusterName"  class="list-item-link">
+            {{ clusterName }}
+          </router-link>
+        </div>
+        <div class="mb-2 mt-4">Last Active</div>
+        <div class="mb-2 mt-4 col-span-4">Created At</div>
+        <div>
+          <div>{{ machineLastAlive }}</div>
+        </div>
+        <div>
+          <div>{{ machineCreatedAt }}</div>
+        </div>
+      </div>
+    </template>
+  </t-list-item>
+</template>
+
+<script setup lang="ts">
+import { computed, toRefs } from "vue";
+import { formatBytes } from "@/methods";
+import pluralize from 'pluralize';
+
+import { useRouter } from "vue-router";
+import { ResourceTyped } from "@/api/grpc";
+import { MachineStatusLinkSpec } from "@/api/omni/specs/ephemeral.pb";
+import { DateTime } from "luxon";
+
+import TListItem from "@/components/common/List/TListItem.vue";
+import TActionsBox from "@/components/common/ActionsBox/TActionsBox.vue";
+import TActionsBoxItem from "@/components/common/ActionsBox/TActionsBoxItem.vue";
+import ItemLabels from "@/views/omni/ItemLabels/ItemLabels.vue";
+import WordHighlighter from "vue-word-highlighter";
+import { addMachineLabels, removeMachineLabels } from "@/methods/machine";
+import { canReadClusters, canReadMachineLogs, canRemoveMachines } from "@/methods/auth";
+
+type MachineWithLinkCounter = ResourceTyped<MachineStatusLinkSpec>;
+const props = defineProps<{
+  machine: MachineWithLinkCounter
+  searchQuery?: string
+}>();
+
+defineEmits(["filterLabels"]);
+
+const { machine } = toRefs(props);
+const router = useRouter();
+
+const machineName = computed(() => {
+  return machine?.value?.spec?.message_status?.network?.hostname ?? machine?.value?.metadata?.id
+});
+
+const openConfigPatches = () => {
+  router.push({ name: "MachineConfigPatches", params: { machine: machine.value.metadata.id } });
+};
+
+const processors = computed(() => {
+  const processors = machine?.value?.spec?.message_status?.hardware?.processors || [];
+
+  const format = (proc: { frequency: number; core_count: number; description: string }) => {
+    return `${proc.frequency / 1000} GHz, ${pluralize("core", proc.core_count, true)}, ${proc.description}`;
+  };
+
+  return processors.map(format);
+});
+
+const memorymodules = computed(() => {
+  const memorymodules = machine?.value?.spec?.message_status?.hardware?.memory_modules || [];
+
+  const format = (mem: { description: string; size_mb: number; }) => {
+    let description = mem.description;
+
+    if (mem.description === undefined) {
+      description = "";
+    }
+    return `${formatBytes(mem.size_mb * 1024 * 1024)} ${description}`;
+  };
+
+  return memorymodules.filter((mem: { size_mb: number; }) => mem.size_mb !== 0).map(format);
+});
+
+const clusterName = computed(() => machine.value?.spec?.message_status?.cluster);
+
+const removeMachine = () => {
+  router.push({
+    query: { modal: "machineRemove", machine: machine.value.metadata.id, cluster: clusterName.value },
+  });
+};
+
+const machineLogs = () => {
+  router.push({
+    name: "MachineLogs",
+    params: { machine: machine.value.metadata.id },
+  });
+};
+
+const showCluster = () => {
+  router.push({
+    name: "ClusterOverview",
+    params: { cluster: clusterName.value },
+  });
+};
+
+const timeGetter = (fn :() => string|undefined) => {
+  return computed(() => {
+    const time = fn();
+    if (time) {
+      const dt: DateTime = /^\d+$/.exec(time) ? DateTime.fromSeconds(parseInt(time)) : DateTime.fromISO(time)
+
+      return dt.setLocale('en').toLocaleString(DateTime.DATETIME_FULL_WITH_SECONDS);
+    }
+
+    return "Never";
+  });
+}
+
+const machineLastAlive = timeGetter(() => machine.value?.spec?.siderolink_counter?.last_alive);
+const machineCreatedAt = timeGetter(() => machine.value?.spec?.machine_created_at);
+</script>
diff --git a/frontend/src/views/omni/Machines/MachineLogs.vue b/frontend/src/views/omni/Machines/MachineLogs.vue
new file mode 100644
index 000000000..be6067cff
--- /dev/null
+++ b/frontend/src/views/omni/Machines/MachineLogs.vue
@@ -0,0 +1,41 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col gap-2">
+    <t-breadcrumbs :last="`${machine} Logs`"/>
+    <machine-logs-container class="flex-1"/>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Runtime } from "@/api/common/omni.pb";
+import { Resource, ResourceService } from "@/api/grpc";
+import { MachineStatusSpec } from "@/api/omni/specs/omni.pb";
+import { withRuntime } from "@/api/options";
+import { DefaultNamespace, MachineStatusType } from "@/api/resources";
+import TBreadcrumbs from "@/components/TBreadcrumbs.vue";
+import MachineLogsContainer from "@/views/omni/Machines/MachineLogsContainer.vue";
+import { onBeforeMount, ref, watch } from "vue";
+import { useRoute } from "vue-router";
+
+const route = useRoute();
+
+const getMachineName = async () => {
+  const res: Resource<MachineStatusSpec> = await ResourceService.Get({
+    namespace: DefaultNamespace,
+    type: MachineStatusType,
+    id: route.params.machine! as string,
+  }, withRuntime(Runtime.Omni));
+
+  machine.value = res.spec.network?.hostname || res.metadata.id!;
+};
+
+const machine = ref(route.params.machine);
+
+onBeforeMount(getMachineName);
+watch(() => route.params, getMachineName)
+</script>
diff --git a/frontend/src/views/omni/Machines/MachineLogsContainer.vue b/frontend/src/views/omni/Machines/MachineLogsContainer.vue
new file mode 100644
index 000000000..c18deba73
--- /dev/null
+++ b/frontend/src/views/omni/Machines/MachineLogsContainer.vue
@@ -0,0 +1,55 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col">
+    <div class="w-1/4 mb-4">
+      <t-input
+        placeholder="Search..."
+        v-model="searchInput"
+        icon="search"
+      />
+    </div>
+    <log-viewer class="flex-1" :logs="logs" :searchOption="searchInput"/>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Ref, ref } from "vue";
+import { useRoute } from "vue-router";
+import { time } from "@/methods/time";
+
+import { setupLogStream, DefaultLogParser } from "@/methods/logs";
+import { LogLine } from "@/methods/logs";
+import { ManagementService } from "@/api/omni/management/management.pb";
+
+import TInput from "@/components/common/TInput/TInput.vue";
+import LogViewer from "@/components/common/LogViewer/LogViewer.vue";
+
+const logs: Ref<LogLine[]> = ref([]);
+const route = useRoute();
+
+const searchInput = ref("");
+
+interface Props {
+  machineId?: string,
+}
+
+const props = defineProps<Props>()
+
+setupLogStream(logs, ManagementService.MachineLogs, {
+  machine_id: props.machineId || route.params.machine as string,
+  tail_lines: -1,
+  follow: true,
+}, new DefaultLogParser((line: string): LogLine => {
+  const data = JSON.parse(line);
+
+  return {
+    date: time.formatISO(data["talos-time"], "dd/MM/yyyy HH:mm:ss"),
+    msg: data.msg,
+  };
+}))
+</script>
diff --git a/frontend/src/views/omni/Machines/Machines.vue b/frontend/src/views/omni/Machines/Machines.vue
new file mode 100644
index 000000000..5cc7d2ed1
--- /dev/null
+++ b/frontend/src/views/omni/Machines/Machines.vue
@@ -0,0 +1,60 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div>
+    <page-header title="Machines"/>
+    <t-list
+      :opts="watchOpts"
+      search
+      pagination
+      :sortOptions="sortOptions"
+      ref="list"
+      >
+      <template #default="{ items, searchQuery }">
+        <machine-item v-for="item in items" :key="itemID(item)" :machine="item" @filterLabels="filterByLabel" :search-query="searchQuery"/>
+      </template>
+    </t-list>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Runtime } from "@/api/common/omni.pb";
+import { MetricsNamespace, MachineStatusLinkType } from "@/api/resources";
+import { itemID, WatchOptions } from "@/api/watch";
+
+import TList from "@/components/common/List/TList.vue";
+import MachineItem from "@/views/omni/Machines/MachineItem.vue";
+import PageHeader from "@/components/common/PageHeader.vue";
+import { Ref, ref } from "vue";
+
+const watchOpts: WatchOptions = {
+    runtime: Runtime.Omni,
+    resource: {
+      type: MachineStatusLinkType,
+      namespace: MetricsNamespace,
+    },
+  };
+
+const sortOptions = [
+  {id: 'machine_created_at', desc: 'Creation Time ⬆', descending: true},
+  {id: 'machine_created_at', desc: 'Creation Time ⬇'},
+  {id: 'hostname', desc: 'Hostname ⬆'},
+  {id: 'hostname', desc: 'Hostname ⬇', descending: true},
+  {id: 'id', desc: 'ID ⬆'},
+  {id: 'id', desc: 'ID ⬇', descending: true},
+  {id: 'last_alive', desc: 'Last Active Time ⬆', descending: true},
+  {id: 'last_alive', desc: 'Last Active Time ⬇'},
+];
+
+const list: Ref<{addFilterLabel: (label: {key: string, value?: string}) => void} | null> = ref(null);
+
+const filterByLabel = (e: {key: string, value?: string}) => {
+  if (list.value) {
+    list.value.addFilterLabel(e);
+  }
+}
+</script>
diff --git a/frontend/src/views/omni/Modals/CloseButton.vue b/frontend/src/views/omni/Modals/CloseButton.vue
new file mode 100644
index 000000000..0eea764be
--- /dev/null
+++ b/frontend/src/views/omni/Modals/CloseButton.vue
@@ -0,0 +1,14 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <t-icon class="fill-current text-naturals-N10 cursor-pointer transition-colors hover:text-naturals-N14 w-6 h-6"
+    icon="close"/>
+</template>
+
+<script setup lang="ts">
+import TIcon from "@/components/common/Icon/TIcon.vue";
+</script>
\ No newline at end of file
diff --git a/frontend/src/views/omni/Modals/ClusterDestroy.vue b/frontend/src/views/omni/Modals/ClusterDestroy.vue
new file mode 100644
index 000000000..fa9dc23c9
--- /dev/null
+++ b/frontend/src/views/omni/Modals/ClusterDestroy.vue
@@ -0,0 +1,171 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14">
+        Destroy the Cluster {{ $route.query.cluster }} ?
+      </h3>
+      <close-button @click="close"/>
+    </div>
+    <managed-by-templates-warning warning-style="popup"/>
+    <p class="text-xs" v-if="destroying">{{ phase }}...</p>
+    <p class="text-xs" v-else-if="loading">Checking the cluster status...</p>
+    <div v-else-if="disconnectedMachines.length > 0" class="text-xs">
+      <p class="text-primary-P3 py-2">
+        Cluster <code>{{ $route.query.cluster }}</code> has {{ disconnectedMachines.length }} disconnected {{ pluralize('machine', disconnectedMachines.length, false) }}.
+        Destroying the cluster now will also destroy disconnected machines.
+      </p>
+      <p class="text-primary-P3 py-2 font-bold">
+        These machines will need to be wiped and reinstalled to be used with Omni again.
+        If the machines can be recovered, you may wish to recover them before destroying the cluster, to allow a graceful reset of the machines.
+      </p>
+    </div>
+    <p v-else class="text-xs">Please confirm the action.</p>
+
+    <div class="flex justify-end gap-4 mt-8">
+      <t-button @click="destroyCluster" :disabled="destroying || loading" class="w-32 h-9">
+        <t-spinner v-if="destroying" class="w-5 h-5" />
+        <span v-else>
+          Destroy
+        </span>
+      </t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref, Ref } from 'vue';
+import { useRoute, useRouter } from "vue-router";
+import { showError, showSuccess } from "@/notification";
+import pluralize from "pluralize";
+import { Resource, ResourceService } from "@/api/grpc";
+import Watch from "@/api/watch";
+import { Runtime } from "@/api/common/omni.pb";
+import { MachineStatusLabelDisconnected, MachineStatusType, DefaultNamespace, LabelCluster, SiderolinkResourceType } from "@/api/resources";
+
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import { clusterDestroy } from "@/methods/cluster";
+import ManagedByTemplatesWarning from "@/views/cluster/ManagedByTemplatesWarning.vue";
+import { withRuntime } from '@/api/options';
+
+const router = useRouter();
+const route = useRoute();
+const phase = ref("");
+let closed = false;
+
+const disconnectedMachines: Ref<Resource[]> = ref([]);
+
+const close = () => {
+  if (closed) {
+    return;
+  }
+
+  closed = true;
+
+  router.go(-1);
+};
+
+const machinesWatch = new Watch(disconnectedMachines);
+const loading = machinesWatch.loading;
+
+machinesWatch.setup({
+  resource: {
+    namespace: DefaultNamespace,
+    type: MachineStatusType,
+  },
+  selectors: [
+    MachineStatusLabelDisconnected,
+    `${LabelCluster}=${route.query.cluster as string}`,
+  ],
+  runtime: Runtime.Omni
+});
+
+const destroyCluster = async () => {
+  destroying.value = true;
+
+  // copy machines to avoid updates coming from the watch
+  const machines = disconnectedMachines.value.slice(0, disconnectedMachines.value.length);
+
+  for (const machine of machines) {
+    phase.value = `Tearing down disconnected machine ${machine.metadata.id}`;
+
+    try {
+      await ResourceService.Teardown({
+        namespace: DefaultNamespace,
+        type: SiderolinkResourceType,
+        id: machine.metadata.id!,
+      }, withRuntime(Runtime.Omni));
+    } catch (e) {
+      close();
+
+      showError("Failed to Destroy the Cluster", e.message)
+
+      return;
+    }
+  }
+
+  try {
+    await clusterDestroy(route.query.cluster as string)
+  } catch (e) {
+    close();
+
+    if (e.errorNotification) {
+      showError(
+        e.errorNotification.title,
+        e.errorNotification.details,
+      )
+
+      return;
+    }
+
+    showError("Failed to Destroy the Cluster", e.message);
+
+    return;
+  }
+
+  for (const machine of machines) {
+    phase.value = `Remove disconnected machine ${machine.metadata.id}`;
+
+    try {
+      await ResourceService.Delete({
+        namespace: DefaultNamespace,
+        type: SiderolinkResourceType,
+        id: machine.metadata.id!,
+      }, withRuntime(Runtime.Omni));
+    } catch (e) {
+      close();
+
+      showError("Failed to Destroy the Cluster", e.message)
+
+      return;
+    }
+  }
+
+  destroying.value = false;
+
+  close();
+
+  showSuccess(
+    `The Cluster ${route.query.cluster} is Tearing Down`,
+  );
+}
+
+const destroying = ref(false);
+</script>
+
+<style scoped>
+.window {
+  @apply rounded bg-naturals-N2 z-30 w-1/3 flex flex-col p-8;
+}
+
+.heading {
+  @apply flex justify-between items-center mb-5 text-xl text-naturals-N14;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/ConfigPatchDestroy.vue b/frontend/src/views/omni/Modals/ConfigPatchDestroy.vue
new file mode 100644
index 000000000..c94f294dd
--- /dev/null
+++ b/frontend/src/views/omni/Modals/ConfigPatchDestroy.vue
@@ -0,0 +1,80 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14">
+        Destroy the Config Patch {{ route.query.id }} ?
+      </h3>
+      <close-button @click="close"/>
+    </div>
+    <managed-by-templates-warning warning-style="popup"/>
+    <p class="text-xs">Please confirm the action.</p>
+    <div class="flex justify-end gap-4 mt-8">
+      <t-button @click="destroyPatch" class="w-32 h-9" :disabled="scalingDown">
+        Destroy
+      </t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { DefaultNamespace, ConfigPatchType } from "@/api/resources";
+import { ref } from "vue";
+import { useRoute, useRouter } from "vue-router";
+import { showError, showSuccess } from "@/notification";
+import { withRuntime } from "@/api/options";
+import { Runtime } from "@/api/common/omni.pb";
+import { ResourceService } from "@/api/grpc";
+
+import TButton from "@/components/common/Button/TButton.vue";
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import ManagedByTemplatesWarning from "@/views/cluster/ManagedByTemplatesWarning.vue";
+
+const router = useRouter();
+const route = useRoute();
+const scalingDown = ref(false);
+
+let closed = false;
+
+const close = () => {
+  if (closed) {
+    return;
+  }
+
+  closed = true;
+
+  router.go(-1);
+};
+
+const destroyPatch = async () => {
+  try {
+    await ResourceService.Delete({
+      namespace: DefaultNamespace,
+      type: ConfigPatchType,
+      id: route.query.id as string,
+    }, withRuntime(Runtime.Omni));
+  } catch (e) {
+    showError("Failed to Destroy The Config Patch", e.message)
+
+    return;
+  } finally {
+    close();
+  }
+
+  showSuccess(
+    `The Config Patch ${route.query.id} was Destroyed`,
+  );
+}
+</script>
+
+<style scoped>
+.heading {
+  @apply flex justify-between items-center mb-5 text-xl text-naturals-N14;
+}
+</style>
+
diff --git a/frontend/src/views/omni/Modals/ConfigPatchEdit.vue b/frontend/src/views/omni/Modals/ConfigPatchEdit.vue
new file mode 100644
index 000000000..85abb60bb
--- /dev/null
+++ b/frontend/src/views/omni/Modals/ConfigPatchEdit.vue
@@ -0,0 +1,141 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window" style="min-height: 350px">
+    <div class="flex px-8 my-7 items-center">
+      <div class="heading">Edit Config Patch</div>
+      <div class="flex justify-end flex-1">
+        <t-button @click="openDocs" icon="question" type="subtle" iconPosition="left">Config Reference</t-button>
+      </div>
+    </div>
+    <div class="px-8 relative" v-if="err">
+      <t-alert
+        class="absolute z-50 left-8 right-8 top-16"
+        type="error"
+        :title="err.title"
+        :dismiss="{action: () => err = null, name: 'Close'}"
+        >{{ err.message }}</t-alert>
+    </div>
+    <TabGroup as="div" class="flex-1 flex flex-col overflow-hidden">
+      <TabList>
+        <tabs-header class="px-6">
+          <Tab v-slot="{ selected }" v-for="tab in tabs" :key="tab.id">
+            <TabButton :selected="selected">
+              {{ tab.id }}
+            </TabButton>
+          </Tab>
+        </tabs-header>
+      </TabList>
+      <TabPanels as="template">
+        <TabPanel as="template" :key="tab.id" v-for="tab in tabs">
+          <div class="flex-1 overflow-y-auto font-sm bg-naturals-N2">
+            <CodeEditor
+                :value="configs[tab.id].value"
+                @update:value="(updated) => configs[tab.id].value = updated"
+            />
+          </div>
+        </TabPanel>
+      </TabPanels>
+    </TabGroup>
+    <div class="flex p-4 gap-4 bg-naturals-N3 rounded-b">
+      <t-button type="secondary" @click="close" class="place-self-start">Cancel</t-button>
+      <div class="flex-1"/>
+      <t-button @click="saveAndClose">Save</t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Ref, ref, toRefs } from "vue";
+import { closeModal } from "@/modal";
+import { ManagementService } from "@/api/omni/management/management.pb";
+import { Code } from "@/api/google/rpc/code.pb";
+
+import TButton from "@/components/common/Button/TButton.vue";
+import TAlert from "@/components/TAlert.vue";
+import TabList from "@/components/common/Tabs/TabList.vue";
+import TabButton from "@/components/common/Tabs/TabButton.vue";
+import TabsHeader from "@/components/common/Tabs/TabsHeader.vue";
+
+import { TabGroup, TabPanel, TabPanels, Tab } from "@headlessui/vue";
+
+import CodeEditor from "@/components/common/CodeEditor/CodeEditor.vue";
+
+interface Props {
+  onSave: (config: string, id?: string) => void,
+  tabs: {id: string, config: string}[],
+}
+
+const configs: Record<string, Ref<string>> = {};
+const props = defineProps<Props>();
+
+const { tabs } = toRefs(props);
+
+for (const tab of tabs.value) {
+  configs[tab.id] = ref(tab.config);
+}
+
+const err = ref<null | {message: string, title: string}>(null);
+
+const close = () => {
+  closeModal();
+};
+
+const save = async (): Promise<any> => {
+  const promises: Promise<any>[] = [];
+
+  for (const id in configs) {
+    err.value = null;
+
+    if (!configs[id].value)
+      continue;
+
+    promises.push(ManagementService.ValidateConfig({
+      config: configs[id].value
+    }).catch((e: { code?: Code, message?: string }) => {
+      if (e.code === Code.INVALID_ARGUMENT) {
+        err.value = {
+          title: "The Config is Invalid",
+          message: e.message!,
+        };
+      } else {
+        err.value = {
+          title: "Failed to Validate the Config",
+          message: e.message!,
+        };
+      }
+      throw e;
+    }));
+  }
+
+  for (const id in configs) {
+    if (props.onSave) {
+      props.onSave(configs[id].value, id);
+    }
+  }
+
+  return Promise.all(promises);
+};
+
+const saveAndClose = async () => {
+  await save();
+  close();
+}
+
+const openDocs = () => {
+  window.open("https://www.talos.dev/latest/reference/configuration/", "_blank");
+};
+</script>
+
+<style scoped>
+.modal-window {
+  @apply p-0 w-2/3 h-2/3;
+}
+.heading {
+  @apply text-xl text-naturals-N14;
+}
+</style> 
diff --git a/frontend/src/views/omni/Modals/DownloadInstallationMedia.vue b/frontend/src/views/omni/Modals/DownloadInstallationMedia.vue
new file mode 100644
index 000000000..1fc06bff8
--- /dev/null
+++ b/frontend/src/views/omni/Modals/DownloadInstallationMedia.vue
@@ -0,0 +1,472 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window flex flex-col gap-4">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14">
+        Download Installation Media
+      </h3>
+      <close-button @click="close" />
+    </div>
+
+    <div v-if="phase !== Phase.Idle" class="flex flex-col items-center">
+      <div class="flex gap-2 items-center"><document-arrow-down-icon class="w-5 h-5"/>{{ installationMedia?.spec.name }}</div>
+      <div class="flex gap-2 items-center"><t-spinner class="w-5 h-5"/>
+        <span v-if="phase === Phase.Loading">{{ downloaded }}</span>
+        <span v-else>Generating Image</span>
+      </div>
+    </div>
+    <template v-else>
+      <div class="flex gap-3 flex-wrap">
+        <div v-if="talosVersions" class="flex flex-wrap gap-4">
+          <t-select-list @checkedValue="setTalosVersion" title="Talos Version" :defaultValue="DefaultTalosVersion" :values="talosVersions"
+            :searcheable="true" />
+        </div>
+
+        <div v-if="!!optionsWatch && defaultValue" class="flex flex-wrap gap-4">
+          <t-select-list @checkedValue="setOption" title="Options" :defaultValue="defaultValue" :values="optionNames"
+            :searcheable="true" />
+        </div>
+      </div>
+
+      <div class="flex">
+        <h3 class="text-sm text-naturals-N14 flex-1">
+          Pre-Install Extensions
+        </h3>
+        <t-checkbox
+          class="col-span-2"
+          label="Show Descriptions"
+          @click="showDescriptions = !showDescriptions"
+          :checked="showDescriptions"/>
+      </div>
+
+      <div class="flex flex-col gap-2">
+        <t-input icon="search" v-model="filterExtensions"/>
+
+        <div class="grid grid-cols-4 bg-naturals-N4 uppercase text-xs text-naturals-N13 pl-2 py-2">
+          <div class="col-span-2">Name</div>
+          <div>Version</div>
+          <div>Author</div>
+        </div>
+
+        <Watch
+          class="max-h-48 overflow-y-auto overflow-x-hidden"
+          v-if="selectedTalosVersion"
+          :opts="{
+            resource: {
+              id: selectedTalosVersion,
+              type: TalosExtensionsType,
+              namespace: DefaultNamespace,
+            },
+            runtime: Runtime.Omni,
+          }"
+          displayAlways
+          >
+          <template #default="{ items }">
+            <div v-if="items[0]?.spec.items" class="flex flex-col">
+              <div v-for="extension in filteredExtensions(items[0].spec.items!)" :key="extension.name" class="cursor-pointer flex gap-2 hover:bg-naturals-N5 transition-colors p-2 border-b border-naturals-N6 items-center"
+                  @click="installExtensions[extension.name!] = !installExtensions[extension.name!]">
+                <t-checkbox
+                    class="col-span-2"
+                    :checked="installExtensions[extension.name!]"/>
+                <div class="grid grid-cols-4 gap-1 flex-1 items-center">
+                  <div class="text-xs text-naturals-N13 col-span-2">
+                    <WordHighlighter
+                        :query="filterExtensions"
+                        :textToHighlight="extension.name!.slice('siderolabs/'.length)"
+                        highlightClass="bg-naturals-N14"
+                    />
+                  </div>
+                  <div class="text-xs text-naturals-N13">{{ extension.version }}</div>
+                  <div class="text-xs text-naturals-N13">{{ extension.author }}</div>
+                  <div class="col-span-4 text-xs" v-if="extension.description && showDescriptions">
+                    {{ extension.description }}
+                  </div>
+                </div>
+              </div>
+            </div>
+            <div v-else class="flex gap-1 items-center text-xs p-4 text-primary-P2">
+              <t-icon class="w-3 h-3" icon="warning"/>No extensions available for this Talos version
+            </div>
+          </template>
+        </Watch>
+      </div>
+
+      <h3 class="text-sm text-naturals-N14 flex-1">
+        Machine User Labels
+      </h3>
+
+      <div class="flex items-center gap-2">
+        <Labels v-model="labels"/>
+      </div>
+
+      <h3 class="text-sm text-naturals-N14 flex-1">
+        Additional Kernel Arguments
+      </h3>
+
+      <t-input v-model="kernelArguments"/>
+
+      <!-- TODO(image-factory): enable this after further testing and making sure that it works -->
+      <template v-if="false">
+        <h3 class="text-sm text-naturals-N14 flex-1">
+          Secure Boot
+        </h3>
+
+        <t-checkbox
+            label="Enabled"
+            :disabled="installationMedia?.spec?.no_secure_boot"
+            @click="secureBoot = !secureBoot"
+            :checked="secureBoot && !installationMedia?.spec?.no_secure_boot"/>
+      </template>
+
+      <h3 class="text-sm text-naturals-N14 flex-1">
+        PXE Boot URL
+      </h3>
+
+      <div class="cursor-pointer px-1.5 py-1.5 rounded border border-naturals-N8 text-xs flex gap-2 items-center">
+        <icon-button class="min-w-max" icon="refresh" @click="createSchematic" :icon-classes="{'animate-spin': creatingSchematic}"/>
+        <span v-if="copiedPXEURL" class="flex-1 text-sm">Copied!</span>
+        <span v-else class="flex-1 break-all" @click="createSchematic">{{ pxeURL ? pxeURL : 'Click to generate' }}</span>
+        <icon-button class="min-w-max" icon="copy" @click="copyPXEURL"/>
+      </div>
+
+      <div>
+        <p class="text-xs">The generated image will include the kernel arguments required to register with Omni automatically.</p>
+      </div>
+
+      <div class="flex justify-end gap-4">
+        <t-button @click="close" class="w-32 h-9">
+          Cancel
+        </t-button>
+        <t-button @click="download" class="w-32 h-9" type="highlighted">
+          Download
+        </t-button>
+      </div>
+    </template>
+   </div>
+</template>
+
+<script setup lang="ts">
+import { DefaultNamespace, DefaultTalosVersion, EphemeralNamespace, LabelsMeta, TalosExtensionsType, TalosVersionType, SecureBoot } from "@/api/resources";
+import { useRouter } from "vue-router";
+import { onUnmounted, ref, watch, computed, Ref } from "vue";
+import { InstallationMediaType } from "@/api/resources";
+import { InstallationMediaSpec, TalosExtensionsSpecInfo, TalosVersionSpec } from "@/api/omni/specs/omni.pb";
+import { Runtime } from "@/api/common/omni.pb";
+import { showError } from "@/notification";
+import { formatBytes } from "@/methods";
+import { Resource } from "@/api/grpc";
+
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import TSelectList from "@/components/common/SelectList/TSelectList.vue";
+import Labels from "@/components/common/Labels/Labels.vue";
+import WatchResource from "@/api/watch";
+import Watch from "@/components/common/Watch/Watch.vue";
+import TCheckbox from "@/components/common/Checkbox/TCheckbox.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import TInput from "@/components/common/TInput/TInput.vue";
+import WordHighlighter from "vue-word-highlighter";
+import IconButton from "@/components/common/Button/IconButton.vue";
+
+import { copyText } from "vue3-clipboard";
+import { DocumentArrowDownIcon } from "@heroicons/vue/24/outline";
+import { CreateSchematicRequest, ManagementService } from "@/api/omni/management/management.pb";
+
+enum Phase {
+  Idle = 0,
+  Generating = 1,
+  Loading = 2,
+}
+
+const installExtensions = ref<Record<string, boolean>>({})
+const router = useRouter();
+const phase = ref(Phase.Idle);
+const showDescriptions = ref(false);
+const fileSizeLoaded = ref(0);
+const filterExtensions = ref("");
+const kernelArguments = ref("");
+const creatingSchematic = ref(false);
+
+let controller: AbortController;
+let closed = false;
+
+const abortDownload = () => {
+  phase.value = Phase.Idle;
+
+  if (controller) {
+    controller.abort();
+  }
+}
+
+const close = () => {
+  abortDownload();
+  if (closed) {
+    return;
+  }
+
+  closed = true;
+
+  router.go(-1);
+};
+
+const labels: Ref<Record<string, {
+  value: string
+  canRemove: boolean
+}>> = ref({});
+
+const optionNames: Ref<string[]> = ref([]);
+
+const watchOptions: Ref<Resource<InstallationMediaSpec>[]> = ref([]);
+
+const options: Ref<Map<string, Resource<InstallationMediaSpec>>> = ref(new Map<string, Resource>());
+
+const defaultValue = ref("")
+
+const talosVersionsResources: Ref<Resource<TalosVersionSpec>[]> = ref([])
+
+const optionsWatch = new WatchResource(watchOptions);
+const talosVersionsWatch = new WatchResource(talosVersionsResources)
+const schematicID = ref<string>();
+const pxeBaseURL = ref<string>();
+const secureBoot = ref(false);
+
+const pxeURL = computed(() => {
+  if (!pxeBaseURL.value || !installationMedia.value) {
+    return;
+  }
+
+  let url = `${pxeBaseURL.value}/${selectedTalosVersion.value}/${installationMedia.value.spec.src_file_prefix}`;
+
+  if (secureBoot.value && !installationMedia.value.spec.no_secure_boot) {
+    url += "-secureboot";
+  }
+
+  return url;
+});
+
+optionsWatch.setup({
+  runtime: Runtime.Omni,
+  resource: {
+    type: InstallationMediaType,
+    namespace: EphemeralNamespace,
+  },
+});
+
+talosVersionsWatch.setup({
+  runtime: Runtime.Omni,
+  resource: {
+    type: TalosVersionType,
+    namespace: DefaultNamespace,
+  },
+})
+
+const talosVersions = computed(() => talosVersionsResources.value?.map(res => res.metadata.id!));
+
+const selectedOption = ref("");
+const selectedTalosVersion = ref(DefaultTalosVersion);
+const filteredExtensions = (items: TalosExtensionsSpecInfo[]) => {
+  if (!filterExtensions.value) {
+    return items;
+  }
+
+  return items.filter(item => item.name?.includes(filterExtensions.value));
+}
+
+watch(() => optionsWatch.items?.value.length, () => {
+  options.value = watchOptions.value.reduce((map, obj) => {
+    return map.set(obj.spec.name!, obj);
+  }, options.value);
+
+  optionNames.value = watchOptions.value.map(item => item.spec.name!).sort()
+
+  defaultValue.value = optionNames.value[0]
+  selectedOption.value = defaultValue.value
+});
+
+watch([selectedOption, selectedTalosVersion, labels, installExtensions.value], () => {
+  pxeBaseURL.value = undefined;
+  schematicID.value = undefined;
+});
+
+onUnmounted(abortDownload);
+
+const createSchematic = async () => {
+  if (creatingSchematic.value) {
+    return;
+  }
+
+  creatingSchematic.value = true;
+
+  try {
+    const schematic: CreateSchematicRequest = {
+      extensions: [],
+      extra_kernel_args: [],
+      meta_values: {},
+    };
+
+    if (labels.value) {
+      const l: Record<string, string> = {};
+      for (const k in labels.value) {
+        l[k] = labels.value[k].value;
+      }
+
+      schematic.meta_values![LabelsMeta] = JSON.stringify(l);
+    }
+
+    for (const key in installExtensions.value) {
+      if (installExtensions.value[key]) {
+        schematic.extensions?.push(key);
+      }
+    }
+
+    schematic.extra_kernel_args = kernelArguments.value.split(" ").filter(item => item.trim());
+
+    const resp = await ManagementService.CreateSchematic(schematic);
+
+    pxeBaseURL.value = resp.pxe_url;
+    schematicID.value = resp.schematic_id;
+
+    return resp;
+  } finally {
+    creatingSchematic.value = false;
+  }
+}
+
+const installationMedia = computed(() => {
+  const downloadOption = options.value.get(selectedOption.value);
+  if (!downloadOption) {
+    return
+  }
+
+  return downloadOption;
+})
+
+const getFilename = (headers: Headers) => {
+  const disposition = headers.get('Content-Disposition');
+  if (!disposition) {
+    throw new Error("no filename header in the response")
+  }
+
+  const parts = disposition.split(";");
+
+  return parts[1].split("=")[1];
+}
+
+const download = async () => {
+  abortDownload();
+
+  controller = new AbortController();
+
+  if (!installationMedia.value) {
+    return;
+  }
+
+  const doRequest = async (url: string, init?: any) => {
+    const resp = await fetch(url, init);
+
+    if (!resp.ok) {
+      throw new Error(`request failed: ${resp.status} ${await resp.text()}`);
+    }
+
+    return resp;
+  }
+
+  try {
+    const schematicResponse = await createSchematic();
+
+    let url = `/image/${schematicResponse.schematic_id}/v${selectedTalosVersion.value}/${installationMedia.value.metadata.id}`;
+
+    if (secureBoot.value && !installationMedia.value.spec.no_secure_boot) {
+      url += `?${SecureBoot}=true`;
+    }
+
+    phase.value = Phase.Generating;
+
+    await doRequest(url, { signal: controller.signal, method: "HEAD" });
+
+    phase.value = Phase.Loading;
+
+    const resp = await doRequest(url, { signal: controller.signal });
+
+    fileSizeLoaded.value = 0;
+
+    const filename = getFilename(resp.headers);
+
+    const res = new Response(new ReadableStream({
+      async start(controller) {
+        const reader = resp.body!.getReader();
+
+        for (; ;) {
+          const { done, value } = await reader.read();
+          if (done) {
+            break;
+          }
+
+          fileSizeLoaded.value += value.byteLength;
+          controller.enqueue(value);
+        }
+
+        controller.close();
+      },
+    }));
+
+    var a = document.createElement('a');
+    const objectURL = window.URL.createObjectURL(await res.blob());
+    a.style.display = "none";
+    a.href = objectURL;
+    a.download = filename;
+    document.body.appendChild(a);
+    a.click();
+    window.URL.revokeObjectURL(objectURL);
+    a.remove();
+  } catch (e) {
+    showError("Download Failed", e.message);
+
+    throw e;
+  } finally {
+    close();
+    phase.value = Phase.Idle;
+  }
+}
+
+const setOption = (value: string) => {
+  selectedOption.value = value;
+}
+
+const setTalosVersion = (value: string) => {
+  selectedTalosVersion.value = value;
+}
+
+const copiedPXEURL = ref(false);
+
+const copyPXEURL = async () => {
+  if (!pxeURL.value) {
+    await createSchematic();
+  }
+
+  copyText(pxeURL.value, undefined, () => {});
+
+  copiedPXEURL.value = true;
+  setTimeout(() => copiedPXEURL.value = false, 2000)
+}
+
+const downloaded = computed(() => {
+  return formatBytes(fileSizeLoaded.value);
+});
+</script>
+
+<style scoped>
+.modal-window {
+  @apply w-1/2 h-auto p-8;
+}
+
+.heading {
+  @apply flex justify-between items-center text-xl text-naturals-N14;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/DownloadOmnictl.vue b/frontend/src/views/omni/Modals/DownloadOmnictl.vue
new file mode 100644
index 000000000..9916241ce
--- /dev/null
+++ b/frontend/src/views/omni/Modals/DownloadOmnictl.vue
@@ -0,0 +1,98 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14">
+        Download Omnictl
+      </h3>
+      <close-button @click="close" />
+    </div>
+
+    <div class="flex flex-wrap gap-4 mb-5">
+      <t-select-list @checkedValue="setOption" title="omnictl" :defaultValue="defaultValue" :values="options"
+        :searcheable="true" />
+    </div>
+
+    <div>
+      <p class="text-xs"><code>omnictl</code> can be used to access omni resources.</p>
+    </div>
+
+    <div class="flex justify-end gap-4 mt-8">
+      <t-button @click="close" class="w-32 h-9">
+        <span>
+          Cancel
+        </span>
+      </t-button>
+      <t-button @click="download" class="w-32 h-9">
+        <span>
+          Download
+        </span>
+      </t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useRouter } from "vue-router";
+
+import TButton from "@/components/common/Button/TButton.vue";
+import TSelectList from "@/components/common/SelectList/TSelectList.vue";
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import { ref } from "vue";
+
+const router = useRouter();
+let closed = false;
+
+const close = () => {
+  if (closed) {
+    return;
+  }
+
+  closed = true;
+
+  router.go(-1);
+};
+
+const options = [
+  'omnictl-darwin-amd64',
+  'omnictl-darwin-arm64',
+  'omnictl-linux-amd64',
+  'omnictl-linux-arm64',
+  'omnictl-windows-amd64.exe'
+]
+
+const selectedOption = ref(options[2])
+
+const download = async () => {
+  close();
+
+  const url: string = "/omnictl/" + selectedOption.value;
+
+  const a = document.createElement('a');
+  a.href = url;
+  document.body.appendChild(a);
+  a.click();
+  a.remove();
+}
+
+const setOption = (value: string) => {
+  selectedOption.value = value;
+}
+
+const defaultValue = options[2];
+</script>
+
+<style scoped>
+.modal-window {
+  @apply w-1/3 h-auto p-8;
+}
+
+.heading {
+  @apply flex justify-between items-center mb-5 text-xl text-naturals-N14;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/DownloadTalosctl.vue b/frontend/src/views/omni/Modals/DownloadTalosctl.vue
new file mode 100644
index 000000000..f84870a93
--- /dev/null
+++ b/frontend/src/views/omni/Modals/DownloadTalosctl.vue
@@ -0,0 +1,154 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14">
+        Download Talosctl
+      </h3>
+      <close-button @click="close"/>
+    </div>
+
+    <div class="flex flex-wrap gap-4 mb-5">
+      <div v-if="selectedOption" class="flex flex-wrap gap-4">
+        <t-select-list @checkedValue="setVersion" title="version" :defaultValue="defaultVersion"
+                       :values="Object.keys(talosctlRelease?.release_data?.available_versions)"
+                       :searcheable="true"/>
+        <t-select-list @checkedValue="setOption" title="talosctl" :defaultValue="defaultValue"
+                       :values="versionBinaries"
+                       :searcheable="true"/>
+      </div>
+      <div v-else>
+        <t-spinner class="w-6 h-6"/>
+      </div>
+    </div>
+
+    <div>
+      <p class="text-xs"><code>talosctl</code> can be used to access cluster nodes using Talos machine API.</p>
+      <p class="text-xs">More downloads links can be found <a target="_blank" rel="noopener noreferrer" class="download-link text-xs" href="https://github.com/siderolabs/talos/releases">here</a>.</p>
+    </div>
+
+    <div class="flex justify-end gap-4 mt-8">
+      <t-button @click="close" class="w-32 h-9">
+        <span>Cancel</span>
+      </t-button>
+      <t-button @click="download" class="w-32 h-9">
+        <span>Download</span>
+      </t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useRouter } from "vue-router";
+import TButton from "@/components/common/Button/TButton.vue";
+import TSelectList from "@/components/common/SelectList/TSelectList.vue";
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import { computed, onMounted, Ref, ref } from "vue";
+import { showError } from "@/notification";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+
+const router = useRouter();
+let closed = false;
+
+const close = () => {
+  if (closed) {
+    return;
+  }
+
+  closed = true;
+
+  router.go(-1);
+};
+
+onMounted(async () => {
+  // Its sad that you cannot execute async function in computed
+  const url = "/talosctl/downloads";
+
+  try {
+    const res = await fetch(url);
+    talosctlRelease.value = await res.json();
+  } catch (e) {
+    showError(e.message);
+    return;
+  }
+
+  defaultVersion.value = talosctlRelease.value.release_data.default_version
+  selectedVersion.value = defaultVersion.value;
+
+  defaultValue.value = talosctlRelease.value.release_data.available_versions[defaultVersion.value].find((item) => item.url.endsWith("linux-amd64"))?.name as string;
+  selectedOption.value = defaultValue.value;
+});
+
+const talosctlRelease: Ref<ResponseData> = ref({});
+const defaultValue = ref("");
+const selectedOption = ref("");
+const setOption = (value: string) => selectedOption.value = value;
+const defaultVersion = ref("");
+const selectedVersion = ref("");
+const setVersion = (value: string) => selectedVersion.value = value;
+
+const download = async () => {
+  close();
+
+  const link = talosctlRelease?.value?.release_data?.available_versions[selectedVersion.value].find((item) => item.name == selectedOption.value);
+  if (!link) {
+    return;
+  }
+
+  const a = document.createElement('a');
+  a.href = link.url;
+  document.body.appendChild(a);
+  a.click();
+  a.remove();
+}
+
+const versionBinaries = computed(() => {
+  const result = talosctlRelease
+    ?.value
+    ?.release_data
+    ?.available_versions[selectedVersion.value]
+    ?.map((item) => {
+      return item.name as string
+    });
+
+  if (!result) {
+    return [] as string[];
+  }
+
+  return result;
+});
+
+interface ResponseData {
+  status: string,
+  release_data: ReleaseData,
+}
+
+interface ReleaseData {
+  default_version: string,
+  available_versions: {[key: string]: Asset[]},
+}
+
+interface Asset {
+  name: string,
+  url: string,
+}
+</script>
+
+<style scoped>
+.modal-window {
+  @apply w-1/3 h-auto p-8;
+}
+
+.heading {
+  @apply flex justify-between items-center mb-5 text-xl text-naturals-N14;
+}
+
+.download-link {
+  @apply underline;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/MachineClassDestroy.vue b/frontend/src/views/omni/Modals/MachineClassDestroy.vue
new file mode 100644
index 000000000..b1bc2fbaf
--- /dev/null
+++ b/frontend/src/views/omni/Modals/MachineClassDestroy.vue
@@ -0,0 +1,75 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14">
+        Destroy the Machine Class {{ $route.query.classname }} ?
+      </h3>
+      <close-button @click="close"/>
+    </div>
+
+    <p class="text-xs py-2">Please confirm the action.</p>
+
+    <div class="flex justify-end gap-4 mt-8">
+      <t-button @click="destroy" class="w-32 h-9" icon="delete" iconPosition="left">
+        Destroy
+      </t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useRoute, useRouter } from "vue-router";
+import { showError, showSuccess } from "@/notification";
+import { ResourceService } from "@/api/grpc";
+import { Runtime } from "@/api/common/omni.pb";
+import { withRuntime } from "@/api/options";
+import { DefaultNamespace, MachineClassType } from "@/api/resources";
+
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+
+const router = useRouter();
+const route = useRoute();
+
+let closed = false;
+
+const close = () => {
+  if (closed) {
+    return;
+  }
+
+  closed = true;
+
+  router.go(-1);
+};
+
+const destroy = async () => {
+  try {
+    await ResourceService.Delete({
+      id: route.query.classname as string,
+      namespace: DefaultNamespace,
+      type: MachineClassType,
+    }, withRuntime(Runtime.Omni));
+  } catch (e) {
+    showError("Failed to remove the machine class", e.message)
+  }
+
+  close();
+
+  showSuccess(
+    `The Machine Class ${route.query.classname} was Destroyed`,
+  );
+}
+</script>
+
+<style scoped>
+.heading {
+  @apply flex justify-between items-center mb-5 text-xl text-naturals-N14;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/MachineRemove.vue b/frontend/src/views/omni/Modals/MachineRemove.vue
new file mode 100644
index 000000000..9ee2c5dcc
--- /dev/null
+++ b/frontend/src/views/omni/Modals/MachineRemove.vue
@@ -0,0 +1,87 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14">
+        Destroy the Machine {{ $route.query.machine }} ?
+      </h3>
+      <close-button @click="close"/>
+    </div>
+
+    <p class="text-xs py-2">Please confirm the action.</p>
+
+    <div v-if="$route.query.cluster" class="text-xs">
+      <p class="text-primary-P3 py-2">
+        The machine <code>{{ $route.query.machine }}</code> is part of the cluster <code>{{ $route.query.cluster }}</code>.
+        Destroying the machine should be only used as a last resort, e.g. in a case of a hardware failure.
+      </p>
+      <p class="text-primary-P3 py-2 font-bold">
+        The machine will need to wiped and reinstalled to be used again with Omni.
+      </p>
+
+      <p class="py-2">
+        If you want to remove the machine from the cluster, please use the <router-link :to="{ name: 'ClusterOverview', params: { cluster: $route.query.cluster }}">cluster overview page</router-link>.
+      </p>
+    </div>
+
+    <div class="flex justify-end gap-4 mt-8">
+      <t-button @click="remove" class="w-32 h-9" icon="delete" iconPosition="left" :disabled="disabled">
+        Remove
+      </t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref } from "vue";
+import { useRoute, useRouter } from "vue-router";
+import { showError, showSuccess } from "@/notification";
+import { removeMachine } from "@/methods/machine";
+
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+
+const router = useRouter();
+const route = useRoute();
+const disabled = ref(false);
+
+let closed = false;
+
+const close = () => {
+  if (closed) {
+    return;
+  }
+
+  closed = true;
+  disabled.value = false;
+
+  router.go(-1);
+};
+
+const remove = async () => {
+  disabled.value = true;
+
+  try {
+    await removeMachine(route.query.machine as string, route.query.cluster as string)
+  } catch (e) {
+    showError("Failed to remove the machine", e.message)
+  }
+
+  close();
+
+  showSuccess(
+    `The Machine ${route.query.machine} was Removed`,
+  );
+}
+</script>
+
+<style scoped>
+.heading {
+  @apply flex justify-between items-center mb-5 text-xl text-naturals-N14;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/MachineSetDestroy.vue b/frontend/src/views/omni/Modals/MachineSetDestroy.vue
new file mode 100644
index 000000000..011db17ef
--- /dev/null
+++ b/frontend/src/views/omni/Modals/MachineSetDestroy.vue
@@ -0,0 +1,93 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14">
+        Destroy the Machine Set {{ $route.query.machineSet }} ?
+      </h3>
+      <close-button @click="close(true)"/>
+    </div>
+    <managed-by-templates-warning warning-style="popup"/>
+    <p class="text-xs mb-2">Please confirm the action.</p>
+    <div v-if="warning" class="text-yellow-Y1 text-xs mt-3">{{ warning }}</div>
+    <div class="flex items-end gap-4 mt-2">
+      <div class="flex-1"/>
+      <t-button @click="destroyMachineSet" class="w-32 h-9">
+        <span>Destroy</span>
+      </t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Ref, ref } from "vue";
+import { useRoute, useRouter } from "vue-router";
+import { showError, showSuccess } from "@/notification";
+
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import { ResourceService } from "@/api/grpc";
+import {
+  DefaultNamespace,
+  MachineSetType,
+} from "@/api/resources";
+import { Runtime } from "@/api/common/omni.pb";
+import { withRuntime } from "@/api/options";
+import ManagedByTemplatesWarning from "@/views/cluster/ManagedByTemplatesWarning.vue";
+
+const router = useRouter();
+const route = useRoute();
+const warning: Ref<string | null> = ref(null);
+
+let closed = false;
+
+const close = (goBack?: boolean) => {
+  if (closed) {
+    return;
+  }
+
+  if (!goBack && !route.query.goback) {
+    router.push({ name: 'ClusterOverview', params: { cluster: route.query.cluster as string } });
+
+    return;
+  }
+
+  closed = true;
+
+  router.go(-1);
+};
+
+const destroyMachineSet = async () => {
+  try {
+    await ResourceService.Teardown({
+      id: route.query.machineSet as string,
+      namespace: DefaultNamespace,
+      type: MachineSetType,
+    }, withRuntime(Runtime.Omni))
+  } catch (e) {
+    close(true);
+
+    showError("Failed to Destroy The Machine Set", e.message)
+
+    return;
+  }
+
+  close(true);
+
+  showSuccess(
+    `The Machine Set ${route.query.machineSet} was Removed From the Cluster`,
+    "The machine set is being torn down",
+  );
+}
+</script>
+
+<style scoped>
+.heading {
+  @apply flex justify-between items-center mb-5 text-xl text-naturals-N14;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/NodeDestroy.vue b/frontend/src/views/omni/Modals/NodeDestroy.vue
new file mode 100644
index 000000000..def7caaa8
--- /dev/null
+++ b/frontend/src/views/omni/Modals/NodeDestroy.vue
@@ -0,0 +1,185 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14">
+        Destroy the Node {{ node ?? $route.query.machine }} ?
+      </h3>
+      <close-button @click="close(true)"/>
+    </div>
+    <managed-by-templates-warning warning-style="popup"/>
+    <p class="text-xs mb-2">Please confirm the action.</p>
+    <div v-if="warning" class="text-yellow-Y1 text-xs mt-3">{{ warning }}</div>
+
+    <div class="flex items-end gap-4 mt-2">
+      <div class="flex-1"/>
+      <t-button @click="destroyNode" class="w-32 h-9" :disabled="scalingDown">
+        <t-spinner v-if="scalingDown" class="w-5 h-5"/>
+        <span v-else>Destroy</span>
+      </t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { onMounted, Ref, ref } from "vue";
+import { useRoute, useRouter } from "vue-router";
+import { showError, showSuccess } from "@/notification";
+import { destroyNodes } from "@/methods/cluster";
+import { controlPlaneMachineSetId } from "@/methods/machineset";
+import { setupNodenameWatch } from "@/methods/node";
+import pluralize from "pluralize";
+
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import { ResourceService, ResourceTyped } from "@/api/grpc";
+import {
+  ClusterMachineStatusType,
+  DefaultNamespace, LabelCluster, LabelControlPlaneRole,
+  LabelMachineSet,
+  MachineSetNodeType
+} from "@/api/resources";
+import { Runtime } from "@/api/common/omni.pb";
+import { ClusterMachineStatusSpec } from "@/api/omni/specs/omni.pb";
+import { withRuntime, withSelectors } from "@/api/options";
+import ManagedByTemplatesWarning from "@/views/cluster/ManagedByTemplatesWarning.vue";
+
+const router = useRouter();
+const route = useRoute();
+const scalingDown = ref(false);
+const warning: Ref<string | null> = ref(null);
+
+let closed = false;
+
+const close = (goBack?: boolean) => {
+  if (closed) {
+    return;
+  }
+
+  if (!goBack && !route.query.goback) {
+    router.push({ name: 'ClusterOverview', params: { cluster: route.query.cluster as string } });
+
+    return;
+  }
+
+  closed = true;
+
+  router.go(-1);
+};
+
+onMounted(async () => {
+  let controlPlanes = 0;
+  let isControlPlane = true;
+
+  try {
+    const clusterMachineStatus: ResourceTyped<ClusterMachineStatusSpec> = await ResourceService.Get({
+      type: ClusterMachineStatusType,
+      namespace: DefaultNamespace,
+      id: route.query.machine as string,
+    }, withRuntime(Runtime.Omni));
+
+    isControlPlane = clusterMachineStatus?.metadata?.labels?.[LabelControlPlaneRole] === "";
+
+    // since this code called for both worker and control plane nodes, we need to check if the node is control plane node
+    const controlPlaneMachineStatus: ResourceTyped<ClusterMachineStatusSpec> = await ResourceService.Get({
+      type: ClusterMachineStatusType,
+      namespace: DefaultNamespace,
+      id: route.query.machine as string,
+    },
+      withRuntime(Runtime.Omni),
+      withSelectors([
+        `${LabelCluster}=${route.query.cluster as string}`,
+        `${LabelControlPlaneRole}`,
+      ]),
+    );
+
+    if (!controlPlaneMachineStatus) {
+      warning.value = null;
+      return;
+    }
+
+    const resp = await ResourceService.List({
+      namespace: DefaultNamespace,
+      type: MachineSetNodeType,
+    },
+      withRuntime(Runtime.Omni),
+      withSelectors([`${LabelMachineSet}=${controlPlaneMachineSetId(route.params.cluster as string)}`]),
+    );
+
+    controlPlanes = resp.length
+  } catch (e) {
+    close(true);
+
+    showError("Failed to Destroy The Node", e.message);
+
+    return;
+  }
+
+  if (!isControlPlane || controlPlanes % 2 === 0 || controlPlanes === 1) {
+    warning.value = null;
+
+    return;
+  }
+
+  warning.value = `${pluralize("Control Plane", controlPlanes - 1, true)} will not provide fault-tolerance with etcd quorum requirements. Removing this machine will result in an even number of control plane nodes, which reduces the fault tolerance of the etcd cluster.`;
+})
+
+const node = setupNodenameWatch(route.query.machine as string);
+
+const destroyNode = async () => {
+  scalingDown.value = true;
+
+  if (!route.query.machine) {
+    showError(
+      "Failed to Destroy The Machine",
+      "The machine id not resolved",
+    )
+
+    close(true);
+
+    return;
+  }
+
+  try {
+    await destroyNodes(route.query.cluster as string, [route.query.machine as string]);
+  } catch (e) {
+    if (e.errorNotification) {
+      showError(
+        e.errorNotification.title,
+        e.errorNotification.details,
+      )
+
+      close(true);
+
+      return;
+    }
+
+    close(true);
+
+    showError("Failed to Destroy The Node", e.message)
+
+    return;
+  } finally {
+    scalingDown.value = false;
+  }
+
+  close();
+
+  showSuccess(
+    `The Machine ${node.value} was Removed From the Machine Set`,
+    "The machine set is scaling down",
+  );
+}
+</script>
+
+<style scoped>
+.heading {
+  @apply flex justify-between items-center mb-5 text-xl text-naturals-N14;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/NodeDestroyCancel.vue b/frontend/src/views/omni/Modals/NodeDestroyCancel.vue
new file mode 100644
index 000000000..f9f093ee8
--- /dev/null
+++ b/frontend/src/views/omni/Modals/NodeDestroyCancel.vue
@@ -0,0 +1,132 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14">
+        Cancel Destroy of Node {{ node ?? $route.query.machine }} ?
+      </h3>
+      <close-button @click="close(true)" />
+    </div>
+    <watch
+      :opts="{ resource: { namespace: DefaultNamespace, id: $route.query.machine as string, type: ClusterMachineType }, runtime: Runtime.Omni }" spinner>
+      <template #default="{ items }">
+        <template v-if="canRestore(items)">
+          <p class="text-xs mb-2">Please confirm the action.</p>
+
+          <div class="flex items-end gap-4 mt-2">
+            <div class="flex-1" />
+            <t-button @click="() => restore(items[0])" class="h-9">
+              Restore Machine
+            </t-button>
+          </div>
+        </template>
+        <template v-else>
+          <p class="text-xs mb-2">Restoring the machine is not possible at this stage.</p>
+
+          <div class="flex items-end gap-4 mt-2">
+            <div class="flex-1" />
+            <t-button @click="close" class="h-9">
+              Close
+            </t-button>
+          </div>
+        </template>
+      </template>
+    </watch>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useRoute, useRouter } from "vue-router";
+import { showError, showSuccess } from "@/notification";
+import { setupNodenameWatch } from "@/methods/node";
+
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import { Resource } from "@/api/grpc";
+import {
+  ClusterMachineType,
+  DefaultNamespace,
+} from "@/api/resources";
+import { ClusterMachineSpec } from "@/api/omni/specs/omni.pb";
+import { Runtime } from "@/api/common/omni.pb";
+import Watch from "@/components/common/Watch/Watch.vue";
+import { restoreNode } from "@/methods/cluster";
+
+const router = useRouter();
+const route = useRoute();
+
+let closed = false;
+
+const close = (goBack?: boolean) => {
+  if (closed) {
+    return;
+  }
+
+  if (!goBack && !route.query.goback) {
+    router.push({ name: 'ClusterOverview', params: { cluster: route.query.cluster as string } });
+
+    return;
+  }
+
+  closed = true;
+
+  router.go(-1);
+};
+
+const canRestore = (items: Resource[]) => {
+  return items.length === 0 || items[0].metadata.phase !== 'Running';
+}
+
+const node = setupNodenameWatch(route.query.machine as string);
+
+const restore = async (clusterMachine: Resource<ClusterMachineSpec>) => {
+  if (!route.query.machine) {
+    showError(
+      "Failed to Restore The Machine Set Node",
+      "The machine id not resolved",
+    )
+
+    close(true);
+
+    return;
+  }
+
+  try {
+    await restoreNode(clusterMachine);
+  } catch (e) {
+    if (e.errorNotification) {
+      showError(
+        e.errorNotification.title,
+        e.errorNotification.details,
+      )
+
+      close(true);
+
+      return;
+    }
+
+    close(true);
+
+    showError("Failed to Restore The Node", e.message)
+
+    return;
+  }
+
+  close();
+
+  showSuccess(
+    `The Machine ${node.value} was Restored`,
+  );
+}
+</script>
+
+<style scoped>
+.heading {
+  @apply flex justify-between items-center mb-5 text-xl text-naturals-N14;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/NodeReboot.vue b/frontend/src/views/omni/Modals/NodeReboot.vue
new file mode 100644
index 000000000..e7fe2916f
--- /dev/null
+++ b/frontend/src/views/omni/Modals/NodeReboot.vue
@@ -0,0 +1,132 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-wrapper" @click.self="close">
+    <div class="modal">
+      <div class="modal-heading">
+        <h3 id="modal-title" class="modal-name">
+          Reboot the machine {{ node }} ?
+        </h3>
+        <t-icon class="modal-exit" icon="close" />
+      </div>
+      <p class="text-xs">Please confirm the action.</p>
+
+      <div class="modal-buttons-box">
+        <t-button @click="close" class="modal-button" type="secondary"
+          >Cancel</t-button
+        >
+        <t-button
+          @click="reboot"
+          :disabled="!canRebootMachines || state === 'Rebooting'"
+          class="modal-button"
+          >{{ state }}</t-button
+        >
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import TButton from "@/components/common/Button/TButton.vue";
+import { computed, ref } from "vue";
+import { useRoute, useRouter } from "vue-router";
+import { MachineService } from "@/api/talos/machine/machine.pb";
+import { withContext, withRuntime } from "@/api/options";
+import { Runtime } from "@/api/common/omni.pb";
+import { showError, showSuccess } from "@/notification";
+import { setupNodenameWatch } from "@/methods/node";
+import { getContext } from "@/context";
+import { setupClusterPermissions } from "@/methods/auth";
+
+const route = useRoute();
+const router = useRouter();
+const state = ref("Reboot");
+
+const close = () => {
+  router.go(-1);
+};
+
+const node = setupNodenameWatch(route.query.machine as string);
+const context = getContext();
+
+const { canRebootMachines } = setupClusterPermissions(computed(() => context.cluster));
+
+const reboot = async () => {
+  state.value = "Rebooting";
+  const nodeName = node.value ?? route.query.machine as string;
+
+  try {
+    const res = await MachineService.Reboot(
+      {},
+      withRuntime(Runtime.Talos),
+      withContext(context),
+    );
+
+    const errors: string[] = [];
+    for (const message of (res.messages || [])) {
+      if (message?.metadata?.error)
+        errors.push(
+          `${message.metadata.hostname || nodeName} ${message.metadata.error
+          }`
+        );
+    }
+
+    if (errors.length > 0) throw new Error(errors.join(", "));
+  } catch (e: any) {
+    close();
+
+    showError("Failed to Issue Reboot", e.toString());
+
+    return
+  }
+
+  if (route.query.goback) {
+    close();
+  } else {
+    await router.push({ name: 'ClusterOverview', params: { cluster: route.params.cluster } });
+  }
+
+  showSuccess(
+    "Machine Reboot",
+    `Machine ${nodeName} is rebooting now.`
+  );
+};
+</script>
+
+<style scoped>
+.modal {
+  @apply rounded bg-naturals-N3 p-8 z-30;
+  width: 390px;
+}
+.modal-wrapper {
+  @apply fixed top-0 bottom-0 left-0 right-0 w-full h-full flex justify-center items-center  z-30;
+  background-color: rgba(16, 17, 24, 0.5);
+}
+.modal-heading {
+  @apply flex justify-between items-center;
+  margin-bottom: 13px;
+}
+.modal-name {
+  @apply text-base text-naturals-N14;
+}
+.modal-subtitle {
+  @apply text-xs;
+  margin-bottom: 19px;
+}
+.modal-subtitle-light {
+  @apply text-xs text-naturals-N13;
+}
+.modal-exit {
+  @apply fill-current text-naturals-N7 cursor-pointer transition-colors hover:text-naturals-N8 w-6 h-6;
+}
+.modal-buttons-box {
+  @apply flex justify-end w-full;
+}
+.modal-button:nth-child(1) {
+  @apply mr-4;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/NodeShutdown.vue b/frontend/src/views/omni/Modals/NodeShutdown.vue
new file mode 100644
index 000000000..68f394f4f
--- /dev/null
+++ b/frontend/src/views/omni/Modals/NodeShutdown.vue
@@ -0,0 +1,133 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-wrapper" @click.self="close">
+    <div class="modal">
+      <div class="modal-heading">
+        <h3 id="modal-title" class="modal-name">
+          Shutdown the machine {{ node }} ?
+        </h3>
+        <t-icon class="modal-exit" icon="close" />
+      </div>
+      <p class="text-xs">Please confirm the action.</p>
+
+      <div class="modal-buttons-box">
+        <t-button @click="close" class="modal-button" type="secondary"
+          >Cancel</t-button
+        >
+        <t-button
+          @click="shutdown"
+          :disabled="!canRebootMachines || state === 'Shutdown in progress'"
+          class="modal-button"
+          >{{ state }}</t-button
+        >
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import TButton from "@/components/common/Button/TButton.vue";
+import { computed, ref } from "vue";
+import { useRoute, useRouter } from "vue-router";
+import { MachineService } from "@/api/talos/machine/machine.pb";
+import { Runtime } from "@/api/common/omni.pb";
+import { showError, showSuccess } from "@/notification";
+import { getContext } from "@/context";
+import { setupNodenameWatch } from "@/methods/node";
+import { withContext, withRuntime } from "@/api/options";
+import { setupClusterPermissions } from "@/methods/auth";
+
+const route = useRoute();
+const router = useRouter();
+const state = ref("Shutdown");
+
+const node = setupNodenameWatch(route.query.machine as string);
+
+const close = () => {
+  router.go(-1);
+};
+
+const context = getContext();
+
+const { canRebootMachines } = setupClusterPermissions(computed(() => context.cluster));
+
+const shutdown = async () => {
+  state.value = "Shutdown in progress";
+
+  const nodeName = node.value ?? route.query.machine as string;
+
+  try {
+    const res = await MachineService.Shutdown(
+      {},
+      withRuntime(Runtime.Talos),
+      withContext(context),
+    );
+
+    const errors: string[] = [];
+    for (const message of (res.messages || [])) {
+      if (message?.metadata?.error)
+        errors.push(
+          `${message.metadata.hostname || nodeName} ${message.metadata.error
+          }`
+        );
+    }
+    if (errors.length > 0) throw new Error(errors.join(", "));
+  } catch (e: any) {
+    close();
+
+    showError("Failed to Issue Shutdown", e.toString());
+
+    return
+  }
+
+  if (route.query.goback) {
+    close();
+  } else {
+    await router.push({ name: 'ClusterOverview', params: { cluster: context.cluster } });
+  }
+
+  showSuccess(
+    "Machine Shutdown",
+    `Machine ${nodeName} is shutting down now.`
+  );
+};
+</script>
+
+<style scoped>
+.modal {
+  @apply rounded bg-naturals-N3 p-8 z-30;
+  width: 500px;
+}
+.modal-wrapper {
+  @apply fixed top-0 bottom-0 left-0 right-0 w-full h-full flex justify-center items-center  z-30;
+  background-color: rgba(16, 17, 24, 0.5);
+}
+.modal-heading {
+  @apply flex justify-between items-center;
+  margin-bottom: 13px;
+}
+.modal-name {
+  @apply text-base text-naturals-N14;
+}
+.modal-subtitle {
+  @apply text-xs;
+  margin-bottom: 19px;
+}
+.modal-subtitle-light {
+  @apply text-xs text-naturals-N13;
+}
+.modal-exit {
+  @apply fill-current text-naturals-N7 cursor-pointer transition-colors hover:text-naturals-N8 w-6 h-6;
+}
+.modal-buttons-box {
+  @apply flex justify-end w-full;
+}
+.modal-button:nth-child(1) {
+  @apply mr-4;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/UntaintSingleNode.vue b/frontend/src/views/omni/Modals/UntaintSingleNode.vue
new file mode 100644
index 000000000..2c468fd2e
--- /dev/null
+++ b/frontend/src/views/omni/Modals/UntaintSingleNode.vue
@@ -0,0 +1,44 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14">
+        Untaint single node cluster
+      </h3>
+      <close-button @click="closeModal"/>
+    </div>
+    <p class="text-xs">Apply patch that will enable scheduling user workloads on this node?</p>
+
+    <div class="flex justify-end gap-2 mt-8">
+      <t-button @click="onContinue(false)" class="secondary w-15 h-9">No</t-button>
+      <t-button type="highlighted" @click="onContinue(true)" class="w-15 h-9">Yes</t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { closeModal } from "@/modal";
+
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+
+const props = defineProps<{
+  onContinue: (untaint: boolean) => void;
+}>();
+
+const onContinue = (untaint: boolean) => {
+  closeModal();
+  props.onContinue(untaint);
+};
+</script>
+
+<style scoped>
+.heading {
+  @apply flex justify-between items-center mb-5 text-xl text-naturals-N14;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/UpdateKubernetes.vue b/frontend/src/views/omni/Modals/UpdateKubernetes.vue
new file mode 100644
index 000000000..e4fecff9e
--- /dev/null
+++ b/frontend/src/views/omni/Modals/UpdateKubernetes.vue
@@ -0,0 +1,190 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window flex flex-col h-1/2 gap-2">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14">Update Kubernetes</h3>
+      <close-button @click="close" />
+    </div>
+    <managed-by-templates-warning warning-style="popup"/>
+    <template v-if="status">
+      <radio-group id="k8s-upgrade-version" class="text-naturals-N13 overflow-y-auto flex-1 flex flex-col gap-2" v-model="selectedVersion">
+        <template v-for="(versions, group) in upgradeVersions" :key="group">
+          <radio-group-label as="div" class="pl-7 font-bold bg-naturals-N4 w-full p-1 text-sm">{{ group }}</radio-group-label>
+          <div class="flex flex-col gap-1">
+            <radio-group-option v-for="version in versions" :key="version" v-slot="{ checked }" :value="version">
+              <div class="flex items-center gap-2 cursor-pointer text-sm px-2 py-1 hover:bg-naturals-N4 tranform transition-color" :class="{ 'bg-naturals-N4': checked }">
+                <t-checkbox :checked="checked"/>
+                {{ version }}
+                <span v-if="version === status.spec.last_upgrade_version">(current)</span>
+              </div>
+            </radio-group-option>
+          </div>
+        </template>
+      </radio-group>
+    </template>
+
+    <p class="text-xs">
+      Changing the Kubernetes version can result in control plane downtime. During this change you will be able to cancel the upgrade.
+    </p>
+    <p class="text-xs">
+      This operation starts immediately.
+    </p>
+
+    <div v-if="runningPrechecks" class="text-primary-P3 text-xs">
+       Running pre-checks to validate the upgrade...
+    </div>
+
+    <div v-if="preCheckError" class="text-primary-P3 text-xs font-mono whitespace-pre-line">
+       {{ preCheckError }}
+    </div>
+
+    <div class="flex justify-end gap-4">
+      <t-button @click="upgradeClick" class="w-32 h-9" :disabled="!status || runningPrechecks || selectedVersion === status?.spec?.last_upgrade_version" type="highlighted">
+        <t-spinner v-if="runningPrechecks || !status" class="w-5 h-5" />
+        <span v-else>{{ action }}</span>
+      </t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Ref, ref, computed, watch } from "vue";
+import { DefaultNamespace, KubernetesUpgradeStatusType } from "@/api/resources";
+import { useRoute, useRouter } from "vue-router";
+import { Runtime } from "@/api/common/omni.pb";
+import { ResourceTyped } from "@/api/grpc";
+import { upgradeKubernetes } from "@/methods/cluster";
+import * as semver from "semver";
+import { RadioGroup, RadioGroupLabel, RadioGroupOption } from '@headlessui/vue'
+
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import TCheckbox from "@/components/common/Checkbox/TCheckbox.vue";
+import Watch from "@/api/watch";
+import { KubernetesUpgradeStatusSpec } from "@/api/omni/specs/omni.pb";
+import { ManagementService } from "@/api/omni/management/management.pb";
+import { withContext } from "@/api/options";
+import ManagedByTemplatesWarning from "@/views/cluster/ManagedByTemplatesWarning.vue";
+
+const route = useRoute();
+const router = useRouter();
+
+const runningPrechecks = ref(false);
+const preCheckError = ref("");
+const selectedVersion = ref("");
+
+const clusterName = route.params.cluster as string;
+
+const resource = {
+  namespace: DefaultNamespace,
+  type: KubernetesUpgradeStatusType,
+  id: clusterName,
+};
+
+const status: Ref<ResourceTyped<KubernetesUpgradeStatusSpec> | undefined> = ref();
+
+const upgradeStatusWatch = new Watch(status);
+
+upgradeStatusWatch.setup({
+  resource: resource,
+  runtime: Runtime.Omni,
+});
+
+watch(status, () => {
+  if (selectedVersion.value === "") {
+    selectedVersion.value = status.value?.spec.last_upgrade_version || "";
+  }
+});
+
+const upgradeVersions = computed(() => {
+  if (!status?.value?.spec?.upgrade_versions) {
+    return [];
+  }
+
+  const sorted = [...status.value.spec.upgrade_versions, status.value.spec.last_upgrade_version].sort(semver.compare);
+
+  const result = {};
+
+  for (const version of sorted) {
+    const major = semver.major(version);
+    const minor = semver.minor(version);
+
+    const majorMinor = `${major}.${minor}`;
+
+    if (!result[majorMinor]) {
+      result[majorMinor] = [];
+    }
+
+    result[majorMinor].push(version);
+  }
+
+  return result;
+});
+
+const action = computed(() => {
+  if (!status.value) {
+    return "Loading...";
+  }
+
+  switch (semver.compare(selectedVersion.value, status.value.spec.last_upgrade_version)) {
+    case 1:
+      return "Upgrade";
+    case -1:
+      return "Downgrade";
+  }
+
+  return "Unchanged";
+});
+
+let closed = false;
+
+const close = () => {
+  if (closed) {
+    return;
+  }
+
+  closed = true;
+
+  router.go(-1);
+};
+
+const upgradeClick = async () =>  {
+  runningPrechecks.value = true;
+  preCheckError.value = "";
+
+  try {
+    const response = await ManagementService.KubernetesUpgradePreChecks(
+      {
+        new_version: selectedVersion.value,
+      }, withContext({cluster: clusterName})
+    );
+
+    if (response.ok) {
+      upgradeKubernetes(clusterName, selectedVersion.value);
+
+      close();
+    } else {
+      preCheckError.value = response.reason!;
+    }
+  } catch (e) {
+    preCheckError.value = e.message || e.toString();
+  }
+
+  runningPrechecks.value = false
+};
+</script>
+
+<style scoped>
+.heading {
+  @apply flex justify-between items-center mb-5 text-xl text-naturals-N14;
+}
+optgroup {
+  @apply text-naturals-N14 font-bold;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/UpdateTalos.vue b/frontend/src/views/omni/Modals/UpdateTalos.vue
new file mode 100644
index 000000000..50b3522e4
--- /dev/null
+++ b/frontend/src/views/omni/Modals/UpdateTalos.vue
@@ -0,0 +1,159 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window flex flex-col h-1/2 gap-2">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14">Update Talos</h3>
+      <close-button @click="close" />
+    </div>
+    <managed-by-templates-warning warning-style="popup"/>
+    <template v-if="status">
+      <radio-group id="k8s-upgrade-version" class="text-naturals-N13 overflow-y-auto flex-1 flex flex-col gap-2" v-model="selectedVersion">
+        <template v-for="(versions, group) in upgradeVersions" :key="group">
+          <radio-group-label as="div" class="pl-7 font-bold bg-naturals-N4 w-full p-1 text-sm">{{ group }}</radio-group-label>
+          <div class="flex flex-col gap-1">
+            <radio-group-option v-for="version in versions" :key="version" v-slot="{ checked }" :value="version">
+              <div class="flex items-center gap-2 cursor-pointer text-sm px-2 py-1 hover:bg-naturals-N4 tranform transition-color" :class="{ 'bg-naturals-N4': checked }">
+                <t-checkbox :checked="checked"/>
+                {{ version }}
+                <span v-if="version === status.spec.last_upgrade_version">(current)</span>
+              </div>
+            </radio-group-option>
+          </div>
+        </template>
+      </radio-group>
+    </template>
+
+    <p class="text-xs">
+      Changing the Talos version can result in control plane downtime. During this change you will be able to cancel the upgrade.
+    </p>
+    <p class="text-xs">
+      This operation starts immediately.
+    </p>
+
+    <div class="flex justify-end gap-4">
+      <t-button @click="upgradeClick" class="w-32 h-9" :disabled="!status || selectedVersion === status?.spec?.last_upgrade_version" type="highlighted">
+        <t-spinner v-if="!status" class="w-5 h-5" />
+        <span v-else>{{ action }}</span>
+      </t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Ref, ref, computed, watch } from "vue";
+import { DefaultNamespace, TalosUpgradeStatusType } from "@/api/resources";
+import { useRoute, useRouter } from "vue-router";
+import { Runtime } from "@/api/common/omni.pb";
+import { updateTalos } from "@/methods/cluster";
+import * as semver from "semver";
+import { RadioGroup, RadioGroupLabel, RadioGroupOption } from '@headlessui/vue'
+
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import TCheckbox from "@/components/common/Checkbox/TCheckbox.vue";
+import Watch from "@/api/watch";
+import { TalosUpgradeStatusSpec } from "@/api/omni/specs/omni.pb";
+import { ResourceTyped } from "@/api/grpc";
+import ManagedByTemplatesWarning from "@/views/cluster/ManagedByTemplatesWarning.vue";
+
+const route = useRoute();
+const router = useRouter();
+
+const selectedVersion = ref("");
+
+const clusterName = route.params.cluster as string;
+
+const resource = {
+  namespace: DefaultNamespace,
+  type: TalosUpgradeStatusType,
+  id: clusterName,
+};
+
+const status: Ref<ResourceTyped<TalosUpgradeStatusSpec> | undefined> = ref();
+
+const upgradeStatusWatch = new Watch(status);
+
+upgradeStatusWatch.setup({
+  resource: resource,
+  runtime: Runtime.Omni,
+});
+
+watch(status, () => {
+  if (selectedVersion.value === "") {
+    selectedVersion.value = status.value?.spec.last_upgrade_version || "";
+  }
+});
+
+const upgradeVersions = computed(() => {
+  if (!status?.value?.spec?.upgrade_versions) {
+    return [];
+  }
+
+  const sorted = [...status.value.spec.upgrade_versions, status.value.spec.last_upgrade_version].sort(semver.compare);
+
+  const result = {};
+
+  for (const version of sorted) {
+    const major = semver.major(version);
+    const minor = semver.minor(version);
+
+    const majorMinor = `${major}.${minor}`;
+
+    if (!result[majorMinor]) {
+      result[majorMinor] = [];
+    }
+
+    result[majorMinor].push(version);
+  }
+
+  return result;
+});
+
+const action = computed(() => {
+  if (!status.value) {
+    return "Loading...";
+  }
+
+  switch (semver.compare(selectedVersion.value, status.value.spec.last_upgrade_version)) {
+    case 1:
+      return "Upgrade";
+    case -1:
+      return "Downgrade";
+  }
+
+  return "Unchanged";
+});
+
+let closed = false;
+
+const close = () => {
+  if (closed) {
+    return;
+  }
+
+  closed = true;
+
+  router.go(-1);
+};
+
+const upgradeClick = async () =>  {
+  updateTalos(clusterName, selectedVersion.value);
+
+  close();
+};
+</script>
+
+<style scoped>
+.heading {
+  @apply flex justify-between items-center mb-5 text-xl text-naturals-N14;
+}
+optgroup {
+  @apply text-naturals-N14 font-bold;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/UserCreate.vue b/frontend/src/views/omni/Modals/UserCreate.vue
new file mode 100644
index 000000000..bcbc340b7
--- /dev/null
+++ b/frontend/src/views/omni/Modals/UserCreate.vue
@@ -0,0 +1,94 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14">
+        Create User
+      </h3>
+      <close-button @click="close"/>
+    </div>
+
+    <div class="flex gap-2 items-center">
+      <t-input title="User Email" class="flex-1 h-full" placeholder="..." v-model="identity"/>
+      <t-select-list
+          class="h-full"
+          title="Role"
+          :values="roles"
+          :defaultValue="RoleReader"
+          @checkedValue="value => role = value"
+      />
+      <t-button type="highlighted" @click="handleUserCreate" :disabled="!canManageUsers && authType !== AuthType.SAML" class="w-32 h-9">Create User</t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Ref, ref } from "vue";
+import { createUser } from "@/methods/user";
+import { showError, showSuccess } from "@/notification";
+import { useRouter } from "vue-router";
+import { RoleNone, RoleReader, RoleOperator, RoleAdmin } from "@/api/resources";
+
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import { canManageUsers } from "@/methods/auth";
+import TSelectList from "@/components/common/SelectList/TSelectList.vue";
+import TInput from "@/components/common/TInput/TInput.vue";
+import { AuthType, authType } from "@/methods";
+
+const identity = ref("");
+const router = useRouter();
+
+const roles = [RoleNone, RoleReader, RoleOperator, RoleAdmin]
+
+const role: Ref<string> = ref(RoleReader);
+
+const handleUserCreate = async () => {
+  if (identity.value === "") {
+    showError("Failed to Create User", "User email is not defined");
+
+    return;
+  }
+
+  try {
+    await createUser(identity.value, role.value);
+  } catch (e) {
+    showError("Failed to Create User", e.message);
+
+    return;
+  }
+
+  close();
+
+  showSuccess(
+      `The User ${identity.value} is created`,
+  );
+};
+
+let closed = false;
+
+const close = () => {
+  if (closed) {
+    return;
+  }
+
+  closed = true;
+
+  router.go(-1);
+};
+</script>
+
+<style scoped>
+.window {
+  @apply rounded bg-naturals-N2 z-30 w-1/3 flex flex-col p-8;
+}
+
+.heading {
+  @apply flex justify-between items-center mb-5 text-xl text-naturals-N14;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/UserDestroy.vue b/frontend/src/views/omni/Modals/UserDestroy.vue
new file mode 100644
index 000000000..bc6ef1df1
--- /dev/null
+++ b/frontend/src/views/omni/Modals/UserDestroy.vue
@@ -0,0 +1,100 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14 truncate flex-1">
+        Destroy the User {{ $route.query.identity }} ?
+      </h3>
+      <close-button @click="close" />
+    </div>
+    <p class="text-xs">Please confirm the action.</p>
+
+    <div class="flex justify-end gap-4 mt-8">
+      <t-button @click="destroyResources" class="w-32 h-9">
+        Destroy
+      </t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { DefaultNamespace, IdentityType, UserType } from "@/api/resources";
+import { useRoute, useRouter } from "vue-router";
+import { showError, showSuccess } from "@/notification";
+import { ResourceService } from "@/api/grpc";
+import { Code } from '@/api/google/rpc/code.pb';
+import { Runtime } from "@/api/common/omni.pb";
+
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import { withRuntime } from "@/api/options";
+
+const router = useRouter();
+const route = useRoute();
+
+let closed = false;
+
+const close = () => {
+  if (closed) {
+    return;
+  }
+
+  closed = true;
+
+  router.go(-1);
+};
+
+const destroyResources = async () => {
+  let destroyed = true;
+
+  if (route.query.user) {
+    try {
+      await ResourceService.Delete({
+        namespace: DefaultNamespace,
+        type: UserType,
+        id: route.query.user as string,
+      }, withRuntime(Runtime.Omni));
+    } catch (e) {
+      if (e.code !== Code.NOT_FOUND) {
+        showError("Failed to remove the user", e.message)
+
+        destroyed = false;
+      }
+    }
+  }
+
+  if (route.query.identity) {
+    try {
+      await ResourceService.Delete({
+        namespace: DefaultNamespace,
+        type: IdentityType,
+        id: route.query.identity as string,
+      }, withRuntime(Runtime.Omni));
+    } catch (e) {
+      if (e.code !== Code.NOT_FOUND) {
+        showError("Failed to remove the identity", e.message)
+
+        destroyed = false;
+      }
+    }
+  }
+
+  close();
+
+  if (destroyed)
+    showSuccess(
+      `The User ${route.query.identity} was Destroyed`
+    );
+}
+</script>
+
+<style scoped>
+.heading {
+  @apply flex gap-2 items-center mb-5 text-xl text-naturals-N14;
+}
+</style>
diff --git a/frontend/src/views/omni/Modals/UserEdit.vue b/frontend/src/views/omni/Modals/UserEdit.vue
new file mode 100644
index 000000000..45116f208
--- /dev/null
+++ b/frontend/src/views/omni/Modals/UserEdit.vue
@@ -0,0 +1,96 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="modal-window">
+    <div class="heading">
+      <h3 class="text-base text-naturals-N14 truncate">
+        Edit User {{ $route.query.identity }}
+      </h3>
+      <close-button @click="close" />
+    </div>
+
+    <div class="flex gap-4">
+      <watch
+        :opts="{ resource: { type: UserType, namespace: DefaultNamespace, id: $route.query.user as string }, runtime: Runtime.Omni }"
+        class="flex-1">
+        <template #default="{ items }">
+          <t-select-list v-if="items[0]?.spec?.role" class="h-full" title="Role" :values="roles" :defaultValue="items[0]?.spec?.role"
+            @checkedValue="value => role = value" />
+        </template>
+      </watch>
+      <t-button type="highlighted" @click="() => { handleRoleUpdate(); close() }" :disabled="!canManageUsers"
+        class="w-32 h-9">Update User</t-button>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { Ref, ref } from "vue";
+import { updateRole } from "@/methods/user";
+import { showError, showSuccess } from "@/notification";
+import { useRoute, useRouter } from "vue-router";
+import { Runtime } from "@/api/common/omni.pb";
+import { RoleNone, RoleReader, RoleOperator, RoleAdmin, DefaultNamespace, UserType } from "@/api/resources";
+import { canManageUsers } from "@/methods/auth";
+
+import CloseButton from "@/views/omni/Modals/CloseButton.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import TSelectList from "@/components/common/SelectList/TSelectList.vue";
+import Watch from "@/components/common/Watch/Watch.vue";
+
+const router = useRouter();
+const route = useRoute();
+
+const roles = [RoleNone, RoleReader, RoleOperator, RoleAdmin]
+
+const role: Ref<string | undefined> = ref();
+const identity = route.query.identity;
+
+const handleRoleUpdate = async () => {
+  if (!role.value) {
+    return;
+  }
+
+  if (!route.query.user) {
+    showError("Failed to Update User", "User id is not defined");
+
+    return;
+  }
+
+  try {
+    await updateRole(route.query.user as string, role.value);
+  } catch (e) {
+    showError("Failed to Update User", e.message)
+
+    return;
+  }
+
+  showSuccess(`Successfully Updated User ${identity}`)
+};
+
+let closed = false;
+
+const close = () => {
+  if (closed) {
+    return;
+  }
+
+  closed = true;
+
+  router.go(-1);
+};
+</script>
+
+<style scoped>
+.window {
+  @apply rounded bg-naturals-N2 z-30 w-1/3 flex flex-col p-8;
+}
+
+.heading {
+  @apply flex justify-between items-center mb-5 text-xl text-naturals-N14;
+}
+</style>
diff --git a/frontend/src/views/omni/Overview/Overview.vue b/frontend/src/views/omni/Overview/Overview.vue
new file mode 100644
index 000000000..53b93b86d
--- /dev/null
+++ b/frontend/src/views/omni/Overview/Overview.vue
@@ -0,0 +1,269 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div v-if="hasRoleNone" class="flex flex-col items-center justify-center gap-2">
+    <div class="w-16 h-16 relative mb-6">
+      <div class="absolute w-full h-full top-0 left-0 rounded-lg bg-naturals-N2 rotate-12 translate-x-1.5 -translate-y-1.5"/>
+      <div class="flex items-center justify-center absolute w-full h-full top-0 left-0 rounded-lg bg-naturals-N3">
+        <t-icon icon="warning" class="w-6 h-6 text-naturals-N11" />
+      </div>
+    </div>
+    <p class="text-lg text-naturals-N14">You don't have access to Omni Web</p>
+    <p class="text-xs text-naturals-N10">At least Reader role is required</p>
+    <div class="flex gap-3 mt-3">
+      <t-button type="primary" icon="talos-config" iconPosition="left" @click="() => downloadOmniconfig()">
+        Download <code>omniconfig</code></t-button>
+      <t-button type="primary" icon="talos-config" iconPosition="left" @click="() => downloadOmnictl()">
+        Download omnictl</t-button>
+    </div>
+  </div>
+  <div v-else>
+    <page-header title="Home"/>
+    <watch :opts="{
+        resource: {
+          type: ConnectionParamsType,
+          namespace: DefaultNamespace,
+          id: ConfigID
+        },
+        runtime: Runtime.Omni
+      }"
+      errorsAlert
+      spinner>
+      <template #default="{ items }">
+        <div class="flex gap-6">
+          <div class="space-y-6 w-full">
+            <div class="overview-card p-6 flex flex-1 flex-wrap gap-3">
+              <div class="flex flex-col gap-3 flex-1" style="min-width: 200px">
+                <div class="text-naturals-N14 text-sm">General Information</div>
+                <div class="overview-general-info-grid">
+                  <div>Backend Version</div>
+                  <watch :opts="{ resource: sysVersionResource, runtime: Runtime.Omni }" class="text-right">
+                    <template #default="{ items }">
+                      {{ items[0]?.spec?.backend_version }}
+                    </template>
+                  </watch>
+                  <div>API Endpoint</div>
+                  <div>
+                    {{ items[0]?.spec?.api_endpoint }}
+                    <t-icon icon="copy" class="overview-copy-icon"
+                      @click="() => copyValue(items[0]?.spec?.api_endpoint)" />
+                  </div>
+                  <div>Wireguard Endpoint</div>
+                  <div>
+                    {{ items[0]?.spec?.wireguard_endpoint }}
+                    <t-icon icon="copy" class="overview-copy-icon"
+                      @click="() => copyValue(items[0]?.spec?.wireguard_endpoint)" />
+                  </div>
+                  <div>Join Token</div>
+                  <div>
+                    <div class="flex-1 truncate text-right cursor-pointer select-none token" @click="() => showJoinToken = !showJoinToken">{{ showJoinToken ? items[0]?.spec?.join_token : items[0]?.spec?.join_token.replace(/./g, "•") }}</div>
+                    <t-icon icon="copy" class="overview-copy-icon"
+                      @click="() => copyValue(items[0]?.spec?.join_token)" />
+                  </div>
+                </div>
+              </div>
+              <div class="flex px-12" v-if="canReadClusters">
+                <watch :opts="{ resource: machineStatusResource, runtime: Runtime.Omni }">
+                  <template #default="{ items }">
+                    <overview-circle-chart-item class="text-naturals-N14 text-sm"
+                      :chartFillPercents="computePercentOfMachinesAssignedToClusters(items)" name="Machines"
+                      :usageName="getNumberOfMachinesAssignedToClusters(items) + ' Used'"
+                      :usagePercents="computePercentOfMachinesAssignedToClusters(items)" :usageTotal="items?.length" />
+                  </template>
+                </watch>
+              </div>
+            </div>
+            <div v-if="canReadClusters" class="overview-card">
+              <div class="flex flex-auto gap-6 p-6">
+                <div class="text-naturals-N14 text-sm">Recent Clusters</div>
+                <div class="grow" />
+                <t-button @click="openClusterCreate" :disabled="!canCreateClusters" iconPosition="left" icon="plus" type="subtle">Create Cluster
+                </t-button>
+                <t-button @click="openClusters" iconPosition="left" icon="clusters" type="subtle">View All</t-button>
+              </div>
+              <watch :opts="{ resource: resource, runtime: Runtime.Omni, sortByField: 'created' }">
+                <template #norecords>
+                  <div class="px-6 pb-6">No clusters</div>
+                </template>
+                <template #default="{ items }">
+                  <div class="recent-clusters-row" v-for="item in items.slice(0, 5)" :key="itemID(item)">
+                    <div class="flex-1 grid grid-cols-3">
+                      <router-link :to="{ name: 'ClusterOverview', params: { cluster: item.metadata.id }}" class="list-item-link">
+                        {{ item.metadata.id }}
+                      </router-link>
+                      <div>
+                        {{ item.spec.machines.total }}
+                        {{ pluralize("Node", item.spec.machines.total) }}
+                      </div>
+                      <cluster-status :cluster="item" />
+                    </div>
+                  </div>
+                </template>
+              </watch>
+            </div>
+          </div>
+          <div class="flex-col space-y-6">
+            <div class="overview-card p-6 flex flex-col gap-5 place-items-stretch" style="width: 350px">
+              <div class="text-naturals-N14 text-sm">Add Machines</div>
+              <t-button icon="long-arrow-down" iconPosition="left" @click="() => openDownloadIso()">Download
+                Installation Media
+              </t-button>
+              <t-button icon="copy" iconPosition="left" @click="() => copyValue(items[0]?.spec?.args)">Copy Kernel
+                Parameters</t-button>
+            </div>
+            <div class="overview-card p-6 flex flex-col gap-5 place-items-stretch" style="width: 350px">
+              <div class="text-naturals-N14 text-sm">CLI</div>
+              <t-button type="primary" icon="talos-config" iconPosition="left" @click="() => downloadTalosconfig()">
+                Download <code>talosconfig</code></t-button>
+              <t-button type="primary" icon="talos-config" iconPosition="left" @click="() => downloadTalosctl()">
+                Download talosctl</t-button>
+              <t-button type="primary" icon="talos-config" iconPosition="left" @click="() => downloadOmniconfig()">
+                Download <code>omniconfig</code></t-button>
+              <t-button type="primary" icon="talos-config" iconPosition="left" @click="() => downloadOmnictl()">
+                Download omnictl</t-button>
+            </div>
+          </div>
+        </div>
+      </template>
+    </watch>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useRouter } from "vue-router";
+import pluralize from "pluralize";
+import {
+  ConnectionParamsType,
+  ClusterStatusType,
+  SysVersionType,
+  SysVersionID,
+  EphemeralNamespace,
+  DefaultNamespace,
+  ConfigID,
+  MachineStatusType, RoleNone,
+} from "@/api/resources";
+import { computed, ref } from "vue";
+import { copyText } from "vue3-clipboard";
+import { Runtime } from "@/api/common/omni.pb";
+
+import { ResourceTyped } from "@/api/grpc";
+import { itemID } from "@/api/watch";
+import { MachineStatusSpec } from "@/api/omni/specs/omni.pb";
+import { downloadTalosconfig, downloadOmniconfig } from "@/methods";
+
+import OverviewCircleChartItem from "@/views/cluster/Overview/components/OverviewCircleChart/OverviewCircleChartItem.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import TIcon from "@/components/common/Icon/TIcon.vue";
+import ClusterStatus from "@/views/omni/Clusters/ClusterStatus.vue";
+import Watch from "@/components/common/Watch/Watch.vue";
+import PageHeader from "@/components/common/PageHeader.vue";
+import { canCreateClusters, canReadClusters, currentUser } from "@/methods/auth";
+
+const hasRoleNone = computed(() => {
+  const role = currentUser.value?.spec?.role
+
+  return !role || role === RoleNone;
+});
+
+const getNumberOfMachinesAssignedToClusters = (items: any) =>
+  items?.filter(
+    (item: ResourceTyped<MachineStatusSpec>) => {
+      return item.spec.cluster;
+    }
+  ).length;
+
+const router = useRouter();
+
+const showJoinToken = ref(false);
+const resource = {
+  namespace: DefaultNamespace,
+  type: ClusterStatusType,
+};
+
+const machineStatusResource = {
+  namespace: DefaultNamespace,
+  type: MachineStatusType,
+};
+
+const sysVersionResource = {
+  type: SysVersionType,
+  namespace: EphemeralNamespace,
+  id: SysVersionID,
+};
+
+const openClusterCreate = () => {
+  router.push({ name: "ClusterCreate" });
+};
+
+const openClusters = () => {
+  router.push({ name: "Clusters" });
+};
+
+const computePercentOfMachinesAssignedToClusters = (items: any): string => {
+  return (
+    (100 / Math.max(items?.length, 1)) *
+    getNumberOfMachinesAssignedToClusters(items)
+  ).toFixed(0);
+};
+
+const copyValue = (value) => {
+  return copyText(value, undefined, () => { });
+};
+
+const openDownloadIso = () => {
+  router.push({
+    query: { modal: "downloadInstallationMedia" },
+  });
+};
+
+const downloadOmnictl = () => {
+  router.push({
+    query: { modal: "downloadOmnictlBinaries" },
+  });
+};
+
+const downloadTalosctl = () => {
+  router.push({
+    query: { modal: "downloadTalosctlBinaries" },
+  });
+};
+</script>
+
+<style scoped>
+.overview-card {
+  font-size: 12px;
+  @apply rounded bg-naturals-N2;
+}
+
+.overview-copy-icon {
+  @apply cursor-pointer w-5 text-primary-P2 p-0.5 rounded;
+}
+
+.overview-copy-icon:hover {
+  @apply bg-naturals-N5 text-primary-P1;
+}
+
+.overview-general-info-grid {
+  @apply grid grid-cols-3 text-xs gap-4;
+}
+
+.overview-general-info-grid>*:nth-child(even) {
+  @apply flex items-center col-span-2 gap-1 justify-end;
+}
+
+.recent-clusters-row {
+  @apply w-full py-4 flex place-content-between px-6;
+}
+
+.recent-clusters-row:not(:first-of-type) {
+  @apply border-t border-naturals-N4;
+}
+
+.token {
+  font-family: "Roboto Mono", "consolas", monospace, sans-serif;
+}
+</style>
diff --git a/frontend/src/views/omni/Settings/BackupStorage.vue b/frontend/src/views/omni/Settings/BackupStorage.vue
new file mode 100644
index 000000000..f0adda117
--- /dev/null
+++ b/frontend/src/views/omni/Settings/BackupStorage.vue
@@ -0,0 +1,172 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col">
+    <div class="flex gap-1 items-start">
+      <page-header title="Configure Backups Storage" class="flex-1"/>
+    </div>
+    <t-alert v-if="error" title="Failed to Fetch Current Storage State" type="error">
+      {{ error }}
+    </t-alert>
+    <div class="flex flex-col gap-5" v-else-if="ready && !saving" @keydown.enter="updateConfig">
+      <div class="text-naturals-N14 font-bold">
+        Storage Type {{ `${store.charAt(0).toUpperCase()}${store.slice(1)}` }}
+      </div>
+      <template v-if="s3Spec">
+        <t-input title="Endpoint" :model-value="s3Spec.endpoint || ''" @update:model-value="value => s3Spec.endpoint = value"/>
+        <t-input title="Bucket" :model-value="s3Spec.bucket || ''" @update:model-value="value => s3Spec.bucket = value"/>
+        <div class="flex gap-5">
+          <t-input title="Access Key ID" type="password" class="flex-1 flex-shrinl" :model-value="s3Spec.access_key_id || ''" @update:model-value="value => s3Spec.access_key_id = value"/>
+          <t-input title="Secret Access Key" type="password" class="flex-1" :model-value="s3Spec.secret_access_key || ''" @update:model-value="value => s3Spec.secret_access_key = value"/>
+        </div>
+        <t-input title="Session Token" :model-value="s3Spec.session_token || ''" @update:model-value="value => s3Spec.session_token = value"/>
+        <div class="place-self-end flex gap-2">
+          <t-button :disabled="!canManageBackupStore" @click="resetConfig">
+            Reset
+          </t-button>
+          <t-button :disabled="!canManageBackupStore" @click="updateConfig" type="highlighted">
+            Save
+          </t-button>
+        </div>
+      </template>
+    </div>
+    <div class="flex flex-1 items-center justify-center" v-else>
+      <t-spinner class="w-6 h-6"/>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { onMounted, ref } from "vue";
+import { canManageBackupStore } from "@/methods/auth";
+import { Resource, ResourceService, ResourceTyped } from "@/api/grpc";
+import { EtcdBackupOverallStatusSpec, EtcdBackupS3ConfSpec } from "@/api/omni/specs/omni.pb";
+import { Runtime } from "@/api/common/omni.pb";
+import { DefaultNamespace, EtcdBackupOverallStatusID, EtcdBackupOverallStatusType, EtcdBackupS3ConfID, EtcdBackupS3ConfType } from "@/api/resources";
+import { withRuntime } from "@/api/options";
+import { Code } from '@/api/google/rpc/code.pb';
+
+import TButton from "@/components/common/Button/TButton.vue";
+import PageHeader from "@/components/common/PageHeader.vue";
+import TInput from "@/components/common/TInput/TInput.vue";
+import TSpinner from "@/components/common/Spinner/TSpinner.vue";
+import TAlert from "@/components/TAlert.vue";
+import { showError, showSuccess } from "@/notification";
+
+const ready = ref(false);
+let s3Spec = ref<EtcdBackupS3ConfSpec>({});
+const store = ref("unknown");
+const error = ref<string>();
+const saving = ref(false);
+
+const s3ConfigMetadata = {
+  id: EtcdBackupS3ConfID,
+  type: EtcdBackupS3ConfType,
+  namespace: DefaultNamespace,
+};
+
+onMounted(async () => {
+  const status: Resource<EtcdBackupOverallStatusSpec> = await ResourceService.Get({
+    id: EtcdBackupOverallStatusID,
+    type: EtcdBackupOverallStatusType,
+    namespace: DefaultNamespace,
+  }, withRuntime(Runtime.Omni));
+
+  store.value = status.spec.configuration_name!;
+
+  if (status.spec.configuration_name !== "s3") {
+    ready.value = true;
+
+    return;
+  }
+
+  try {
+    const config = await ResourceService.Get(s3ConfigMetadata, withRuntime(Runtime.Omni));
+
+    s3Spec.value = config?.spec;
+  } catch (e) {
+    if (e.code !== Code.NOT_FOUND) {
+      error.value = e.message;
+    }
+
+    s3Spec.value = {};
+  } finally {
+    ready.value = true;
+  }
+});
+
+const resetConfig = async () => {
+  saving.value = true
+
+  try {
+    await ResourceService.Delete(s3ConfigMetadata, withRuntime(Runtime.Omni));
+  } catch (e) {
+    if (e.code !== Code.NOT_FOUND) {
+      showError("Failed to Update Storage Config", e.message);
+
+      saving.value = false;
+
+      return;
+    }
+  } finally {
+    saving.value = false;
+  }
+
+  s3Spec.value = {};
+
+  showSuccess("The Backup Storage Config was Reset")
+};
+
+const updateConfig = async () => {
+  if (Object.keys(s3Spec.value).length === 0) {
+    showError("Failed to Update Storage Config", "No configuration was specified");
+
+    return;
+  }
+
+  saving.value = true
+  let config: ResourceTyped<EtcdBackupS3ConfSpec> = {
+    metadata: s3ConfigMetadata,
+    spec: {},
+  };
+
+  let exists: boolean = false;
+
+  try {
+    config = await ResourceService.Get(s3ConfigMetadata, withRuntime(Runtime.Omni));
+
+    exists = true;
+  } catch (e) {
+    if (e.code !== Code.NOT_FOUND) {
+      showError("Failed to Update Storage Config", e.message);
+
+      saving.value = false;
+
+      return;
+    }
+  }
+
+  config.spec = s3Spec.value;
+
+  try {
+    if (exists) {
+      await ResourceService.Update(config, config.metadata.version || 0, withRuntime(Runtime.Omni));
+    } else {
+      await ResourceService.Create(config, withRuntime(Runtime.Omni));
+    }
+  } catch (e) {
+    showError("Failed to Update Storage Config", e.message);
+
+    return;
+  } finally {
+    saving.value = false
+  }
+
+
+  showSuccess("The Backup Storage Config was Updated")
+};
+</script>
diff --git a/frontend/src/views/omni/SideBar.vue b/frontend/src/views/omni/SideBar.vue
new file mode 100644
index 000000000..0516e4f64
--- /dev/null
+++ b/frontend/src/views/omni/SideBar.vue
@@ -0,0 +1,85 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <t-sidebar-list :items="items"/>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import { useRoute } from "vue-router";
+
+import TSidebarList from "@/components/SideBar/TSideBarList.vue";
+import { canManageBackupStore, canManageUsers, canReadClusters, canReadMachines } from "@/methods/auth";
+import { setupBackupStatus } from "@/methods";
+import { IconType } from "@/components/common/Icon/TIcon.vue";
+
+const route = useRoute();
+
+const getRoute = (name: string, path: string) => {
+  return route.query.cluster ? {
+        name: name,
+        query: {
+          cluster: route.query.cluster,
+          namespace: route.query.namespace,
+          uid: route.query.uid,
+        },
+      } : path;
+};
+
+const { status: backupStatus } = setupBackupStatus();
+
+const items = computed(() => {
+  const result = [{
+    name: "Home",
+    route: getRoute("Overview", "/omni/"),
+    icon: "home" as IconType,
+  }];
+
+  if (canReadClusters.value) {
+    result.push({
+      name: "Clusters",
+      route: getRoute("Clusters", "/omni/clusters"),
+      icon: "clusters",
+    });
+  }
+
+  if (canReadMachines.value) {
+    result.push({
+      name: "Machines",
+      route: getRoute("Machines", "/omni/machines"),
+      icon: "nodes",
+    });
+  }
+
+  if (canReadMachines.value) {
+    result.push({
+      name: "Machine Classes",
+      route: getRoute("MachineClasses", "/omni/machine-classes"),
+      icon: "code-bracket",
+    });
+  }
+
+  if (backupStatus.value.configurable && canManageBackupStore.value) {
+    result.push({
+      name: "Backups Storage",
+      route: getRoute("BackupStorage", "/omni/backups"),
+      icon: "circle-stack"
+    });
+  }
+
+  if (canManageUsers.value) {
+    result.push({
+      name: "Users",
+      route: getRoute("Users", "/omni/users"),
+      icon: "users",
+    });
+  }
+
+  return result;
+}
+);
+</script>
diff --git a/frontend/src/views/omni/Users/UserItem.vue b/frontend/src/views/omni/Users/UserItem.vue
new file mode 100644
index 000000000..5fe63b24b
--- /dev/null
+++ b/frontend/src/views/omni/Users/UserItem.vue
@@ -0,0 +1,109 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <t-list-item>
+    <template #default>
+      <div class="flex items-center gap-2">
+        <div class="users-grid text-naturals-N13 flex-1">
+          <div class="font-bold">{{ item.metadata.id }}</div>
+          <div class="px-2 py-1 max-w-min text-naturals-N10 rounded bg-naturals-N3">{{ props.item.spec.role ?? "None" }}</div>
+          <div class="flex flex-wrap gap-1 col-span-3">
+            <div v-for="label in labels" :key="label" class="resource-label text-xs label-light6">{{ label }}</div>
+          </div>
+        </div>
+        <div class="flex justify-between">
+          <t-actions-box v-if="canManageUsers" style="height: 24px">
+            <t-actions-box-item icon="edit" @click.stop="editUser">Edit User</t-actions-box-item>
+            <t-actions-box-item icon="delete" @click.stop="deleteUser" danger>Delete User</t-actions-box-item>
+          </t-actions-box>
+        </div>
+      </div>
+    </template>
+  </t-list-item>
+</template>
+
+<script setup lang="ts">
+import { UserSpec, IdentitySpec } from "@/api/omni/specs/auth.pb";
+import { ResourceTyped } from "@/api/grpc";
+
+import { useRouter } from "vue-router";
+
+import TListItem from "@/components/common/List/TListItem.vue";
+import TActionsBox from "@/components/common/ActionsBox/TActionsBox.vue";
+import TActionsBoxItem from "@/components/common/ActionsBox/TActionsBoxItem.vue";
+import { canManageUsers } from "@/methods/auth";
+import { computed, toRefs } from "vue";
+import { SAMLLabelPrefix } from "@/api/resources";
+
+const props = defineProps<{
+  item: ResourceTyped<UserSpec & IdentitySpec>
+}>();
+
+const { item } = toRefs(props);
+
+const router = useRouter();
+
+const labels = computed(() => {
+  return Object.keys(item?.value?.metadata?.labels || {}).filter(
+    l => l.startsWith(SAMLLabelPrefix)
+  ).map((l: string) => l.replace(`${SAMLLabelPrefix}`, "")) || [];
+});
+
+const deleteUser = () => {
+  const query: Record<string, string> = {
+    user: props.item.spec.user_id!,
+    identity: props.item.metadata.id ?? "",
+  };
+
+  router.push({
+    query: { modal: "userDestroy", ...query },
+  });
+};
+
+const editUser = () => {
+  const query: Record<string, string> = {
+    user: props.item.spec.user_id!,
+    identity: props.item.metadata.id ?? "",
+  };
+
+  router.push({
+    query: { modal: "userEdit", ...query },
+  });
+};
+</script>
+
+<style scoped>
+.users-grid {
+  @apply grid grid-cols-5 pr-2 items-center;
+}
+
+.users-grid>* {
+  @apply text-xs truncate;
+}
+
+.scope > * {
+  @apply bg-naturals-N4 p-0.5 px-1 text-naturals-N10;
+}
+
+.scope-action-enabled {
+  @apply bg-naturals-N4 p-0.5 px-1 text-green-G1;
+}
+
+.scope > *:first-child {
+  @apply rounded-l;
+}
+
+.scope > *:last-child {
+  @apply rounded-r;
+}
+.label-light6 {
+  --label-h: 208;
+  --label-s: 70;
+  --label-l: 86;
+  --lighten-by: 0;
+}
+</style>
diff --git a/frontend/src/views/omni/Users/Users.vue b/frontend/src/views/omni/Users/Users.vue
new file mode 100644
index 000000000..4ebb7c98f
--- /dev/null
+++ b/frontend/src/views/omni/Users/Users.vue
@@ -0,0 +1,84 @@
+<!--
+Copyright (c) 2024 Sidero Labs, Inc.
+
+Use of this software is governed by the Business Source License
+included in the LICENSE file.
+-->
+<template>
+  <div class="flex flex-col">
+    <div class="flex gap-1 items-start">
+      <page-header title="Users" class="flex-1"/>
+      <t-button @click="openUserCreate" icon="user-add" icon-position="left" type="highlighted" :disabled="!canManageUsers || authType === AuthType.SAML">Add User</t-button>
+    </div>
+    <t-list :opts="watchOpts" pagination class="flex-1">
+      <template #default="{ items }">
+        <div class="users-header">
+          <div class="users-grid">
+            <div>Email</div>
+            <div>Role</div>
+            <div class="col-span-3">Labels</div>
+          </div>
+        </div>
+        <user-item v-for="item in items" :key="itemID(item)" :item="item"/>
+      </template>
+    </t-list>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useRouter } from "vue-router";
+import { Runtime } from "@/api/common/omni.pb";
+import { DefaultNamespace, UserType, IdentityType, LabelIdentityUserID, LabelIdentityTypeServiceAccount } from "@/api/resources";
+import { IdentitySpec } from "@/api/omni/specs/auth.pb";
+import { itemID } from "@/api/watch";
+
+import TList from "@/components/common/List/TList.vue";
+import UserItem from "@/views/omni/Users/UserItem.vue";
+import PageHeader from "@/components/common/PageHeader.vue";
+import TButton from "@/components/common/Button/TButton.vue";
+import { ResourceTyped } from "@/api/grpc";
+import { canManageUsers } from "@/methods/auth";
+import { AuthType, authType } from "@/methods";
+
+const router = useRouter();
+
+const watchOpts = [
+  {
+    runtime: Runtime.Omni,
+    resource: {
+      type: IdentityType,
+      namespace: DefaultNamespace,
+    },
+    idFunc: (res: ResourceTyped<IdentitySpec>) => `default.${(res?.metadata?.labels || {})[LabelIdentityUserID] ?? ""}`,
+    selectors: [`!${LabelIdentityTypeServiceAccount}`],
+  },
+  {
+    runtime: Runtime.Omni,
+    resource: {
+      type: UserType,
+      namespace: DefaultNamespace,
+    },
+  },
+];
+
+const openUserCreate = () => {
+  router.push({
+    query: { modal: "userCreate" },
+  });
+};
+</script>
+
+<style scoped>
+.users-grid {
+  @apply grid grid-cols-5 pr-2;
+}
+
+.users-header {
+  @apply bg-naturals-N2 mb-1;
+  padding: 10px 16px;
+}
+
+.users-header>* {
+  @apply text-xs;
+}
+</style>
diff --git a/frontend/tailwind.config.js b/frontend/tailwind.config.js
new file mode 100644
index 000000000..3830c7c57
--- /dev/null
+++ b/frontend/tailwind.config.js
@@ -0,0 +1,63 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+const defaultTheme = require("tailwindcss/defaultTheme");
+const colors = require("tailwindcss/colors");
+const colorsTheme = require("./src/vars/colors");
+
+module.exports = {
+  content: ["./public/**/*.html", "./src/**/*.vue"],
+  darkMode: "class",
+  theme: {
+    fontFamily: {
+      sans: ["Inter var", ...defaultTheme.fontFamily.sans],
+      roboto: ["Roboto Mono", "monospace"],
+      firasans: ["Fira Sans", "Roboto", "sans-serif"],
+    },
+    extend: {
+      colors: {
+        "talos-gray": colors.neutral,
+        "light-blue": colors.sky,
+        ...colorsTheme,
+      },
+      animation: {
+        blink: 'blink-frames 3s cubic-bezier(.6,.4,.4,.5) infinite',
+        fadein: 'fadein 300ms linear',
+      },
+      keyframes: {
+        fadein: {
+          '0%': { opacity: 0 },
+          '100%': { opacity: 100 },
+        }
+      }
+    },
+    screens: {
+      sm: "640px",
+      // => @media (min-width: 640px) { ... }
+
+      md: "768px",
+      // => @media (min-width: 768px) { ... }
+
+      lg: "1024px",
+      // => @media (min-width: 1024px) { ... }
+
+      xl: "1280px",
+      // => @media (min-width: 1280px) { ... }
+
+      "2xl": "1536px",
+      // => @media (min-width: 1536px) { ... }
+    },
+  },
+  variants: {
+    extend: {
+      backgroundColor: ["active", "disabled"],
+      textColor: ["active", "disabled"],
+      borderColor: ["active", "disabled"],
+      cursor: ["disabled"],
+      textDecoration: ["active"],
+    },
+  },
+  plugins: [],
+};
diff --git a/frontend/tests/unit/clusterManageState.spec.ts b/frontend/tests/unit/clusterManageState.spec.ts
new file mode 100644
index 000000000..2bb5407ee
--- /dev/null
+++ b/frontend/tests/unit/clusterManageState.spec.ts
@@ -0,0 +1,413 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+import { Resource } from "../../src/api/grpc";
+import { ClusterSpec, ConfigPatchSpec, MachineSetNodeSpec, MachineSetSpec, MachineSetSpecMachineClassAllocationType, MachineSetSpecUpdateStrategy } from "../../src/api/omni/specs/omni.pb";
+import { ClusterType, ConfigPatchType, DefaultNamespace, LabelCluster, LabelClusterMachine, LabelControlPlaneRole, LabelMachineSet, LabelWorkerRole, MachineSetNodeType, MachineSetType } from "../../src/api/resources";
+import { Cluster, initState, MachineSet, PatchID, state } from "../../src/states/cluster-management";
+
+const crypto = require('crypto');
+
+Object.defineProperty(globalThis, 'crypto', {
+  value: {
+    getRandomValues: arr => crypto.randomBytes(arr.length)
+  }
+});
+
+describe("cluster-management-state", () => {
+  initState();
+
+  const tests: {
+    name: string
+    cluster: Cluster
+    machineSets?: Partial<MachineSet>[]
+    shouldFail?: boolean
+    base?: Resource[]
+    expectedResources?: {
+      [ConfigPatchType]?: Record<string, Partial<Resource<ConfigPatchSpec>>>
+      [MachineSetType]?: Record<string, Partial<Resource<MachineSetSpec>>>
+      [ClusterType]?: Record<string, Partial<Resource<ClusterSpec>>>
+      [MachineSetNodeType]?: Record<string, Partial<Resource<MachineSetNodeSpec>>>
+    }
+  }[] = [
+    {
+      name: "no cluster name",
+      cluster: {
+        patches: {},
+        features: {},
+      },
+      shouldFail: true,
+    },
+    {
+      name: "everything set",
+      cluster: {
+        patches: {
+          [PatchID.Default]: {
+            weight: 400,
+            data: "abcd"
+          },
+          additional: {
+            weight: 200,
+            data: "aaaa"
+          }
+        },
+        features: {
+          enableWorkloadProxy: true,
+          encryptDisks: true,
+        },
+        labels: {
+          my: "label",
+        },
+        annotations: {
+          my: "annotation",
+        },
+        kubernetesVersion: "1.24.0",
+        talosVersion: "1.5.3",
+        etcdBackupConfig: {
+          enabled: true,
+          interval: "100s",
+        },
+        name: "talos-default",
+      },
+      machineSets: [
+        {
+          machineClass: {
+            name: "mc1",
+            size: "unlimited",
+          },
+          machines: {
+            node4: {
+              patches: {},
+            },
+          },
+          bootstrapSpec: {
+            cluster_uuid: "abcd",
+            snapshot: "dcba",
+          }
+        },
+        {
+          machineClass: {
+            name: "mc2",
+            size: 3,
+          },
+          patches: {
+            [PatchID.Default]: {
+              data: "works",
+              weight: 200,
+            },
+            [PatchID.Untaint]: {
+              data: "untaint",
+              weight: 1,
+            }
+          }
+        },
+        {
+          machines: {
+            node1: {
+              patches: {
+                "cm-node1": {
+                  weight: 100,
+                  data: "works",
+                }
+              },
+            },
+          }
+        },
+      ],
+      expectedResources: {
+        [ClusterType]: {
+          "talos-default": {
+            metadata: {
+              labels: {
+                my: "label",
+              },
+              annotations: {
+                my: "annotation",
+              },
+            },
+            spec: {
+              features: {
+                disk_encryption: true,
+                enable_workload_proxy: true,
+              },
+              kubernetes_version: "1.24.0",
+              talos_version: "1.5.3",
+              backup_configuration: {
+                enabled: true,
+                interval: "100s",
+              }
+            }
+          }
+        },
+        [MachineSetNodeType]: {
+          "node1": {
+            metadata: {
+              labels: {
+                [LabelCluster]: "talos-default",
+                [LabelMachineSet]: "talos-default-w000000",
+                [LabelWorkerRole]: ""
+              },
+            },
+            spec: {},
+          }
+        },
+        [MachineSetType]: {
+          "talos-default-control-planes": {
+            metadata: {
+              labels: {
+                [LabelCluster]: "talos-default",
+                [LabelControlPlaneRole]: ""
+              }
+            },
+            spec: {
+              bootstrap_spec: {
+                cluster_uuid: "abcd",
+                snapshot: "dcba",
+              },
+              update_strategy: MachineSetSpecUpdateStrategy.Rolling,
+              machine_class: {
+                name: "mc1",
+                allocation_type: MachineSetSpecMachineClassAllocationType.Unlimited,
+              }
+            }
+          },
+          "talos-default-workers": {
+            metadata: {
+              labels: {
+                [LabelCluster]: "talos-default",
+                [LabelWorkerRole]: ""
+              }
+            },
+            spec: {
+              bootstrap_spec: undefined,
+              update_strategy: MachineSetSpecUpdateStrategy.Rolling,
+              machine_class: {
+                name: "mc2",
+                machine_count: 3,
+              }
+            }
+          },
+          "talos-default-w000000": {
+            metadata: {
+              labels: {
+                [LabelCluster]: "talos-default",
+                [LabelWorkerRole]: ""
+              }
+            },
+            spec: {
+              bootstrap_spec: undefined,
+              update_strategy: MachineSetSpecUpdateStrategy.Rolling,
+              machine_class: undefined,
+            }
+          }
+        },
+        [ConfigPatchType]: {
+          "400-talos-default": {
+            metadata: {
+              labels: {
+                [LabelCluster]: "talos-default",
+              }
+            },
+            spec: {
+              data: "abcd"
+            },
+          },
+          "200-talos-default-additional": {
+            metadata: {
+              labels: {
+                [LabelCluster]: "talos-default",
+              }
+            },
+            spec: {
+              data: "aaaa"
+            },
+          },
+          "200-talos-default-workers": {
+            metadata: {
+              labels: {
+                [LabelCluster]: "talos-default",
+                [LabelMachineSet]: "talos-default-workers"
+              }
+            },
+            spec: {
+              data: "works"
+            },
+          },
+          "001-talos-default-workers-untaint": {
+            metadata: {
+              labels: {
+                [LabelCluster]: "talos-default",
+                [LabelMachineSet]: "talos-default-workers"
+              }
+            },
+            spec: {
+              data: "untaint"
+            },
+          },
+          "100-cm-node1": {
+            metadata: {
+              labels: {
+                [LabelCluster]: "talos-default",
+                [LabelClusterMachine]: "node1"
+              }
+            },
+            spec: {
+              data: "works"
+            },
+          }
+        }
+      }
+    },
+    {
+      name: "update base",
+      cluster: {
+        name: "talos-default",
+        kubernetesVersion: "1.29.0",
+        talosVersion: "1.4.5",
+        patches: {},
+        features: {},
+      },
+      base: [
+        {
+          metadata: {
+            type: ClusterType,
+            id: "talos-default",
+            labels: {
+              my: "label",
+            },
+            annotations: {
+              my: "annotation",
+            },
+          },
+          spec: {
+            features: {
+              disk_encryption: true,
+              enable_workload_proxy: true,
+            },
+            kubernetes_version: "1.24.0",
+            talos_version: "1.5.3",
+            backup_configuration: {
+              enabled: true,
+              interval: "100s",
+            }
+          }
+        },
+      ],
+      expectedResources: {
+        [ClusterType]: {
+          "talos-default": {
+            metadata: {
+              annotations: undefined,
+              labels: undefined,
+            },
+            spec: {
+              kubernetes_version: "1.29.0",
+              talos_version: "1.4.5",
+              backup_configuration: undefined,
+              features: {},
+            }
+          }
+        },
+        [MachineSetType]: {
+          "talos-default-control-planes": {
+            metadata: {
+              labels: {
+                [LabelCluster]: "talos-default",
+                [LabelControlPlaneRole]: ""
+              }
+            },
+            spec: {
+              bootstrap_spec: undefined,
+              update_strategy: MachineSetSpecUpdateStrategy.Rolling,
+              machine_class: undefined,
+            }
+          },
+          "talos-default-workers": {
+            metadata: {
+              labels: {
+                [LabelCluster]: "talos-default",
+                [LabelWorkerRole]: ""
+              }
+            },
+            spec: {
+              bootstrap_spec: undefined,
+              update_strategy: MachineSetSpecUpdateStrategy.Rolling,
+              machine_class: undefined,
+            }
+          },
+        },
+      },
+    },
+  ];
+
+  for (const tt of tests) {
+    test(`resource generation: ${tt.name}`, () => {
+      const run = () => {
+        initState()
+
+        state.value.cluster = tt.cluster;
+
+        if (tt.machineSets) {
+          for (let i = 0; i < tt.machineSets.length ?? 0; i++) {
+            const machineSet = tt.machineSets[i];
+
+            if (state.value.machineSets.length <= i) {
+              state.value.addMachineSet(LabelWorkerRole);
+            }
+
+            state.value.machineSets[i].machineClass = machineSet.machineClass;
+            state.value.machineSets[i].machines = machineSet.machines ?? {};
+            state.value.machineSets[i].patches = machineSet.patches ?? {};
+
+            if (machineSet.bootstrapSpec) {
+              state.value.machineSets[i].bootstrapSpec = machineSet.bootstrapSpec;
+            }
+          }
+        }
+
+        state.value.baseResources = tt.base;
+        const resources = state.value.resources();
+
+        expect(resources.length).toBeGreaterThan(0);
+
+        const empty: Record<string, any> = {};
+
+        for (const key in tt.expectedResources) {
+          empty[key] = {};
+        }
+
+        for (const res of resources) {
+          const expected = tt.expectedResources?.[res.metadata.type!]?.[res.metadata.id!];
+
+          console.log(`should have resource ${res.metadata.type}/${res.metadata.id}`);
+
+          expect(expected).toBeDefined();
+
+          delete tt.expectedResources?.[res.metadata.type!]?.[res.metadata.id!];
+
+          expect(res).toStrictEqual({
+            metadata: {
+              id: res.metadata.id,
+              namespace: DefaultNamespace,
+              type: res.metadata.type,
+              ...expected.metadata,
+            },
+            spec: expected.spec,
+          });
+        }
+
+        expect(tt.expectedResources).toStrictEqual(empty);
+      }
+
+      if (tt.shouldFail) {
+        expect(run).toThrowError();
+
+        return;
+      }
+
+      run()
+    });
+  }
+});
diff --git a/frontend/tests/unit/watch.spec.ts b/frontend/tests/unit/watch.spec.ts
new file mode 100644
index 000000000..e2ffa84d3
--- /dev/null
+++ b/frontend/tests/unit/watch.spec.ts
@@ -0,0 +1,276 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Import the `mount()` method from Vue Test Utils
+import { Ref } from "vue";
+import { ResourceTyped } from "../../src/api/grpc";
+import { MachineSpec } from "../../src/api/omni/specs/omni.pb";
+import { Event, EventType, ResourceService, WatchRequest, WatchResponse } from "../../src/api/omni/resources/resources.pb";
+import Watch from "../../src/api/watch";
+import { fetchOption, NotifyStreamEntityArrival, RequestOptions } from "../../src/api/fetch.pb";
+import { Runtime } from "../../src/api/common/omni.pb";
+import { DefaultNamespace, MachineType } from "../../src/api/resources";
+import { ref } from "vue";
+import { Metadata } from "../../src/api/v1alpha1/resource.pb";
+
+class fakeStream extends EventTarget {
+  private resolve?: (value: void | PromiseLike<void>) => void;
+  private reject?: (value: Error | PromiseLike<void>) => void;
+
+  public run(...args: any[]): Promise<void> {
+    console.log("starting fake stream", ...args);
+
+    this.dispatchEvent(new Event("run"));
+
+    return new Promise<void>(
+      (resolve, reject) => {
+        this.resolve = resolve;
+        this.reject = reject;
+      }
+    )
+  }
+
+  public waitRunning(timeout: number): Promise<any> {
+    return new Promise<any>(
+      (resolve, reject) => {
+        const onRunning = () => {
+          resolve(null);
+
+          this.removeEventListener("run", onRunning);
+        };
+
+        setTimeout(() => {
+          reject(new Error(`stream is not running after ${timeout}ms`));
+          this.removeEventListener("run", onRunning);
+        }, timeout);
+
+        this.addEventListener("run", onRunning)
+      }
+    );
+  }
+
+  public close(err?: Error) {
+    if (!this.resolve || !this.reject) {
+      throw new Error("fake stream is not running");
+    }
+
+    err ? this.reject(err) : this.resolve();
+  }
+}
+
+describe('watch', () => {
+  const items: Ref<ResourceTyped<MachineSpec>[]> = ref([]);
+  const watch = new Watch(items);
+  const stream = new fakeStream();
+
+  let callback: NotifyStreamEntityArrival<WatchResponse> | undefined;
+
+  ResourceService.Watch = async (req: WatchRequest, entityNotifier?: NotifyStreamEntityArrival<WatchResponse>, ...options: fetchOption[]): Promise<void> => {
+    callback = entityNotifier;
+
+    const opts: RequestOptions = {} as RequestOptions;
+    for (const opt of options) {
+      opt(opts);
+    }
+
+    if (opts?.signal) {
+      opts.signal.onabort = () => {
+        stream.close();
+      };
+    }
+
+    await stream.run(opts);
+  };
+
+  const pushEvents = (...events: {type: EventType, metadata?: Metadata, resource?: MachineSpec}[]) => {
+    if(!callback) {
+      throw new Error("the watch is hasn't been started: the callback is null")
+    }
+
+    for (const e of events) {
+      const event: Event = {
+        event_type: e.type,
+      };
+
+      if (e.metadata && e.resource) {
+        event.resource = JSON.stringify({
+          metadata: e.metadata,
+          spec: e.resource
+        });
+      }
+
+      if (e.type === EventType.UPDATED) {
+        event.old = JSON.stringify({
+          metadata: e.metadata,
+          spec: e.resource
+        });
+      }
+
+      callback({event: event});
+    }
+  }
+
+  test("event handling", async () => {
+    await watch.start({
+      runtime: Runtime.Omni,
+      resource: {type: MachineType, namespace: DefaultNamespace}
+    });
+
+    pushEvents({
+      type: EventType.CREATED,
+      metadata: {
+        id: "1",  
+        namespace: "default",
+        type: MachineType,
+      },
+      resource: {
+        connected: true,
+        management_address: "localhost",
+      }
+    }, {
+      type: EventType.CREATED,
+      metadata: {
+        id: "2",  
+        namespace: "default",
+        type: MachineType,
+      },
+      resource: {
+        connected: true,
+        management_address: "localhost",
+      }
+    }, {
+      type: EventType.DESTROYED,
+      metadata: {
+        id: "2",  
+        namespace: "default",
+        type: MachineType,
+      },
+      resource: {
+        connected: true,
+        management_address: "localhost",
+      }
+    }, {
+      type: EventType.UPDATED,
+      metadata: {
+        id: "1",  
+        namespace: "default",
+        type: MachineType,
+      },
+      resource: {
+        connected: false,
+        management_address: "localhost",
+      }
+    });
+
+    // not yet bootstrapped
+    expect(items.value).toHaveLength(0);
+
+    // still loading
+    expect(watch.loading.value).toBeTruthy();
+
+    pushEvents({
+      type: EventType.BOOTSTRAPPED,
+    });
+
+    expect(items.value).toHaveLength(1);
+
+    const machine = items.value[0];
+    expect(machine.metadata.id).toBe("1");
+    expect(machine.spec.connected).toBeFalsy();
+    expect(watch.loading.value).toBeFalsy();
+
+    pushEvents({
+      type: EventType.CREATED,
+      metadata: {
+        id: "2",  
+        namespace: "default",
+        type: MachineType,
+      },
+      resource: {
+        connected: true,
+        management_address: "localhost",
+      }
+    });
+
+    expect(items.value).toHaveLength(2);
+
+    watch.stop();
+
+    expect(items.value).toHaveLength(0);
+  });
+
+  test("restarts handling", async () => {
+    await watch.start({
+      runtime: Runtime.Omni,
+      resource: {type: MachineType, namespace: DefaultNamespace},
+    });
+
+    const populate = () => {
+      pushEvents({
+        type: EventType.CREATED,
+        metadata: {
+          id: "1",
+          namespace: "default",
+          type: MachineType,
+        },
+        resource: {
+          connected: true,
+          management_address: "localhost",
+        }
+      }, {
+        type: EventType.CREATED,
+        metadata: {
+          id: "2",
+          namespace: "default",
+          type: MachineType,
+        },
+        resource: {
+          connected: true,
+          management_address: "localhost",
+        }
+      }, {
+        type: EventType.CREATED,
+        metadata: {
+          id: "3",
+          namespace: "default",
+          type: MachineType,
+        },
+        resource: {
+          connected: true,
+          management_address: "localhost",
+        }
+      }, {
+        type: EventType.CREATED,
+        metadata: {
+          id: "4",
+          namespace: "default",
+          type: MachineType,
+        },
+        resource: {
+          connected: false,
+          management_address: "localhost",
+        }
+      }, {
+        type: EventType.BOOTSTRAPPED,
+      });
+    }
+
+    populate();
+
+    expect(watch.loading.value).toBeFalsy();
+    expect(items.value).toHaveLength(4);
+
+    stream.close(new Error("network error"));
+
+    await stream.waitRunning(6000);
+
+    populate();
+
+    expect(watch.loading.value).toBeFalsy();
+    expect(items.value).toHaveLength(4);
+
+    watch.stop();
+  });
+});
diff --git a/frontend/tsconfig.json b/frontend/tsconfig.json
new file mode 100644
index 000000000..26110b67d
--- /dev/null
+++ b/frontend/tsconfig.json
@@ -0,0 +1,27 @@
+{
+  "compilerOptions": {
+    "baseUrl": ".",
+    "allowSyntheticDefaultImports": true,
+    "useUnknownInCatchVariables": false,
+    "experimentalDecorators": true,
+    "strict": true,
+    "module": "es2022",
+    "moduleResolution": "node",
+    "noImplicitAny": false,
+    "noEmitOnError": true,
+    "removeComments": true,
+    "sourceMap": true,
+    "target": "es6",
+    "outDir": "dist",
+    "resolveJsonModule": true,
+    "paths": {
+      "@/*": [
+        "./src/*"
+      ],
+    }
+  },
+  "include": [
+    "src/**/*.ts",
+    "src/**/*.vue",
+  ]
+}
diff --git a/frontend/vue.config.js b/frontend/vue.config.js
new file mode 100644
index 000000000..6bcdb6a0f
--- /dev/null
+++ b/frontend/vue.config.js
@@ -0,0 +1,23 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+module.exports = {
+  devServer: {
+    server: {
+      type: 'http',
+    },
+    client: {
+      webSocketURL: {
+        hostname: '0.0.0.0',
+        pathname: '/ws',
+        protocol: 'auto',
+        port: 0,
+      },
+    },
+    allowedHosts: 'all',
+    host: '127.0.0.1',
+    port: 8121,
+  }
+}
diff --git a/go.mod b/go.mod
new file mode 100644
index 000000000..06ce7c39e
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,251 @@
+module github.com/siderolabs/omni
+
+go 1.22.0
+
+replace (
+	// use nested module
+	github.com/siderolabs/omni/client => ./client
+	// forked go-yaml that introduces RawYAML interface, which can be used to populate YAML fields using bytes
+	// which are then encoded as a valid YAML blocks with proper indentiation
+	gopkg.in/yaml.v3 => github.com/unix4ever/yaml v0.0.0-20220527175918-f17b0f05cf2c
+)
+
+require (
+	filippo.io/age v1.1.2-0.20230807224457-6ad4560f4afc
+	github.com/ProtonMail/gopenpgp/v2 v2.7.5
+	github.com/adrg/xdg v0.4.0
+	github.com/akutz/memconn v0.1.1-0.20211110233653-dae351d188b3
+	github.com/auth0/go-jwt-middleware/v2 v2.2.0
+	github.com/aws/aws-sdk-go-v2 v1.24.1
+	github.com/aws/aws-sdk-go-v2/config v1.26.4
+	github.com/aws/aws-sdk-go-v2/credentials v1.16.15
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.15.8
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.47.6
+	github.com/benbjohnson/clock v1.3.5
+	github.com/blang/semver v3.5.1+incompatible
+	github.com/blang/semver/v4 v4.0.0
+	github.com/cenkalti/backoff/v4 v4.2.1
+	github.com/containers/image v3.0.2+incompatible
+	github.com/cosi-project/runtime v0.4.0-alpha.8
+	github.com/cosi-project/state-etcd v0.2.8
+	github.com/crewjam/saml v0.4.14
+	github.com/dustin/go-humanize v1.0.1
+	github.com/emicklei/dot v1.6.0
+	github.com/felixge/httpsnoop v1.0.4
+	github.com/gertd/go-pluralize v0.2.1
+	github.com/go-logr/zapr v1.3.0
+	github.com/golang-jwt/jwt/v4 v4.5.0
+	github.com/google/go-cmp v0.6.0
+	github.com/google/go-containerregistry v0.18.0
+	github.com/google/uuid v1.6.0
+	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
+	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1
+	github.com/hashicorp/go-cleanhttp v0.5.2
+	github.com/hashicorp/go-multierror v1.1.1
+	github.com/hashicorp/golang-lru/v2 v2.0.7
+	github.com/hashicorp/vault/api v1.10.0
+	github.com/hashicorp/vault/api/auth/kubernetes v0.5.0
+	github.com/hexops/gotextdiff v1.0.3
+	github.com/johannesboyne/gofakes3 v0.0.0-20230914150226-f005f5cc03aa
+	github.com/jonboulle/clockwork v0.4.0
+	github.com/julienschmidt/httprouter v1.3.0
+	github.com/jxskiss/base62 v1.1.0
+	github.com/mattn/go-shellwords v1.0.12
+	github.com/prometheus/client_golang v1.18.0
+	github.com/siderolabs/crypto v0.4.1
+	github.com/siderolabs/discovery-api v0.1.3
+	github.com/siderolabs/gen v0.4.7
+	github.com/siderolabs/go-api-signature v0.3.1
+	github.com/siderolabs/go-circular v0.1.0
+	github.com/siderolabs/go-debug v0.3.0
+	github.com/siderolabs/go-kubernetes v0.2.8
+	github.com/siderolabs/go-loadbalancer v0.3.2
+	github.com/siderolabs/go-pointer v1.0.0
+	github.com/siderolabs/go-retry v0.3.3
+	github.com/siderolabs/go-tail v0.1.0
+	github.com/siderolabs/grpc-proxy v0.4.0
+	github.com/siderolabs/image-factory v0.2.2
+	github.com/siderolabs/kms-client v0.1.0
+	github.com/siderolabs/omni/client v0.0.0-00010101000000-000000000000
+	github.com/siderolabs/siderolink v0.3.4
+	github.com/siderolabs/talos/pkg/machinery v1.6.4
+	github.com/sirupsen/logrus v1.9.3
+	github.com/spf13/cobra v1.8.0
+	github.com/stretchr/testify v1.8.4
+	github.com/zitadel/logging v0.5.0
+	github.com/zitadel/oidc v1.13.5
+	go.etcd.io/bbolt v1.3.9
+	go.etcd.io/etcd/client/pkg/v3 v3.5.12
+	go.etcd.io/etcd/client/v3 v3.5.12
+	go.etcd.io/etcd/server/v3 v3.5.12
+	go.uber.org/goleak v1.3.0
+	go.uber.org/zap v1.27.0
+	golang.org/x/crypto v0.19.0
+	golang.org/x/net v0.21.0
+	golang.org/x/sync v0.6.0
+	golang.org/x/text v0.14.0
+	golang.org/x/tools v0.16.1
+	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
+	google.golang.org/grpc v1.62.0
+	google.golang.org/protobuf v1.32.0
+	gopkg.in/square/go-jose.v2 v2.6.0
+	gopkg.in/yaml.v3 v3.0.3
+	k8s.io/api v0.29.1
+	k8s.io/apimachinery v0.29.1
+	k8s.io/client-go v0.29.1
+	k8s.io/klog/v2 v2.120.0
+	sigs.k8s.io/controller-runtime v0.16.3
+)
+
+require (
+	github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c // indirect
+	github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f // indirect
+	github.com/aws/aws-sdk-go v1.44.256 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.18.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 // indirect
+	github.com/aws/smithy-go v1.19.0 // indirect
+	github.com/beevik/etree v1.2.0 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cenkalti/backoff/v3 v3.2.2 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/cloudflare/circl v1.3.6 // indirect
+	github.com/containerd/go-cni v1.1.9 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.15.1 // indirect
+	github.com/containernetworking/cni v1.1.2 // indirect
+	github.com/coreos/go-semver v0.3.1 // indirect
+	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
+	github.com/crewjam/httperr v0.2.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/docker/cli v24.0.7+incompatible // indirect
+	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker v24.0.7+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.8.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/evanphx/json-patch v5.7.0+incompatible // indirect
+	github.com/fatih/color v1.16.0 // indirect
+	github.com/ghodss/yaml v1.0.0 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.1 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-openapi/jsonpointer v0.20.0 // indirect
+	github.com/go-openapi/jsonreference v0.20.2 // indirect
+	github.com/go-openapi/swag v0.22.4 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/btree v1.1.2 // indirect
+	github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
+	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/gorilla/schema v1.2.1 // indirect
+	github.com/gorilla/securecookie v1.1.2 // indirect
+	github.com/gorilla/websocket v1.5.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-hclog v1.5.0 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.5 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.6 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/josharian/native v1.1.0 // indirect
+	github.com/jsimonetti/rtnetlink v1.4.0 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/compress v1.17.7 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
+	github.com/mdlayher/ethtool v0.1.0 // indirect
+	github.com/mdlayher/genetlink v1.3.2 // indirect
+	github.com/mdlayher/netlink v1.7.2 // indirect
+	github.com/mdlayher/socket v0.5.0 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.0-rc5 // indirect
+	github.com/opencontainers/runtime-spec v1.1.0 // indirect
+	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/planetscale/vtprotobuf v0.6.0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_model v0.5.0 // indirect
+	github.com/prometheus/common v0.45.0 // indirect
+	github.com/prometheus/procfs v0.12.0 // indirect
+	github.com/rs/cors v1.10.1 // indirect
+	github.com/russellhaering/goxmldsig v1.4.0 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 // indirect
+	github.com/sergi/go-diff v1.3.1 // indirect
+	github.com/shabbyrobe/gocovmerge v0.0.0-20190829150210-3e036491d500 // indirect
+	github.com/siderolabs/go-blockdevice v0.4.7 // indirect
+	github.com/siderolabs/go-kubeconfig v0.1.0 // indirect
+	github.com/siderolabs/net v0.4.0 // indirect
+	github.com/siderolabs/protoenc v0.2.1 // indirect
+	github.com/siderolabs/tcpproxy v0.1.0 // indirect
+	github.com/soheilhy/cmux v0.1.5 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/stretchr/objx v0.5.1 // indirect
+	github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75 // indirect
+	github.com/vbatts/tar-split v0.11.5 // indirect
+	github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510 // indirect
+	github.com/xlab/treeprint v1.2.0 // indirect
+	go.etcd.io/etcd/api/v3 v3.5.12 // indirect
+	go.etcd.io/etcd/client/v2 v2.305.12 // indirect
+	go.etcd.io/etcd/pkg/v3 v3.5.12 // indirect
+	go.etcd.io/etcd/raft/v3 v3.5.12 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1 // indirect
+	go.opentelemetry.io/otel v1.21.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 // indirect
+	go.opentelemetry.io/otel/metric v1.21.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.21.0 // indirect
+	go.opentelemetry.io/otel/trace v1.21.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
+	golang.org/x/exp v0.0.0-20231219180239-dc181d75b848 // indirect
+	golang.org/x/mod v0.14.0 // indirect
+	golang.org/x/oauth2 v0.16.0 // indirect
+	golang.org/x/sys v0.17.0 // indirect
+	golang.org/x/term v0.17.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
+	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
+	golang.zx2c4.com/wireguard v0.0.0-20231022001213-2e0774f246fb // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe // indirect
+	gopkg.in/go-jose/go-jose.v2 v2.6.1 // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gotest.tools/v3 v3.4.0 // indirect
+	k8s.io/kube-openapi v0.0.0-20231129212854-f0671cc7e66a // indirect
+	k8s.io/utils v0.0.0-20231127182322-b307cd553661 // indirect
+	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
+)
diff --git a/go.sum b/go.sum
new file mode 100644
index 000000000..9e0ee33b7
--- /dev/null
+++ b/go.sum
@@ -0,0 +1,821 @@
+c2sp.org/CCTV/age v0.0.0-20221230231406-5ea85644bd03 h1:0e2QjhWG02SgzlUOvNYaFraf04OBsUPOLxf+K+Ae/yM=
+c2sp.org/CCTV/age v0.0.0-20221230231406-5ea85644bd03/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.112.0 h1:tpFCD7hpHFlQ8yPwT3x+QeXqc2T6+n6T+hmABHfDUSM=
+cloud.google.com/go/compute v1.23.3 h1:6sVlXXBmbd7jNX0Ipq0trII3e4n1/MsADLK6a+aiVlk=
+cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
+cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
+cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
+filippo.io/age v1.1.2-0.20230807224457-6ad4560f4afc h1:6kgD5G8k7AvURnyZqEUB9fhsDV0LRxs318cXcZJmqmM=
+filippo.io/age v1.1.2-0.20230807224457-6ad4560f4afc/go.mod h1:y3Zb/i2jHg/kL8xc3ocrI0Wd0Vm+VWV6DKfsKzSGUmU=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c h1:kMFnB0vCcX7IL/m9Y5LO+KQYv+t1CQOiFe6+SV2J7bE=
+github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f h1:tCbYj7/299ekTTXpdwKYF8eBlsYsDVoggDAuAjoK66k=
+github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f/go.mod h1:gcr0kNtGBqin9zDW9GOHcVntrwnjrK+qdJ06mWYBybw=
+github.com/ProtonMail/gopenpgp/v2 v2.7.5 h1:STOY3vgES59gNgoOt2w0nyHBjKViB/qSg7NjbQWPJkA=
+github.com/ProtonMail/gopenpgp/v2 v2.7.5/go.mod h1:IhkNEDaxec6NyzSI0PlxapinnwPVIESk8/76da3Ct3g=
+github.com/adrg/xdg v0.4.0 h1:RzRqFcjH4nE5C6oTAxhBtoE2IRyjBSa62SCbyPidvls=
+github.com/adrg/xdg v0.4.0/go.mod h1:N6ag73EX4wyxeaoeHctc1mas01KZgsj5tYiAIwqJE/E=
+github.com/akutz/memconn v0.1.1-0.20211110233653-dae351d188b3 h1:hSRF7qxE4473jwp0saKPe6EiOdovLidTR2txE55FkEM=
+github.com/akutz/memconn v0.1.1-0.20211110233653-dae351d188b3/go.mod h1:XOEusVuSOuL1ZmZplnxVabw2HUS6VCOkjV2EZgjRF84=
+github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
+github.com/armon/go-proxyproto v0.0.0-20210323213023-7e956b284f0a/go.mod h1:QmP9hvJ91BbJmGVGSbutW19IC0Q9phDCLGaomwTJbgU=
+github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/auth0/go-jwt-middleware/v2 v2.2.0 h1:4WTpcHh+VZJOLEnS4E+hh+vP96Jy1tSbJOMnbJ29/KI=
+github.com/auth0/go-jwt-middleware/v2 v2.2.0/go.mod h1:BFCz+RF+1szSkrGNJLYn2ng2PtfzBiKR6fynTvS2A/k=
+github.com/aws/aws-sdk-go v1.44.256 h1:O8VH+bJqgLDguqkH/xQBFz5o/YheeZqgcOYIgsTVWY4=
+github.com/aws/aws-sdk-go v1.44.256/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
+github.com/aws/aws-sdk-go-v2 v1.24.1 h1:xAojnj+ktS95YZlDf0zxWBkbFtymPeDP+rvUQIH3uAU=
+github.com/aws/aws-sdk-go-v2 v1.24.1/go.mod h1:LNh45Br1YAkEKaAqvmE1m8FUx6a5b/V0oAKV7of29b4=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4 h1:OCs21ST2LrepDfD3lwlQiOqIGp6JiEUqG84GzTDoyJs=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4/go.mod h1:usURWEKSNNAcAZuzRn/9ZYPT8aZQkR7xcCtunK/LkJo=
+github.com/aws/aws-sdk-go-v2/config v1.26.4 h1:Juj7LhtxNudNUlfX22K5AnLafO+v4eq9PA3VWSCIQs4=
+github.com/aws/aws-sdk-go-v2/config v1.26.4/go.mod h1:tioqQ7wvxMYnTDpoTTLHhV3Zh+z261i/f2oz+ds8eNI=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.15 h1:P0/m1LU08MF2kRzx4P//+7lNjiJod1z4xI2WpWhdpTQ=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.15/go.mod h1:pgtMCf7Dx4GWw5EpHOTc2Sy17LIP0A0N2C9nQ83pQ/0=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 h1:c5I5iH+DZcH3xOIMlz3/tCKJDaHFwYEmxvlh2fAcFo8=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11/go.mod h1:cRrYDYAMUohBJUtUnOhydaMHtiK/1NZ0Otc9lIb6O0Y=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.15.8 h1:7wCngExMTAW2Bjf0Y92uWap6ZUcenLLWI5T3VJiQneU=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.15.8/go.mod h1:XVrAWYYM4ZRwOCOuLoUiao5hbLqNutEdqwCR3ZvkXgc=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 h1:vF+Zgd9s+H4vOXd5BMaPWykta2a6Ih0AKLq/X6NYKn4=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10/go.mod h1:6BkRjejp/GR4411UGqkX8+wFMbFbqsUIimfK4XjOKR4=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 h1:nYPe006ktcqUji8S2mqXf9c/7NdiKriOwMvWQHgYztw=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10/go.mod h1:6UV4SZkVvmODfXKql4LCbaZUpF7HO2BX38FgBf9ZOLw=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 h1:GrSw8s0Gs/5zZ0SX+gX4zQjRnRsMJDJ2sLur1gRBhEM=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2/go.mod h1:6fQQgfuGmw8Al/3M2IgIllycxV7ZW7WCdVSqfBeUiCY=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.9 h1:ugD6qzjYtB7zM5PN/ZIeaAIyefPaD82G8+SJopgvUpw=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.9/go.mod h1:YD0aYBWCrPENpHolhKw2XDlTIWae2GKXT1T4o6N6hiM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 h1:/b31bi3YVNlkzkBrm9LfpaKoaYZUxIAj4sHfOTmLfqw=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4/go.mod h1:2aGXHFmbInwgP9ZfpmdIfOELL79zhdNYNmReK8qDfdQ=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.9 h1:/90OR2XbSYfXucBMJ4U14wrjlfleq/0SB6dZDPncgmo=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.9/go.mod h1:dN/Of9/fNZet7UrQQ6kTDo/VSwKPIq94vjlU16bRARc=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 h1:DBYTXwIGQSGs9w4jKm60F5dmCQ3EEruxdc0MFh+3EY4=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10/go.mod h1:wohMUQiFdzo0NtxbBg0mSRGZ4vL3n0dKjLTINdcIino=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.9 h1:iEAeF6YC3l4FzlJPP9H3Ko1TXpdjdqWffxXjp8SY6uk=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.9/go.mod h1:kjsXoK23q9Z/tLBrckZLLyvjhZoS+AGrzqzUfEClvMM=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.47.6 h1:bkmlzokzTJyrFNA0J+EPlsF8x4/wp+9D45HTHO/ZUiY=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.47.6/go.mod h1:vADO6Jn+Rq4nDtfwNjhgR84qkZwiC6FqCaXdw/kYwjA=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.6 h1:dGrs+Q/WzhsiUKh82SfTVN66QzyulXuMDTV/G8ZxOac=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.6/go.mod h1:+mJNDdF+qiUlNKNC3fxn74WWNN+sOiGOEImje+3ScPM=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7 h1:QPMJf+Jw8E1l7zqhZmMlFw6w1NmfkfiSK8mS4zOx3BA=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7/go.mod h1:ykf3COxYI0UJmxcfcxcVuz7b6uADi1FkiUz6Eb7AgM8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 h1:NzO4Vrau795RkUdSHKEwiR01FaGzGOH1EETJ+5QHnm0=
+github.com/aws/aws-sdk-go-v2/service/sts v1.26.7/go.mod h1:6h2YuIoxaMSCFf5fi1EgZAwdfkGMgDY+DVfa61uLe4U=
+github.com/aws/smithy-go v1.19.0 h1:KWFKQV80DpP3vJrrA9sVAHQ5gc2z8i4EzrLhLlWXcBM=
+github.com/aws/smithy-go v1.19.0/go.mod h1:NukqUGpCZIILqqiV0NIjeFh24kd/FAa4beRb6nbIUPE=
+github.com/beevik/etree v1.1.0/go.mod h1:r8Aw8JqVegEf0w2fDnATrX9VpkMcyFeM0FhwO62wh+A=
+github.com/beevik/etree v1.2.0 h1:l7WETslUG/T+xOPs47dtd6jov2Ii/8/OjCldk5fYfQw=
+github.com/beevik/etree v1.2.0/go.mod h1:aiPf89g/1k3AShMVAzriilpcE4R/Vuor90y83zVZWFc=
+github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/benbjohnson/clock v1.3.5 h1:VvXlSJBzZpA/zum6Sj74hxwYI2DIxRWuNIoXAzHZz5o=
+github.com/benbjohnson/clock v1.3.5/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
+github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
+github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
+github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
+github.com/brianvoe/gofakeit/v6 v6.24.0 h1:74yq7RRz/noddscZHRS2T84oHZisW9muwbb8sRnU52A=
+github.com/brianvoe/gofakeit/v6 v6.24.0/go.mod h1:Ow6qC71xtwm79anlwKRlWZW6zVq9D2XHE4QSSMP/rU8=
+github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
+github.com/cenkalti/backoff/v3 v3.0.0/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
+github.com/cenkalti/backoff/v3 v3.2.2 h1:cfUAAO3yvKMYKPrvhDuHSwQnhZNk/RMHKdZqKTxfm6M=
+github.com/cenkalti/backoff/v3 v3.2.2/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
+github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
+github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/cilium/ebpf v0.12.3 h1:8ht6F9MquybnY97at+VDZb3eQQr8ev79RueWeVaEcG4=
+github.com/cilium/ebpf v0.12.3/go.mod h1:TctK1ivibvI3znr66ljgi4hqOT8EYQjz1KWBfb1UVgM=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
+github.com/cloudflare/circl v1.3.6 h1:/xbKIqSHbZXHwkhbrhrt2YOHIwYJlXH94E3tI/gDlUg=
+github.com/cloudflare/circl v1.3.6/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa h1:jQCWAUqqlij9Pgj2i/PB79y4KOPYVyFYdROxgaCwdTQ=
+github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa/go.mod h1:x/1Gn8zydmfq8dk6e9PdstVsDgu9RuyIIJqAaF//0IM=
+github.com/cockroachdb/datadriven v1.0.2 h1:H9MtNqVoVhvd9nCBwOyDjUEdZCREqbIdCJD93PBm/jA=
+github.com/cockroachdb/datadriven v1.0.2/go.mod h1:a9RdTaap04u637JoCzcUoIcDmvwSUtcUFtT/C3kJlTU=
+github.com/containerd/go-cni v1.1.9 h1:ORi7P1dYzCwVM6XPN4n3CbkuOx/NZ2DOqy+SHRdo9rU=
+github.com/containerd/go-cni v1.1.9/go.mod h1:XYrZJ1d5W6E2VOvjffL3IZq0Dz6bsVlERHbekNK90PM=
+github.com/containerd/stargz-snapshotter/estargz v0.15.1 h1:eXJjw9RbkLFgioVaTG+G/ZW/0kEe2oEKCdS/ZxIyoCU=
+github.com/containerd/stargz-snapshotter/estargz v0.15.1/go.mod h1:gr2RNwukQ/S9Nv33Lt6UC7xEx58C+LHRdoqbEKjz1Kk=
+github.com/containernetworking/cni v1.1.2 h1:wtRGZVv7olUHMOqouPpn3cXJWpJgM6+EUl31EQbXALQ=
+github.com/containernetworking/cni v1.1.2/go.mod h1:sDpYKmGVENF3s6uvMvGgldDWeG8dMxakj/u+i9ht9vw=
+github.com/containers/image v3.0.2+incompatible h1:B1lqAE8MUPCrsBLE86J0gnXleeRq8zJnQryhiiGQNyE=
+github.com/containers/image v3.0.2+incompatible/go.mod h1:8Vtij257IWSanUQKe1tAeNOm2sRVkSqQTVQ1IlwI3+M=
+github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
+github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
+github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cosi-project/runtime v0.4.0-alpha.8 h1:wpv0Vw6ENJMjlxftMKQ0im0woh5F57DlF+23dglgE74=
+github.com/cosi-project/runtime v0.4.0-alpha.8/go.mod h1:Was5rgpxPSJfNqbw01atuWHer5KYMtzhwJm02+xbU90=
+github.com/cosi-project/state-etcd v0.2.8 h1:77e3VoA+hw/CSoJH4ibKWwrJwY5pSbIdOli7pbgYBNQ=
+github.com/cosi-project/state-etcd v0.2.8/go.mod h1:P/QdrlDu1JTptfteGgt6ClR9BHnbpt5EXxPFMvg+RuY=
+github.com/cpuguy83/go-md2man/v2 v2.0.3 h1:qMCsGGgs+MAzDFyp9LpAe1Lqy/fY/qCovCm0qnXZOBM=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/crewjam/httperr v0.2.0 h1:b2BfXR8U3AlIHwNeFFvZ+BV1LFvKLlzMjzaTnZMybNo=
+github.com/crewjam/httperr v0.2.0/go.mod h1:Jlz+Sg/XqBQhyMjdDiC+GNNRzZTD7x39Gu3pglZ5oH4=
+github.com/crewjam/saml v0.4.14 h1:g9FBNx62osKusnFzs3QTN5L9CVA/Egfgm+stJShzw/c=
+github.com/crewjam/saml v0.4.14/go.mod h1:UVSZCf18jJkk6GpWNVqcyQJMD5HsRugBPf4I1nl2mME=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/docker/cli v24.0.7+incompatible h1:wa/nIwYFW7BVTGa7SWPVyyXU9lgORqUb1xfI36MSkFg=
+github.com/docker/cli v24.0.7+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
+github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v24.0.7+incompatible h1:Wo6l37AuwP3JaMnZa226lzVXGA3F9Ig1seQen0cKYlM=
+github.com/docker/docker v24.0.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8=
+github.com/docker/docker-credential-helpers v0.8.0/go.mod h1:UGFXcuoQ5TxPiB54nHOZ32AWRqQdECoh/Mg0AlEYb40=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/emicklei/dot v1.6.0 h1:vUzuoVE8ipzS7QkES4UfxdpCwdU2U97m2Pb2tQCoYRY=
+github.com/emicklei/dot v1.6.0/go.mod h1:DeV7GvQtIw4h2u73RKBkkFdvVAz0D9fzeJrgPW6gy/s=
+github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
+github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/envoyproxy/protoc-gen-validate v1.0.4 h1:gVPz/FMfvh57HdSJQyvBtF00j8JU4zdyUgIUNhlgg0A=
+github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew=
+github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI=
+github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww=
+github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
+github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
+github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/gertd/go-pluralize v0.2.1 h1:M3uASbVjMnTsPb0PNqg+E/24Vwigyo/tvyMTtAlLgiA=
+github.com/gertd/go-pluralize v0.2.1/go.mod h1:rbYaKDbsXxmRfr8uygAEKhOWsjyrrqrkHVpZvoOp8zk=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
+github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-jose/go-jose/v3 v3.0.0/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
+github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
+github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
+github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
+github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
+github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
+github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
+github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
+github.com/go-openapi/jsonpointer v0.20.0 h1:ESKJdU9ASRfaPNOPRx12IUyA1vn3R9GiE3KYD14BXdQ=
+github.com/go-openapi/jsonpointer v0.20.0/go.mod h1:6PGzBjjIIumbLYysB73Klnms1mwnU4G3YHOECG3CedA=
+github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
+github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
+github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
+github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
+github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
+github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
+github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
+github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
+github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
+github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
+github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 h1:0VpGH+cDhbDtdcweoyCVsF3fhN8kejK6rFe/2FFX2nU=
+github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49/go.mod h1:BkkQ4L1KS1xMt2aWSPStnn55ChGC0DPOn2FQYj+f25M=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-containerregistry v0.18.0 h1:ShE7erKNPqRh5ue6Z9DUOlk04WsnFWPO6YGr3OxnfoQ=
+github.com/google/go-containerregistry v0.18.0/go.mod h1:u0qB2l7mvtWVR5kNcbFIhFY1hLbf8eeGapA+vbFDCtQ=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec=
+github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/gorilla/schema v1.2.1 h1:tjDxcmdb+siIqkTNoV+qRH2mjYdr2hHe5MKXbp61ziM=
+github.com/gorilla/schema v1.2.1/go.mod h1:Dg5SSm5PV60mhF2NFaTV1xuYYj8tV8NOPRo4FggUMnM=
+github.com/gorilla/securecookie v1.1.2 h1:YCIWL56dvtr73r6715mJs5ZvhtnY73hBvEF8kXD8ePA=
+github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
+github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/gorilla/websocket v1.5.1 h1:gmztn0JnHVt9JZquRuzLw3g4wouNVzKL15iLr/zn/QY=
+github.com/gorilla/websocket v1.5.1/go.mod h1:x3kM2JMyaluk02fnUJpQuwD2dCS5NDG2ZHL0uE0tcaY=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
+github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 h1:Ovs26xHkKqVztRpIrF/92BcuyuQ/YW4NSIpoGtfXNho=
+github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
+github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
+github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 h1:/c3QmbOGMGTOumP2iT/rCwB7b0QDGLKzqOmktBjT+Is=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1/go.mod h1:5SN9VR2LTsRFsrEC6FHgRbTWrTHu6tqPeKxEQv15giM=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
+github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
+github.com/hashicorp/go-hclog v0.16.2/go.mod h1:whpDNt7SSdeAju8AWKIWsul05p54N/39EeqMAyrmvFQ=
+github.com/hashicorp/go-hclog v1.5.0 h1:bI2ocEMgcVlz55Oj1xZNBsVi900c7II+fWDyV9o+13c=
+github.com/hashicorp/go-hclog v1.5.0/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hashicorp/go-retryablehttp v0.6.6/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
+github.com/hashicorp/go-retryablehttp v0.7.5 h1:bJj+Pj19UZMIweq/iie+1u5YCdGrnxCT9yvm0e+Nd5M=
+github.com/hashicorp/go-retryablehttp v0.7.5/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
+github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
+github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 h1:iBt4Ew4XEGLfh6/bPk4rSYmuZJGizr6/x/AEizP0CQc=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8/go.mod h1:aiJI+PIApBRQG7FZTEBx5GiiX+HbOHilUdNxUZi4eV0=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
+github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
+github.com/hashicorp/go-sockaddr v1.0.6 h1:RSG8rKU28VTUTvEKghe5gIhIQpv8evvNpnDEyqO4u9I=
+github.com/hashicorp/go-sockaddr v1.0.6/go.mod h1:uoUUmtwU7n9Dv3O4SNLeFvg0SxQ3lyjsj6+CCykpaxI=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/hcl v1.0.1-vault-5 h1:kI3hhbbyzr4dldA8UdTb7ZlVVlI2DACdCfz31RPDgJM=
+github.com/hashicorp/hcl v1.0.1-vault-5/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hashicorp/vault/api v1.10.0 h1:/US7sIjWN6Imp4o/Rj1Ce2Nr5bki/AXi9vAW3p2tOJQ=
+github.com/hashicorp/vault/api v1.10.0/go.mod h1:jo5Y/ET+hNyz+JnKDt8XLAdKs+AM0G5W0Vp1IrFI8N8=
+github.com/hashicorp/vault/api/auth/kubernetes v0.5.0 h1:CXO0fD7M3iCGovP/UApeHhPcH4paDFKcu7AjEXi94rI=
+github.com/hashicorp/vault/api/auth/kubernetes v0.5.0/go.mod h1:afrElBIO9Q4sHFVuVWgNevG4uAs1bT2AZFA9aEiI608=
+github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
+github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
+github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
+github.com/johannesboyne/gofakes3 v0.0.0-20230914150226-f005f5cc03aa h1:a6Hc6Hlq6MxPNBW53/S/HnVwVXKc0nbdD/vgnQYuxG0=
+github.com/johannesboyne/gofakes3 v0.0.0-20230914150226-f005f5cc03aa/go.mod h1:AxgWC4DDX54O2WDoQO1Ceabtn6IbktjU/7bigor+66g=
+github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
+github.com/jonboulle/clockwork v0.4.0 h1:p4Cf1aMWXnXAUh8lVfewRBx1zaTSYKrKMF2g3ST4RZ4=
+github.com/jonboulle/clockwork v0.4.0/go.mod h1:xgRqUGwRcjKCO1vbZUEtSLrqKoPSsUpK7fnezOII0kc=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
+github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
+github.com/jsimonetti/rtnetlink v1.4.0 h1:Z1BF0fRgcETPEa0Kt0MRk3yV5+kF1FWTni6KUFKrq2I=
+github.com/jsimonetti/rtnetlink v1.4.0/go.mod h1:5W1jDvWdnthFJ7fxYX1GMK07BUpI4oskfOqvPteYS6E=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/julienschmidt/httprouter v1.3.0 h1:U0609e9tgbseu3rBINet9P48AI/D3oJs4dN7jwJOQ1U=
+github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
+github.com/jxskiss/base62 v1.1.0 h1:A5zbF8v8WXx2xixnAKD2w+abC+sIzYJX+nxmhA6HWFw=
+github.com/jxskiss/base62 v1.1.0/go.mod h1:HhWAlUXvxKThfOlZbcuFzsqwtF5TcqS9ru3y5GfjWAc=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.17.7 h1:ehO88t2UGzQK66LMdE8tibEd1ErmzZjNEqWkjLAKQQg=
+github.com/klauspost/compress v1.17.7/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
+github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
+github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
+github.com/mattn/go-isatty v0.0.10/go.mod h1:qgIWMr58cqv1PHHyhnkY9lrL7etaEgOFcMEpPG5Rm84=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
+github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
+github.com/mdlayher/ethtool v0.1.0 h1:XAWHsmKhyPOo42qq/yTPb0eFBGUKKTR1rE0dVrWVQ0Y=
+github.com/mdlayher/ethtool v0.1.0/go.mod h1:fBMLn2UhfRGtcH5ZFjr+6GUiHEjZsItFD7fSn7jbZVQ=
+github.com/mdlayher/genetlink v1.3.2 h1:KdrNKe+CTu+IbZnm/GVUMXSqBBLqcGpRDa0xkQy56gw=
+github.com/mdlayher/genetlink v1.3.2/go.mod h1:tcC3pkCrPUGIKKsCsp0B3AdaaKuHtaxoJRz3cc+528o=
+github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/g=
+github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
+github.com/mdlayher/socket v0.5.0 h1:ilICZmJcQz70vrWVes1MFera4jGiWNocSkykwwoy3XI=
+github.com/mdlayher/socket v0.5.0/go.mod h1:WkcBFfvyG8QENs5+hfQPl1X6Jpd2yeLIYgrGFmJiJxI=
+github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
+github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
+github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
+github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
+github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
+github.com/onsi/ginkgo/v2 v2.1.3/go.mod h1:vw5CSIxN1JObi/U8gcbwft7ZxR2dgaR70JSE3/PpL4c=
+github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4=
+github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o=
+github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
+github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
+github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg=
+github.com/onsi/gomega v1.29.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.0-rc5 h1:Ygwkfw9bpDvs+c9E34SdgGOj41dX/cbdlwvlWt0pnFI=
+github.com/opencontainers/image-spec v1.1.0-rc5/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
+github.com/opencontainers/runtime-spec v1.1.0 h1:HHUyrt9mwHUjtasSbXSMvs4cyFxh+Bll4AjJ9odEGpg=
+github.com/opencontainers/runtime-spec v1.1.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
+github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/planetscale/vtprotobuf v0.6.0 h1:nBeETjudeJ5ZgBHUz1fVHvbqUKnYOXNhsIEabROxmNA=
+github.com/planetscale/vtprotobuf v0.6.0/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
+github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
+github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
+github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
+github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lneoxM=
+github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
+github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
+github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
+github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
+github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/rogpeppe/go-internal v1.8.0/go.mod h1:WmiCO8CzOY8rg0OYDC4/i/2WRWAB6poM+XZ2dLUbcbE=
+github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
+github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+github.com/rs/cors v1.10.1 h1:L0uuZVXIKlI1SShY2nhFfo44TYvDPQ1w4oFkUJNfhyo=
+github.com/rs/cors v1.10.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
+github.com/russellhaering/goxmldsig v1.4.0 h1:8UcDh/xGyQiyrW+Fq5t8f+l2DLB1+zlhYzkPUJ7Qhys=
+github.com/russellhaering/goxmldsig v1.4.0/go.mod h1:gM4MDENBQf7M+V824SGfyIUVFWydB7n0KkEubVJl+Tw=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
+github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
+github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
+github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46 h1:GHRpF1pTW19a8tTFrMLUcfWwyC0pnifVo2ClaLq+hP8=
+github.com/ryszard/goskiplist v0.0.0-20150312221310-2dfbae5fcf46/go.mod h1:uAQ5PCi+MFsC7HjREoAz1BU+Mq60+05gifQSsHSDG/8=
+github.com/sergi/go-diff v1.3.1 h1:xkr+Oxo4BOQKmkn/B9eMK0g5Kg/983T9DqqPHwYqD+8=
+github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NFbPK1I=
+github.com/shabbyrobe/gocovmerge v0.0.0-20190829150210-3e036491d500 h1:WnNuhiq+FOY3jNj6JXFT+eLN3CQ/oPIsDPRanvwsmbI=
+github.com/shabbyrobe/gocovmerge v0.0.0-20190829150210-3e036491d500/go.mod h1:+njLrG5wSeoG4Ds61rFgEzKvenR2UHbjMoDHsczxly0=
+github.com/siderolabs/crypto v0.4.1 h1:PP84WSDDyCCbjYKePcc0IaMSPXDndz8V3cQ9hMRSvpA=
+github.com/siderolabs/crypto v0.4.1/go.mod h1:nJmvkqWy1Hngbzw3eg2TdtJ/ZYHHofQK1NbmmYywW8k=
+github.com/siderolabs/discovery-api v0.1.3 h1:37ue+0w2A7Q2FrhyuDbfdhL4VPvDTpCzUYGvibhMwv0=
+github.com/siderolabs/discovery-api v0.1.3/go.mod h1:fC6DOJwYQy2QsMCLLTvoScKmBCMNza+VwK2/RHLsoHU=
+github.com/siderolabs/gen v0.4.7 h1:lM69UYggT7yzpubf7hEFaNujPdY55Y9zvQf/NC18GvA=
+github.com/siderolabs/gen v0.4.7/go.mod h1:4PBYMdXxTg292IDRq4CGn5AymyDxJVEDvobVKDqFBEA=
+github.com/siderolabs/go-api-signature v0.3.1 h1:ePXOxBT2fxRICsDntXed9kivmVK269nZe5UXvOxgtnM=
+github.com/siderolabs/go-api-signature v0.3.1/go.mod h1:RZQFRiZ4midsdC9XCGhhWyS8QcIWtpEFeigvqoDPYJY=
+github.com/siderolabs/go-blockdevice v0.4.7 h1:2bk4WpEEflGxjrNwp57ye24Pr+cYgAiAeNMWiQOuWbQ=
+github.com/siderolabs/go-blockdevice v0.4.7/go.mod h1:4PeOuk71pReJj1JQEXDE7kIIQJPVe8a+HZQa+qjxSEA=
+github.com/siderolabs/go-circular v0.1.0 h1:zpBJNUbCZSh0odZxA4Dcj0d3ShLLR2WxKW6hTdAtoiE=
+github.com/siderolabs/go-circular v0.1.0/go.mod h1:14XnLf/I3J0VjzTgmwWNGjp58/bdIi4zXppAEx8plfw=
+github.com/siderolabs/go-debug v0.3.0 h1:C8t7jbac5Va2eYu9QRXXEGsy3Vz5xOEVo0TDwVJH268=
+github.com/siderolabs/go-debug v0.3.0/go.mod h1:DonqzIQOm3+qof020meFwJ2gXI5Jv/x4Dj27FyUW4aE=
+github.com/siderolabs/go-kubeconfig v0.1.0 h1:t/2oMWkLSdWHXglKPMz8ySXnx6ZjHckeGY79NaDcBTo=
+github.com/siderolabs/go-kubeconfig v0.1.0/go.mod h1:eM3mO02Td6wYDvdi9zTbMrj1Q4WqEFN8XQ6pNjCUWkI=
+github.com/siderolabs/go-kubernetes v0.2.8 h1:ks+xA0sZdYhdRTkSZlngaku+BWngbZxijidh2e+XX5Q=
+github.com/siderolabs/go-kubernetes v0.2.8/go.mod h1:JrhhdnHeeuEi+4nGCSrnkTjEy9oNQ6YJ/2/0Tzy+PQU=
+github.com/siderolabs/go-loadbalancer v0.3.2 h1:R2jKq8ifWOARxJ5blXwOOkiWCA5/46stGxUR8+qV8GE=
+github.com/siderolabs/go-loadbalancer v0.3.2/go.mod h1:sKP/xSN4R+1fifcqIjnk1FtM5sSW20d+pi+0FV6CpVo=
+github.com/siderolabs/go-pointer v1.0.0 h1:6TshPKep2doDQJAAtHUuHWXbca8ZfyRySjSBT/4GsMU=
+github.com/siderolabs/go-pointer v1.0.0/go.mod h1:HTRFUNYa3R+k0FFKNv11zgkaCLzEkWVzoYZ433P3kHc=
+github.com/siderolabs/go-retry v0.3.3 h1:zKV+S1vumtO72E6sYsLlmIdV/G/GcYSBLiEx/c9oCEg=
+github.com/siderolabs/go-retry v0.3.3/go.mod h1:Ff/VGc7v7un4uQg3DybgrmOWHEmJ8BzZds/XNn/BqMI=
+github.com/siderolabs/go-tail v0.1.0 h1:U+ZClt7BXLGsxDNU/XQ12sz7lQElfFZBYEPdkW78Qro=
+github.com/siderolabs/go-tail v0.1.0/go.mod h1:vWxumnRUS3eTZczORCJW3QMjxiTETN31vyuFdaW8rPw=
+github.com/siderolabs/grpc-proxy v0.4.0 h1:zYrhqLYs8JlYoLHYeel7/XwXDZ4OJ5XyP9wX7JlbPew=
+github.com/siderolabs/grpc-proxy v0.4.0/go.mod h1:QDurYOwQD4H8BKyvCuUxMiuG/etYnb/++xaQB644NdU=
+github.com/siderolabs/image-factory v0.2.2 h1:LYyO217Q//Og1hFXJZrzuNWSpXOTs5YWUx7uhCZMbxg=
+github.com/siderolabs/image-factory v0.2.2/go.mod h1:8YbpLjiKnuMGC0oyJB999rbAtIPKE4UL6owkwL9+AVs=
+github.com/siderolabs/kms-client v0.1.0 h1:rCDWzcDDsNlp6zdyLngOuuhchVILn+vwUQy3tk6rQps=
+github.com/siderolabs/kms-client v0.1.0/go.mod h1:4UQkRhuEh3kaK7VhJxez4YyJLv6lPEff7g3Pa6Y9okg=
+github.com/siderolabs/net v0.4.0 h1:1bOgVay/ijPkJz4qct98nHsiB/ysLQU0KLoBC4qLm7I=
+github.com/siderolabs/net v0.4.0/go.mod h1:/ibG+Hm9HU27agp5r9Q3eZicEfjquzNzQNux5uEk0kM=
+github.com/siderolabs/protoenc v0.2.1 h1:BqxEmeWQeMpNP3R6WrPqDatX8sM/r4t97OP8mFmg6GA=
+github.com/siderolabs/protoenc v0.2.1/go.mod h1:StTHxjet1g11GpNAWiATgc8K0HMKiFSEVVFOa/H0otc=
+github.com/siderolabs/siderolink v0.3.4 h1:850JRSSrD3EEDh35h6wiSTtRiGuclEc/6k4wx/It4nU=
+github.com/siderolabs/siderolink v0.3.4/go.mod h1:juxlSF9cBzeBHsOjS7hVS3s0NDpC034i/OZunVReqmo=
+github.com/siderolabs/talos/pkg/machinery v1.6.4 h1:xzkHpHqVnio3IL2z44f/dG3TNVvSafZFvuyqlR6J7nY=
+github.com/siderolabs/talos/pkg/machinery v1.6.4/go.mod h1:0x8zKxjyasg7n03lHXo5FX8ZaodFSSaompcGYa4alPE=
+github.com/siderolabs/tcpproxy v0.1.0 h1:IbkS9vRhjMOscc1US3M5P1RnsGKFgB6U5IzUk+4WkKA=
+github.com/siderolabs/tcpproxy v0.1.0/go.mod h1:onn6CPPj/w1UNqQ0U97oRPF0CqbrgEApYCw4P9IiCW8=
+github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
+github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js=
+github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
+github.com/spf13/afero v1.2.1/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
+github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
+github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
+github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.1 h1:4VhoImhV/Bm0ToFkXFi8hXNXwpDRZ/ynw3amt82mzq0=
+github.com/stretchr/objx v0.5.1/go.mod h1:/iHQpkQwBD6DLUmQ4pE+s1TXdob1mORJ4/UFdrifcy0=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75 h1:6fotK7otjonDflCTK0BCfls4SPy3NcCVb5dqqmbRknE=
+github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75/go.mod h1:KO6IkyS8Y3j8OdNO85qEYBsRPuteD+YciPomcXdrMnk=
+github.com/unix4ever/yaml v0.0.0-20220527175918-f17b0f05cf2c h1:Vn6nVVu9MdOYvXPkJP83iX5jVIfvxFC9v9xIKb+DlaQ=
+github.com/unix4ever/yaml v0.0.0-20220527175918-f17b0f05cf2c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+github.com/vbatts/tar-split v0.11.5 h1:3bHCTIheBm1qFTcgh9oPu+nNBtX+XJIupG/vacinCts=
+github.com/vbatts/tar-split v0.11.5/go.mod h1:yZbwRsSeGjusneWgA781EKej9HF8vme8okylkAeNKLk=
+github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510 h1:S2dVYn90KE98chqDkyE9Z4N61UnQd+KOfgp5Iu53llk=
+github.com/xiang90/probing v0.0.0-20221125231312-a49e3df8f510/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
+github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
+github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zitadel/logging v0.5.0 h1:Kunouvqse/efXy4UDvFw5s3vP+Z4AlHo3y8wF7stXHA=
+github.com/zitadel/logging v0.5.0/go.mod h1:IzP5fzwFhzzyxHkSmfF8dsyqFsQRJLLcQmwhIBzlGsE=
+github.com/zitadel/oidc v1.13.5 h1:7jhh68NGZitLqwLiVU9Dtwa4IraJPFF1vS+4UupO93U=
+github.com/zitadel/oidc v1.13.5/go.mod h1:rHs1DhU3Sv3tnI6bQRVlFa3u0lCwtR7S21WHY+yXgPA=
+go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
+go.etcd.io/bbolt v1.3.9 h1:8x7aARPEXiXbHmtUwAIv7eV2fQFHrLLavdiJ3uzJXoI=
+go.etcd.io/bbolt v1.3.9/go.mod h1:zaO32+Ti0PK1ivdPtgMESzuzL2VPoIG1PCQNvOdo/dE=
+go.etcd.io/etcd/api/v3 v3.5.12 h1:W4sw5ZoU2Juc9gBWuLk5U6fHfNVyY1WC5g9uiXZio/c=
+go.etcd.io/etcd/api/v3 v3.5.12/go.mod h1:Ot+o0SWSyT6uHhA56al1oCED0JImsRiU9Dc26+C2a+4=
+go.etcd.io/etcd/client/pkg/v3 v3.5.12 h1:EYDL6pWwyOsylrQyLp2w+HkQ46ATiOvoEdMarindU2A=
+go.etcd.io/etcd/client/pkg/v3 v3.5.12/go.mod h1:seTzl2d9APP8R5Y2hFL3NVlD6qC/dOT+3kvrqPyTas4=
+go.etcd.io/etcd/client/v2 v2.305.12 h1:0m4ovXYo1CHaA/Mp3X/Fak5sRNIWf01wk/X1/G3sGKI=
+go.etcd.io/etcd/client/v2 v2.305.12/go.mod h1:aQ/yhsxMu+Oht1FOupSr60oBvcS9cKXHrzBpDsPTf9E=
+go.etcd.io/etcd/client/v3 v3.5.12 h1:v5lCPXn1pf1Uu3M4laUE2hp/geOTc5uPcYYsNe1lDxg=
+go.etcd.io/etcd/client/v3 v3.5.12/go.mod h1:tSbBCakoWmmddL+BKVAJHa9km+O/E+bumDe9mSbPiqw=
+go.etcd.io/etcd/pkg/v3 v3.5.12 h1:OK2fZKI5hX/+BTK76gXSTyZMrbnARyX9S643GenNGb8=
+go.etcd.io/etcd/pkg/v3 v3.5.12/go.mod h1:UVwg/QIMoJncyeb/YxvJBJCE/NEwtHWashqc8A1nj/M=
+go.etcd.io/etcd/raft/v3 v3.5.12 h1:7r22RufdDsq2z3STjoR7Msz6fYH8tmbkdheGfwJNRmU=
+go.etcd.io/etcd/raft/v3 v3.5.12/go.mod h1:ERQuZVe79PI6vcC3DlKBukDCLja/L7YMu29B74Iwj4U=
+go.etcd.io/etcd/server/v3 v3.5.12 h1:EtMjsbfyfkwZuA2JlKOiBfuGkFCekv5H178qjXypbG8=
+go.etcd.io/etcd/server/v3 v3.5.12/go.mod h1:axB0oCjMy+cemo5290/CutIjoxlfA6KVYKD1w0uue10=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1 h1:SpGay3w+nEwMpfVnbqOLH5gY52/foP8RE8UzTZ1pdSE=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.1/go.mod h1:4UoMYEZOC0yN/sPGH76KPkkU7zgiEWYWL9vwmbnTJPE=
+go.opentelemetry.io/otel v1.21.0 h1:hzLeKBZEL7Okw2mGzZ0cc4k/A7Fta0uoPgaJCr8fsFc=
+go.opentelemetry.io/otel v1.21.0/go.mod h1:QZzNPQPm1zLX4gZK4cMi+71eaorMSGT3A4znnUvNNEo=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 h1:cl5P5/GIfFh4t6xyruOgJP5QiA1pw4fYYdv6nc6CBWw=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0/go.mod h1:zgBdWWAu7oEEMC06MMKc5NLbA/1YDXV1sMpSqEeLQLg=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0 h1:tIqheXEFWAZ7O8A7m+J0aPTmpJN3YQ7qetUAdkkkKpk=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0/go.mod h1:nUeKExfxAQVbiVFn32YXpXZZHZ61Cc3s3Rn1pDBGAb0=
+go.opentelemetry.io/otel/metric v1.21.0 h1:tlYWfeo+Bocx5kLEloTjbcDwBuELRrIFxwdQ36PlJu4=
+go.opentelemetry.io/otel/metric v1.21.0/go.mod h1:o1p3CA8nNHW8j5yuQLdc1eeqEaPfzug24uvsyIEJRWM=
+go.opentelemetry.io/otel/sdk v1.21.0 h1:FTt8qirL1EysG6sTQRZ5TokkU8d0ugCj8htOgThZXQ8=
+go.opentelemetry.io/otel/sdk v1.21.0/go.mod h1:Nna6Yv7PWTdgJHVRD9hIYywQBRx7pbox6nwBnZIxl/E=
+go.opentelemetry.io/otel/trace v1.21.0 h1:WD9i5gzvoUPuXIXH24ZNBudiarZDKuekPqi/E8fpfLc=
+go.opentelemetry.io/otel/trace v1.21.0/go.mod h1:LGbsEB0f9LGjN+OZaQQ26sohbOmiMR+BaslueVtS/qQ=
+go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
+go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
+go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
+golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
+golang.org/x/crypto v0.19.0 h1:ENy+Az/9Y1vSrlrvBSyna3PITt4tiZLf7sgCjZBX7Wo=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20231219180239-dc181d75b848 h1:+iq7lrkxmFNBM7xx+Rae2W6uyPfhPeDWD+n+JgppptE=
+golang.org/x/exp v0.0.0-20231219180239-dc181d75b848/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
+golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
+golang.org/x/net v0.0.0-20211123203042-d83791d6bcd9/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
+golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
+golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
+golang.org/x/net v0.21.0 h1:AQyQV4dYCvJ7vGmJyKki9+PBdyvhkSd8EIx/qb0AYv4=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.16.0 h1:aDkGMBSYxElaoP81NpoUoz2oo2R2wHdZpGToUxfyQrQ=
+golang.org/x/oauth2 v0.16.0/go.mod h1:hqZ+0LWXsiVoZpeld6jVt06P3adbS2Uu911W1SsJv2o=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
+golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
+golang.org/x/term v0.17.0 h1:mkTF7LCd6WGJNL3K1Ad7kwxNfYAW6a8a8QqtMblp/4U=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
+golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190829051458-42f498d34c4d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4=
+golang.org/x/tools v0.16.1 h1:TLyB3WofjdOEepBHAU20JdNC1Zbg87elYofWYAY5oZA=
+golang.org/x/tools v0.16.1/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=
+golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2/go.mod h1:deeaetjYA+DHMHg+sMSMI58GrEteJUUzzw7en6TJQcI=
+golang.zx2c4.com/wireguard v0.0.0-20231022001213-2e0774f246fb h1:c5tyN8sSp8jSDxdCCDXVOpJwYXXhmTkNMt+g0zTSOic=
+golang.zx2c4.com/wireguard v0.0.0-20231022001213-2e0774f246fb/go.mod h1:tkCQ4FQXmpAgYVh++1cq16/dH4QJtmvpRv19DWGAHSA=
+golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 h1:CawjfCvYQH2OU3/TnxLx97WDSUDRABfT18pCOYwc2GE=
+golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6/go.mod h1:3rxYc4HtVcSG9gVaTs2GEBdehh+sYPOwKtyUWEOTb80=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 h1:KAeGQVN3M9nD0/bQXnr/ClcEMJ968gUXJQ9pwfSynuQ=
+google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80/go.mod h1:cc8bqMqtv9gMOr0zHg2Vzff5ULhhL2IXP4sbcn32Dro=
+google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe h1:0poefMBYvYbs7g5UkjS6HcxBPaTRAmznle9jnxYoAI8=
+google.golang.org/genproto/googleapis/api v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:4jWUdICTdgc3Ibxmr8nAJiiLHwQBY0UI0XZcEMaFKaA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe h1:bQnxqljG/wqi4NTXu2+DJ3n7APcEA882QZ1JvhQAq9o=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240125205218-1f4bbc51befe/go.mod h1:PAREbraiVEVGVdTZsVWjSbbTtSyGbAgIIvni8a8CD5s=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
+google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
+google.golang.org/grpc v1.62.0 h1:HQKZ/fa1bXkX1oFOvSjmZEUL8wLSaZTjCcLAlmZRtdk=
+google.golang.org/grpc v1.62.0/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
+google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/go-jose/go-jose.v2 v2.6.1 h1:qEzJlIDmG9q5VO0M/o8tGS65QMHMS1w01TQJB1VPJ4U=
+gopkg.in/go-jose/go-jose.v2 v2.6.1/go.mod h1:zzZDPkNNw/c9IE7Z9jr11mBZQhKQTMzoEEIoEdZlFBI=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/mgo.v2 v2.0.0-20180705113604-9856a29383ce/go.mod h1:yeKp02qBN3iKW1OzL3MGk2IdtZzaj7SFntXj72NppTA=
+gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
+gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
+gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
+gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
+gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
+gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
+gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
+gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259 h1:TbRPT0HtzFP3Cno1zZo7yPzEEnfu8EjLfl6IU9VfqkQ=
+gvisor.dev/gvisor v0.0.0-20230927004350-cbd86285d259/go.mod h1:AVgIgHMwK63XvmAzWG9vLQ41YnVHN0du0tEC46fI7yY=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+k8s.io/api v0.29.1 h1:DAjwWX/9YT7NQD4INu49ROJuZAAAP/Ijki48GUPzxqw=
+k8s.io/api v0.29.1/go.mod h1:7Kl10vBRUXhnQQI8YR/R327zXC8eJ7887/+Ybta+RoQ=
+k8s.io/apiextensions-apiserver v0.28.3 h1:Od7DEnhXHnHPZG+W9I97/fSQkVpVPQx2diy+2EtmY08=
+k8s.io/apiextensions-apiserver v0.28.3/go.mod h1:NE1XJZ4On0hS11aWWJUTNkmVB03j9LM7gJSisbRt8Lc=
+k8s.io/apimachinery v0.29.1 h1:KY4/E6km/wLBguvCZv8cKTeOwwOBqFNjwJIdMkMbbRc=
+k8s.io/apimachinery v0.29.1/go.mod h1:6HVkd1FwxIagpYrHSwJlQqZI3G9LfYWRPAkUvLnXTKU=
+k8s.io/client-go v0.29.1 h1:19B/+2NGEwnFLzt0uB5kNJnfTsbV8w6TgQRz9l7ti7A=
+k8s.io/client-go v0.29.1/go.mod h1:TDG/psL9hdet0TI9mGyHJSgRkW3H9JZk2dNEUS7bRks=
+k8s.io/klog/v2 v2.120.0 h1:z+q5mfovBj1fKFxiRzsa2DsJLPIVMk/KFL81LMOfK+8=
+k8s.io/klog/v2 v2.120.0/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20231129212854-f0671cc7e66a h1:ZeIPbyHHqahGIbeyLJJjAUhnxCKqXaDY+n89Ms8szyA=
+k8s.io/kube-openapi v0.0.0-20231129212854-f0671cc7e66a/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
+k8s.io/utils v0.0.0-20231127182322-b307cd553661 h1:FepOBzJ0GXm8t0su67ln2wAZjbQ6RxQGZDnzuLcrUTI=
+k8s.io/utils v0.0.0-20231127182322-b307cd553661/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/controller-runtime v0.16.3 h1:2TuvuokmfXvDUamSx1SuAOO3eTyye+47mJCigwG62c4=
+sigs.k8s.io/controller-runtime v0.16.3/go.mod h1:j7bialYoSn142nv9sCOJmQgDXQXxnroFU4VnX/brVJ0=
+sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
+sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
+sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=
+sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY=
diff --git a/hack/certs/localhost-key.pem b/hack/certs/localhost-key.pem
new file mode 100644
index 000000000..63dc034b2
--- /dev/null
+++ b/hack/certs/localhost-key.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDY6wcBCRtiCPzI
+tEMOEPjckQACoGDtz9+alLU12TywPZeDWIh73HCmNzIgZa9mOsNHKG+1Z/VABuFQ
+EICqz8YNjlDpkj1jUAe9QOjFKt+Y6YqxBKlObIwQ8Bh/87xJhGMxtid8UinDJASX
+ZjPdyc9gCrufB7kn5TgCSQSjZC7E1VRYzrdXNQBvRepWZ5gs2dAPhsDpdf2hFddp
+vzd+ZLDaUX++4dMcflRHs08AJTpaM39O2RmJHSnJxMCIkONV7RNyo6NWdWr89HGw
+awpGTqmiOs27W3MTeZP9okmwUsz3DQakfiYwyYlocFXD6d10V/T499jxEwW8KdFK
+QpMAfMIpAgMBAAECggEBAIM4IeOJe8whPbG4AjxXHgRnnsb398rEjjJ3tOsfP+wp
+RieJff7XijmyeBtLCADimVDJcFIf0idqQhBp+zvZNqjqp52z/ni+aAAfbPAhEGPz
+GxgchsLPPSfd5iQ48HTUpiDjXR2CoorOlgx0IfoP4+fodjksteAhdHFFdI3Ww8gD
+W8C0P7HL6rauRr+trTzpXVMbpp2beccGXbSD0fGE7VK5/C7BqmMGxDM6Sw2L8Fb4
+PkzSqJiawcSmiX/v3z5to5TD7tjHGbX8eDLF0Pa9YVE0YaQQ4m/GC0FfY5AaLsfX
+6VKkIgXY6ewOAnxEj/YehcfXE6DVn0N600kho/VbgAUCgYEA6C2FAZN0BKSMNxwT
+MpJgzt35xIZ6l5/eynSorgtkfYkBwYrN7tSdbXdS2sTLml8CeCXp9rGq7xsrvK5v
+g5NKwVct3JGZ+qu78O6JUfjp8Itj7AoM0klmpAEFHgbbpl/o3P+1z/+xS8RvRhk9
+Ul6e8fWrIaby+cm054gy5RzciYcCgYEA7yywbIGWm38khUV/gaTJnb3SsBeFda4L
+QkaxLhbKj4RumLoUrBDAYZLrXKGj77XPeB3+5vLHGGDPnfjYaxCqOXNd1dKk1SQg
+z1WzzBjKPOyfmgHTjhQKEkW7e0isCW97gnXcXpLQROR0ecPTLQed55YbhWuazlFg
+6O6KJ4nVgs8CgYBq2Qfswb8So+cjNXhgPZzvlpfrKTghryEIasd10Shd3T9Bom9D
+CfWo+tDWfNp2IGMyh8A0F29iuk5WdrA7DP3KHCSu7RK/mWjUZ/IqFzMR0BQb/EQK
+Ql1J/G4uc1mCJ4EyszsojbM5+xx6VgMydPkQwM4QnpQTABCQvM0vQyj64QKBgQDd
+w1P559Yba7ITGDN3o7GFXyJhQA3w5WVvGFjkYSGEHMjnN3I/cHDQiAdPJlj4xF0Q
+BM/6l5TfF7Spxrfz3cnX5w5UWjGXpx384HwLe9jY0JXTmGntzMrh0mJZlzJctU+R
+0XJ5BiuyFRmiZV4C3JMezeHKvdEWCAKRN8xFiNm9pQKBgH+UAxtYdR8+UE0KW2nm
+nLZlDYNBNwEeYv3MiObotla6NDyRYYjpsIxupxnPa/ubQjWQt1rG7E9eMpS77j5h
+O8gSm3U3s4grrr//dYDO+lAy4Eb4zEzxtsFZM8jko2CjBI/CG7GcgtAReXXdL8KE
+iFWC+UlGGhGuifal/2FG/zB/
+-----END PRIVATE KEY-----
diff --git a/hack/certs/localhost.pem b/hack/certs/localhost.pem
new file mode 100644
index 000000000..56cc039c5
--- /dev/null
+++ b/hack/certs/localhost.pem
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEQzCCAqugAwIBAgIQc/rjEz+kG+oO/x0OH9xAbDANBgkqhkiG9w0BAQsFADCB
+gzEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50IENBMSwwKgYDVQQLDCNhcnRl
+bUBhcnRzdGF0aW9uIChBcnRlbSBDaGVybnlzaGV2KTEzMDEGA1UEAwwqbWtjZXJ0
+IGFydGVtQGFydHN0YXRpb24gKEFydGVtIENoZXJueXNoZXYpMB4XDTIyMTAwNjE0
+NTExM1oXDTI1MDEwNjE0NTExM1owVzEnMCUGA1UEChMebWtjZXJ0IGRldmVsb3Bt
+ZW50IGNlcnRpZmljYXRlMSwwKgYDVQQLDCNhcnRlbUBhcnRzdGF0aW9uIChBcnRl
+bSBDaGVybnlzaGV2KTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANjr
+BwEJG2II/Mi0Qw4Q+NyRAAKgYO3P35qUtTXZPLA9l4NYiHvccKY3MiBlr2Y6w0co
+b7Vn9UAG4VAQgKrPxg2OUOmSPWNQB71A6MUq35jpirEEqU5sjBDwGH/zvEmEYzG2
+J3xSKcMkBJdmM93Jz2AKu58HuSflOAJJBKNkLsTVVFjOt1c1AG9F6lZnmCzZ0A+G
+wOl1/aEV12m/N35ksNpRf77h0xx+VEezTwAlOlozf07ZGYkdKcnEwIiQ41XtE3Kj
+o1Z1avz0cbBrCkZOqaI6zbtbcxN5k/2iSbBSzPcNBqR+JjDJiWhwVcPp3XRX9Pj3
+2PETBbwp0UpCkwB8wikCAwEAAaNeMFwwDgYDVR0PAQH/BAQDAgWgMBMGA1UdJQQM
+MAoGCCsGAQUFBwMBMB8GA1UdIwQYMBaAFL2gWUvsvsPAP96mHAyI9p5hkw6EMBQG
+A1UdEQQNMAuCCWxvY2FsaG9zdDANBgkqhkiG9w0BAQsFAAOCAYEAkhjElSVaNNEn
+WDMhZX6vx3EA0HuDQJlG6PxfTIPWSK+GcYTmtej0NnxpZfQz7m8baKeyXmJG7XDb
+afK5CVNzpN4II3eTz04JkpY5br0GheX69FfEMJJRGwbfuzsSDDkrRNyyZSJ4IVLa
+OVIekACb7HY+atJ/n7SfZkMGVSlgUppjdYpa7xaHPe9XNupADnBNjT4BBhyTa7qF
+6rli+b/HxuHhx/DJc//Ed61fyXNvHcq8sM0E8JPwu996PsTq29JNs9xrgAuap9B5
+BF+WWN6uXY5UKgaqNj2sv/E3fJ7+kPQec4QNYMXWFIlsGNaa7gpaFFhvGTFyYxpW
+oL588oTa22L+kmsPNPL2AW63vrUYFXKXFCJifIVTkbZaVjAB4DCaTTACoDCHbz4T
+qTRMqpakfqI+cXZoSS3nO6X8IW/TbrF9joRaKUI9XH+poew6o61bAr7k68J9XnC3
+L6kO5lTtD08MCr+AK7PsbuS37ESnR5BdoewZPzc2sHzpRIRDCZDU
+-----END CERTIFICATE-----
diff --git a/hack/compose/docker-compose.yml b/hack/compose/docker-compose.yml
new file mode 100644
index 000000000..3bc585db5
--- /dev/null
+++ b/hack/compose/docker-compose.yml
@@ -0,0 +1,117 @@
+# Copyright (c) 2024 Sidero Labs, Inc.
+#
+# Use of this software is governed by the Business Source License
+# included in the LICENSE file.
+
+version: '3.8'
+services:
+  omni:
+    network_mode: host
+    depends_on:
+      - vault-dev
+      - node-dev
+      - minio-mc
+    volumes:
+      - etcd:/_out/etcd
+      - logs:/_out/logs
+      - secondary-storage:/_out/secondary-storage
+      - etcd-backup:/tmp/omni-data/etcd-backup
+      - ../generate-certs/certs:/etc/ssl/omni-certs:ro
+    container_name: local-omni
+    restart: on-failure
+    cap_add:
+      - NET_ADMIN
+    build:
+      context: ../../
+      dockerfile: Dockerfile
+      args:
+        - ARTIFACTS=${ARTIFACTS:?error}
+        - SHA=${SHA:?error}
+        - TAG=${TAG:?error}
+        - USERNAME=${USERNAME:?error}
+        - REGISTRY=${REGISTRY:?error}
+        - JS_TOOLCHAIN=${JS_TOOLCHAIN:?error}
+        - PROTOBUF_GRPC_GATEWAY_TS_VERSION=${PROTOBUF_GRPC_GATEWAY_TS_VERSION:?error}
+        - NODE_BUILD_ARGS=${NODE_BUILD_ARGS}
+        - TOOLCHAIN=${TOOLCHAIN:?error}
+        - CGO_ENABLED=${CGO_ENABLED:?error}
+        - GO_BUILDFLAGS=${GO_BUILDFLAGS}
+        - GOLANGCILINT_VERSION=${GOLANGCILINT_VERSION:?error}
+        - GOFUMPT_VERSION=${GOFUMPT_VERSION:?error}
+        - GOIMPORTS_VERSION=${GOIMPORTS_VERSION:?error}
+        - PROTOBUF_GO_VERSION=${PROTOBUF_GO_VERSION:?error}
+        - GRPC_GO_VERSION=${GRPC_GO_VERSION:?error}
+        - GRPC_GATEWAY_VERSION=${GRPC_GATEWAY_VERSION:?error}
+        - VTPROTOBUF_VERSION=${VTPROTOBUF_VERSION:?error}
+        - DEEPCOPY_VERSION=${DEEPCOPY_VERSION:?error}
+        - TESTPKGS=${TESTPKGS:?error}
+        - GO_LDFLAGS=${GO_LDFLAGS}
+    environment:
+      - VAULT_ADDR=http://127.0.0.1:8200
+      - VAULT_TOKEN=dev-o-token
+      - SIDEROLINK_DEV_JOIN_TOKEN=w7uVuW3zbVKIYQuzEcyetAHeYMeo5q2L9RvkAVfCfSCD
+
+  vault-dev:
+    container_name: local-vault
+    image: hashicorp/vault:1.15
+    environment:
+      - VAULT_DEV_ROOT_TOKEN_ID=dev-o-token
+    cap_add:
+      - IPC_LOCK
+    ports:
+      - "127.0.0.1:8200:8200"
+
+  vault-startup:
+    depends_on:
+      - vault-dev
+    restart: on-failure
+    container_name: local-vault-init
+    image: hashicorp/vault:1.15
+    volumes:
+      - ../../internal/backend/runtime/omni/testdata/pgp/new_key.private:/tmp/key.private:ro
+    environment:
+      - VAULT_ADDR=http://vault-dev:8200
+      - VAULT_TOKEN=dev-o-token
+    entrypoint: >-
+      vault kv put
+      -mount=secret
+      omni-private-key
+      private-key=@/tmp/key.private
+      || sleep 15 && exit 1
+
+  node-dev:
+    network_mode: host
+    container_name: local-node
+    image: node
+    volumes:
+      - ../../frontend:/app:rw
+    working_dir: /app
+    command: sh -c 'npm install && npm run serve'
+    stop_signal: SIGKILL
+
+  minio-server:
+    image: minio/minio:latest
+    volumes:
+      - minio:/minio-server
+    ports:
+      - "127.0.0.1:9000:9000"
+    environment:
+      MINIO_ACCESS_KEY: access
+      MINIO_SECRET_KEY: secret123
+    command: server /minio-server/export
+
+  minio-mc:
+    image: minio/mc:latest
+    container_name: minio-mc
+    depends_on:
+      - minio-server
+    entrypoint: /bin/sh
+    restart: on-failure
+    command: -c "mc alias set myminio http://minio-server:9000 access secret123 && mc mb --ignore-existing myminio/mybucket"
+
+volumes:
+  etcd:
+  logs:
+  minio:
+  secondary-storage:
+  etcd-backup:
diff --git a/hack/dev-server.sh b/hack/dev-server.sh
new file mode 100755
index 000000000..8e1855ea8
--- /dev/null
+++ b/hack/dev-server.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+# Copyright (c) 2024 Sidero Labs, Inc.
+#
+# Use of this software is governed by the Business Source License
+# included in the LICENSE file.
+
+PLATFORM=$(uname -s | tr "[:upper:]" "[:lower:]")
+ARCHITECTURE=""
+case $(uname -m) in
+  i386)   echo "32 bit architecture is not supported" exit 1 ;;
+  i686)   echo "32 bit architecture is not supported" exit 1 ;;
+  x86_64) ARCHITECTURE="amd64" ;;
+  arm)    ARCHITECTURE="arm64" ;;
+esac
+
+sudo -E _out/omni-${PLATFORM}-${ARCHITECTURE} --port 8091 >_out/backend.log 2>&1 &
+cd frontend && npm install && npm run serve
diff --git a/hack/generate-certs.example.yml b/hack/generate-certs.example.yml
new file mode 100644
index 000000000..ac3c2f0dc
--- /dev/null
+++ b/hack/generate-certs.example.yml
@@ -0,0 +1,20 @@
+# Copyright (c) 2024 Sidero Labs, Inc.
+#
+# Use of this software is governed by the Business Source License
+# included in the LICENSE file.
+
+email: test-user@siderolabs.com
+host: localhost
+additional-hosts: []
+bind_addr: 0.0.0.0:443
+client-id: jS47T064CfFE1IqqIYZ8HfYLkZhFoa1Y
+auth0-domain: sidero-omni-dev.us.auth0.com
+pprof-bind-addr: 0.0.0.0:2135
+# registry-mirrors: # optional, but speeds up deployments a lot
+#   docker.io: http://172.20.0.1:5000
+#   k8s.gcr.io: http://172.20.0.1:5001
+#   quay.io: http://172.20.0.1:5002
+#   gcr.io: http://172.20.0.1:5003
+#   ghcr.io: http://172.20.0.1:5004
+#   registry.k8s.io: http://172.20.0.1:5001
+#   factory.talos.dev: http://172.20.0.1:5006
diff --git a/hack/generate-certs/main.go b/hack/generate-certs/main.go
new file mode 100644
index 000000000..2fa488a30
--- /dev/null
+++ b/hack/generate-certs/main.go
@@ -0,0 +1,283 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// generate-certs is used to generate local CA certs for development and docker-compose.override.yml file.
+package main
+
+import (
+	"errors"
+	"flag"
+	"fmt"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"text/template"
+
+	"github.com/siderolabs/gen/ensure"
+	"gopkg.in/yaml.v3"
+)
+
+var cfgFile = flag.String("config", "", "config file path")
+
+func main() {
+	flag.Parse()
+
+	args := flag.Args()
+
+	if len(args) != 1 {
+		printStderr("usage: %s [install|uninstall|generate]", os.Args[0])
+		os.Exit(1)
+	}
+
+	toRun := install
+
+	switch args[0] {
+	case "install":
+		break
+	case "uninstall":
+		toRun = uninstall
+	case "generate":
+		toRun = generate
+	default:
+		printStderr("usage: %s [install|uninstall|generate]", os.Args[0])
+		os.Exit(1)
+	}
+
+	run := func() error {
+		if ok, err := fileExist("./hack/compose/docker-compose.yml"); err != nil {
+			return fmt.Errorf("error checking for docker-compose.yml: %w", err)
+		} else if !ok {
+			return errors.New("must be run from the root of the repo")
+		}
+
+		return toRun()
+	}
+
+	if err := run(); err != nil {
+		printStderr("\n\napp failed with error: %v\n", err)
+		os.Exit(1)
+	}
+}
+
+func install() (err error) {
+	defer handleErr(&err)
+
+	certsDir := getCARootDir()
+	ensure.NoError(os.MkdirAll(certsDir, 0o755))
+	ensure.Value(exec.LookPath("mkcert"))
+	ensure.NoError(os.Setenv("CAROOT", certsDir))
+	ensure.NoError(runApp("mkcert", "-install"))
+
+	printStderr("generated certs in %s\n", certsDir)
+
+	return nil
+}
+
+func uninstall() (err error) {
+	defer handleErr(&err)
+
+	ensure.Value(exec.LookPath("mkcert"))
+
+	if certsDir := getCARootDir(); ensure.Value(dirExists(certsDir)) {
+		printStderr("found certs dir '%s'\n\n", certsDir)
+		ensure.NoError(os.Setenv("CAROOT", certsDir))
+	}
+
+	ensure.NoError(runApp("mkcert", "-uninstall"))
+
+	return nil
+}
+
+func generate() (err error) {
+	defer handleErr(&err)
+
+	if *cfgFile == "" {
+		return errors.New("config file path is required")
+	}
+
+	certsDir := getCARootDir()
+	if !ensure.Value(dirExists(certsDir)) {
+		return fmt.Errorf("no certs dir found at '%s', please run 'install' before", certsDir)
+	}
+
+	var cfg cfg
+
+	ensure.NoError(yaml.Unmarshal(ensure.Value(os.ReadFile(*cfgFile)), &cfg))
+	ensure.NoError(os.Setenv("CAROOT", certsDir))
+	ensure.NoError(os.MkdirAll("./hack/generate-certs/certs", 0o755))
+
+	mkcertArgs := []string{
+		"-cert-file",
+		"./hack/generate-certs/certs/localhost.pem",
+		"-key-file",
+		"./hack/generate-certs/certs/localhost-key.pem",
+		cfg.Host,
+	}
+
+	mkcertArgs = append(mkcertArgs, cfg.AdditionalHosts...)
+
+	ensure.NoError(runApp("mkcert", mkcertArgs...))
+
+	file := ensure.Value(os.OpenFile("./hack/compose/docker-compose.override.yml", os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644))
+
+	_, port, err := net.SplitHostPort(cfg.BindAddr)
+	if err != nil {
+		return fmt.Errorf("error parsing bind addr: %w", err)
+	}
+
+	if port == "443" {
+		port = ""
+	}
+
+	data := struct { //nolint:govet
+		ClientID         string
+		Auth0Domain      string
+		Host             string
+		Port             string
+		Email            string
+		BindAddr         string
+		RegistryMirrors  map[string]string
+		PprofBindAddress string
+	}{
+		ClientID:         cfg.ClientID,
+		Auth0Domain:      cfg.Auth0Domain,
+		Host:             cfg.Host,
+		Port:             port,
+		Email:            cfg.Email,
+		BindAddr:         cfg.BindAddr,
+		RegistryMirrors:  cfg.RegistryMirrors,
+		PprofBindAddress: cfg.PprofBindAddress,
+	}
+
+	ensure.NoError(template.Must(template.New("docker-compose.override.yml").Parse(composeTemplate)).Execute(file, &data))
+
+	return nil
+}
+
+func runApp(app string, args ...string) error {
+	cmd := exec.Command(app, args...)
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	cmd.Stdin = os.Stdin
+
+	if err := cmd.Run(); err != nil {
+		return fmt.Errorf("error running '%s': %w", app, err)
+	}
+
+	return nil
+}
+
+func dirExists(path string) (bool, error) {
+	s, err := os.Stat(path)
+	if os.IsNotExist(err) {
+		return false, nil
+	}
+
+	if err != nil {
+		return false, err
+	}
+
+	return s.IsDir(), nil
+}
+
+func fileExist(path string) (bool, error) {
+	if _, err := os.Stat(path); os.IsNotExist(err) {
+		return false, nil
+	} else if err != nil {
+		return false, err
+	}
+
+	return true, nil
+}
+
+func getCARootDir() string {
+	return filepath.Join(ensure.Value(os.Getwd()), "hack/generate-certs/ca-root")
+}
+
+type expectedError struct{ error }
+
+func handleErr(err *error) {
+	if r := recover(); r != nil {
+		if e, ok := r.(*expectedError); ok {
+			*err = e.error
+		} else {
+			panic(r)
+		}
+	}
+}
+
+func printStderr(msg string, args ...any) {
+	ensure.Value(fmt.Fprintf(os.Stderr, msg, args...))
+}
+
+type cfg struct { //nolint:govet
+	Email            string            `yaml:"email"`
+	Host             string            `yaml:"host"`
+	AdditionalHosts  []string          `yaml:"additional-hosts"`
+	BindAddr         string            `yaml:"bind_addr"`
+	ClientID         string            `yaml:"client-id"`
+	Auth0Domain      string            `yaml:"auth0-domain"`
+	RegistryMirrors  map[string]string `yaml:"registry-mirrors"`
+	PprofBindAddress string            `yaml:"pprof-bind-address"`
+}
+
+func (c *cfg) UnmarshalYAML(value *yaml.Node) error {
+	type innerCfg cfg
+
+	err := value.Decode((*innerCfg)(c))
+	if err != nil {
+		return err
+	}
+
+	return c.validate()
+}
+
+func (c *cfg) validate() error {
+	switch {
+	case c.Email == "":
+		return errors.New("email is required")
+	case c.Host == "":
+		return errors.New("host is required")
+	case c.BindAddr == "":
+		return errors.New("bind_addr is required")
+	case c.ClientID == "":
+		return errors.New("client-id is required")
+	case c.Auth0Domain == "":
+		return errors.New("auth0-domain is required")
+	default:
+		return nil
+	}
+}
+
+const composeTemplate = `version: '3.8'
+services:
+  omni:
+    command: >-
+      --siderolink-wireguard-advertised-addr 172.20.0.1:50180
+      --siderolink-wireguard-bind-addr='0.0.0.0:50180'
+      --private-key-source vault://secret/omni-private-key
+      --auth-auth0-enabled true
+      --auth-auth0-client-id {{ .ClientID }}
+      --auth-auth0-domain {{ .Auth0Domain }}
+      --initial-users {{ .Email }},test-user@siderolabs.com
+      --advertised-api-url https://{{ .Host }}{{- if .Port -}}:{{- end -}}{{ .Port }}
+      --advertised-kubernetes-proxy-url https://{{ .Host }}:8095/
+      --workload-proxying-enabled=true
+      --key /etc/ssl/omni-certs/localhost-key.pem
+      --cert /etc/ssl/omni-certs/localhost.pem
+      --bind-addr {{ .BindAddr }}
+      --frontend-dst http://127.0.0.1:8121
+      --frontend-bind 0.0.0.0:8120
+      --debug
+      --etcd-embedded-unsafe-fsync=true
+      --etcd-backup-s3
+      {{- range $key, $value := .RegistryMirrors }}
+      --registry-mirror {{ $key }}={{ $value }}
+      {{- end }}
+      {{- if ne .PprofBindAddress ""}}
+      --pprof-bind-addr {{ .PprofBindAddress }}
+      {{- end}}
+`
diff --git a/hack/release.sh b/hack/release.sh
new file mode 100755
index 000000000..308bf91e1
--- /dev/null
+++ b/hack/release.sh
@@ -0,0 +1,66 @@
+#!/bin/bash
+
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2022-03-24T11:54:05Z by kres latest.
+
+set -e
+
+RELEASE_TOOL_IMAGE="ghcr.io/siderolabs/release-tool:latest"
+
+function release-tool {
+  docker pull "${RELEASE_TOOL_IMAGE}" >/dev/null
+  docker run --rm -w /src -v "${PWD}":/src:ro "${RELEASE_TOOL_IMAGE}" -l -d -n -t "${1}" ./hack/release.toml
+}
+
+function changelog {
+  if [ "$#" -eq 1 ]; then
+    (release-tool ${1}; echo; cat CHANGELOG.md) > CHANGELOG.md- && mv CHANGELOG.md- CHANGELOG.md
+  else
+    echo 1>&2 "Usage: $0 changelog [tag]"
+    exit 1
+  fi
+}
+
+function release-notes {
+  release-tool "${2}" > "${1}"
+}
+
+function cherry-pick {
+  if [ $# -ne 2 ]; then
+    echo 1>&2 "Usage: $0 cherry-pick <commit> <branch>"
+    exit 1
+  fi
+
+  git checkout $2
+  git fetch
+  git rebase upstream/$2
+  git cherry-pick -x $1
+}
+
+function commit {
+  if [ $# -ne 1 ]; then
+    echo 1>&2 "Usage: $0 commit <tag>"
+    exit 1
+  fi
+
+  git commit -s -m "release($1): prepare release" -m "This is the official $1 release."
+}
+
+if declare -f "$1" > /dev/null
+then
+  cmd="$1"
+  shift
+  $cmd "$@"
+else
+  cat <<EOF
+Usage:
+  commit:        Create the official release commit message.
+  cherry-pick:   Cherry-pick a commit into a release branch.
+  changelog:     Update the specified CHANGELOG.
+  release-notes: Create release notes for GitHub release.
+EOF
+
+  exit 1
+fi
+
diff --git a/hack/release.toml b/hack/release.toml
new file mode 100644
index 000000000..336835b0e
--- /dev/null
+++ b/hack/release.toml
@@ -0,0 +1,24 @@
+# commit to be tagged for the new release
+commit = "HEAD"
+
+project_name = "Omni"
+github_repo = "siderolabs/omni"
+match_deps = "^github.com/((talos-systems|siderolabs)/[a-zA-Z0-9-]+)$"
+
+pre_release = false
+previous = "v0.19.0"
+
+[notes]
+
+  [notes.kubernetes-config]
+    title = "Kubeconfig Changes"
+    description = """\
+Omni now generates Kubernetes configs without accessing Talos API.
+"""
+
+  [notes.saml-roles]
+    title = ""
+    description = """\
+Omni can now define SAML user roles depending on the SAML labels it gets from the SAML assertion.
+Role is assigned only once on user creation.
+"""
diff --git a/hack/test/freeze-a-vm.sh b/hack/test/freeze-a-vm.sh
new file mode 100755
index 000000000..106f98856
--- /dev/null
+++ b/hack/test/freeze-a-vm.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# Copyright (c) 2024 Sidero Labs, Inc.
+#
+# Use of this software is governed by the Business Source License
+# included in the LICENSE file.
+
+set -eoux pipefail
+
+# freeze a VM UUID $1 in talosctl cluster created cluster 'talos-default'
+
+echo "s" | socat - unix-connect:${HOME}/.talos/clusters/talos-default/machine-$1.monitor
diff --git a/hack/test/integration.sh b/hack/test/integration.sh
new file mode 100755
index 000000000..60c109506
--- /dev/null
+++ b/hack/test/integration.sh
@@ -0,0 +1,157 @@
+#!/bin/bash
+
+# Copyright (c) 2024 Sidero Labs, Inc.
+#
+# Use of this software is governed by the Business Source License
+# included in the LICENSE file.
+
+set -eoux pipefail
+
+# Settings.
+
+TALOS_VERSION=1.6.4
+ARTIFACTS=_out
+JOIN_TOKEN=testonly
+RUN_DIR=$(pwd)
+
+# Download required artifacts.
+
+mkdir -p ${ARTIFACTS}
+
+[ -f ${ARTIFACTS}/talosctl ] || (crane export ghcr.io/siderolabs/talosctl:latest | tar x -C ${ARTIFACTS})
+
+# Your image schematic ID is: cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f
+#
+# customization:
+#     systemExtensions:
+#         officialExtensions:
+#             - siderolabs/hello-world-service
+SCHEMATIC_ID="cf9b7aab9ed7c365d5384509b4d31c02fdaa06d2b3ac6cc0bc806f28130eff1f"
+
+# Build registry mirror args.
+
+if [[ "${CI:-false}" == "true" ]]; then
+  REGISTRY_MIRROR_FLAGS=()
+
+  for registry in docker.io k8s.gcr.io quay.io gcr.io ghcr.io registry.k8s.io factory.talos.dev; do
+    service="registry-${registry//./-}.ci.svc"
+    addr=$(python3 -c "import socket; print(socket.gethostbyname('${service}'))")
+
+    REGISTRY_MIRROR_FLAGS+=("--registry-mirror=${registry}=http://${addr}:5000")
+  done
+else
+  # use the value from the environment, if present
+  REGISTRY_MIRROR_FLAGS=("${REGISTRY_MIRROR_FLAGS:-}")
+fi
+
+function cleanup() {
+  cd "${RUN_DIR}"
+  rm -rf ${ARTIFACTS}/omni.db ${ARTIFACTS}/etcd/
+}
+
+trap cleanup EXIT SIGINT
+
+# Determine the local IP SideroLink API will listen on
+LOCAL_IP=$(ip -o route get to 8.8.8.8 | sed -n 's/.*src \([0-9.]\+\).*/\1/p')
+
+# Start Vault.
+
+docker run --rm -d --cap-add=IPC_LOCK -p 8200:8200 -e 'VAULT_DEV_ROOT_TOKEN_ID=dev-o-token' --name vault-dev hashicorp/vault:1.15
+
+sleep 10
+
+# Load key into Vault.
+
+docker cp internal/backend/runtime/omni/testdata/pgp/old_key.private vault-dev:/tmp/old_key.private
+docker exec -e VAULT_ADDR='http://0.0.0.0:8200' -e VAULT_TOKEN=dev-o-token vault-dev \
+    vault kv put -mount=secret omni-private-key \
+    private-key=@/tmp/old_key.private
+
+sleep 5
+
+[ -f ${ARTIFACTS}/minio ] || curl -Lo ${ARTIFACTS}/minio https://dl.min.io/server/minio/release/linux-amd64/minio
+chmod +x ${ARTIFACTS}/minio && MINIO_ACCESS_KEY=access MINIO_SECRET_KEY=secret123 ${ARTIFACTS}/minio server minio-server/export &
+
+sleep 2
+
+[ -f ${ARTIFACTS}/mc ] || curl -Lo ${ARTIFACTS}/mc https://dl.min.io/client/mc/release/linux-amd64/mc
+chmod +x ${ARTIFACTS}/mc && ${ARTIFACTS}/mc alias set myminio http://127.0.0.1:9000 access secret123 && ${ARTIFACTS}/mc mb myminio/mybucket
+
+
+# Launch Omni in the background.
+
+export VAULT_ADDR='http://127.0.0.1:8200'
+export VAULT_TOKEN=dev-o-token
+export AUTH_USERNAME="${AUTH0_TEST_USERNAME}"
+export AUTH_PASSWORD="${AUTH0_TEST_PASSWORD}"
+export BASE_URL=https://localhost:8099/
+export VIDEO_DIR=""
+
+# Create omnictl downloads directory (required by the server) and copy the omnictl binaries in it.
+mkdir -p omnictl
+cp -p ${ARTIFACTS}/omnictl-* omnictl/
+
+SIDEROLINK_DEV_JOIN_TOKEN="${JOIN_TOKEN}" \
+nice -n 10 ${ARTIFACTS}/omni-linux-amd64 \
+    --siderolink-wireguard-advertised-addr 172.20.0.1:50180 \
+    --siderolink-api-advertised-url "grpc://$LOCAL_IP:8090" \
+    --auth-auth0-enabled true \
+    --advertised-api-url "${BASE_URL}" \
+    --auth-auth0-client-id jS47T064CfFE1IqqIYZ8HfYLkZhFoa1Y \
+    --auth-auth0-domain sidero-omni-dev.us.auth0.com \
+    --initial-users ${AUTH_USERNAME} \
+    --private-key-source "vault://secret/omni-private-key" \
+    --public-key-files "internal/backend/runtime/omni/testdata/pgp/new_key.public" \
+    --bind-addr 0.0.0.0:8099 \
+    --key hack/certs/localhost-key.pem \
+    --cert hack/certs/localhost.pem \
+    --etcd-embedded-unsafe-fsync=true \
+    --etcd-backup-s3 \
+    "${REGISTRY_MIRROR_FLAGS[@]}" \
+    &
+
+# Launch empty Talos VMs.
+${ARTIFACTS}/talosctl cluster create \
+    --provisioner=qemu \
+    --cidr=172.20.0.0/24 \
+    --controlplanes=1 \
+    --workers=7 \
+    --skip-injecting-config \
+    --extra-boot-kernel-args "siderolink.api=grpc://$LOCAL_IP:8090?jointoken=${JOIN_TOKEN} talos.events.sink=[fdae:41e4:649b:9303::1]:8090 talos.logging.kernel=tcp://[fdae:41e4:649b:9303::1]:8092" \
+    --vmlinuz-path="https://factory.talos.dev/image/${SCHEMATIC_ID}/v${TALOS_VERSION}/kernel-amd64" \
+    --initrd-path="https://factory.talos.dev/image/${SCHEMATIC_ID}/v${TALOS_VERSION}/initramfs-amd64.xz" \
+    --wait=false \
+    --mtu=1430 \
+    --memory=3072 \
+    --memory-workers=3072 \
+    --cpus=3 \
+    --cpus-workers=3 \
+    --with-init-node \
+    --with-uuid-hostnames
+
+sleep 5
+
+# Run the integration test.
+
+SSL_CERT_DIR=hack/certs:/etc/ssl/certs \
+${ARTIFACTS}/omni-integration-test-linux-amd64 \
+    --endpoint https://localhost:8099 \
+    --talos-version=${TALOS_VERSION} \
+    --expected-machines=8 `# equal to the masters+workers above` \
+    ${INTEGRATION_TEST_ARGS:-}
+
+if [ "${INTEGRATION_RUN_E2E_TEST:-true}" == "true" ]; then
+  # Run the e2e test.
+  # the e2e tests are in a submodule and need to be executed in a container with playwright dependencies
+  cd internal/e2e-tests/
+  docker buildx build --load . -t e2etest
+  docker run --rm \
+      -e AUTH_PASSWORD=$AUTH_PASSWORD \
+      -e AUTH_USERNAME=$AUTH_USERNAME \
+      -e BASE_URL=$BASE_URL \
+      -e VIDEO_DIR="$VIDEO_DIR" \
+      --network=host \
+      e2etest
+fi
+
+# No cleanup here, as it runs in the CI as a container in a pod.
diff --git a/hack/test/restart-a-vm.sh b/hack/test/restart-a-vm.sh
new file mode 100755
index 000000000..acc6cad18
--- /dev/null
+++ b/hack/test/restart-a-vm.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# Copyright (c) 2024 Sidero Labs, Inc.
+#
+# Use of this software is governed by the Business Source License
+# included in the LICENSE file.
+
+set -eoux pipefail
+
+# restart a VM UUID $1 in talosctl cluster created cluster 'talos-default'
+
+echo "q" | socat - unix-connect:${HOME}/.talos/clusters/talos-default/machine-$1.monitor
diff --git a/hack/test/wipe-a-vm.sh b/hack/test/wipe-a-vm.sh
new file mode 100755
index 000000000..756981e35
--- /dev/null
+++ b/hack/test/wipe-a-vm.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+
+# Copyright (c) 2024 Sidero Labs, Inc.
+#
+# Use of this software is governed by the Business Source License
+# included in the LICENSE file.
+
+set -eoux pipefail
+
+# wipe a VM UUID $1 in talosctl cluster created cluster 'talos-default'
+
+echo "s" | socat - unix-connect:${HOME}/.talos/clusters/talos-default/machine-$1.monitor
+
+disk="${HOME}/.talos/clusters/talos-default/machine-$1-0.disk"
+
+size=$(du -bs "${disk}" | cut -f1)
+
+rm "${disk}"
+
+truncate -s "${size}" "${disk}"
+
+echo "q" | socat - unix-connect:${HOME}/.talos/clusters/talos-default/machine-$1.monitor
diff --git a/internal/backend/debug/debug.go b/internal/backend/debug/debug.go
new file mode 100644
index 000000000..5fd2c36e1
--- /dev/null
+++ b/internal/backend/debug/debug.go
@@ -0,0 +1,28 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package debug provides HTTP handlers in debug mode.
+package debug
+
+import (
+	"github.com/cosi-project/runtime/pkg/controller/runtime"
+	"github.com/cosi-project/runtime/pkg/state"
+)
+
+// Handler of imager requests.
+type Handler struct {
+	runtime *runtime.Runtime
+	state   state.State
+}
+
+// NewHandler creates a new debug handler.
+//
+// Debug handler provides real implementation only when sidero.debug is enabled.
+func NewHandler(runtime *runtime.Runtime, state state.State) *Handler {
+	return &Handler{
+		runtime: runtime,
+		state:   state,
+	}
+}
diff --git a/internal/backend/debug/debug_disabled.go b/internal/backend/debug/debug_disabled.go
new file mode 100644
index 000000000..06138770d
--- /dev/null
+++ b/internal/backend/debug/debug_disabled.go
@@ -0,0 +1,16 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//go:build !sidero.debug
+
+package debug
+
+import "net/http"
+
+// ServeHTTP handles debug requests.
+func (handler *Handler) ServeHTTP(w http.ResponseWriter, _ *http.Request) {
+	// no debug handlers when debug is disabled
+	http.Error(w, "Not found", http.StatusNotFound)
+}
diff --git a/internal/backend/debug/debug_enabled.go b/internal/backend/debug/debug_enabled.go
new file mode 100644
index 000000000..ab23e5376
--- /dev/null
+++ b/internal/backend/debug/debug_enabled.go
@@ -0,0 +1,37 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//go:build sidero.debug
+
+package debug
+
+import (
+	"io"
+	"net/http"
+)
+
+// ServeHTTP handles debug requests.
+func (handler *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	io.Copy(io.Discard, r.Body) //nolint:errcheck
+	r.Body.Close()              //nolint:errcheck
+
+	switch r.Method {
+	case http.MethodGet, http.MethodHead:
+		// supported
+	default:
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+
+		return
+	}
+
+	switch r.URL.Path {
+	case "/debug/controller-graph":
+		handler.handleDependencyGraph(w, r, false)
+	case "/debug/controller-resource-graph":
+		handler.handleDependencyGraph(w, r, true)
+	default:
+		http.Error(w, "Not found", http.StatusNotFound)
+	}
+}
diff --git a/internal/backend/debug/graphs.go b/internal/backend/debug/graphs.go
new file mode 100644
index 000000000..e6d29f119
--- /dev/null
+++ b/internal/backend/debug/graphs.go
@@ -0,0 +1,178 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//go:build sidero.debug
+
+package debug
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/emicklei/dot"
+
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+)
+
+func (handler *Handler) handleDependencyGraph(w http.ResponseWriter, r *http.Request, withResources bool) {
+	if r.Method == http.MethodHead {
+		return
+	}
+
+	var (
+		graph *dot.Graph
+		err   error
+	)
+
+	if withResources {
+		graph, err = handler.generateControllerResourceGraph(r.Context())
+	} else {
+		graph, err = handler.generateControllerGraph()
+	}
+
+	if err != nil {
+		http.Error(w, fmt.Sprintf("Internal server error: %s", err), http.StatusInternalServerError)
+
+		return
+	}
+
+	graph.Write(w)
+}
+
+func (handler *Handler) generateControllerGraph() (*dot.Graph, error) {
+	depGraph, err := handler.runtime.GetDependencyGraph()
+	if err != nil {
+		return nil, err
+	}
+
+	graph := dot.NewGraph(dot.Directed)
+
+	for _, edge := range depGraph.Edges {
+		graph.Node(edge.ControllerName).Box()
+
+		graph.Node(edge.ResourceType).
+			Attr("shape", "note").
+			Attr("fillcolor", "azure2").
+			Attr("style", "filled")
+	}
+
+	for _, edge := range depGraph.Edges {
+		var idLabels []string
+
+		if edge.ResourceID != "" {
+			idLabels = append(idLabels, edge.ResourceID)
+		}
+
+		switch edge.EdgeType {
+		case controller.EdgeOutputExclusive:
+			graph.Edge(graph.Node(edge.ControllerName), graph.Node(edge.ResourceType)).Bold()
+		case controller.EdgeOutputShared:
+			graph.Edge(graph.Node(edge.ControllerName), graph.Node(edge.ResourceType)).Solid()
+		case controller.EdgeInputStrong, controller.EdgeInputQPrimary:
+			graph.Edge(graph.Node(edge.ResourceType), graph.Node(edge.ControllerName), idLabels...).Solid()
+		case controller.EdgeInputWeak, controller.EdgeInputQMapped:
+			graph.Edge(graph.Node(edge.ResourceType), graph.Node(edge.ControllerName), idLabels...).Dotted()
+		case controller.EdgeInputDestroyReady:
+			// don't show the DestroyReady inputs to reduce the visual clutter
+		}
+	}
+
+	return graph, nil
+}
+
+func (handler *Handler) generateControllerResourceGraph(ctx context.Context) (*dot.Graph, error) {
+	depGraph, err := handler.runtime.GetDependencyGraph()
+	if err != nil {
+		return nil, err
+	}
+
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	graph := dot.NewGraph(dot.Directed)
+
+	resourceID := func(r resource.Resource) string {
+		return fmt.Sprintf("%s/%s/%s", r.Metadata().Namespace(), r.Metadata().Type(), r.Metadata().ID())
+	}
+
+	resources := map[resource.Type][]resource.Resource{}
+
+	for _, edge := range depGraph.Edges {
+		if _, ok := resources[edge.ResourceType]; ok {
+			continue
+		}
+
+		rd, err := safe.StateGet[*meta.ResourceDefinition](ctx, handler.state, resource.NewMetadata(meta.NamespaceName, meta.ResourceDefinitionType, strings.ToLower(edge.ResourceType), resource.VersionUndefined))
+		if err != nil {
+			return nil, err
+		}
+
+		items, err := handler.state.List(ctx, resource.NewMetadata(rd.TypedSpec().DefaultNamespace, edge.ResourceType, "", resource.VersionUndefined))
+		if err != nil {
+			return nil, err
+		}
+
+		for _, r := range items.Items {
+			resources[edge.ResourceType] = append(resources[edge.ResourceType], r)
+		}
+	}
+
+	for _, edge := range depGraph.Edges {
+		graph.Node(edge.ControllerName).Box()
+	}
+
+	for resourceType, resourceList := range resources {
+		cluster := graph.Subgraph(resourceType, dot.ClusterOption{})
+		cluster.Attr("label", dot.HTML(fmt.Sprintf("<B>%s</B>", resourceType)))
+
+		for _, resource := range resourceList {
+			label := fmt.Sprintf("<B>%s</B>", resource.Metadata().ID())
+
+			for k, v := range resource.Metadata().Labels().Raw() {
+				label += fmt.Sprintf("<BR/><I>%s</I>: %s", k, v)
+			}
+
+			cluster.Node(resourceID(resource)).
+				Attr("shape", "note").
+				Attr("fillcolor", "azure2").
+				Attr("style", "filled").
+				Attr("label", dot.HTML(label))
+		}
+	}
+
+	for _, edge := range depGraph.Edges {
+		for _, resource := range resources[edge.ResourceType] {
+			if edge.ResourceID != "" && resource.Metadata().ID() != edge.ResourceID {
+				continue
+			}
+
+			if (edge.EdgeType == controller.EdgeOutputExclusive ||
+				edge.EdgeType == controller.EdgeOutputShared) &&
+				edge.ControllerName != resource.Metadata().Owner() {
+				continue
+			}
+
+			switch edge.EdgeType {
+			case controller.EdgeOutputExclusive:
+				graph.Edge(graph.Node(edge.ControllerName), graph.Subgraph(edge.ResourceType).Node(resourceID(resource))).Solid()
+			case controller.EdgeOutputShared:
+				graph.Edge(graph.Node(edge.ControllerName), graph.Subgraph(edge.ResourceType).Node(resourceID(resource))).Solid()
+			case controller.EdgeInputStrong, controller.EdgeInputQPrimary:
+				graph.Edge(graph.Subgraph(edge.ResourceType).Node(resourceID(resource)), graph.Node(edge.ControllerName)).Solid()
+			case controller.EdgeInputWeak, controller.EdgeInputQMapped:
+				graph.Edge(graph.Subgraph(edge.ResourceType).Node(resourceID(resource)), graph.Node(edge.ControllerName)).Dotted()
+			case controller.EdgeInputDestroyReady:
+				// don't show the DestroyReady inputs to reduce the visual clutter
+			}
+		}
+	}
+
+	return graph, nil
+}
diff --git a/internal/backend/dns/service.go b/internal/backend/dns/service.go
new file mode 100644
index 000000000..d2edbf1ee
--- /dev/null
+++ b/internal/backend/dns/service.go
@@ -0,0 +1,260 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package dns provides node name to node IP lookups, similar to a Service service.
+package dns
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+type record struct {
+	cluster string
+	name    string
+}
+
+// Info contains information about a node.
+type Info struct {
+	Cluster      string
+	ID           string
+	Name         string
+	Address      string
+	TalosVersion string
+}
+
+// Service is the DNS service.
+type Service struct {
+	omniState state.State
+	logger    *zap.Logger
+
+	recordToNodeID map[record]resource.ID
+	nodeIDToInfo   map[resource.ID]Info
+
+	lock sync.Mutex
+}
+
+// NewService creates a new DNS service. It needs to be started before use.
+func NewService(omniState state.State, logger *zap.Logger) *Service {
+	return &Service{
+		omniState:      omniState,
+		logger:         logger,
+		recordToNodeID: make(map[record]string),
+		nodeIDToInfo:   make(map[string]Info),
+	}
+}
+
+// Start starts the DNS service.
+func (d *Service) Start(ctx context.Context) error {
+	ch := make(chan state.Event)
+
+	if err := d.omniState.WatchKind(ctx,
+		omni.NewClusterMachineIdentity(resources.DefaultNamespace, "").Metadata(), ch,
+		state.WithBootstrapContents(true),
+	); err != nil {
+		return err
+	}
+
+	if err := d.omniState.WatchKind(ctx,
+		omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, "").Metadata(), ch,
+		state.WithBootstrapContents(true),
+	); err != nil {
+		return err
+	}
+
+	for {
+		select {
+		case <-ctx.Done():
+			if errors.Is(ctx.Err(), context.Canceled) {
+				d.logger.Debug("stopping DNS service")
+
+				return nil
+			}
+
+			return fmt.Errorf("dns service context error: %w", ctx.Err())
+		case ev := <-ch:
+			switch ev.Type {
+			case state.Errored:
+				return fmt.Errorf("dns service received an error event: %w", ev.Error)
+			case state.Bootstrapped:
+				// ignore
+			case state.Destroyed:
+				if ev.Resource == nil {
+					d.logger.Warn("dns service received a destroyed event without a resource")
+
+					continue
+				}
+
+				if _, ok := ev.Resource.(*omni.ClusterMachineIdentity); ok {
+					d.deleteByID(ev.Resource.Metadata().ID())
+				}
+			case state.Created, state.Updated:
+				switch r := ev.Resource.(type) {
+				case *omni.ClusterMachineIdentity:
+					d.updateEntryByIdentity(r)
+				case *omni.ClusterMachineConfigStatus:
+					d.updateEntryByConfigStatus(r)
+				default:
+					d.logger.Warn(
+						"dns service received an event with an unexpected resource type",
+						zap.String("type", fmt.Sprintf("%T", r)),
+					)
+
+					continue
+				}
+			}
+		}
+	}
+}
+
+func (d *Service) updateEntryByIdentity(res *omni.ClusterMachineIdentity) {
+	nodeName := res.TypedSpec().Value.Nodename
+	if nodeName == "" {
+		d.logger.Warn("received cluster machine identity without a node name", zap.String("id", res.Metadata().ID()))
+
+		return
+	}
+
+	clusterName, ok := res.Metadata().Labels().Get(omni.LabelCluster)
+	if !ok {
+		d.logger.Warn("received cluster machine identity without cluster label", zap.String("id", res.Metadata().ID()))
+
+		return
+	}
+
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	// create or update info
+	info := d.nodeIDToInfo[res.Metadata().ID()]
+
+	info.Cluster = clusterName
+	info.ID = res.Metadata().ID()
+	info.Name = nodeName
+
+	previousAddress := info.Address
+
+	nodeIPs := res.TypedSpec().Value.NodeIps
+	if len(nodeIPs) == 0 {
+		info.Address = ""
+	} else {
+		info.Address = nodeIPs[0]
+	}
+
+	d.nodeIDToInfo[res.Metadata().ID()] = info
+
+	// create entry by node name
+	d.recordToNodeID[record{
+		cluster: clusterName,
+		name:    nodeName,
+	}] = res.Metadata().ID()
+
+	// create entry by machine ID
+	d.recordToNodeID[record{
+		cluster: clusterName,
+		name:    res.Metadata().ID(),
+	}] = res.Metadata().ID()
+
+	// create entry by address
+	if info.Address != "" {
+		d.recordToNodeID[record{
+			cluster: clusterName,
+			name:    info.Address,
+		}] = res.Metadata().ID()
+	}
+
+	// cleanup old entry by address
+	if previousAddress != "" && previousAddress != info.Address {
+		delete(d.recordToNodeID, record{
+			cluster: clusterName,
+			name:    previousAddress,
+		})
+	}
+
+	d.logger.Debug(
+		"set node DNS entry",
+		zap.String("id", res.Metadata().ID()),
+		zap.String("cluster", clusterName),
+		zap.String("node_name", nodeName),
+		zap.String("address", info.Address),
+	)
+}
+
+func (d *Service) updateEntryByConfigStatus(res *omni.ClusterMachineConfigStatus) {
+	version := res.TypedSpec().Value.GetTalosVersion()
+	if version == "" {
+		d.logger.Warn("received config status without a Talos version", zap.String("id", res.Metadata().ID()))
+
+		return
+	}
+
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	info := d.nodeIDToInfo[res.Metadata().ID()]
+
+	info.TalosVersion = version
+
+	d.nodeIDToInfo[res.Metadata().ID()] = info
+
+	d.logger.Debug(
+		"set node talos version in DNS entry",
+		zap.String("id", res.Metadata().ID()),
+		zap.String("talos_version", version),
+	)
+}
+
+func (d *Service) deleteByID(id resource.ID) {
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	info, infoOk := d.nodeIDToInfo[id]
+	if infoOk {
+		delete(d.recordToNodeID, record{
+			cluster: info.Cluster,
+			name:    info.ID,
+		})
+		delete(d.recordToNodeID, record{
+			cluster: info.Cluster,
+			name:    info.Name,
+		})
+		delete(d.recordToNodeID, record{
+			cluster: info.Cluster,
+			name:    info.Address,
+		})
+	}
+
+	delete(d.nodeIDToInfo, id)
+
+	d.logger.Debug(
+		"deleted node DNS entry",
+		zap.String("id", id),
+		zap.String("cluster", info.Cluster),
+		zap.String("node_name", info.Name),
+		zap.String("address", info.Address),
+	)
+}
+
+// Resolve returns the dns.Info for the given node name, address or machine UUID.
+func (d *Service) Resolve(clusterName, name string) Info {
+	d.lock.Lock()
+	defer d.lock.Unlock()
+
+	nodeID := d.recordToNodeID[record{
+		cluster: clusterName,
+		name:    name,
+	}]
+
+	return d.nodeIDToInfo[nodeID]
+}
diff --git a/internal/backend/dns/service_test.go b/internal/backend/dns/service_test.go
new file mode 100644
index 000000000..76dcb930f
--- /dev/null
+++ b/internal/backend/dns/service_test.go
@@ -0,0 +1,162 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package dns_test
+
+import (
+	"context"
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/dns"
+)
+
+const cluster = "test-cluster-1"
+
+type ServiceSuite struct {
+	suite.Suite
+	state state.State
+
+	dnsService *dns.Service
+	logger     *zap.Logger
+
+	ctx       context.Context //nolint:containedctx
+	ctxCancel context.CancelFunc
+
+	eg errgroup.Group
+}
+
+func (suite *ServiceSuite) SetupTest() {
+	suite.ctx, suite.ctxCancel = context.WithTimeout(context.Background(), 3*time.Minute)
+
+	suite.state = state.WrapCore(namespaced.NewState(inmem.Build))
+
+	suite.logger = zaptest.NewLogger(suite.T(), zaptest.WrapOptions(zap.AddCaller()))
+
+	suite.dnsService = dns.NewService(suite.state, suite.logger)
+
+	// create a ClusterMachineIdentity before starting the DNS service to make sure it picks the existing records
+	bootstrapIdentity := omni.NewClusterMachineIdentity(resources.DefaultNamespace, "test-bootstrap-1")
+	bootstrapIdentity.Metadata().Labels().Set(omni.LabelCluster, "test-bootstrap-cluster-1")
+
+	bootstrapIdentity.TypedSpec().Value.Nodename = "test-bootstrap-1-node"
+	bootstrapIdentity.TypedSpec().Value.NodeIps = []string{"10.0.0.84"}
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, bootstrapIdentity))
+
+	suite.eg.Go(func() error {
+		return suite.dnsService.Start(suite.ctx)
+	})
+}
+
+func (suite *ServiceSuite) TearDownTest() {
+	suite.logger.Info("tear down")
+
+	suite.ctxCancel()
+
+	suite.Require().NoError(suite.eg.Wait())
+}
+
+func (suite *ServiceSuite) TestResolve() {
+	suite.assertResolveAddress("test-bootstrap-cluster-1", "test-bootstrap-1-node", "10.0.0.84")
+
+	identity := omni.NewClusterMachineIdentity(resources.DefaultNamespace, "test-1")
+	identity.Metadata().Labels().Set(omni.LabelCluster, "test-cluster-1")
+
+	identity.TypedSpec().Value.Nodename = "test-1-node"
+	identity.TypedSpec().Value.NodeIps = []string{"10.0.0.42"}
+
+	// create and assert that it resolves by machine ID, address and node name
+	suite.Require().NoError(suite.state.Create(suite.ctx, identity))
+
+	expected := dns.Info{
+		Cluster: cluster,
+		ID:      "test-1",
+		Name:    "test-1-node",
+		Address: "10.0.0.42",
+	}
+	suite.assertResolve("test-1", expected)
+	suite.assertResolve("test-1-node", expected)
+	suite.assertResolve("10.0.0.42", expected)
+
+	// update address, assert that it resolves with new address and old address doesn't resolve anymore
+	identity.TypedSpec().Value.NodeIps = []string{"10.0.0.43"}
+
+	suite.Require().NoError(suite.state.Update(suite.ctx, identity))
+
+	expected = dns.Info{
+		Cluster: cluster,
+		ID:      "test-1",
+		Name:    "test-1-node",
+		Address: "10.0.0.43",
+	}
+
+	suite.assertResolve("test-1", expected)
+	suite.assertResolve("test-1-node", expected)
+	suite.assertResolve("10.0.0.43", expected)
+
+	var zeroInfo dns.Info
+
+	suite.assertResolve("10.0.0.42", zeroInfo)
+
+	// update Talos version, assert that it resolves
+	configStatus := omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, "test-1")
+	configStatus.TypedSpec().Value.TalosVersion = "1.4.1"
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, configStatus))
+
+	expected.TalosVersion = "1.4.1"
+
+	suite.assertResolve("test-1", expected)
+
+	// destroy the identity, assert that it doesn't resolve anymore
+	suite.Require().NoError(suite.state.Destroy(suite.ctx, identity.Metadata()))
+
+	suite.assertResolve("test-1", zeroInfo)
+	suite.assertResolve("test-1-node", zeroInfo)
+	suite.assertResolve("10.0.0.42", zeroInfo)
+}
+
+func (suite *ServiceSuite) assertResolveAddress(cluster, node, expected string) {
+	err := retry.Constant(3*time.Second, retry.WithUnits(100*time.Millisecond)).RetryWithContext(suite.ctx, func(context.Context) error {
+		resolved := suite.dnsService.Resolve(cluster, node)
+
+		if resolved.Address != expected {
+			return retry.ExpectedErrorf("expected %s, got %s", expected, resolved)
+		}
+
+		return nil
+	})
+	suite.Assert().NoError(err)
+}
+
+func (suite *ServiceSuite) assertResolve(node string, expected dns.Info) {
+	err := retry.Constant(3*time.Second, retry.WithUnits(100*time.Millisecond)).RetryWithContext(suite.ctx, func(context.Context) error {
+		resolved := suite.dnsService.Resolve(cluster, node)
+
+		if !reflect.DeepEqual(resolved, expected) {
+			return retry.ExpectedErrorf("expected %#v, got %#v", expected, resolved)
+		}
+
+		return nil
+	})
+	suite.Assert().NoError(err)
+}
+
+func TestServiceSuite(t *testing.T) {
+	suite.Run(t, new(ServiceSuite))
+}
diff --git a/internal/backend/factory/export_test.go b/internal/backend/factory/export_test.go
new file mode 100644
index 000000000..89db7f101
--- /dev/null
+++ b/internal/backend/factory/export_test.go
@@ -0,0 +1,8 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package factory
+
+var ParseRequest = parseRequest
diff --git a/internal/backend/factory/factory.go b/internal/backend/factory/factory.go
new file mode 100644
index 000000000..066f6d106
--- /dev/null
+++ b/internal/backend/factory/factory.go
@@ -0,0 +1,201 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package factory provides the code to call Talos image factory.
+package factory
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+// Handler of image requests.
+type Handler struct {
+	State  state.State
+	Logger *zap.Logger
+}
+
+func setContentHeaders(w http.ResponseWriter, contentType, filename string) {
+	w.Header().Set("Content-Type", contentType)
+	w.Header().Set("Content-Disposition", "attachment; filename="+filename)
+	w.Header().Set("Access-Control-Expose-Headers", "Content-Disposition")
+}
+
+func httpNotFound(w http.ResponseWriter) {
+	http.Error(w, "Not found", http.StatusNotFound)
+}
+
+func (handler *Handler) handleError(msg string, w http.ResponseWriter, err error) {
+	handler.Logger.Error(msg, zap.Error(err))
+
+	switch status.Code(err) { //nolint:exhaustive
+	case codes.Unauthenticated:
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+	case codes.PermissionDenied:
+		http.Error(w, "Permission denied", http.StatusForbidden)
+	default:
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+	}
+}
+
+// ServeHTTP handles image requests.
+func (handler *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	io.Copy(io.Discard, r.Body) //nolint:errcheck
+	r.Body.Close()              //nolint:errcheck
+
+	switch r.Method {
+	case http.MethodGet, http.MethodHead:
+		// supported
+	default:
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+
+		return
+	}
+
+	params, err := parseRequest(r, handler.State)
+	if err != nil {
+		if errors.Is(err, errNotFound) {
+			httpNotFound(w)
+
+			return
+		}
+
+		handler.handleError("failed to parse request", w, err)
+
+		return
+	}
+
+	handler.Logger.Info("proxy request", zap.String("url", params.ProxyURL))
+
+	proxyReq, err := http.NewRequestWithContext(r.Context(), r.Method, params.ProxyURL, nil)
+	if err != nil {
+		handler.handleError("failed to call image factory", w, err)
+
+		return
+	}
+
+	setContentHeaders(w, params.ContentType, params.DestinationFilename)
+
+	for name, values := range r.Header {
+		for _, value := range values {
+			proxyReq.Header.Add(name, value)
+		}
+	}
+
+	client := http.Client{}
+
+	resp, err := client.Do(proxyReq)
+	if err != nil {
+		handler.handleError("failed to call image factory", w, err)
+
+		return
+	}
+
+	defer resp.Body.Close() //nolint:errcheck
+
+	for name, values := range resp.Header {
+		// ignore content disposition header from the image factory
+		// as we override it here
+		if name == "Content-Disposition" {
+			continue
+		}
+
+		for _, value := range values {
+			w.Header().Add(name, value)
+		}
+	}
+
+	w.WriteHeader(resp.StatusCode)
+
+	io.Copy(w, resp.Body) //nolint:errcheck
+}
+
+var errNotFound = errors.New("not found")
+
+// ProxyParams is exposed for the unit tests.
+type ProxyParams struct {
+	ProxyURL            string
+	ContentType         string
+	DestinationFilename string
+}
+
+func parseRequest(r *http.Request, st state.State) (*ProxyParams, error) {
+	segments := strings.Split(strings.Trim(r.URL.Path, "/"), "/")
+
+	if len(segments) < 4 {
+		return nil, errNotFound
+	}
+
+	if segments[0] != "image" {
+		return nil, errNotFound
+	}
+
+	ctx := r.Context()
+
+	media, err := safe.ReaderGet[*omni.InstallationMedia](ctx, st, resource.NewMetadata(
+		resources.EphemeralNamespace, omni.InstallationMediaType, segments[3], resource.VersionUndefined,
+	))
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, errNotFound
+		}
+
+		return nil, err
+	}
+
+	secureBoot := r.URL.Query().Get(constants.SecureBoot) == "true"
+
+	srcFilename := segments[2]
+
+	if secureBoot {
+		srcFilename += "-secureboot"
+	}
+
+	p := &ProxyParams{
+		ContentType:         media.TypedSpec().Value.ContentType,
+		DestinationFilename: fmt.Sprintf("%s-%s.%s", media.TypedSpec().Value.DestFilePrefix, srcFilename, media.TypedSpec().Value.Extension),
+	}
+
+	proxyURL, err := url.Parse(config.Config.ImageFactoryBaseURL)
+	if err != nil {
+		return nil, err
+	}
+
+	// filename is the last part of the proxy URL which is parsed by the image factory
+	// so it should have the appropriate format
+	filename := media.TypedSpec().Value.SrcFilePrefix
+
+	if secureBoot {
+		filename += "-secureboot"
+	}
+
+	filename += "." + media.TypedSpec().Value.Extension
+
+	// strip the last element from the URL
+	// replace it with the generated filename
+	segments = append(segments[:3], filename)
+
+	proxyURL = proxyURL.JoinPath(segments...)
+
+	p.ProxyURL = proxyURL.String()
+
+	return p, nil
+}
diff --git a/internal/backend/factory/factory_test.go b/internal/backend/factory/factory_test.go
new file mode 100644
index 000000000..502d468f2
--- /dev/null
+++ b/internal/backend/factory/factory_test.go
@@ -0,0 +1,106 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package factory_test
+
+import (
+	"context"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/factory"
+)
+
+func TestParseRequest(t *testing.T) {
+	state := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	specs := map[string]*specs.InstallationMediaSpec{
+		"iso-metal-arm64": {
+			Name:           "ISO",
+			Architecture:   "arm64",
+			Profile:        "iso",
+			ContentType:    "application/x-iso",
+			SrcFilePrefix:  "metal-arm64",
+			DestFilePrefix: "omni-metal-arm64",
+			Extension:      "iso",
+		},
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+
+	for id, spec := range specs {
+		res := omni.NewInstallationMedia(resources.EphemeralNamespace, id)
+		res.TypedSpec().Value = spec
+
+		require.NoError(t, state.Create(ctx, res))
+	}
+
+	for _, tt := range []struct {
+		expectedParams *factory.ProxyParams
+		name           string
+		incomingURL    string
+		shouldFail     bool
+	}{
+		{
+			name:        "with secureboot",
+			incomingURL: "/image/schematic/1.6.0/iso-metal-arm64?secureboot=true",
+			expectedParams: &factory.ProxyParams{
+				ProxyURL:            "https://factory.talos.dev/image/schematic/1.6.0/metal-arm64-secureboot.iso",
+				ContentType:         "application/x-iso",
+				DestinationFilename: "omni-metal-arm64-1.6.0-secureboot.iso",
+			},
+		},
+		{
+			name:        "without secureboot",
+			incomingURL: "/image/schematic/1.6.0/iso-metal-arm64",
+			expectedParams: &factory.ProxyParams{
+				ProxyURL:            "https://factory.talos.dev/image/schematic/1.6.0/metal-arm64.iso",
+				ContentType:         "application/x-iso",
+				DestinationFilename: "omni-metal-arm64-1.6.0.iso",
+			},
+		},
+		{
+			name:        "not found: incomplete path",
+			incomingURL: "/image/schematic/",
+			shouldFail:  true,
+		},
+		{
+			name:        "not found: no /image prefix",
+			incomingURL: "/unknown",
+			shouldFail:  true,
+		},
+		{
+			name:        "not found: no such image",
+			incomingURL: "/image/schematic/1.6.0/the-image",
+			shouldFail:  true,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			require := require.New(t)
+
+			request, err := http.NewRequestWithContext(ctx, http.MethodHead, "https://localhost"+tt.incomingURL, nil)
+			require.NoError(err)
+
+			params, err := factory.ParseRequest(request, state)
+			if tt.shouldFail {
+				require.Error(err)
+
+				return
+			}
+
+			require.EqualValues(tt.expectedParams, params)
+		})
+	}
+}
diff --git a/internal/backend/grpc/auth.go b/internal/backend/grpc/auth.go
new file mode 100644
index 000000000..00f847994
--- /dev/null
+++ b/internal/backend/grpc/auth.go
@@ -0,0 +1,286 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package grpc
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	gateway "github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	authpb "github.com/siderolabs/go-api-signature/api/auth"
+	"github.com/siderolabs/go-pointer"
+	"go.uber.org/zap"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	authres "github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+const (
+	loginPath = "/omni/authenticate"
+
+	// tsgen:authPublicKeyIDQueryParam
+	publicKeyIDQueryParam = "public-key-id"
+
+	awaitPublicKeyConfirmationTimeout = 5 * time.Minute
+)
+
+type authServer struct {
+	authpb.UnimplementedAuthServiceServer
+
+	state  state.State
+	logger *zap.Logger
+}
+
+func (s *authServer) register(server grpc.ServiceRegistrar) {
+	authpb.RegisterAuthServiceServer(server, s)
+}
+
+func (s *authServer) gateway(ctx context.Context, mux *gateway.ServeMux, address string, opts []grpc.DialOption) error {
+	return authpb.RegisterAuthServiceHandlerFromEndpoint(ctx, mux, address, opts)
+}
+
+// RegisterPublicKey registers a public key for the given identity.
+// The registered key will be unconfirmed, and a login page URL will be returned.
+func (s *authServer) RegisterPublicKey(ctx context.Context, request *authpb.RegisterPublicKeyRequest) (*authpb.RegisterPublicKeyResponse, error) {
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	email := strings.ToLower(request.GetIdentity().GetEmail())
+
+	pubKey, err := validatePublicKey(request.GetPublicKey())
+	if err != nil {
+		return nil, err
+	}
+
+	loginURL, err := s.buildLoginURL(pubKey.id)
+	if err != nil {
+		return nil, err
+	}
+
+	result := &authpb.RegisterPublicKeyResponse{
+		PublicKeyId: pubKey.id,
+		LoginUrl:    loginURL,
+	}
+
+	identity, err := safe.StateGet[*authres.Identity](ctx, s.state, authres.NewIdentity(resources.DefaultNamespace, email).Metadata())
+	if state.IsNotFoundError(err) {
+		s.logger.Error("public key not registered, identity not found",
+			zap.String("email", email),
+			zap.String("fingerprint", pubKey.id),
+		)
+
+		// we do not fail explicitly to prevent user enumeration
+		return result, nil
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	userID := identity.TypedSpec().Value.GetUserId()
+
+	roleStr := request.GetRole()
+
+	// if skipUserRole is false, we use the role of the user
+	if !request.GetSkipUserRole() {
+		var user *authres.User
+
+		user, err = safe.StateGet[*authres.User](ctx, s.state, authres.NewUser(resources.DefaultNamespace, userID).Metadata())
+		if state.IsNotFoundError(err) {
+			s.logger.Error("public key not registered, user not found",
+				zap.String("email", email),
+				zap.String("user_id", userID),
+				zap.String("fingerprint", pubKey.id),
+			)
+
+			// we do not fail explicitly to prevent user enumeration
+			return result, nil
+		}
+
+		if err != nil {
+			return nil, err
+		}
+
+		roleStr = user.TypedSpec().Value.Role
+	}
+
+	pubKeyRole, err := role.Parse(roleStr)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse role for public key: %w", err)
+	}
+
+	setPubKeyAttributes := func(k *authres.PublicKey) {
+		k.Metadata().Labels().Set(authres.LabelPublicKeyUserID, userID)
+
+		k.TypedSpec().Value.Confirmed = false
+		k.TypedSpec().Value.PublicKey = pubKey.data
+		k.TypedSpec().Value.Expiration = timestamppb.New(pubKey.expiration)
+		k.TypedSpec().Value.Role = string(pubKeyRole)
+		k.TypedSpec().Value.Identity = &specs.Identity{
+			Email: email,
+		}
+	}
+
+	newPubKey := authres.NewPublicKey(resources.DefaultNamespace, pubKey.id)
+
+	_, err = safe.StateGet[*authres.PublicKey](ctx, s.state, newPubKey.Metadata())
+	if state.IsNotFoundError(err) {
+		setPubKeyAttributes(newPubKey)
+
+		err = s.state.Create(ctx, newPubKey, state.WithCreateOwner(pointer.To(omni.KeyPrunerController{}).Name()))
+		if err != nil {
+			return nil, err
+		}
+
+		s.logger.Info("new public key registered",
+			zap.String("email", email),
+			zap.String("fingerprint", pubKey.id),
+			zap.Time("expiration", pubKey.expiration),
+			zap.String("role", newPubKey.TypedSpec().Value.GetRole()),
+		)
+
+		return result, nil
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	// it already exists, do nothing
+
+	return result, nil
+}
+
+// AwaitPublicKeyConfirmation waits until the public key with the given information is confirmed.
+func (s *authServer) AwaitPublicKeyConfirmation(ctx context.Context, request *authpb.AwaitPublicKeyConfirmationRequest) (*emptypb.Empty, error) {
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	ctx, cancel := context.WithTimeout(ctx, awaitPublicKeyConfirmationTimeout)
+	defer cancel()
+
+	pubKey := authres.NewPublicKey(resources.DefaultNamespace, request.GetPublicKeyId())
+
+	_, err := s.state.WatchFor(ctx, pubKey.Metadata(),
+		state.WithEventTypes(state.Created, state.Updated),
+		state.WithCondition(func(r resource.Resource) (bool, error) {
+			pubKeyResource, ok := r.(*authres.PublicKey)
+			if !ok {
+				return false, errors.New("resource is not a PublicKey")
+			}
+
+			return pubKeyResource.TypedSpec().Value.GetConfirmed(), nil
+		}))
+	if err != nil {
+		return nil, err
+	}
+
+	return &emptypb.Empty{}, nil
+}
+
+// ConfirmPublicKey confirms the public key with the given ID.
+// It uses the ID token in the request metadata to validate the user identity.
+func (s *authServer) ConfirmPublicKey(ctx context.Context, request *authpb.ConfirmPublicKeyRequest) (*emptypb.Empty, error) {
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	email, err := verifiedEmail(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	if request.GetPublicKeyId() == "" {
+		return nil, status.Error(codes.InvalidArgument, "public key id is required")
+	}
+
+	identity, err := safe.StateGet[*authres.Identity](ctx, s.state, authres.NewIdentity(resources.DefaultNamespace, email).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, status.Errorf(codes.PermissionDenied, "The identity %q is not authorized to this instance", email)
+		}
+
+		return nil, err
+	}
+
+	pubKey, err := safe.StateGet[*authres.PublicKey](ctx, s.state, authres.NewPublicKey(resources.DefaultNamespace, request.GetPublicKeyId()).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, status.Error(codes.PermissionDenied, "permission denied")
+		}
+
+		return nil, err
+	}
+
+	userID := identity.TypedSpec().Value.UserId
+
+	existingUserID, ok := pubKey.Metadata().Labels().Get(authres.LabelPublicKeyUserID)
+	if !ok || existingUserID != userID {
+		return nil, errors.New("public key <> id mismatch")
+	}
+
+	_, err = safe.StateUpdateWithConflicts(ctx, s.state, pubKey.Metadata(), func(pk *authres.PublicKey) error {
+		pk.TypedSpec().Value.Confirmed = true
+
+		return nil
+	}, state.WithUpdateOwner(pointer.To(omni.KeyPrunerController{}).Name()))
+	if err != nil {
+		return nil, err
+	}
+
+	s.logger.Info("public key confirmed",
+		zap.String("email", email),
+		zap.String("fingerprint", pubKey.Metadata().ID()),
+		zap.Time("expiration", pubKey.TypedSpec().Value.GetExpiration().AsTime()),
+		zap.String("role", pubKey.TypedSpec().Value.GetRole()),
+	)
+
+	return &emptypb.Empty{}, nil
+}
+
+func verifiedEmail(ctx context.Context) (string, error) {
+	if email := debugEmail(ctx); email != "" {
+		return email, nil
+	}
+
+	authCheckResult, err := auth.Check(ctx, auth.WithVerifiedEmail())
+	if err != nil {
+		return "", err
+	}
+
+	return authCheckResult.VerifiedEmail, nil
+}
+
+func (s *authServer) buildLoginURL(pgpKeyID string) (string, error) {
+	loginURL, err := url.Parse(config.Config.APIURL)
+	if err != nil {
+		return "", err
+	}
+
+	loginURL.Path = loginPath
+
+	query := loginURL.Query()
+	query.Set(publicKeyIDQueryParam, pgpKeyID)
+	query.Set(auth.FlowQueryParam, auth.CLIAuthFlow)
+
+	loginURL.RawQuery = query.Encode()
+
+	return loginURL.String(), nil
+}
diff --git a/internal/backend/grpc/auth_debug.go b/internal/backend/grpc/auth_debug.go
new file mode 100644
index 000000000..3bac3003d
--- /dev/null
+++ b/internal/backend/grpc/auth_debug.go
@@ -0,0 +1,33 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//go:build sidero.debug
+
+package grpc
+
+import (
+	"context"
+
+	"google.golang.org/grpc/metadata"
+)
+
+// DebugVerifiedEmailHeaderKey is the metadata key that allows specifying a verified email in debug builds.
+//
+// When this key is found in the metadata, JWT validation is skipped and the email is taken as the truth.
+const DebugVerifiedEmailHeaderKey = "x-sidero-debug-verified-email"
+
+func debugEmail(ctx context.Context) string {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return ""
+	}
+
+	emails := md.Get(DebugVerifiedEmailHeaderKey)
+	if len(emails) == 0 {
+		return ""
+	}
+
+	return emails[0]
+}
diff --git a/internal/backend/grpc/auth_no_debug.go b/internal/backend/grpc/auth_no_debug.go
new file mode 100644
index 000000000..ff421b4ec
--- /dev/null
+++ b/internal/backend/grpc/auth_no_debug.go
@@ -0,0 +1,14 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//go:build !sidero.debug
+
+package grpc
+
+import "context"
+
+func debugEmail(context.Context) string {
+	return ""
+}
diff --git a/internal/backend/grpc/cosi.go b/internal/backend/grpc/cosi.go
new file mode 100644
index 000000000..ae750b49d
--- /dev/null
+++ b/internal/backend/grpc/cosi.go
@@ -0,0 +1,29 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package grpc
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/api/v1alpha1"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/protobuf/server"
+	gateway "github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"google.golang.org/grpc"
+)
+
+// COSIResourceServer implements installation of COSI resource API server.
+type COSIResourceServer struct {
+	State state.State
+}
+
+func (s *COSIResourceServer) register(srv grpc.ServiceRegistrar) {
+	v1alpha1.RegisterStateServer(srv, server.NewState(s.State))
+}
+
+func (s *COSIResourceServer) gateway(ctx context.Context, mux *gateway.ServeMux, address string, opts []grpc.DialOption) error {
+	return v1alpha1.RegisterStateHandlerFromEndpoint(ctx, mux, address, opts)
+}
diff --git a/internal/backend/grpc/export_test.go b/internal/backend/grpc/export_test.go
new file mode 100644
index 000000000..787d8fa86
--- /dev/null
+++ b/internal/backend/grpc/export_test.go
@@ -0,0 +1,23 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package grpc
+
+import (
+	"github.com/cosi-project/runtime/pkg/state"
+)
+
+type ManagementServer = managementServer
+
+//nolint:revive
+func NewManagementServer(st state.State) *ManagementServer {
+	return &ManagementServer{
+		omniState: st,
+	}
+}
+
+func GenerateDest(apiurl string) (string, error) {
+	return generateDest(apiurl)
+}
diff --git a/internal/backend/grpc/grpc.go b/internal/backend/grpc/grpc.go
new file mode 100644
index 000000000..7f70d8a84
--- /dev/null
+++ b/internal/backend/grpc/grpc.go
@@ -0,0 +1,127 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package grpc implements gRPC server.
+package grpc
+
+import (
+	"compress/gzip"
+	"context"
+	"fmt"
+	"math"
+	"net"
+	"net/http"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	gateway "github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/prometheus/client_golang/prometheus"
+	"go.uber.org/zap"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/protobuf/encoding/protojson"
+
+	"github.com/siderolabs/omni/client/api/talos/machine"
+	"github.com/siderolabs/omni/internal/backend/logging"
+	"github.com/siderolabs/omni/internal/backend/monitoring"
+	"github.com/siderolabs/omni/internal/memconn"
+	"github.com/siderolabs/omni/internal/pkg/compress"
+	"github.com/siderolabs/omni/internal/pkg/config"
+	"github.com/siderolabs/omni/internal/pkg/siderolink"
+)
+
+// ServiceServer is a gRPC service server.
+type ServiceServer interface {
+	register(grpc.ServiceRegistrar)
+	gateway(context.Context, *gateway.ServeMux, string, []grpc.DialOption) error
+}
+
+// MakeServiceServers creates a list of service servers.
+func MakeServiceServers(
+	state state.State,
+	logHandler *siderolink.LogHandler,
+	oidcProvider OIDCProvider,
+	jwtSigningKeyProvider JWTSigningKeyProvider,
+	logger *zap.Logger,
+) ([]ServiceServer, error) {
+	dest, err := generateDest(config.Config.APIURL)
+	if err != nil {
+		return nil, err
+	}
+
+	return []ServiceServer{
+		&ResourceServer{},
+		&oidcServer{
+			provider: oidcProvider,
+		},
+		&managementServer{
+			logHandler:            logHandler,
+			omniconfigDest:        dest,
+			omniState:             state,
+			jwtSigningKeyProvider: jwtSigningKeyProvider,
+			logger:                logger.With(logging.Component("management_server")),
+		},
+		&authServer{
+			state:  state,
+			logger: logger.With(logging.Component("auth_server")),
+		},
+		&COSIResourceServer{
+			State: state,
+		},
+	}, nil
+}
+
+// New creates new grpc server and registers all routes.
+func New(ctx context.Context, mux *http.ServeMux, servers []ServiceServer, transport *memconn.Transport, logger *zap.Logger, options ...grpc.ServerOption) (*grpc.Server, error) {
+	server := grpc.NewServer(options...)
+
+	for _, srv := range servers {
+		srv.register(server)
+	}
+
+	marshaller := &gateway.JSONPb{
+		MarshalOptions: protojson.MarshalOptions{
+			UseProtoNames:  true,
+			UseEnumNumbers: true,
+		},
+	}
+	runtimeMux := gateway.NewServeMux(
+		gateway.WithMarshalerOption(gateway.MIMEWildcard, marshaller),
+	)
+	opts := []grpc.DialOption{
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		// we are proxying requests to ourselves, so we don't need to impose a limit
+		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(math.MaxInt32)),
+		grpc.WithContextDialer(func(context.Context, string) (net.Conn, error) {
+			return transport.Dial()
+		}),
+		grpc.WithSharedWriteBuffer(true),
+	}
+
+	for _, srv := range servers {
+		err := srv.gateway(ctx, runtimeMux, transport.Address, opts)
+		if err != nil {
+			return nil, fmt.Errorf("error registering gateway: %w", err)
+		}
+	}
+
+	if err := machine.RegisterMachineServiceHandlerFromEndpoint(ctx, runtimeMux, transport.Address, opts); err != nil {
+		return nil, fmt.Errorf("error registering gateway: %w", err)
+	}
+
+	mux.Handle("/api/",
+		compress.Handler(
+			monitoring.NewHandler(
+				logging.NewHandler(
+					http.StripPrefix("/api", runtimeMux),
+					logger.With(zap.String("handler", "grpc_gateway")),
+				),
+				prometheus.Labels{"handler": "grpc_gateway"},
+			),
+			gzip.DefaultCompression,
+		),
+	)
+
+	return server, nil
+}
diff --git a/internal/backend/grpc/grpc_test.go b/internal/backend/grpc/grpc_test.go
new file mode 100644
index 000000000..a68c56584
--- /dev/null
+++ b/internal/backend/grpc/grpc_test.go
@@ -0,0 +1,303 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package grpc_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/api/v1alpha1"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/zap/zaptest"
+	"golang.org/x/sync/errgroup"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/siderolabs/omni/client/api/common"
+	"github.com/siderolabs/omni/client/api/omni/management"
+	resapi "github.com/siderolabs/omni/client/api/omni/resources"
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/dns"
+	grpcomni "github.com/siderolabs/omni/internal/backend/grpc"
+	"github.com/siderolabs/omni/internal/backend/logging"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	omniruntime "github.com/siderolabs/omni/internal/backend/runtime/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+	"github.com/siderolabs/omni/internal/backend/workloadproxy"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/auth/interceptor"
+)
+
+type GrpcSuite struct {
+	suite.Suite
+	runtime *omniruntime.Runtime
+	server  *grpc.Server
+	conn    *grpc.ClientConn
+	state   state.State
+	eg      errgroup.Group
+
+	ctx        context.Context //nolint:containedctx
+	ctxCancel  context.CancelFunc
+	socketPath string
+}
+
+func (suite *GrpcSuite) SetupTest() {
+	suite.ctx, suite.ctxCancel = context.WithTimeout(context.Background(), 3*time.Minute)
+
+	var err error
+
+	suite.state = state.WrapCore(namespaced.NewState(inmem.Build))
+
+	logger := zaptest.NewLogger(suite.T())
+
+	clientFactory := talos.NewClientFactory(suite.state, logger)
+
+	dnsService := dns.NewService(suite.state, logger)
+
+	workloadProxyServiceRegistry, err := workloadproxy.NewServiceRegistry(suite.state, logger)
+	suite.Require().NoError(err)
+
+	suite.runtime, err = omniruntime.New(clientFactory, dnsService, workloadProxyServiceRegistry, nil,
+		nil, suite.state, nil, prometheus.NewRegistry(), logger)
+	suite.Require().NoError(err)
+	runtime.Install(omniruntime.Name, suite.runtime)
+
+	suite.Require().NoError(err)
+
+	suite.startRuntime()
+
+	authConfigInterceptor := interceptor.NewAuthConfig(false, logger.With(logging.Component("interceptor")))
+
+	err = suite.newServer(
+		grpc.ChainUnaryInterceptor(authConfigInterceptor.Unary()),
+		grpc.ChainStreamInterceptor(authConfigInterceptor.Stream()),
+	)
+	suite.Require().NoError(err)
+}
+
+func (suite *GrpcSuite) startRuntime() {
+	suite.runtime.Run(actor.MarkContextAsInternalActor(suite.ctx), &suite.eg)
+}
+
+func (suite *GrpcSuite) TestGetDenied() {
+	client := resapi.NewResourceServiceClient(suite.conn)
+
+	ctx := metadata.AppendToOutgoingContext(suite.ctx, "runtime", common.Runtime_Omni.String())
+	_, err := client.Get(ctx, &resapi.GetRequest{
+		Id:        "1",
+		Type:      omni.ClusterMachineConfigType,
+		Namespace: resources.DefaultNamespace,
+	})
+	suite.Require().Error(err)
+	suite.Assert().Equal(codes.PermissionDenied, status.Code(err))
+}
+
+func (suite *GrpcSuite) TestCreateDenied() {
+	client := resapi.NewResourceServiceClient(suite.conn)
+
+	rawSpec, err := runtime.MarshalJSON(&specs.ClusterStatusSpec{})
+	suite.Assert().NoError(err)
+
+	md := &v1alpha1.Metadata{
+		Id:        "1",
+		Type:      omni.ClusterStatusType,
+		Namespace: resources.DefaultNamespace,
+		Version:   resource.VersionUndefined.String(),
+		Phase:     "running",
+	}
+
+	ctx := metadata.AppendToOutgoingContext(suite.ctx, "runtime", common.Runtime_Omni.String())
+	_, err = client.Create(ctx, &resapi.CreateRequest{
+		Resource: &resapi.Resource{
+			Metadata: md,
+			Spec:     rawSpec,
+		},
+	})
+
+	suite.Require().Error(err)
+	suite.Assert().Equal(codes.PermissionDenied, status.Code(err))
+}
+
+func (suite *GrpcSuite) TestCrud() {
+	client := resapi.NewResourceServiceClient(suite.conn)
+
+	resourceSpec := &specs.ConfigPatchSpec{
+		Data: strings.TrimSpace(`
+{
+  "machine": {
+    "env": {
+      "bla": "bla"
+    }
+  }
+}
+`),
+	}
+
+	rawSpec, err := runtime.MarshalJSON(resourceSpec)
+	suite.Assert().NoError(err)
+
+	md := &v1alpha1.Metadata{
+		Id:        "1",
+		Type:      omni.ConfigPatchType,
+		Namespace: resources.DefaultNamespace,
+		Version:   resource.VersionUndefined.String(),
+		Phase:     "running",
+	}
+
+	ctx := metadata.AppendToOutgoingContext(suite.ctx, "runtime", common.Runtime_Omni.String())
+	_, err = client.Create(ctx, &resapi.CreateRequest{
+		Resource: &resapi.Resource{
+			Metadata: md,
+			Spec:     rawSpec,
+		},
+	})
+
+	suite.Require().NoError(err)
+
+	metadata, err := resource.NewMetadataFromProto(md)
+	suite.Assert().NoError(err)
+
+	res, err := safe.StateGet[*omni.ConfigPatch](ctx, suite.state, metadata)
+	suite.Assert().NoError(err)
+
+	suite.Require().True(proto.Equal(res.TypedSpec().Value, resourceSpec))
+
+	resourceSpec = &specs.ConfigPatchSpec{
+		Data: "machine: {}",
+	}
+
+	rawSpec, err = runtime.MarshalJSON(resourceSpec)
+	suite.Assert().NoError(err)
+
+	_, err = client.Update(ctx, &resapi.UpdateRequest{
+		CurrentVersion: res.Metadata().Version().String(),
+		Resource: &resapi.Resource{
+			Metadata: md,
+			Spec:     rawSpec,
+		},
+	})
+	suite.Assert().NoError(err)
+
+	res, err = safe.StateGet[*omni.ConfigPatch](ctx, suite.state, metadata)
+	suite.Assert().NoError(err)
+
+	suite.Require().True(proto.Equal(res.TypedSpec().Value, resourceSpec))
+
+	items, err := client.List(ctx, &resapi.ListRequest{
+		Namespace: resources.DefaultNamespace,
+		Type:      omni.ConfigPatchType,
+	})
+
+	suite.Assert().NoError(err)
+
+	for _, item := range items.Items {
+		var data struct {
+			Spec struct {
+				Data string `json:"data"`
+			} `json:"spec"`
+		}
+
+		suite.Assert().NoError(json.Unmarshal([]byte(item), &data))
+		suite.Require().Equal(resourceSpec.Data, data.Spec.Data)
+	}
+
+	_, err = client.Delete(ctx, &resapi.DeleteRequest{
+		Namespace: resources.DefaultNamespace,
+		Type:      omni.ConfigPatchType,
+		Id:        "1",
+	})
+	suite.Require().NoError(err)
+
+	_, err = suite.state.Get(ctx, metadata)
+	suite.Assert().True(state.IsNotFoundError(err))
+}
+
+func (suite *GrpcSuite) TearDownTest() {
+	suite.T().Log("tear down")
+
+	suite.ctxCancel()
+
+	if suite.server != nil {
+		suite.server.Stop()
+	}
+
+	if suite.conn != nil {
+		suite.Require().NoError(suite.conn.Close())
+	}
+
+	suite.Require().NoError(suite.eg.Wait())
+}
+
+func (suite *GrpcSuite) TestConfigValidation() {
+	client := management.NewManagementServiceClient(suite.conn)
+
+	_, err := client.ValidateConfig(suite.ctx, &management.ValidateConfigRequest{
+		Config: `machine:
+				network:
+				  hostname: abcd`,
+	})
+	suite.Require().Error(err)
+	suite.Require().Equalf(codes.InvalidArgument, status.Code(err), err.Error())
+}
+
+func (suite *GrpcSuite) newServer(opts ...grpc.ServerOption) error {
+	var err error
+
+	suite.socketPath = filepath.Join(suite.T().TempDir(), "socket")
+
+	listener, err := net.Listen("unix", suite.socketPath)
+	if err != nil {
+		return err
+	}
+
+	grpcAddress := fmt.Sprintf("unix://%s", suite.socketPath)
+
+	suite.server = grpc.NewServer(opts...)
+
+	resapi.RegisterResourceServiceServer(suite.server, &grpcomni.ResourceServer{})
+	management.RegisterManagementServiceServer(suite.server, grpcomni.NewManagementServer(
+		suite.state,
+	))
+
+	go func() {
+		for {
+			err = suite.server.Serve(listener)
+			if err == nil || errors.Is(err, grpc.ErrServerStopped) {
+				break
+			}
+		}
+	}()
+
+	suite.conn, err = grpc.DialContext(suite.ctx, grpcAddress, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func TestGrpcSuite(t *testing.T) {
+	suite.Run(t, new(GrpcSuite))
+}
diff --git a/internal/backend/grpc/management.go b/internal/backend/grpc/management.go
new file mode 100644
index 000000000..e1854cfcd
--- /dev/null
+++ b/internal/backend/grpc/management.go
@@ -0,0 +1,887 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package grpc
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/url"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/google/uuid"
+	gateway "github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/hashicorp/go-multierror"
+	"github.com/siderolabs/gen/optional"
+	"github.com/siderolabs/go-api-signature/pkg/pgp"
+	"github.com/siderolabs/go-kubernetes/kubernetes/manifests"
+	"github.com/siderolabs/go-kubernetes/kubernetes/upgrade"
+	"github.com/siderolabs/talos/pkg/machinery/api/common"
+	"go.uber.org/zap"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+	"gopkg.in/square/go-jose.v2"
+	"gopkg.in/yaml.v3"
+	"k8s.io/client-go/rest"
+
+	commonOmni "github.com/siderolabs/omni/client/api/common"
+	"github.com/siderolabs/omni/client/api/omni/management"
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	pkgaccess "github.com/siderolabs/omni/client/pkg/access"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	authres "github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	omnires "github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	ctlcfg "github.com/siderolabs/omni/client/pkg/omnictl/config"
+	"github.com/siderolabs/omni/internal/backend/grpc/router"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime/kubernetes"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni"
+	omniCtrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/accesspolicy"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/siderolink"
+)
+
+// JWTSigningKeyProvider is an interface for a JWT signing key provider.
+type JWTSigningKeyProvider interface {
+	GetCurrentSigningKey() (*jose.JSONWebKey, error)
+}
+
+// managementServer implements omni management service.
+type managementServer struct {
+	management.UnimplementedManagementServiceServer
+
+	omniState             state.State
+	jwtSigningKeyProvider JWTSigningKeyProvider
+
+	logHandler     *siderolink.LogHandler
+	logger         *zap.Logger
+	omniconfigDest string
+}
+
+func (s *managementServer) register(server grpc.ServiceRegistrar) {
+	management.RegisterManagementServiceServer(server, s)
+}
+
+func (s *managementServer) gateway(ctx context.Context, mux *gateway.ServeMux, address string, opts []grpc.DialOption) error {
+	return management.RegisterManagementServiceHandlerFromEndpoint(ctx, mux, address, opts)
+}
+
+func (s *managementServer) Kubeconfig(ctx context.Context, req *management.KubeconfigRequest) (*management.KubeconfigResponse, error) {
+	commonContext := router.ExtractContext(ctx)
+
+	clusterName := ""
+	if commonContext != nil {
+		clusterName = commonContext.Name
+	}
+
+	ctx, err := s.applyClusterAccessPolicy(ctx, clusterName)
+	if err != nil {
+		return nil, err
+	}
+
+	if req.GetServiceAccount() {
+		return s.serviceAccountKubeconfig(ctx, req)
+	}
+
+	// not a service account, generate OIDC (user) kubeconfig
+
+	authResult, err := auth.CheckGRPC(ctx, auth.WithRole(role.Reader))
+	if err != nil {
+		return nil, err
+	}
+
+	type oidcRuntime interface {
+		GetOIDCKubeconfig(context *commonOmni.Context, identity string) ([]byte, error)
+	}
+
+	r, err := runtime.LookupInterface[oidcRuntime](kubernetes.Name)
+	if err != nil {
+		return nil, err
+	}
+
+	kubeconfig, err := r.GetOIDCKubeconfig(commonContext, authResult.Identity)
+	if err != nil {
+		return nil, err
+	}
+
+	return &management.KubeconfigResponse{
+		Kubeconfig: kubeconfig,
+	}, nil
+}
+
+func (s *managementServer) Talosconfig(ctx context.Context, request *management.TalosconfigRequest) (*management.TalosconfigResponse, error) {
+	// getting talosconfig is low risk, as it doesn't contain any sensitive data
+	// real check for authentication happens in the Talos API gRPC proxy
+	authResult, err := auth.CheckGRPC(ctx, auth.WithRole(role.Reader))
+	if err != nil {
+		return nil, err
+	}
+
+	// this one is not low-risk, but it works only in debug mode
+	if request.Admin {
+		return s.adminTalosconfig(ctx)
+	}
+
+	type talosRuntime interface {
+		GetTalosconfigRaw(context *commonOmni.Context, identity string) ([]byte, error)
+	}
+
+	t, err := runtime.LookupInterface[talosRuntime](talos.Name)
+	if err != nil {
+		return nil, err
+	}
+
+	talosconfig, err := t.GetTalosconfigRaw(router.ExtractContext(ctx), authResult.Identity)
+	if err != nil {
+		return nil, err
+	}
+
+	return &management.TalosconfigResponse{
+		Talosconfig: talosconfig,
+	}, nil
+}
+
+func (s *managementServer) Omniconfig(ctx context.Context, _ *emptypb.Empty) (*management.OmniconfigResponse, error) {
+	// getting omniconfig is low risk, since it only contains parameters already known by the user
+	authResult, err := auth.CheckGRPC(ctx, auth.WithValidSignature(true))
+	if err != nil {
+		return nil, err
+	}
+
+	cfg, err := generateConfig(authResult, s.omniconfigDest)
+	if err != nil {
+		return nil, err
+	}
+
+	return &management.OmniconfigResponse{
+		Omniconfig: cfg,
+	}, nil
+}
+
+func (s *managementServer) MachineLogs(request *management.MachineLogsRequest, response management.ManagementService_MachineLogsServer) error {
+	// getting machine logs is equivalent to reading machine resource
+	if _, err := auth.CheckGRPC(response.Context(), auth.WithRole(role.Reader)); err != nil {
+		return err
+	}
+
+	machineID := request.GetMachineId()
+	if machineID == "" {
+		return status.Error(codes.InvalidArgument, "machine id is required")
+	}
+
+	tailLines := optional.None[int32]()
+	if request.TailLines >= 0 {
+		tailLines = optional.Some(request.TailLines)
+	}
+
+	logReader, err := s.logHandler.GetReader(siderolink.MachineID(machineID), request.Follow, tailLines)
+	if err != nil {
+		return handleError(err)
+	}
+
+	once := sync.Once{}
+	cancel := func() {
+		once.Do(func() {
+			logReader.Close() //nolint:errcheck
+		})
+	}
+
+	defer cancel()
+
+	go func() {
+		// connection closed, stop reading
+		<-response.Context().Done()
+		cancel()
+	}()
+
+	for {
+		line, err := logReader.ReadLine()
+		if err != nil {
+			return handleError(err)
+		}
+
+		if err := response.Send(&common.Data{
+			Bytes: line,
+		}); err != nil {
+			return err
+		}
+	}
+}
+
+func (s *managementServer) ValidateConfig(ctx context.Context, request *management.ValidateConfigRequest) (*emptypb.Empty, error) {
+	// validating machine config is low risk, require any valid signature
+	if _, err := auth.CheckGRPC(ctx, auth.WithValidSignature(true)); err != nil {
+		return nil, err
+	}
+
+	if err := omnires.ValidateConfigPatch(request.Config); err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
+	return &emptypb.Empty{}, nil
+}
+
+func (s *managementServer) adminTalosconfig(ctx context.Context) (*management.TalosconfigResponse, error) {
+	if !constants.IsDebugBuild {
+		return nil, status.Error(codes.PermissionDenied, "not allowed")
+	}
+
+	routerContext := router.ExtractContext(ctx)
+
+	if routerContext == nil || routerContext.Name == "" {
+		return nil, status.Error(codes.InvalidArgument, "cluster name is required")
+	}
+
+	clusterName := routerContext.Name
+
+	type omniAdmin interface {
+		AdminTalosconfig(ctx context.Context, clusterName string) ([]byte, error)
+	}
+
+	omniRuntime, err := runtime.LookupInterface[omniAdmin](omni.Name)
+	if err != nil {
+		return nil, err
+	}
+
+	data, err := omniRuntime.AdminTalosconfig(ctx, clusterName)
+	if err != nil {
+		return nil, err
+	}
+
+	return &management.TalosconfigResponse{
+		Talosconfig: data,
+	}, nil
+}
+
+func (s *managementServer) CreateServiceAccount(ctx context.Context, req *management.CreateServiceAccountRequest) (*management.CreateServiceAccountResponse, error) {
+	authCheckResult, err := s.authCheckGRPC(ctx, auth.WithRole(role.Admin))
+	if err != nil {
+		return nil, err
+	}
+
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	key, err := validatePGPPublicKey(
+		[]byte(req.GetArmoredPgpPublicKey()),
+		pgp.WithMaxAllowedLifetime(auth.ServiceAccountMaxAllowedLifetime),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	email := key.username + pkgaccess.ServiceAccountNameSuffix
+
+	_, err = s.omniState.Get(ctx, authres.NewIdentity(resources.DefaultNamespace, email).Metadata())
+	if err == nil {
+		return nil, fmt.Errorf("service account %q already exists", email)
+	}
+
+	if !state.IsNotFoundError(err) { // the identity must not exist
+		return nil, err
+	}
+
+	newUserID := uuid.New().String()
+
+	publicKeyResource := authres.NewPublicKey(resources.DefaultNamespace, key.id)
+	publicKeyResource.Metadata().Labels().Set(authres.LabelPublicKeyUserID, newUserID)
+
+	publicKeyResource.TypedSpec().Value.PublicKey = key.data
+	publicKeyResource.TypedSpec().Value.Expiration = timestamppb.New(key.expiration)
+	publicKeyResource.TypedSpec().Value.Role = req.Role
+
+	// register the public key of the service account as "confirmed" because we are already authenticated
+	publicKeyResource.TypedSpec().Value.Confirmed = true
+
+	publicKeyResource.TypedSpec().Value.Identity = &specs.Identity{
+		Email: email,
+	}
+
+	if req.GetUseUserRole() {
+		publicKeyResource.TypedSpec().Value.Role = string(authCheckResult.Role)
+	} else {
+		var reqRole role.Role
+
+		reqRole, err = role.Parse(req.GetRole())
+		if err != nil {
+			return nil, err
+		}
+
+		err = authCheckResult.Role.Check(reqRole)
+		if err != nil {
+			return nil, status.Errorf(
+				codes.PermissionDenied,
+				"not enough permissions to create service account with role %q: %s",
+				req.GetRole(),
+				err.Error(),
+			)
+		}
+
+		publicKeyResource.TypedSpec().Value.Role = req.GetRole()
+	}
+
+	err = s.omniState.Create(ctx, publicKeyResource)
+	if err != nil {
+		return nil, err
+	}
+
+	// create the user resource representing the service account with the same scopes as the public key
+	user := authres.NewUser(resources.DefaultNamespace, newUserID)
+	user.TypedSpec().Value.Role = publicKeyResource.TypedSpec().Value.GetRole()
+
+	err = s.omniState.Create(ctx, user)
+	if err != nil {
+		return nil, err
+	}
+
+	// create the identity resource representing the service account
+	identity := authres.NewIdentity(resources.DefaultNamespace, email)
+	identity.TypedSpec().Value.UserId = user.Metadata().ID()
+	identity.Metadata().Labels().Set(authres.LabelIdentityUserID, newUserID)
+	identity.Metadata().Labels().Set(authres.LabelIdentityTypeServiceAccount, "")
+
+	err = s.omniState.Create(ctx, identity)
+	if err != nil {
+		return nil, err
+	}
+
+	return &management.CreateServiceAccountResponse{PublicKeyId: key.id}, nil
+}
+
+// RenewServiceAccount registers a new public key to the service account, effectively renewing it.
+func (s *managementServer) RenewServiceAccount(ctx context.Context, req *management.RenewServiceAccountRequest) (*management.RenewServiceAccountResponse, error) {
+	_, err := s.authCheckGRPC(ctx, auth.WithRole(role.Admin))
+	if err != nil {
+		return nil, err
+	}
+
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	name := req.Name + pkgaccess.ServiceAccountNameSuffix
+
+	identity, err := safe.StateGet[*authres.Identity](ctx, s.omniState, authres.NewIdentity(resources.DefaultNamespace, name).Metadata())
+	if err != nil {
+		return nil, err
+	}
+
+	user, err := safe.StateGet[*authres.User](ctx, s.omniState, authres.NewUser(resources.DefaultNamespace, identity.TypedSpec().Value.UserId).Metadata())
+	if err != nil {
+		return nil, err
+	}
+
+	key, err := validatePGPPublicKey(
+		[]byte(req.GetArmoredPgpPublicKey()),
+		pgp.WithMaxAllowedLifetime(auth.ServiceAccountMaxAllowedLifetime),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	publicKeyResource := authres.NewPublicKey(resources.DefaultNamespace, key.id)
+	publicKeyResource.Metadata().Labels().Set(authres.LabelPublicKeyUserID, identity.TypedSpec().Value.UserId)
+
+	publicKeyResource.TypedSpec().Value.PublicKey = key.data
+	publicKeyResource.TypedSpec().Value.Expiration = timestamppb.New(key.expiration)
+	publicKeyResource.TypedSpec().Value.Role = user.TypedSpec().Value.GetRole()
+
+	publicKeyResource.TypedSpec().Value.Confirmed = true
+
+	publicKeyResource.TypedSpec().Value.Identity = &specs.Identity{
+		Email: name,
+	}
+
+	err = s.omniState.Create(ctx, publicKeyResource)
+	if err != nil {
+		return nil, err
+	}
+
+	return &management.RenewServiceAccountResponse{PublicKeyId: key.id}, nil
+}
+
+func (s *managementServer) ListServiceAccounts(ctx context.Context, _ *emptypb.Empty) (*management.ListServiceAccountsResponse, error) {
+	_, err := s.authCheckGRPC(ctx, auth.WithRole(role.Admin))
+	if err != nil {
+		return nil, err
+	}
+
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	identityList, err := safe.StateListAll[*authres.Identity](
+		ctx,
+		s.omniState,
+		state.WithLabelQuery(resource.LabelExists(authres.LabelIdentityTypeServiceAccount)),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	serviceAccounts := make([]*management.ListServiceAccountsResponse_ServiceAccount, 0, identityList.Len())
+
+	for iter := identityList.Iterator(); iter.Next(); {
+		identity := iter.Value()
+
+		user, err := safe.StateGet[*authres.User](ctx, s.omniState, authres.NewUser(resources.DefaultNamespace, identity.TypedSpec().Value.UserId).Metadata())
+		if err != nil {
+			return nil, err
+		}
+
+		publicKeyList, err := safe.StateListAll[*authres.PublicKey](
+			ctx,
+			s.omniState,
+			state.WithLabelQuery(resource.LabelEqual(authres.LabelPublicKeyUserID, user.Metadata().ID())),
+		)
+		if err != nil {
+			return nil, err
+		}
+
+		publicKeys := make([]*management.ListServiceAccountsResponse_ServiceAccount_PgpPublicKey, 0, publicKeyList.Len())
+
+		for keyIter := publicKeyList.Iterator(); keyIter.Next(); {
+			key := keyIter.Value()
+
+			publicKeys = append(publicKeys, &management.ListServiceAccountsResponse_ServiceAccount_PgpPublicKey{
+				Id:         key.Metadata().ID(),
+				Armored:    string(key.TypedSpec().Value.GetPublicKey()),
+				Expiration: key.TypedSpec().Value.GetExpiration(),
+			})
+		}
+
+		name := strings.TrimSuffix(identity.Metadata().ID(), pkgaccess.ServiceAccountNameSuffix)
+
+		serviceAccounts = append(serviceAccounts, &management.ListServiceAccountsResponse_ServiceAccount{
+			Name:          name,
+			PgpPublicKeys: publicKeys,
+			Role:          user.TypedSpec().Value.GetRole(),
+		})
+	}
+
+	return &management.ListServiceAccountsResponse{
+		ServiceAccounts: serviceAccounts,
+	}, nil
+}
+
+func (s *managementServer) DestroyServiceAccount(ctx context.Context, req *management.DestroyServiceAccountRequest) (*emptypb.Empty, error) {
+	_, err := s.authCheckGRPC(ctx, auth.WithRole(role.Admin))
+	if err != nil {
+		return nil, err
+	}
+
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	name := req.Name + pkgaccess.ServiceAccountNameSuffix
+
+	identity, err := safe.StateGet[*authres.Identity](ctx, s.omniState, authres.NewIdentity(resources.DefaultNamespace, name).Metadata())
+	if state.IsNotFoundError(err) {
+		return nil, status.Errorf(codes.NotFound, "service account %q not found", name)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+
+	_, isServiceAccount := identity.Metadata().Labels().Get(authres.LabelIdentityTypeServiceAccount)
+	if !isServiceAccount {
+		return nil, status.Errorf(codes.NotFound, "service account %q not found", req.Name)
+	}
+
+	pubKeys, err := s.omniState.List(
+		ctx,
+		authres.NewPublicKey(resources.DefaultNamespace, "").Metadata(),
+		state.WithLabelQuery(resource.LabelEqual(authres.LabelIdentityUserID, identity.TypedSpec().Value.UserId)),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	var destroyErr error
+
+	for _, pubKey := range pubKeys.Items {
+		err = s.omniState.Destroy(ctx, pubKey.Metadata())
+		if err != nil {
+			destroyErr = multierror.Append(destroyErr, err)
+		}
+	}
+
+	err = s.omniState.Destroy(ctx, identity.Metadata())
+	if err != nil {
+		destroyErr = multierror.Append(destroyErr, err)
+	}
+
+	err = s.omniState.Destroy(ctx, authres.NewUser(resources.DefaultNamespace, identity.TypedSpec().Value.UserId).Metadata())
+	if err != nil {
+		destroyErr = multierror.Append(destroyErr, err)
+	}
+
+	if destroyErr != nil {
+		return nil, destroyErr
+	}
+
+	return &emptypb.Empty{}, nil
+}
+
+func (s *managementServer) KubernetesUpgradePreChecks(ctx context.Context, req *management.KubernetesUpgradePreChecksRequest) (*management.KubernetesUpgradePreChecksResponse, error) {
+	if _, err := s.authCheckGRPC(ctx, auth.WithRole(role.Operator)); err != nil {
+		return nil, err
+	}
+
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	requestContext := router.ExtractContext(ctx)
+	if requestContext == nil {
+		return nil, status.Error(codes.InvalidArgument, "unable to extract request context")
+	}
+
+	upgradeStatus, err := safe.StateGet[*omnires.KubernetesUpgradeStatus](ctx, s.omniState, omnires.NewKubernetesUpgradeStatus(resources.DefaultNamespace, requestContext.Name).Metadata())
+	if err != nil {
+		return nil, err
+	}
+
+	currentVersion := upgradeStatus.TypedSpec().Value.LastUpgradeVersion
+	if currentVersion == "" {
+		return nil, status.Error(codes.FailedPrecondition, "current version is not known yet")
+	}
+
+	path, err := upgrade.NewPath(currentVersion, req.NewVersion)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "invalid upgrade path: %v", err)
+	}
+
+	if !path.IsSupported() {
+		return nil, status.Errorf(codes.InvalidArgument, "unsupported upgrade path: %s", path)
+	}
+
+	type kubeConfigGetter interface {
+		GetKubeconfig(ctx context.Context, cluster *commonOmni.Context) (*rest.Config, error)
+	}
+
+	k8sRuntime, err := runtime.LookupInterface[kubeConfigGetter](kubernetes.Name)
+	if err != nil {
+		return nil, err
+	}
+
+	restConfig, err := k8sRuntime.GetKubeconfig(ctx, requestContext)
+	if err != nil {
+		return nil, fmt.Errorf("error getting kubeconfig: %w", err)
+	}
+
+	type talosClientGetter interface {
+		GetClient(ctx context.Context, clusterName string) (*talos.Client, error)
+	}
+
+	talosRuntime, err := runtime.LookupInterface[talosClientGetter](talos.Name)
+	if err != nil {
+		return nil, err
+	}
+
+	talosClient, err := talosRuntime.GetClient(ctx, requestContext.Name)
+	if err != nil {
+		return nil, fmt.Errorf("error getting talos client: %w", err)
+	}
+
+	var controlplaneNodes []string
+
+	cmis, err := safe.StateListAll[*omnires.ClusterMachineIdentity](
+		ctx,
+		s.omniState,
+		state.WithLabelQuery(
+			resource.LabelEqual(omnires.LabelCluster, requestContext.Name),
+			resource.LabelExists(omnires.LabelControlPlaneRole),
+		),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	for iter := cmis.Iterator(); iter.Next(); {
+		if len(iter.Value().TypedSpec().Value.NodeIps) > 0 {
+			controlplaneNodes = append(controlplaneNodes, iter.Value().TypedSpec().Value.NodeIps[0])
+		}
+	}
+
+	s.logger.Debug("running k8s upgrade pre-checks", zap.Strings("controlplane_nodes", controlplaneNodes), zap.String("cluster", requestContext.Name))
+
+	var logBuffer strings.Builder
+
+	preCheck, err := upgrade.NewChecks(path, talosClient.COSI, restConfig, controlplaneNodes, nil, func(format string, args ...any) {
+		fmt.Fprintf(&logBuffer, format, args...)
+		fmt.Fprintln(&logBuffer)
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	if err = preCheck.Run(ctx); err != nil {
+		s.logger.Error("failed running pre-checks", zap.String("log", logBuffer.String()), zap.String("cluster", requestContext.Name), zap.Error(err))
+
+		fmt.Fprintf(&logBuffer, "pre-checks failed: %v\n", err)
+
+		return &management.KubernetesUpgradePreChecksResponse{
+			Ok:     false,
+			Reason: logBuffer.String(),
+		}, nil
+	}
+
+	s.logger.Debug("k8s upgrade pre-checks successful", zap.String("log", logBuffer.String()), zap.String("cluster", requestContext.Name))
+
+	return &management.KubernetesUpgradePreChecksResponse{
+		Ok: true,
+	}, nil
+}
+
+//nolint:gocognit,gocyclo,cyclop
+func (s *managementServer) KubernetesSyncManifests(req *management.KubernetesSyncManifestRequest, srv management.ManagementService_KubernetesSyncManifestsServer) error {
+	ctx := srv.Context()
+
+	if _, err := s.authCheckGRPC(ctx, auth.WithRole(role.Operator)); err != nil {
+		return err
+	}
+
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	requestContext := router.ExtractContext(ctx)
+	if requestContext == nil {
+		return status.Error(codes.InvalidArgument, "unable to extract request context")
+	}
+
+	type kubernetesConfigurator interface {
+		GetKubeconfig(ctx context.Context, context *commonOmni.Context) (*rest.Config, error)
+	}
+
+	kubernetesRuntime, err := runtime.LookupInterface[kubernetesConfigurator](kubernetes.Name)
+	if err != nil {
+		return err
+	}
+
+	cfg, err := kubernetesRuntime.GetKubeconfig(ctx, requestContext)
+	if err != nil {
+		return fmt.Errorf("failed to get kubeconfig: %w", err)
+	}
+
+	type talosClientProvider interface {
+		GetClient(ctx context.Context, clusterName string) (*talos.Client, error)
+	}
+
+	talosRuntime, err := runtime.LookupInterface[talosClientProvider](talos.Name)
+	if err != nil {
+		return err
+	}
+
+	talosClient, err := talosRuntime.GetClient(ctx, requestContext.Name)
+	if err != nil {
+		return fmt.Errorf("failed to get talos client: %w", err)
+	}
+
+	bootstrapManifests, err := manifests.GetBootstrapManifests(ctx, talosClient.COSI, nil)
+	if err != nil {
+		return fmt.Errorf("failed to get manifests: %w", err)
+	}
+
+	errCh := make(chan error, 1)
+	synCh := make(chan manifests.SyncResult)
+
+	go func() {
+		errCh <- manifests.Sync(ctx, bootstrapManifests, cfg, req.DryRun, synCh)
+	}()
+
+	var updatedManifests []manifests.Manifest
+
+syncLoop:
+	for {
+		select {
+		case err := <-errCh:
+			if err != nil {
+				return fmt.Errorf("failed to sync manifests: %w", err)
+			}
+
+			break syncLoop
+		case result := <-synCh:
+			obj, err := yaml.Marshal(result.Object.Object)
+			if err != nil {
+				return fmt.Errorf("failed to marshal object: %w", err)
+			}
+
+			if err := srv.Send(&management.KubernetesSyncManifestResponse{
+				ResponseType: management.KubernetesSyncManifestResponse_MANIFEST,
+				Path:         result.Path,
+				Object:       obj,
+				Diff:         result.Diff,
+				Skipped:      result.Skipped,
+			}); err != nil {
+				return err
+			}
+
+			if !result.Skipped {
+				updatedManifests = append(updatedManifests, result.Object)
+			}
+		}
+	}
+
+	if req.DryRun {
+		// no rollout if dry run
+		return s.triggerManifestResync(ctx, requestContext)
+	}
+
+	rolloutCh := make(chan manifests.RolloutProgress)
+
+	go func() {
+		errCh <- manifests.WaitForRollout(ctx, cfg, updatedManifests, rolloutCh)
+	}()
+
+rolloutLoop:
+	for {
+		select {
+		case err := <-errCh:
+			if err != nil {
+				return fmt.Errorf("failed to wait fo rollout: %w", err)
+			}
+
+			break rolloutLoop
+		case result := <-rolloutCh:
+			obj, err := yaml.Marshal(result.Object.Object)
+			if err != nil {
+				return fmt.Errorf("failed to marshal object: %w", err)
+			}
+
+			if err := srv.Send(&management.KubernetesSyncManifestResponse{
+				ResponseType: management.KubernetesSyncManifestResponse_ROLLOUT,
+				Path:         result.Path,
+				Object:       obj,
+			}); err != nil {
+				return err
+			}
+		}
+	}
+
+	return s.triggerManifestResync(ctx, requestContext)
+}
+
+func (s *managementServer) triggerManifestResync(ctx context.Context, requestContext *commonOmni.Context) error {
+	// trigger fake update in KubernetesUpgradeStatusType to force re-calculating the status
+	// this is needed because the status is not updated when the rollout is finished
+	_, err := safe.StateUpdateWithConflicts(
+		ctx,
+		s.omniState,
+		omnires.NewKubernetesUpgradeStatus(resources.DefaultNamespace, requestContext.Name).Metadata(),
+		func(res *omnires.KubernetesUpgradeStatus) error {
+			res.Metadata().Annotations().Set("manifest-rollout", strconv.Itoa(int(time.Now().Unix())))
+
+			return nil
+		},
+		state.WithUpdateOwner(omniCtrl.KubernetesUpgradeStatusControllerName),
+	)
+	if err != nil && !state.IsNotFoundError(err) {
+		return fmt.Errorf("failed to update KubernetesUpgradeStatus: %w", err)
+	}
+
+	return nil
+}
+
+func (s *managementServer) authCheckGRPC(ctx context.Context, opts ...auth.CheckOption) (auth.CheckResult, error) {
+	authCheckResult, err := auth.Check(ctx, opts...)
+	if errors.Is(err, auth.ErrUnauthenticated) {
+		return auth.CheckResult{}, status.Error(codes.Unauthenticated, err.Error())
+	}
+
+	if errors.Is(err, auth.ErrUnauthorized) {
+		return auth.CheckResult{}, status.Error(codes.PermissionDenied, err.Error())
+	}
+
+	if err != nil {
+		return auth.CheckResult{}, err
+	}
+
+	return authCheckResult, nil
+}
+
+// applyClusterAccessPolicy checks the ACLs for the user in the context against the given cluster ID.
+// If there is a match and the matched role is higher than the user's role,
+// a child context containing the given role will be returned.
+func (s *managementServer) applyClusterAccessPolicy(ctx context.Context, clusterID resource.ID) (context.Context, error) {
+	clusterRole, _, err := accesspolicy.RoleForCluster(ctx, clusterID, s.omniState)
+	if err != nil {
+		return nil, err
+	}
+
+	userRole, userRoleExists := ctx.Value(auth.RoleContextKey{}).(role.Role)
+	if !userRoleExists {
+		userRole = role.None
+	}
+
+	newRole, err := role.Max(userRole, clusterRole)
+	if err != nil {
+		return nil, err
+	}
+
+	if newRole == userRole {
+		return ctx, nil
+	}
+
+	return context.WithValue(ctx, auth.RoleContextKey{}, newRole), nil
+}
+
+func handleError(err error) error {
+	switch {
+	case errors.Is(err, io.EOF):
+		return nil
+	case siderolink.IsBufferNotFoundError(err):
+		return status.Error(codes.NotFound, err.Error())
+	}
+
+	return err
+}
+
+func generateConfig(authResult auth.CheckResult, contextURL string) ([]byte, error) {
+	// This is safe to do, since omnictl config pkg doesn't import anything from the backend
+	cfg := &ctlcfg.Config{
+		Contexts: map[string]*ctlcfg.Context{
+			"default": {
+				URL: contextURL,
+				Auth: ctlcfg.Auth{
+					SideroV1: ctlcfg.SideroV1{
+						Identity: authResult.Identity,
+					},
+				},
+			},
+		},
+		Context: "default",
+	}
+
+	result, err := yaml.Marshal(cfg)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal omnicfg: %w", err)
+	}
+
+	return result, error(nil)
+}
+
+func generateDest(apiurl string) (string, error) {
+	parsedDest, err := url.Parse(apiurl)
+	if err != nil {
+		return "", fmt.Errorf("incorrect destination: %w", err)
+	}
+
+	result := parsedDest.String()
+	if result == "" {
+		// This can happen if Parse actually failed but didn't return an error
+		return "", fmt.Errorf("incorrect destination '%s'", parsedDest)
+	}
+
+	return result, nil
+}
diff --git a/internal/backend/grpc/oidc.go b/internal/backend/grpc/oidc.go
new file mode 100644
index 000000000..9305eb218
--- /dev/null
+++ b/internal/backend/grpc/oidc.go
@@ -0,0 +1,59 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package grpc
+
+import (
+	"context"
+
+	gateway "github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/zitadel/oidc/pkg/op"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/client/api/omni/oidc"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+)
+
+// OIDCProvider provides a link to the OIDC implementation to authenticate the actual request.
+type OIDCProvider interface {
+	op.OpenIDProvider
+	AuthenticateRequest(requestID, identity string) error
+}
+
+type oidcServer struct {
+	oidc.UnimplementedOIDCServiceServer
+
+	provider OIDCProvider
+}
+
+func (s *oidcServer) register(server grpc.ServiceRegistrar) {
+	oidc.RegisterOIDCServiceServer(server, s)
+}
+
+func (s *oidcServer) gateway(ctx context.Context, mux *gateway.ServeMux, address string, opts []grpc.DialOption) error {
+	return oidc.RegisterOIDCServiceHandlerFromEndpoint(ctx, mux, address, opts)
+}
+
+func (s *oidcServer) Authenticate(ctx context.Context, req *oidc.AuthenticateRequest) (*oidc.AuthenticateResponse, error) {
+	authResult, err := auth.CheckGRPC(ctx, auth.WithValidSignature(true))
+	if err != nil {
+		return nil, err
+	}
+
+	identity := authResult.Identity
+	if !authResult.AuthEnabled {
+		identity = "anonymous@omni"
+	}
+
+	if err := s.provider.AuthenticateRequest(req.AuthRequestId, identity); err != nil {
+		return nil, status.Errorf(codes.PermissionDenied, "failed to authenticate request: %s", err)
+	}
+
+	return &oidc.AuthenticateResponse{
+		RedirectUrl: op.AuthCallbackURL(s.provider)(req.AuthRequestId),
+	}, nil
+}
diff --git a/internal/backend/grpc/resource.go b/internal/backend/grpc/resource.go
new file mode 100644
index 000000000..35589e7e3
--- /dev/null
+++ b/internal/backend/grpc/resource.go
@@ -0,0 +1,399 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package grpc
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"time"
+
+	cosiresource "github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/state"
+	gateway "github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"github.com/siderolabs/go-api-signature/pkg/message"
+	"golang.org/x/sync/errgroup"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/siderolabs/omni/client/api/common"
+	"github.com/siderolabs/omni/client/api/omni/resources"
+	"github.com/siderolabs/omni/internal/backend/grpc/router"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+)
+
+// ResourceServer implements resources CRUD API.
+type ResourceServer struct {
+	resources.UnimplementedResourceServiceServer
+}
+
+func (s *ResourceServer) register(server grpc.ServiceRegistrar) {
+	resources.RegisterResourceServiceServer(server, s)
+}
+
+func (s *ResourceServer) gateway(ctx context.Context, mux *gateway.ServeMux, address string, opts []grpc.DialOption) error {
+	return resources.RegisterResourceServiceHandlerFromEndpoint(ctx, mux, address, opts)
+}
+
+// Get returns resource from cluster using Talos or Kubernetes.
+func (s *ResourceServer) Get(ctx context.Context, in *resources.GetRequest) (*resources.GetResponse, error) {
+	r, err := runtime.Get(getSource(ctx).String())
+	if err != nil {
+		return nil, err
+	}
+
+	opts := withContext(router.ExtractContext(ctx))
+
+	opts = append(opts, withResource(in)...)
+
+	if in.Id != "" {
+		opts = append(opts, runtime.WithName(in.Id))
+	}
+
+	res := &resources.GetResponse{}
+
+	md, _ := metadata.FromIncomingContext(ctx)
+
+	if nodes := md.Get(router.ResolvedNodesHeaderKey); nodes != nil {
+		opts = append(opts, runtime.WithNodes(nodes...))
+	}
+
+	result, err := r.Get(ctx, opts...)
+	if err != nil {
+		return nil, wrapError(err)
+	}
+
+	res.Body, err = runtime.MarshalJSON(result)
+	if err != nil {
+		return nil, err
+	}
+
+	return res, nil
+}
+
+// List returns resources from cluster using Talos or Kubernetes.
+func (s *ResourceServer) List(ctx context.Context, in *resources.ListRequest) (*resources.ListResponse, error) {
+	r, err := runtime.Get(getSource(ctx).String())
+	if err != nil {
+		return nil, err
+	}
+
+	opts := withContext(router.ExtractContext(ctx))
+
+	opts = append(opts, withResource(in)...)
+
+	md, _ := metadata.FromIncomingContext(ctx)
+
+	if s := md.Get(message.SelectorsHeaderKey); len(s) > 0 {
+		opts = append(opts, runtime.WithLabelSelectors(s...))
+	}
+
+	if s := md.Get(message.FieldSelectorsHeaderKey); len(s) > 0 {
+		opts = append(opts, runtime.WithFieldSelector(s[0]))
+	}
+
+	if nodes := md.Get(router.ResolvedNodesHeaderKey); nodes != nil {
+		opts = append(opts, runtime.WithNodes(nodes...))
+	}
+
+	if in.Offset > 0 {
+		opts = append(opts, runtime.WithOffset(int(in.Offset)))
+	}
+
+	if in.Limit > 0 {
+		opts = append(opts, runtime.WithLimit(int(in.Limit)))
+	}
+
+	if len(in.SearchFor) > 0 {
+		opts = append(opts, runtime.WithSearchFor(in.SearchFor))
+	}
+
+	opts = append(opts, runtime.WithSort(in.SortByField, in.SortDescending))
+
+	items, err := r.List(ctx, opts...)
+	if err != nil {
+		return nil, wrapError(err)
+	}
+
+	result := make([]string, 0, len(items.Items))
+
+	for _, item := range items.Items {
+		data, err := runtime.MarshalJSON(item.Unwrap())
+		if err != nil {
+			return nil, err
+		}
+
+		result = append(result, data)
+	}
+
+	return &resources.ListResponse{
+		Items: result,
+		Total: int32(items.Total),
+	}, nil
+}
+
+// Watch the resource.
+func (s *ResourceServer) Watch(in *resources.WatchRequest, serv resources.ResourceService_WatchServer) error {
+	ctx, cancel := context.WithCancel(serv.Context())
+	defer cancel()
+
+	r, err := runtime.Get(getSource(ctx).String())
+	if err != nil {
+		return err
+	}
+
+	opts := withContext(router.ExtractContext(ctx))
+
+	opts = append(opts, withResource(in)...)
+
+	md, _ := metadata.FromIncomingContext(ctx)
+
+	if s := md.Get(message.SelectorsHeaderKey); len(s) > 0 {
+		opts = append(opts, runtime.WithLabelSelectors(s...))
+	}
+
+	if s := md.Get(message.FieldSelectorsHeaderKey); len(s) > 0 {
+		opts = append(opts, runtime.WithFieldSelector(s[0]))
+	}
+
+	if nodes := md.Get(router.ResolvedNodesHeaderKey); len(nodes) > 0 {
+		opts = append(opts, runtime.WithNodes(nodes...))
+	}
+
+	if in.Id != "" {
+		opts = append(opts, runtime.WithName(in.Id))
+	}
+
+	events := make(chan runtime.WatchResponse)
+	eg, ctx := errgroup.WithContext(ctx)
+
+	if in.TailEvents != 0 {
+		opts = append(opts, runtime.WithTailEvents(int(in.TailEvents)))
+	}
+
+	if in.Offset != 0 {
+		opts = append(opts, runtime.WithOffset(int(in.Offset)))
+	}
+
+	if in.Limit != 0 {
+		opts = append(opts, runtime.WithLimit(int(in.Limit)))
+	}
+
+	if len(in.SearchFor) > 0 {
+		opts = append(opts, runtime.WithSearchFor(in.SearchFor))
+	}
+
+	opts = append(opts, runtime.WithSort(in.SortByField, in.SortDescending))
+
+	eg.Go(func() error {
+		for {
+			select {
+			case <-ctx.Done():
+				return nil
+			case ev := <-events:
+				if err = serv.Send(ev.Unwrap()); err != nil {
+					return err
+				}
+			}
+		}
+	})
+
+	eg.Go(func() error {
+		defer cancel()
+
+		return wrapError(r.Watch(ctx, events, opts...))
+	})
+
+	return eg.Wait()
+}
+
+// Create a new resource in Omni runtime or Kubernetes.
+func (s *ResourceServer) Create(ctx context.Context, in *resources.CreateRequest) (*resources.CreateResponse, error) {
+	r, err := runtime.Get(getSource(ctx).String())
+	if err != nil {
+		return nil, err
+	}
+
+	opts := withContext(router.ExtractContext(ctx))
+
+	obj, err := CreateResource(in.Resource)
+	if err != nil {
+		return nil, err
+	}
+
+	if err = r.Create(ctx, obj, opts...); err != nil {
+		return nil, wrapError(err)
+	}
+
+	return &resources.CreateResponse{}, nil
+}
+
+// Update a resource in Omni runtime or Kubernetes.
+func (s *ResourceServer) Update(ctx context.Context, in *resources.UpdateRequest) (*resources.UpdateResponse, error) {
+	r, err := runtime.Get(getSource(ctx).String())
+	if err != nil {
+		return nil, err
+	}
+
+	opts := withContext(router.ExtractContext(ctx))
+
+	if in.CurrentVersion != "" {
+		opts = append(opts, runtime.WithCurrentVersion(in.CurrentVersion))
+	}
+
+	obj, err := CreateResource(in.Resource)
+	if err != nil {
+		return nil, err
+	}
+
+	if err = r.Update(ctx, obj, opts...); err != nil {
+		return nil, wrapError(err)
+	}
+
+	return &resources.UpdateResponse{}, nil
+}
+
+// Delete a resource in Omni runtime or Kubernetes.
+func (s *ResourceServer) Delete(ctx context.Context, in *resources.DeleteRequest) (*resources.DeleteResponse, error) {
+	r, err := runtime.Get(getSource(ctx).String())
+	if err != nil {
+		return nil, err
+	}
+
+	opts := withContext(router.ExtractContext(ctx))
+
+	opts = append(opts,
+		runtime.WithNamespace(in.Namespace),
+		runtime.WithName(in.Id),
+		runtime.WithResource(in.Type),
+	)
+
+	if err = r.Delete(ctx, opts...); err != nil {
+		return nil, wrapError(err)
+	}
+
+	return &resources.DeleteResponse{}, nil
+}
+
+// Teardown a resource in Omni runtime.
+func (s *ResourceServer) Teardown(ctx context.Context, in *resources.DeleteRequest) (*resources.DeleteResponse, error) {
+	r, err := runtime.Get(getSource(ctx).String())
+	if err != nil {
+		return nil, err
+	}
+
+	opts := withContext(router.ExtractContext(ctx))
+
+	opts = append(opts,
+		runtime.WithNamespace(in.Namespace),
+		runtime.WithName(in.Id),
+		runtime.WithResource(in.Type),
+		runtime.WithTeardownOnly(),
+	)
+
+	if err = r.Delete(ctx, opts...); err != nil {
+		return nil, wrapError(err)
+	}
+
+	return &resources.DeleteResponse{}, nil
+}
+
+func getSource(ctx context.Context) common.Runtime {
+	if md, ok := metadata.FromIncomingContext(ctx); ok {
+		source := md.Get(message.RuntimeHeaderHey)
+		if source != nil {
+			if res, ok := common.Runtime_value[source[0]]; ok {
+				return common.Runtime(res)
+			}
+		}
+	}
+
+	return common.Runtime_Kubernetes
+}
+
+type res interface {
+	GetType() string
+	GetNamespace() string
+}
+
+func withContext(ctx *common.Context) []runtime.QueryOption {
+	if ctx == nil {
+		return nil
+	}
+
+	return []runtime.QueryOption{runtime.WithContext(ctx.Name)}
+}
+
+func withResource(r res) []runtime.QueryOption {
+	if r == nil {
+		return nil
+	}
+
+	var opts []runtime.QueryOption
+
+	if r.GetNamespace() != "" {
+		opts = append(opts, runtime.WithNamespace(r.GetNamespace()))
+	}
+
+	if r.GetType() != "" {
+		opts = append(opts, runtime.WithResource(r.GetType()))
+	}
+
+	return opts
+}
+
+// CreateResource creates a resource from a resource proto representation.
+func CreateResource(resource *resources.Resource) (cosiresource.Resource, error) { //nolint:ireturn
+	if resource.Metadata.Version == "" {
+		resource.Metadata.Version = "1"
+	}
+
+	resource.Metadata.Phase = "running"
+
+	obj, err := protobuf.CreateResource(resource.Metadata.Type)
+	if err != nil {
+		return nil, err
+	}
+
+	if resource.Spec != "" {
+		err = json.Unmarshal([]byte(resource.Spec), obj.Spec())
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	if resource.Metadata.Created.AsTime().Equal(time.Unix(0, 0)) {
+		resource.Metadata.Created = timestamppb.Now()
+	}
+
+	*obj.Metadata(), err = cosiresource.NewMetadataFromProto(resource.Metadata)
+	if err != nil {
+		return nil, err
+	}
+
+	return obj, nil
+}
+
+func wrapError(err error) error {
+	switch {
+	case state.IsNotFoundError(err):
+		return status.Error(codes.NotFound, err.Error())
+	case state.IsOwnerConflictError(err):
+		return status.Error(codes.PermissionDenied, err.Error())
+	case state.IsPhaseConflictError(err):
+		return status.Error(codes.InvalidArgument, err.Error())
+	case state.IsConflictError(err):
+		return status.Error(codes.AlreadyExists, err.Error())
+	case errors.Is(err, context.Canceled):
+		return status.Error(codes.Canceled, err.Error())
+	}
+
+	return err
+}
diff --git a/internal/backend/grpc/router/omni_backend.go b/internal/backend/grpc/router/omni_backend.go
new file mode 100644
index 000000000..7d4525fd6
--- /dev/null
+++ b/internal/backend/grpc/router/omni_backend.go
@@ -0,0 +1,72 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package router
+
+import (
+	"context"
+
+	"github.com/siderolabs/gen/xslices"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+
+	"github.com/siderolabs/omni/internal/backend/dns"
+)
+
+// ResolvedNodesHeaderKey is used to propagate the node IP information from the node/nodes headers to the backend.
+const ResolvedNodesHeaderKey = "resolved-nodes"
+
+// OmniBackend implements a backend (proxying one2one to a Talos node).
+type OmniBackend struct {
+	conn         *grpc.ClientConn
+	nodeResolver NodeResolver
+	name         string
+}
+
+// NewOmniBackend builds new backend.
+func NewOmniBackend(name string, nodeResolver NodeResolver, conn *grpc.ClientConn) *OmniBackend {
+	backend := &OmniBackend{
+		name:         name,
+		nodeResolver: nodeResolver,
+		conn:         conn,
+	}
+
+	return backend
+}
+
+func (l *OmniBackend) String() string {
+	return l.name
+}
+
+// GetConnection returns a grpc connection to the backend.
+func (l *OmniBackend) GetConnection(ctx context.Context, _ string) (context.Context, *grpc.ClientConn, error) {
+	md, _ := metadata.FromIncomingContext(ctx)
+
+	// Set resolved nodes as a header to be used by the ResourceServer.
+	// Use a new header to avoid signature mismatch.
+	resolved := resolveNodes(l.nodeResolver, md)
+
+	if resolved.node.Address != "" {
+		md.Set(ResolvedNodesHeaderKey, resolved.node.Address)
+	} else if len(resolved.nodes) > 0 {
+		md.Set(ResolvedNodesHeaderKey, xslices.Map(resolved.nodes, func(info dns.Info) string {
+			return info.Address
+		})...)
+	}
+
+	outCtx := metadata.NewOutgoingContext(ctx, md)
+
+	return outCtx, l.conn, nil
+}
+
+// AppendInfo is called to enhance response from the backend with additional data.
+func (l *OmniBackend) AppendInfo(_ bool, resp []byte) ([]byte, error) {
+	return resp, nil
+}
+
+// BuildError is called to convert error from upstream into response field.
+func (l *OmniBackend) BuildError(bool, error) ([]byte, error) {
+	return nil, nil
+}
diff --git a/internal/backend/grpc/router/resolve.go b/internal/backend/grpc/router/resolve.go
new file mode 100644
index 000000000..db037c083
--- /dev/null
+++ b/internal/backend/grpc/router/resolve.go
@@ -0,0 +1,71 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package router
+
+import (
+	"strings"
+
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/go-api-signature/pkg/message"
+	"google.golang.org/grpc/metadata"
+
+	"github.com/siderolabs/omni/internal/backend/dns"
+)
+
+// NodeResolver resolves a given cluster and a node name to an IP address.
+type NodeResolver interface {
+	Resolve(cluster, node string) dns.Info
+}
+
+type resolvedNodeInfo struct {
+	node  dns.Info
+	nodes []dns.Info
+}
+
+func resolveNodes(dnsService NodeResolver, md metadata.MD) resolvedNodeInfo {
+	nodesVal := md.Get(message.NodesHeaderKey)
+
+	cluster := getClusterName(md)
+
+	nodes := make([]string, 0, len(nodesVal)*2)
+	for _, node := range nodesVal {
+		nodes = append(nodes, strings.Split(node, ",")...)
+	}
+
+	node := ""
+	if nodeVal := md.Get("node"); len(nodeVal) > 0 {
+		node = nodeVal[0]
+	}
+
+	if cluster == "" {
+		return resolvedNodeInfo{
+			nodes: xslices.Map(nodes, func(n string) dns.Info {
+				return dns.Info{Address: n}
+			}),
+			node: dns.Info{Address: node},
+		}
+	}
+
+	resolveNode := func(val string) dns.Info {
+		if val == "" {
+			return dns.Info{}
+		}
+
+		return dnsService.Resolve(cluster, val)
+	}
+
+	resolvedNode := resolveNode(node)
+
+	resolvedNodes := make([]dns.Info, 0, len(nodes))
+	for _, n := range nodesVal {
+		resolvedNodes = append(resolvedNodes, resolveNode(n))
+	}
+
+	return resolvedNodeInfo{
+		nodes: resolvedNodes,
+		node:  resolvedNode,
+	}
+}
diff --git a/internal/backend/grpc/router/router.go b/internal/backend/grpc/router/router.go
new file mode 100644
index 000000000..923e8ffe8
--- /dev/null
+++ b/internal/backend/grpc/router/router.go
@@ -0,0 +1,375 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package router defines gRPC proxy helpers.
+package router
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"math"
+	"net"
+	"runtime"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/hashicorp/golang-lru/v2/expirable"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/go-api-signature/pkg/message"
+	"github.com/siderolabs/grpc-proxy/proxy"
+	"github.com/siderolabs/talos/pkg/machinery/client/resolver"
+	talosconstants "github.com/siderolabs/talos/pkg/machinery/constants"
+	"github.com/siderolabs/talos/pkg/machinery/role"
+	"golang.org/x/sync/singleflight"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/backoff"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/client/api/common"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/memconn"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/certs"
+)
+
+const (
+	talosBackendLRUSize = 32
+	talosBackendTTL     = time.Hour
+)
+
+// Router wraps grpc-proxy StreamDirector.
+type Router struct {
+	talosBackends                        *expirable.LRU[string, proxy.Backend]
+	sf                                   singleflight.Group
+	metricCacheSize, metricActiveClients prometheus.Gauge
+	metricCacheHits, metricCacheMisses   prometheus.Counter
+
+	omniBackend  proxy.Backend
+	nodeResolver NodeResolver
+	verifier     grpc.UnaryServerInterceptor
+	cosiState    state.State
+	authEnabled  bool
+}
+
+// NewRouter builds new Router.
+func NewRouter(
+	transport *memconn.Transport,
+	cosiState state.State,
+	nodeResolver NodeResolver,
+	authEnabled bool,
+	verifier grpc.UnaryServerInterceptor,
+) (*Router, error) {
+	omniConn, err := grpc.Dial(transport.Address,
+		grpc.WithContextDialer(func(context.Context, string) (net.Conn, error) {
+			return transport.Dial()
+		}),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		grpc.WithCodec(proxy.Codec()), //nolint:staticcheck
+		// we are proxying requests to ourselves, so we don't need to impose a limit
+		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(math.MaxInt32)),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to dial omni backend: %w", err)
+	}
+
+	r := &Router{
+		talosBackends: expirable.NewLRU[string, proxy.Backend](talosBackendLRUSize, nil, talosBackendTTL),
+		omniBackend:   NewOmniBackend("omni", nodeResolver, omniConn),
+		cosiState:     cosiState,
+		nodeResolver:  nodeResolver,
+		authEnabled:   authEnabled,
+		verifier:      verifier,
+
+		metricCacheSize: prometheus.NewGauge(prometheus.GaugeOpts{
+			Name: "omni_grpc_proxy_talos_backend_cache_size",
+			Help: "Number of Talos clients in the cache of gRPC Proxy.",
+		}),
+		metricActiveClients: prometheus.NewGauge(prometheus.GaugeOpts{
+			Name: "omni_grpc_proxy_talos_backend_active_clients",
+			Help: "Number of active Talos clients created by gRPC Proxy.",
+		}),
+		metricCacheHits: prometheus.NewCounter(prometheus.CounterOpts{
+			Name: "omni_grpc_proxy_talos_backend_cache_hits_total",
+			Help: "Number of gRPC Proxy Talos client cache hits.",
+		}),
+		metricCacheMisses: prometheus.NewCounter(prometheus.CounterOpts{
+			Name: "omni_grpc_proxy_talos_backend_cache_misses_total",
+			Help: "Number of gRPC Proxy Talos client cache misses.",
+		}),
+	}
+
+	return r, nil
+}
+
+// removeBackend clears cached client for a cluster.
+func (r *Router) removeBackend(id string) {
+	r.talosBackends.Remove(id)
+}
+
+// Director implements proxy.StreamDirector function.
+func (r *Router) Director(ctx context.Context, fullMethodName string) (proxy.Mode, []proxy.Backend, error) {
+	fullMethodName = strings.TrimLeft(fullMethodName, "/")
+
+	// Proxy explicitly local APIs to the local backend.
+	switch {
+	case strings.HasPrefix(fullMethodName, "auth."),
+		strings.HasPrefix(fullMethodName, "config."),
+		strings.HasPrefix(fullMethodName, "management."),
+		strings.HasPrefix(fullMethodName, "oidc."),
+		strings.HasPrefix(fullMethodName, "omni."):
+		return proxy.One2One, []proxy.Backend{r.omniBackend}, nil
+	default:
+	}
+
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return proxy.One2One, []proxy.Backend{r.omniBackend}, nil
+	}
+
+	if runtime := md.Get(message.RuntimeHeaderHey); runtime != nil && runtime[0] == common.Runtime_Talos.String() {
+		backends, _, err := r.getTalosBackend(ctx, md)
+		if err != nil {
+			return proxy.One2One, nil, err
+		}
+
+		return proxy.One2One, backends, nil
+	}
+
+	return proxy.One2One, []proxy.Backend{r.omniBackend}, nil
+}
+
+func (r *Router) getTalosBackend(ctx context.Context, md metadata.MD) ([]proxy.Backend, string, error) {
+	clusterName := getClusterName(md)
+
+	if backend, ok := r.talosBackends.Get(clusterName); ok {
+		r.metricCacheHits.Inc()
+
+		return []proxy.Backend{backend}, clusterName, nil
+	}
+
+	ch := r.sf.DoChan(clusterName, func() (any, error) {
+		ctx = actor.MarkContextAsInternalActor(ctx)
+
+		r.metricCacheMisses.Inc()
+
+		conn, err := r.getConn(ctx, clusterName)
+		if err != nil {
+			return nil, err
+		}
+
+		r.metricActiveClients.Inc()
+
+		backend := NewTalosBackend(clusterName, r.nodeResolver, conn, r.authEnabled, r.verifier)
+		r.talosBackends.Add(clusterName, backend)
+
+		runtime.SetFinalizer(backend, func(backend *TalosBackend) {
+			r.metricActiveClients.Dec()
+
+			backend.conn.Close() //nolint:errcheck
+		})
+
+		return backend, nil
+	})
+
+	select {
+	case <-ctx.Done():
+		return nil, "", ctx.Err()
+	case res := <-ch:
+		if res.Err != nil {
+			return nil, "", res.Err
+		}
+
+		backend := res.Val.(proxy.Backend) //nolint:errcheck,forcetypeassert
+
+		return []proxy.Backend{backend}, clusterName, nil
+	}
+}
+
+func (r *Router) getConn(ctx context.Context, contextName string) (*grpc.ClientConn, error) {
+	clusterCredentials, err := r.getClusterCredentials(ctx, contextName)
+	if err != nil {
+		return nil, err
+	}
+
+	tlsConfig := &tls.Config{}
+
+	tlsConfig.RootCAs = x509.NewCertPool()
+
+	if ok := tlsConfig.RootCAs.AppendCertsFromPEM(clusterCredentials.CAPEM); !ok {
+		return nil, errors.New("failed to append CA certificate to RootCAs pool")
+	}
+
+	clientCert, err := tls.X509KeyPair(clusterCredentials.CertPEM, clusterCredentials.KeyPEM)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create TLS client certificate: %w", err)
+	}
+
+	tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
+	tlsConfig.Certificates = append(tlsConfig.Certificates, clientCert)
+
+	creds := credentials.NewTLS(tlsConfig)
+
+	backoffConfig := backoff.DefaultConfig
+	backoffConfig.MaxDelay = 15 * time.Second
+
+	endpoints := xslices.Map(clusterCredentials.Endpoints, func(endpoint string) string {
+		return net.JoinHostPort(endpoint, strconv.FormatInt(talosconstants.ApidPort, 10))
+	})
+
+	endpoint := fmt.Sprintf("%s:///%s", resolver.RoundRobinResolverScheme, strings.Join(endpoints, ","))
+
+	opts := []grpc.DialOption{
+		grpc.WithInitialWindowSize(65535 * 32),
+		grpc.WithInitialConnWindowSize(65535 * 16),
+		grpc.WithConnectParams(grpc.ConnectParams{
+			Backoff:           backoffConfig,
+			MinConnectTimeout: 20 * time.Second,
+		}),
+		grpc.WithTransportCredentials(creds),
+		grpc.WithCodec(proxy.Codec()), //nolint:staticcheck
+		grpc.WithSharedWriteBuffer(true),
+	}
+
+	return grpc.DialContext(
+		ctx,
+		endpoint,
+		opts...,
+	)
+}
+
+type talosClusterCredentials struct {
+	CAPEM     []byte
+	CertPEM   []byte
+	KeyPEM    []byte
+	Endpoints []string
+}
+
+func (r *Router) getClusterCredentials(ctx context.Context, clusterName string) (*talosClusterCredentials, error) {
+	if clusterName == "" {
+		return nil, status.Errorf(codes.InvalidArgument, "cluster name is not set")
+	}
+
+	secrets, err := safe.StateGet[*omni.ClusterSecrets](ctx, r.cosiState, omni.NewClusterSecrets(resources.DefaultNamespace, clusterName).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, status.Errorf(codes.NotFound, "cluster %q is not registered", clusterName)
+		}
+
+		return nil, err
+	}
+
+	// use the `os:impersonator` role here, set the required role directly in router.TalosBackend.GetConnection.
+	clientCert, CA, err := certs.TalosAPIClientCertificateFromSecrets(secrets, constants.CertificateValidityTime, role.MakeSet(role.Impersonator))
+	if err != nil {
+		return nil, err
+	}
+
+	clusterEndpoint, err := safe.StateGet[*omni.ClusterEndpoint](ctx, r.cosiState, omni.NewClusterEndpoint(resources.DefaultNamespace, clusterName).Metadata())
+	if err != nil {
+		return nil, err
+	}
+
+	endpoints := clusterEndpoint.TypedSpec().Value.ManagementAddresses
+
+	return &talosClusterCredentials{
+		Endpoints: endpoints,
+		CAPEM:     CA,
+		CertPEM:   clientCert.Crt,
+		KeyPEM:    clientCert.Key,
+	}, nil
+}
+
+// ClusterWatcher watches the cluster state and removes cached Talos API connections.
+func (r *Router) ClusterWatcher(ctx context.Context, s state.State) error {
+	events := make(chan state.Event)
+
+	if err := s.WatchKind(ctx, resource.NewMetadata(resources.DefaultNamespace, omni.ClusterType, "", resource.VersionUndefined), events); err != nil {
+		return err
+	}
+
+	if err := s.WatchKind(ctx, resource.NewMetadata(resources.DefaultNamespace, omni.ClusterSecretsType, "", resource.VersionUndefined), events); err != nil {
+		return err
+	}
+
+	if err := s.WatchKind(ctx, resource.NewMetadata(resources.DefaultNamespace, omni.ClusterEndpointType, "", resource.VersionUndefined), events); err != nil {
+		return err
+	}
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case e := <-events:
+			switch e.Type {
+			case state.Errored:
+				return fmt.Errorf("talos backend cluster watch failed: %w", e.Error)
+			case state.Bootstrapped:
+				// ignore
+			case state.Created, state.Updated, state.Destroyed:
+				// all resources have cluster name as the ID, drop the backend to make sure we have new connection established
+				r.removeBackend(e.Resource.Metadata().ID())
+			}
+		}
+	}
+}
+
+// ExtractContext reads cluster context from the supplied metadata.
+func ExtractContext(ctx context.Context) *common.Context {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return nil
+	}
+
+	return &common.Context{Name: getClusterName(md)}
+}
+
+func getClusterName(md metadata.MD) string {
+	get := func(key string) string {
+		vals := md.Get(key)
+		if vals == nil {
+			return ""
+		}
+
+		return vals[0]
+	}
+
+	if clusterName := get(message.ClusterHeaderKey); clusterName != "" {
+		return clusterName
+	}
+
+	return get(message.ContextHeaderKey)
+}
+
+// Describe implements prom.Collector interface.
+func (r *Router) Describe(ch chan<- *prometheus.Desc) {
+	prometheus.DescribeByCollect(r, ch)
+}
+
+// Collect implements prom.Collector interface.
+func (r *Router) Collect(ch chan<- prometheus.Metric) {
+	r.metricActiveClients.Collect(ch)
+
+	r.metricCacheSize.Set(float64(r.talosBackends.Len()))
+	r.metricCacheSize.Collect(ch)
+
+	r.metricCacheHits.Collect(ch)
+	r.metricCacheMisses.Collect(ch)
+}
+
+var _ prometheus.Collector = &Router{}
diff --git a/internal/backend/grpc/router/server.go b/internal/backend/grpc/router/server.go
new file mode 100644
index 000000000..d34378e0b
--- /dev/null
+++ b/internal/backend/grpc/router/server.go
@@ -0,0 +1,61 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package router
+
+import (
+	"context"
+
+	grpc_zap "github.com/grpc-ecosystem/go-grpc-middleware/logging/zap"
+	grpc_ctxtags "github.com/grpc-ecosystem/go-grpc-middleware/tags"
+	"github.com/siderolabs/grpc-proxy/proxy"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+
+	"github.com/siderolabs/omni/internal/pkg/grpcutil"
+)
+
+// Director is a gRPC proxy director.
+type Director interface {
+	Director(ctx context.Context, fullMethodName string) (proxy.Mode, []proxy.Backend, error)
+}
+
+// NewServer creates new gRPC server which routes request either to self or to Talos backend.
+func NewServer(router Director, options ...grpc.ServerOption) *grpc.Server {
+	opts := append(
+		[]grpc.ServerOption{
+			grpc.CustomCodec(proxy.Codec()), //nolint:staticcheck
+			grpc.UnknownServiceHandler(
+				proxy.TransparentHandler(
+					router.Director,
+				),
+			),
+			grpc.SharedWriteBuffer(true),
+		},
+		options...,
+	)
+
+	return grpc.NewServer(opts...)
+}
+
+// Interceptors returns gRPC interceptors for router.
+func Interceptors(logger *zap.Logger) grpc.ServerOption {
+	return grpc.ChainStreamInterceptor(
+		grpc_ctxtags.StreamServerInterceptor(),
+		grpc_zap.StreamServerInterceptor(logger, grpc_zap.WithMessageProducer(msgProducer)),
+		grpcutil.StreamSetUserAgent(),
+		grpcutil.StreamSetRealPeerAddress(),
+	)
+}
+
+func msgProducer(ctx context.Context, msg string, level zapcore.Level, code codes.Code, err error, duration zapcore.Field) {
+	if !grpcutil.ShouldLog(ctx) {
+		return
+	}
+
+	grpc_zap.DefaultMessageProducer(ctx, msg, level, code, err, duration)
+}
diff --git a/internal/backend/grpc/router/talos_backend.go b/internal/backend/grpc/router/talos_backend.go
new file mode 100644
index 000000000..daa129bad
--- /dev/null
+++ b/internal/backend/grpc/router/talos_backend.go
@@ -0,0 +1,197 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package router
+
+import (
+	"context"
+
+	"github.com/blang/semver"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/go-api-signature/pkg/message"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/siderolabs/talos/pkg/machinery/constants"
+	talosrole "github.com/siderolabs/talos/pkg/machinery/role"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+
+	"github.com/siderolabs/omni/internal/backend/dns"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/grpcutil"
+)
+
+// operatorMethodSet is the set of methods that are allowed to be called by the minimum role of os:operator.
+var operatorMethodSet = xslices.ToSet([]string{
+	grpcutil.MustFullMethodName(&machine.MachineService_ServiceDesc, "EtcdAlarmList"),
+	grpcutil.MustFullMethodName(&machine.MachineService_ServiceDesc, "EtcdAlarmDisarm"),
+	grpcutil.MustFullMethodName(&machine.MachineService_ServiceDesc, "EtcdDefragment"),
+	grpcutil.MustFullMethodName(&machine.MachineService_ServiceDesc, "EtcdStatus"),
+	grpcutil.MustFullMethodName(&machine.MachineService_ServiceDesc, "PacketCapture"),
+	grpcutil.MustFullMethodName(&machine.MachineService_ServiceDesc, "Reboot"),
+	grpcutil.MustFullMethodName(&machine.MachineService_ServiceDesc, "Restart"),
+	grpcutil.MustFullMethodName(&machine.MachineService_ServiceDesc, "ServiceRestart"),
+	grpcutil.MustFullMethodName(&machine.MachineService_ServiceDesc, "ServiceStart"),
+	grpcutil.MustFullMethodName(&machine.MachineService_ServiceDesc, "ServiceStop"),
+	grpcutil.MustFullMethodName(&machine.MachineService_ServiceDesc, "Shutdown"),
+})
+
+// TalosBackend implements a backend (proxying one2one to a Talos node).
+type TalosBackend struct {
+	conn         *grpc.ClientConn
+	nodeResolver NodeResolver
+	verifier     grpc.UnaryServerInterceptor
+	name         string
+	authEnabled  bool
+}
+
+// NewTalosBackend builds new Talos API backend.
+func NewTalosBackend(name string, nodeResolver NodeResolver, conn *grpc.ClientConn, authEnabled bool, verifier grpc.UnaryServerInterceptor) *TalosBackend {
+	backend := &TalosBackend{
+		name:         name,
+		nodeResolver: nodeResolver,
+		conn:         conn,
+		authEnabled:  authEnabled,
+		verifier:     verifier,
+	}
+
+	return backend
+}
+
+func (l *TalosBackend) String() string {
+	return l.name
+}
+
+// GetConnection returns a grpc connection to the backend.
+func (l *TalosBackend) GetConnection(ctx context.Context, fullMethodName string) (context.Context, *grpc.ClientConn, error) {
+	md, _ := metadata.FromIncomingContext(ctx)
+
+	// we can't use regular gRPC server interceptors here, as proxy interface is a bit different
+
+	// prepare context values for the verifier
+	ctx = context.WithValue(ctx, auth.EnabledAuthContextKey{}, l.authEnabled)
+	msg := message.NewGRPC(md, fullMethodName)
+	ctx = context.WithValue(ctx, auth.GRPCMessageContextKey{}, msg)
+
+	grpcutil.SetShouldLog(ctx, "talos-backend")
+	grpcutil.AddLogPair(ctx, "cluster", l.name)
+
+	// perform authentication, result of the authentication should be written to ctx
+	_, err := l.verifier(ctx, nil, nil,
+		func(innerCtx context.Context, _ any) (any, error) {
+			// save enhanced context
+			ctx = innerCtx
+
+			return nil, nil //nolint:nilnil
+		},
+	)
+	if err != nil {
+		// authentication failed
+		return ctx, nil, err
+	}
+
+	hasModifyAccess := false
+
+	_, modifyErr := auth.Check(ctx, auth.WithRole(role.Operator))
+	if modifyErr == nil {
+		hasModifyAccess = true
+	}
+
+	if !hasModifyAccess {
+		// at least read access is required
+		if _, err := auth.CheckGRPC(ctx, auth.WithRole(role.Reader)); err != nil {
+			return ctx, nil, err
+		}
+	}
+
+	// overwrite the node headers with the resolved ones
+	resolved := resolveNodes(l.nodeResolver, md)
+	if resolved.node.Address != "" {
+		md = md.Copy()
+
+		setHeaderData(ctx, md, "node", resolved.node.Address)
+	} else if len(resolved.nodes) > 0 {
+		md = md.Copy()
+
+		setHeaderData(ctx, md, "nodes", xslices.Map(resolved.nodes, func(info dns.Info) string {
+			return info.Address
+		})...)
+	}
+
+	l.setRoleHeaders(ctx, md, fullMethodName, resolved, hasModifyAccess)
+
+	outCtx := metadata.NewOutgoingContext(ctx, md)
+
+	return outCtx, l.conn, nil
+}
+
+func (l *TalosBackend) setRoleHeaders(ctx context.Context, md metadata.MD, fullMethodName string, resolvedInfo resolvedNodeInfo, hasModifyAccess bool) {
+	if !hasModifyAccess {
+		setHeaderData(ctx, md, constants.APIAuthzRoleMetadataKey, talosrole.MakeSet(talosrole.Reader).Strings()...)
+
+		return
+	}
+
+	minTalosVersion := l.minTalosVersion(resolvedInfo)
+
+	// min Talos version is >= 1.4.0, we can use Operator role
+	if minTalosVersion != nil && minTalosVersion.GTE(semver.MustParse("1.4.0")) {
+		setHeaderData(ctx, md, constants.APIAuthzRoleMetadataKey, talosrole.MakeSet(talosrole.Operator).Strings()...)
+
+		return
+	}
+
+	// min Talos version is unknown or < 1.4.0, fallback to backwards-compatibility logic
+	if _, ok := operatorMethodSet[fullMethodName]; ok {
+		setHeaderData(ctx, md, constants.APIAuthzRoleMetadataKey, talosrole.MakeSet(talosrole.Admin).Strings()...)
+	} else {
+		setHeaderData(ctx, md, constants.APIAuthzRoleMetadataKey, talosrole.MakeSet(talosrole.Reader).Strings()...)
+	}
+}
+
+func (l *TalosBackend) minTalosVersion(info resolvedNodeInfo) *semver.Version {
+	ver := takePtr(semver.ParseTolerant(info.node.TalosVersion))
+
+	for _, node := range info.nodes {
+		nodeVer := takePtr(semver.ParseTolerant(node.TalosVersion))
+		if nodeVer != nil && (ver == nil || nodeVer.LT(*ver)) {
+			ver = nodeVer
+		}
+	}
+
+	return ver
+}
+
+func takePtr[T any](v T, err error) *T {
+	if err != nil {
+		return nil
+	}
+
+	return &v
+}
+
+// AppendInfo is called to enhance response from the backend with additional data.
+func (l *TalosBackend) AppendInfo(_ bool, resp []byte) ([]byte, error) {
+	return resp, nil
+}
+
+// BuildError is called to convert error from upstream into response field.
+func (l *TalosBackend) BuildError(bool, error) ([]byte, error) {
+	return nil, nil
+}
+
+func setHeaderData(ctx context.Context, md metadata.MD, k string, v ...string) {
+	if len(v) == 0 {
+		return
+	}
+
+	md.Set(k, v...)
+
+	if len(v) == 1 {
+		grpcutil.AddLogPair(ctx, k, v[0])
+	} else {
+		grpcutil.AddLogPair(ctx, k, v)
+	}
+}
diff --git a/internal/backend/grpc/router/talos_backend_test.go b/internal/backend/grpc/router/talos_backend_test.go
new file mode 100644
index 000000000..06fab27b8
--- /dev/null
+++ b/internal/backend/grpc/router/talos_backend_test.go
@@ -0,0 +1,211 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package router_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"testing"
+	"time"
+
+	"github.com/siderolabs/gen/xtesting/must"
+	"github.com/siderolabs/grpc-proxy/proxy"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/siderolabs/talos/pkg/machinery/role"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/backoff"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/protobuf/types/known/emptypb"
+
+	"github.com/siderolabs/omni/internal/backend/dns"
+	"github.com/siderolabs/omni/internal/backend/grpc/router"
+)
+
+type testNodeResolver struct{}
+
+func (t *testNodeResolver) Resolve(_, node string) dns.Info {
+	return dns.Info{Address: node}
+}
+
+func TestTalosBackendRoles(t *testing.T) {
+	// Start mock server.
+	const serverEndpoint = "127.0.0.1:10501"
+	serverCloser := startTestServer(must.Value(net.Listen("tcp", serverEndpoint))(t))
+
+	t.Cleanup(func() { require.NoError(t, serverCloser()) })
+
+	// Start mock proxy.
+	const proxyEndpoint = "127.0.0.1:10500"
+
+	ctx, cancel := context.WithTimeout(context.Background(), 500*time.Second)
+	defer cancel()
+
+	g, ctx := errgroup.WithContext(ctx)
+
+	grpcProxy, err := makeGRPCProxy(ctx, proxyEndpoint, serverEndpoint)
+	require.NoError(t, err)
+
+	g.Go(grpcProxy)
+
+	t.Cleanup(func() { require.NoError(t, g.Wait()) })
+
+	conn := must.Value(grpc.DialContext(ctx, proxyEndpoint, grpc.WithTransportCredentials(insecure.NewCredentials())))(t)
+	rebootResult := must.Value(machine.NewMachineServiceClient(conn).Reboot(ctx, &machine.RebootRequest{Mode: 0}))(t)
+	require.NotNil(t, rebootResult)
+
+	hostnameResult := must.Value(machine.NewMachineServiceClient(conn).Hostname(ctx, &emptypb.Empty{}))(t)
+	require.Equal(t, "talos-machine", hostnameResult.Messages[0].Hostname)
+}
+
+func makeGRPCProxy(ctx context.Context, endpoint, serverEndpoint string) (func() error, error) {
+	grpcProxyServer := router.NewServer(&testDirector{serverEndpoint: serverEndpoint})
+
+	lis, err := net.Listen("tcp", endpoint)
+	if err != nil {
+		return nil, fmt.Errorf("failed to listen on %s: %w", endpoint, err)
+	}
+
+	return func() error {
+		errCh := make(chan error, 1)
+
+		go func() { errCh <- grpcProxyServer.Serve(lis) }()
+
+		if err, ok := recvContext(ctx, errCh); ok {
+			return fmt.Errorf("error running grpc proxy: %w", err)
+		}
+
+		grpcProxyServer.Stop()
+
+		if srvErr := <-errCh; srvErr != nil && !errors.Is(srvErr, grpc.ErrServerStopped) {
+			return fmt.Errorf("error stopping grpc proxy: %w", srvErr)
+		}
+
+		return nil
+	}, nil
+}
+
+type testDirector struct {
+	serverEndpoint string
+}
+
+func (t *testDirector) Director(ctx context.Context, _ string) (proxy.Mode, []proxy.Backend, error) {
+	conn, err := dial(ctx, t.serverEndpoint)
+	if err != nil {
+		return 0, nil, err
+	}
+
+	backend := router.NewTalosBackend(
+		"test-backend",
+		&testNodeResolver{},
+		conn,
+		false,
+		func(ctx context.Context, req any, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (resp interface{}, err error) {
+			return handler(ctx, req)
+		},
+	)
+
+	return proxy.One2One, []proxy.Backend{backend}, nil
+}
+
+func dial(ctx context.Context, serverEndpoint string) (*grpc.ClientConn, error) {
+	backoffConfig := backoff.DefaultConfig
+	backoffConfig.MaxDelay = 15 * time.Second
+
+	creds := insecure.NewCredentials()
+	opts := []grpc.DialOption{
+		grpc.WithInitialWindowSize(65535 * 32),
+		grpc.WithInitialConnWindowSize(65535 * 16),
+		grpc.WithConnectParams(grpc.ConnectParams{
+			Backoff:           backoffConfig,
+			MinConnectTimeout: 20 * time.Second,
+		}),
+		grpc.WithTransportCredentials(creds),
+		grpc.WithCodec(proxy.Codec()), //nolint:staticcheck
+		grpc.WithBlock(),
+	}
+
+	return grpc.DialContext(ctx, serverEndpoint, opts...)
+}
+
+func startTestServer(lis net.Listener) (closer func() error) {
+	server := grpc.NewServer()
+	machine.RegisterMachineServiceServer(server, &testServer{})
+
+	errCh := make(chan error, 1)
+
+	go func() { errCh <- server.Serve(lis) }()
+
+	return func() error {
+		if err, ok := tryRecv(errCh); ok {
+			return err
+		}
+
+		server.Stop()
+
+		return <-errCh
+	}
+}
+
+type testServer struct {
+	machine.UnimplementedMachineServiceServer
+}
+
+func (ts *testServer) Reboot(ctx context.Context, _ *machine.RebootRequest) (*machine.RebootResponse, error) {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return nil, errors.New("no metadata")
+	}
+
+	if got := md.Get("talos-role")[0]; got != string(role.Admin) {
+		return nil, fmt.Errorf("unexpected role: %s", got)
+	}
+
+	return &machine.RebootResponse{}, nil
+}
+
+func (ts *testServer) Hostname(ctx context.Context, _ *emptypb.Empty) (*machine.HostnameResponse, error) {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return nil, errors.New("no metadata")
+	}
+
+	if got := md.Get("talos-role")[0]; got != string(role.Reader) {
+		return nil, fmt.Errorf("unexpected role: %s", got)
+	}
+
+	return &machine.HostnameResponse{
+		Messages: []*machine.Hostname{
+			{
+				Hostname: "talos-machine",
+			},
+		},
+	}, nil
+}
+
+func tryRecv[T any](ch <-chan T) (T, bool) {
+	select {
+	case v := <-ch:
+		return v, true
+	default:
+		var zero T
+
+		return zero, false
+	}
+}
+
+func recvContext[T any](ctx context.Context, ch <-chan T) (T, bool) {
+	select {
+	case <-ctx.Done():
+		return *new(T), false
+	case v := <-ch:
+		return v, true
+	}
+}
diff --git a/internal/backend/grpc/schematics.go b/internal/backend/grpc/schematics.go
new file mode 100644
index 000000000..43fc9ad6c
--- /dev/null
+++ b/internal/backend/grpc/schematics.go
@@ -0,0 +1,126 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package grpc
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/image-factory/pkg/client"
+	"github.com/siderolabs/image-factory/pkg/schematic"
+	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/client/api/omni/management"
+	"github.com/siderolabs/omni/client/pkg/meta"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+// CreateSchematic implements ManagementServer.
+func (s *managementServer) CreateSchematic(ctx context.Context, request *management.CreateSchematicRequest) (*management.CreateSchematicResponse, error) {
+	// creating a schematic is equivalent to creating a machine
+	if _, err := auth.CheckGRPC(ctx, auth.WithRole(role.Operator)); err != nil {
+		return nil, err
+	}
+
+	params, err := safe.StateGet[*siderolink.ConnectionParams](ctx, s.omniState, siderolink.NewConnectionParams(
+		resources.DefaultNamespace,
+		siderolink.ConfigID,
+	).Metadata())
+	if err != nil {
+		return nil, fmt.Errorf("failed to get Omni connection params for the extra kernel arguments: %w", err)
+	}
+
+	customization := schematic.Customization{
+		ExtraKernelArgs: append(strings.Split(params.TypedSpec().Value.Args, " "), request.ExtraKernelArgs...),
+		SystemExtensions: schematic.SystemExtensions{
+			OfficialExtensions: request.Extensions,
+		},
+	}
+
+	for key, value := range request.MetaValues {
+		if !meta.CanSetMetaKey(int(key)) {
+			return nil, status.Errorf(codes.InvalidArgument, "meta key %s is not allowed to be set in the schematic, as it's reserved by Talos", runtime.MetaKeyTagToID(uint8(key)))
+		}
+
+		customization.Meta = append(customization.Meta, schematic.MetaValue{
+			Key:   uint8(key),
+			Value: value,
+		})
+	}
+
+	slices.SortFunc(customization.Meta, func(a, b schematic.MetaValue) int {
+		switch {
+		case a.Key < b.Key:
+			return 1
+		case a.Key > b.Key:
+			return -1
+		}
+
+		return 0
+	})
+
+	schematic := schematic.Schematic{
+		Customization: customization,
+	}
+
+	schematicID, err := schematic.ID()
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate schematic ID: %w", err)
+	}
+
+	schematicResource := omni.NewSchematic(
+		resources.DefaultNamespace, schematicID,
+	)
+
+	res, err := safe.StateGet[*omni.Schematic](ctx, s.omniState, schematicResource.Metadata())
+	if err != nil && !state.IsNotFoundError(err) {
+		return nil, err
+	}
+
+	pxeURL, err := config.Config.GetImageFactoryPXEBaseURL()
+	if err != nil {
+		return nil, err
+	}
+
+	response := &management.CreateSchematicResponse{
+		SchematicId: schematicID,
+		PxeUrl:      pxeURL.JoinPath("pxe", schematicID).String(),
+	}
+
+	if res != nil {
+		return response, nil
+	}
+
+	client, err := client.New(config.Config.ImageFactoryBaseURL)
+	if err != nil {
+		return nil, err
+	}
+
+	response.SchematicId, err = client.SchematicCreate(ctx, schematic)
+	if err != nil {
+		return nil, err
+	}
+
+	schematicResource.TypedSpec().Value.Extensions = request.Extensions
+
+	if err = s.omniState.Create(actor.MarkContextAsInternalActor(ctx), schematicResource); err != nil && !state.IsConflictError(err) {
+		return nil, err
+	}
+
+	return response, nil
+}
diff --git a/internal/backend/grpc/schematics_test.go b/internal/backend/grpc/schematics_test.go
new file mode 100644
index 000000000..350dcd843
--- /dev/null
+++ b/internal/backend/grpc/schematics_test.go
@@ -0,0 +1,261 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package grpc_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/julienschmidt/httprouter"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/image-factory/pkg/schematic"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/client/api/omni/management"
+	"github.com/siderolabs/omni/client/pkg/meta"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+type imageFactoryMock struct {
+	listener   net.Listener
+	schematics map[string]schematic.Schematic
+	eg         errgroup.Group
+	address    string
+
+	schematicMu sync.Mutex
+}
+
+func (m *imageFactoryMock) run() error {
+	var err error
+
+	m.listener, err = net.Listen("tcp", ":0")
+	if err != nil {
+		return err
+	}
+
+	m.address = fmt.Sprintf("http://%s", m.listener.Addr().String())
+
+	return nil
+}
+
+func (m *imageFactoryMock) serve(ctx context.Context) {
+	router := httprouter.New()
+	router.POST("/schematics", m.handleSchematics)
+
+	server := http.Server{
+		Handler: router,
+	}
+
+	m.eg.Go(func() error {
+		if err := server.Serve(m.listener); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			return err
+		}
+
+		return nil
+	})
+
+	m.eg.Go(func() error {
+		<-ctx.Done()
+
+		innerContext, cancel := context.WithTimeout(ctx, time.Second)
+
+		defer cancel()
+
+		return server.Shutdown(innerContext)
+	})
+}
+
+func (m *imageFactoryMock) handleSchematics(rw http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+	m.schematicMu.Lock()
+	defer m.schematicMu.Unlock()
+
+	id, err := m.saveSchematic(r)
+	if err != nil {
+		rw.WriteHeader(http.StatusInternalServerError)
+		rw.Write([]byte(err.Error())) //nolint:errcheck
+
+		return
+	}
+
+	rw.Header().Add("Content-Type", "application/json")
+	rw.WriteHeader(http.StatusCreated)
+
+	resp, err := json.Marshal(struct {
+		ID string `json:"id"`
+	}{
+		ID: id,
+	})
+	if err != nil {
+		rw.WriteHeader(http.StatusInternalServerError)
+		rw.Write([]byte(err.Error())) //nolint:errcheck
+
+		return
+	}
+
+	rw.Write(resp) //nolint:errcheck
+}
+
+func (m *imageFactoryMock) saveSchematic(r *http.Request) (string, error) {
+	data, err := io.ReadAll(r.Body)
+	if err != nil {
+		return "", err
+	}
+
+	if err = r.Body.Close(); err != nil {
+		return "", err
+	}
+
+	cfg, err := schematic.Unmarshal(data)
+	if err != nil {
+		return "", err
+	}
+
+	id, err := cfg.ID()
+	if err != nil {
+		return "", err
+	}
+
+	if m.schematics == nil {
+		m.schematics = map[string]schematic.Schematic{}
+	}
+
+	m.schematics[id] = *cfg
+
+	return id, nil
+}
+
+func (suite *GrpcSuite) TestSchematicCreate() {
+	ctx, cancel := context.WithTimeout(suite.ctx, time.Second*5)
+	defer cancel()
+
+	params := siderolink.NewConnectionParams(resources.DefaultNamespace, siderolink.ConfigID)
+	params.TypedSpec().Value.Args = "arg=value"
+
+	suite.Require().NoError(suite.state.Create(ctx, params))
+
+	factory := imageFactoryMock{}
+	suite.Require().NoError(factory.run())
+
+	factory.serve(ctx)
+
+	defer func() {
+		cancel()
+
+		suite.Require().NoError(factory.eg.Wait())
+	}()
+
+	config.Config.ImageFactoryBaseURL = factory.address
+
+	client := management.NewManagementServiceClient(suite.conn)
+
+	for _, tt := range []struct {
+		request       *management.CreateSchematicRequest
+		expectedError func(*testing.T, error)
+		name          string
+	}{
+		{
+			name:    "empty",
+			request: &management.CreateSchematicRequest{},
+		},
+		{
+			name: "with extensions",
+			request: &management.CreateSchematicRequest{
+				Extensions: []string{
+					"github.com/my/cool-extension",
+				},
+			},
+		},
+		{
+			name: "with extensions and labels",
+			request: &management.CreateSchematicRequest{
+				Extensions: []string{
+					"github.com/my/another-one",
+				},
+				MetaValues: map[uint32]string{
+					meta.LabelsMeta: "",
+				},
+			},
+		},
+		{
+			name: "with extensions, labels and extra kernel args",
+			request: &management.CreateSchematicRequest{
+				Extensions: []string{
+					"github.com/my/another-one",
+				},
+				MetaValues: map[uint32]string{
+					meta.LabelsMeta:                 "",
+					meta.MetalNetworkPlatformConfig: "{}",
+				},
+				ExtraKernelArgs: []string{
+					"ip=127.0.0.1",
+					"another=value",
+				},
+			},
+		},
+		{
+			name: "fail to set protected meta key",
+			request: &management.CreateSchematicRequest{
+				Extensions: []string{
+					"github.com/my/another-one",
+				},
+				MetaValues: map[uint32]string{
+					meta.StateEncryptionConfig: "",
+				},
+			},
+			expectedError: func(t *testing.T, err error) {
+				require.Equal(t, codes.InvalidArgument, status.Code(err))
+			},
+		},
+	} {
+		req := tt.request
+
+		suite.T().Run(tt.name, func(t *testing.T) {
+			resp, err := client.CreateSchematic(ctx, req)
+			if tt.expectedError != nil {
+				tt.expectedError(t, err)
+
+				return
+			}
+
+			require.NoError(t, err)
+			require.NotEmpty(t, resp.SchematicId)
+
+			rtestutils.AssertResource(ctx, t, suite.state, resp.SchematicId, func(res *omni.Schematic, assert *assert.Assertions) {
+				assert.EqualValues(req.Extensions, res.TypedSpec().Value.Extensions)
+			})
+
+			factory.schematicMu.Lock()
+			defer factory.schematicMu.Unlock()
+
+			config, ok := factory.schematics[resp.SchematicId]
+			require.Truef(t, ok, "the schematic id %q doesn't exist in the image factory", resp.SchematicId)
+
+			meta := xslices.ToMap(config.Customization.Meta, func(k schematic.MetaValue) (uint32, string) {
+				return uint32(k.Key), k.Value
+			})
+
+			require.EqualValues(t, req.MetaValues, meta)
+			require.Equal(t, strings.Join(append([]string{params.TypedSpec().Value.Args}, req.ExtraKernelArgs...), " "), strings.Join(config.Customization.ExtraKernelArgs, " "))
+		})
+	}
+}
diff --git a/internal/backend/grpc/serviceaccount.go b/internal/backend/grpc/serviceaccount.go
new file mode 100644
index 000000000..5599bb0de
--- /dev/null
+++ b/internal/backend/grpc/serviceaccount.go
@@ -0,0 +1,138 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package grpc
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/golang-jwt/jwt/v4"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"k8s.io/client-go/tools/clientcmd"
+	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
+
+	"github.com/siderolabs/omni/client/api/omni/management"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/grpc/router"
+	"github.com/siderolabs/omni/internal/backend/oidc/external"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+func (s *managementServer) serviceAccountKubeconfig(ctx context.Context, req *management.KubeconfigRequest) (*management.KubeconfigResponse, error) {
+	if _, err := auth.CheckGRPC(ctx, auth.WithRole(role.Operator)); err != nil {
+		return nil, err
+	}
+
+	cluster := router.ExtractContext(ctx).Name
+
+	if err := s.validateServiceAccountRequest(cluster, req); err != nil {
+		return nil, err
+	}
+
+	clusterUUID, err := safe.StateGetByID[*omni.ClusterUUID](ctx, s.omniState, cluster)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get cluster UUID: %w", err)
+	}
+
+	signedToken, err := s.generateServiceAccountJWT(req, cluster, clusterUUID.TypedSpec().Value.GetUuid())
+	if err != nil {
+		return nil, err
+	}
+
+	kubeconfig, err := s.buildServiceAccountKubeconfig(cluster, req.GetServiceAccountUser(), signedToken)
+	if err != nil {
+		return nil, err
+	}
+
+	return &management.KubeconfigResponse{
+		Kubeconfig: kubeconfig,
+	}, nil
+}
+
+func (s *managementServer) validateServiceAccountRequest(cluster string, req *management.KubeconfigRequest) error {
+	if cluster == "" {
+		return status.Error(codes.InvalidArgument, "cluster name is not in context")
+	}
+
+	if req.GetServiceAccountUser() == "" {
+		return status.Error(codes.InvalidArgument, "service account user name is not set")
+	}
+
+	if req.GetServiceAccountTtl() == nil {
+		return status.Error(codes.InvalidArgument, "service account ttl is not set")
+	}
+
+	ttl := req.GetServiceAccountTtl().AsDuration()
+
+	if ttl <= 0 {
+		return status.Error(codes.InvalidArgument, "service account ttl is must be positive")
+	}
+
+	if ttl > external.ServiceAccountTokenLifetime {
+		return status.Errorf(codes.InvalidArgument, "service account ttl is too long (max allowed: %s)", external.ServiceAccountTokenLifetime)
+	}
+
+	return nil
+}
+
+func (s *managementServer) generateServiceAccountJWT(req *management.KubeconfigRequest, clusterName, clusterUUID string) (string, error) {
+	signingKey, err := s.jwtSigningKeyProvider.GetCurrentSigningKey()
+	if err != nil {
+		return "", err
+	}
+
+	signingMethod := jwt.GetSigningMethod(signingKey.Algorithm)
+
+	now := time.Now()
+	token := jwt.NewWithClaims(signingMethod, jwt.MapClaims{
+		"iat":          now.Unix(),
+		"iss":          fmt.Sprintf("omni-%s-service-account-issuer", config.Config.Name),
+		"exp":          now.Add(req.GetServiceAccountTtl().AsDuration()).Unix(),
+		"sub":          req.GetServiceAccountUser(),
+		"groups":       req.GetServiceAccountGroups(),
+		"cluster":      clusterName,
+		"cluster_uuid": clusterUUID,
+	})
+
+	token.Header["kid"] = signingKey.KeyID
+
+	return token.SignedString(signingKey.Key)
+}
+
+func (s *managementServer) buildServiceAccountKubeconfig(cluster, user, token string) ([]byte, error) {
+	clusterName := config.Config.Name + "-" + cluster + "-" + user
+	contextName := clusterName
+
+	conf := clientcmdapi.Config{
+		APIVersion:     "v1",
+		Kind:           "Config",
+		CurrentContext: contextName,
+		Clusters: map[string]*clientcmdapi.Cluster{
+			clusterName: {
+				Server: config.Config.KubernetesProxyURL,
+			},
+		},
+		Contexts: map[string]*clientcmdapi.Context{
+			contextName: {
+				Cluster:   clusterName,
+				Namespace: "default",
+				AuthInfo:  clusterName,
+			},
+		},
+		AuthInfos: map[string]*clientcmdapi.AuthInfo{
+			clusterName: {
+				Token: token,
+			},
+		},
+	}
+
+	return clientcmd.Write(conf)
+}
diff --git a/internal/backend/grpc/validate.go b/internal/backend/grpc/validate.go
new file mode 100644
index 000000000..4059e3489
--- /dev/null
+++ b/internal/backend/grpc/validate.go
@@ -0,0 +1,72 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package grpc
+
+import (
+	"errors"
+	"time"
+
+	pgpcrypto "github.com/ProtonMail/gopenpgp/v2/crypto"
+	authpb "github.com/siderolabs/go-api-signature/api/auth"
+	"github.com/siderolabs/go-api-signature/pkg/pgp"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+type publicKey struct {
+	expiration time.Time
+	id         string
+	username   string
+	data       []byte
+}
+
+// validatePublicKey validates the public key in the request and returns a publicKey.
+func validatePublicKey(keypb *authpb.PublicKey, opts ...pgp.ValidationOption) (publicKey, error) {
+	if keypb.GetPgpData() == nil && keypb.GetWebauthnData() == nil {
+		return publicKey{}, errors.New("no public key data provided")
+	}
+
+	if keypb.GetWebauthnData() != nil {
+		return publicKey{}, status.Error(codes.Unimplemented, "unimplemented") // todo: implement webauthn
+	}
+
+	return validatePGPPublicKey(keypb.GetPgpData(), opts...)
+}
+
+func validatePGPPublicKey(armored []byte, opts ...pgp.ValidationOption) (publicKey, error) {
+	pgpKey, err := pgpcrypto.NewKeyFromArmored(string(armored))
+	if err != nil {
+		return publicKey{}, err
+	}
+
+	key, err := pgp.NewKey(pgpKey)
+	if err != nil {
+		return publicKey{}, err
+	}
+
+	err = key.Validate(opts...)
+	if err != nil {
+		return publicKey{}, err
+	}
+
+	if key.IsPrivate() {
+		return publicKey{}, errors.New("PGP key contains private key")
+	}
+
+	lifetimeSecs := pgpKey.GetEntity().PrimaryIdentity().SelfSignature.KeyLifetimeSecs
+	if lifetimeSecs == nil {
+		return publicKey{}, errors.New("PGP key has no expiration")
+	}
+
+	expiration := pgpKey.GetEntity().PrimaryKey.CreationTime.Add(time.Duration(*lifetimeSecs) * time.Second)
+
+	return publicKey{
+		data:       armored,
+		id:         pgpKey.GetFingerprint(),
+		username:   pgpKey.GetEntity().PrimaryIdentity().UserId.Name,
+		expiration: expiration,
+	}, nil
+}
diff --git a/internal/backend/health/health.go b/internal/backend/health/health.go
new file mode 100644
index 000000000..d61a6e348
--- /dev/null
+++ b/internal/backend/health/health.go
@@ -0,0 +1,67 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package health defines health check endpoints for omni
+package health
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+)
+
+// Handler of health requests.
+type Handler struct {
+	state  state.State
+	ptr    resource.Pointer
+	logger *zap.Logger
+}
+
+// NewHandler creates http handler wrapper which reports health status.
+func NewHandler(state state.State, logger *zap.Logger) http.Handler {
+	return &Handler{
+		state:  state,
+		ptr:    omni.NewTalosVersion(resources.DefaultNamespace, "health-check").Metadata(),
+		logger: logger,
+	}
+}
+
+// ServeHTTP handles health check requests.
+func (handler *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	io.Copy(io.Discard, r.Body) //nolint:errcheck
+	r.Body.Close()              //nolint:errcheck
+
+	switch r.Method {
+	case http.MethodGet, http.MethodHead:
+		// supported
+	default:
+		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+
+		return
+	}
+
+	switch r.URL.Path {
+	case "/", "/healthz":
+		ctx, cancel := context.WithTimeout(actor.MarkContextAsInternalActor(r.Context()), 1*time.Second)
+		defer cancel()
+
+		if _, err := handler.state.Get(ctx, handler.ptr); !state.IsNotFoundError(err) {
+			handler.logger.Error("unexpected error on health check", zap.Error(err))
+
+			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		}
+	default:
+		http.Error(w, "Not found", http.StatusNotFound)
+	}
+}
diff --git a/internal/backend/k8sproxy/export_test.go b/internal/backend/k8sproxy/export_test.go
new file mode 100644
index 000000000..fc8dbf194
--- /dev/null
+++ b/internal/backend/k8sproxy/export_test.go
@@ -0,0 +1,12 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package k8sproxy
+
+// ClusterContextKey is exposed for testing.
+type ClusterContextKey = clusterContextKey
+
+// Claims is exposed for testing.
+type Claims = claims
diff --git a/internal/backend/k8sproxy/jwt.go b/internal/backend/k8sproxy/jwt.go
new file mode 100644
index 000000000..4866058d1
--- /dev/null
+++ b/internal/backend/k8sproxy/jwt.go
@@ -0,0 +1,52 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package k8sproxy
+
+import (
+	"github.com/golang-jwt/jwt/v4"
+)
+
+// claims represents a JWT claims.
+//
+// Kubernetes proxy expects all three claims to be present in the token.
+type claims struct {
+	jwt.RegisteredClaims
+
+	// Cluster is the name of the cluster.
+	// For legacy JWTs in which ClusterUUID is not present, this field is used as the source of truth.
+	// For all new JWTs issued, ClusterUUID field is used as the source of truth, and this field is solely checked if it matches with the UUID.
+	Cluster string `json:"cluster"`
+
+	// ClusterUUID is the UUID of the cluster.
+	ClusterUUID string `json:"cluster_uuid"`
+
+	// Groups are the groups the subject belongs to.
+	Groups []string `json:"groups"`
+}
+
+func (claims *claims) Valid() error {
+	if err := claims.RegisteredClaims.Valid(); err != nil {
+		return err
+	}
+
+	if claims.ExpiresAt == nil {
+		return jwt.NewValidationError("expiration is empty", jwt.ValidationErrorClaimsInvalid)
+	}
+
+	if claims.Cluster == "" {
+		return jwt.NewValidationError("cluster is empty", jwt.ValidationErrorClaimsInvalid)
+	}
+
+	if claims.Subject == "" {
+		return jwt.NewValidationError("subject is empty", jwt.ValidationErrorClaimsInvalid)
+	}
+
+	if len(claims.Groups) == 0 {
+		return jwt.NewValidationError("groups is empty", jwt.ValidationErrorClaimsInvalid)
+	}
+
+	return nil
+}
diff --git a/internal/backend/k8sproxy/jwt_test.go b/internal/backend/k8sproxy/jwt_test.go
new file mode 100644
index 000000000..7b8b65ba2
--- /dev/null
+++ b/internal/backend/k8sproxy/jwt_test.go
@@ -0,0 +1,132 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package k8sproxy_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/internal/backend/k8sproxy"
+)
+
+func TestJWTValidation(t *testing.T) {
+	for _, tt := range []struct { //nolint:govet
+		name                  string
+		claims                k8sproxy.Claims
+		expectedErrorContains string
+	}{
+		{
+			name: "missing-subject",
+			claims: k8sproxy.Claims{
+				RegisteredClaims: jwt.RegisteredClaims{
+					Issuer:    "issuer",
+					Subject:   "",
+					ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
+				},
+				Cluster: "cluster-a",
+				Groups:  []string{"group-a"},
+			},
+			expectedErrorContains: "subject is empty",
+		},
+		{
+			name: "missing-cluster",
+			claims: k8sproxy.Claims{
+				RegisteredClaims: jwt.RegisteredClaims{
+					Issuer:    "issuer",
+					Subject:   "subject-a",
+					ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
+				},
+				Cluster: "",
+				Groups:  []string{"group-a"},
+			},
+			expectedErrorContains: "cluster is empty",
+		},
+		{
+			name: "missing-expiration",
+			claims: k8sproxy.Claims{
+				RegisteredClaims: jwt.RegisteredClaims{
+					Issuer:    "issuer",
+					Subject:   "subject-a",
+					ExpiresAt: nil,
+				},
+				Cluster: "cluster-a",
+				Groups:  []string{"group-a"},
+			},
+			expectedErrorContains: "expiration is empty",
+		},
+		{
+			name: "no-groups",
+			claims: k8sproxy.Claims{
+				RegisteredClaims: jwt.RegisteredClaims{
+					Issuer:    "issuer",
+					Subject:   "subject-a",
+					ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
+				},
+				Cluster: "cluster-a",
+				Groups:  []string{},
+			},
+			expectedErrorContains: "groups is empty",
+		},
+		{
+			name: "expired",
+			claims: k8sproxy.Claims{
+				RegisteredClaims: jwt.RegisteredClaims{
+					Issuer:    "issuer",
+					Subject:   "subject-a",
+					ExpiresAt: jwt.NewNumericDate(time.Now().Add(-time.Hour)),
+				},
+				Cluster: "cluster-a",
+				Groups:  []string{"group-a"},
+			},
+			expectedErrorContains: "token is expired by",
+		},
+		{
+			name: "not-yet-valid",
+			claims: k8sproxy.Claims{
+				RegisteredClaims: jwt.RegisteredClaims{
+					Issuer:    "issuer",
+					Subject:   "subject-a",
+					ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
+					NotBefore: jwt.NewNumericDate(time.Now().Add(time.Hour)),
+				},
+				Cluster: "cluster-a",
+				Groups:  []string{"group-a"},
+			},
+			expectedErrorContains: "token is not valid yet",
+		},
+		{
+			name: "valid",
+			claims: k8sproxy.Claims{
+				RegisteredClaims: jwt.RegisteredClaims{
+					Issuer:    "issuer",
+					Subject:   "subject-a",
+					ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
+					NotBefore: jwt.NewNumericDate(time.Now().Add(-time.Hour)),
+				},
+				Cluster: "cluster-a",
+				Groups:  []string{"group-a"},
+			},
+			expectedErrorContains: "",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.claims.Valid()
+
+			if tt.expectedErrorContains != "" {
+				var validationError *jwt.ValidationError
+
+				require.ErrorAs(t, err, &validationError)
+				assert.ErrorContains(t, validationError, tt.expectedErrorContains)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
diff --git a/internal/backend/k8sproxy/k8sproxy.go b/internal/backend/k8sproxy/k8sproxy.go
new file mode 100644
index 000000000..cc3202c94
--- /dev/null
+++ b/internal/backend/k8sproxy/k8sproxy.go
@@ -0,0 +1,78 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package k8sproxy provides JWT-authenticated proxy to Kubernetes API server.
+package k8sproxy
+
+import (
+	"net/http"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime/kubernetes"
+)
+
+// clusterContextKey is a type for cluster name.
+type clusterContextKey struct{}
+
+// Handler implements the HTTP reverse proxy for Kubernetes clusters.
+//
+// Handler intercepts the request, verifies the authentication info and
+// routes the request to matching Kubernetes cluster with impersonation headers.
+//
+// Handler itself implements httt.Handler interface.
+type Handler struct {
+	multiplexer *multiplexer
+	chain       http.Handler
+}
+
+// NewHandler creates a new Handler.
+func NewHandler(keyFunc KeyProvider, clusterUUIDResolver ClusterUUIDResolver, logger *zap.Logger) (*Handler, error) {
+	multiplexer := newMultiplexer()
+	proxy := newProxyHandler(multiplexer, logger)
+
+	handler := &Handler{
+		multiplexer: multiplexer,
+		chain:       AuthorizeRequest(proxy, keyFunc, clusterUUIDResolver),
+	}
+
+	type kubeRuntime interface {
+		RegisterCleanuper(kubernetes.ClusterCleanuper)
+	}
+
+	r, err := runtime.LookupInterface[kubeRuntime](kubernetes.Name)
+	if err != nil {
+		return nil, err
+	}
+
+	// register self as  cluster cleanuper
+	r.RegisterCleanuper(handler)
+
+	return handler, nil
+}
+
+// ServeHTTP implements http.Handler interface.
+func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	h.chain.ServeHTTP(w, r)
+}
+
+// ClusterRemove implements ClusterCleanuper interface.
+func (h *Handler) ClusterRemove(clusterName string) {
+	h.multiplexer.removeClusterConnector(clusterName)
+}
+
+// Describe implements prom.Collector interface.
+func (h *Handler) Describe(ch chan<- *prometheus.Desc) {
+	h.multiplexer.Describe(ch)
+}
+
+// Collect implements prom.Collector interface.
+func (h *Handler) Collect(ch chan<- prometheus.Metric) {
+	h.multiplexer.Collect(ch)
+}
+
+var _ prometheus.Collector = &Handler{}
diff --git a/internal/backend/k8sproxy/middleware.go b/internal/backend/k8sproxy/middleware.go
new file mode 100644
index 000000000..5df7f3e2c
--- /dev/null
+++ b/internal/backend/k8sproxy/middleware.go
@@ -0,0 +1,125 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package k8sproxy
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
+	grpc_ctxtags "github.com/grpc-ecosystem/go-grpc-middleware/tags"
+	"go.uber.org/zap"
+	"k8s.io/client-go/transport"
+)
+
+const authorizationHeader = "Authorization"
+
+// KeyProvider implements a function which returns a public key with a given key ID to verify JWT token.
+type KeyProvider func(ctx context.Context, keyID string) (any, error)
+
+// ClusterUUIDResolver resolves a cluster ID to its UUID.
+type ClusterUUIDResolver func(ctx context.Context, clusterID resource.ID) (string, error)
+
+// AuthorizeRequest checks for valid token in the request.
+func AuthorizeRequest(next http.Handler, keyFunc KeyProvider, clusterUUIDResolver ClusterUUIDResolver) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		ctx := req.Context()
+
+		authorization := req.Header.Get(authorizationHeader)
+
+		bearer, tok, ok := strings.Cut(authorization, " ")
+		if !ok || bearer != "Bearer" {
+			ctxzap.Error(ctx, "invalid authorization header")
+
+			w.WriteHeader(http.StatusUnauthorized)
+
+			return
+		}
+
+		token, err := jwt.ParseWithClaims(tok, &claims{}, func(token *jwt.Token) (any, error) {
+			if token.Method.Alg() != jwt.SigningMethodRS256.Alg() {
+				return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+			}
+
+			keyID, ok := token.Header["kid"].(string)
+			if !ok {
+				ctxzap.Error(ctx, "invalid token header", zap.Any("header", token.Header))
+
+				return nil, errors.New("invalid token header")
+			}
+
+			return keyFunc(ctx, keyID)
+		})
+		if err != nil {
+			ctxzap.Error(ctx, "failed to validate JWT token", zap.Error(err))
+
+			w.WriteHeader(http.StatusUnauthorized)
+			w.Write([]byte(err.Error())) //nolint:errcheck
+
+			return
+		}
+
+		claims, _ := token.Claims.(*claims) //nolint:errcheck
+		clusterName := claims.Cluster
+		clusterUUID := claims.ClusterUUID
+
+		grpc_ctxtags.Extract(req.Context()).
+			Set("cluster", clusterName).
+			Set("cluster_uuid", clusterUUID).
+			Set("impersonate.user", claims.Subject).
+			Set("impersonate.groups", claims.Groups)
+
+		if clusterName == "" {
+			ctxzap.Error(ctx, "cluster name is empty")
+
+			w.WriteHeader(http.StatusUnauthorized)
+
+			return
+		}
+
+		// Allow JWTs without cluster UUID for backwards compatibility - use their "cluster" claim as the target cluster.
+		// If this is a newer JWT with the "cluster_uuid" claim, get the matching cluster uuid and validate it against the "cluster_uuid" claim.
+		if clusterUUID != "" {
+			resolvedClusterUUID, err := clusterUUIDResolver(ctx, clusterName)
+			if err != nil {
+				ctxzap.Error(ctx, "failed to resolve cluster UUID", zap.Error(err))
+
+				w.WriteHeader(http.StatusUnauthorized)
+
+				return
+			}
+
+			if resolvedClusterUUID != clusterUUID {
+				ctxzap.Error(ctx, "cluster UUID does not match cluster name")
+
+				w.WriteHeader(http.StatusUnauthorized)
+
+				return
+			}
+		}
+
+		// clone the request before modifying it
+		req = req.WithContext(context.WithValue(ctx, clusterContextKey{}, clusterName))
+
+		// clean all headers which are going to be overridden
+		req.Header.Del(authorizationHeader)
+		req.Header.Del(transport.ImpersonateUserHeader)
+		req.Header.Del(transport.ImpersonateGroupHeader)
+
+		req.Header.Add(transport.ImpersonateUserHeader, claims.Subject)
+
+		for _, group := range claims.Groups {
+			req.Header.Add(transport.ImpersonateGroupHeader, group)
+		}
+
+		next.ServeHTTP(w, req)
+	})
+}
diff --git a/internal/backend/k8sproxy/middleware_test.go b/internal/backend/k8sproxy/middleware_test.go
new file mode 100644
index 000000000..55e7f6c4f
--- /dev/null
+++ b/internal/backend/k8sproxy/middleware_test.go
@@ -0,0 +1,284 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package k8sproxy_test
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/golang-jwt/jwt/v4"
+	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap/zaptest"
+	"k8s.io/client-go/transport"
+
+	"github.com/siderolabs/omni/internal/backend/k8sproxy"
+)
+
+var mockClusterUUIDResolver = func(_ context.Context, clusterID resource.ID) (string, error) {
+	upper := strings.ToUpper(clusterID)
+	if upper == clusterID {
+		return "", fmt.Errorf("invalid test cluster ID - does not contain lowercase: %s", clusterID)
+	}
+
+	return upper, nil
+}
+
+type mockClaims struct {
+	ExpiresAt   *jwt.NumericDate `json:"exp,omitempty"`
+	Cluster     string           `json:"cluster,omitempty"`
+	ClusterUUID string           `json:"cluster_uuid,omitempty"`
+	Subject     string           `json:"sub,omitempty"`
+	Groups      []string         `json:"groups,omitempty"`
+}
+
+func (c *mockClaims) Valid() error {
+	return nil
+}
+
+func TestAuthorize(t *testing.T) {
+	reqCh := make(chan *http.Request, 1)
+
+	coreHandler := http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
+		reqCh <- r.Clone(r.Context())
+	})
+
+	key1, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	key2, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+
+	keyFunc := func(_ context.Context, keyID string) (any, error) {
+		switch keyID {
+		case "1":
+			return &key1.PublicKey, nil
+		case "2":
+			return &key2.PublicKey, nil
+		default:
+			return nil, errors.New("unknown key")
+		}
+	}
+
+	ts := httptest.NewServer(k8sproxy.AuthorizeRequest(coreHandler, keyFunc, mockClusterUUIDResolver))
+	defer ts.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	logger := zaptest.NewLogger(t)
+
+	ctx = ctxzap.ToContext(ctx, logger)
+
+	type testCase struct { //nolint:govet
+		name string
+
+		claims       mockClaims
+		kid          string
+		signingKey   *rsa.PrivateKey
+		extraHeaders map[string]string
+
+		expectedCode int
+
+		expectedImpersonateUser   string
+		expectedImpersonateGroups []string
+		expectedCluster           string
+	}
+
+	testCases := []testCase{
+		{
+			name: "valid key - legacy with cluster name",
+			claims: mockClaims{
+				Cluster:   "cluster1",
+				Subject:   "user1",
+				Groups:    []string{"group1", "group2"},
+				ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
+			},
+			kid:        "1",
+			signingKey: key1,
+
+			expectedCode: http.StatusOK,
+
+			expectedImpersonateUser:   "user1",
+			expectedImpersonateGroups: []string{"group1", "group2"},
+			expectedCluster:           "cluster1",
+		},
+		{
+			name: "valid key1",
+			claims: mockClaims{
+				Cluster:     "cluster1",
+				ClusterUUID: "CLUSTER1",
+				Subject:     "user1",
+				Groups:      []string{"group1", "group2"},
+				ExpiresAt:   jwt.NewNumericDate(time.Now().Add(time.Hour)),
+			},
+			kid:        "1",
+			signingKey: key1,
+
+			expectedCode: http.StatusOK,
+
+			expectedImpersonateUser:   "user1",
+			expectedImpersonateGroups: []string{"group1", "group2"},
+			expectedCluster:           "cluster1",
+		},
+		{
+			name: "valid key2 + extra headers",
+			claims: mockClaims{
+				Cluster:     "cluster2",
+				ClusterUUID: "CLUSTER2",
+				Subject:     "user2",
+				Groups:      []string{"group2"},
+				ExpiresAt:   jwt.NewNumericDate(time.Now().Add(time.Hour)),
+			},
+			kid:        "2",
+			signingKey: key2,
+			extraHeaders: map[string]string{
+				transport.ImpersonateUserHeader:  "foo",
+				transport.ImpersonateGroupHeader: "bar",
+			},
+
+			expectedCode: http.StatusOK,
+
+			expectedImpersonateUser:   "user2",
+			expectedImpersonateGroups: []string{"group2"},
+			expectedCluster:           "cluster2",
+		},
+		{
+			name: "cluster-uuid mismatch",
+			claims: mockClaims{
+				Cluster:     "cluster-1",
+				ClusterUUID: "CLUSTER2",
+				Subject:     "user2",
+				Groups:      []string{"group2"},
+				ExpiresAt:   jwt.NewNumericDate(time.Now().Add(time.Hour)),
+			},
+			kid:        "2",
+			signingKey: key1,
+
+			expectedCode: http.StatusUnauthorized,
+		},
+		{
+			name: "kid mismatch",
+			claims: mockClaims{
+				Cluster:     "cluster2",
+				ClusterUUID: "CLUSTER2",
+				Subject:     "user2",
+				Groups:      []string{"group2"},
+				ExpiresAt:   jwt.NewNumericDate(time.Now().Add(time.Hour)),
+			},
+			kid:        "2",
+			signingKey: key1,
+
+			expectedCode: http.StatusUnauthorized,
+		},
+		{
+			name: "wrong kid",
+			claims: mockClaims{
+				Cluster:     "cluster2",
+				ClusterUUID: "CLUSTER2",
+				Subject:     "user2",
+				Groups:      []string{"group2"},
+				ExpiresAt:   jwt.NewNumericDate(time.Now().Add(time.Hour)),
+			},
+			kid:        "3",
+			signingKey: key1,
+
+			expectedCode: http.StatusUnauthorized,
+		},
+		{
+			name: "malformed claims 1",
+			claims: mockClaims{
+				Subject:   "user2",
+				Groups:    []string{"group2"},
+				ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Hour)),
+			},
+			kid:        "1",
+			signingKey: key1,
+
+			expectedCode: http.StatusUnauthorized,
+		},
+		{
+			name: "malformed claims 2",
+			claims: mockClaims{
+				Cluster:     "cluster2",
+				ClusterUUID: "CLUSTER2",
+				Groups:      []string{"group2"},
+				ExpiresAt:   jwt.NewNumericDate(time.Now().Add(time.Hour)),
+			},
+			kid:        "1",
+			signingKey: key1,
+
+			expectedCode: http.StatusUnauthorized,
+		},
+		{
+			name: "malformed claims 2",
+			claims: mockClaims{
+				Cluster:     "cluster2",
+				ClusterUUID: "CLUSTER2",
+				Subject:     "foo",
+				ExpiresAt:   jwt.NewNumericDate(time.Now().Add(time.Hour)),
+			},
+			kid:        "1",
+			signingKey: key1,
+
+			expectedCode: http.StatusUnauthorized,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			req, err := http.NewRequestWithContext(ctx, http.MethodGet, ts.URL, nil)
+			require.NoError(t, err)
+
+			token := jwt.NewWithClaims(jwt.SigningMethodRS256, &tc.claims)
+			token.Header["kid"] = tc.kid
+
+			auth, err := token.SignedString(tc.signingKey)
+			require.NoError(t, err)
+
+			req.Header["Authorization"] = []string{"Bearer " + auth}
+
+			for k, v := range tc.extraHeaders {
+				req.Header.Set(k, v)
+			}
+
+			resp, err := http.DefaultClient.Do(req) //nolint:bodyclose
+			require.NoError(t, err)
+
+			require.Equal(t, tc.expectedCode, resp.StatusCode)
+
+			if tc.expectedCode != http.StatusOK {
+				return
+			}
+
+			var receivedReq *http.Request
+
+			select {
+			case receivedReq = <-reqCh:
+			case <-time.After(time.Second):
+				t.Fatal("timeout")
+			}
+
+			assert.Equal(t, []string{tc.expectedImpersonateUser}, receivedReq.Header.Values(transport.ImpersonateUserHeader))
+			assert.Equal(t, tc.expectedImpersonateGroups, receivedReq.Header.Values(transport.ImpersonateGroupHeader))
+			assert.Nil(t, receivedReq.Header.Values("Authorization"))
+
+			v, ok := receivedReq.Context().Value(k8sproxy.ClusterContextKey{}).(string)
+			assert.True(t, ok)
+			assert.Equal(t, tc.expectedCluster, v)
+		})
+	}
+}
diff --git a/internal/backend/k8sproxy/multiplex.go b/internal/backend/k8sproxy/multiplex.go
new file mode 100644
index 000000000..d6c1e427f
--- /dev/null
+++ b/internal/backend/k8sproxy/multiplex.go
@@ -0,0 +1,201 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package k8sproxy
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"time"
+
+	"github.com/hashicorp/go-cleanhttp"
+	"github.com/hashicorp/golang-lru/v2/expirable"
+	"github.com/prometheus/client_golang/prometheus"
+	"golang.org/x/sync/singleflight"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/transport"
+	"k8s.io/client-go/util/connrotation"
+
+	"github.com/siderolabs/omni/client/api/common"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime/kubernetes"
+)
+
+// multiplexer provides an http.RoundTripper which selects the cluster based on the request context.
+type multiplexer struct {
+	connectors *expirable.LRU[string, *clusterConnector]
+	sf         singleflight.Group
+
+	metricCacheSize                    prometheus.Gauge
+	metricCacheHits, metricCacheMisses prometheus.Counter
+}
+
+const (
+	k8sConnectorLRUSize = 128
+	k8sConnectorTTL     = time.Hour
+)
+
+type clusterConnector struct {
+	dialer    *connrotation.Dialer
+	transport *http.Transport
+	rt        http.RoundTripper
+	apiHost   string
+}
+
+func newMultiplexer() *multiplexer {
+	return &multiplexer{
+		connectors: expirable.NewLRU[string, *clusterConnector](
+			k8sConnectorLRUSize,
+			func(_ string, connector *clusterConnector) {
+				connector.transport.CloseIdleConnections()
+				connector.dialer.CloseAll()
+			},
+			k8sConnectorTTL,
+		),
+		metricCacheSize: prometheus.NewGauge(prometheus.GaugeOpts{
+			Name: "omni_k8sproxy_cache_size",
+			Help: "Number of Kubernetes proxy connections in the cache.",
+		}),
+		metricCacheHits: prometheus.NewCounter(prometheus.CounterOpts{
+			Name: "omni_k8sproxy_cache_hits_total",
+			Help: "Number of Kubebernetes proxy connection cache hits.",
+		}),
+		metricCacheMisses: prometheus.NewCounter(prometheus.CounterOpts{
+			Name: "omni_k8sproxy_cache_misses_total",
+			Help: "Number of Kubernetes proxy connection cache misses.",
+		}),
+	}
+}
+
+// RoundTrip implements http.RoundTripper interface.
+func (m *multiplexer) RoundTrip(req *http.Request) (*http.Response, error) {
+	clusterName, ok := req.Context().Value(clusterContextKey{}).(string)
+	if !ok {
+		return nil, errors.New("cluster name not found in request context")
+	}
+
+	rt, err := m.getRT(req.Context(), clusterName)
+	if err != nil {
+		return nil, err
+	}
+
+	return rt.RoundTrip(req)
+}
+
+func (m *multiplexer) getRT(ctx context.Context, clusterName string) (http.RoundTripper, error) {
+	clusterInfo, err := m.getClusterConnector(ctx, clusterName)
+	if err != nil {
+		return nil, err
+	}
+
+	return clusterInfo.rt, nil
+}
+
+func (m *multiplexer) removeClusterConnector(clusterName string) {
+	m.connectors.Remove(clusterName)
+	m.sf.Forget(clusterName)
+}
+
+func (m *multiplexer) getClusterConnector(ctx context.Context, clusterName string) (*clusterConnector, error) {
+	if connector, ok := m.connectors.Get(clusterName); ok {
+		// refresh the TTL
+		m.connectors.Add(clusterName, connector)
+
+		m.metricCacheHits.Inc()
+
+		return connector, nil
+	}
+
+	ch := m.sf.DoChan(clusterName, func() (any, error) {
+		type kubeRuntime interface {
+			GetKubeconfig(ctx context.Context, cluster *common.Context) (*rest.Config, error)
+		}
+
+		k8s, err := runtime.LookupInterface[kubeRuntime](kubernetes.Name)
+		if err != nil {
+			return nil, err
+		}
+
+		restConfig, err := k8s.GetKubeconfig(ctx, &common.Context{Name: clusterName})
+		if err != nil {
+			return nil, fmt.Errorf("error getting kubeconfig: %w", err)
+		}
+
+		tlsConfig, err := rest.TLSConfigFor(restConfig)
+		if err != nil {
+			return nil, err
+		}
+
+		clientTransport := cleanhttp.DefaultPooledTransport()
+		clientTransport.TLSClientConfig = tlsConfig
+
+		dialer := connrotation.NewDialer(clientTransport.DialContext)
+		clientTransport.DialContext = dialer.DialContext
+
+		// disable HTTP/2:
+		//  * request path is `kubectl` -> `nginx` -> Omni -> kube-apiserver
+		//  * nginx does not support HTTP/2 for backend connections
+		//  * we need to have same HTTP version all the way from `kubectl` to kube-apiserver
+		//  * so nginx should disable HTTP/2 for the external connection, and we should same for Omni -> kube-apiserver
+		clientTransport.ForceAttemptHTTP2 = false
+
+		restTransportConfig, err := restConfig.TransportConfig()
+		if err != nil {
+			return nil, err
+		}
+
+		rt, err := transport.HTTPWrappersForConfig(restTransportConfig, clientTransport)
+		if err != nil {
+			return nil, err
+		}
+
+		u, err := url.Parse(restConfig.Host)
+		if err != nil {
+			return nil, err
+		}
+
+		connector := &clusterConnector{
+			dialer:    dialer,
+			transport: clientTransport,
+			rt:        rt,
+			apiHost:   u.Host,
+		}
+
+		m.metricCacheMisses.Inc()
+		m.connectors.Add(clusterName, connector)
+
+		return connector, nil
+	})
+
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case res := <-ch:
+		if res.Err != nil {
+			return nil, res.Err
+		}
+
+		return res.Val.(*clusterConnector), nil //nolint:forcetypeassert
+	}
+}
+
+// Describe implements prom.Collector interface.
+func (m *multiplexer) Describe(ch chan<- *prometheus.Desc) {
+	prometheus.DescribeByCollect(m, ch)
+}
+
+// Collect implements prom.Collector interface.
+func (m *multiplexer) Collect(ch chan<- prometheus.Metric) {
+	m.metricCacheSize.Set(float64(m.connectors.Len()))
+	m.metricCacheSize.Collect(ch)
+
+	m.metricCacheHits.Collect(ch)
+	m.metricCacheMisses.Collect(ch)
+}
+
+var _ prometheus.Collector = &multiplexer{}
diff --git a/internal/backend/k8sproxy/proxy.go b/internal/backend/k8sproxy/proxy.go
new file mode 100644
index 000000000..bfb52ffc2
--- /dev/null
+++ b/internal/backend/k8sproxy/proxy.go
@@ -0,0 +1,67 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package k8sproxy
+
+import (
+	"net/http"
+	"net/http/httputil"
+
+	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/internal/backend/logging"
+)
+
+// proxyHandler implements the HTTP reverse proxy.
+type proxyHandler struct {
+	multiplexer *multiplexer
+	proxy       *httputil.ReverseProxy
+}
+
+func newProxyHandler(m *multiplexer, logger *zap.Logger) *proxyHandler {
+	p := &proxyHandler{
+		multiplexer: m,
+	}
+
+	logger = logger.With(logging.Component("k8s_proxy"))
+
+	p.proxy = &httputil.ReverseProxy{
+		Director:  p.director,
+		Transport: m,
+		ErrorLog:  zap.NewStdLog(logger),
+		ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
+			ctxzap.Error(r.Context(), "proxy handling error", zap.Error(err))
+
+			http.Error(w, "proxy error", http.StatusBadGateway)
+		},
+	}
+
+	return p
+}
+
+// director sets the target URL for the reverse proxy.
+func (p *proxyHandler) director(req *http.Request) {
+	clusterName, ok := req.Context().Value(clusterContextKey{}).(string)
+	if !ok {
+		ctxzap.Error(req.Context(), "cluster name not found in request context")
+
+		return
+	}
+
+	connector, err := p.multiplexer.getClusterConnector(req.Context(), clusterName)
+	if err != nil {
+		ctxzap.Error(req.Context(), "failed to get cluster connector", zap.Error(err))
+
+		return
+	}
+
+	req.URL.Scheme = "https"
+	req.URL.Host = connector.apiHost
+}
+
+func (p *proxyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	p.proxy.ServeHTTP(w, r)
+}
diff --git a/internal/backend/logging/handler.go b/internal/backend/logging/handler.go
new file mode 100644
index 000000000..ab7373093
--- /dev/null
+++ b/internal/backend/logging/handler.go
@@ -0,0 +1,74 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package logging
+
+import (
+	"net"
+	"net/http"
+
+	"github.com/felixge/httpsnoop"
+	"github.com/grpc-ecosystem/go-grpc-middleware/logging/zap/ctxzap"
+	grpc_ctxtags "github.com/grpc-ecosystem/go-grpc-middleware/tags"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
+)
+
+// Handler adds structured logging to each request going through a wrapped handler.
+type Handler struct {
+	h      http.Handler
+	logger *zap.Logger
+	fields []zap.Field
+}
+
+// ServeHTTP implements http.Handler.
+func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	remoteAddr := r.RemoteAddr
+	remoteAddr, _, _ = net.SplitHostPort(remoteAddr) //nolint:errcheck
+
+	if realIP := r.Header.Get("X-Real-IP"); realIP != "" {
+		remoteAddr = realIP
+	}
+
+	logger := h.logger.With(
+		zap.String("request_url", r.RequestURI),
+		zap.String("method", r.Method),
+		zap.String("remote_addr", remoteAddr),
+	).With(h.fields...)
+
+	// inject empty ctxtags and logger into request context
+	r = r.WithContext(
+		ctxzap.ToContext(
+			grpc_ctxtags.SetInContext(r.Context(), grpc_ctxtags.NewTags()),
+			logger,
+		),
+	)
+
+	metrics := httpsnoop.CaptureMetrics(h.h, w, r)
+
+	// get injected ctxtags back
+	ctxtags := grpc_ctxtags.Extract(r.Context()).Values()
+	fields := make([]zapcore.Field, 0, len(ctxtags))
+
+	for k, v := range ctxtags {
+		fields = append(fields, zap.Any(k, v))
+	}
+
+	logger.Info("HTTP request done",
+		append(
+			[]zapcore.Field{
+				zap.Duration("duration", metrics.Duration),
+				zap.Int("status", metrics.Code),
+				zap.Int64("response_length", metrics.Written),
+			},
+			fields...,
+		)...,
+	)
+}
+
+// NewHandler creates new Handler.
+func NewHandler(h http.Handler, logger *zap.Logger) *Handler {
+	return &Handler{h: h, logger: logger}
+}
diff --git a/internal/backend/logging/logging.go b/internal/backend/logging/logging.go
new file mode 100644
index 000000000..77c814b10
--- /dev/null
+++ b/internal/backend/logging/logging.go
@@ -0,0 +1,16 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package logging contains zap logging helpers.
+package logging
+
+import (
+	"go.uber.org/zap"
+)
+
+// Component returns the well-known "component" zap field.
+func Component(name string) zap.Field {
+	return zap.String("component", name)
+}
diff --git a/internal/backend/monitoring/monitoring.go b/internal/backend/monitoring/monitoring.go
new file mode 100644
index 000000000..15ecfe186
--- /dev/null
+++ b/internal/backend/monitoring/monitoring.go
@@ -0,0 +1,72 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package monitoring defines monitoring helpers common for the various parts of the project.
+package monitoring
+
+import (
+	"net/http"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+)
+
+var (
+	requestsInFlightGauge prometheus.Gauge
+	requestsCounter       *prometheus.CounterVec
+	requestsDuration      *prometheus.HistogramVec
+	requestsResponseSize  *prometheus.HistogramVec
+)
+
+func init() {
+	requestsInFlightGauge = prometheus.NewGauge(prometheus.GaugeOpts{
+		Name: "http_requests_current",
+		Help: "Current number of requests being processed.",
+	})
+
+	requestsCounter = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "http_requests_total",
+			Help: "Requests total.",
+		},
+		[]string{"code", "method", "handler"},
+	)
+
+	// requestsDuration is partitioned by the HTTP method and handler. It uses custom
+	// buckets based on the expected request requestsDuration.
+	requestsDuration = prometheus.NewHistogramVec(
+		prometheus.HistogramOpts{
+			Name:    "http_request_duration_seconds",
+			Help:    "A histogram of latencies for requests.",
+			Buckets: []float64{.25, .5, 1, 2.5, 5, 10},
+		},
+		[]string{"handler", "method"},
+	)
+
+	// requestsResponseSize has no labels, making it a zero-dimensional
+	// ObserverVec.
+	requestsResponseSize = prometheus.NewHistogramVec(
+		prometheus.HistogramOpts{
+			Name:    "http_response_size_bytes",
+			Help:    "A histogram of response sizes for requests.",
+			Buckets: []float64{200, 500, 900, 1500},
+		},
+		[]string{"handler"},
+	)
+
+	// Register all of the metrics in the standard registry.
+	prometheus.MustRegister(requestsInFlightGauge, requestsCounter, requestsDuration, requestsResponseSize)
+}
+
+// NewHandler creates http handler wrapper which reports metrics to prometheus.
+func NewHandler(handler http.Handler, labels prometheus.Labels) http.Handler {
+	return promhttp.InstrumentHandlerInFlight(requestsInFlightGauge,
+		promhttp.InstrumentHandlerDuration(requestsDuration.MustCurryWith(labels),
+			promhttp.InstrumentHandlerCounter(requestsCounter.MustCurryWith(labels),
+				promhttp.InstrumentHandlerResponseSize(requestsResponseSize.MustCurryWith(labels), handler),
+			),
+		),
+	)
+}
diff --git a/internal/backend/oidc/external/external.go b/internal/backend/oidc/external/external.go
new file mode 100644
index 000000000..2cbe7fa04
--- /dev/null
+++ b/internal/backend/oidc/external/external.go
@@ -0,0 +1,24 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package external provides constants which are consumed in other places.
+package external
+
+import "time"
+
+// DefaultClientID is the client_id of the default (an only) client.
+const DefaultClientID = "native"
+
+// ScopeClusterPrefix defines the scope prefix to specify cluster name.
+const ScopeClusterPrefix = "cluster:"
+
+// OIDCTokenLifetime specifies the lifetime of the JWT token.
+const OIDCTokenLifetime = 12 * time.Hour
+
+// ServiceAccountTokenLifetime specifies the lifetime of the (kubeconfig) service account token.
+const ServiceAccountTokenLifetime = 10 * 365 * 24 * time.Hour
+
+// KeyRotationInterval specifies the interval in which the keys are rotated.
+const KeyRotationInterval = 30 * 24 * time.Hour
diff --git a/internal/backend/oidc/internal/client/client.go b/internal/backend/oidc/internal/client/client.go
new file mode 100644
index 000000000..4652fde89
--- /dev/null
+++ b/internal/backend/oidc/internal/client/client.go
@@ -0,0 +1,121 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package client provides an OIDC client.
+package client
+
+import (
+	"fmt"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/zitadel/oidc/pkg/oidc"
+	"github.com/zitadel/oidc/pkg/op"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/internal/backend/oidc/external"
+)
+
+const loginPath = "/omni/oidc-login/%s"
+
+// Client represents the default client for kubectl.
+type Client struct{}
+
+// GetID must return the client_id.
+func (Client) GetID() string {
+	return external.DefaultClientID
+}
+
+// RedirectURIs must return the registered redirect_uris for Code and Implicit Flow.
+func (Client) RedirectURIs() []string {
+	// these are the URLs used by the kubectl plugin
+	return []string{
+		"http://localhost:8000",
+		"http://localhost:18000",
+	}
+}
+
+// PostLogoutRedirectURIs must return the registered post_logout_redirect_uris for sign-outs.
+func (Client) PostLogoutRedirectURIs() []string {
+	return []string{}
+}
+
+// ApplicationType must return the type of the client (app, native, user agent).
+func (Client) ApplicationType() op.ApplicationType {
+	return op.ApplicationTypeNative
+}
+
+// AuthMethod must return the authentication method (client_secret_basic, client_secret_post, none, private_key_jwt).
+func (Client) AuthMethod() oidc.AuthMethod {
+	return oidc.AuthMethodNone
+}
+
+// ResponseTypes must return all allowed response types (code, id_token token, id_token)
+// these must match with the allowed grant types.
+func (Client) ResponseTypes() []oidc.ResponseType {
+	return []oidc.ResponseType{oidc.ResponseTypeCode}
+}
+
+// GrantTypes must return all allowed grant types (authorization_code, refresh_token, urn:ietf:params:oauth:grant-type:jwt-bearer).
+func (Client) GrantTypes() []oidc.GrantType {
+	return []oidc.GrantType{oidc.GrantTypeCode}
+}
+
+// LoginURL will be called to redirect the user (agent) to the login UI
+// you could implement some logic here to redirect the users to different login UIs depending on the client.
+func (Client) LoginURL(id string) string {
+	return fmt.Sprintf(loginPath, url.PathEscape(id))
+}
+
+// AccessTokenType must return the type of access token the client uses (Bearer (opaque) or JWT).
+func (Client) AccessTokenType() op.AccessTokenType {
+	return 0
+}
+
+// IDTokenLifetime must return the lifetime of the client's id_tokens.
+func (Client) IDTokenLifetime() time.Duration {
+	return external.OIDCTokenLifetime
+}
+
+// DevMode enables the use of non-compliant configs such as redirect_uris (e.g. http schema for user agent client).
+func (Client) DevMode() bool {
+	return constants.IsDebugBuild
+}
+
+// RestrictAdditionalIdTokenScopes allows specifying which custom scopes shall be asserted into the id_token.
+func (Client) RestrictAdditionalIdTokenScopes() func(scopes []string) []string { //nolint:revive,stylecheck
+	return func(scopes []string) []string {
+		return scopes
+	}
+}
+
+// RestrictAdditionalAccessTokenScopes allows specifying which custom scopes shall be asserted into the JWT access_token.
+func (Client) RestrictAdditionalAccessTokenScopes() func(scopes []string) []string {
+	return func(scopes []string) []string {
+		return scopes
+	}
+}
+
+// IsScopeAllowed enables Client specific custom scopes validation
+// in this example we allow the CustomScope for all clients.
+func (Client) IsScopeAllowed(scope string) bool {
+	return strings.HasPrefix(scope, external.ScopeClusterPrefix)
+}
+
+// IDTokenUserinfoClaimsAssertion allows specifying if claims of scope profile, email, phone and address are asserted into the id_token
+// even if an access token if issued which violates the OIDC Core spec.
+//
+// (5.4. Requesting Claims using Scope Values: https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims)
+// some clients though require that e.g. email is always in the id_token when requested even if an access_token is issued.
+func (Client) IDTokenUserinfoClaimsAssertion() bool {
+	return false
+}
+
+// ClockSkew enables clients to instruct the OP to apply a clock skew on the various times and expirations
+// (subtract from issued_at, add to expiration, ...).
+func (Client) ClockSkew() time.Duration {
+	return 5 * time.Minute
+}
diff --git a/internal/backend/oidc/internal/models/auth_request.go b/internal/backend/oidc/internal/models/auth_request.go
new file mode 100644
index 000000000..868a1884b
--- /dev/null
+++ b/internal/backend/oidc/internal/models/auth_request.go
@@ -0,0 +1,163 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package models
+
+import (
+	"time"
+
+	"github.com/siderolabs/go-pointer"
+	"github.com/zitadel/oidc/pkg/oidc"
+)
+
+// AuthRequest is a request for authentication.
+type AuthRequest struct { //nolint:govet
+	ID            string
+	CreationDate  time.Time
+	ApplicationID string
+	CallbackURI   string
+	TransferState string
+	Prompt        []string
+	LoginHint     string
+	MaxAuthAge    *time.Duration
+	UserID        string
+	Scopes        []string
+	ResponseType  oidc.ResponseType
+	Nonce         string
+	CodeChallenge *OIDCCodeChallenge
+
+	authenticated bool
+	authTime      time.Time
+}
+
+// GetID implements the oidc.AuthRequest interface.
+func (a *AuthRequest) GetID() string {
+	return a.ID
+}
+
+// GetACR implements the oidc.AuthRequest interface.
+func (a *AuthRequest) GetACR() string {
+	return ""
+}
+
+// GetAMR implements the oidc.AuthRequest interface.
+func (a *AuthRequest) GetAMR() []string {
+	if a.authenticated {
+		return []string{"pop"}
+	}
+
+	return nil
+}
+
+// GetAudience implements the oidc.AuthRequest interface.
+func (a *AuthRequest) GetAudience() []string {
+	return []string{a.ApplicationID}
+}
+
+// GetAuthTime implements the oidc.AuthRequest interface.
+func (a *AuthRequest) GetAuthTime() time.Time {
+	return a.authTime
+}
+
+// GetClientID implements the oidc.AuthRequest interface.
+func (a *AuthRequest) GetClientID() string {
+	return a.ApplicationID
+}
+
+// GetCodeChallenge implements the oidc.AuthRequest interface.
+func (a *AuthRequest) GetCodeChallenge() *oidc.CodeChallenge {
+	return codeChallengeToOIDC(a.CodeChallenge)
+}
+
+// GetNonce implements the oidc.AuthRequest interface.
+func (a *AuthRequest) GetNonce() string {
+	return a.Nonce
+}
+
+// GetRedirectURI implements the oidc.AuthRequest interface.
+func (a *AuthRequest) GetRedirectURI() string {
+	return a.CallbackURI
+}
+
+// GetResponseType implements the oidc.AuthRequest interface.
+func (a *AuthRequest) GetResponseType() oidc.ResponseType {
+	return a.ResponseType
+}
+
+// GetResponseMode implements the oidc.AuthRequest interface.
+func (a *AuthRequest) GetResponseMode() oidc.ResponseMode {
+	return ""
+}
+
+// GetScopes implements the oidc.AuthRequest interface.
+func (a *AuthRequest) GetScopes() []string {
+	return a.Scopes
+}
+
+// GetState implements the oidc.AuthRequest interface.
+func (a *AuthRequest) GetState() string {
+	return a.TransferState
+}
+
+// GetSubject implements the oidc.AuthRequest interface.
+func (a *AuthRequest) GetSubject() string {
+	return a.UserID
+}
+
+// Done implements the oidc.AuthRequest interface.
+func (a *AuthRequest) Done() bool {
+	return a.authenticated
+}
+
+// MarkAsAuthenticated marks the request as authenticated.
+func (a *AuthRequest) MarkAsAuthenticated(authTime time.Time) {
+	a.authenticated = true
+	a.authTime = authTime
+}
+
+func promptToInternal(oidcPrompt oidc.SpaceDelimitedArray) []string {
+	prompts := make([]string, 0, len(oidcPrompt))
+
+	for _, oidcPrompt := range oidcPrompt {
+		switch oidcPrompt {
+		case oidc.PromptNone,
+			oidc.PromptLogin,
+			oidc.PromptConsent,
+			oidc.PromptSelectAccount:
+			prompts = append(prompts, oidcPrompt)
+		}
+	}
+
+	return prompts
+}
+
+func maxAgeToInternal(maxAge *uint) *time.Duration {
+	if maxAge == nil {
+		return nil
+	}
+
+	return pointer.To(time.Duration(*maxAge) * time.Second)
+}
+
+// AuthRequestToInternal converts an oidc.AuthRequest to an internal AuthRequest.
+func AuthRequestToInternal(authReq *oidc.AuthRequest, userID string) *AuthRequest {
+	return &AuthRequest{
+		CreationDate:  time.Now(),
+		ApplicationID: authReq.ClientID,
+		CallbackURI:   authReq.RedirectURI,
+		TransferState: authReq.State,
+		Prompt:        promptToInternal(authReq.Prompt),
+		LoginHint:     authReq.LoginHint,
+		MaxAuthAge:    maxAgeToInternal(authReq.MaxAge),
+		UserID:        userID,
+		Scopes:        authReq.Scopes,
+		ResponseType:  authReq.ResponseType,
+		Nonce:         authReq.Nonce,
+		CodeChallenge: &OIDCCodeChallenge{
+			Challenge: authReq.CodeChallenge,
+			Method:    string(authReq.CodeChallengeMethod),
+		},
+	}
+}
diff --git a/internal/backend/oidc/internal/models/challenge.go b/internal/backend/oidc/internal/models/challenge.go
new file mode 100644
index 000000000..0549e67ae
--- /dev/null
+++ b/internal/backend/oidc/internal/models/challenge.go
@@ -0,0 +1,31 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package models
+
+import "github.com/zitadel/oidc/pkg/oidc"
+
+// OIDCCodeChallenge is a code challenge as defined in https://tools.ietf.org/html/rfc7636.
+type OIDCCodeChallenge struct {
+	Challenge string
+	Method    string
+}
+
+func codeChallengeToOIDC(challenge *OIDCCodeChallenge) *oidc.CodeChallenge {
+	if challenge == nil {
+		return nil
+	}
+
+	challengeMethod := oidc.CodeChallengeMethodPlain
+
+	if challenge.Method == "S256" {
+		challengeMethod = oidc.CodeChallengeMethodS256
+	}
+
+	return &oidc.CodeChallenge{
+		Challenge: challenge.Challenge,
+		Method:    challengeMethod,
+	}
+}
diff --git a/internal/backend/oidc/internal/models/models.go b/internal/backend/oidc/internal/models/models.go
new file mode 100644
index 000000000..5393dbb01
--- /dev/null
+++ b/internal/backend/oidc/internal/models/models.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package models provides OIDC models used in the implementation.
+package models
diff --git a/internal/backend/oidc/internal/models/token.go b/internal/backend/oidc/internal/models/token.go
new file mode 100644
index 000000000..30f4af846
--- /dev/null
+++ b/internal/backend/oidc/internal/models/token.go
@@ -0,0 +1,19 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package models
+
+import "time"
+
+// Token wraps OIDC tokens.
+type Token struct {
+	ID             string
+	ApplicationID  string
+	Subject        string
+	RefreshTokenID string
+	Audience       []string
+	Expiration     time.Time
+	Scopes         []string
+}
diff --git a/internal/backend/oidc/internal/storage/authrequest/authrequest.go b/internal/backend/oidc/internal/storage/authrequest/authrequest.go
new file mode 100644
index 000000000..9cc7a4e50
--- /dev/null
+++ b/internal/backend/oidc/internal/storage/authrequest/authrequest.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package authrequest implements storing and handling OIDC authentication requests.
+package authrequest
diff --git a/internal/backend/oidc/internal/storage/authrequest/storage.go b/internal/backend/oidc/internal/storage/authrequest/storage.go
new file mode 100644
index 000000000..16ab3d9fd
--- /dev/null
+++ b/internal/backend/oidc/internal/storage/authrequest/storage.go
@@ -0,0 +1,133 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package authrequest
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/zitadel/oidc/pkg/oidc"
+	"github.com/zitadel/oidc/pkg/op"
+
+	"github.com/siderolabs/omni/internal/backend/oidc/internal/models"
+)
+
+// Storage implements authentication request storage.
+type Storage struct {
+	authRequests map[string]*models.AuthRequest
+	codes        map[string]string
+	lock         sync.Mutex
+}
+
+// NewStorage creates a new auth request storage.
+func NewStorage() *Storage {
+	return &Storage{
+		authRequests: map[string]*models.AuthRequest{},
+		codes:        map[string]string{},
+	}
+}
+
+// CreateAuthRequest implements the op.Storage interface
+// it will be called after parsing and validation of the authentication request.
+func (s *Storage) CreateAuthRequest(_ context.Context, authReq *oidc.AuthRequest, userID string) (op.AuthRequest, error) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	request := models.AuthRequestToInternal(authReq, userID)
+	request.ID = uuid.NewString()
+
+	s.authRequests[request.ID] = request
+
+	return request, nil
+}
+
+// AuthRequestByID implements the op.Storage interface
+// it will be called after the Login UI redirects back to the OIDC endpoint.
+func (s *Storage) AuthRequestByID(_ context.Context, id string) (op.AuthRequest, error) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	request, ok := s.authRequests[id]
+	if !ok {
+		return nil, errors.New("request not found")
+	}
+
+	return request, nil
+}
+
+// AuthRequestByCode implements the op.Storage interface
+// it will be called after parsing and validation of the token request (in an authorization code flow).
+func (s *Storage) AuthRequestByCode(ctx context.Context, code string) (op.AuthRequest, error) {
+	// for this example we read the id by code and then get the request by id
+	requestID, ok := func() (string, bool) {
+		s.lock.Lock()
+		defer s.lock.Unlock()
+
+		requestID, ok := s.codes[code]
+
+		return requestID, ok
+	}()
+	if !ok {
+		return nil, errors.New("code invalid or expired")
+	}
+
+	return s.AuthRequestByID(ctx, requestID)
+}
+
+// SaveAuthCode implements the op.Storage interface
+// it will be called after the authentication has been successful and before redirecting the user agent to the redirect_uri
+// (in an authorization code flow).
+func (s *Storage) SaveAuthCode(_ context.Context, id string, code string) error {
+	// for this example we'll just save the authRequestID to the code
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	s.codes[code] = id
+
+	return nil
+}
+
+// DeleteAuthRequest implements the op.Storage interface.
+//
+// It will be called after creating the token response (id and access tokens) for a valid
+//   - authentication request (in an implicit flow)
+//   - token request (in an authorization code flow).
+func (s *Storage) DeleteAuthRequest(_ context.Context, id string) error {
+	// you can simply delete all reference to the auth request
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	delete(s.authRequests, id)
+
+	for code, requestID := range s.codes {
+		if id == requestID {
+			delete(s.codes, code)
+
+			return nil
+		}
+	}
+
+	return nil
+}
+
+// AuthenticateRequest implements the `authenticate` interface of the login.
+func (s *Storage) AuthenticateRequest(requestID, identity string) error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	request, ok := s.authRequests[requestID]
+	if !ok {
+		return errors.New("request not found")
+	}
+
+	request.UserID = identity
+	request.MarkAsAuthenticated(time.Now())
+
+	return nil
+}
diff --git a/internal/backend/oidc/internal/storage/authrequest/storage_test.go b/internal/backend/oidc/internal/storage/authrequest/storage_test.go
new file mode 100644
index 000000000..28c58f534
--- /dev/null
+++ b/internal/backend/oidc/internal/storage/authrequest/storage_test.go
@@ -0,0 +1,75 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package authrequest_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/zitadel/oidc/pkg/oidc"
+
+	"github.com/siderolabs/omni/internal/backend/oidc/internal/storage/authrequest"
+)
+
+func TestStorage(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	s := authrequest.NewStorage()
+
+	// create
+	req, err := s.CreateAuthRequest(ctx,
+		&oidc.AuthRequest{
+			ClientID: "test",
+		}, "")
+	require.NoError(t, err)
+
+	assert.Equal(t, "test", req.GetClientID())
+	assert.False(t, req.Done())
+
+	// get by ID
+	req2, err := s.AuthRequestByID(ctx, req.GetID())
+	require.NoError(t, err)
+
+	assert.Equal(t, req, req2)
+
+	_, err = s.AuthRequestByID(ctx, "invalid")
+	assert.Error(t, err)
+
+	// attach code, get by code
+	err = s.SaveAuthCode(ctx, req.GetID(), "code")
+	require.NoError(t, err)
+
+	req3, err := s.AuthRequestByCode(ctx, "code")
+	require.NoError(t, err)
+
+	assert.Equal(t, req, req3)
+
+	_, err = s.AuthRequestByCode(ctx, "invalid")
+	assert.Error(t, err)
+
+	// authenticate request
+	err = s.AuthenticateRequest(req.GetID(), "test@example.com")
+	require.NoError(t, err)
+
+	req, err = s.AuthRequestByID(ctx, req.GetID())
+	require.NoError(t, err)
+
+	assert.True(t, req.Done())
+	assert.Equal(t, "test@example.com", req.GetSubject())
+
+	// delete
+	err = s.DeleteAuthRequest(ctx, req.GetID())
+	require.NoError(t, err)
+
+	_, err = s.AuthRequestByID(ctx, req.GetID())
+	assert.Error(t, err)
+
+	_, err = s.AuthRequestByCode(ctx, "code")
+	assert.Error(t, err)
+}
diff --git a/internal/backend/oidc/internal/storage/keys/keys.go b/internal/backend/oidc/internal/storage/keys/keys.go
new file mode 100644
index 000000000..29e76feac
--- /dev/null
+++ b/internal/backend/oidc/internal/storage/keys/keys.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package keys implements JWT signing key management.
+package keys
diff --git a/internal/backend/oidc/internal/storage/keys/storage.go b/internal/backend/oidc/internal/storage/keys/storage.go
new file mode 100644
index 000000000..0810aec6e
--- /dev/null
+++ b/internal/backend/oidc/internal/storage/keys/storage.go
@@ -0,0 +1,247 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package keys
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/benbjohnson/clock"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/google/uuid"
+	"github.com/siderolabs/gen/xslices"
+	oidczitadel "github.com/zitadel/oidc/pkg/oidc"
+	"go.uber.org/zap"
+	"google.golang.org/protobuf/types/known/timestamppb"
+	"gopkg.in/square/go-jose.v2"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/oidc"
+	"github.com/siderolabs/omni/internal/backend/oidc/external"
+)
+
+// Storage implements JWT key signing storage around resource state.
+type Storage struct {
+	currentKey   *jose.JSONWebKey
+	activeKeySet *jose.JSONWebKeySet
+	logger       *zap.Logger
+	st           state.State
+	clock        clock.Clock
+	lock         sync.Mutex
+}
+
+// NewStorage creates a new Storage.
+func NewStorage(logger *zap.Logger, st state.State, clock clock.Clock) *Storage {
+	return &Storage{
+		logger: logger,
+		st:     st,
+		clock:  clock,
+	}
+}
+
+// GetSigningKey implements the op.Storage interface.
+//
+// It will be called when creating the OpenID Provider.
+func (s *Storage) GetSigningKey(ctx context.Context, keyCh chan<- jose.SigningKey) {
+	for ctx.Err() == nil {
+		err := s.keyRefresher(ctx, keyCh)
+		if err == nil {
+			return
+		}
+
+		s.logger.Error("key refresher failed", zap.Error(err))
+
+		// wait some time before restarting
+		select {
+		case <-ctx.Done():
+			return
+		case <-s.clock.After(10 * time.Second):
+		}
+	}
+}
+
+// GetKeySet implements the op.Storage interface.
+//
+// It will be called to get the current (public) keys, among others for the keys_endpoint or for validating access_tokens on the userinfo_endpoint, ...
+func (s *Storage) GetKeySet(context.Context) (*jose.JSONWebKeySet, error) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	if s.activeKeySet != nil {
+		return s.activeKeySet, nil
+	}
+
+	return nil, errors.New("no active key set")
+}
+
+// GetPublicKeyByID looks up the public key with the given ID.
+func (s *Storage) GetPublicKeyByID(keyID string) (any, error) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	if s.activeKeySet == nil {
+		return nil, errors.New("no active key set")
+	}
+
+	for _, key := range s.activeKeySet.Keys {
+		if key.KeyID == keyID {
+			return key.Key, nil
+		}
+	}
+
+	return nil, fmt.Errorf("key not found, ID %q", keyID)
+}
+
+// GetCurrentSigningKey returns the active and currently used signing key.
+func (s *Storage) GetCurrentSigningKey() (*jose.JSONWebKey, error) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	if s.currentKey != nil {
+		return s.currentKey, nil
+	}
+
+	return nil, errors.New("no current key")
+}
+
+func (s *Storage) keyRefresher(ctx context.Context, keyCh chan<- jose.SigningKey) error {
+	ticker := s.clock.Ticker(external.KeyRotationInterval)
+	defer ticker.Stop()
+
+	for {
+		// renew the key
+		privateKey, err := s.generateKey()
+		if err != nil {
+			return fmt.Errorf("failure to generate the key: %w", err)
+		}
+
+		keyID := uuid.NewString()
+
+		if err = s.storeKey(ctx, keyID, privateKey); err != nil {
+			return fmt.Errorf("failure to store the key: %w", err)
+		}
+
+		if err = s.cleanupOldKeys(ctx); err != nil {
+			return fmt.Errorf("failure to cleanup old keys: %w", err)
+		}
+
+		jsonWebKey := jose.JSONWebKey{
+			KeyID:     keyID,
+			Key:       privateKey,
+			Algorithm: string(jose.RS256),
+		}
+
+		s.lock.Lock()
+		s.currentKey = &jsonWebKey
+		s.lock.Unlock()
+
+		// send the new signing key to be used by OIDC
+		select {
+		case <-ctx.Done():
+			return nil
+		case keyCh <- jose.SigningKey{
+			Algorithm: jose.RS256,
+			Key:       jsonWebKey,
+		}:
+		}
+
+		s.logger.Info("new OIDC signing key generated", zap.String("key_id", keyID))
+
+		// wait for key rotation interval
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-ticker.C:
+		}
+	}
+}
+
+func (s *Storage) generateKey() (*rsa.PrivateKey, error) {
+	return rsa.GenerateKey(rand.Reader, 2048)
+}
+
+func (s *Storage) storeKey(ctx context.Context, keyID string, privateKey *rsa.PrivateKey) error {
+	key := oidc.NewJWTPublicKey(oidc.NamespaceName, keyID)
+	key.TypedSpec().Value.PublicKey = x509.MarshalPKCS1PublicKey(&privateKey.PublicKey)
+
+	maxTokenFiletime := s.MaxTokenLifetime()
+
+	key.TypedSpec().Value.Expiration = timestamppb.New(s.clock.Now().Add(2*external.KeyRotationInterval + maxTokenFiletime))
+
+	s.logger.Info("generating new OIDC key",
+		zap.String("key_id", key.Metadata().ID()),
+		zap.Stringer("expiration", key.TypedSpec().Value.Expiration.AsTime()),
+	)
+
+	return s.st.Create(ctx, key)
+}
+
+func (s *Storage) cleanupOldKeys(ctx context.Context) error {
+	keys, err := safe.StateListAll[*oidc.JWTPublicKey](ctx, s.st)
+	if err != nil {
+		return err
+	}
+
+	newKeySet := &jose.JSONWebKeySet{}
+
+	for iter := keys.Iterator(); iter.Next(); {
+		key := iter.Value()
+
+		if s.clock.Now().After(key.TypedSpec().Value.Expiration.AsTime()) {
+			s.logger.Info("destroying expired OIDC key",
+				zap.String("key_id", key.Metadata().ID()),
+				zap.Stringer("expiration", key.TypedSpec().Value.Expiration.AsTime()),
+			)
+
+			if err = s.st.Destroy(ctx, key.Metadata()); err != nil {
+				return err
+			}
+		} else {
+			publicKey, err := x509.ParsePKCS1PublicKey(key.TypedSpec().Value.PublicKey)
+			if err != nil {
+				return err
+			}
+
+			newKeySet.Keys = append(newKeySet.Keys, jose.JSONWebKey{
+				KeyID:     key.Metadata().ID(),
+				Algorithm: string(jose.RS256),
+				Use:       oidczitadel.KeyUseSignature,
+				Key:       publicKey,
+			})
+		}
+	}
+
+	s.logger.Info("active OIDC public signing keys",
+		zap.Strings("key_ids",
+			xslices.Map(newKeySet.Keys, func(key jose.JSONWebKey) string {
+				return key.KeyID
+			}),
+		),
+	)
+
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	s.activeKeySet = newKeySet
+
+	return nil
+}
+
+// MaxTokenLifetime returns the maximum lifetime of an access token.
+func (s *Storage) MaxTokenLifetime() time.Duration {
+	//goland:noinspection GoBoolExpressions
+	if external.ServiceAccountTokenLifetime > external.OIDCTokenLifetime {
+		return external.ServiceAccountTokenLifetime
+	}
+
+	return external.OIDCTokenLifetime
+}
diff --git a/internal/backend/oidc/internal/storage/keys/storage_test.go b/internal/backend/oidc/internal/storage/keys/storage_test.go
new file mode 100644
index 000000000..4d10eca04
--- /dev/null
+++ b/internal/backend/oidc/internal/storage/keys/storage_test.go
@@ -0,0 +1,161 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package keys_test
+
+import (
+	"context"
+	"crypto/rsa"
+	"slices"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/benbjohnson/clock"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap/zaptest"
+	"gopkg.in/square/go-jose.v2"
+
+	"github.com/siderolabs/omni/internal/backend/oidc/external"
+	"github.com/siderolabs/omni/internal/backend/oidc/internal/storage/keys"
+)
+
+func TestStorage(t *testing.T) {
+	var wg sync.WaitGroup
+
+	t.Cleanup(wg.Wait)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+	clock := clock.NewMock()
+
+	storage := keys.NewStorage(zaptest.NewLogger(t), st, clock)
+
+	keyCh := make(chan jose.SigningKey, 1)
+
+	// run the key rotation loop
+	wg.Add(1)
+
+	go func() {
+		defer wg.Done()
+
+		storage.GetSigningKey(ctx, keyCh)
+	}()
+
+	// the first key should be generated immediately
+	var key jose.SigningKey
+
+	select {
+	case key = <-keyCh:
+	case <-time.After(10 * time.Second):
+		t.Fatal("timeout waiting for key")
+	}
+
+	assert.Equal(t, jose.RS256, key.Algorithm)
+
+	privateKey, ok := key.Key.(jose.JSONWebKey)
+	require.True(t, ok)
+
+	// get the active set of public keys, it should have exactly one key
+	// public key should match a private key
+	keySet, err := storage.GetKeySet(ctx)
+	require.NoError(t, err)
+
+	assert.Len(t, keySet.Keys, 1)
+	assert.Equal(t, keySet.Keys[0].KeyID, privateKey.KeyID)
+	assert.Equal(t, *keySet.Keys[0].Key.(*rsa.PublicKey), privateKey.Key.(*rsa.PrivateKey).PublicKey) //nolint:forcetypeassert
+
+	expectedPublicKeyIDs := []string{privateKey.KeyID}
+
+	// advance time and generate one more key - will trigger one timer tick
+	clock.Add(external.KeyRotationInterval)
+
+	select {
+	case key = <-keyCh:
+	case <-time.After(10 * time.Second):
+		t.Fatal("timeout waiting for key")
+	}
+
+	assert.Equal(t, jose.RS256, key.Algorithm)
+
+	privateKey, ok = key.Key.(jose.JSONWebKey)
+	require.True(t, ok)
+
+	expectedPublicKeyIDs = append(expectedPublicKeyIDs, privateKey.KeyID)
+
+	// get the active set of public keys, it should have two keys now
+	keySet, err = storage.GetKeySet(ctx)
+	require.NoError(t, err)
+
+	assert.Len(t, keySet.Keys, 2)
+	assert.Equal(t, sorted(expectedPublicKeyIDs), getKeyIDs(keySet))
+
+	// advance the time even more so that the first key expires
+	// this triggers at least one timer tick, but the exact number varies due to the mocked clock
+	clock.Add(external.KeyRotationInterval + storage.MaxTokenLifetime() + time.Second)
+
+	expectedKeyToExpire := expectedPublicKeyIDs[0]
+	expectedPublicKeyIDs = expectedPublicKeyIDs[1:]
+
+	// consume the newly generated keys until we reach the last one,
+	// which will cause the first (oldest) key to be removed due to expiration
+	for {
+		select {
+		case key = <-keyCh:
+		case <-time.After(10 * time.Second):
+			t.Fatal("timeout waiting for key")
+		}
+
+		assert.Equal(t, jose.RS256, key.Algorithm)
+
+		privateKey, ok = key.Key.(jose.JSONWebKey)
+		require.True(t, ok)
+
+		expectedPublicKeyIDs = append(expectedPublicKeyIDs, privateKey.KeyID)
+
+		// get the active set of public keys
+		keySet, err = storage.GetKeySet(ctx)
+		require.NoError(t, err)
+
+		keyIDs := getKeyIDs(keySet)
+
+		if !slices.Contains(keyIDs, expectedKeyToExpire) {
+			t.Logf("first key is removed, stop receiving")
+
+			break
+		}
+	}
+
+	// get the active set of public keys - it should have at least two keys:
+	// - the second key from the previous set, because it shouldn't be expired yet.
+	// - the newly generated keys due to the tick(s) happened above.
+	keySet, err = storage.GetKeySet(ctx)
+	require.NoError(t, err)
+
+	keyIDs := getKeyIDs(keySet)
+
+	assert.GreaterOrEqual(t, len(keyIDs), 2, "at least two keys should be present")
+	assert.Equal(t, sorted(expectedPublicKeyIDs), keyIDs)
+}
+
+func getKeyIDs(keySet *jose.JSONWebKeySet) []string {
+	ids := xslices.Map(keySet.Keys, func(k jose.JSONWebKey) string { return k.KeyID })
+
+	return sorted(ids)
+}
+
+func sorted(s []string) []string {
+	s = slices.Clone(s)
+	slices.Sort(s)
+
+	return s
+}
diff --git a/internal/backend/oidc/internal/storage/storage.go b/internal/backend/oidc/internal/storage/storage.go
new file mode 100644
index 000000000..f957ad883
--- /dev/null
+++ b/internal/backend/oidc/internal/storage/storage.go
@@ -0,0 +1,213 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package storage implements OIDC storage for requests, tokens, etc.
+package storage
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/benbjohnson/clock"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/zitadel/oidc/pkg/oidc"
+	"github.com/zitadel/oidc/pkg/op"
+	"go.uber.org/zap"
+	"gopkg.in/square/go-jose.v2"
+
+	"github.com/siderolabs/omni/internal/backend/logging"
+	"github.com/siderolabs/omni/internal/backend/oidc/external"
+	"github.com/siderolabs/omni/internal/backend/oidc/internal/client"
+	"github.com/siderolabs/omni/internal/backend/oidc/internal/storage/authrequest"
+	"github.com/siderolabs/omni/internal/backend/oidc/internal/storage/keys"
+	"github.com/siderolabs/omni/internal/backend/oidc/internal/storage/token"
+)
+
+// Storage implements the op.Storage interface.
+//
+// We implement this on top of mostly ephemeral in-memory storage.
+type Storage struct {
+	authRequestStorage *authrequest.Storage
+	tokenStorage       *token.Storage
+	keyStorage         *keys.Storage
+}
+
+// Interface check.
+var _ op.Storage = &Storage{}
+
+// NewStorage creates a new instance of OIDC storage.
+func NewStorage(st state.State, logger *zap.Logger) *Storage {
+	logger = logger.With(logging.Component("oidc_storage"))
+
+	return &Storage{
+		authRequestStorage: authrequest.NewStorage(),
+		tokenStorage:       token.NewStorage(clock.New(), st),
+		keyStorage:         keys.NewStorage(logger, st, clock.New()),
+	}
+}
+
+// Health implements the op.Storage interface.
+func (s *Storage) Health(context.Context) error {
+	return nil
+}
+
+// GetSigningKey implements the op.Storage interface.
+//
+// It will be called when creating the OpenID Provider.
+func (s *Storage) GetSigningKey(ctx context.Context, keyCh chan<- jose.SigningKey) {
+	s.keyStorage.GetSigningKey(ctx, keyCh)
+}
+
+// GetKeySet implements the op.Storage interface.
+//
+// It will be called to get the current (public) keys, among others for the keys_endpoint or for validating access_tokens on the userinfo_endpoint, ...
+func (s *Storage) GetKeySet(ctx context.Context) (*jose.JSONWebKeySet, error) {
+	return s.keyStorage.GetKeySet(ctx)
+}
+
+// GetPublicKeyByID looks up the public key with the given ID.
+func (s *Storage) GetPublicKeyByID(keyID string) (any, error) {
+	return s.keyStorage.GetPublicKeyByID(keyID)
+}
+
+// GetClientByClientID implements the op.Storage interface.
+//
+// In our case we have a single fixed client.
+func (s *Storage) GetClientByClientID(_ context.Context, clientID string) (op.Client, error) {
+	if clientID != external.DefaultClientID {
+		return nil, errors.New("client not found")
+	}
+
+	return client.Client{}, nil
+}
+
+// AuthorizeClientIDSecret implements the op.Storage interface.
+//
+// We don't use a client_secret, so stub implementation.
+func (s *Storage) AuthorizeClientIDSecret(context.Context, string, string) error {
+	return nil
+}
+
+// CreateAuthRequest implements the op.Storage interface
+// it will be called after parsing and validation of the authentication request.
+func (s *Storage) CreateAuthRequest(ctx context.Context, authReq *oidc.AuthRequest, userID string) (op.AuthRequest, error) {
+	return s.authRequestStorage.CreateAuthRequest(ctx, authReq, userID)
+}
+
+// AuthRequestByID implements the op.Storage interface
+// it will be called after the Login UI redirects back to the OIDC endpoint.
+func (s *Storage) AuthRequestByID(ctx context.Context, id string) (op.AuthRequest, error) {
+	return s.authRequestStorage.AuthRequestByID(ctx, id)
+}
+
+// AuthRequestByCode implements the op.Storage interface
+// it will be called after parsing and validation of the token request (in an authorization code flow).
+func (s *Storage) AuthRequestByCode(ctx context.Context, code string) (op.AuthRequest, error) {
+	return s.authRequestStorage.AuthRequestByCode(ctx, code)
+}
+
+// SaveAuthCode implements the op.Storage interface
+// it will be called after the authentication has been successful and before redirecting the user agent to the redirect_uri
+// (in an authorization code flow).
+func (s *Storage) SaveAuthCode(ctx context.Context, id string, code string) error {
+	return s.authRequestStorage.SaveAuthCode(ctx, id, code)
+}
+
+// DeleteAuthRequest implements the op.Storage interface.
+//
+// It will be called after creating the token response (id and access tokens) for a valid
+//   - authentication request (in an implicit flow)
+//   - token request (in an authorization code flow).
+func (s *Storage) DeleteAuthRequest(ctx context.Context, id string) error {
+	return s.authRequestStorage.DeleteAuthRequest(ctx, id)
+}
+
+// AuthenticateRequest implements the `authenticate` interface of the login.
+func (s *Storage) AuthenticateRequest(requestID, identity string) error {
+	return s.authRequestStorage.AuthenticateRequest(requestID, identity)
+}
+
+// GetPrivateClaimsFromScopes implements the op.Storage interface.
+//
+// It will be called for the creation of a JWT access token to assert claims for custom scopes.
+func (s *Storage) GetPrivateClaimsFromScopes(ctx context.Context, userID, clientID string, scopes []string) (claims map[string]any, err error) {
+	return s.tokenStorage.GetPrivateClaimsFromScopes(ctx, userID, clientID, scopes)
+}
+
+// ValidateJWTProfileScopes implements the op.Storage interface.
+//
+// It will be called to validate the scopes of a JWT Profile Authorization Grant request.
+func (s *Storage) ValidateJWTProfileScopes(ctx context.Context, userID string, scopes []string) ([]string, error) {
+	return s.tokenStorage.ValidateJWTProfileScopes(ctx, userID, scopes)
+}
+
+// SetUserinfoFromScopes implements the op.Storage interface.
+//
+// It will be called for the creation of an id_token, so we'll just pass it to the private function without any further check.
+func (s *Storage) SetUserinfoFromScopes(ctx context.Context, userinfo oidc.UserInfoSetter, userID, clientID string, scopes []string) error {
+	return s.tokenStorage.SetUserinfoFromScopes(ctx, userinfo, userID, clientID, scopes)
+}
+
+// SetUserinfoFromToken implements the op.Storage interface.
+//
+// It will be called for the userinfo endpoint, so we read the token and pass the information from that to the private function.
+func (s *Storage) SetUserinfoFromToken(ctx context.Context, userinfo oidc.UserInfoSetter, tokenID, subject, origin string) error {
+	return s.tokenStorage.SetUserinfoFromToken(ctx, userinfo, tokenID, subject, origin)
+}
+
+// SetIntrospectionFromToken implements the op.Storage interface.
+//
+// It will be called for the introspection endpoint, so we read the token and pass the information from that to the private function.
+func (s *Storage) SetIntrospectionFromToken(ctx context.Context, introspection oidc.IntrospectionResponse, tokenID, subject, clientID string) error {
+	return s.tokenStorage.SetIntrospectionFromToken(ctx, introspection, tokenID, subject, clientID)
+}
+
+// GetKeyByIDAndUserID implements the op.Storage interface.
+//
+// It will be called to validate the signatures of a JWT (JWT Profile Grant and Authentication).
+func (s *Storage) GetKeyByIDAndUserID(ctx context.Context, keyID, clientID string) (*jose.JSONWebKey, error) {
+	return s.tokenStorage.GetKeyByIDAndUserID(ctx, keyID, clientID)
+}
+
+// CreateAccessToken implements the op.Storage interface.
+//
+// It will be called for all requests able to return an access token (Authorization Code Flow, Implicit Flow, JWT Profile, ...).
+func (s *Storage) CreateAccessToken(ctx context.Context, request op.TokenRequest) (string, time.Time, error) {
+	return s.tokenStorage.CreateAccessToken(ctx, request)
+}
+
+// CreateAccessAndRefreshTokens implements the op.Storage interface.
+//
+// It will be called for all requests able to return an access and refresh token (Authorization Code Flow, Refresh Token Request).
+func (s *Storage) CreateAccessAndRefreshTokens(ctx context.Context, req op.TokenRequest, id string) (string, string, time.Time, error) {
+	return s.tokenStorage.CreateAccessAndRefreshTokens(ctx, req, id)
+}
+
+// TokenRequestByRefreshToken implements the op.Storage interface.
+//
+// It will be called after parsing and validation of the refresh token request.
+func (s *Storage) TokenRequestByRefreshToken(ctx context.Context, refreshToken string) (op.RefreshTokenRequest, error) {
+	return s.tokenStorage.TokenRequestByRefreshToken(ctx, refreshToken)
+}
+
+// TerminateSession implements the op.Storage interface.
+//
+// It will be called after the user signed out, therefore the access and refresh token of the user of this client must be removed.
+func (s *Storage) TerminateSession(ctx context.Context, userID string, clientID string) error {
+	return s.tokenStorage.TerminateSession(ctx, userID, clientID)
+}
+
+// RevokeToken implements the op.Storage interface.
+//
+// It will be called after parsing and validation of the token revocation request.
+func (s *Storage) RevokeToken(ctx context.Context, token string, userID string, clientID string) *oidc.Error {
+	return s.tokenStorage.RevokeToken(ctx, token, userID, clientID)
+}
+
+// GetCurrentSigningKey returns the active and currently used signing key.
+func (s *Storage) GetCurrentSigningKey() (*jose.JSONWebKey, error) {
+	return s.keyStorage.GetCurrentSigningKey()
+}
diff --git a/internal/backend/oidc/internal/storage/token/mock_test.go b/internal/backend/oidc/internal/storage/token/mock_test.go
new file mode 100644
index 000000000..ecc5eb27f
--- /dev/null
+++ b/internal/backend/oidc/internal/storage/token/mock_test.go
@@ -0,0 +1,151 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package token_test
+
+import (
+	"time"
+
+	"github.com/zitadel/oidc/pkg/oidc"
+	"golang.org/x/text/language"
+
+	"github.com/siderolabs/omni/internal/backend/oidc/external"
+)
+
+type mockTokenRequest struct{}
+
+func (mockTokenRequest) GetAudience() []string {
+	return []string{"test"}
+}
+
+func (mockTokenRequest) GetScopes() []string {
+	return []string{
+		oidc.ScopeOpenID,
+		external.ScopeClusterPrefix + "cluster1",
+	}
+}
+
+func (mockTokenRequest) GetSubject() string {
+	return "some@example.com"
+}
+
+type mockUserInfoSetter struct {
+	claims  map[string]any
+	subject string
+}
+
+func (m *mockUserInfoSetter) GetSubject() string {
+	return ""
+}
+
+func (m *mockUserInfoSetter) GetName() string {
+	return ""
+}
+
+func (m *mockUserInfoSetter) GetGivenName() string {
+	return ""
+}
+
+func (m *mockUserInfoSetter) GetFamilyName() string {
+	return ""
+}
+
+func (m *mockUserInfoSetter) GetMiddleName() string {
+	return ""
+}
+
+func (m *mockUserInfoSetter) GetNickname() string {
+	return ""
+}
+
+func (m *mockUserInfoSetter) GetProfile() string {
+	return ""
+}
+
+func (m *mockUserInfoSetter) GetPicture() string {
+	return ""
+}
+
+func (m *mockUserInfoSetter) GetWebsite() string {
+	return ""
+}
+
+func (m *mockUserInfoSetter) GetGender() oidc.Gender {
+	return ""
+}
+
+func (m *mockUserInfoSetter) GetBirthdate() string {
+	return ""
+}
+
+func (m *mockUserInfoSetter) GetZoneinfo() string {
+	return ""
+}
+
+func (m *mockUserInfoSetter) GetLocale() language.Tag {
+	return language.Und
+}
+
+func (m *mockUserInfoSetter) GetPreferredUsername() string {
+	return ""
+}
+
+func (m *mockUserInfoSetter) GetEmail() string {
+	return ""
+}
+
+func (m *mockUserInfoSetter) IsEmailVerified() bool {
+	return false
+}
+
+func (m *mockUserInfoSetter) GetPhoneNumber() string {
+	return ""
+}
+
+func (m *mockUserInfoSetter) IsPhoneNumberVerified() bool {
+	return false
+}
+
+func (m *mockUserInfoSetter) GetAddress() oidc.UserInfoAddress {
+	return nil
+}
+
+func (m *mockUserInfoSetter) GetClaim(string) any {
+	return nil
+}
+
+func (m *mockUserInfoSetter) GetClaims() map[string]any {
+	return nil
+}
+
+func (m *mockUserInfoSetter) SetSubject(sub string) {
+	m.subject = sub
+}
+
+func (m *mockUserInfoSetter) AppendClaims(key string, values any) {
+	if m.claims == nil {
+		m.claims = map[string]any{}
+	}
+
+	m.claims[key] = values
+}
+
+func (m *mockUserInfoSetter) SetName(string)                  {}
+func (m *mockUserInfoSetter) SetGivenName(string)             {}
+func (m *mockUserInfoSetter) SetFamilyName(string)            {}
+func (m *mockUserInfoSetter) SetMiddleName(string)            {}
+func (m *mockUserInfoSetter) SetNickname(string)              {}
+func (m *mockUserInfoSetter) SetUpdatedAt(time.Time)          {}
+func (m *mockUserInfoSetter) SetProfile(string)               {}
+func (m *mockUserInfoSetter) SetPicture(string)               {}
+func (m *mockUserInfoSetter) SetWebsite(string)               {}
+func (m *mockUserInfoSetter) SetGender(oidc.Gender)           {}
+func (m *mockUserInfoSetter) SetBirthdate(string)             {}
+func (m *mockUserInfoSetter) SetZoneinfo(string)              {}
+func (m *mockUserInfoSetter) SetLocale(language.Tag)          {}
+func (m *mockUserInfoSetter) SetPreferredUsername(string)     {}
+func (m *mockUserInfoSetter) SetEmail(string, bool)           {}
+func (m *mockUserInfoSetter) SetPhone(string, bool)           {}
+func (m *mockUserInfoSetter) SetAddress(oidc.UserInfoAddress) {}
diff --git a/internal/backend/oidc/internal/storage/token/storage.go b/internal/backend/oidc/internal/storage/token/storage.go
new file mode 100644
index 000000000..23fe4a231
--- /dev/null
+++ b/internal/backend/oidc/internal/storage/token/storage.go
@@ -0,0 +1,374 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package token
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/benbjohnson/clock"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/google/uuid"
+	"github.com/siderolabs/gen/maps"
+	"github.com/zitadel/oidc/pkg/oidc"
+	"github.com/zitadel/oidc/pkg/op"
+	"gopkg.in/square/go-jose.v2"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/oidc/external"
+	"github.com/siderolabs/omni/internal/backend/oidc/internal/models"
+	"github.com/siderolabs/omni/internal/pkg/auth/accesspolicy"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+)
+
+// Lifetime of the token.
+const Lifetime = 5 * time.Minute
+
+// Storage implements storing and handling OIDC access tokens, handling roles and claims.
+type Storage struct {
+	clock  clock.Clock
+	state  state.State
+	tokens map[string]*models.Token
+	lock   sync.Mutex
+}
+
+// NewStorage creates a new token storage.
+func NewStorage(clock clock.Clock, st state.State) *Storage {
+	return &Storage{
+		clock:  clock,
+		tokens: map[string]*models.Token{},
+		state:  st,
+	}
+}
+
+// CreateAccessToken implements the op.Storage interface.
+//
+// It will be called for all requests able to return an access token (Authorization Code Flow, Implicit Flow, JWT Profile, ...).
+func (s *Storage) CreateAccessToken(_ context.Context, request op.TokenRequest) (string, time.Time, error) {
+	var applicationID string
+
+	// if authenticated for an app (auth code / implicit flow) we must save the client_id to the token
+	authReq, ok := request.(*models.AuthRequest)
+	if ok {
+		applicationID = authReq.ApplicationID
+	}
+
+	token := s.accessToken(applicationID, "", request.GetSubject(), request.GetAudience(), request.GetScopes())
+
+	return token.ID, token.Expiration, nil
+}
+
+// CreateAccessAndRefreshTokens implements the op.Storage interface.
+//
+// It will be called for all requests able to return an access and refresh token (Authorization Code Flow, Refresh Token Request).
+func (s *Storage) CreateAccessAndRefreshTokens(context.Context, op.TokenRequest, string) (string, string, time.Time, error) {
+	return "", "", time.Time{}, errors.New("not implemented")
+}
+
+// TokenRequestByRefreshToken implements the op.Storage interface.
+//
+// It will be called after parsing and validation of the refresh token request.
+func (s *Storage) TokenRequestByRefreshToken(context.Context, string) (op.RefreshTokenRequest, error) {
+	return nil, errors.New("not implemented")
+}
+
+// TerminateSession implements the op.Storage interface.
+//
+// It will be called after the user signed out, therefore the access and refresh token of the user of this client must be removed.
+func (s *Storage) TerminateSession(_ context.Context, userID string, clientID string) error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	for _, token := range s.tokens {
+		if token.ApplicationID == clientID && token.Subject == userID {
+			delete(s.tokens, token.ID)
+
+			return nil
+		}
+	}
+
+	return nil
+}
+
+// RevokeToken implements the op.Storage interface.
+//
+// It will be called after parsing and validation of the token revocation request.
+func (s *Storage) RevokeToken(_ context.Context, token string, _ string, clientID string) *oidc.Error {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	accessToken, ok := s.tokens[token]
+	if ok {
+		if accessToken.ApplicationID != clientID {
+			return oidc.ErrInvalidClient().WithDescription("token was not issued for this client")
+		}
+
+		// if it is an access token, just remove it
+		// you could also remove the corresponding refresh token if really necessary
+		delete(s.tokens, accessToken.ID)
+
+		return nil
+	}
+
+	return nil
+}
+
+// accessToken will store an access_token in-memory based on the provided information.
+func (s *Storage) accessToken(applicationID, refreshTokenID, subject string, audience, scopes []string) *models.Token {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	token := &models.Token{
+		ID:             uuid.NewString(),
+		ApplicationID:  applicationID,
+		RefreshTokenID: refreshTokenID,
+		Subject:        subject,
+		Audience:       audience,
+		Expiration:     s.clock.Now().Add(Lifetime),
+		Scopes:         scopes,
+	}
+
+	s.tokens[token.ID] = token
+
+	return token
+}
+
+// SetUserinfoFromScopes implements the op.Storage interface.
+//
+// It will be called for the creation of an id_token, so we'll just pass it to the private function without any further check.
+func (s *Storage) SetUserinfoFromScopes(ctx context.Context, userinfo oidc.UserInfoSetter, userID, _ string, scopes []string) error {
+	return s.setUserinfo(ctx, userinfo, userID, scopes)
+}
+
+// SetUserinfoFromToken implements the op.Storage interface.
+//
+// It will be called for the userinfo endpoint, so we read the token and pass the information from that to the private function.
+func (s *Storage) SetUserinfoFromToken(ctx context.Context, userinfo oidc.UserInfoSetter, tokenID, _, _ string) error {
+	token, ok := func() (*models.Token, bool) {
+		s.lock.Lock()
+		defer s.lock.Unlock()
+
+		token, ok := s.tokens[tokenID]
+
+		if ok && s.clock.Now().After(token.Expiration) {
+			return nil, false
+		}
+
+		return token, ok
+	}()
+	if !ok {
+		return errors.New("token is invalid or has expired")
+	}
+
+	return s.setUserinfo(ctx, userinfo, token.Subject, token.Scopes)
+}
+
+// SetIntrospectionFromToken implements the op.Storage interface.
+//
+// It will be called for the introspection endpoint, so we read the token and pass the information from that to the private function.
+func (s *Storage) SetIntrospectionFromToken(ctx context.Context, introspection oidc.IntrospectionResponse, tokenID, subject, clientID string) error {
+	token, ok := func() (*models.Token, bool) {
+		s.lock.Lock()
+		defer s.lock.Unlock()
+
+		token, ok := s.tokens[tokenID]
+
+		return token, ok
+	}()
+	if !ok {
+		return errors.New("token is invalid or has expired")
+	}
+
+	// check if the client is part of the requested audience
+	for _, aud := range token.Audience {
+		if aud == clientID {
+			// the introspection response only has to return a boolean (active) if the token is active
+			// this will automatically be done by the library if you don't return an error
+			// you can also return further information about the user / associated token
+			// e.g. the userinfo (equivalent to userinfo endpoint)
+			err := s.setUserinfo(ctx, introspection, subject, token.Scopes)
+			if err != nil {
+				return err
+			}
+
+			// ...and also the requested scopes...
+			introspection.SetScopes(token.Scopes)
+
+			// ...and the client the token was issued to
+			introspection.SetClientID(token.ApplicationID)
+
+			return nil
+		}
+	}
+
+	return errors.New("token is not valid for this client")
+}
+
+// GetKeyByIDAndUserID implements the op.Storage interface.
+//
+// It will be called to validate the signatures of a JWT (JWT Profile Grant and Authentication).
+func (s *Storage) GetKeyByIDAndUserID(context.Context, string, string) (*jose.JSONWebKey, error) {
+	return nil, errors.New("not implemented")
+}
+
+// setUserinfo sets the info based on the user, scopes and if necessary the clientID.
+func (s *Storage) setUserinfo(ctx context.Context, userInfo oidc.UserInfoSetter, userID string, scopes []string) error {
+	for _, currentScope := range scopes {
+		switch {
+		case currentScope == oidc.ScopeOpenID:
+			userInfo.SetSubject(userID)
+		case strings.HasPrefix(currentScope, external.ScopeClusterPrefix):
+			cluster := currentScope[len(external.ScopeClusterPrefix):]
+
+			impersonateGroups, err := s.getImpersonateGroups(ctx, cluster, userID)
+			if err != nil {
+				return err
+			}
+
+			userInfo.AppendClaims("cluster", cluster)
+			userInfo.AppendClaims("groups", impersonateGroups)
+		}
+	}
+
+	return nil
+}
+
+func (s *Storage) getImpersonateGroups(ctx context.Context, cluster, userID string) ([]string, error) {
+	groupSet := map[string]struct{}{}
+
+	userImpersonateGroups, err := s.impersonateGroupsFromUser(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, group := range userImpersonateGroups {
+		groupSet[group] = struct{}{}
+	}
+
+	accessPolicyImpersonateGroups, err := s.impersonateGroupsFromAccessPolicy(ctx, cluster, userID)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, group := range accessPolicyImpersonateGroups {
+		groupSet[group] = struct{}{}
+	}
+
+	return maps.Keys(groupSet), nil
+}
+
+func (s *Storage) impersonateGroupsFromUser(ctx context.Context, userID string) ([]string, error) {
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	identity, err := safe.StateGet[*auth.Identity](ctx, s.state, auth.NewIdentity(resources.DefaultNamespace, userID).Metadata())
+	if err != nil {
+		return nil, fmt.Errorf("failed to get identity: %w", err)
+	}
+
+	user, err := safe.StateGet[*auth.User](ctx, s.state, auth.NewUser(resources.DefaultNamespace, identity.TypedSpec().Value.GetUserId()).Metadata())
+	if err != nil {
+		return nil, fmt.Errorf("failed to get user: %w", err)
+	}
+
+	userRole, err := role.Parse(user.TypedSpec().Value.GetRole())
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse user role: %w", err)
+	}
+
+	// if the user has the operator role, we assign the default access group (system:masters)
+	if err = userRole.Check(role.Operator); err == nil {
+		return []string{constants.DefaultAccessGroup}, nil
+	}
+
+	return nil, nil
+}
+
+func (s *Storage) impersonateGroupsFromAccessPolicy(ctx context.Context, cluster, userID string) ([]string, error) {
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	accessPolicy, err := safe.StateGet[*auth.AccessPolicy](ctx, s.state, auth.NewAccessPolicy().Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, nil
+		}
+
+		return nil, fmt.Errorf("failed to get access policy: %w", err)
+	}
+
+	clusterRes, err := safe.StateGet[*omni.Cluster](ctx, s.state, omni.NewCluster(resources.DefaultNamespace, cluster).Metadata())
+	if err != nil {
+		return nil, fmt.Errorf("failed to get cluster: %w", err)
+	}
+
+	identityRes, err := safe.StateGet[*auth.Identity](ctx, s.state, auth.NewIdentity(resources.DefaultNamespace, userID).Metadata())
+	if err != nil {
+		return nil, fmt.Errorf("failed to get identity: %w", err)
+	}
+
+	checkResult, err := accesspolicy.Check(accessPolicy, clusterRes.Metadata(), identityRes.Metadata())
+	if err != nil {
+		return nil, fmt.Errorf("failed to check access policy: %w", err)
+	}
+
+	groups := checkResult.KubernetesImpersonateGroups
+
+	// if the ACL matches the operator role, we add the default access group (system:masters)
+	if checkResult.Role.Check(role.Operator) == nil {
+		groups = append(groups, constants.DefaultAccessGroup)
+	}
+
+	return groups, nil
+}
+
+// GetPrivateClaimsFromScopes implements the op.Storage interface.
+//
+// It will be called for the creation of a JWT access token to assert claims for custom scopes.
+func (s *Storage) GetPrivateClaimsFromScopes(ctx context.Context, userID, _ string, scopes []string) (map[string]any, error) {
+	claims := map[string]any{}
+
+	for _, scope := range scopes {
+		if strings.HasPrefix(scope, external.ScopeClusterPrefix) {
+			cluster := scope[len(external.ScopeClusterPrefix):]
+
+			impersonateGroups, err := s.getImpersonateGroups(ctx, cluster, userID)
+			if err != nil {
+				return nil, fmt.Errorf("failed to get impersonate groups: %w", err)
+			}
+
+			claims["cluster"] = cluster
+			claims["groups"] = impersonateGroups
+		}
+	}
+
+	return claims, nil
+}
+
+// ValidateJWTProfileScopes implements the op.Storage interface.
+//
+// It will be called to validate the scopes of a JWT Profile Authorization Grant request.
+func (s *Storage) ValidateJWTProfileScopes(_ context.Context, _ string, scopes []string) ([]string, error) {
+	var allowedScopes []string
+
+	for _, scope := range scopes {
+		switch {
+		case scope == oidc.ScopeOpenID:
+			allowedScopes = append(allowedScopes, scope)
+		case strings.HasPrefix(scope, external.ScopeClusterPrefix):
+			allowedScopes = append(allowedScopes, scope)
+		}
+	}
+
+	return allowedScopes, nil
+}
diff --git a/internal/backend/oidc/internal/storage/token/storage_test.go b/internal/backend/oidc/internal/storage/token/storage_test.go
new file mode 100644
index 000000000..4c145a3b4
--- /dev/null
+++ b/internal/backend/oidc/internal/storage/token/storage_test.go
@@ -0,0 +1,313 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//nolint:goconst
+package token_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/benbjohnson/clock"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/zitadel/oidc/pkg/oidc"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/oidc/external"
+	"github.com/siderolabs/omni/internal/backend/oidc/internal/storage/token"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+)
+
+func TestValidateJWTProfileScopes(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	s := token.NewStorage(clock.NewMock(), st)
+
+	scopes, err := s.ValidateJWTProfileScopes(ctx, "", []string{
+		oidc.ScopeOpenID,
+		external.ScopeClusterPrefix + "talos-default",
+		"other-scope",
+	})
+	require.NoError(t, err)
+
+	assert.Equal(t, []string{
+		oidc.ScopeOpenID,
+		external.ScopeClusterPrefix + "talos-default",
+	}, scopes)
+}
+
+func TestGetPrivateClaimsFromScopes(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	userIdentity := "test-user"
+	userID := "test-user-id"
+	clusterID := "talos-default"
+	group := "foobar"
+
+	accessPolicy := auth.NewAccessPolicy()
+
+	accessPolicy.TypedSpec().Value.Rules = []*specs.AccessPolicyRule{
+		{
+			Users:    []string{userIdentity},
+			Clusters: []string{clusterID},
+			Kubernetes: &specs.AccessPolicyRule_Kubernetes{
+				Impersonate: &specs.AccessPolicyRule_Kubernetes_Impersonate{
+					Groups: []string{group},
+				},
+			},
+		},
+	}
+
+	identity := auth.NewIdentity(resources.DefaultNamespace, userIdentity)
+
+	identity.TypedSpec().Value.UserId = userID
+
+	user := auth.NewUser(resources.DefaultNamespace, userID)
+	user.TypedSpec().Value.Role = string(role.None)
+
+	cluster := omni.NewCluster(resources.DefaultNamespace, clusterID)
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	require.NoError(t, st.Create(ctx, accessPolicy))
+	require.NoError(t, st.Create(ctx, identity))
+	require.NoError(t, st.Create(ctx, user))
+	require.NoError(t, st.Create(ctx, cluster))
+
+	s := token.NewStorage(clock.NewMock(), st)
+
+	claims, err := s.GetPrivateClaimsFromScopes(ctx, userIdentity, "", []string{
+		oidc.ScopeOpenID,
+		external.ScopeClusterPrefix + clusterID,
+		"other-scope",
+	})
+	require.NoError(t, err)
+
+	assert.Equal(t, map[string]any{
+		"cluster": clusterID,
+		"groups":  []string{group},
+	}, claims)
+}
+
+func TestSetUserinfoFromScopes(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	userIdentity := "test@example.com"
+	userID := "test-user-id"
+	clusterID := "talos-default"
+
+	accessPolicy := auth.NewAccessPolicy()
+
+	accessPolicy.TypedSpec().Value.UserGroups = map[string]*specs.AccessPolicyUserGroup{
+		"some-other-user-group": {
+			Users: []*specs.AccessPolicyUserGroup_User{
+				{Name: "some-other-user"},
+			},
+		},
+		"some-user-group": {
+			Users: []*specs.AccessPolicyUserGroup_User{
+				{Name: "doesntmatter1"},
+				{Name: userIdentity},
+				{Name: "doesntmatter2"},
+			},
+		},
+	}
+
+	accessPolicy.TypedSpec().Value.ClusterGroups = map[string]*specs.AccessPolicyClusterGroup{
+		"some-other-cluster-group": {
+			Clusters: []*specs.AccessPolicyClusterGroup_Cluster{
+				{Name: "some-other-cluster-1"},
+				{Name: "some-other-cluster-2"},
+			},
+		},
+		"some-cluster-group": {
+			Clusters: []*specs.AccessPolicyClusterGroup_Cluster{
+				{Name: "doesntmatter1"},
+				{Name: clusterID},
+				{Name: "doesntmatter2"},
+			},
+		},
+	}
+
+	accessPolicy.TypedSpec().Value.Rules = []*specs.AccessPolicyRule{
+		{
+			Users:    []string{"some-user", "group/some-user-group", "some-other-user"},
+			Clusters: []string{"some-cluster", "group/some-cluster-group", "some-other-cluster"},
+			Kubernetes: &specs.AccessPolicyRule_Kubernetes{
+				Impersonate: &specs.AccessPolicyRule_Kubernetes_Impersonate{
+					Groups: []string{"group-1", "group-2"},
+				},
+			},
+		},
+		{
+			Users:    []string{userIdentity},
+			Clusters: []string{clusterID},
+			Kubernetes: &specs.AccessPolicyRule_Kubernetes{
+				Impersonate: &specs.AccessPolicyRule_Kubernetes_Impersonate{
+					Groups: []string{"group-3"},
+				},
+			},
+		},
+		{
+			Users:    []string{userIdentity},
+			Clusters: []string{"some-other-cluster"},
+			Kubernetes: &specs.AccessPolicyRule_Kubernetes{
+				Impersonate: &specs.AccessPolicyRule_Kubernetes_Impersonate{
+					Groups: []string{"group-4"},
+				},
+			},
+		},
+	}
+
+	identity := auth.NewIdentity(resources.DefaultNamespace, userIdentity)
+
+	identity.TypedSpec().Value.UserId = userID
+
+	user := auth.NewUser(resources.DefaultNamespace, userID)
+
+	// will bring constants.DefaultAccessGroup scope
+	user.TypedSpec().Value.Role = string(role.Operator)
+
+	cluster := omni.NewCluster(resources.DefaultNamespace, clusterID)
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	require.NoError(t, st.Create(ctx, accessPolicy))
+	require.NoError(t, st.Create(ctx, identity))
+	require.NoError(t, st.Create(ctx, user))
+	require.NoError(t, st.Create(ctx, cluster))
+
+	s := token.NewStorage(clock.NewMock(), st)
+
+	var mockUserInfo mockUserInfoSetter
+
+	err := s.SetUserinfoFromScopes(ctx, &mockUserInfo, "test@example.com", "", []string{
+		oidc.ScopeOpenID,
+		external.ScopeClusterPrefix + "talos-default",
+		"other-scope",
+	})
+	require.NoError(t, err)
+
+	assert.Equal(t, userIdentity, mockUserInfo.subject)
+
+	actualCluster, ok := mockUserInfo.claims["cluster"]
+	require.True(t, ok)
+	assert.Equal(t, clusterID, actualCluster)
+
+	actualGroups, ok := mockUserInfo.claims["groups"]
+	require.True(t, ok)
+
+	actualGroupsSlc, ok := actualGroups.([]string)
+	require.True(t, ok)
+
+	assert.ElementsMatch(t, []string{constants.DefaultAccessGroup, "group-1", "group-2", "group-3"}, actualGroupsSlc)
+}
+
+func TestTokenIntrospection(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	req := mockTokenRequest{}
+
+	userIdentity := req.GetSubject()
+	userID := "test-user-id"
+
+	identity := auth.NewIdentity(resources.DefaultNamespace, userIdentity)
+
+	identity.TypedSpec().Value.UserId = userID
+
+	user := auth.NewUser(resources.DefaultNamespace, userID)
+
+	// will bring constants.DefaultAccessGroup scope
+	user.TypedSpec().Value.Role = string(role.Operator)
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	require.NoError(t, st.Create(ctx, identity))
+	require.NoError(t, st.Create(ctx, user))
+
+	clock := clock.NewMock()
+	s := token.NewStorage(clock, st)
+
+	// create token and try fetching information from it
+	tokenID, expiration, err := s.CreateAccessToken(ctx, req)
+	require.NoError(t, err)
+
+	assert.Equal(t, clock.Now().Add(token.Lifetime), expiration)
+	assert.NotEmpty(t, tokenID)
+
+	var mockUserInfo mockUserInfoSetter
+
+	err = s.SetUserinfoFromToken(ctx, &mockUserInfo, tokenID, userIdentity, "")
+	require.NoError(t, err)
+
+	assert.Equal(t, "some@example.com", mockUserInfo.subject)
+	assert.Equal(t, map[string]any{
+		"cluster": "cluster1",
+		"groups":  []string{constants.DefaultAccessGroup},
+	}, mockUserInfo.claims)
+
+	// advance time so that token expires
+	clock.Add(token.Lifetime + time.Second)
+
+	err = s.SetUserinfoFromToken(ctx, &mockUserInfo, tokenID, "", "")
+	assert.Error(t, err)
+
+	// invalid ID
+	err = s.SetUserinfoFromToken(ctx, &mockUserInfo, "invalid", "", "")
+	assert.Error(t, err)
+}
+
+func TestRevokeToken(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	clock := clock.NewMock()
+	s := token.NewStorage(clock, st)
+
+	tokenID, _, err := s.CreateAccessToken(ctx, mockTokenRequest{})
+	require.NoError(t, err)
+
+	err = s.RevokeToken(ctx, tokenID, mockTokenRequest{}.GetSubject(), "")
+	require.Nil(t, err)
+
+	err = s.SetUserinfoFromToken(ctx, nil, tokenID, "", "")
+	assert.Error(t, err)
+}
+
+func TestTerminateSession(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	clock := clock.NewMock()
+	s := token.NewStorage(clock, st)
+
+	tokenID, _, err := s.CreateAccessToken(ctx, mockTokenRequest{})
+	require.NoError(t, err)
+
+	err = s.TerminateSession(ctx, mockTokenRequest{}.GetSubject(), "")
+	require.Nil(t, err)
+
+	err = s.SetUserinfoFromToken(ctx, nil, tokenID, "", "")
+	assert.Error(t, err)
+}
diff --git a/internal/backend/oidc/internal/storage/token/token.go b/internal/backend/oidc/internal/storage/token/token.go
new file mode 100644
index 000000000..aa7fee1cb
--- /dev/null
+++ b/internal/backend/oidc/internal/storage/token/token.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package token implements storing and handling OIDC access tokens, handling scopes and claims.
+package token
diff --git a/internal/backend/oidc/oidc.go b/internal/backend/oidc/oidc.go
new file mode 100644
index 000000000..3e427dc5b
--- /dev/null
+++ b/internal/backend/oidc/oidc.go
@@ -0,0 +1,87 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package oidc implements OIDC server.
+package oidc
+
+import (
+	"context"
+	"crypto/rand"
+	"fmt"
+	"os"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/sirupsen/logrus"
+	oidc_logging "github.com/zitadel/logging"
+	"github.com/zitadel/oidc/pkg/op"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/internal/backend/oidc/internal/storage"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+func init() {
+	oidc_logging.SetFormatter(&logrus.JSONFormatter{})
+}
+
+// NewStorage creates OIDC internal storage.
+func NewStorage(st state.State, logger *zap.Logger) *storage.Storage {
+	return storage.NewStorage(st, logger)
+}
+
+// Provider combines OIDC provider and storage.
+type Provider struct {
+	op.OpenIDProvider
+
+	storage *storage.Storage
+}
+
+// NewProvider creates new OIDC provider.
+func NewProvider(ctx context.Context, store *storage.Storage) (*Provider, error) {
+	issuerEndpoint, err := config.Config.GetOIDCIssuerEndpoint()
+	if err != nil {
+		return nil, err
+	}
+
+	// generate fresh crypto key time, as all auth requests are ephemeral in the storage
+	var cryptoKey [32]byte
+
+	_, err = rand.Read(cryptoKey[:])
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate crypto key: %w", err)
+	}
+
+	config := &op.Config{
+		Issuer:                   issuerEndpoint,
+		CryptoKey:                cryptoKey,
+		DefaultLogoutRedirectURI: "/logout",
+		CodeMethodS256:           true,
+		AuthMethodPost:           true,
+		AuthMethodPrivateKeyJWT:  true,
+		GrantTypeRefreshToken:    false,
+		RequestObjectSupported:   true,
+	}
+
+	if constants.IsDebugBuild {
+		// allow HTTP in OIDC issuer endpoint
+		os.Setenv(op.OidcDevMode, "true") //nolint:errcheck
+	}
+
+	h, err := op.NewOpenIDProvider(ctx, config, store)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Provider{
+		OpenIDProvider: h,
+		storage:        store,
+	}, nil
+}
+
+// AuthenticateRequest authenticates OIDC request.
+func (p *Provider) AuthenticateRequest(requestID, identity string) error {
+	return p.storage.AuthenticateRequest(requestID, identity)
+}
diff --git a/internal/backend/proxy_server.go b/internal/backend/proxy_server.go
new file mode 100644
index 000000000..5f5eb607f
--- /dev/null
+++ b/internal/backend/proxy_server.go
@@ -0,0 +1,132 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package backend
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strings"
+	"time"
+
+	"go.uber.org/zap"
+)
+
+// Proxy is a proxy server.
+type Proxy interface {
+	Run(ctx context.Context, next http.Handler, logger *zap.Logger) error
+}
+
+// NewProxyServer creates a new proxy server. If the destination is empty, the proxy server will be a no-op.
+func NewProxyServer(bindAddr string, proxyTo http.Handler, keyFile, certFile string) Proxy {
+	switch {
+	case bindAddr == "":
+		return &nopProxy{reason: "bind address is empty"}
+	case proxyTo == nopHandler:
+		return &nopProxy{reason: "proxy destination is empty"}
+	default:
+		return &httpProxy{
+			bindAddr: bindAddr,
+			proxyTo:  proxyTo,
+			keyFile:  keyFile,
+			certFile: certFile,
+		}
+	}
+}
+
+type httpProxy struct {
+	proxyTo  http.Handler
+	bindAddr string
+	keyFile  string
+	certFile string
+}
+
+func hasPrefix(s string, prefixes ...string) bool {
+	for _, prefix := range prefixes {
+		if strings.HasPrefix(s, prefix) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (prx *httpProxy) Run(ctx context.Context, next http.Handler, logger *zap.Logger) error {
+	server := &server{
+		server: &http.Server{
+			Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if hasPrefix(r.URL.Path, "/api/", "/omnictl/", "/talosctl/", "/image/") {
+					next.ServeHTTP(w, r)
+
+					return
+				}
+
+				prx.proxyTo.ServeHTTP(w, r)
+			}),
+			Addr: prx.bindAddr,
+		},
+		certData: certData{
+			certFile: prx.certFile,
+			keyFile:  prx.keyFile,
+		},
+	}
+
+	logger = logger.With(zap.String("server", prx.bindAddr), zap.String("server_type", "proxy_server"))
+
+	return runServer(ctx, server, logger)
+}
+
+type nopProxy struct {
+	reason string
+}
+
+func (n *nopProxy) Run(ctx context.Context, _ http.Handler, logger *zap.Logger) error {
+	logger.Info("proxy server disabled", zap.String("reason", n.reason))
+
+	<-ctx.Done()
+
+	return nil
+}
+
+// NewFrontendHandler creates a new frontend handler from the given dst address. If dst is empty, the handler will be a no-op.
+func NewFrontendHandler(dst string, logger *zap.Logger) (http.Handler, error) {
+	if dst == "" {
+		logger.Info("frontend handler disabled")
+
+		return nopHandler, nil
+	}
+
+	parse, err := url.ParseRequestURI(dst)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse proxy destination: %w", err)
+	}
+
+	proxy := httputil.NewSingleHostReverseProxy(parse)
+
+	// Some basic client settings so that the proxy works as expected even in dev mode.
+	proxy.Transport = &http.Transport{
+		DialContext: (&net.Dialer{
+			Timeout:   30 * time.Second,
+			KeepAlive: 30 * time.Second,
+		}).DialContext,
+		IdleConnTimeout:       90 * time.Second,
+		ResponseHeaderTimeout: 10 * time.Second,
+		ExpectContinueTimeout: 1 * time.Second,
+	}
+
+	logger.Info("frontend handler enabled", zap.String("destination", dst))
+
+	return proxy, nil
+}
+
+var nopHandler http.Handler = &nopServeHTTP{}
+
+type nopServeHTTP struct{}
+
+func (*nopServeHTTP) ServeHTTP(http.ResponseWriter, *http.Request) {}
diff --git a/internal/backend/resourcelogger/resourcelogger.go b/internal/backend/resourcelogger/resourcelogger.go
new file mode 100644
index 000000000..b43d9e343
--- /dev/null
+++ b/internal/backend/resourcelogger/resourcelogger.go
@@ -0,0 +1,213 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package resourcelogger provides a logger for resource updates.
+package resourcelogger
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/hexops/gotextdiff"
+	"github.com/hexops/gotextdiff/myers"
+	"github.com/hexops/gotextdiff/span"
+	"github.com/siderolabs/gen/maps"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
+	"gopkg.in/yaml.v3"
+)
+
+type eventHandler func(event state.Event) error
+
+// Logger logs resource updates.
+type Logger struct {
+	state        state.State
+	eventCh      chan state.Event
+	eventHandler eventHandler
+	types        map[resource.Type]*meta.ResourceDefinition
+}
+
+// New creates a new resource logger. It logs diffs of resource updates on the given types using the given logger with the given log level.
+func New(ctx context.Context, st state.State, logger *zap.Logger, level string, typeNames ...string) (*Logger, error) {
+	lvl, err := zapcore.ParseLevel(level)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse log level: %w", err)
+	}
+
+	types, err := resolveResourceTypes(ctx, st, typeNames)
+	if err != nil {
+		return nil, fmt.Errorf("failed to resolve resource types: %w", err)
+	}
+
+	return &Logger{
+		types:        types,
+		state:        st,
+		eventCh:      make(chan state.Event),
+		eventHandler: loggingEventHandler(logger, lvl, types),
+	}, nil
+}
+
+func loggingEventHandler(logger *zap.Logger, lvl zapcore.Level, types map[resource.Type]*meta.ResourceDefinition) eventHandler {
+	return func(event state.Event) error {
+		switch event.Type { //nolint:exhaustive
+		case state.Created, state.Updated, state.Destroyed:
+		default:
+			return nil
+		}
+
+		sensitivity := types[event.Resource.Metadata().Type()].TypedSpec().Sensitivity
+
+		// log the diff only if this is an update event and the resource is not sensitive
+		logDiff := event.Type == state.Updated && sensitivity != meta.Sensitive
+
+		fields := []zap.Field{
+			zap.String("resource", event.Resource.Metadata().String()),
+		}
+
+		if logDiff {
+			oldYAML, err := resourceAsYAML(event.Old)
+			if err != nil {
+				return fmt.Errorf("failed to convert old resource to YAML: %w", err)
+			}
+
+			newYAML, err := resourceAsYAML(event.Resource)
+			if err != nil {
+				return fmt.Errorf("failed to convert new resource to YAML: %w", err)
+			}
+
+			resStr := resource.String(event.Old)
+
+			edits := myers.ComputeEdits(span.URIFromPath(resStr), oldYAML, newYAML)
+			diff := gotextdiff.ToUnified(resStr, resStr, oldYAML, edits)
+			diffLines := strings.Split(fmt.Sprint(diff), "\n")
+
+			fields = append(fields, zap.Strings("diff", diffLines))
+		}
+
+		logger.Log(lvl, "resource "+strings.ToLower(event.Type.String()), fields...)
+
+		return nil
+	}
+}
+
+func resourceAsYAML(res resource.Resource) (string, error) {
+	resYAML, err := resource.MarshalYAML(res)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal resource to YAML: %w", err)
+	}
+
+	yamlBytes, err := yaml.Marshal(resYAML)
+	if err != nil {
+		return "", fmt.Errorf("failed to marshal resource to YAML bytes: %w", err)
+	}
+
+	return string(yamlBytes), nil
+}
+
+// StartWatches starts the watches for all resource types and returns.
+func (l *Logger) StartWatches(ctx context.Context) error {
+	for _, resType := range l.types {
+		md := resource.NewMetadata(resType.TypedSpec().DefaultNamespace, resType.TypedSpec().Type, "", resource.VersionUndefined)
+
+		if err := l.state.WatchKind(ctx, md, l.eventCh); err != nil {
+			return fmt.Errorf("failed to watch resource %q: %w", resType.Metadata(), err)
+		}
+	}
+
+	return nil
+}
+
+// StartLogger starts the logger and blocks until the context is canceled.
+func (l *Logger) StartLogger(ctx context.Context) error {
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case event := <-l.eventCh:
+			if event.Type == state.Errored {
+				return fmt.Errorf("watch errored: %w", event.Error)
+			}
+
+			if err := l.eventHandler(event); err != nil {
+				return err
+			}
+		}
+	}
+}
+
+// Start starts the watches, then starts the logger and blocks until the context is canceled.
+func (l *Logger) Start(ctx context.Context) error {
+	if err := l.StartWatches(ctx); err != nil {
+		return err
+	}
+
+	return l.StartLogger(ctx)
+}
+
+func resolveResourceTypes(ctx context.Context, st state.State, resourceTypes []string) (map[resource.Type]*meta.ResourceDefinition, error) {
+	namesToDefinitions, err := resourceNamesToDefinitions(ctx, st)
+	if err != nil {
+		return nil, err
+	}
+
+	definitions := make(map[resource.Type]*meta.ResourceDefinition, len(resourceTypes))
+
+	for _, resourceType := range resourceTypes {
+		name := strings.ToLower(resourceType)
+
+		resDefinitions, ok := namesToDefinitions[name]
+		if !ok {
+			return nil, fmt.Errorf("resource type %q is not registered", resourceType)
+		}
+
+		if len(resDefinitions) > 1 {
+			return nil, fmt.Errorf("resource type %q is ambiguous: %q", resourceType, maps.Keys(resDefinitions))
+		}
+
+		for resourceType, definition := range resDefinitions {
+			definitions[resourceType] = definition
+
+			break
+		}
+	}
+
+	return definitions, nil
+}
+
+func resourceNamesToDefinitions(ctx context.Context, st state.State) (map[string]map[resource.Type]*meta.ResourceDefinition, error) {
+	rds, err := safe.StateListAll[*meta.ResourceDefinition](ctx, st)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list resource definitions: %w", err)
+	}
+
+	nameToRDs := make(map[string]map[resource.ID]*meta.ResourceDefinition, rds.Len()*3)
+
+	add := func(name string, rd *meta.ResourceDefinition) {
+		name = strings.ToLower(name)
+
+		if _, ok := nameToRDs[name]; !ok {
+			nameToRDs[name] = make(map[resource.ID]*meta.ResourceDefinition)
+		}
+
+		nameToRDs[name][rd.TypedSpec().Type] = rd
+	}
+
+	for it := rds.Iterator(); it.Next(); {
+		rd := it.Value()
+
+		add(rd.Metadata().ID(), rd)
+
+		for _, alias := range rd.TypedSpec().AllAliases {
+			add(alias, rd)
+		}
+	}
+
+	return nameToRDs, nil
+}
diff --git a/internal/backend/resourcelogger/resourcelogger_test.go b/internal/backend/resourcelogger/resourcelogger_test.go
new file mode 100644
index 000000000..2816ab1b0
--- /dev/null
+++ b/internal/backend/resourcelogger/resourcelogger_test.go
@@ -0,0 +1,243 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package resourcelogger_test
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/cosi-project/runtime/pkg/state/registry"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
+	"go.uber.org/zap/zaptest/observer"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	resourceregistry "github.com/siderolabs/omni/client/pkg/omni/resources/registry"
+	"github.com/siderolabs/omni/internal/backend/resourcelogger"
+)
+
+func TestResourceLogger(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	t.Cleanup(cancel)
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+	resourceRegistry := registry.NewResourceRegistry(st)
+
+	for _, r := range resourceregistry.Resources {
+		require.NoError(t, resourceRegistry.Register(ctx, r))
+	}
+
+	machineStatus := omni.NewMachineStatus(resources.DefaultNamespace, "test")
+	cbs := omni.NewClusterBootstrapStatus(resources.DefaultNamespace, "test")
+	cp := omni.NewConfigPatch(resources.DefaultNamespace, "test")
+
+	logObserverCore, observedLogs := observer.New(zapcore.InfoLevel)
+
+	logger := zap.New(logObserverCore)
+
+	resLogger, err := resourcelogger.New(ctx, st, logger, zapcore.WarnLevel.String(), "machinestatus", "cbs", "configpatches")
+	require.NoError(t, err)
+
+	require.NoError(t, resLogger.StartWatches(ctx))
+
+	var eg errgroup.Group
+
+	t.Cleanup(func() {
+		cancel()
+
+		require.NoError(t, eg.Wait())
+	})
+
+	eg.Go(func() error { return resLogger.StartLogger(ctx) })
+
+	machineStatus.TypedSpec().Value.Cluster = "some-cluster"
+	machineStatus.TypedSpec().Value.ManagementAddress = "some-address"
+	machineStatus.TypedSpec().Value.TalosVersion = "v1.2.3"
+	machineStatus.TypedSpec().Value.Role = specs.MachineStatusSpec_WORKER
+	machineStatus.TypedSpec().Value.Network = &specs.MachineStatusSpec_NetworkStatus{
+		Hostname:        "aaa",
+		Domainname:      "bbb",
+		Addresses:       []string{"1.2.3.4", "5.6.7.8"},
+		DefaultGateways: []string{"2.3.4.5"},
+		NetworkLinks: []*specs.MachineStatusSpec_NetworkStatus_NetworkLinkStatus{
+			{
+				LinuxName:       "linux-name",
+				HardwareAddress: "hw-address",
+				SpeedMbps:       1234,
+				LinkUp:          true,
+				Description:     "hello",
+			},
+		},
+	}
+	cbs.TypedSpec().Value.Bootstrapped = false
+	cp.TypedSpec().Value.Data = "some data"
+
+	require.NoError(t, st.Create(ctx, machineStatus))
+	require.NoError(t, st.Create(ctx, cbs))
+	require.NoError(t, st.Create(ctx, cp))
+
+	machineStatus.TypedSpec().Value.Cluster = "some-cluster-updated"
+	machineStatus.TypedSpec().Value.ManagementAddress = "some-address-updated"
+	machineStatus.TypedSpec().Value.Network.Domainname = "ccc"
+	cbs.TypedSpec().Value.Bootstrapped = true
+	cp.TypedSpec().Value.Data = "some data updated"
+
+	require.NoError(t, st.Update(ctx, machineStatus))
+	require.NoError(t, st.Update(ctx, cbs))
+	require.NoError(t, st.Update(ctx, cp))
+
+	require.NoError(t, st.Destroy(ctx, machineStatus.Metadata()))
+	require.NoError(t, st.Destroy(ctx, cbs.Metadata()))
+	require.NoError(t, st.Destroy(ctx, cp.Metadata()))
+
+	assert.EventuallyWithT(t, func(*assert.CollectT) {
+		entries := xslices.Map(observedLogs.All(), func(entry observer.LoggedEntry) logEntry {
+			return parseLogEntry(t, entry)
+		})
+
+		assert.ElementsMatch(t, entries, []logEntry{
+			{
+				message:  "resource created",
+				resource: "ClusterBootstrapStatuses.omni.sidero.dev(default/test@1)",
+			},
+			{
+				message:  "resource created",
+				resource: "MachineStatuses.omni.sidero.dev(default/test@1)",
+			},
+			{
+				message:  "resource created",
+				resource: "ConfigPatches.omni.sidero.dev(default/test@1)",
+			},
+			{
+				message:  "resource updated",
+				resource: "ClusterBootstrapStatuses.omni.sidero.dev(default/test@2)",
+				diff: fmt.Sprintf(`--- ClusterBootstrapStatuses.omni.sidero.dev(default/test)
++++ ClusterBootstrapStatuses.omni.sidero.dev(default/test)
+@@ -2,10 +2,10 @@
+     namespace: default
+     type: ClusterBootstrapStatuses.omni.sidero.dev
+     id: test
+-    version: 1
++    version: 2
+     owner:
+     phase: running
+     created: %s
+     updated: %s
+ spec:
+-    bootstrapped: false
++    bootstrapped: true
+`, cbs.Metadata().Created().Format(time.RFC3339), cbs.Metadata().Updated().Format(time.RFC3339)),
+			},
+			{
+				message:  "resource updated",
+				resource: "MachineStatuses.omni.sidero.dev(default/test@2)",
+				diff: fmt.Sprintf(`--- MachineStatuses.omni.sidero.dev(default/test)
++++ MachineStatuses.omni.sidero.dev(default/test)
+@@ -2,7 +2,7 @@
+     namespace: default
+     type: MachineStatuses.omni.sidero.dev
+     id: test
+-    version: 1
++    version: 2
+     owner:
+     phase: running
+     created: %s
+@@ -12,7 +12,7 @@
+     hardware: null
+     network:
+         hostname: aaa
+-        domainname: bbb
++        domainname: ccc
+         addresses:
+             - 1.2.3.4
+             - 5.6.7.8
+@@ -25,10 +25,10 @@
+               linkup: true
+               description: hello
+     lasterror: ""
+-    managementaddress: some-address
++    managementaddress: some-address-updated
+     connected: false
+     maintenance: false
+-    cluster: some-cluster
++    cluster: some-cluster-updated
+     role: 2
+     platformmetadata: null
+     imagelabels: {}
+`, machineStatus.Metadata().Created().Format(time.RFC3339)),
+			},
+			{
+				message:  "resource updated",
+				resource: "ConfigPatches.omni.sidero.dev(default/test@2)",
+				// there should be no diff logged, as ConfigPatches are sensitive resources
+			},
+			{
+				message:  "resource destroyed",
+				resource: "MachineStatuses.omni.sidero.dev(default/test@2)",
+			},
+			{
+				message:  "resource destroyed",
+				resource: "ClusterBootstrapStatuses.omni.sidero.dev(default/test@2)",
+			},
+			{
+				message:  "resource destroyed",
+				resource: "ConfigPatches.omni.sidero.dev(default/test@2)",
+			},
+		})
+	}, 5*time.Second, 100*time.Millisecond)
+}
+
+type logEntry struct {
+	message  string
+	resource string
+	diff     string
+}
+
+func parseLogEntry(t *testing.T, entry observer.LoggedEntry) logEntry {
+	require.NotEmpty(t, entry.Context)
+	require.LessOrEqual(t, len(entry.Context), 2, "expected at most 2 context fields")
+	require.Equal(t, "resource", entry.Context[0].Key)
+
+	var diffLines []string
+
+	if len(entry.Context) == 2 {
+		require.Equal(t, "diff", entry.Context[1].Key)
+
+		data := entry.Context[1].Interface
+
+		// use reflection to convert private type zap.stringArray to []string
+
+		require.Equal(t, reflect.Slice, reflect.TypeOf(data).Kind())
+		require.Equal(t, reflect.String, reflect.TypeOf(data).Elem().Kind())
+
+		val := reflect.ValueOf(data)
+
+		diffLines = make([]string, 0, val.Len())
+
+		for i := 0; i < val.Len(); i++ {
+			diffLines = append(diffLines, val.Index(i).String())
+		}
+	}
+
+	return logEntry{
+		message:  entry.Message,
+		resource: entry.Context[0].String,
+		diff:     strings.Join(diffLines, "\n"),
+	}
+}
diff --git a/internal/backend/runtime/cosi/cosi.go b/internal/backend/runtime/cosi/cosi.go
new file mode 100644
index 000000000..4fb85a478
--- /dev/null
+++ b/internal/backend/runtime/cosi/cosi.go
@@ -0,0 +1,329 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package cosi contains common code for handling COSI API proxying.
+package cosi
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/channel"
+
+	"github.com/siderolabs/omni/client/api/omni/resources"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+)
+
+// WatchLegacy starts watch on top of COSI state.
+//
+// WatchLegacy performs some tricks to "emulate" Bootstrapped event.
+// Recent COSI versions (in Omni itself, and Talos v1.3+) support native
+// 'Bootstrapped' event, so this handler is only needed for Talos < 1.3.0.
+// Once Omni deprecates Talos 1.2.x, this method can be safely removed.
+//
+//nolint:gocognit,gocyclo,cyclop
+func WatchLegacy(ctx context.Context, st state.State, md resource.Metadata, out chan<- runtime.WatchResponse, tailEvents int, queries []resource.LabelQuery) error {
+	var items []*runtime.Resource
+
+	events := make(chan state.Event)
+
+	var err error
+
+	listMD := resource.NewMetadata(md.Namespace(), md.Type(), "", resource.VersionUndefined)
+
+	var opts []state.WatchKindOption //nolint:prealloc
+
+	for _, query := range queries {
+		opts = append(opts, state.WatchWithLabelQuery(resource.RawLabelQuery(query)))
+	}
+
+	if md.ID() == "" {
+		err = st.WatchKind(ctx, md, events, opts...)
+	} else {
+		var opts []state.WatchOption
+		if tailEvents != 0 {
+			opts = append(opts, state.WithTailEvents(tailEvents))
+		}
+
+		err = st.Watch(ctx, md, events, opts...)
+	}
+
+	if err != nil {
+		return err
+	}
+
+	created := func(ctx context.Context, r *runtime.Resource) error {
+		var ev *resources.WatchResponse
+
+		ev, err = runtime.NewWatchResponse(resources.EventType_CREATED, r, nil)
+		if err != nil {
+			return err
+		}
+
+		items = append(items, r)
+
+		channel.SendWithContext(ctx, out, responseFromResource(ev, r))
+
+		return nil
+	}
+
+	var listOpts []state.ListOption //nolint:prealloc
+
+	for _, query := range queries {
+		listOpts = append(listOpts, state.WithLabelQuery(resource.RawLabelQuery(query)))
+	}
+
+	var listResponse resource.List
+
+	if md.ID() == "" {
+		listResponse, err = st.List(ctx, listMD, listOpts...)
+		if err != nil {
+			return err
+		}
+	} else {
+		res, resErr := st.Get(ctx, md)
+		if resErr != nil {
+			if !state.IsNotFoundError(resErr) {
+				return resErr
+			}
+		}
+
+		if res != nil {
+			listResponse.Items = append(listResponse.Items, res)
+		}
+	}
+
+	for _, item := range listResponse.Items {
+		r, rErr := runtime.NewResource(item)
+		if rErr != nil {
+			return rErr
+		}
+
+		if rErr = created(ctx, r); rErr != nil {
+			return rErr
+		}
+	}
+
+	channel.SendWithContext(ctx, out, newBooststrappedResponse())
+
+	for {
+		var ev *resources.WatchResponse
+
+		select {
+		case msg := <-events:
+			if _, ok := msg.Resource.(*resource.Tombstone); ok {
+				continue
+			}
+
+			var r *runtime.Resource
+
+			if msg.Resource != nil {
+				r, err = runtime.NewResource(msg.Resource)
+				if err != nil {
+					return fmt.Errorf("failed to create resource %w", err)
+				}
+			}
+
+			switch msg.Type {
+			case state.Created:
+				if err = created(ctx, r); err != nil {
+					return err
+				}
+			case state.Updated:
+				index := itemIndex(items, r)
+				if index < 0 {
+					// when tail events is specified we should never get Created event
+					// so the first update should be treated as updated
+					if tailEvents == 0 {
+						return errors.New("failed to find an old item in the items cache")
+					} else if err = created(ctx, r); err != nil {
+						return err
+					}
+
+					continue
+				}
+
+				items[index] = r
+
+				ev, err = runtime.NewWatchResponseFromCOSIEvent(msg)
+				if err != nil {
+					return fmt.Errorf("failed to encode resource to send back to the client %w", err)
+				}
+
+				channel.SendWithContext(ctx, out, responseFromResource(ev, r))
+			case state.Destroyed:
+				index := itemIndex(items, r)
+
+				if index < 0 {
+					return errors.New("failed to find an old item in the items cache")
+				}
+
+				ev, err = runtime.NewWatchResponseFromCOSIEvent(msg)
+				if err != nil {
+					return fmt.Errorf("failed to encode resource to send back to the client %w", err)
+				}
+
+				items = append(items[:index], items[index+1:]...)
+
+				channel.SendWithContext(ctx, out, responseFromResource(ev, r))
+			case state.Bootstrapped:
+				// ignored, see Watch() below
+			case state.Errored:
+				return fmt.Errorf("watch error: %w", msg.Error)
+			}
+		case <-ctx.Done():
+			return nil
+		}
+	}
+}
+
+func itemIndex(items []*runtime.Resource, r *runtime.Resource) int {
+	var (
+		index int
+		item  *runtime.Resource
+	)
+
+	for index, item = range items {
+		if item.ID == r.ID {
+			break
+		}
+	}
+
+	return index
+}
+
+// Watch starts watch on top of COSI state.
+//
+// Watch converts COSI representation into resource API version.
+func Watch(ctx context.Context, st state.State, md resource.Metadata, out chan<- runtime.WatchResponse, tailEvents int, queries []resource.LabelQuery) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	events := make(chan state.Event)
+
+	var err error
+
+	opts := []state.WatchKindOption{
+		state.WithBootstrapContents(true),
+	}
+
+	for _, query := range queries {
+		opts = append(opts, state.WatchWithLabelQuery(resource.RawLabelQuery(query)))
+	}
+
+	if md.ID() == "" {
+		err = st.WatchKind(ctx, md, events, opts...)
+	} else {
+		var opts []state.WatchOption
+		if tailEvents != 0 {
+			opts = append(opts, state.WithTailEvents(tailEvents))
+		}
+
+		err = st.Watch(ctx, md, events, opts...)
+	}
+
+	if err != nil {
+		return err
+	}
+
+	// single-resource Watch in COSI doesn't use Bootstrapped event, as it always
+	// send a single event back anyways, so mock here Bootstrapped to be compatible with expected Resource service API
+	// TODO: we should probably drop bootstrapped in the frontend for single-item watches?
+	var bootstrapOnce sync.Once
+
+	bootstrapEvent := func() {
+		channel.SendWithContext(ctx, out, newBooststrappedResponse())
+	}
+
+	for {
+		var msg state.Event
+
+		select {
+		case msg = <-events:
+		case <-ctx.Done():
+			return nil
+		}
+
+		if msg.Type == state.Destroyed {
+			if _, ok := msg.Resource.(*resource.Tombstone); ok {
+				if md.ID() != "" {
+					bootstrapOnce.Do(bootstrapEvent)
+				}
+
+				continue
+			}
+		}
+
+		switch msg.Type {
+		case state.Created, state.Updated, state.Destroyed:
+			ev, err := runtime.NewWatchResponseFromCOSIEvent(msg)
+			if err != nil {
+				return err
+			}
+
+			channel.SendWithContext(ctx, out, NewResponse(msg.Resource.Metadata().ID(), msg.Resource.Metadata().Namespace(), ev, msg.Resource))
+		case state.Bootstrapped:
+			bootstrapOnce.Do(bootstrapEvent)
+		case state.Errored:
+			return fmt.Errorf("watch error: %w", msg.Error)
+		}
+
+		if md.ID() != "" {
+			bootstrapOnce.Do(bootstrapEvent)
+		}
+	}
+}
+
+func responseFromResource(resp *resources.WatchResponse, r *runtime.Resource) runtime.WatchResponse {
+	return NewResponse(
+		r.Metadata.ID,
+		r.Metadata.Namespace,
+		resp,
+		r.Resource,
+	)
+}
+
+func newBooststrappedResponse() runtime.WatchResponse {
+	return NewResponse(
+		"",
+		"",
+		&resources.WatchResponse{
+			Event: &resources.Event{EventType: resources.EventType_BOOTSTRAPPED},
+		},
+		nil,
+	)
+}
+
+// NewResponse creates new watch response.
+func NewResponse(id, namespace string, resp *resources.WatchResponse, res resource.Resource) runtime.WatchResponse {
+	return &watchResponse{BasicResponse: runtime.NewBasicResponse(id, namespace, resp), res: res}
+}
+
+type watchResponse struct {
+	res resource.Resource
+	runtime.BasicResponse
+}
+
+func (w *watchResponse) Field(name string) (string, bool) {
+	val, ok := w.BasicResponse.Field(name)
+	if ok {
+		return val, true
+	}
+
+	val, ok = runtime.ResourceField(w.res, name)
+	if ok {
+		return val, true
+	}
+
+	return "", false
+}
+
+func (w *watchResponse) Match(searchFor string) bool {
+	return w.BasicResponse.Match(searchFor) || runtime.MatchResource(w.res, searchFor)
+}
diff --git a/internal/backend/runtime/export_test.go b/internal/backend/runtime/export_test.go
new file mode 100644
index 000000000..2e3f71b20
--- /dev/null
+++ b/internal/backend/runtime/export_test.go
@@ -0,0 +1,8 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package runtime
+
+type ProxyRuntime = proxyRuntime
diff --git a/internal/backend/runtime/keyprovider/storage.go b/internal/backend/runtime/keyprovider/storage.go
new file mode 100644
index 000000000..84c18c416
--- /dev/null
+++ b/internal/backend/runtime/keyprovider/storage.go
@@ -0,0 +1,246 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package keyprovider contains a key provider.
+package keyprovider
+
+import (
+	"context"
+	"crypto/rand"
+	"errors"
+
+	"github.com/ProtonMail/gopenpgp/v2/crypto"
+	"github.com/cosi-project/runtime/pkg/keystorage"
+	"github.com/cosi-project/state-etcd/pkg/keystorage/recstore"
+	"github.com/cosi-project/state-etcd/pkg/state/impl/etcd"
+	"github.com/siderolabs/gen/ensure"
+	"github.com/siderolabs/gen/xerrors"
+	"go.uber.org/zap"
+)
+
+// KeyProvider is a key provider.
+type KeyProvider struct {
+	recstore   *recstore.RecStore[*keystorage.KeyStorage]
+	privateKey PrivateKeyData
+	version    int64
+}
+
+// ProvideKey imlements KeyProvider.
+func (s *KeyProvider) ProvideKey() ([]byte, error) {
+	got, err := s.recstore.Get(context.Background())
+	if err != nil {
+		return nil, err
+	}
+
+	key, err := got.Res.GetMasterKey(s.privateKey.slot, s.privateKey.key)
+	if err != nil {
+		return nil, err
+	}
+
+	return key, nil
+}
+
+// New creates a new key provider.
+func New(
+	client etcd.Client,
+	name string,
+	privateKey PrivateKeyData,
+	publicKeys []PublicKeyData,
+	logger *zap.Logger,
+) (*KeyProvider, error) {
+	recStore := recstore.New(client, name, "keystore-omni", storageMarshal, storageUnmarshal)
+
+	res, err := recStore.Get(context.Background())
+	if err != nil {
+		ok := xerrors.TagIs[recstore.NotFoundTag](err)
+		if !ok {
+			return nil, err
+		}
+
+		// We do not have a key store yet, so we create a new one.
+		return initKeyProvider(name, recStore, privateKey, publicKeys, logger)
+	}
+
+	keyStorage := res.Res
+	version := res.Version
+
+	_, err = keyStorage.GetMasterKey(privateKey.slot, privateKey.key)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(publicKeys) > 0 {
+		// We have new public keys, let's try to add them to the key storage
+		err = storePublicKeys(keyStorage, privateKey, publicKeys, logger)
+		if err != nil {
+			return nil, err
+		}
+
+		err = recStore.Update(context.Background(), keyStorage, version)
+		if err != nil {
+			return nil, err
+		}
+
+		version++
+	}
+
+	logger.Info(
+		"using existing key store",
+		zap.String("name", name),
+		zap.String("slot", privateKey.slot),
+		zap.Int64("version", version),
+		zap.String("key_identity", ensure.Value(GetIdentityString(privateKey.key))),
+	)
+
+	return &KeyProvider{
+		recstore:   recStore,
+		privateKey: privateKey,
+		version:    version,
+	}, nil
+}
+
+// GetIdentityString returns the identity string from the openpgp key.
+func GetIdentityString(key string) (string, error) {
+	armored, err := crypto.NewKeyFromArmored(key)
+	if err != nil {
+		return "", err
+	}
+
+	firstIdentity := ""
+
+	for name := range armored.GetEntity().Identities {
+		firstIdentity = name
+
+		break
+	}
+
+	if firstIdentity == "" {
+		return "", errors.New("no identity attached to the key found")
+	}
+
+	return firstIdentity + " <" + armored.GetFingerprint() + ">", nil
+}
+
+func storePublicKeys(ks *keystorage.KeyStorage, privateKey PrivateKeyData, publicKeys []PublicKeyData, logger *zap.Logger) error {
+	for _, elem := range publicKeys {
+		err := ks.AddKeySlot(elem.slot, elem.key, privateKey.slot, privateKey.key)
+		if err != nil {
+			if !xerrors.TagIs[keystorage.SlotAlreadyExists](err) {
+				return err
+			}
+
+			// Ignore SlotAlreadyExists error
+			logger.Info("slot already exists, skipping", zap.String("slot", elem.slot))
+
+			continue
+		}
+	}
+
+	return nil
+}
+
+func storageMarshal(ks *keystorage.KeyStorage) ([]byte, error) {
+	return ks.MarshalBinary()
+}
+
+func storageUnmarshal(data []byte) (*keystorage.KeyStorage, error) {
+	ks := &keystorage.KeyStorage{}
+
+	if err := ks.UnmarshalBinary(data); err != nil {
+		return nil, err
+	}
+
+	return ks, nil
+}
+
+func initKeyProvider(name string, recStore *recstore.RecStore[*keystorage.KeyStorage], privateKey PrivateKeyData, publicKeys []PublicKeyData, logger *zap.Logger) (*KeyProvider, error) {
+	logger.Warn(
+		"initializing new key store",
+		zap.String("name", name),
+		zap.String("slot", privateKey.slot),
+		zap.String("key_identity", ensure.Value(GetIdentityString(privateKey.key))),
+	)
+
+	ks := &keystorage.KeyStorage{}
+
+	// We do not have a public key for our private key, so let's create one.
+	armoredKey, err := crypto.NewKeyFromArmored(privateKey.key)
+	if err != nil {
+		return nil, err
+	}
+
+	publicKey, err := armoredKey.GetArmoredPublicKey()
+	if err != nil {
+		return nil, err
+	}
+
+	err = ks.InitializeRnd(rand.Reader, privateKey.slot, publicKey)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(publicKeys) > 0 {
+		// We have new public keys, let's try to add them to the key storage
+		err = storePublicKeys(ks, privateKey, publicKeys, logger)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	version := int64(0)
+
+	err = recStore.Update(context.Background(), ks, version)
+	if err != nil {
+		return nil, err
+	}
+
+	version++
+
+	return &KeyProvider{
+		recstore:   recStore,
+		privateKey: privateKey,
+		version:    version,
+	}, nil
+}
+
+// PublicKeyData is a public key and a slot.
+type PublicKeyData struct {
+	slot string
+	key  string
+}
+
+// MakePublicKeyData creates a new public key.
+func MakePublicKeyData(key string) (PublicKeyData, error) {
+	if key == "" {
+		return PublicKeyData{}, errors.New("key is empty")
+	}
+
+	identityString, err := GetIdentityString(key)
+	if err != nil {
+		return PublicKeyData{}, err
+	}
+
+	return PublicKeyData{slot: identityString, key: key}, nil
+}
+
+// PrivateKeyData is a private key and a slot.
+type PrivateKeyData struct {
+	slot string
+	key  string
+}
+
+// MakePrivateKeyData creates a new private key.
+func MakePrivateKeyData(key string) (PrivateKeyData, error) {
+	if key == "" {
+		return PrivateKeyData{}, errors.New("key is empty")
+	}
+
+	identityString, err := GetIdentityString(key)
+	if err != nil {
+		return PrivateKeyData{}, err
+	}
+
+	return PrivateKeyData{slot: identityString, key: key}, nil
+}
diff --git a/internal/backend/runtime/kubernetes/cleanup.go b/internal/backend/runtime/kubernetes/cleanup.go
new file mode 100644
index 000000000..38e29dced
--- /dev/null
+++ b/internal/backend/runtime/kubernetes/cleanup.go
@@ -0,0 +1,36 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package kubernetes
+
+import "sync"
+
+// ClusterCleanuper is an interface for cleaning up clusters when they are being removed.
+type ClusterCleanuper interface {
+	ClusterRemove(clusterName string)
+}
+
+// cleanuperTracker tracks registered ClusterCleanupers.
+type cleanuperTracker struct {
+	cleanupers   []ClusterCleanuper
+	cleanupersMu sync.Mutex
+}
+
+// RegisterCleanuper adds a cleanup handler to the list so that it gets called when cluster is removed.
+func (cleanuper *cleanuperTracker) RegisterCleanuper(c ClusterCleanuper) {
+	cleanuper.cleanupersMu.Lock()
+	defer cleanuper.cleanupersMu.Unlock()
+
+	cleanuper.cleanupers = append(cleanuper.cleanupers, c)
+}
+
+func (cleanuper *cleanuperTracker) triggerCleanupers(cluster string) {
+	cleanuper.cleanupersMu.Lock()
+	defer cleanuper.cleanupersMu.Unlock()
+
+	for _, c := range cleanuper.cleanupers {
+		c.ClusterRemove(cluster)
+	}
+}
diff --git a/internal/backend/runtime/kubernetes/client.go b/internal/backend/runtime/kubernetes/client.go
new file mode 100644
index 000000000..092d753d0
--- /dev/null
+++ b/internal/backend/runtime/kubernetes/client.go
@@ -0,0 +1,253 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package kubernetes
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+	"time"
+
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/util/connrotation"
+	"sigs.k8s.io/controller-runtime/pkg/client/apiutil"
+)
+
+// Client wrapper.
+type Client struct {
+	client    dynamic.Interface
+	clientset *kubernetes.Clientset
+	Mapper    meta.RESTMapper
+	dialer    *connrotation.Dialer
+}
+
+// Resource ...
+func (c *Client) Resource(res *unstructured.Unstructured) (dynamic.ResourceInterface, error) { //nolint:ireturn
+	var versions []string
+
+	gvk := res.GroupVersionKind()
+
+	if gvk.Version != "" {
+		versions = append(versions, gvk.Version)
+	}
+
+	mapping, err := c.Mapper.RESTMapping(gvk.GroupKind(), versions...)
+	if err != nil {
+		return nil, err
+	}
+
+	var dr dynamic.ResourceInterface
+
+	if mapping.Scope.Name() == meta.RESTScopeNameNamespace {
+		dr = c.client.Resource(mapping.Resource).Namespace(res.GetNamespace())
+	} else {
+		dr = c.client.Resource(mapping.Resource)
+	}
+
+	return dr, nil
+}
+
+// Create saves the object obj in the Kubernetes cluster.
+func (c *Client) Create(ctx context.Context, res *unstructured.Unstructured, opts metav1.CreateOptions, subresources ...string) (*unstructured.Unstructured, error) {
+	dr, err := c.Resource(res)
+	if err != nil {
+		return nil, err
+	}
+
+	return dr.Create(ctx, res, opts, subresources...)
+}
+
+// Delete deletes the given obj from Kubernetes cluster.
+func (c *Client) Delete(ctx context.Context, resource, name, namespace string, opts metav1.DeleteOptions, subresources ...string) error {
+	res, err := c.parseResource(resource, namespace)
+	if err != nil {
+		return err
+	}
+
+	dr, err := c.Resource(res)
+	if err != nil {
+		return err
+	}
+
+	return dr.Delete(ctx, name, opts, subresources...)
+}
+
+// Get retrieves an obj for the given object key from the Kubernetes Cluster.
+func (c *Client) Get(ctx context.Context, resource, name, namespace string, opts metav1.GetOptions, subresources ...string) (*unstructured.Unstructured, error) {
+	res, err := c.parseResource(resource, namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	dr, err := c.Resource(res)
+	if err != nil {
+		return nil, err
+	}
+
+	return dr.Get(ctx, name, opts, subresources...)
+}
+
+// List retrieves the list of object for the given object type from the Kubernetes Cluster.
+func (c *Client) List(ctx context.Context, resource, namespace string, opts metav1.ListOptions) (*unstructured.UnstructuredList, error) {
+	res, err := c.parseResource(resource, namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	dr, err := c.Resource(res)
+	if err != nil {
+		return nil, err
+	}
+
+	return dr.List(ctx, opts)
+}
+
+// Update updates the resource.
+func (c *Client) Update(ctx context.Context, res *unstructured.Unstructured, opts metav1.UpdateOptions, subresources ...string) (*unstructured.Unstructured, error) {
+	dr, err := c.Resource(res)
+	if err != nil {
+		return nil, err
+	}
+
+	return dr.Update(ctx, res, opts, subresources...)
+}
+
+// Dynamic returns the underlying dynamic client.
+func (c *Client) Dynamic() dynamic.Interface { //nolint:ireturn
+	return c.client
+}
+
+// Clientset returns the underlying clientset.
+func (c *Client) Clientset() *kubernetes.Clientset {
+	return c.clientset
+}
+
+// Close closes all clients.
+func (c *Client) Close() {
+	c.dialer.CloseAll()
+}
+
+func (c *Client) kindFor(gvr schema.GroupVersionResource) (schema.GroupVersionKind, error) {
+	return c.Mapper.KindFor(gvr)
+}
+
+func (c *Client) parseResource(resource, namespace string) (*unstructured.Unstructured, error) {
+	gvr, err := c.getGVR(resource)
+	if err != nil {
+		return nil, err
+	}
+
+	res := &unstructured.Unstructured{}
+
+	gvk, err := c.kindFor(*gvr)
+	if err != nil {
+		return nil, err
+	}
+
+	res.SetGroupVersionKind(gvk)
+	res.SetNamespace(namespace)
+
+	return res, nil
+}
+
+func (c *Client) getGVR(resource string) (*schema.GroupVersionResource, error) {
+	var gvr *schema.GroupVersionResource
+
+	parts := strings.Split(resource, ".")
+
+	var err error
+
+	switch {
+	case len(parts) == 2:
+		gvr = &schema.GroupVersionResource{
+			Resource: parts[0],
+			Version:  parts[1],
+		}
+	case len(parts) == 1:
+		gvr, err = c.discoverGVR(resource)
+		if err != nil {
+			return nil, err
+		}
+	default:
+		gvr, _ = schema.ParseResourceArg(resource)
+	}
+
+	if gvr == nil {
+		return nil, errors.New("couldn't parse resource name")
+	}
+
+	return gvr, nil
+}
+
+func (c *Client) discoverGVR(resource string) (*schema.GroupVersionResource, error) {
+	gvr := &schema.GroupVersionResource{
+		Resource: resource,
+	}
+
+	resources, err := c.clientset.ServerPreferredResources()
+	if err != nil {
+		return nil, err
+	}
+
+	for _, res := range resources {
+		for _, r := range res.APIResources {
+			if r.Name == resource {
+				gv, err := schema.ParseGroupVersion(res.GroupVersion)
+				if err != nil {
+					return nil, err
+				}
+
+				gvr.Version = gv.Version
+				gvr.Group = gv.Group
+			}
+		}
+	}
+
+	return gvr, nil
+}
+
+// NewClient creates new Kubernetes client.
+func NewClient(config *rest.Config) (*Client, error) {
+	dialerRef := &net.Dialer{Timeout: 30 * time.Second, KeepAlive: 30 * time.Second}
+	dialer := connrotation.NewDialer(dialerRef.DialContext)
+	config.Dial = dialer.DialContext
+
+	client, err := rest.HTTPClientFor(config)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create HTTP client for %q: %w", config.Host, err)
+	}
+
+	mapper, err := apiutil.NewDynamicRESTMapper(config, client)
+	if err != nil {
+		return nil, err
+	}
+
+	if config.Timeout == 0 {
+		config.Timeout = 30 * time.Second
+	}
+
+	c, err := dynamic.NewForConfig(config)
+	if err != nil {
+		return nil, err
+	}
+
+	var clientset *kubernetes.Clientset
+
+	clientset, err = kubernetes.NewForConfig(config)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Client{c, clientset, mapper, dialer}, nil
+}
diff --git a/internal/backend/runtime/kubernetes/kubernetes.go b/internal/backend/runtime/kubernetes/kubernetes.go
new file mode 100644
index 000000000..f3c50de14
--- /dev/null
+++ b/internal/backend/runtime/kubernetes/kubernetes.go
@@ -0,0 +1,605 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package kubernetes implements the connector that can pull data from the Kubernetes control plane.
+package kubernetes
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	stderrors "errors"
+	"fmt"
+	goruntime "runtime"
+	"strings"
+	"text/template"
+	"time"
+
+	cosiresource "github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/hashicorp/golang-lru/v2/expirable"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/siderolabs/gen/channel"
+	"golang.org/x/sync/errgroup"
+	"golang.org/x/sync/singleflight"
+	v1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/client-go/dynamic/dynamicinformer"
+	"k8s.io/client-go/rest"
+	toolscache "k8s.io/client-go/tools/cache"
+	"k8s.io/client-go/tools/clientcmd"
+
+	"github.com/siderolabs/omni/client/api/common"
+	"github.com/siderolabs/omni/client/api/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/k8s"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	pkgruntime "github.com/siderolabs/omni/client/pkg/runtime"
+	"github.com/siderolabs/omni/internal/backend/oidc/external"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+// Name kubernetes runtime string id.
+var Name = common.Runtime_Kubernetes.String()
+
+const (
+	kubernetesClientLRUSize = 32
+	kubernetesClientTTL     = time.Hour
+)
+
+// New creates new Runtime.
+func New(omniState state.State) (*Runtime, error) {
+	return &Runtime{
+		clientsCache: expirable.NewLRU[string, *Client](kubernetesClientLRUSize, nil, kubernetesClientTTL),
+
+		state: omniState,
+
+		metricCacheSize: prometheus.NewGauge(prometheus.GaugeOpts{
+			Name: "omni_k8s_clientfactory_cache_size",
+			Help: "Number of Kubernetes clients in the cache of Kubernetes runtime.",
+		}),
+		metricActiveClients: prometheus.NewGauge(prometheus.GaugeOpts{
+			Name: "omni_k8s_clientfactory_active_clients",
+			Help: "Number of active Kubernetes clients created by Kubernetes runtime.",
+		}),
+		metricCacheHits: prometheus.NewCounter(prometheus.CounterOpts{
+			Name: "omni_k8s_clientfactory_cache_hits_total",
+			Help: "Number of Kubernetes client factory cache hits.",
+		}),
+		metricCacheMisses: prometheus.NewCounter(prometheus.CounterOpts{
+			Name: "omni_k8s_clientfactory_cache_misses_total",
+			Help: "Number of Kubernetes client factory cache misses.",
+		}),
+	}, nil
+}
+
+// Runtime implements runtime.Runtime.
+type Runtime struct { //nolint:govet // there is just a single instance
+	cleanuperTracker
+	clientsCache *expirable.LRU[string, *Client]
+	sf           singleflight.Group
+
+	state state.State
+
+	metricCacheSize, metricActiveClients prometheus.Gauge
+	metricCacheHits, metricCacheMisses   prometheus.Counter
+}
+
+// Watch creates new kubernetes watch.
+func (r *Runtime) Watch(ctx context.Context, events chan<- runtime.WatchResponse, setters ...runtime.QueryOption) error {
+	opts := runtime.NewQueryOptions(setters...)
+
+	selector := ""
+	if len(opts.LabelSelectors) > 0 {
+		selector = opts.LabelSelectors[0]
+	}
+
+	w := &Watch{
+		resource: &watchRequest{
+			Namespace: opts.Namespace,
+			Type:      opts.Resource,
+			ID:        opts.Name,
+		},
+		events:   events,
+		selector: selector,
+	}
+
+	client, err := r.getOrCreateClient(ctx, opts)
+	if err != nil {
+		return err
+	}
+
+	if err := w.run(ctx, client); err != nil {
+		return fmt.Errorf("error running watch: %w", err)
+	}
+
+	return nil
+}
+
+// Get implements runtime.Runtime.
+func (r *Runtime) Get(ctx context.Context, setters ...runtime.QueryOption) (any, error) {
+	opts := runtime.NewQueryOptions(setters...)
+
+	client, err := r.getOrCreateClient(ctx, opts)
+	if err != nil {
+		return nil, err
+	}
+
+	res, err := client.Get(ctx, opts.Resource, opts.Name, opts.Namespace, metav1.GetOptions{})
+	if err != nil {
+		return nil, wrapError(err, opts)
+	}
+
+	return res, nil
+}
+
+// List implements runtime.Runtime.
+func (r *Runtime) List(ctx context.Context, setters ...runtime.QueryOption) (runtime.ListResult, error) {
+	opts := runtime.NewQueryOptions(setters...)
+
+	client, err := r.getOrCreateClient(ctx, opts)
+	if err != nil {
+		return runtime.ListResult{}, err
+	}
+
+	listOpts := metav1.ListOptions{
+		LabelSelector: opts.LabelSelectors[0],
+		FieldSelector: opts.FieldSelector,
+	}
+
+	list, err := client.List(ctx, opts.Resource, opts.Namespace, listOpts)
+	if err != nil {
+		return runtime.ListResult{}, wrapError(err, opts)
+	}
+
+	res := make([]pkgruntime.ListItem, 0, len(list.Items))
+
+	for _, obj := range list.Items {
+		res = append(res, newItem(obj))
+	}
+
+	return runtime.ListResult{
+		Items: res,
+		Total: len(res),
+	}, nil
+}
+
+// Create implements runtime.Runtime.
+func (r *Runtime) Create(ctx context.Context, resource cosiresource.Resource, setters ...runtime.QueryOption) error {
+	opts := runtime.NewQueryOptions(setters...)
+
+	client, err := r.getOrCreateClient(ctx, opts)
+	if err != nil {
+		return err
+	}
+
+	obj, err := UnstructuredFromResource(resource)
+	if err != nil {
+		return err
+	}
+
+	_, err = client.Create(ctx, obj, metav1.CreateOptions{})
+
+	return wrapError(err, opts)
+}
+
+// Update implements runtime.Runtime.
+func (r *Runtime) Update(ctx context.Context, resource cosiresource.Resource, setters ...runtime.QueryOption) error {
+	opts := runtime.NewQueryOptions(setters...)
+
+	client, err := r.getOrCreateClient(ctx, opts)
+	if err != nil {
+		return err
+	}
+
+	obj, err := UnstructuredFromResource(resource)
+	if err != nil {
+		return err
+	}
+
+	_, err = client.Update(ctx, obj, metav1.UpdateOptions{})
+
+	return wrapError(err, opts)
+}
+
+// Delete implements runtime.Runtime.
+func (r *Runtime) Delete(ctx context.Context, setters ...runtime.QueryOption) error {
+	opts := runtime.NewQueryOptions(setters...)
+
+	client, err := r.getOrCreateClient(ctx, opts)
+	if err != nil {
+		return err
+	}
+
+	return wrapError(client.Delete(ctx, opts.Resource, opts.Name, opts.Namespace, metav1.DeleteOptions{}), opts)
+}
+
+// DestroyClient closes Kubernetes client and deletes it from the client cache.
+func (r *Runtime) DestroyClient(id string) {
+	r.clientsCache.Remove(id)
+	r.sf.Forget(id)
+
+	r.triggerCleanupers(id)
+}
+
+var oidcKubeConfigTemplate = strings.TrimSpace(`
+apiVersion: v1
+kind: Config
+clusters:
+  - cluster:
+      server: {{ .KubernetesProxyEndpoint }}
+    name: {{ .InstanceName }}-{{ .ClusterName }}
+contexts:
+  - context:
+      cluster: {{ .InstanceName }}-{{ .ClusterName }}
+      namespace: default
+      user: {{ .InstanceName }}-{{ .ClusterName }}{{- if .Identity }}-{{ .Identity }}{{ end }}
+    name: {{ .InstanceName }}-{{ .ClusterName }}
+current-context: {{ .InstanceName }}-{{ .ClusterName }}
+users:
+- name: {{ .InstanceName }}-{{ .ClusterName }}{{- if .Identity }}-{{ .Identity }}{{ end }}
+  user:
+    exec:
+      apiVersion: client.authentication.k8s.io/v1beta1
+      args:
+        - oidc-login
+        - get-token
+        - --oidc-issuer-url={{ .EndpointOIDC }}
+        - --oidc-client-id={{ .ClientID }}
+        - --oidc-extra-scope=cluster:{{ .ClusterName }}
+      command: kubectl
+      env: null
+      provideClusterInfo: false
+`) + "\n"
+
+// GetOIDCKubeconfig generates kubeconfig for the user using Omni as OIDC Proxy.
+func (r *Runtime) GetOIDCKubeconfig(context *common.Context, identity string) ([]byte, error) {
+	tmpl, err := template.New("kubeconfig").Parse(oidcKubeConfigTemplate)
+	if err != nil {
+		return nil, err
+	}
+
+	var buf bytes.Buffer
+
+	issuerEndpoint, err := config.Config.GetOIDCIssuerEndpoint()
+	if err != nil {
+		return nil, err
+	}
+
+	if err = tmpl.Execute(&buf, struct {
+		InstanceName string
+		ClusterName  string
+
+		KubernetesProxyEndpoint string
+		EndpointOIDC            string
+
+		ClientID string
+		Identity string
+	}{
+		InstanceName: config.Config.Name,
+		ClusterName:  context.Name,
+
+		EndpointOIDC:            issuerEndpoint,
+		KubernetesProxyEndpoint: config.Config.KubernetesProxyURL,
+
+		ClientID: external.DefaultClientID,
+		Identity: identity,
+	}); err != nil {
+		return nil, err
+	}
+
+	return buf.Bytes(), nil
+}
+
+// GetKubeconfig returns kubeconfig.
+func (r *Runtime) GetKubeconfig(ctx context.Context, context *common.Context) (*rest.Config, error) {
+	if context == nil {
+		return nil, stderrors.New("the context is required")
+	}
+
+	ctx = actor.MarkContextAsInternalActor(ctx)
+	id := context.Name
+
+	kubeconfig, err := safe.ReaderGetByID[*omni.Kubeconfig](ctx, r.state, id)
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, fmt.Errorf("kubeconfig for cluster %s is not found", id)
+		}
+
+		return nil, err
+	}
+
+	return clientcmd.RESTConfigFromKubeConfig(kubeconfig.TypedSpec().Value.Data)
+}
+
+// GetClient returns K8s client.
+func (r *Runtime) GetClient(ctx context.Context, cluster string) (*Client, error) {
+	// require proper auth to access kubeconfig, but allow internal access
+	// this method gets called from the Kubernetes backend
+	if !actor.ContextIsInternalActor(ctx) {
+		if _, err := auth.CheckGRPC(ctx, auth.WithRole(role.Reader)); err != nil {
+			return nil, err
+		}
+	}
+
+	return r.getOrCreateClient(ctx, &runtime.QueryOptions{
+		Context: cluster,
+	})
+}
+
+func (r *Runtime) getOrCreateClient(ctx context.Context, opts *runtime.QueryOptions) (*Client, error) {
+	id := opts.Context
+
+	if client, ok := r.clientsCache.Get(id); ok {
+		r.metricCacheHits.Inc()
+
+		return client, nil
+	}
+
+	ch := r.sf.DoChan(id, func() (any, error) {
+		cfg, err := r.GetKubeconfig(ctx, &common.Context{Name: id})
+		if err != nil {
+			return nil, err
+		}
+
+		client, err := NewClient(cfg)
+		if err != nil {
+			return nil, err
+		}
+
+		r.metricActiveClients.Inc()
+		r.metricCacheMisses.Inc()
+
+		goruntime.SetFinalizer(client, func(client *Client) {
+			r.metricActiveClients.Dec()
+			client.Close()
+		})
+
+		r.clientsCache.Add(id, client)
+
+		return client, nil
+	})
+
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case res := <-ch:
+		if res.Err != nil {
+			return nil, res.Err
+		}
+
+		return res.Val.(*Client), nil //nolint:forcetypeassert // we know the type
+	}
+}
+
+// Describe implements prom.Collector interface.
+func (r *Runtime) Describe(ch chan<- *prometheus.Desc) {
+	prometheus.DescribeByCollect(r, ch)
+}
+
+// Collect implements prom.Collector interface.
+func (r *Runtime) Collect(ch chan<- prometheus.Metric) {
+	r.metricActiveClients.Collect(ch)
+
+	r.metricCacheSize.Set(float64(r.clientsCache.Len()))
+	r.metricCacheSize.Collect(ch)
+
+	r.metricCacheHits.Collect(ch)
+	r.metricCacheMisses.Collect(ch)
+}
+
+var _ prometheus.Collector = &Runtime{}
+
+// Watch watches kubernetes resources.
+type Watch struct {
+	events   chan<- runtime.WatchResponse
+	resource *watchRequest
+	selector string
+}
+
+// watchRequest describes target for Watch.
+type watchRequest struct {
+	Namespace, Type, ID string
+}
+
+func (w *Watch) run(ctx context.Context, client *Client) error {
+	namespace := v1.NamespaceAll
+	if w.resource.Namespace != "" {
+		namespace = w.resource.Namespace
+	}
+
+	filter := func(options *metav1.ListOptions) {
+		if w.selector != "" {
+			options.LabelSelector = w.selector
+		}
+
+		if w.resource.ID != "" {
+			options.FieldSelector = fmt.Sprintf("metadata.name=%s", w.resource.ID)
+		}
+	}
+
+	dynamicInformer := dynamicinformer.NewFilteredDynamicSharedInformerFactory(client.Dynamic(), 0, namespace, filter)
+
+	gvr, err := client.getGVR(w.resource.Type)
+	if err != nil {
+		return err
+	}
+
+	informer := dynamicInformer.ForResource(*gvr)
+
+	errCh := make(chan error, 1)
+
+	eg, ctx := errgroup.WithContext(ctx)
+
+	if err := informer.Informer().SetWatchErrorHandler(func(_ *toolscache.Reflector, e error) {
+		channel.SendWithContext(ctx, errCh, e)
+	}); err != nil {
+		return err
+	}
+
+	informer.Informer().AddEventHandler(toolscache.ResourceEventHandlerFuncs{ //nolint:errcheck
+		AddFunc: func(obj any) {
+			event, err := runtime.NewWatchResponse(resources.EventType_CREATED, obj, nil)
+			if err != nil {
+				channel.SendWithContext(ctx, errCh, err)
+
+				return
+			}
+
+			channel.SendWithContext(ctx, w.events, respFromK8sObject(event, obj))
+		},
+		UpdateFunc: func(oldObj, newObj any) {
+			event, err := runtime.NewWatchResponse(resources.EventType_UPDATED, newObj, oldObj)
+			if err != nil {
+				channel.SendWithContext(ctx, errCh, err)
+
+				return
+			}
+
+			channel.SendWithContext(ctx, w.events, respFromK8sObject(event, newObj))
+		},
+		DeleteFunc: func(obj any) {
+			event, err := runtime.NewWatchResponse(resources.EventType_DESTROYED, obj, nil)
+			if err != nil {
+				channel.SendWithContext(ctx, errCh, err)
+
+				return
+			}
+
+			channel.SendWithContext(ctx, w.events, respFromK8sObject(event, obj))
+		},
+	})
+
+	eg.Go(func() error {
+		dynamicInformer.Start(ctx.Done())
+
+		return nil
+	})
+
+	eg.Go(func() error {
+		select {
+		case <-ctx.Done():
+			return nil
+		case err := <-errCh:
+			return err
+		}
+	})
+
+	dynamicInformer.WaitForCacheSync(ctx.Done())
+
+	channel.SendWithContext(ctx, w.events, booststrappedResponse())
+
+	return eg.Wait()
+}
+
+func wrapError(err error, opts *runtime.QueryOptions) error {
+	md := cosiresource.NewMetadata(opts.Namespace, opts.Resource, opts.Name, cosiresource.VersionUndefined)
+
+	switch {
+	case errors.IsConflict(err):
+		fallthrough
+	case errors.IsAlreadyExists(err):
+		return inmem.ErrAlreadyExists(md)
+	case errors.IsNotFound(err):
+		return inmem.ErrNotFound(md)
+	}
+
+	return err
+}
+
+// UnstructuredFromResource creates Unstructured resource from k8s.KubernetesResource.
+func UnstructuredFromResource(resource cosiresource.Resource) (*unstructured.Unstructured, error) {
+	if resource.Metadata().Type() != k8s.KubernetesResourceType {
+		return nil, fmt.Errorf("kubernetes runtime accepts only %s type as an input, got %s", k8s.KubernetesResourceType, resource.Metadata().Type())
+	}
+
+	var (
+		res *k8s.KubernetesResource
+		ok  bool
+	)
+
+	if res, ok = resource.(*k8s.KubernetesResource); !ok {
+		return nil, stderrors.New("failed to convert spec to KubernetesResourceSpec")
+	}
+
+	data := res.TypedSpec()
+
+	if data == nil {
+		return nil, stderrors.New("no resource spec is defined in the resource")
+	}
+
+	obj := &unstructured.Unstructured{}
+	if err := json.Unmarshal([]byte(*data), &obj.Object); err != nil {
+		return nil, err
+	}
+
+	return obj, nil
+}
+
+func respFromK8sObject(resp *resources.WatchResponse, obj any) runtime.WatchResponse {
+	// copied from klog.KMetadata
+	type metadata interface {
+		GetName() string
+		GetNamespace() string
+	}
+
+	md, ok := obj.(metadata)
+	if !ok {
+		return newWatchResponse("", "", resp)
+	}
+
+	return newWatchResponse(md.GetName(), md.GetNamespace(), resp)
+}
+
+func booststrappedResponse() runtime.WatchResponse {
+	return newWatchResponse(
+		"",
+		"",
+		&resources.WatchResponse{
+			Event: &resources.Event{EventType: resources.EventType_BOOTSTRAPPED},
+		},
+	)
+}
+
+func newWatchResponse(id, namespace string, resp *resources.WatchResponse) runtime.WatchResponse {
+	return &watchResponse{BasicResponse: runtime.NewBasicResponse(id, namespace, resp)}
+}
+
+type watchResponse struct {
+	runtime.BasicResponse
+}
+
+func newItem(obj unstructured.Unstructured) pkgruntime.ListItem {
+	return &item{BasicItem: runtime.MakeBasicItem(obj.GetName(), obj.GetNamespace(), obj)}
+}
+
+type item struct {
+	runtime.BasicItem[unstructured.Unstructured]
+}
+
+func (it *item) Field(name string) (string, bool) {
+	val, ok := it.BasicItem.Field(name)
+	if ok {
+		return val, true
+	}
+
+	// TODO: add field search here
+	return "", false
+}
+
+func (it *item) Match(searchFor string) bool {
+	return it.BasicItem.Match(searchFor)
+}
+
+func (it *item) Unwrap() any {
+	return it.BasicItem.Unwrap()
+}
diff --git a/internal/backend/runtime/kubernetes/kubernetes_test.go b/internal/backend/runtime/kubernetes/kubernetes_test.go
new file mode 100644
index 000000000..e9a9a8f96
--- /dev/null
+++ b/internal/backend/runtime/kubernetes/kubernetes_test.go
@@ -0,0 +1,69 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package kubernetes_test
+
+import (
+	_ "embed"
+	"encoding/json"
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	v1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+
+	"github.com/siderolabs/omni/client/api/common"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/k8s"
+	"github.com/siderolabs/omni/internal/backend/runtime/kubernetes"
+)
+
+func TestResourceConversion(t *testing.T) {
+	pod := &v1.Pod{}
+	pod.Name = "test"
+	pod.Namespace = "test"
+
+	data, err := json.Marshal(pod)
+	assert.NoError(t, err)
+
+	typedRes := typed.NewResource[k8s.KubernetesResourceSpec, k8s.KubernetesResourceExtension](
+		resource.NewMetadata("default", k8s.KubernetesResourceType, "pod", resource.VersionUndefined),
+		k8s.KubernetesResourceSpec(data),
+	)
+
+	res, err := kubernetes.UnstructuredFromResource(typedRes)
+	assert.NoError(t, err)
+	name, ok, err := unstructured.NestedString(res.Object, "metadata", "name")
+	assert.True(t, ok)
+	assert.NoError(t, err)
+	assert.Equal(t, pod.Name, name)
+}
+
+//go:embed testdata/oidc-kubeconfig1.yaml
+var oidcKubeconfig1 []byte
+
+//go:embed testdata/oidc-kubeconfig2.yaml
+var oidcKubeconfig2 []byte
+
+func TestOIDCKubeconfig(t *testing.T) {
+	r, err := kubernetes.New(nil)
+	require.NoError(t, err)
+
+	kubeconfig, err := r.GetOIDCKubeconfig(&common.Context{
+		Name: "cluster1",
+	}, "test@example.com")
+	require.NoError(t, err)
+
+	assert.Equal(t, string(oidcKubeconfig1), string(kubeconfig))
+
+	kubeconfig, err = r.GetOIDCKubeconfig(&common.Context{
+		Name: "cluster1",
+	}, "")
+	require.NoError(t, err)
+
+	assert.Equal(t, string(oidcKubeconfig2), string(kubeconfig))
+}
diff --git a/internal/backend/runtime/kubernetes/testdata/oidc-kubeconfig1.yaml b/internal/backend/runtime/kubernetes/testdata/oidc-kubeconfig1.yaml
new file mode 100644
index 000000000..b56db884c
--- /dev/null
+++ b/internal/backend/runtime/kubernetes/testdata/oidc-kubeconfig1.yaml
@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Config
+clusters:
+  - cluster:
+      server: https://localhost:8095
+    name: default-cluster1
+contexts:
+  - context:
+      cluster: default-cluster1
+      namespace: default
+      user: default-cluster1-test@example.com
+    name: default-cluster1
+current-context: default-cluster1
+users:
+- name: default-cluster1-test@example.com
+  user:
+    exec:
+      apiVersion: client.authentication.k8s.io/v1beta1
+      args:
+        - oidc-login
+        - get-token
+        - --oidc-issuer-url=http://localhost:8080/oidc
+        - --oidc-client-id=native
+        - --oidc-extra-scope=cluster:cluster1
+      command: kubectl
+      env: null
+      provideClusterInfo: false
diff --git a/internal/backend/runtime/kubernetes/testdata/oidc-kubeconfig2.yaml b/internal/backend/runtime/kubernetes/testdata/oidc-kubeconfig2.yaml
new file mode 100644
index 000000000..a30f8c88f
--- /dev/null
+++ b/internal/backend/runtime/kubernetes/testdata/oidc-kubeconfig2.yaml
@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Config
+clusters:
+  - cluster:
+      server: https://localhost:8095
+    name: default-cluster1
+contexts:
+  - context:
+      cluster: default-cluster1
+      namespace: default
+      user: default-cluster1
+    name: default-cluster1
+current-context: default-cluster1
+users:
+- name: default-cluster1
+  user:
+    exec:
+      apiVersion: client.authentication.k8s.io/v1beta1
+      args:
+        - oidc-login
+        - get-token
+        - --oidc-issuer-url=http://localhost:8080/oidc
+        - --oidc-client-id=native
+        - --oidc-extra-scope=cluster:cluster1
+      command: kubectl
+      env: null
+      provideClusterInfo: false
diff --git a/internal/backend/runtime/omni/controllers/controllers.go b/internal/backend/runtime/omni/controllers/controllers.go
new file mode 100644
index 000000000..9f42f8c13
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/controllers.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package controllers contains all Omni internal COSI runtime controllers.
+package controllers
diff --git a/internal/backend/runtime/omni/controllers/omni/backup_data.go b/internal/backend/runtime/omni/controllers/omni/backup_data.go
new file mode 100644
index 000000000..918da36e6
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/backup_data.go
@@ -0,0 +1,97 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/xerrors"
+	"go.uber.org/zap"
+	"google.golang.org/protobuf/types/known/durationpb"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// BackupDataController is a controller that manages BackupData.
+type BackupDataController = qtransform.QController[*omni.Cluster, *omni.BackupData]
+
+// NewBackupDataController initializes BackupDataController.
+func NewBackupDataController() *BackupDataController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.Cluster, *omni.BackupData]{
+			Name: "BackupDataController",
+			MapMetadataFunc: func(cluster *omni.Cluster) *omni.BackupData {
+				return omni.NewBackupData(cluster.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(backupData *omni.BackupData) *omni.Cluster {
+				return omni.NewCluster(resources.DefaultNamespace, backupData.Metadata().ID())
+			},
+			TransformFunc: func(ctx context.Context, r controller.Reader, _ *zap.Logger, cluster *omni.Cluster, backupData *omni.BackupData) error {
+				clusterID := cluster.Metadata().ID()
+
+				clusterUUID, err := safe.ReaderGetByID[*omni.ClusterUUID](ctx, r, clusterID)
+				if err != nil {
+					if state.IsNotFoundError(err) {
+						return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+					}
+
+					return fmt.Errorf("failed to get cluster %q UUID: %w", clusterID, err)
+				}
+
+				etcdBackupEncryption, err := safe.ReaderGetByID[*omni.EtcdBackupEncryption](ctx, r, clusterID)
+				if err != nil {
+					if state.IsNotFoundError(err) {
+						return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+					}
+
+					return fmt.Errorf("failed to get cluster %q etcd backup encryption: %w", clusterID, err)
+				}
+
+				clusterSecrets, err := safe.ReaderGetByID[*omni.ClusterSecrets](ctx, r, clusterID)
+				if err != nil {
+					if state.IsNotFoundError(err) {
+						return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+					}
+
+					return fmt.Errorf("failed to get cluster %q secrets: %w", clusterID, err)
+				}
+
+				bundle, err := omni.ToSecretsBundle(clusterSecrets)
+				if err != nil {
+					return fmt.Errorf("failed to decode cluster %q secrets: %w", clusterID, err)
+				}
+
+				if cluster.TypedSpec().Value.BackupConfiguration != nil && cluster.TypedSpec().Value.BackupConfiguration.Enabled {
+					backupData.TypedSpec().Value.Interval = cluster.TypedSpec().Value.GetBackupConfiguration().GetInterval()
+				} else {
+					backupData.TypedSpec().Value.Interval = durationpb.New(0)
+				}
+
+				backupData.TypedSpec().Value.ClusterUuid = clusterUUID.TypedSpec().Value.GetUuid()
+				backupData.TypedSpec().Value.EncryptionKey = etcdBackupEncryption.TypedSpec().Value.GetEncryptionKey()
+				backupData.TypedSpec().Value.SecretboxEncryptionSecret = bundle.Secrets.SecretboxEncryptionSecret
+				backupData.TypedSpec().Value.AesCbcEncryptionSecret = bundle.Secrets.AESCBCEncryptionSecret
+
+				return nil
+			},
+		},
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.EtcdBackupEncryption, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.ClusterSecrets, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.ClusterUUID, *omni.Cluster](),
+		),
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cert_refresh_tick.go b/internal/backend/runtime/omni/controllers/omni/cert_refresh_tick.go
new file mode 100644
index 000000000..bb26074f3
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cert_refresh_tick.go
@@ -0,0 +1,73 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
+)
+
+// CertRefreshTickController creates ticks to notify all certificate management controllers to refresh certificates.
+type CertRefreshTickController struct {
+	tickInterval time.Duration
+}
+
+// NewCertRefreshTickController creates a new CertRefreshTickController.
+func NewCertRefreshTickController(tickInterval time.Duration) *CertRefreshTickController {
+	return &CertRefreshTickController{tickInterval: tickInterval}
+}
+
+// Name implements controller.Controller interface.
+func (ctrl *CertRefreshTickController) Name() string {
+	return "CertRefreshTickController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *CertRefreshTickController) Inputs() []controller.Input {
+	return nil
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *CertRefreshTickController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: system.CertRefreshTickType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *CertRefreshTickController) Run(ctx context.Context, r controller.Runtime, _ *zap.Logger) error {
+	ticker := time.NewTicker(ctrl.tickInterval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case t := <-ticker.C:
+			// issue a "refresh" tick to notify all certificate management controllers to refresh certificates
+			if err := safe.WriterModify(
+				ctx, r,
+				system.NewCertRefreshTick(resources.EphemeralNamespace, t.String()),
+				func(*system.CertRefreshTick) error {
+					return nil
+				},
+			); err != nil {
+				return err
+			}
+		case <-r.EventCh(): // ignore, we have no inputs
+		}
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cert_refresh_tick_test.go b/internal/backend/runtime/omni/controllers/omni/cert_refresh_tick_test.go
new file mode 100644
index 000000000..3e0901b8a
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cert_refresh_tick_test.go
@@ -0,0 +1,54 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type CertRefreshTickSuite struct {
+	OmniSuite
+}
+
+func (suite *CertRefreshTickSuite) TestReconcile() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewCertRefreshTickController(100 * time.Millisecond)))
+
+	watchCh := make(chan state.Event)
+
+	suite.Require().NoError(suite.state.WatchKind(suite.ctx, system.NewCertRefreshTick(resources.EphemeralNamespace, "").Metadata(), watchCh))
+
+	// wait for two ticks
+	ticks := 0
+
+	for {
+		select {
+		case ev := <-watchCh:
+			suite.Require().Equal(state.Created, ev.Type)
+
+			ticks++
+		case <-time.After(500 * time.Millisecond):
+			suite.Require().FailNow("timeout waiting for tick")
+		}
+
+		if ticks == 2 {
+			break
+		}
+	}
+}
+
+func TestCertRefreshTickSuite(t *testing.T) {
+	suite.Run(t, new(CertRefreshTickSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster.go b/internal/backend/runtime/omni/controllers/omni/cluster.go
new file mode 100644
index 000000000..12b042755
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster.go
@@ -0,0 +1,101 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/cleanup"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime/kubernetes"
+)
+
+// ClusterController manages Cluster resource lifecycle.
+//
+// ClusterController plays the role of machine discovery.
+type ClusterController = cleanup.Controller[*omni.Cluster]
+
+type handler struct {
+	handler   cleanup.Handler[*omni.Cluster]
+	finalizer string
+}
+
+func (c handler) FinalizerRemoval(ctx context.Context, r controller.Runtime, logger *zap.Logger, input *omni.Cluster) error {
+	if err := c.handler.FinalizerRemoval(ctx, r, logger, input); err != nil {
+		return err
+	}
+
+	type kubeRuntime interface {
+		DestroyClient(string)
+	}
+
+	// destroy client cache for the destroyed cluster
+	k8s, err := runtime.LookupInterface[kubeRuntime](kubernetes.Name)
+	if err != nil {
+		return err
+	}
+
+	k8s.DestroyClient(input.Metadata().ID())
+
+	return nil
+}
+
+func (c handler) Inputs() []controller.Input {
+	return c.handler.Inputs()
+}
+
+func (c handler) Outputs() []controller.Output {
+	return c.handler.Outputs()
+}
+
+// NewClusterController creates new ClusterController.
+func NewClusterController() *ClusterController {
+	name := "ClusterController"
+
+	return cleanup.NewController(
+		cleanup.Settings[*omni.Cluster]{
+			Name: name,
+			Handler: handler{
+				finalizer: name,
+				handler: cleanup.Combine(
+					cleanup.RemoveOutputs[*omni.MachineSet](func(cluster *omni.Cluster) state.ListOption {
+						return state.WithLabelQuery(
+							resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID()),
+							resource.LabelExists(omni.LabelWorkerRole),
+						)
+					}),
+					cleanup.RemoveOutputs[*omni.MachineSet](func(cluster *omni.Cluster) state.ListOption {
+						return state.WithLabelQuery(
+							resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID()),
+							resource.LabelExists(omni.LabelControlPlaneRole),
+						)
+					}),
+					cleanup.RemoveOutputs[*omni.ConfigPatch](func(cluster *omni.Cluster) state.ListOption {
+						return state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID()))
+					}),
+					cleanup.RemoveOutputs[*omni.SchematicConfiguration](func(cluster *omni.Cluster) state.ListOption {
+						return state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID()))
+					}),
+					cleanup.HasNoOutputs[*omni.ClusterMachine](func(cluster *omni.Cluster) state.ListOption {
+						return state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID()))
+					}),
+					cleanup.HasNoOutputs[*omni.ClusterMachineConfigPatches](func(cluster *omni.Cluster) state.ListOption {
+						return state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID()))
+					}),
+					cleanup.HasNoOutputs[*omni.ClusterMachineConfig](func(cluster *omni.Cluster) state.ListOption {
+						return state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID()))
+					}),
+				),
+			},
+		},
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_bootstrap_status.go b/internal/backend/runtime/omni/controllers/omni/cluster_bootstrap_status.go
new file mode 100644
index 000000000..38eacb4a2
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_bootstrap_status.go
@@ -0,0 +1,247 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup/store"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/mappers"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+)
+
+// ClusterBootstrapStatusController manages ClusterStatus resource lifecycle.
+//
+// ClusterBootstrapStatusController applies the generated machine config on each corresponding machine.
+type ClusterBootstrapStatusController = qtransform.QController[*omni.ClusterStatus, *omni.ClusterBootstrapStatus]
+
+// ClusterBootstrapStatusControllerName is the name of the ClusterBootstrapStatusController.
+const ClusterBootstrapStatusControllerName = "ClusterBootstrapStatusController"
+
+// NewClusterBootstrapStatusController initializes ClusterBootstrapStatusController.
+//
+//nolint:gocognit
+func NewClusterBootstrapStatusController(etcdBackupStoreFactory store.Factory) *ClusterBootstrapStatusController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.ClusterStatus, *omni.ClusterBootstrapStatus]{
+			Name: ClusterBootstrapStatusControllerName,
+			MapMetadataFunc: func(clusterStatus *omni.ClusterStatus) *omni.ClusterBootstrapStatus {
+				return omni.NewClusterBootstrapStatus(resources.DefaultNamespace, clusterStatus.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(bootstrapStatus *omni.ClusterBootstrapStatus) *omni.ClusterStatus {
+				return omni.NewClusterStatus(resources.DefaultNamespace, bootstrapStatus.Metadata().ID())
+			},
+			TransformExtraOutputFunc: func(ctx context.Context, r controller.ReaderWriter, logger *zap.Logger, clusterStatus *omni.ClusterStatus, bootstrapStatus *omni.ClusterBootstrapStatus) error {
+				cpMachineSet, err := safe.ReaderGetByID[*omni.MachineSet](ctx, r, omni.ControlPlanesResourceID(clusterStatus.Metadata().ID()))
+				if err != nil {
+					if state.IsNotFoundError(err) { // missing control-plane, mark the cluster as non-bootstrapped
+						bootstrapStatus.TypedSpec().Value.Bootstrapped = false
+
+						return nil
+					}
+
+					return fmt.Errorf("error getting control plane machineset for cluster '%s': %w", clusterStatus.Metadata().ID(), err)
+				}
+
+				if cpMachineSet.Metadata().Phase() == resource.PhaseTearingDown {
+					bootstrapStatus.TypedSpec().Value.Bootstrapped = false
+
+					return r.RemoveFinalizer(ctx, cpMachineSet.Metadata(), ClusterBootstrapStatusControllerName)
+				}
+
+				if !cpMachineSet.Metadata().Finalizers().Has(ClusterBootstrapStatusControllerName) {
+					if err = r.AddFinalizer(ctx, cpMachineSet.Metadata(), ClusterBootstrapStatusControllerName); err != nil {
+						return fmt.Errorf("error adding finalizer to control plane machineset for cluster '%s': %w", clusterStatus.Metadata().ID(), err)
+					}
+				}
+
+				if bootstrapStatus.TypedSpec().Value.Bootstrapped {
+					return nil
+				}
+
+				if !clusterStatus.TypedSpec().Value.Available {
+					return nil
+				}
+
+				if !clusterStatus.TypedSpec().Value.HasConnectedControlPlanes {
+					return nil
+				}
+
+				talosCli, err := getTalosClientForBootstrap(ctx, r, clusterStatus.Metadata().ID())
+				if err != nil {
+					if talos.IsClientNotReadyError(err) {
+						return nil
+					}
+
+					return fmt.Errorf("error getting talos client for cluster '%s': %w", clusterStatus.Metadata().ID(), err)
+				}
+
+				bootstrapSpec := cpMachineSet.TypedSpec().Value.GetBootstrapSpec()
+				recoverEtcd := bootstrapSpec != nil
+
+				if recoverEtcd {
+					logger.Info(
+						"recovering etcd from backup",
+						zap.String("cluster_id", clusterStatus.Metadata().ID()),
+						zap.String("cluster_uuid", bootstrapSpec.GetClusterUuid()),
+						zap.String("snapshot", bootstrapSpec.GetSnapshot()),
+					)
+
+					if err = recoverEtcdFromBackup(ctx, r, talosCli, etcdBackupStoreFactory, bootstrapSpec); err != nil {
+						return err
+					}
+				}
+
+				if err = talosCli.Bootstrap(ctx, &machine.BootstrapRequest{
+					RecoverEtcd: recoverEtcd,
+				}); err != nil {
+					return fmt.Errorf("error bootstrapping cluster '%s': %w", clusterStatus.Metadata().ID(), err)
+				}
+
+				logger.Info("bootstrapping cluster", zap.String("cluster_id", clusterStatus.Metadata().ID()))
+
+				bootstrapStatus.TypedSpec().Value.Bootstrapped = true
+
+				return nil
+			},
+			FinalizerRemovalExtraOutputFunc: func(ctx context.Context, r controller.ReaderWriter, _ *zap.Logger, clusterStatus *omni.ClusterStatus) error {
+				cpMachineSet, err := safe.ReaderGetByID[*omni.MachineSet](ctx, r, omni.ControlPlanesResourceID(clusterStatus.Metadata().ID()))
+				if err != nil && !state.IsNotFoundError(err) {
+					return err
+				}
+
+				if cpMachineSet != nil {
+					return r.RemoveFinalizer(ctx, cpMachineSet.Metadata(), ClusterBootstrapStatusControllerName)
+				}
+
+				return nil
+			},
+		},
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.TalosConfig, *omni.ClusterStatus](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.ClusterEndpoint, *omni.ClusterStatus](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByClusterLabelOnlyControlplane[*omni.MachineSet, *omni.ClusterStatus](),
+		),
+		qtransform.WithExtraMappedInput(
+			// no need to requeue anything, just allow the controller to read data (when restoring from another cluster backup)
+			qtransform.MapperNone[*omni.ClusterUUID](),
+		),
+		qtransform.WithExtraMappedInput(
+			// no need to requeue anything, just allow the controller to read data (when restoring from another cluster backup)
+			qtransform.MapperNone[*omni.BackupData](),
+		),
+		qtransform.WithConcurrency(4),
+	)
+}
+
+// recoverEtcdFromBackup recovers etcd of the given cluster using the given bootstrap spec.
+func recoverEtcdFromBackup(ctx context.Context, r controller.Reader, talosCli *client.Client,
+	etcdBackupStoreFactory store.Factory, bootstrapSpec *specs.MachineSetSpec_BootstrapSpec,
+) error {
+	clusterUUIDs, err := safe.ReaderListAll[*omni.ClusterUUID](ctx, r, state.WithLabelQuery(resource.LabelEqual(omni.LabelClusterUUID, bootstrapSpec.GetClusterUuid())))
+	if err != nil {
+		return fmt.Errorf("failed to list cluster uuids: %w", err)
+	}
+
+	if clusterUUIDs.Len() != 1 {
+		return fmt.Errorf("expected exactly one cluster uuid, got %d", clusterUUIDs.Len())
+	}
+
+	clusterID := clusterUUIDs.Get(0).Metadata().ID()
+
+	backupData, err := safe.ReaderGetByID[*omni.BackupData](ctx, r, clusterID)
+	if err != nil {
+		return fmt.Errorf("failed to get backup data for cluster %q: %w", clusterID, err)
+	}
+
+	backupStore, err := etcdBackupStoreFactory.GetStore()
+	if err != nil {
+		return fmt.Errorf("failed to get backup store: %w", err)
+	}
+
+	downloadedBackupData, readCloser, err := backupStore.Download(ctx, backupData.TypedSpec().Value.GetEncryptionKey(), bootstrapSpec.GetClusterUuid(), bootstrapSpec.GetSnapshot())
+	if err != nil {
+		return fmt.Errorf("failed to download backup: %w", err)
+	}
+
+	defer readCloser.Close() //nolint:errcheck
+
+	if downloadedBackupData.AESCBCEncryptionSecret != backupData.TypedSpec().Value.GetAesCbcEncryptionSecret() {
+		return errors.New("aes cbc encryption secret mismatch")
+	}
+
+	if downloadedBackupData.SecretboxEncryptionSecret != backupData.TypedSpec().Value.GetSecretboxEncryptionSecret() {
+		return errors.New("secretbox encryption secret mismatch")
+	}
+
+	if _, err = talosCli.EtcdRecover(ctx, readCloser); err != nil {
+		return fmt.Errorf("failed calling talos client EtcdRecover: %w", err)
+	}
+
+	return nil
+}
+
+func getTalosClientForBootstrap(ctx context.Context, r controller.Reader, clusterName string) (*client.Client, error) {
+	talosConfig, err := safe.ReaderGet[*omni.TalosConfig](ctx, r, omni.NewTalosConfig(resources.DefaultNamespace, clusterName).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, talos.NewClientNotReadyError(fmt.Errorf("talosconfig not found for cluster %q", clusterName))
+		}
+
+		return nil, fmt.Errorf("failed to get talosconfig for cluster %q: %w", clusterName, err)
+	}
+
+	clusterEndpoint, err := safe.ReaderGetByID[*omni.ClusterEndpoint](ctx, r, clusterName)
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, talos.NewClientNotReadyError(fmt.Errorf("cluster endpoint not found for cluster %q", clusterName))
+		}
+
+		return nil, fmt.Errorf("failed to get cluster endpoint: %w", err)
+	}
+
+	addresses := clusterEndpoint.TypedSpec().Value.GetManagementAddresses()
+	if len(addresses) == 0 {
+		return nil, talos.NewClientNotReadyError(fmt.Errorf("no management addresses found for cluster %q", clusterName))
+	}
+
+	// We always pick the first management address to ensure that we always target the same node for recover & bootstrap, even across controller crashes.
+	// This makes us avoid the rare case where due to some failure in GRPC calls, we could bootstrap two separate nodes.
+	managementAddress := addresses[0]
+
+	opts := talos.GetSocketOptions(managementAddress)
+
+	if opts == nil {
+		opts = append(opts, client.WithEndpoints(managementAddress))
+	}
+
+	opts = append(opts, client.WithConfig(omni.NewTalosClientConfig(talosConfig, managementAddress)))
+
+	result, err := client.New(ctx, opts...)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create Talos client for cluster %q with mgmt address: %q: %w", clusterName, managementAddress, err)
+	}
+
+	return result, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_bootstrap_status_test.go b/internal/backend/runtime/omni/controllers/omni/cluster_bootstrap_status_test.go
new file mode 100644
index 000000000..c11d29548
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_bootstrap_status_test.go
@@ -0,0 +1,181 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"io"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+)
+
+type mockStoreFactory struct {
+	etcdBackupDataMock etcdbackup.BackupData
+}
+
+func (m *mockStoreFactory) GetStore() (etcdbackup.Store, error) {
+	return &mockEtcdBackupStore{m.etcdBackupDataMock}, nil
+}
+
+func (m *mockStoreFactory) Start(context.Context, state.State, *zap.Logger) error { return nil }
+
+func (m *mockStoreFactory) Description() string { return "mock-store" }
+
+type mockEtcdBackupStore struct {
+	etcdBackupDataMock etcdbackup.BackupData
+}
+
+func (m *mockEtcdBackupStore) ListBackups(context.Context, string) (etcdbackup.InfoIterator, error) {
+	return nil, nil
+}
+
+func (m *mockEtcdBackupStore) Upload(context.Context, etcdbackup.Description, io.Reader) error {
+	return nil
+}
+
+func (m *mockEtcdBackupStore) Download(context.Context, []byte, string, string) (etcdbackup.BackupData, io.ReadCloser, error) {
+	return m.etcdBackupDataMock, io.NopCloser(strings.NewReader("test-data")), nil
+}
+
+type ClusterBootstrapStatusSuite struct {
+	OmniSuite
+}
+
+func (suite *ClusterBootstrapStatusSuite) TestReconcile() {
+	suite.startRuntime()
+
+	etcdBackupDataMock := etcdbackup.BackupData{
+		AESCBCEncryptionSecret:    "test-aes-secret",
+		SecretboxEncryptionSecret: "test-secretbox-secret",
+	}
+
+	storeFactory := &mockStoreFactory{etcdBackupDataMock}
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewSecretsController(storeFactory)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosConfigController(constants.CertificateValidityTime)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterEndpointController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterBootstrapStatusController(storeFactory)))
+
+	clusterName := "talos-default-5"
+
+	cmIdentity := omni.NewClusterMachineIdentity(resources.DefaultNamespace, "test-endpoint")
+	cmIdentity.TypedSpec().Value.NodeIps = []string{"127.0.0.1"}
+
+	cmIdentity.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+	cmIdentity.Metadata().Labels().Set(omni.LabelControlPlaneRole, "")
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, cmIdentity))
+
+	cluster, machines := suite.createCluster(clusterName, 1, 1)
+
+	for i, m := range machines {
+		clusterMachineStatus := omni.NewClusterMachineStatus(resources.DefaultNamespace, m.Metadata().ID())
+
+		clusterMachineStatus.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+
+		if i == 0 {
+			clusterMachineStatus.Metadata().Labels().Set(omni.LabelControlPlaneRole, clusterName)
+		}
+
+		clusterMachineStatus.TypedSpec().Value.ManagementAddress = suite.socketConnectionString
+		clusterMachineStatus.TypedSpec().Value.ApidAvailable = true
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, clusterMachineStatus))
+	}
+
+	clusterStatus := omni.NewClusterStatus(resources.DefaultNamespace, cluster.Metadata().ID())
+	clusterStatus.TypedSpec().Value.Available = true
+	clusterStatus.TypedSpec().Value.HasConnectedControlPlanes = true
+	suite.Require().NoError(suite.state.Create(suite.ctx, clusterStatus))
+
+	md := *omni.NewClusterBootstrapStatus(resources.DefaultNamespace, cluster.Metadata().ID()).Metadata()
+	assertResource(
+		&suite.OmniSuite,
+		md,
+		func(v *omni.ClusterBootstrapStatus, assertions *assert.Assertions) {
+			assertions.True(v.TypedSpec().Value.Bootstrapped, "the cluster is not bootstrapped yet")
+		},
+	)
+
+	suite.Require().Len(suite.machineService.getBootstrapRequests(), 1)
+
+	suite.testRecoverControlPlaneFromEtcdBackup(cluster.Metadata().ID(), etcdBackupDataMock)
+
+	suite.destroyCluster(cluster)
+	rtestutils.Destroy[*omni.ClusterStatus](suite.ctx, suite.T(), suite.state, []resource.ID{clusterStatus.Metadata().ID()})
+
+	suite.Assert().NoError(retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+		suite.assertNoResource(md),
+	))
+}
+
+func (suite *ClusterBootstrapStatusSuite) testRecoverControlPlaneFromEtcdBackup(clusterID resource.ID, backupDataMock etcdbackup.BackupData) {
+	cpMachineSetMd := omni.NewMachineSet(resources.DefaultNamespace, omni.ControlPlanesResourceID(clusterID)).Metadata()
+
+	cpMachineSet, err := safe.StateGet[*omni.MachineSet](suite.ctx, suite.state, cpMachineSetMd)
+	suite.Require().NoError(err)
+
+	// destroy the control plane machine set and expect the bootstrapped flag to be cleared
+	rtestutils.Destroy[*omni.MachineSet](suite.ctx, suite.T(), suite.state, []resource.ID{cpMachineSetMd.ID()})
+	assertResource(
+		&suite.OmniSuite,
+		omni.NewClusterBootstrapStatus(resources.DefaultNamespace, clusterID).Metadata(),
+		func(v *omni.ClusterBootstrapStatus, assertions *assert.Assertions) {
+			assertions.False(v.TypedSpec().Value.Bootstrapped, "the cluster still appears to be bootstrapped")
+		},
+	)
+
+	backupData := omni.NewBackupData(clusterID)
+	backupData.TypedSpec().Value.EncryptionKey = []byte("test-key")
+	backupData.TypedSpec().Value.AesCbcEncryptionSecret = backupDataMock.AESCBCEncryptionSecret
+	backupData.TypedSpec().Value.SecretboxEncryptionSecret = backupDataMock.SecretboxEncryptionSecret
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, backupData))
+
+	clusterUUID := "842b441b-abc3-43df-b7c0-51f369eb4fb5"
+	clusterUUIDRes := omni.NewClusterUUID(clusterID)
+	clusterUUIDRes.TypedSpec().Value.Uuid = clusterUUID
+
+	clusterUUIDRes.Metadata().Labels().Set(omni.LabelClusterUUID, clusterUUID)
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, clusterUUIDRes))
+
+	// re-create the control plane machine set but now with a bootstrap spec
+	cpMachineSet.TypedSpec().Value.BootstrapSpec = &specs.MachineSetSpec_BootstrapSpec{
+		ClusterUuid: clusterUUID,
+		Snapshot:    etcdbackup.CreateSnapshotName(time.Now()),
+	}
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, cpMachineSet))
+
+	suite.EventuallyWithT(func(collect *assert.CollectT) {
+		assert.Equal(collect, uint64(1), suite.machineService.etcdRecoverRequestCount.Load(), "etcd recover request count is not 1")
+		assert.Len(collect, suite.machineService.getBootstrapRequests(), 2, "expected 2 bootstrap requests")
+	}, 5*time.Second, 100*time.Millisecond)
+
+	rtestutils.Destroy[*omni.BackupData](suite.ctx, suite.T(), suite.state, []string{backupData.Metadata().ID()})
+}
+
+func TestClusterBootstrapStatusSuite(t *testing.T) {
+	suite.Run(t, new(ClusterBootstrapStatusSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_config_version.go b/internal/backend/runtime/omni/controllers/omni/cluster_config_version.go
new file mode 100644
index 000000000..92d0969e8
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_config_version.go
@@ -0,0 +1,44 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// ClusterConfigVersionController manages config version for each cluster.
+type ClusterConfigVersionController = qtransform.QController[*omni.Cluster, *omni.ClusterConfigVersion]
+
+// NewClusterConfigVersionController initializes ClusterConfigVersionController.
+func NewClusterConfigVersionController() *ClusterConfigVersionController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.Cluster, *omni.ClusterConfigVersion]{
+			Name: "ClusterConfigVersionController",
+			MapMetadataFunc: func(cluster *omni.Cluster) *omni.ClusterConfigVersion {
+				return omni.NewClusterConfigVersion(resources.DefaultNamespace, cluster.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(clusterConfigVersion *omni.ClusterConfigVersion) *omni.Cluster {
+				return omni.NewCluster(resources.DefaultNamespace, clusterConfigVersion.Metadata().ID())
+			},
+			TransformFunc: func(_ context.Context, _ controller.Reader, _ *zap.Logger, cluster *omni.Cluster, clusterVersion *omni.ClusterConfigVersion) error {
+				if cluster.TypedSpec().Value.TalosVersion != "" {
+					if clusterVersion.TypedSpec().Value.Version == "" {
+						clusterVersion.TypedSpec().Value.Version = "v" + cluster.TypedSpec().Value.TalosVersion
+					}
+				}
+
+				return nil
+			},
+		},
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_destroy_status.go b/internal/backend/runtime/omni/controllers/omni/cluster_destroy_status.go
new file mode 100644
index 000000000..d010d7f19
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_destroy_status.go
@@ -0,0 +1,150 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/gertd/go-pluralize"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// ClusterDestroyStatusController manages ClusterStatus resource lifecycle.
+//
+// ClusterDestroyStatusController aggregates the cluster state based on the cluster machines states.
+type ClusterDestroyStatusController struct{}
+
+// Name implements controller.Controller interface.
+func (ctrl *ClusterDestroyStatusController) Name() string {
+	return "ClusterDestroyStatusController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *ClusterDestroyStatusController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Type:      omni.ClusterType,
+			Kind:      controller.InputDestroyReady,
+			Namespace: resources.DefaultNamespace,
+		},
+		{
+			Type:      omni.MachineSetStatusType,
+			Kind:      controller.InputWeak,
+			Namespace: resources.DefaultNamespace,
+		},
+		{
+			Type:      omni.ClusterMachineStatusType,
+			Kind:      controller.InputWeak,
+			Namespace: resources.DefaultNamespace,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *ClusterDestroyStatusController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.ClusterDestroyStatusType,
+			Kind: controller.OutputExclusive,
+		},
+		{
+			Type: omni.ClusterType,
+			Kind: controller.OutputShared,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+//
+//nolint:dupl
+func (ctrl *ClusterDestroyStatusController) Run(ctx context.Context, r controller.Runtime, _ *zap.Logger) error {
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+		}
+
+		tracker := trackResource(r, resources.DefaultNamespace, omni.ClusterDestroyStatusType)
+
+		clusters, err := safe.ReaderListAll[*omni.Cluster](ctx, r)
+		if err != nil {
+			return fmt.Errorf("error listing Cluster resources: %w", err)
+		}
+
+		for iter := clusters.Iterator(); iter.Next(); {
+			cluster := iter.Value()
+
+			if cluster.Metadata().Phase() != resource.PhaseTearingDown {
+				continue
+			}
+
+			tracker.keep(cluster)
+
+			if err = ctrl.collectDestroyStatus(ctx, cluster, r); err != nil {
+				return err
+			}
+
+			if cluster.Metadata().Finalizers().Empty() {
+				if err = r.Destroy(ctx, cluster.Metadata(), controller.WithOwner("")); err != nil {
+					if state.IsNotFoundError(err) {
+						continue
+					}
+
+					return fmt.Errorf("failed to destroy cluster %w", err)
+				}
+			}
+		}
+
+		if err = tracker.cleanup(ctx); err != nil {
+			return err
+		}
+	}
+}
+
+func (ctrl *ClusterDestroyStatusController) collectDestroyStatus(ctx context.Context, cluster *omni.Cluster, r controller.Runtime) error {
+	var err error
+
+	machineSets, err := r.List(ctx, omni.NewMachineSetStatus(resources.DefaultNamespace, "").Metadata(), state.WithLabelQuery(
+		resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID()),
+	))
+	if err != nil {
+		return fmt.Errorf("failed to list control planes %w", err)
+	}
+
+	remainingMachines := 0
+	remainingMachineSets := len(machineSets.Items)
+
+	for _, machineSet := range machineSets.Items {
+		machines, err := r.List(ctx, omni.NewClusterMachineStatus(resources.DefaultNamespace, "").Metadata(),
+			state.WithLabelQuery(resource.LabelEqual(
+				omni.LabelMachineSet, machineSet.Metadata().ID()),
+			),
+		)
+		if err != nil {
+			return err
+		}
+
+		remainingMachines += len(machines.Items)
+	}
+
+	return safe.WriterModify(ctx, r, omni.NewClusterDestroyStatus(resources.DefaultNamespace, cluster.Metadata().ID()), func(status *omni.ClusterDestroyStatus) error {
+		status.TypedSpec().Value.Phase = fmt.Sprintf("Destroying: %s, %s",
+			pluralize.NewClient().Pluralize("machine set", remainingMachineSets, true),
+			pluralize.NewClient().Pluralize("machine", remainingMachines, true),
+		)
+
+		return nil
+	})
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_endpoint.go b/internal/backend/runtime/omni/controllers/omni/cluster_endpoint.go
new file mode 100644
index 000000000..a34d64d7e
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_endpoint.go
@@ -0,0 +1,70 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/mappers"
+)
+
+// ClusterEndpointController manages endpoints for each Cluster.
+type ClusterEndpointController = qtransform.QController[*omni.Cluster, *omni.ClusterEndpoint]
+
+// NewClusterEndpointController initializes ClusterEndpointController.
+func NewClusterEndpointController() *ClusterEndpointController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.Cluster, *omni.ClusterEndpoint]{
+			Name: "ClusterEndpointController",
+			MapMetadataFunc: func(cluster *omni.Cluster) *omni.ClusterEndpoint {
+				return omni.NewClusterEndpoint(resources.DefaultNamespace, cluster.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(clusterEndpoint *omni.ClusterEndpoint) *omni.Cluster {
+				return omni.NewCluster(resources.DefaultNamespace, clusterEndpoint.Metadata().ID())
+			},
+			TransformFunc: func(ctx context.Context, r controller.Reader, _ *zap.Logger, cluster *omni.Cluster, clusterEndpoint *omni.ClusterEndpoint) error {
+				items, err := safe.ReaderListAll[*omni.ClusterMachineStatus](ctx, r,
+					state.WithLabelQuery(
+						resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID()),
+						resource.LabelExists(omni.LabelControlPlaneRole),
+					),
+				)
+				if err != nil {
+					return fmt.Errorf("error listing cluster machine statuses: %w", err)
+				}
+
+				clusterEndpoint.TypedSpec().Value.ManagementAddresses = nil
+
+				for iter := items.Iterator(); iter.Next(); {
+					if iter.Value().TypedSpec().Value.ManagementAddress == "" {
+						continue
+					}
+
+					clusterEndpoint.TypedSpec().Value.ManagementAddresses = append(
+						clusterEndpoint.TypedSpec().Value.ManagementAddresses,
+						iter.Value().TypedSpec().Value.ManagementAddress,
+					)
+				}
+
+				return nil
+			},
+		},
+		qtransform.WithExtraMappedInput(
+			// reconcile on controlplane MachineSet changes
+			mappers.MapByClusterLabelOnlyControlplane[*omni.ClusterMachineStatus, *omni.Cluster](),
+		),
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_endpoint_test.go b/internal/backend/runtime/omni/controllers/omni/cluster_endpoint_test.go
new file mode 100644
index 000000000..8199e143d
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_endpoint_test.go
@@ -0,0 +1,53 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type ClusterEndpointSuite struct {
+	OmniSuite
+}
+
+func (suite *ClusterEndpointSuite) TestReconcile() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewClusterController()))
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewMachineSetController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterEndpointController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterConfigVersionController()))
+
+	clusterName := "talos-default-44"
+
+	cluster, _ := suite.createCluster(clusterName, 3, 1)
+
+	rtestutils.AssertResources(suite.ctx, suite.T(), suite.state, []string{clusterName},
+		func(clusterEndpoint *omni.ClusterEndpoint, assert *assert.Assertions) {
+			assert.Len(clusterEndpoint.TypedSpec().Value.ManagementAddresses, 3)
+
+			if len(clusterEndpoint.TypedSpec().Value.ManagementAddresses) > 0 {
+				assert.Equal(suite.socketConnectionString, clusterEndpoint.TypedSpec().Value.ManagementAddresses[0])
+			}
+		},
+	)
+
+	suite.destroyCluster(cluster)
+
+	rtestutils.AssertNoResource[*omni.ClusterEndpoint](suite.ctx, suite.T(), suite.state, clusterName)
+}
+
+func TestClusterEndpointSuite(t *testing.T) {
+	suite.Run(t, new(ClusterEndpointSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_loadbalancer.go b/internal/backend/runtime/omni/controllers/omni/cluster_loadbalancer.go
new file mode 100644
index 000000000..444d3e270
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_loadbalancer.go
@@ -0,0 +1,192 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"errors"
+	"net"
+	"net/url"
+	"strconv"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/optional"
+	"github.com/siderolabs/gen/xslices"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+)
+
+// NewClusterLoadBalancerController creates new ClusterLoadBalancerController.
+func NewClusterLoadBalancerController(minPort, maxPort int) *ClusterLoadBalancerController {
+	return &ClusterLoadBalancerController{
+		minPort: minPort,
+		maxPort: maxPort,
+	}
+}
+
+// ClusterLoadBalancerController manages ClusterStatus resource lifecycle.
+//
+// ClusterLoadBalancerController applies the generated machine config  on each corresponding machine.
+type ClusterLoadBalancerController struct {
+	minPort int
+	maxPort int
+}
+
+// Name implements controller.Controller interface.
+func (ctrl *ClusterLoadBalancerController) Name() string {
+	return "ClusterLoadBalancerController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *ClusterLoadBalancerController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterEndpointType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      siderolink.ConfigType,
+			ID:        optional.Some(siderolink.ConfigID),
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *ClusterLoadBalancerController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.LoadBalancerConfigType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+//
+//nolint:gocognit
+func (ctrl *ClusterLoadBalancerController) Run(ctx context.Context, r controller.Runtime, _ *zap.Logger) error {
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+		}
+
+		siderolink, err := safe.ReaderGet[*siderolink.Config](ctx, r, siderolink.NewConfig(resources.DefaultNamespace).Metadata())
+		if err != nil {
+			if state.IsNotFoundError(err) {
+				continue
+			}
+
+			return err
+		}
+
+		list, err := safe.ReaderListAll[*omni.Cluster](ctx, r)
+		if err != nil {
+			return err
+		}
+
+		configs, err := safe.ReaderListAll[*omni.LoadBalancerConfig](ctx, r)
+		if err != nil {
+			return err
+		}
+
+		allocatedPorts := map[string]struct{}{}
+		for iter := configs.Iterator(); iter.Next(); {
+			allocatedPorts[iter.Value().TypedSpec().Value.BindPort] = struct{}{}
+		}
+
+		tracker := trackResource(r, resources.DefaultNamespace, omni.LoadBalancerConfigType)
+
+		for iter := list.Iterator(); iter.Next(); {
+			cluster := iter.Value()
+
+			tracker.keep(cluster)
+
+			var endpoints []string
+
+			endpoints, err = ctrl.getEndpoints(ctx, r, cluster.Metadata().ID())
+			if err != nil {
+				return err
+			}
+
+			err = safe.WriterModify(ctx, r, omni.NewLoadBalancerConfig(resources.DefaultNamespace, cluster.Metadata().ID()), func(config *omni.LoadBalancerConfig) error {
+				spec := config.TypedSpec().Value
+
+				spec.Endpoints = endpoints
+
+				if spec.BindPort == "" {
+					spec.BindPort, err = ctrl.getPort(allocatedPorts)
+					if err != nil {
+						return err
+					}
+				}
+
+				lbEndpoint := url.URL{
+					Scheme: "https",
+					Host:   net.JoinHostPort(siderolink.TypedSpec().Value.ServerAddress, spec.BindPort),
+				}
+
+				spec.SiderolinkEndpoint = lbEndpoint.String()
+
+				return nil
+			})
+			if err != nil {
+				return err
+			}
+		}
+
+		if err = tracker.cleanup(ctx); err != nil {
+			return err
+		}
+
+		r.ResetRestartBackoff()
+	}
+}
+
+func (ctrl *ClusterLoadBalancerController) getEndpoints(ctx context.Context, r controller.Runtime, clusterName string) ([]string, error) {
+	clusterEndpoints, err := safe.ReaderGet[*omni.ClusterEndpoint](ctx, r, omni.NewClusterEndpoint(resources.DefaultNamespace, clusterName).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, nil
+		}
+
+		return nil, err
+	}
+
+	return xslices.Map(clusterEndpoints.TypedSpec().Value.ManagementAddresses, func(addr string) string {
+		return net.JoinHostPort(addr, "6443")
+	}), nil
+}
+
+func (ctrl *ClusterLoadBalancerController) getPort(allocatedPorts map[string]struct{}) (string, error) {
+	for i := ctrl.minPort; i <= ctrl.maxPort; i++ {
+		port := strconv.FormatInt(int64(i), 10)
+
+		if _, ok := allocatedPorts[port]; ok {
+			continue
+		}
+
+		allocatedPorts[port] = struct{}{}
+
+		return port, nil
+	}
+
+	return "", errors.New("no more ports available for the loadbalancer to allocate")
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_loadbalancer_test.go b/internal/backend/runtime/omni/controllers/omni/cluster_loadbalancer_test.go
new file mode 100644
index 000000000..5c1c52364
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_loadbalancer_test.go
@@ -0,0 +1,114 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type ClusterLoadBalancerSuite struct {
+	OmniSuite
+}
+
+func (suite *ClusterLoadBalancerSuite) TestReconcile() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterEndpointController()))
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewClusterLoadBalancerController(5000, 6000)))
+
+	siderolinkConfig := siderolink.NewConfig(resources.DefaultNamespace)
+	suite.Require().NoError(suite.state.Create(suite.ctx, siderolinkConfig))
+
+	clusterName := "talos-default-3"
+
+	cluster, _ := suite.createCluster(clusterName, 1, 1)
+
+	md := *omni.NewLoadBalancerConfig(resources.DefaultNamespace, cluster.Metadata().ID()).Metadata()
+
+	// remove the LB config created by the mock setup to let the controller handle it
+	suite.Require().NoError(suite.state.Destroy(suite.ctx, md))
+
+	assertResource(
+		&suite.OmniSuite,
+		md,
+		func(res *omni.LoadBalancerConfig, assertions *assert.Assertions) {
+			spec := res.TypedSpec().Value
+
+			assertions.NotEmpty(spec.Endpoints, "no endpoints in the loadbalancer config")
+			assertions.NotEmpty(spec.SiderolinkEndpoint, "no siderolink endpoint is set on the load balancer")
+			v, err := strconv.ParseInt(spec.BindPort, 10, 64)
+			assertions.NoError(err, "failed to parse bind port")
+			assertions.EqualValues(5000, v, "the port should be 5000")
+		},
+	)
+
+	// create another cluster and see if the next loadbalancer port will be used for it
+
+	secondClusterName := "talos-default-4"
+
+	secondCluster, _ := suite.createCluster(secondClusterName, 1, 1)
+
+	secondMD := *omni.NewLoadBalancerConfig(resources.DefaultNamespace, secondCluster.Metadata().ID()).Metadata()
+
+	// remove the LB config created by the mock setup to let the controller handle it
+	suite.Require().NoError(suite.state.Destroy(suite.ctx, secondMD))
+
+	assertResource(
+		&suite.OmniSuite,
+		secondMD,
+		func(res *omni.LoadBalancerConfig, assertions *assert.Assertions) {
+			spec := res.TypedSpec().Value
+
+			v, err := strconv.ParseInt(spec.BindPort, 10, 64)
+			assertions.NoError(err)
+			assertions.EqualValues(5001, v, "the port should be 5001")
+		},
+	)
+
+	suite.destroyCluster(cluster)
+
+	suite.Assert().NoError(retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+		suite.assertNoResource(md),
+	))
+
+	// recreate load balancer and see if it will reuse previously used port 5000
+	cluster, _ = suite.createCluster(clusterName, 1, 1)
+
+	md = *omni.NewLoadBalancerConfig(resources.DefaultNamespace, cluster.Metadata().ID()).Metadata()
+
+	// remove the LB config created by the mock setup to let the controller handle it
+	suite.Require().NoError(suite.state.Destroy(suite.ctx, md))
+
+	assertResource(
+		&suite.OmniSuite,
+		md,
+		func(res *omni.LoadBalancerConfig, assertions *assert.Assertions) {
+			spec := res.TypedSpec().Value
+
+			v, err := strconv.ParseInt(spec.BindPort, 10, 64)
+			assertions.NoError(err)
+			assertions.EqualValues(5000, v, "the port should be 5000")
+		},
+	)
+
+	suite.destroyCluster(cluster)
+}
+
+func TestClusterLoadbalancerSuite(t *testing.T) {
+	suite.Run(t, new(ClusterLoadBalancerSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_machine.go b/internal/backend/runtime/omni/controllers/omni/cluster_machine.go
new file mode 100644
index 000000000..a3539680c
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_machine.go
@@ -0,0 +1,47 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller/generic/cleanup"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// ClusterMachineController manages ClusterMachine resource lifecycle.
+type ClusterMachineController = cleanup.Controller[*omni.ClusterMachine]
+
+// NewClusterMachineController returns a new ClusterMachine controller.
+func NewClusterMachineController() *ClusterMachineController {
+	return cleanup.NewController(
+		cleanup.Settings[*omni.ClusterMachine]{
+			Name: "ClusterMachineController",
+			Handler: cleanup.Combine(
+				withFinalizerCheck(cleanup.RemoveOutputs[*omni.ConfigPatch](func(clusterMachine *omni.ClusterMachine) state.ListOption {
+					clusterName, _ := clusterMachine.Metadata().Labels().Get(omni.LabelCluster)
+
+					return state.WithLabelQuery(
+						resource.LabelEqual(omni.LabelCluster, clusterName),
+						resource.LabelEqual(omni.LabelClusterMachine, clusterMachine.Metadata().ID()),
+					)
+				},
+					cleanup.WithExtraOwners(KubernetesUpgradeStatusControllerName),
+				), func(clusterMachine *omni.ClusterMachine) error {
+					_, ok := clusterMachine.Metadata().Labels().Get(omni.LabelCluster)
+					if !ok {
+						return fmt.Errorf("cluster machine doesn't have %q label", omni.LabelCluster)
+					}
+
+					return nil
+				}),
+			),
+		},
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_machine_config.go b/internal/backend/runtime/omni/controllers/omni/cluster_machine_config.go
new file mode 100644
index 000000000..92ea6f67a
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_machine_config.go
@@ -0,0 +1,472 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/url"
+	"strings"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/xerrors"
+	"github.com/siderolabs/talos/pkg/machinery/config"
+	documentconfig "github.com/siderolabs/talos/pkg/machinery/config/config"
+	"github.com/siderolabs/talos/pkg/machinery/config/configpatcher"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
+	"github.com/siderolabs/talos/pkg/machinery/config/generate"
+	machineapi "github.com/siderolabs/talos/pkg/machinery/config/machine"
+	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
+	talosrole "github.com/siderolabs/talos/pkg/machinery/role"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/mappers"
+	appconfig "github.com/siderolabs/omni/internal/pkg/config"
+	"github.com/siderolabs/omni/internal/pkg/constants"
+)
+
+// ClusterMachineConfigController manages machine configurations for each ClusterMachine.
+//
+// ClusterMachineConfigController generates machine configuration for each created machine.
+type ClusterMachineConfigController = qtransform.QController[*omni.ClusterMachine, *omni.ClusterMachineConfig]
+
+// NewClusterMachineConfigController initializes ClusterMachineConfigController.
+func NewClusterMachineConfigController(defaultGenOptions []generate.Option) *ClusterMachineConfigController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.ClusterMachine, *omni.ClusterMachineConfig]{
+			Name: "ClusterMachineConfigController",
+			MapMetadataFunc: func(clusterMachine *omni.ClusterMachine) *omni.ClusterMachineConfig {
+				return omni.NewClusterMachineConfig(resources.DefaultNamespace, clusterMachine.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(machineConfig *omni.ClusterMachineConfig) *omni.ClusterMachine {
+				return omni.NewClusterMachine(resources.DefaultNamespace, machineConfig.Metadata().ID())
+			},
+			TransformFunc: func(ctx context.Context, r controller.Reader, logger *zap.Logger, clusterMachine *omni.ClusterMachine, machineConfig *omni.ClusterMachineConfig) error {
+				return reconcileClusterMachineConfig(ctx, r, logger, clusterMachine, machineConfig, defaultGenOptions)
+			},
+		},
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.ClusterMachineConfigPatches, *omni.ClusterMachine](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.MachineSetNode, *omni.ClusterMachine](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.MachineConfigGenOptions, *omni.ClusterMachine](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.MachineStatus, *omni.ClusterMachine](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.ClusterMachineTalosVersion, *omni.ClusterMachine](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapClusterResourceToLabeledResources[*omni.Cluster, *omni.ClusterMachine](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapClusterResourceToLabeledResources[*omni.ClusterSecrets, *omni.ClusterMachine](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapClusterResourceToLabeledResources[*omni.ClusterConfigVersion, *omni.ClusterMachine](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapClusterResourceToLabeledResources[*omni.LoadBalancerConfig, *omni.ClusterMachine](),
+		),
+		qtransform.WithConcurrency(2),
+	)
+}
+
+//nolint:gocognit,cyclop,gocyclo
+func reconcileClusterMachineConfig(
+	ctx context.Context,
+	r controller.Reader,
+	logger *zap.Logger,
+	clusterMachine *omni.ClusterMachine,
+	machineConfig *omni.ClusterMachineConfig,
+	defaultGenOptions []generate.Option,
+) error {
+	clusterName, ok := clusterMachine.Metadata().Labels().Get(omni.LabelCluster)
+	if !ok {
+		return fmt.Errorf("missing cluster label on %s", clusterMachine.Metadata().ID())
+	}
+
+	cluster, err := safe.ReaderGet[*omni.Cluster](ctx, r, omni.NewCluster(resources.DefaultNamespace, clusterName).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+		}
+
+		return err
+	}
+
+	machineSetNode, err := safe.ReaderGet[*omni.MachineSetNode](ctx, r,
+		resource.NewMetadata(resources.DefaultNamespace, omni.MachineSetNodeType, clusterMachine.Metadata().ID(), resource.VersionUndefined))
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+		}
+
+		return err
+	}
+
+	if machineSetNode.Metadata().Phase() == resource.PhaseTearingDown {
+		return xerrors.NewTagged[qtransform.SkipReconcileTag](errors.New("machine is being torn down"))
+	}
+
+	if clusterLabel, ok := machineSetNode.Metadata().Labels().Get(omni.LabelCluster); !ok || clusterLabel != clusterName {
+		return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("cluster label on %s doesn't match", machineSetNode.Metadata().ID())
+	}
+
+	secrets, err := safe.ReaderGet[*omni.ClusterSecrets](ctx, r, omni.NewClusterSecrets(resources.DefaultNamespace, clusterName).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+		}
+
+		return err
+	}
+
+	loadBalancerConfig, err := safe.ReaderGet[*omni.LoadBalancerConfig](ctx, r, omni.NewLoadBalancerConfig(resources.DefaultNamespace, clusterName).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+		}
+
+		return err
+	}
+
+	clusterConfigVersion, err := safe.ReaderGet[*omni.ClusterConfigVersion](ctx, r, omni.NewClusterConfigVersion(resources.DefaultNamespace, clusterName).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+		}
+
+		return err
+	}
+
+	clusterMachineConfigPatches, err := safe.ReaderGet[*omni.ClusterMachineConfigPatches](
+		ctx,
+		r,
+		omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, clusterMachine.Metadata().ID()).Metadata(),
+	)
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+		}
+
+		return err
+	}
+
+	machineConfigGenOptions, err := safe.ReaderGet[*omni.MachineConfigGenOptions](
+		ctx,
+		r,
+		omni.NewMachineConfigGenOptions(resources.DefaultNamespace, clusterMachine.Metadata().ID()).Metadata(),
+	)
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+		}
+
+		return err
+	}
+
+	clusterMachineTalosVersion, err := safe.ReaderGet[*omni.ClusterMachineTalosVersion](
+		ctx,
+		r,
+		omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, clusterMachine.Metadata().ID()).Metadata(),
+	)
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+		}
+
+		return err
+	}
+
+	inputs := []resource.Resource{
+		secrets,
+		clusterMachine,
+		loadBalancerConfig,
+		cluster,
+		clusterMachineConfigPatches,
+		machineConfigGenOptions,
+		clusterMachineTalosVersion,
+	}
+
+	if !UpdateInputsVersions(machineConfig, inputs...) {
+		return xerrors.NewTagged[qtransform.SkipReconcileTag](errors.New("config inputs not changed"))
+	}
+
+	machineConfig.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+
+	// TODO: temporary transition code, remove in the future
+	if clusterMachine.TypedSpec().Value.KubernetesVersion == "" {
+		return xerrors.NewTagged[qtransform.SkipReconcileTag](errors.New("kubernetes version is not set yet"))
+	}
+
+	// TODO(image-factory): temporary method to preserve the existing schematics of Talos nodes on install/updates. Might change later.
+	machineStatus, err := safe.ReaderGet[*omni.MachineStatus](ctx, r, omni.NewMachineStatus(resources.DefaultNamespace, clusterMachine.Metadata().ID()).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+		}
+
+		return err
+	}
+
+	// skip if the machine schematic information is not yet detected
+	if machineStatus.TypedSpec().Value.Schematic == nil {
+		logger.Error("machine schematic is not set, skip reconcile")
+
+		return xerrors.NewTagged[qtransform.SkipReconcileTag](errors.New("machine schematic is not set detected"))
+	}
+
+	var helper clusterMachineConfigControllerHelper
+
+	machineConfig.TypedSpec().Value.Data, err = helper.generateConfig(
+		clusterMachine,
+		clusterMachineConfigPatches,
+		secrets,
+		loadBalancerConfig,
+		cluster,
+		clusterConfigVersion,
+		machineConfigGenOptions,
+		clusterMachineTalosVersion,
+		defaultGenOptions,
+		machineStatus,
+	)
+	if err != nil {
+		machineConfig.TypedSpec().Value.GenerationError = err.Error()
+
+		return nil //nolint:nilerr
+	}
+
+	machineConfig.TypedSpec().Value.ClusterMachineVersion = clusterMachine.Metadata().Version().String()
+	machineConfig.TypedSpec().Value.GenerationError = ""
+
+	return nil
+}
+
+type clusterMachineConfigControllerHelper struct{}
+
+func (clusterMachineConfigControllerHelper) generateConfig(
+	clusterMachine *omni.ClusterMachine,
+	clusterMachineConfigPatches *omni.ClusterMachineConfigPatches,
+	secrets *omni.ClusterSecrets,
+	loadbalancer *omni.LoadBalancerConfig,
+	cluster *omni.Cluster,
+	clusterConfigVersion *omni.ClusterConfigVersion,
+	machineConfigGenOptions *omni.MachineConfigGenOptions,
+	clusterMachineTalosVersion *omni.ClusterMachineTalosVersion,
+	extraGenOptions []generate.Option,
+	machineStatus *omni.MachineStatus,
+) ([]byte, error) {
+	clusterName := cluster.Metadata().ID()
+
+	talosVersion := clusterConfigVersion.TypedSpec().Value.Version
+	kubernetesVersion := clusterMachine.TypedSpec().Value.KubernetesVersion
+
+	if talosVersion == "" {
+		return nil, fmt.Errorf("talos version is not set on the resource %s", clusterConfigVersion.Metadata())
+	}
+
+	installImage, err := buildInstallImage(clusterMachineTalosVersion, machineStatus, talosVersion)
+	if err != nil {
+		return nil, err
+	}
+
+	genOptions := []generate.Option{
+		generate.WithInstallImage(installImage),
+	}
+
+	genOptions = append(genOptions, extraGenOptions...)
+
+	if machineConfigGenOptions.TypedSpec().Value.InstallDisk != "" {
+		genOptions = append(genOptions, generate.WithInstallDisk(machineConfigGenOptions.TypedSpec().Value.InstallDisk))
+	}
+
+	if talosVersion != "latest" {
+		versionContract, parseErr := config.ParseContractFromVersion(talosVersion)
+		if parseErr != nil {
+			return nil, parseErr
+		}
+
+		genOptions = append(genOptions, generate.WithVersionContract(versionContract))
+
+		// For Talos 1.5+, enable KubePrism feature. It's not enabled by default in the machine generation.
+		if versionContract.Greater(config.TalosVersion1_4) {
+			genOptions = append(genOptions, generate.WithKubePrismPort(constants.KubePrismPort))
+		}
+	}
+
+	// add the advertised host of the app so kube-apiserver cert is valid for external access
+	apiHost, err := appconfig.Config.GetAdvertisedAPIHost()
+	if err != nil {
+		return nil, err
+	}
+
+	genOptions = append(genOptions, generate.WithAdditionalSubjectAltNames([]string{apiHost}))
+
+	secretBundle, err := omni.ToSecretsBundle(secrets)
+	if err != nil {
+		return nil, err
+	}
+
+	genOptions = append(genOptions, generate.WithSecretsBundle(secretBundle))
+
+	input, err := generate.NewInput(
+		clusterName,
+		loadbalancer.TypedSpec().Value.SiderolinkEndpoint,
+		kubernetesVersion,
+		genOptions...,
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	machineType := machineapi.TypeWorker
+
+	if _, ok := clusterMachine.Metadata().Labels().Get(omni.LabelControlPlaneRole); ok {
+		machineType = machineapi.TypeControlPlane
+	}
+
+	cfg, err := input.Config(machineType)
+	if err != nil {
+		return nil, err
+	}
+
+	patches, err := configpatcher.LoadPatches(clusterMachineConfigPatches.TypedSpec().Value.Patches)
+	if err != nil {
+		return nil, err
+	}
+
+	patched, err := configpatcher.Apply(configpatcher.WithConfig(cfg), patches)
+	if err != nil {
+		return nil, err
+	}
+
+	patchedConfig, err := patched.Config()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get patched config: %w", err)
+	}
+
+	strippedConfig, err := stripTalosAPIAccessOSAdminRole(patchedConfig)
+	if err != nil {
+		return nil, fmt.Errorf("failed to build talos api access feature allowed roles patch: %w", err)
+	}
+
+	bytes, err := strippedConfig.Bytes()
+	if err != nil {
+		return nil, err
+	}
+
+	headerComment := []byte(fmt.Sprintf("# Generated by Omni on %s\n", time.Now().UTC().Format(time.RFC3339Nano)))
+
+	return append(headerComment, bytes...), nil
+}
+
+// stripTalosAPIAccessOSAdminRole ensures that the OS admin role is never included in the allowed roles of the
+// Kubernetes Talos API Access feature configuration.
+//
+// Config patches are already validated to not contain it, this is merely an additional safety measure.
+func stripTalosAPIAccessOSAdminRole(cfg config.Provider) (config.Provider, error) {
+	if cfg.Machine() == nil {
+		return cfg, nil
+	}
+
+	allowedRoles := cfg.Machine().Features().KubernetesTalosAPIAccess().AllowedRoles()
+	if len(allowedRoles) == 0 {
+		return cfg, nil
+	}
+
+	filteredAllowedRoles := make([]string, 0, len(allowedRoles))
+
+	osAdminRole := string(talosrole.Admin)
+
+	for _, role := range allowedRoles {
+		if role != osAdminRole {
+			filteredAllowedRoles = append(filteredAllowedRoles, role)
+		}
+	}
+
+	// nothing is filtered out, short-circuit
+	if len(filteredAllowedRoles) == len(allowedRoles) {
+		return cfg, nil
+	}
+
+	configDocs := cfg.Documents()
+	updatedDocs := make([]documentconfig.Document, 0, len(configDocs))
+
+	for _, document := range configDocs {
+		if document.APIVersion() == "" && document.Kind() == v1alpha1.Version {
+			v1alpha1Config := cfg.RawV1Alpha1() // this ensures that we get a writeable copy of v1alpha1 config
+
+			v1alpha1Config.MachineConfig.MachineFeatures.KubernetesTalosAPIAccessConfig.AccessAllowedRoles = filteredAllowedRoles
+
+			updatedDocs = append(updatedDocs, v1alpha1Config)
+
+			continue
+		}
+
+		updatedDocs = append(updatedDocs, document)
+	}
+
+	return container.New(updatedDocs...)
+}
+
+var imageFactoryHost string
+
+func init() {
+	parsed, err := url.Parse(appconfig.Config.ImageFactoryBaseURL)
+	if err != nil {
+		panic(err)
+	}
+
+	imageFactoryHost = parsed.Host
+}
+
+func buildInstallImage(clusterMachineTalosVersion *omni.ClusterMachineTalosVersion, machineStatus *omni.MachineStatus, talosVersion string) (string, error) {
+	if machineStatus.TypedSpec().Value.Schematic == nil {
+		return "", fmt.Errorf("machine %q has no schematic information set", machineStatus.Metadata().ID())
+	}
+
+	schematicID := machineStatus.TypedSpec().Value.Schematic.Id
+
+	if talosVersion == "latest" && schematicID != "" {
+		return "", fmt.Errorf("machine %q has a schematic but using Talos version %q", machineStatus.Metadata().ID(), talosVersion)
+	}
+
+	if clusterMachineTalosVersion.TypedSpec().Value.SchematicId != "" {
+		schematicID = clusterMachineTalosVersion.TypedSpec().Value.SchematicId
+	}
+
+	if machineStatus.TypedSpec().Value.Schematic.Invalid {
+		schematicID = ""
+	}
+
+	if clusterMachineTalosVersion.TypedSpec().Value.TalosVersion != "" {
+		talosVersion = clusterMachineTalosVersion.TypedSpec().Value.TalosVersion
+	}
+
+	if !strings.HasPrefix(talosVersion, "v") {
+		talosVersion = "v" + talosVersion
+	}
+
+	// TODO(image-factory): detect if secure boot is enabled, if it is, use `installer-secureboot`
+	if schematicID != "" {
+		return imageFactoryHost + "/installer/" + schematicID + ":" + talosVersion, nil
+	}
+
+	return appconfig.Config.TalosRegistry + ":" + talosVersion, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_machine_config_status.go b/internal/backend/runtime/omni/controllers/omni/cluster_machine_config_status.go
new file mode 100644
index 000000000..094fd6861
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_machine_config_status.go
@@ -0,0 +1,706 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/tls"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/xerrors"
+	machineapi "github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+	"github.com/siderolabs/talos/pkg/machinery/constants"
+	"go.uber.org/zap"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/client/pkg/meta"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/mappers"
+	talosutils "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/talos"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+)
+
+const gracefulResetAttemptCount = 2
+
+// ClusterMachineConfigStatusController manages ClusterMachineStatus resource lifecycle.
+//
+// ClusterMachineConfigStatusController applies the generated machine config  on each corresponding machine.
+type ClusterMachineConfigStatusController = qtransform.QController[*omni.ClusterMachineConfig, *omni.ClusterMachineConfigStatus]
+
+// NewClusterMachineConfigStatusController initializes ClusterMachineConfigStatusController.
+//
+//nolint:gocognit,gocyclo,cyclop
+func NewClusterMachineConfigStatusController() *ClusterMachineConfigStatusController {
+	ongoingResets := &ongoingResets{
+		statuses: map[string]*resetStatus{},
+	}
+
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.ClusterMachineConfig, *omni.ClusterMachineConfigStatus]{
+			Name: "ClusterMachineConfigStatusController",
+			MapMetadataFunc: func(machineConfig *omni.ClusterMachineConfig) *omni.ClusterMachineConfigStatus {
+				return omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, machineConfig.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(machineConfigStatus *omni.ClusterMachineConfigStatus) *omni.ClusterMachineConfig {
+				return omni.NewClusterMachineConfig(resources.DefaultNamespace, machineConfigStatus.Metadata().ID())
+			},
+			TransformFunc: func(ctx context.Context, r controller.Reader, logger *zap.Logger, machineConfig *omni.ClusterMachineConfig, configStatus *omni.ClusterMachineConfigStatus) error {
+				handler := clusterMachineConfigStatusControllerHandler{
+					r:             r,
+					logger:        logger,
+					ongoingResets: ongoingResets,
+				}
+
+				if machineConfig.TypedSpec().Value.GenerationError != "" {
+					configStatus.TypedSpec().Value.LastConfigError = machineConfig.TypedSpec().Value.GenerationError
+
+					return nil
+				}
+
+				statusSnapshot, err := safe.ReaderGet[*omni.MachineStatusSnapshot](ctx, r, omni.NewMachineStatusSnapshot(resources.DefaultNamespace, machineConfig.Metadata().ID()).Metadata())
+				if err != nil {
+					if state.IsNotFoundError(err) {
+						return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("'%s' machine status snapshot not found: %w", machineConfig.Metadata().ID(), err)
+					}
+
+					return fmt.Errorf("failed to get machine status snapshot '%s': %w", machineConfig.Metadata().ID(), err)
+				}
+
+				talosVersion, err := safe.ReaderGet[*omni.ClusterMachineTalosVersion](ctx, r, omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, machineConfig.Metadata().ID()).Metadata())
+				if err != nil {
+					if state.IsNotFoundError(err) {
+						return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("'%s' machine talos version not found: %w", machineConfig.Metadata().ID(), err)
+					}
+
+					return fmt.Errorf("failed to get machine talos version '%s': %w", machineConfig.Metadata().ID(), err)
+				}
+
+				machineStatus, err := safe.ReaderGet[*omni.MachineStatus](ctx, r, omni.NewMachineStatus(resources.DefaultNamespace, machineConfig.Metadata().ID()).Metadata())
+				if err != nil {
+					if state.IsNotFoundError(err) {
+						return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("'%s' machine status not found: %w", machineConfig.Metadata().ID(), err)
+					}
+
+					return fmt.Errorf("failed to get machine status '%s': %w", machineConfig.Metadata().ID(), err)
+				}
+
+				if !machineStatus.TypedSpec().Value.Connected {
+					return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("'%s' machine is not connected", machineConfig.Metadata().ID())
+				}
+
+				if machineStatus.TypedSpec().Value.Schematic == nil {
+					logger.Error("machine schematic is not set, skip reconcile")
+
+					return xerrors.NewTagged[qtransform.SkipReconcileTag](fmt.Errorf("machine status '%s' does not have schematic information", machineConfig.Metadata().ID()))
+				}
+
+				// compatibility code for the machines having extensions that bypass the image factory
+				// drop when there's no such machines, or when we are able to detect schematic id for the machines of that kind
+				expectedSchematic := talosVersion.TypedSpec().Value.SchematicId
+				if machineStatus.TypedSpec().Value.Schematic.Invalid {
+					expectedSchematic = ""
+				}
+
+				versionMismatch := strings.TrimLeft(machineStatus.TypedSpec().Value.TalosVersion, "v") != configStatus.TypedSpec().Value.TalosVersion ||
+					configStatus.TypedSpec().Value.TalosVersion != talosVersion.TypedSpec().Value.TalosVersion ||
+					configStatus.TypedSpec().Value.SchematicId != expectedSchematic ||
+					machineStatus.TypedSpec().Value.Schematic.Id != expectedSchematic
+
+				// don't run the upgrade check if the running version and expected versions match
+				if versionMismatch && talosVersion.TypedSpec().Value.TalosVersion != "" && talosVersion.TypedSpec().Value.SchematicId != "" {
+					inSync, err := handler.syncTalosVersionAndSchematic(ctx, configStatus, machineStatus, machineConfig, statusSnapshot, talosVersion)
+					if err != nil {
+						return err
+					}
+
+					if !inSync {
+						logger.Info("the machine talos version is out of sync, the config is not applied",
+							zap.String("machine", machineConfig.Metadata().ID()),
+						)
+
+						return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("'%s' the machine talos version is out of sync: %w", machineConfig.Metadata().ID(), err)
+					}
+				}
+
+				shaSum := sha256.Sum256(machineConfig.TypedSpec().Value.Data)
+				shaSumString := hex.EncodeToString(shaSum[:])
+
+				if configStatus.TypedSpec().Value.ClusterMachineConfigSha256 == shaSumString {
+					// config is already applied
+
+					return nil
+				}
+
+				// perform config apply
+				if err := handler.applyConfig(ctx, machineStatus, machineConfig, statusSnapshot); err != nil {
+					grpcSt := client.Status(err)
+					if grpcSt != nil && grpcSt.Code() == codes.InvalidArgument {
+						configStatus.TypedSpec().Value.LastConfigError = grpcSt.Message()
+
+						return nil
+					}
+
+					return fmt.Errorf("failed to apply config to machine '%s': %w", machineConfig.Metadata().ID(), err)
+				}
+
+				configStatus.TypedSpec().Value.ClusterMachineVersion = machineConfig.TypedSpec().Value.ClusterMachineVersion
+				configStatus.TypedSpec().Value.ClusterMachineConfigVersion = machineConfig.Metadata().Version().String()
+				configStatus.TypedSpec().Value.ClusterMachineConfigSha256 = shaSumString
+
+				configStatus.TypedSpec().Value.LastConfigError = ""
+
+				return nil
+			},
+			FinalizerRemovalFunc: func(ctx context.Context, r controller.Reader, logger *zap.Logger, machineConfig *omni.ClusterMachineConfig) error {
+				handler := clusterMachineConfigStatusControllerHandler{
+					r:             r,
+					logger:        logger,
+					ongoingResets: ongoingResets,
+				}
+
+				clusterMachine, err := safe.ReaderGet[*omni.ClusterMachine](ctx, r, omni.NewClusterMachine(resources.DefaultNamespace, machineConfig.Metadata().ID()).Metadata())
+				if err != nil {
+					return fmt.Errorf("finalizer: failed to get cluster machine '%s': %w", machineConfig.Metadata().ID(), err)
+				}
+
+				// perform reset of the node
+				err = handler.reset(ctx, machineConfig, clusterMachine)
+				if err != nil {
+					return err
+				}
+
+				// delete ongoing resets information if the machine was reset
+				handler.ongoingResets.deleteStatus(clusterMachine.Metadata().ID())
+
+				return nil
+			},
+		},
+		qtransform.WithConcurrency(8),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.ClusterMachine, *omni.ClusterMachineConfig](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.MachineStatus, *omni.ClusterMachineConfig](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.MachineStatusSnapshot, *omni.ClusterMachineConfig](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.ClusterMachineTalosVersion, *omni.ClusterMachineConfig](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.Machine, *omni.ClusterMachineConfig](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapClusterResourceToLabeledResources[*omni.TalosConfig, *omni.ClusterMachineConfig](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperNone[*omni.MachineSet](),
+		),
+	)
+}
+
+type resetStatus struct {
+	attempts        uint
+	forceUngraceful bool
+}
+
+type ongoingResets struct {
+	statuses map[resource.ID]*resetStatus
+	mu       sync.Mutex
+}
+
+func (r *ongoingResets) getStatus(id resource.ID) (*resetStatus, bool) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	rs, ok := r.statuses[id]
+
+	return rs, ok
+}
+
+func (r *ongoingResets) isGraceful(id resource.ID) bool {
+	rs, ok := r.getStatus(id)
+	if !ok {
+		return true
+	}
+
+	return !rs.forceUngraceful && rs.attempts < gracefulResetAttemptCount
+}
+
+func (r *ongoingResets) handleReset(id resource.ID) uint {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if _, ok := r.statuses[id]; !ok {
+		r.statuses[id] = &resetStatus{}
+	}
+
+	r.statuses[id].attempts++
+
+	return r.statuses[id].attempts
+}
+
+func (r *ongoingResets) forceUngraceful(id resource.ID) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if _, ok := r.statuses[id]; !ok {
+		r.statuses[id] = &resetStatus{}
+	}
+
+	r.statuses[id].forceUngraceful = true
+}
+
+func (r *ongoingResets) deleteStatus(id resource.ID) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	delete(r.statuses, id)
+}
+
+type clusterMachineConfigStatusControllerHandler struct {
+	r             controller.Reader
+	logger        *zap.Logger
+	ongoingResets *ongoingResets
+}
+
+func (h *clusterMachineConfigStatusControllerHandler) syncTalosVersionAndSchematic(inputCtx context.Context, configStatus *omni.ClusterMachineConfigStatus,
+	machineStatus *omni.MachineStatus, machineConfig *omni.ClusterMachineConfig, statusSnapshot *omni.MachineStatusSnapshot, talosVersion *omni.ClusterMachineTalosVersion,
+) (bool, error) {
+	// use short timeout for the all API calls but upgrade to quickly skip "dead" nodes
+	ctx, cancel := context.WithTimeout(inputCtx, 5*time.Second)
+	defer cancel()
+
+	var maintenance bool
+
+	//nolint:exhaustive
+	switch statusSnapshot.TypedSpec().Value.GetMachineStatus().GetStage() {
+	case machineapi.MachineStatusEvent_MAINTENANCE:
+		maintenance = true
+	case machineapi.MachineStatusEvent_BOOTING:
+	case machineapi.MachineStatusEvent_RUNNING:
+	default:
+		return configStatus.TypedSpec().Value.TalosVersion != "", nil
+	}
+
+	if talosVersion.TypedSpec().Value.TalosVersion == "" {
+		return false, xerrors.NewTagged[qtransform.SkipReconcileTag](fmt.Errorf("machine '%s' does not have talos version", machineConfig.Metadata().ID()))
+	}
+
+	c, err := h.getClient(ctx, maintenance, machineStatus, machineConfig)
+	if err != nil {
+		return false, fmt.Errorf("failed to get client: %w", err)
+	}
+
+	defer logClose(c, h.logger, fmt.Sprintf("machine '%s'", machineConfig.Metadata().ID()))
+
+	expectedVersion := talosVersion.TypedSpec().Value.TalosVersion
+	expectedSchematic := talosVersion.TypedSpec().Value.SchematicId
+
+	actualVersion, err := getVersion(ctx, c)
+	if err != nil {
+		return false, err
+	}
+
+	actualSchematic, err := getSchematic(ctx, c)
+	if err != nil {
+		if !errors.Is(err, talosutils.ErrInvalidSchematic) {
+			return false, err
+		}
+
+		// compatibility code for the machines running extensions installed bypassing image factory
+		// make schematic play no role in the checks
+		expectedSchematic = ""
+		actualSchematic = ""
+	}
+
+	if actualVersion == expectedVersion && actualSchematic == expectedSchematic {
+		configStatus.TypedSpec().Value.TalosVersion = actualVersion
+		configStatus.TypedSpec().Value.SchematicId = actualSchematic
+
+		return true, nil
+	}
+
+	image, err := buildInstallImage(talosVersion, machineStatus, expectedVersion)
+	if err != nil {
+		return false, err
+	}
+
+	h.logger.Info("upgrading the machine",
+		zap.String("from_version", actualVersion),
+		zap.String("to_version", expectedVersion),
+		zap.String("from_schematic", actualSchematic),
+		zap.String("to_schematic", expectedSchematic),
+		zap.String("image", image),
+		zap.String("machine", machineConfig.Metadata().ID()))
+
+	// give the Upgrade API longer timeout, as it pulls the installer image before returning
+	upgradeCtx, upgradeCancel := context.WithTimeout(inputCtx, 5*time.Minute)
+	defer upgradeCancel()
+
+	_, err = c.Upgrade(upgradeCtx, image, !maintenance, false, false)
+
+	// Failed Precondition means that the node is not in a state when the system can be upgraded.
+	if status.Code(err) == codes.FailedPrecondition {
+		return true, nil
+	}
+
+	// If upgrade is not implemented, it means that we run older Talos that doesn't support upgrades in maintenance mode.
+	if status.Code(err) == codes.Unimplemented {
+		return true, nil
+	}
+
+	return false, err
+}
+
+func (h *clusterMachineConfigStatusControllerHandler) applyConfig(inputCtx context.Context,
+	machineStatus *omni.MachineStatus, machineConfig *omni.ClusterMachineConfig, statusSnapshot *omni.MachineStatusSnapshot,
+) error {
+	ctx, cancel := context.WithTimeout(inputCtx, 5*time.Second)
+	defer cancel()
+
+	applyMaintenance := false
+
+	switch statusSnapshot.TypedSpec().Value.GetMachineStatus().GetStage() {
+	case machineapi.MachineStatusEvent_BOOTING,
+		machineapi.MachineStatusEvent_RUNNING:
+		// can apply config normal mode
+	case machineapi.MachineStatusEvent_MAINTENANCE:
+		// can apply config maintenance mode
+		applyMaintenance = true
+	case machineapi.MachineStatusEvent_INSTALLING,
+		machineapi.MachineStatusEvent_REBOOTING,
+		machineapi.MachineStatusEvent_RESETTING,
+		machineapi.MachineStatusEvent_SHUTTING_DOWN,
+		machineapi.MachineStatusEvent_UNKNOWN,
+		machineapi.MachineStatusEvent_UPGRADING:
+		// no way to apply config at this stage
+		return xerrors.NewTagged[qtransform.SkipReconcileTag](fmt.Errorf("machine '%s' is in %s stage", machineConfig.Metadata().ID(), statusSnapshot.TypedSpec().Value.GetMachineStatus().GetStage()))
+	}
+
+	c, err := h.getClient(ctx, applyMaintenance, machineStatus, machineConfig)
+	if err != nil {
+		return fmt.Errorf("failed to get client: %w", err)
+	}
+
+	defer logClose(c, h.logger, fmt.Sprintf("machine '%s'", machineConfig.Metadata().ID()))
+
+	_, err = c.Version(ctx)
+	if err != nil {
+		return err
+	}
+
+	ctx, applyCancel := context.WithTimeout(inputCtx, time.Minute)
+	defer applyCancel()
+
+	resp, err := c.ApplyConfiguration(ctx, &machineapi.ApplyConfigurationRequest{
+		Data: machineConfig.TypedSpec().Value.Data,
+		Mode: machineapi.ApplyConfigurationRequest_AUTO,
+	})
+	if err != nil {
+		h.logger.Error("apply config failed",
+			zap.String("machine", machineConfig.Metadata().ID()),
+			zap.Error(err),
+			zap.Stringer("config_version", machineConfig.Metadata().Version()),
+		)
+
+		return fmt.Errorf("failed to apply config to machine '%s': %w", machineConfig.Metadata().ID(), err)
+	}
+
+	if len(resp.Messages) != 1 {
+		return fmt.Errorf("unexpected number of responses: %d", len(resp.Messages))
+	}
+
+	mode := resp.Messages[0].GetMode()
+	h.logger.Info("applied machine config",
+		zap.String("machine", machineConfig.Metadata().ID()),
+		zap.Stringer("config_version", machineConfig.Metadata().Version()),
+		zap.Stringer("mode", mode),
+	)
+
+	if mode != machineapi.ApplyConfigurationRequest_NO_REBOOT {
+		return xerrors.NewTagged[qtransform.SkipReconcileTag](fmt.Errorf("applied config to machine '%s' in %s mode", machineConfig.Metadata().ID(), mode))
+	}
+
+	return nil
+}
+
+func logClose(c io.Closer, logger *zap.Logger, additional string) {
+	if err := c.Close(); err != nil {
+		logger.Error(additional+": failed to close client", zap.Error(err))
+	}
+}
+
+//nolint:gocyclo,cyclop,gocognit
+func (h *clusterMachineConfigStatusControllerHandler) reset(
+	ctx context.Context,
+	machineConfig *omni.ClusterMachineConfig,
+	clusterMachine *omni.ClusterMachine,
+) error {
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	logger := h.logger.With(
+		zap.String("machine", clusterMachine.Metadata().ID()),
+	)
+
+	machine, err := safe.ReaderGetByID[*omni.Machine](ctx, h.r, machineConfig.Metadata().ID())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			// Machine is gone, means that we should just let it go
+			logger.Info("removed without reset")
+
+			return nil
+		}
+
+		return fmt.Errorf("failed to get machine '%s': %w", machineConfig.Metadata().ID(), err)
+	}
+
+	if machine.Metadata().Phase() == resource.PhaseTearingDown {
+		// Machine is tearing down, means that we should just let it go
+		logger.Info("removed without reset")
+
+		return nil
+	}
+
+	machineStatus, err := safe.ReaderGet[*omni.MachineStatus](ctx, h.r, omni.NewMachineStatus(resources.DefaultNamespace, machineConfig.Metadata().ID()).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			// MachineStatus is gone, means that we should just let it go
+			logger.Info("removed without reset")
+
+			return nil
+		}
+
+		return fmt.Errorf("failed to get machine status '%s': %w", machineConfig.Metadata().ID(), err)
+	}
+
+	if !machineStatus.TypedSpec().Value.Connected {
+		// machine is not connected, so we can't reset it
+		return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("machine '%s' is not connected", machineConfig.Metadata().ID())
+	}
+
+	statusSnapshot, err := safe.ReaderGet[*omni.MachineStatusSnapshot](ctx, h.r, omni.NewMachineStatusSnapshot(resources.DefaultNamespace, machineConfig.Metadata().ID()).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("machine '%s' status snapshot is not found: %w", machineConfig.Metadata().ID(), err)
+		}
+
+		return fmt.Errorf("failed to get machine status snapshot '%s': %w", machineConfig.Metadata().ID(), err)
+	}
+
+	var c *client.Client
+
+	machineStage := statusSnapshot.TypedSpec().Value.GetMachineStatus().GetStage()
+
+	logger.Debug("getting ready to reset the machine", zap.Stringer("stage", machineStage))
+
+	inMaintenance := machineStage == machineapi.MachineStatusEvent_MAINTENANCE
+
+	if inMaintenance {
+		// verify that we are in maintenance mode
+		c, err = h.getClient(ctx, true, machineStatus, machineConfig)
+		if err != nil {
+			return fmt.Errorf("failed to get maintenance client for machine '%s': %w", machineConfig.Metadata().ID(), err)
+		}
+
+		defer logClose(c, logger, "reset maintenance")
+
+		_, err = c.Disks(ctx)
+
+		logger.Debug("maintenance mode check", zap.Error(err))
+
+		if err == nil {
+			// really in maintenance mode, no need to reset
+			return nil
+		}
+
+		// retry next time when MachineStatus updates
+		return xerrors.NewTagged[qtransform.SkipReconcileTag](fmt.Errorf("failed to get disks in maintenance mode for machine '%s': %w", machineConfig.Metadata().ID(), err))
+	}
+
+	machineSetName, ok := clusterMachine.Metadata().Labels().Get(omni.LabelMachineSet)
+	if !ok {
+		return fmt.Errorf("failed to determine machine set of the cluster machine %s", clusterMachine.Metadata().ID())
+	}
+
+	machineSet, err := safe.ReaderGet[*omni.MachineSet](ctx, h.r, omni.NewMachineSet(resources.DefaultNamespace, machineSetName).Metadata())
+	if err != nil {
+		return fmt.Errorf("failed to get machine set '%s': %w", machineSetName, err)
+	}
+
+	graceful := machineSet.Metadata().Phase() == resource.PhaseRunning
+
+	if !h.ongoingResets.isGraceful(clusterMachine.Metadata().ID()) {
+		graceful = false
+	}
+
+	isControlPlane := isControlPlane(clusterMachine)
+
+	switch {
+	// check that machine is ready to be reset
+	// if running allow reset always
+	case machineStage == machineapi.MachineStatusEvent_RUNNING:
+	// if booting allow only non-graceful reset for control plane nodes
+	case (!graceful || !isControlPlane) && machineStage == machineapi.MachineStatusEvent_BOOTING:
+	default:
+		return xerrors.NewTagged[qtransform.SkipReconcileTag](fmt.Errorf("machine '%s' is in %s stage", machineConfig.Metadata().ID(), machineStage))
+	}
+
+	c, err = h.getClient(ctx, false, machineStatus, machineConfig)
+	if err != nil {
+		return fmt.Errorf("failed to get client for machine '%s': %w", machineConfig.Metadata().ID(), err)
+	}
+
+	defer logClose(c, logger, "reset")
+
+	err = c.MetaDelete(ctx, meta.StateEncryptionConfig)
+	if err != nil {
+		//nolint:exhaustive
+		switch status.Code(err) {
+		case
+			codes.NotFound,
+			codes.Unimplemented,
+			codes.FailedPrecondition:
+		default:
+			return fmt.Errorf("failed resetting node '%s': %w", machineConfig.Metadata().ID(), err)
+		}
+	}
+
+	// if is control plane first leave etcd
+	if graceful && isControlPlane {
+		_, err = c.EtcdForfeitLeadership(ctx, &machineapi.EtcdForfeitLeadershipRequest{})
+		if err != nil {
+			h.ongoingResets.forceUngraceful(clusterMachine.Metadata().ID())
+
+			return fmt.Errorf("failed to forfeit leadership, node %q: %w", machineConfig.Metadata().ID(), err)
+		}
+
+		err = c.EtcdLeaveCluster(ctx, &machineapi.EtcdLeaveClusterRequest{})
+		if err != nil {
+			h.ongoingResets.forceUngraceful(clusterMachine.Metadata().ID())
+
+			return fmt.Errorf("failed to leave etcd cluster, node %q: %w", machineConfig.Metadata().ID(), err)
+		}
+	}
+
+	err = c.ResetGeneric(ctx, &machineapi.ResetRequest{
+		Graceful: graceful,
+		Reboot:   true,
+		SystemPartitionsToWipe: []*machineapi.ResetPartitionSpec{
+			{
+				Label: constants.EphemeralPartitionLabel,
+				Wipe:  true,
+			},
+			{
+				Label: constants.StatePartitionLabel,
+				Wipe:  true,
+			},
+		},
+	})
+
+	if err == nil {
+		attempt := h.ongoingResets.handleReset(clusterMachine.Metadata().ID())
+		logger.Info("resetting node", zap.Uint("attempt", attempt), zap.Bool("graceful", graceful))
+
+		return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("check back when machine '%s' gets into maintenance mode", machineConfig.Metadata().ID())
+	}
+
+	logger.Error("failed resetting node",
+		zap.Error(err),
+	)
+
+	return fmt.Errorf("failed resetting node '%s': %w", machineConfig.Metadata().ID(), err)
+}
+
+func (h *clusterMachineConfigStatusControllerHandler) getClient(
+	ctx context.Context,
+	useMaintenance bool,
+	machineStatus *omni.MachineStatus,
+	machineConfig *omni.ClusterMachineConfig,
+) (*client.Client, error) {
+	address := machineStatus.TypedSpec().Value.ManagementAddress
+	opts := talos.GetSocketOptions(address)
+
+	if useMaintenance {
+		return client.New(ctx,
+			append(
+				opts,
+				client.WithTLSConfig(insecureTLSConfig),
+				client.WithEndpoints(address),
+			)...)
+	}
+
+	clusterName, ok := machineConfig.Metadata().Labels().Get(omni.LabelCluster)
+	if !ok {
+		return nil, errors.New("no cluster name label")
+	}
+
+	talosConfig, err := safe.ReaderGet[*omni.TalosConfig](ctx, h.r, omni.NewTalosConfig(resources.DefaultNamespace, clusterName).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, xerrors.NewTaggedf[qtransform.SkipReconcileTag]("cluster '%s' talosconfig not found: %w", clusterName, err)
+		}
+
+		return nil, fmt.Errorf("cluster '%s' failed to get talosconfig: %w", clusterName, err)
+	}
+
+	var endpoints []string
+
+	if opts == nil {
+		endpoints = []string{address}
+	}
+
+	config := omni.NewTalosClientConfig(talosConfig, endpoints...)
+	opts = append(opts, client.WithConfig(config))
+
+	result, err := client.New(ctx, opts...)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create client to machine '%s': %w", machineStatus.Metadata().ID(), err)
+	}
+
+	return result, nil
+}
+
+var insecureTLSConfig = &tls.Config{
+	InsecureSkipVerify: true,
+}
+
+func getVersion(ctx context.Context, c *client.Client) (string, error) {
+	ctx, cancel := context.WithTimeout(ctx, time.Second*5)
+	defer cancel()
+
+	versionResponse, err := c.Version(ctx)
+	if err != nil {
+		return "", err
+	}
+
+	for _, m := range versionResponse.Messages {
+		return strings.TrimLeft(m.Version.Tag, "v"), nil
+	}
+
+	return "", errors.New("failed to get Talos version on the machine")
+}
+
+func getSchematic(ctx context.Context, c *client.Client) (string, error) {
+	return talosutils.GetSchematicID(ctx, c)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_machine_config_status_test.go b/internal/backend/runtime/omni/controllers/omni/cluster_machine_config_status_test.go
new file mode 100644
index 000000000..4636ef9e7
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_machine_config_status_test.go
@@ -0,0 +1,604 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/google/uuid"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type ClusterMachineConfigStatusSuite struct {
+	OmniSuite
+}
+
+func (suite *ClusterMachineConfigStatusSuite) TestApplyReset() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewClusterController()))
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewMachineSetController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewSecretsController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosConfigController(constants.CertificateValidityTime)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosUpgradeStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterConfigVersionController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewMachineConfigGenOptionsController()))
+
+	clusterName := "talos-default-4"
+
+	cluster, machines := suite.createCluster(clusterName, 3, 0)
+
+	for _, m := range machines {
+		statusSnapshot := omni.NewMachineStatusSnapshot(resources.DefaultNamespace, m.Metadata().ID())
+
+		statusSnapshot.TypedSpec().Value.MachineStatus = &machine.MachineStatusEvent{
+			Stage: machine.MachineStatusEvent_BOOTING,
+		}
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, statusSnapshot))
+
+		_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, resource.NewMetadata(
+			m.Metadata().Namespace(),
+			omni.MachineStatusType,
+			m.Metadata().ID(),
+			resource.VersionUndefined,
+		),
+			func(res *omni.MachineStatus) error {
+				res.TypedSpec().Value.Connected = true
+				res.TypedSpec().Value.Maintenance = false
+
+				return nil
+			},
+		)
+
+		suite.Require().NoError(err)
+	}
+
+	for _, m := range machines {
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, m.Metadata().ID()).Metadata(),
+			func(res *omni.ClusterMachineConfigStatus, assertions *assert.Assertions) {
+				assertions.NotEmpty(res.TypedSpec().Value.ClusterMachineConfigSha256, "the machine is not configured yet")
+			},
+		)
+	}
+
+	for _, m := range machines {
+		statusSnapshot := omni.NewMachineStatusSnapshot(resources.DefaultNamespace, m.Metadata().ID())
+
+		_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, statusSnapshot.Metadata(), func(res *omni.MachineStatusSnapshot) error {
+			res.TypedSpec().Value.MachineStatus = &machine.MachineStatusEvent{
+				Stage: machine.MachineStatusEvent_RUNNING,
+			}
+
+			return nil
+		})
+
+		suite.Require().NoError(err)
+	}
+
+	suite.Assert().GreaterOrEqual(len(suite.machineService.getApplyRequests()), len(machines))
+
+	go func() {
+		for _, m := range machines {
+			<-suite.machineService.resetChan
+
+			suite.T().Logf("setting maintenance for %v", m.Metadata().ID())
+
+			statusSnapshot := omni.NewMachineStatusSnapshot(resources.DefaultNamespace, m.Metadata().ID())
+
+			_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, statusSnapshot.Metadata(),
+				func(res *omni.MachineStatusSnapshot) error {
+					res.TypedSpec().Value.MachineStatus.Stage = machine.MachineStatusEvent_MAINTENANCE
+
+					return nil
+				},
+			)
+
+			suite.Require().NoError(err)
+		}
+	}()
+
+	time.Sleep(time.Second * 1)
+	suite.destroyCluster(cluster)
+
+	for _, m := range machines {
+		suite.Assert().NoError(retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+			suite.assertNoResource(*omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, m.Metadata().ID()).Metadata()),
+		))
+	}
+
+	suite.Assert().Len(suite.machineService.getResetRequests(), len(machines))
+}
+
+func (suite *ClusterMachineConfigStatusSuite) TestResetMachineRemoved() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewClusterController()))
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewMachineSetController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewSecretsController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosConfigController(constants.CertificateValidityTime)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosUpgradeStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterConfigVersionController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewMachineConfigGenOptionsController()))
+
+	clusterName := "machine-ungraceful-reset"
+
+	cluster, machines := suite.createCluster(clusterName, 2, 0)
+
+	for _, m := range machines {
+		statusSnapshot := omni.NewMachineStatusSnapshot(resources.DefaultNamespace, m.Metadata().ID())
+
+		statusSnapshot.TypedSpec().Value.MachineStatus = &machine.MachineStatusEvent{
+			Stage: machine.MachineStatusEvent_RUNNING,
+		}
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, statusSnapshot))
+
+		_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, resource.NewMetadata(
+			m.Metadata().Namespace(),
+			omni.MachineStatusType,
+			m.Metadata().ID(),
+			resource.VersionUndefined,
+		),
+			func(res *omni.MachineStatus) error {
+				res.TypedSpec().Value.Connected = true
+				res.TypedSpec().Value.Maintenance = false
+
+				return nil
+			},
+		)
+
+		suite.Require().NoError(err)
+	}
+
+	for _, m := range machines {
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, m.Metadata().ID()).Metadata(),
+			func(res *omni.ClusterMachineConfigStatus, assertions *assert.Assertions) {
+				assertions.NotEmpty(res.TypedSpec().Value.ClusterMachineConfigSha256, "the machine is not configured yet")
+			},
+		)
+	}
+
+	for _, m := range machines {
+		_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, resource.NewMetadata(
+			m.Metadata().Namespace(),
+			omni.MachineStatusType,
+			m.Metadata().ID(),
+			resource.VersionUndefined,
+		),
+			func(res *omni.MachineStatus) error {
+				res.TypedSpec().Value.Connected = false
+
+				return nil
+			},
+		)
+
+		suite.Require().NoError(err)
+	}
+
+	for _, m := range machines {
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, m.Metadata().ID()).Metadata(),
+			func(*omni.ClusterMachineConfigStatus, *assert.Assertions) {},
+		)
+	}
+
+	rtestutils.Teardown[*omni.Cluster](suite.ctx, suite.T(), suite.state, []string{cluster.Metadata().ID()})
+
+	for _, m := range machines {
+		rtestutils.Teardown[*omni.ClusterMachine](suite.ctx, suite.T(), suite.state, []string{m.Metadata().ID()})
+	}
+
+	for _, m := range machines {
+		rtestutils.Destroy[*omni.MachineStatus](suite.ctx, suite.T(), suite.state, []string{m.Metadata().ID()})
+		rtestutils.Teardown[*omni.Machine](suite.ctx, suite.T(), suite.state, []string{m.Metadata().ID()})
+
+		suite.Assert().NoError(retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+			suite.assertNoResource(*omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, m.Metadata().ID()).Metadata()),
+		))
+	}
+}
+
+func (suite *ClusterMachineConfigStatusSuite) TestResetUngraceful() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewClusterController()))
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewMachineSetController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewSecretsController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosConfigController(constants.CertificateValidityTime)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosUpgradeStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterConfigVersionController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewMachineConfigGenOptionsController()))
+
+	clusterName := "talos-default-5"
+
+	machineServices := map[resource.ID]*machineService{}
+
+	cluster, machines := suite.createCluster(clusterName, 3, 0)
+
+	brokenEtcdMachine := 2
+
+	for i, m := range machines {
+		statusSnapshot := omni.NewMachineStatusSnapshot(resources.DefaultNamespace, m.Metadata().ID())
+
+		machineService, err := suite.newServer(m.Metadata().ID())
+		suite.Require().NoError(err)
+
+		if i == brokenEtcdMachine {
+			machineService.lock.Lock()
+			machineService.etcdLeaveClusterHandler = func(context.Context, *machine.EtcdLeaveClusterRequest) (*machine.EtcdLeaveClusterResponse, error) {
+				return nil, errors.New("sowwy I'm bwoken")
+			}
+			machineService.lock.Unlock()
+		}
+
+		statusSnapshot.TypedSpec().Value.MachineStatus = &machine.MachineStatusEvent{
+			Stage: machine.MachineStatusEvent_BOOTING,
+		}
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, statusSnapshot))
+
+		_, err = safe.StateUpdateWithConflicts(suite.ctx, suite.state, resource.NewMetadata(
+			m.Metadata().Namespace(),
+			omni.MachineStatusType,
+			m.Metadata().ID(),
+			resource.VersionUndefined,
+		),
+			func(res *omni.MachineStatus) error {
+				res.TypedSpec().Value.Connected = true
+				res.TypedSpec().Value.Maintenance = false
+				res.TypedSpec().Value.ManagementAddress = unixSocket + machineService.address
+
+				return nil
+			},
+		)
+
+		suite.Require().NoError(err)
+
+		machineServices[m.Metadata().ID()] = machineService
+	}
+
+	for _, m := range machines {
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, m.Metadata().ID()).Metadata(),
+			func(res *omni.ClusterMachineConfigStatus, assertions *assert.Assertions) {
+				assertions.NotEmpty(res.TypedSpec().Value.ClusterMachineConfigSha256, "the machine is not configured yet")
+			},
+		)
+
+		statusSnapshot := omni.NewMachineStatusSnapshot(resources.DefaultNamespace, m.Metadata().ID())
+
+		_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, statusSnapshot.Metadata(), func(res *omni.MachineStatusSnapshot) error {
+			res.TypedSpec().Value.MachineStatus = &machine.MachineStatusEvent{
+				Stage: machine.MachineStatusEvent_RUNNING,
+			}
+
+			return nil
+		})
+
+		suite.Require().NoError(err)
+	}
+
+	ctx, cancel := context.WithCancel(suite.ctx)
+	defer cancel()
+
+	for _, m := range machines {
+		machineService := machineServices[m.Metadata().ID()]
+		id := m.Metadata().ID()
+
+		go func() {
+			for {
+				select {
+				case <-ctx.Done():
+					return
+				case req := <-machineService.resetChan:
+					statusSnapshot := omni.NewMachineStatusSnapshot(resources.DefaultNamespace, id)
+
+					_, err := safe.StateUpdateWithConflicts(ctx, suite.state, statusSnapshot.Metadata(),
+						func(*omni.MachineStatusSnapshot) error {
+							// poke machine status to trigger reconciliation
+							_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, statusSnapshot.Metadata(),
+								func(res *omni.MachineStatusSnapshot) error {
+									if req.Graceful {
+										res.Metadata().Annotations().Set("random", uuid.New().String())
+
+										return nil
+									}
+
+									suite.T().Logf("setting maintenance for %v", id)
+
+									// set to maintenance only if non graceful reset was requested
+									res.TypedSpec().Value.MachineStatus.Stage = machine.MachineStatusEvent_MAINTENANCE
+
+									return nil
+								},
+							)
+
+							return err
+						},
+					)
+
+					suite.Require().NoError(err)
+				}
+			}
+		}()
+	}
+
+	time.Sleep(time.Second * 1)
+	suite.destroyCluster(cluster)
+
+	for _, m := range machines {
+		suite.Assert().NoError(retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+			suite.assertNoResource(*omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, m.Metadata().ID()).Metadata()),
+		))
+	}
+
+	for i, m := range machines {
+		count := 3
+		if i == brokenEtcdMachine {
+			count = 1
+		}
+
+		suite.Assert().Len(machineServices[m.Metadata().ID()].getResetRequests(), count)
+	}
+}
+
+func (suite *ClusterMachineConfigStatusSuite) TestUpgrades() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewClusterController()))
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewMachineSetController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewSecretsController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosConfigController(constants.CertificateValidityTime)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterConfigVersionController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewMachineConfigGenOptionsController()))
+
+	clusterName := "test-upgrades"
+
+	cluster, machines := suite.createCluster(clusterName, 1, 0)
+
+	for _, m := range machines {
+		talosVersion := omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, m.Metadata().ID())
+		talosVersion.TypedSpec().Value.TalosVersion = cluster.TypedSpec().Value.TalosVersion
+		suite.Require().NoError(suite.state.Create(suite.ctx, talosVersion))
+
+		statusSnapshot := omni.NewMachineStatusSnapshot(resources.DefaultNamespace, m.Metadata().ID())
+
+		statusSnapshot.TypedSpec().Value.MachineStatus = &machine.MachineStatusEvent{
+			Stage: machine.MachineStatusEvent_RUNNING,
+		}
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, statusSnapshot))
+
+		_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, resource.NewMetadata(
+			m.Metadata().Namespace(),
+			omni.MachineStatusType,
+			m.Metadata().ID(),
+			resource.VersionUndefined,
+		),
+			func(res *omni.MachineStatus) error {
+				res.TypedSpec().Value.Connected = true
+				res.TypedSpec().Value.Maintenance = false
+
+				return nil
+			},
+		)
+
+		suite.Require().NoError(err)
+	}
+
+	for _, m := range machines {
+		talosVersion := omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, m.Metadata().ID())
+		_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, talosVersion.Metadata(), func(res *omni.ClusterMachineTalosVersion) error {
+			res.TypedSpec().Value.TalosVersion = "1.6.1"
+			res.TypedSpec().Value.SchematicId = "cccc"
+
+			return nil
+		})
+		suite.Require().NoError(err)
+	}
+
+	suite.Require().NoError(retry.Constant(time.Second * 5).Retry(func() error {
+		requests := suite.machineService.getUpgradeRequests()
+		if len(requests) == 0 {
+			return retry.ExpectedErrorf("no upgrade requests received")
+		}
+
+		expectedImage := "factory.talos.dev/installer/cccc:v1.6.1"
+		for i, r := range requests {
+			if r.Image != expectedImage {
+				return fmt.Errorf("%d request image is invalid: expected %q got %q", i, expectedImage, r.Image)
+			}
+		}
+
+		return nil
+	}))
+}
+
+func (suite *ClusterMachineConfigStatusSuite) TestSchematicChanges() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewClusterController()))
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewMachineSetController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewSecretsController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosConfigController(constants.CertificateValidityTime)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterConfigVersionController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewMachineConfigGenOptionsController()))
+
+	clusterName := "test-upgrades"
+
+	cluster, machines := suite.createCluster(clusterName, 1, 0)
+
+	for _, m := range machines {
+		talosVersion := omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, m.Metadata().ID())
+		talosVersion.TypedSpec().Value.TalosVersion = cluster.TypedSpec().Value.TalosVersion
+		suite.Require().NoError(suite.state.Create(suite.ctx, talosVersion))
+
+		statusSnapshot := omni.NewMachineStatusSnapshot(resources.DefaultNamespace, m.Metadata().ID())
+
+		statusSnapshot.TypedSpec().Value.MachineStatus = &machine.MachineStatusEvent{
+			Stage: machine.MachineStatusEvent_RUNNING,
+		}
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, statusSnapshot))
+
+		_, err := safe.StateUpdateWithConflicts[*omni.ClusterMachineTalosVersion](suite.ctx, suite.state, talosVersion.Metadata(), func(res *omni.ClusterMachineTalosVersion) error {
+			res.TypedSpec().Value.SchematicId = "ffff"
+
+			return nil
+		})
+
+		suite.Require().NoError(err)
+
+		_, err = safe.StateUpdateWithConflicts(suite.ctx, suite.state, resource.NewMetadata(
+			m.Metadata().Namespace(),
+			omni.MachineStatusType,
+			m.Metadata().ID(),
+			resource.VersionUndefined,
+		),
+			func(res *omni.MachineStatus) error {
+				res.TypedSpec().Value.Connected = true
+				res.TypedSpec().Value.Maintenance = false
+
+				return nil
+			},
+		)
+
+		suite.Require().NoError(err)
+	}
+
+	for _, m := range machines {
+		talosVersion := omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, m.Metadata().ID())
+		_, err := safe.StateUpdateWithConflicts[*omni.ClusterMachineTalosVersion](suite.ctx, suite.state, talosVersion.Metadata(), func(res *omni.ClusterMachineTalosVersion) error {
+			res.TypedSpec().Value.SchematicId = "bbbb"
+
+			return nil
+		})
+
+		suite.Require().NoError(err)
+		suite.Require().NoError(err)
+	}
+
+	suite.Require().NoError(retry.Constant(time.Second * 5).Retry(func() error {
+		requests := suite.machineService.getUpgradeRequests()
+		if len(requests) == 0 {
+			return retry.ExpectedErrorf("no upgrade requests received")
+		}
+
+		expectedImage := "factory.talos.dev/installer/bbbb:v1.3.0"
+		for i, r := range requests {
+			if r.Image != expectedImage {
+				return fmt.Errorf("%d request image is invalid: expected %q got %q", i, expectedImage, r.Image)
+			}
+		}
+
+		return nil
+	}))
+
+	suite.machineService.clearUpgradeRequests()
+
+	// check fallback to ghcr image if the schematic is invalid
+	for _, m := range machines {
+		machineStatus := omni.NewMachineStatus(resources.DefaultNamespace, m.Metadata().ID())
+		_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, machineStatus.Metadata(), func(res *omni.MachineStatus) error {
+			res.TypedSpec().Value.Schematic = &specs.MachineStatusSpec_Schematic{
+				Invalid: true,
+			}
+
+			return nil
+		})
+		suite.Require().NoError(err)
+	}
+
+	suite.Require().NoError(retry.Constant(time.Second * 5).Retry(func() error {
+		requests := suite.machineService.getUpgradeRequests()
+		if len(requests) == 0 {
+			return retry.ExpectedErrorf("no upgrade requests received")
+		}
+
+		expectedImage := "ghcr.io/siderolabs/installer:v1.3.0"
+		for i, r := range requests {
+			if r.Image != expectedImage {
+				return fmt.Errorf("%d request image is invalid: expected %q got %q", i, expectedImage, r.Image)
+			}
+		}
+
+		return nil
+	}))
+}
+
+func (suite *ClusterMachineConfigStatusSuite) TestGenerationErrorPropagation() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewClusterController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewSecretsController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosConfigController(constants.CertificateValidityTime)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterConfigVersionController()))
+
+	clusterName := "test-generation-error-propagation"
+
+	_, machines := suite.createCluster(clusterName, 1, 0)
+
+	suite.Require().Greater(len(machines), 0)
+
+	m := machines[0]
+
+	clusterMachineConfig := omni.NewClusterMachineConfig(resources.DefaultNamespace, m.Metadata().ID())
+	clusterMachineConfig.TypedSpec().Value.GenerationError = "TestGenerationErrorPropagation error"
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, clusterMachineConfig))
+
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, m.Metadata().ID()).Metadata(),
+		func(sts *omni.ClusterMachineConfigStatus, assertions *assert.Assertions) {
+			assertions.Equal("TestGenerationErrorPropagation error", sts.TypedSpec().Value.LastConfigError)
+		},
+	)
+}
+
+func TestClusterMachineConfigStatusSuite(t *testing.T) {
+	suite.Run(t, new(ClusterMachineConfigStatusSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_machine_config_strip_role_test.go b/internal/backend/runtime/omni/controllers/omni/cluster_machine_config_strip_role_test.go
new file mode 100644
index 000000000..680e46d98
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_machine_config_strip_role_test.go
@@ -0,0 +1,117 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
+	"github.com/siderolabs/talos/pkg/machinery/config/types/network"
+	"github.com/siderolabs/talos/pkg/machinery/config/types/siderolink"
+	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
+	"github.com/siderolabs/talos/pkg/machinery/nethelpers"
+	talosrole "github.com/siderolabs/talos/pkg/machinery/role"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+func TestStripTalosAPIAccessOSAdminRole(t *testing.T) {
+	t.Run("empty config container", func(t *testing.T) {
+		ctr, err := container.New()
+		require.NoError(t, err)
+
+		cfg, err := omni.StripTalosAPIAccessOSAdminRole(ctr)
+		require.NoError(t, err)
+
+		assert.Empty(t, cfg.Documents())
+	})
+
+	t.Run("container without v1alpha1 config", func(t *testing.T) {
+		ctr, err := container.New(
+			siderolinkCfg(t),
+			networkDefaultActionCfg(),
+		)
+		require.NoError(t, err)
+
+		cfg, err := omni.StripTalosAPIAccessOSAdminRole(ctr)
+		require.NoError(t, err)
+
+		assert.Len(t, cfg.Documents(), 2)
+		assert.Nil(t, cfg.RawV1Alpha1())
+	})
+
+	t.Run("os:admin role", func(t *testing.T) {
+		ctr, err := container.New(
+			siderolinkCfg(t),
+			v1alpha1Cfg(),
+			networkDefaultActionCfg(),
+		)
+		require.NoError(t, err)
+
+		cfg, err := omni.StripTalosAPIAccessOSAdminRole(ctr)
+		require.NoError(t, err)
+
+		assert.Len(t, cfg.Documents(), 3)
+		assert.Equal(t, cfg.Machine().Features().KubernetesTalosAPIAccess().AllowedRoles(), []string{string(talosrole.EtcdBackup), string(talosrole.Reader)})
+	})
+
+	t.Run("nil machine features", func(t *testing.T) {
+		v1alpha1Config := v1alpha1Cfg()
+		v1alpha1Config.MachineConfig.MachineFeatures = nil
+
+		_, err := container.New(
+			siderolinkCfg(t),
+			v1alpha1Config,
+			networkDefaultActionCfg(),
+		)
+		require.NoError(t, err)
+	})
+
+	t.Run("nil machine", func(t *testing.T) {
+		v1alpha1Config := v1alpha1Cfg()
+		v1alpha1Config.MachineConfig = nil
+
+		_, err := container.New(
+			siderolinkCfg(t),
+			v1alpha1Config,
+			networkDefaultActionCfg(),
+		)
+		require.NoError(t, err)
+	})
+}
+
+func siderolinkCfg(t *testing.T) *siderolink.ConfigV1Alpha1 {
+	var err error
+
+	cfg := siderolink.NewConfigV1Alpha1()
+	cfg.APIUrlConfig.URL, err = url.Parse("https://siderolink.api/join?token=secret")
+
+	require.NoError(t, err)
+
+	return cfg
+}
+
+func v1alpha1Cfg() *v1alpha1.Config {
+	return &v1alpha1.Config{
+		MachineConfig: &v1alpha1.MachineConfig{
+			MachineFeatures: &v1alpha1.FeaturesConfig{
+				KubernetesTalosAPIAccessConfig: &v1alpha1.KubernetesTalosAPIAccessConfig{
+					AccessAllowedRoles: []string{string(talosrole.EtcdBackup), string(talosrole.Admin), string(talosrole.Reader)},
+				},
+			},
+		},
+	}
+}
+
+func networkDefaultActionCfg() *network.DefaultActionConfigV1Alpha1 {
+	cfg := network.NewDefaultActionConfigV1Alpha1()
+	cfg.Ingress = nethelpers.DefaultActionBlock
+
+	return cfg
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_machine_config_test.go b/internal/backend/runtime/omni/controllers/omni/cluster_machine_config_test.go
new file mode 100644
index 000000000..3cd6e4e91
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_machine_config_test.go
@@ -0,0 +1,181 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/siderolabs/talos/pkg/machinery/config"
+	"github.com/siderolabs/talos/pkg/machinery/config/configloader"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+	conf "github.com/siderolabs/omni/internal/pkg/config"
+)
+
+type ClusterMachineConfigSuite struct {
+	OmniSuite
+}
+
+func (suite *ClusterMachineConfigSuite) TestReconcile() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewClusterController()))
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewMachineSetController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewSecretsController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosUpgradeStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterConfigVersionController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewMachineConfigGenOptionsController()))
+
+	clusterName := "talos-default-2"
+
+	cluster, machines := suite.createCluster(clusterName, 1, 1)
+
+	_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, machines[0].Metadata().ID()).Metadata(),
+		func(config *omni.ClusterMachineConfigPatches) error {
+			config.TypedSpec().Value.Patches = append(config.TypedSpec().Value.Patches, `machine:
+  network:
+    hostname: patched-node`)
+
+			return nil
+		},
+	)
+
+	suite.Require().NoError(err)
+
+	for i, m := range machines {
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachineConfig(resources.DefaultNamespace, m.Metadata().ID()).Metadata(),
+			func(cfg *omni.ClusterMachineConfig, assertions *assert.Assertions) {
+				var machineconfig config.Provider
+
+				machineconfig, err = configloader.NewFromBytes(cfg.TypedSpec().Value.Data)
+				suite.Require().NoError(err)
+
+				expectedType := machine.TypeWorker
+				if _, ok := m.Metadata().Labels().Get(omni.LabelControlPlaneRole); ok {
+					expectedType = machine.TypeControlPlane
+				}
+
+				assertions.Equal(expectedType, machineconfig.Machine().Type())
+
+				var disk string
+
+				disk, err = machineconfig.Machine().Install().Disk()
+				assertions.NoError(err)
+
+				var version string
+
+				version, err = omni.GetInstallImage(constants.TalosRegistry, constants.ImageFactoryBaseURL, defaultSchematic, cluster.TypedSpec().Value.TalosVersion)
+				assertions.NoError(err)
+
+				assertions.Equal(testInstallDisk, disk)
+				assertions.Equal(version, machineconfig.Machine().Install().Image())
+
+				if i == 0 {
+					assertions.Equal(machineconfig.Machine().Network().Hostname(), "patched-node")
+				}
+			},
+		)
+	}
+
+	newImage := fmt.Sprintf("%s:v1.0.2", conf.Config.TalosRegistry)
+
+	_, err = safe.StateUpdateWithConflicts(suite.ctx, suite.state, omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, machines[0].Metadata().ID()).Metadata(),
+		func(config *omni.ClusterMachineConfigPatches) error {
+			config.TypedSpec().Value.Patches = append(config.TypedSpec().Value.Patches, `machine:
+  install:
+    image: `+newImage)
+
+			return nil
+		},
+	)
+
+	suite.Require().NoError(err)
+
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewClusterMachineConfig(resources.DefaultNamespace, machines[0].Metadata().ID()).Metadata(),
+		func(res *omni.ClusterMachineConfig, assertions *assert.Assertions) {
+			spec := res.TypedSpec().Value
+
+			var machineconfig config.Provider
+
+			machineconfig, err = configloader.NewFromBytes(spec.Data)
+			suite.Require().NoError(err)
+
+			assertions.Equal(newImage, machineconfig.Machine().Install().Image())
+		},
+	)
+
+	suite.destroyCluster(cluster)
+
+	for _, m := range machines {
+		suite.Assert().NoError(retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+			suite.assertNoResource(*omni.NewClusterMachineConfig(resources.DefaultNamespace, m.Metadata().ID()).Metadata()),
+		))
+	}
+}
+
+func (suite *ClusterMachineConfigSuite) TestGenerationError() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewClusterController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewSecretsController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewMachineConfigGenOptionsController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosUpgradeStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterConfigVersionController()))
+
+	clusterName := "test-generation-error"
+
+	_, machines := suite.createCluster(clusterName, 1, 0)
+	suite.Require().Greater(len(machines), 0)
+
+	_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, machines[0].Metadata().ID()).Metadata(),
+		func(config *omni.ClusterMachineConfigPatches) error {
+			config.TypedSpec().Value.Patches = append(config.TypedSpec().Value.Patches, `machine:
+  network:
+    interfaces:
+      - interface: eth42
+        bridge: invalidValueType`)
+
+			return nil
+		},
+	)
+
+	suite.Require().NoError(err)
+
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewClusterMachineConfig(resources.DefaultNamespace, machines[0].Metadata().ID()).Metadata(),
+		func(cfg *omni.ClusterMachineConfig, _ *assert.Assertions) {
+			req := require.New(suite.T())
+
+			expectedError := "yaml: unmarshal errors"
+			req.Contains(cfg.TypedSpec().Value.GenerationError, expectedError, string(cfg.TypedSpec().Value.GetData()))
+			req.Empty(cfg.TypedSpec().Value.ClusterMachineVersion)
+		},
+	)
+}
+
+func TestClusterMachineConfigSuite(t *testing.T) {
+	suite.Run(t, new(ClusterMachineConfigSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_machine_encryption.go b/internal/backend/runtime/omni/controllers/omni/cluster_machine_encryption.go
new file mode 100644
index 000000000..db1dbc713
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_machine_encryption.go
@@ -0,0 +1,136 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"bytes"
+	"context"
+	_ "embed"
+	"fmt"
+	"text/template"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/siderolabs/gen/optional"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+)
+
+//go:embed data/kms-encryption-config-patch.yaml
+var encryptionConfigPatchData string
+
+// ClusterMachineEncryptionController manages disk encryption configuration for the cluster.
+type ClusterMachineEncryptionController struct{}
+
+// Name implements controller.Controller interface.
+func (*ClusterMachineEncryptionController) Name() string {
+	return "ClusterMachineEncryptionController"
+}
+
+// Inputs implements controller.Controller interface.
+func (*ClusterMachineEncryptionController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      siderolink.ConnectionParamsType,
+			ID:        optional.Some(siderolink.ConfigID),
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (*ClusterMachineEncryptionController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.ConfigPatchType,
+			Kind: controller.OutputShared,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *ClusterMachineEncryptionController) Run(ctx context.Context, r controller.Runtime, _ *zap.Logger) error {
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+		}
+
+		tracker := trackResource(r, resources.DefaultNamespace, omni.ConfigPatchType)
+		tracker.owner = ctrl.Name()
+
+		clusters, err := safe.ReaderListAll[*omni.Cluster](ctx, r)
+		if err != nil {
+			return err
+		}
+
+		params, err := safe.ReaderGet[*siderolink.ConnectionParams](ctx, r, siderolink.NewConnectionParams(resources.DefaultNamespace, siderolink.ConfigID).Metadata())
+		if err != nil {
+			return err
+		}
+
+		kmsEndpoint := params.TypedSpec().Value.ApiEndpoint
+
+		template, err := template.New("patch").Parse(encryptionConfigPatchData)
+		if err != nil {
+			return err
+		}
+
+		var buffer bytes.Buffer
+
+		if err = template.Execute(&buffer, struct {
+			KmsEndpoint string
+		}{
+			KmsEndpoint: kmsEndpoint,
+		}); err != nil {
+			return err
+		}
+
+		data := buffer.String()
+
+		err = clusters.ForEachErr(func(cluster *omni.Cluster) error {
+			if !omni.GetEncryptionEnabled(cluster) {
+				return nil
+			}
+
+			clusterName := cluster.Metadata().ID()
+
+			patch := omni.NewConfigPatch(resources.DefaultNamespace,
+				fmt.Sprintf("%s-%s-encryption", constants.EncryptionPatchPrefix, clusterName),
+			)
+
+			return safe.WriterModify[*omni.ConfigPatch](ctx, r, patch, func(r *omni.ConfigPatch) error {
+				r.TypedSpec().Value.Data = data
+				r.Metadata().Annotations().Set(omni.ConfigPatchName, constants.EncryptionConfigName)
+				r.Metadata().Annotations().Set(omni.ConfigPatchDescription, constants.EncryptionConfigDescription)
+				r.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+				r.Metadata().Labels().Set(omni.LabelSystemPatch, "")
+
+				tracker.keep(r)
+
+				return nil
+			})
+		})
+		if err != nil {
+			return err
+		}
+
+		if err = tracker.cleanup(ctx); err != nil {
+			return err
+		}
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_machine_encryption_key.go b/internal/backend/runtime/omni/controllers/omni/cluster_machine_encryption_key.go
new file mode 100644
index 000000000..4995f1b3e
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_machine_encryption_key.go
@@ -0,0 +1,58 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"crypto/rand"
+	"io"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// ClusterMachineEncryptionKeyController reflects the status of a machine that is a member of a cluster.
+type ClusterMachineEncryptionKeyController = qtransform.QController[*omni.ClusterMachine, *omni.ClusterMachineEncryptionKey]
+
+// ClusterMachineEncryptionKeyControllerName is the name of the ClusterMachineEncryptionKeyController.
+const ClusterMachineEncryptionKeyControllerName = "ClusterMachineEncryptionKeyController"
+
+// NewClusterMachineEncryptionKeyController initializes ClusterMachineEncryptionKeyController.
+func NewClusterMachineEncryptionKeyController() *ClusterMachineEncryptionKeyController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.ClusterMachine, *omni.ClusterMachineEncryptionKey]{
+			Name: ClusterMachineEncryptionKeyControllerName,
+			MapMetadataFunc: func(clusterMachine *omni.ClusterMachine) *omni.ClusterMachineEncryptionKey {
+				return omni.NewClusterMachineEncryptionKey(resources.DefaultNamespace, clusterMachine.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(clusterMachineEncryptionKey *omni.ClusterMachineEncryptionKey) *omni.ClusterMachine {
+				return omni.NewClusterMachine(resources.DefaultNamespace, clusterMachineEncryptionKey.Metadata().ID())
+			},
+			TransformFunc: func(_ context.Context, _ controller.Reader, _ *zap.Logger, _ *omni.ClusterMachine, clusterMachineEncryptionKey *omni.ClusterMachineEncryptionKey) error {
+				if clusterMachineEncryptionKey.TypedSpec().Value.Data != nil {
+					return nil
+				}
+
+				key := make([]byte, 32)
+				if _, err := io.ReadFull(rand.Reader, key); err != nil {
+					return err
+				}
+
+				clusterMachineEncryptionKey.TypedSpec().Value.Data = key
+
+				return nil
+			},
+			FinalizerRemovalFunc: func(context.Context, controller.Reader, *zap.Logger, *omni.ClusterMachine) error {
+				return nil
+			},
+		},
+		qtransform.WithIgnoreTeardownUntil(), // delete the resource only when every other controller is done with ClusterMachine
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_machine_identity.go b/internal/backend/runtime/omni/controllers/omni/cluster_machine_identity.go
new file mode 100644
index 000000000..4c048bf77
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_machine_identity.go
@@ -0,0 +1,182 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/task"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/task/clustermachine"
+)
+
+// ClusterMachineIdentityController manages ClusterMachineIdentity resource lifecycle.
+type ClusterMachineIdentityController struct {
+	runner *task.Runner[clustermachine.IdentityCollectorChan, clustermachine.IdentityCollectorTaskSpec]
+}
+
+// Name implements controller.Controller interface.
+func (ctrl *ClusterMachineIdentityController) Name() string {
+	return "ClusterMachineIdentityController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *ClusterMachineIdentityController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterMachineType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.MachineType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.TalosConfigType,
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *ClusterMachineIdentityController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.ClusterMachineIdentityType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *ClusterMachineIdentityController) Run(ctx context.Context, r controller.Runtime, logger *zap.Logger) error {
+	notifyCh := make(chan *omni.ClusterMachineIdentity)
+
+	ctrl.runner = task.NewEqualRunner[clustermachine.IdentityCollectorTaskSpec]()
+	defer ctrl.runner.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case clusterMachineIdentity := <-notifyCh:
+			err := safe.WriterModify(ctx, r, clusterMachineIdentity, func(res *omni.ClusterMachineIdentity) error {
+				CopyAllLabels(clusterMachineIdentity, res)
+
+				spec := clusterMachineIdentity.TypedSpec().Value
+				if spec.EtcdMemberId != 0 {
+					res.TypedSpec().Value.EtcdMemberId = spec.EtcdMemberId
+				}
+
+				if spec.NodeIdentity != "" {
+					res.TypedSpec().Value.NodeIdentity = spec.NodeIdentity
+				}
+
+				if spec.Nodename != "" {
+					res.TypedSpec().Value.Nodename = spec.Nodename
+				}
+
+				if spec.NodeIps != nil {
+					res.TypedSpec().Value.NodeIps = spec.NodeIps
+				}
+
+				return nil
+			})
+			if err != nil {
+				return err
+			}
+		case <-r.EventCh():
+			if err := ctrl.reconcileCollectors(ctx, r, logger, notifyCh); err != nil {
+				return err
+			}
+		}
+
+		r.ResetRestartBackoff()
+	}
+}
+
+func (ctrl *ClusterMachineIdentityController) reconcileCollectors(ctx context.Context, r controller.Runtime, logger *zap.Logger, notifyCh clustermachine.IdentityCollectorChan) error {
+	list, err := safe.ReaderListAll[*omni.ClusterMachine](ctx, r)
+	if err != nil {
+		return err
+	}
+
+	tracker := trackResource(r, resources.DefaultNamespace, omni.ClusterMachineIdentityType)
+
+	expectedCollectors := map[string]clustermachine.IdentityCollectorTaskSpec{}
+
+	for iter := list.Iterator(); iter.Next(); {
+		clusterMachine := iter.Value()
+
+		tracker.keep(clusterMachine)
+
+		if clusterMachine.Metadata().Phase() == resource.PhaseTearingDown {
+			// skip machines being torn down
+			continue
+		}
+
+		id := clusterMachine.Metadata().ID()
+
+		clusterName, ok := clusterMachine.Metadata().Labels().Get(omni.LabelCluster)
+		if !ok {
+			return fmt.Errorf("failed to determine the cluster of the cluster machine %s", id)
+		}
+
+		machine, err := safe.ReaderGet[*omni.Machine](ctx, r,
+			omni.NewMachine(resources.DefaultNamespace, id).Metadata(),
+		)
+		if err != nil {
+			if state.IsNotFoundError(err) {
+				continue
+			}
+
+			return err
+		}
+
+		if !machine.TypedSpec().Value.Connected {
+			// skip machines which are not connected
+			continue
+		}
+
+		talosConfig, err := safe.ReaderGet[*omni.TalosConfig](ctx, r, resource.NewMetadata(
+			resources.DefaultNamespace,
+			omni.TalosConfigType,
+			clusterName,
+			resource.VersionUndefined,
+		))
+		if err != nil {
+			return err
+		}
+
+		config := omni.NewTalosClientConfig(talosConfig)
+
+		_, isControlPlane := clusterMachine.Metadata().Labels().Get(omni.LabelControlPlaneRole)
+
+		expectedCollectors[id] = clustermachine.NewIdentityCollectorTaskSpec(
+			id,
+			config,
+			talosConfig.Metadata().Version(),
+			machine.TypedSpec().Value.ManagementAddress,
+			isControlPlane,
+			clusterName,
+		)
+	}
+
+	ctrl.runner.Reconcile(ctx, logger, expectedCollectors, notifyCh)
+
+	return tracker.cleanup(ctx)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_machine_status.go b/internal/backend/runtime/omni/controllers/omni/cluster_machine_status.go
new file mode 100644
index 000000000..ebcc9d479
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_machine_status.go
@@ -0,0 +1,229 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	machineapi "github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// ClusterMachineStatusController reflects the status of a machine that is a member of a cluster.
+type ClusterMachineStatusController = qtransform.QController[*omni.ClusterMachine, *omni.ClusterMachineStatus]
+
+// NewClusterMachineStatusController initializes ClusterMachineStatusController.
+//
+//nolint:gocognit,gocyclo,cyclop,maintidx
+func NewClusterMachineStatusController() *ClusterMachineStatusController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.ClusterMachine, *omni.ClusterMachineStatus]{
+			Name: "ClusterMachineStatusController",
+			MapMetadataFunc: func(clusterMachine *omni.ClusterMachine) *omni.ClusterMachineStatus {
+				return omni.NewClusterMachineStatus(resources.DefaultNamespace, clusterMachine.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(clusterMachineStatus *omni.ClusterMachineStatus) *omni.ClusterMachine {
+				return omni.NewClusterMachine(resources.DefaultNamespace, clusterMachineStatus.Metadata().ID())
+			},
+			TransformFunc: func(ctx context.Context, r controller.Reader, _ *zap.Logger, clusterMachine *omni.ClusterMachine, clusterMachineStatus *omni.ClusterMachineStatus) error {
+				machine, err := safe.ReaderGet[*omni.Machine](ctx, r, resource.NewMetadata(resources.DefaultNamespace, omni.MachineType, clusterMachine.Metadata().ID(), resource.VersionUndefined))
+				if err != nil {
+					return err
+				}
+
+				CopyLabels(clusterMachine, clusterMachineStatus,
+					omni.LabelCluster,
+					omni.LabelControlPlaneRole,
+					omni.LabelWorkerRole,
+					omni.LabelMachineSet,
+				)
+
+				if machine.TypedSpec().Value.Connected {
+					clusterMachineStatus.Metadata().Labels().Set(omni.MachineStatusLabelConnected, "")
+				} else {
+					clusterMachineStatus.Metadata().Labels().Delete(omni.MachineStatusLabelConnected)
+				}
+
+				cmsVal := clusterMachineStatus.TypedSpec().Value
+
+				machineStatus, err := safe.ReaderGet[*omni.MachineStatus](
+					ctx, r,
+					resource.NewMetadata(resources.DefaultNamespace, omni.MachineStatusType, clusterMachine.Metadata().ID(), resource.VersionUndefined),
+				)
+				if err != nil {
+					if state.IsNotFoundError(err) { // ignore, as another reconciliation will be triggered once it appears
+						cmsVal.Stage = specs.ClusterMachineStatusSpec_UNKNOWN
+						cmsVal.ApidAvailable = false
+						cmsVal.Ready = false
+
+						return nil
+					}
+
+					return err
+				}
+
+				machineSetNode, err := r.Get(ctx, resource.NewMetadata(resources.DefaultNamespace, omni.MachineSetNodeType, clusterMachine.Metadata().ID(), resource.VersionUndefined))
+				if err != nil && !state.IsNotFoundError(err) {
+					return err
+				}
+
+				var locked bool
+				if machineSetNode != nil {
+					_, locked = machineSetNode.Metadata().Annotations().Get(omni.MachineLocked)
+				}
+
+				if locked {
+					clusterMachineStatus.Metadata().Annotations().Set(omni.MachineLocked, "")
+				} else {
+					clusterMachineStatus.Metadata().Annotations().Delete(omni.MachineLocked)
+				}
+
+				if machineStatus.TypedSpec().Value.Network != nil {
+					clusterMachineStatus.Metadata().Labels().Set(omni.LabelHostname, machineStatus.TypedSpec().Value.Network.Hostname)
+				}
+
+				cmsVal.ManagementAddress = machineStatus.TypedSpec().Value.ManagementAddress
+
+				statusSnapshot, err := safe.ReaderGet[*omni.MachineStatusSnapshot](
+					ctx, r,
+					resource.NewMetadata(resources.DefaultNamespace, omni.MachineStatusSnapshotType, clusterMachine.Metadata().ID(), resource.VersionUndefined),
+				)
+				if err != nil {
+					if state.IsNotFoundError(err) {
+						cmsVal.Stage = specs.ClusterMachineStatusSpec_UNKNOWN
+						cmsVal.ApidAvailable = false
+						cmsVal.Ready = false
+
+						return nil
+					}
+
+					return err
+				}
+
+				clusterMachineConfigStatus, err := safe.ReaderGet[*omni.ClusterMachineConfigStatus](
+					ctx,
+					r,
+					omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, clusterMachineStatus.Metadata().ID()).Metadata(),
+				)
+				if err != nil {
+					if !state.IsNotFoundError(err) {
+						return err
+					}
+				}
+
+				if clusterMachineConfigStatus != nil {
+					cmsVal.ConfigUpToDate = !isOutdated(clusterMachine, clusterMachineConfigStatus)
+					cmsVal.LastConfigError = clusterMachineConfigStatus.TypedSpec().Value.LastConfigError
+				} else {
+					cmsVal.ConfigUpToDate = false
+					cmsVal.LastConfigError = ""
+				}
+
+				cmsVal.ConfigApplyStatus = configApplyStatus(cmsVal)
+
+				status := statusSnapshot.TypedSpec().Value.GetMachineStatus()
+
+				cmsVal.ApidAvailable = false
+
+				_, isControlPlaneNode := clusterMachineStatus.Metadata().Labels().Get(omni.LabelControlPlaneRole)
+				if (status.GetStage() == machineapi.MachineStatusEvent_BOOTING || status.GetStage() == machineapi.MachineStatusEvent_RUNNING) && isControlPlaneNode {
+					cmsVal.ApidAvailable = machine.TypedSpec().Value.Connected
+				}
+
+				cmsVal.Ready = status.GetStatus().GetReady() && machine.TypedSpec().Value.Connected
+
+				if clusterMachine.Metadata().Phase() == resource.PhaseTearingDown {
+					cmsVal.Stage = specs.ClusterMachineStatusSpec_DESTROYING
+
+					return nil
+				}
+
+				if machineSetNode == nil {
+					cmsVal.Stage = specs.ClusterMachineStatusSpec_BEFORE_DESTROY
+
+					return nil
+				}
+
+				switch status.GetStage() {
+				case machineapi.MachineStatusEvent_UNKNOWN:
+					cmsVal.Stage = specs.ClusterMachineStatusSpec_UNKNOWN
+				case machineapi.MachineStatusEvent_RESETTING:
+					cmsVal.Stage = specs.ClusterMachineStatusSpec_DESTROYING
+				case machineapi.MachineStatusEvent_INSTALLING:
+					cmsVal.Stage = specs.ClusterMachineStatusSpec_INSTALLING
+				case machineapi.MachineStatusEvent_UPGRADING:
+					cmsVal.Stage = specs.ClusterMachineStatusSpec_UPGRADING
+				case machineapi.MachineStatusEvent_REBOOTING:
+					cmsVal.Stage = specs.ClusterMachineStatusSpec_REBOOTING
+				case machineapi.MachineStatusEvent_SHUTTING_DOWN:
+					cmsVal.Stage = specs.ClusterMachineStatusSpec_SHUTTING_DOWN
+				case machineapi.MachineStatusEvent_BOOTING:
+					cmsVal.Stage = specs.ClusterMachineStatusSpec_BOOTING
+				case machineapi.MachineStatusEvent_RUNNING:
+					cmsVal.Stage = specs.ClusterMachineStatusSpec_RUNNING
+				case machineapi.MachineStatusEvent_MAINTENANCE:
+					// shouldn't happen as machine config should be submitted
+					cmsVal.Stage = specs.ClusterMachineStatusSpec_UNKNOWN
+				}
+
+				clusterMachineIdentity, err := safe.ReaderGet[*omni.ClusterMachineIdentity](ctx, r, omni.NewClusterMachineIdentity(
+					resources.DefaultNamespace,
+					clusterMachineStatus.Metadata().ID(),
+				).Metadata())
+				if err != nil && !state.IsNotFoundError(err) {
+					return err
+				}
+
+				if clusterMachineIdentity != nil {
+					clusterMachineStatus.Metadata().Labels().Set(omni.ClusterMachineStatusLabelNodeName, clusterMachineIdentity.TypedSpec().Value.Nodename)
+				}
+
+				return nil
+			},
+		},
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.MachineStatusSnapshot, *omni.ClusterMachine](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.Machine, *omni.ClusterMachine](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.MachineStatus, *omni.ClusterMachine](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.ClusterMachineConfigStatus, *omni.ClusterMachine](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.ClusterMachineIdentity, *omni.ClusterMachine](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.MachineSetNode, *omni.ClusterMachine](),
+		),
+		qtransform.WithIgnoreTeardownUntil(ClusterMachineEncryptionKeyControllerName), // destroy the ClusterMachineStatus after the ClusterMachineEncryptionKey is destroyed
+		qtransform.WithConcurrency(2),
+	)
+}
+
+// configApplyStatus returns the config apply status for the given cluster machine status spec.
+func configApplyStatus(spec *specs.ClusterMachineStatusSpec) specs.ConfigApplyStatus {
+	switch {
+	case spec.ConfigUpToDate:
+		return specs.ConfigApplyStatus_APPLIED
+	case spec.LastConfigError == "":
+		return specs.ConfigApplyStatus_PENDING
+	default:
+		return specs.ConfigApplyStatus_FAILED
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_machine_status_metrics.go b/internal/backend/runtime/omni/controllers/omni/cluster_machine_status_metrics.go
new file mode 100644
index 000000000..311ad8d99
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_machine_status_metrics.go
@@ -0,0 +1,120 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/prometheus/client_golang/prometheus"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// ClusterMachineStatusMetricsController publishes metrics on cluster machines.
+//
+//nolint:govet
+type ClusterMachineStatusMetricsController struct {
+	metricsOnce       sync.Once
+	metricNumMachines *prometheus.GaugeVec
+}
+
+// Name implements controller.Controller interface.
+func (ctrl *ClusterMachineStatusMetricsController) Name() string {
+	return "ClusterMachineStatusMetricsController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *ClusterMachineStatusMetricsController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterMachineStatusType,
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *ClusterMachineStatusMetricsController) Outputs() []controller.Output {
+	return nil
+}
+
+func (ctrl *ClusterMachineStatusMetricsController) initMetrics() {
+	ctrl.metricsOnce.Do(func() {
+		ctrl.metricNumMachines = prometheus.NewGaugeVec(prometheus.GaugeOpts{
+			Name: "omni_cluster_machines",
+			Help: "Number of cluster machines by status in the instance.",
+		},
+			[]string{"stage"})
+	})
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *ClusterMachineStatusMetricsController) Run(ctx context.Context, r controller.Runtime, _ *zap.Logger) error {
+	ctrl.initMetrics()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+		}
+
+		clusterMachineStatusList, err := safe.ReaderListAll[*omni.ClusterMachineStatus](ctx, r)
+		if err != nil {
+			return err
+		}
+
+		// it is important to enumerate here all status values, as otherwise metric might not be cleared properly
+		// when there are no clusters in a given status
+		clusterMachinesByStatus := map[specs.ClusterMachineStatusSpec_Stage]int{
+			specs.ClusterMachineStatusSpec_UNKNOWN:       0,
+			specs.ClusterMachineStatusSpec_BOOTING:       0,
+			specs.ClusterMachineStatusSpec_INSTALLING:    0,
+			specs.ClusterMachineStatusSpec_UPGRADING:     0,
+			specs.ClusterMachineStatusSpec_CONFIGURING:   0,
+			specs.ClusterMachineStatusSpec_RUNNING:       0,
+			specs.ClusterMachineStatusSpec_REBOOTING:     0,
+			specs.ClusterMachineStatusSpec_SHUTTING_DOWN: 0,
+			specs.ClusterMachineStatusSpec_DESTROYING:    0,
+		}
+
+		for iter := clusterMachineStatusList.Iterator(); iter.Next(); {
+			clusterMachinesByStatus[iter.Value().TypedSpec().Value.Stage]++
+		}
+
+		for status, num := range clusterMachinesByStatus {
+			ctrl.metricNumMachines.WithLabelValues(status.String()).Set(float64(num))
+		}
+
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-time.After(10 * time.Second): // don't reconcile too often, as metrics are not scraped that often
+		}
+	}
+}
+
+// Describe implements prom.Collector interface.
+func (ctrl *ClusterMachineStatusMetricsController) Describe(ch chan<- *prometheus.Desc) {
+	prometheus.DescribeByCollect(ctrl, ch)
+}
+
+// Collect implements prom.Collector interface.
+func (ctrl *ClusterMachineStatusMetricsController) Collect(ch chan<- prometheus.Metric) {
+	ctrl.initMetrics()
+
+	ctrl.metricNumMachines.Collect(ch)
+}
+
+var _ prometheus.Collector = &ClusterMachineStatusMetricsController{}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_machine_status_test.go b/internal/backend/runtime/omni/controllers/omni/cluster_machine_status_test.go
new file mode 100644
index 000000000..34a6078d2
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_machine_status_test.go
@@ -0,0 +1,223 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/siderolabs/go-retry/retry"
+	machineapi "github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type ClusterMachineStatusSuite struct {
+	OmniSuite
+}
+
+func (suite *ClusterMachineStatusSuite) setup() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineStatusController()))
+}
+
+func (suite *ClusterMachineStatusSuite) TestNoMachineStatusSnapShotClusterStatusZeroValue() {
+	suite.setup()
+
+	// given
+	testID := "testID"
+	machine := omni.NewMachine(resources.DefaultNamespace, testID)
+	machineStatus := omni.NewMachineStatus(resources.DefaultNamespace, testID)
+	clusterMachine := omni.NewClusterMachine(resources.DefaultNamespace, testID)
+
+	// when
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machine))
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machineStatus))
+	suite.Assert().NoError(suite.state.Create(suite.ctx, clusterMachine))
+
+	// then
+	suite.assertStage(specs.ClusterMachineStatusSpec_UNKNOWN, false, false)
+}
+
+func (suite *ClusterMachineStatusSuite) TestApplyConfigErrorPropagation() {
+	suite.setupStageTest(&machineapi.MachineStatusEvent{Stage: machineapi.MachineStatusEvent_RUNNING}, true, false)
+
+	md := omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, testID).Metadata()
+	_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, md, func(s *omni.ClusterMachineConfigStatus) error {
+		s.TypedSpec().Value.LastConfigError = "TestApplyConfigErrorPropagation error"
+
+		return nil
+	})
+	suite.Require().NoError(err)
+
+	clusterMachineStatus := omni.NewClusterMachineStatus(resources.DefaultNamespace, testID)
+
+	err = retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).RetryWithContext(suite.ctx, func(ctx context.Context) error {
+		res, resErr := safe.StateGet[*omni.ClusterMachineStatus](ctx, suite.state, clusterMachineStatus.Metadata())
+		if resErr != nil {
+			return retry.ExpectedError(resErr)
+		}
+
+		if res.TypedSpec().Value.LastConfigError != "TestApplyConfigErrorPropagation error" {
+			return retry.ExpectedErrorf("error not set")
+		}
+
+		if res.TypedSpec().Value.ConfigUpToDate {
+			return retry.ExpectedErrorf("config is up to date")
+		}
+
+		if res.TypedSpec().Value.ConfigApplyStatus != specs.ConfigApplyStatus_FAILED {
+			return retry.ExpectedErrorf("config apply status is not failed")
+		}
+
+		return nil
+	})
+	suite.Assert().NoError(err)
+}
+
+func (suite *ClusterMachineStatusSuite) TestOutdatedConfig() {
+	suite.setupStageTest(&machineapi.MachineStatusEvent{Stage: machineapi.MachineStatusEvent_RUNNING}, true, false)
+
+	md := omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, testID).Metadata()
+	_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, md, func(s *omni.ClusterMachineConfigStatus) error {
+		s.TypedSpec().Value.ClusterMachineConfigVersion = "42"
+
+		return nil
+	})
+	suite.Require().NoError(err)
+
+	clusterMachineStatus := omni.NewClusterMachineStatus(resources.DefaultNamespace, testID)
+
+	err = retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).RetryWithContext(suite.ctx, func(ctx context.Context) error {
+		res, resErr := safe.StateGet[*omni.ClusterMachineStatus](ctx, suite.state, clusterMachineStatus.Metadata())
+		if resErr != nil {
+			return retry.ExpectedError(resErr)
+		}
+
+		if res.TypedSpec().Value.ConfigUpToDate {
+			return retry.ExpectedErrorf("config is up to date")
+		}
+
+		if res.TypedSpec().Value.ConfigApplyStatus != specs.ConfigApplyStatus_PENDING {
+			return retry.ExpectedErrorf("config apply status is not pending")
+		}
+
+		return nil
+	})
+	suite.Assert().NoError(err)
+}
+
+func (suite *ClusterMachineStatusSuite) setupStageTest(machineStatusEvent *machineapi.MachineStatusEvent, connected, isControlPlaneNode bool) {
+	suite.setup()
+
+	testID := "testID"
+
+	machine := omni.NewMachine(resources.DefaultNamespace, testID)
+	machine.TypedSpec().Value.Connected = connected
+	machineStatus := omni.NewMachineStatus(resources.DefaultNamespace, testID)
+
+	clusterMachine := omni.NewClusterMachine(resources.DefaultNamespace, testID)
+
+	statusSnapshot := omni.NewMachineStatusSnapshot(resources.DefaultNamespace, testID)
+	statusSnapshot.TypedSpec().Value.MachineStatus = machineStatusEvent
+
+	clusterMachineConfigStatus := omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, testID)
+
+	if isControlPlaneNode {
+		clusterMachine.Metadata().Labels().Set(omni.LabelControlPlaneRole, "")
+	}
+
+	machineSetNode := omni.NewMachineSetNode(resources.DefaultNamespace, testID, omni.NewMachineSet(resources.DefaultNamespace, "ms"))
+
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machine))
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machineStatus))
+	suite.Assert().NoError(suite.state.Create(suite.ctx, clusterMachine))
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machineSetNode))
+	suite.Assert().NoError(suite.state.Create(suite.ctx, statusSnapshot))
+	suite.Assert().NoError(suite.state.Create(suite.ctx, clusterMachineConfigStatus))
+}
+
+func (suite *ClusterMachineStatusSuite) assertStage(expectedStage specs.ClusterMachineStatusSpec_Stage, expectedReadiness, expectedApidAvailable bool) {
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewClusterMachineStatus(resources.DefaultNamespace, "testID").Metadata(),
+		func(status *omni.ClusterMachineStatus, assertions *assert.Assertions) {
+			statusVal := status.TypedSpec().Value
+
+			assertions.Equal(expectedReadiness, statusVal.Ready)
+			assertions.Equal(expectedStage, statusVal.Stage)
+			assertions.Equal(expectedApidAvailable, statusVal.ApidAvailable)
+		})
+}
+
+func (suite *ClusterMachineStatusSuite) TestDestroying() {
+	suite.setupStageTest(&machineapi.MachineStatusEvent{Stage: machineapi.MachineStatusEvent_RESETTING}, true, false)
+
+	suite.assertStage(specs.ClusterMachineStatusSpec_DESTROYING, false, false)
+}
+
+func (suite *ClusterMachineStatusSuite) TestInstalling() {
+	suite.setupStageTest(&machineapi.MachineStatusEvent{Stage: machineapi.MachineStatusEvent_INSTALLING}, true, false)
+
+	suite.assertStage(specs.ClusterMachineStatusSpec_INSTALLING, false, false)
+}
+
+func (suite *ClusterMachineStatusSuite) TestBoot() {
+	suite.setupStageTest(&machineapi.MachineStatusEvent{Stage: machineapi.MachineStatusEvent_BOOTING}, true, false)
+
+	suite.assertStage(specs.ClusterMachineStatusSpec_BOOTING, false, false)
+}
+
+func (suite *ClusterMachineStatusSuite) TestReboot() {
+	suite.setupStageTest(&machineapi.MachineStatusEvent{Stage: machineapi.MachineStatusEvent_REBOOTING}, true, false)
+
+	suite.assertStage(specs.ClusterMachineStatusSpec_REBOOTING, false, false)
+}
+
+func (suite *ClusterMachineStatusSuite) TestRunning() {
+	suite.setupStageTest(&machineapi.MachineStatusEvent{
+		Stage:  machineapi.MachineStatusEvent_RUNNING,
+		Status: &machineapi.MachineStatusEvent_MachineStatus{Ready: true},
+	}, true, false)
+
+	suite.assertStage(specs.ClusterMachineStatusSpec_RUNNING, true, false)
+}
+
+func (suite *ClusterMachineStatusSuite) TestRunningNotConnected() {
+	suite.setupStageTest(&machineapi.MachineStatusEvent{
+		Stage:  machineapi.MachineStatusEvent_RUNNING,
+		Status: &machineapi.MachineStatusEvent_MachineStatus{Ready: true},
+	}, false, false)
+
+	suite.assertStage(specs.ClusterMachineStatusSpec_RUNNING, false, false)
+}
+
+func (suite *ClusterMachineStatusSuite) TestRunningNotReady() {
+	suite.setupStageTest(&machineapi.MachineStatusEvent{Stage: machineapi.MachineStatusEvent_RUNNING}, true, false)
+
+	suite.assertStage(specs.ClusterMachineStatusSpec_RUNNING, false, false)
+}
+
+func (suite *ClusterMachineStatusSuite) TestApidAvailable() {
+	suite.setupStageTest(&machineapi.MachineStatusEvent{
+		Stage:  machineapi.MachineStatusEvent_RUNNING,
+		Status: &machineapi.MachineStatusEvent_MachineStatus{Ready: true},
+	}, true, true)
+
+	suite.assertStage(specs.ClusterMachineStatusSpec_RUNNING, true, true)
+}
+
+func TestClusterMachineStatusSuite(t *testing.T) {
+	suite.Run(t, new(ClusterMachineStatusSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_status.go b/internal/backend/runtime/omni/controllers/omni/cluster_status.go
new file mode 100644
index 000000000..d1a5c0eb1
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_status.go
@@ -0,0 +1,154 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/mappers"
+)
+
+// ClusterStatusController manages ClusterStatus resource lifecycle.
+//
+// ClusterStatusController aggregates the cluster state based on the cluster machines states.
+type ClusterStatusController = qtransform.QController[*omni.Cluster, *omni.ClusterStatus]
+
+// NewClusterStatusController initializes ClusterStatusController.
+//
+//nolint:gocognit,gocyclo,cyclop
+func NewClusterStatusController() *ClusterStatusController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.Cluster, *omni.ClusterStatus]{
+			Name: "ClusterStatusController",
+			MapMetadataFunc: func(cluster *omni.Cluster) *omni.ClusterStatus {
+				return omni.NewClusterStatus(resources.DefaultNamespace, cluster.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(clusterStatus *omni.ClusterStatus) *omni.Cluster {
+				return omni.NewCluster(resources.DefaultNamespace, clusterStatus.Metadata().ID())
+			},
+			TransformFunc: func(ctx context.Context, r controller.Reader, _ *zap.Logger, cluster *omni.Cluster, clusterStatus *omni.ClusterStatus) error {
+				list, err := safe.ReaderListAll[*omni.MachineSetStatus](
+					ctx, r,
+					state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID())),
+				)
+				if err != nil {
+					return err
+				}
+
+				lbStatus, err := safe.ReaderGetByID[*omni.LoadBalancerStatus](ctx, r, cluster.Metadata().ID())
+				if err != nil && !state.IsNotFoundError(err) {
+					return err
+				}
+
+				cpStatusReady := false
+
+				clusterIsAvailable := false
+				cpMachineSetHealthy := false
+				allMachineSetsReady := true
+				clusterHasConnectedControlPlanes := false
+
+				machines := specs.Machines{}
+
+				phases := map[specs.MachineSetPhase]int{}
+
+				for iter := list.Iterator(); iter.Next(); {
+					machineSetStatus := iter.Value().TypedSpec().Value
+
+					machines.Total += machineSetStatus.GetMachines().GetTotal()
+					machines.Healthy += machineSetStatus.GetMachines().GetHealthy()
+
+					_, isControlPlane := iter.Value().Metadata().Labels().Get(omni.LabelControlPlaneRole)
+					if isControlPlane {
+						cpStatus, err := safe.ReaderGet[*omni.ControlPlaneStatus](
+							ctx, r,
+							resource.NewMetadata(resources.DefaultNamespace, omni.ControlPlaneStatusType, iter.Value().Metadata().ID(), resource.VersionUndefined),
+						)
+						if err != nil && !state.IsNotFoundError(err) {
+							return err
+						}
+
+						if cpStatus != nil && len(cpStatus.TypedSpec().Value.Conditions) > 0 {
+							cpStatusReady = true
+
+							for _, condition := range cpStatus.TypedSpec().Value.Conditions {
+								cpStatusReady = cpStatusReady && condition.Status == specs.ControlPlaneStatusSpec_Condition_Ready
+							}
+						}
+
+						if machineSetStatus.GetMachines().GetTotal() > 0 {
+							clusterIsAvailable = true
+						}
+
+						if machineSetStatus.Phase == specs.MachineSetPhase_Running && machineSetStatus.Ready {
+							cpMachineSetHealthy = true
+						}
+
+						if machineSetStatus.GetMachines().GetConnected() > 0 {
+							clusterHasConnectedControlPlanes = true
+						}
+					}
+
+					phases[machineSetStatus.Phase]++
+
+					allMachineSetsReady = allMachineSetsReady && machineSetStatus.Ready
+				}
+
+				phase := specs.ClusterStatusSpec_UNKNOWN
+
+				switch {
+				case cluster.Metadata().Phase() == resource.PhaseTearingDown:
+					phase = specs.ClusterStatusSpec_DESTROYING
+				case len(phases) == 1 && phases[specs.MachineSetPhase_Destroying] > 0:
+					// all destroying
+					phase = specs.ClusterStatusSpec_DESTROYING
+				case phases[specs.MachineSetPhase_ScalingUp] > 0:
+					// at least one scaling up
+					phase = specs.ClusterStatusSpec_SCALING_UP
+				case phases[specs.MachineSetPhase_ScalingDown] > 0 || phases[specs.MachineSetPhase_Destroying] > 0:
+					// at least one scaling down
+					phase = specs.ClusterStatusSpec_SCALING_DOWN
+				case phases[specs.MachineSetPhase_Running] > 0 || phases[specs.MachineSetPhase_Reconfiguring] > 0:
+					// some running/reconfiguration
+					phase = specs.ClusterStatusSpec_RUNNING
+				}
+
+				clusterStatus.TypedSpec().Value = &specs.ClusterStatusSpec{
+					Available:                 clusterIsAvailable,
+					Ready:                     allMachineSetsReady && phase == specs.ClusterStatusSpec_RUNNING,
+					KubernetesAPIReady:        lbStatus != nil && lbStatus.TypedSpec().Value.Healthy,
+					ControlplaneReady:         cpStatusReady && cpMachineSetHealthy,
+					Phase:                     phase,
+					Machines:                  &machines,
+					HasConnectedControlPlanes: clusterHasConnectedControlPlanes,
+				}
+
+				CopyUserLabels(clusterStatus, cluster.Metadata().Labels().Raw())
+
+				return nil
+			},
+		},
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.LoadBalancerStatus, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByClusterLabel[*omni.MachineSetStatus, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByClusterLabel[*omni.ControlPlaneStatus, *omni.Cluster](),
+		),
+		qtransform.WithIgnoreTeardownUntil(), // keep ClusterStatus alive until every other controller is done with Cluster
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_status_metrics.go b/internal/backend/runtime/omni/controllers/omni/cluster_status_metrics.go
new file mode 100644
index 000000000..be16fb58e
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_status_metrics.go
@@ -0,0 +1,116 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/prometheus/client_golang/prometheus"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// ClusterStatusMetricsController provides metrics based on ClusterStatus.
+//
+//nolint:govet
+type ClusterStatusMetricsController struct {
+	metricsOnce       sync.Once
+	metricNumClusters *prometheus.GaugeVec
+}
+
+// Name implements controller.Controller interface.
+func (ctrl *ClusterStatusMetricsController) Name() string {
+	return "ClusterStatusMetricsController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *ClusterStatusMetricsController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterStatusType,
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *ClusterStatusMetricsController) Outputs() []controller.Output {
+	return nil
+}
+
+func (ctrl *ClusterStatusMetricsController) initMetrics() {
+	ctrl.metricsOnce.Do(func() {
+		ctrl.metricNumClusters = prometheus.NewGaugeVec(prometheus.GaugeOpts{
+			Name: "omni_clusters",
+			Help: "Number of clusters by status in the instance.",
+		},
+			[]string{"phase"})
+	})
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *ClusterStatusMetricsController) Run(ctx context.Context, r controller.Runtime, _ *zap.Logger) error {
+	ctrl.initMetrics()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+		}
+
+		list, err := safe.ReaderListAll[*omni.ClusterStatus](ctx, r)
+		if err != nil {
+			return err
+		}
+
+		// it is important to enumerate here all status values, as otherwise metric might not be cleared properly
+		// when there are no clusters in a given status
+		clustersByStatus := map[specs.ClusterStatusSpec_Phase]int{
+			specs.ClusterStatusSpec_UNKNOWN:      0,
+			specs.ClusterStatusSpec_SCALING_UP:   0,
+			specs.ClusterStatusSpec_SCALING_DOWN: 0,
+			specs.ClusterStatusSpec_RUNNING:      0,
+			specs.ClusterStatusSpec_DESTROYING:   0,
+		}
+
+		for iter := list.Iterator(); iter.Next(); {
+			clustersByStatus[iter.Value().TypedSpec().Value.Phase]++
+		}
+
+		for status, num := range clustersByStatus {
+			ctrl.metricNumClusters.WithLabelValues(status.String()).Set(float64(num))
+		}
+
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-time.After(10 * time.Second): // don't reconcile too often, as metrics are not scraped that often
+		}
+	}
+}
+
+// Describe implements prom.Collector interface.
+func (ctrl *ClusterStatusMetricsController) Describe(ch chan<- *prometheus.Desc) {
+	prometheus.DescribeByCollect(ctrl, ch)
+}
+
+// Collect implements prom.Collector interface.
+func (ctrl *ClusterStatusMetricsController) Collect(ch chan<- prometheus.Metric) {
+	ctrl.initMetrics()
+
+	ctrl.metricNumClusters.Collect(ch)
+}
+
+var _ prometheus.Collector = &ClusterStatusMetricsController{}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_status_test.go b/internal/backend/runtime/omni/controllers/omni/cluster_status_test.go
new file mode 100644
index 000000000..a720769c5
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_status_test.go
@@ -0,0 +1,226 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type ClusterStatusSuite struct {
+	OmniSuite
+}
+
+func (suite *ClusterStatusSuite) TestReconcile() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterStatusController()))
+
+	for _, tt := range []struct { //nolint:govet
+		name             string
+		cpMachineSet     *specs.MachineSetStatusSpec
+		workerMachineSet *specs.MachineSetStatusSpec
+		cpStatus         *specs.ControlPlaneStatusSpec
+		lbStatus         *specs.LoadBalancerStatusSpec
+		expected         *specs.ClusterStatusSpec
+	}{
+		{
+			name: "no statuses",
+			expected: &specs.ClusterStatusSpec{
+				Available:          false,
+				Phase:              specs.ClusterStatusSpec_UNKNOWN,
+				Ready:              false,
+				ControlplaneReady:  false,
+				KubernetesAPIReady: false,
+				Machines: &specs.Machines{
+					Total:   0,
+					Healthy: 0,
+				},
+			},
+		},
+		{
+			name: "all healthy",
+			cpMachineSet: &specs.MachineSetStatusSpec{
+				Phase: specs.MachineSetPhase_Running,
+				Ready: true,
+				Machines: &specs.Machines{
+					Total:   3,
+					Healthy: 3,
+				},
+			},
+			workerMachineSet: &specs.MachineSetStatusSpec{
+				Phase: specs.MachineSetPhase_Running,
+				Ready: true,
+				Machines: &specs.Machines{
+					Total:   2,
+					Healthy: 2,
+				},
+			},
+			cpStatus: &specs.ControlPlaneStatusSpec{
+				Conditions: []*specs.ControlPlaneStatusSpec_Condition{
+					{
+						Type:   specs.ConditionType_Etcd,
+						Reason: "",
+						Status: specs.ControlPlaneStatusSpec_Condition_Ready,
+					},
+				},
+			},
+			lbStatus: &specs.LoadBalancerStatusSpec{
+				Healthy: true,
+			},
+			expected: &specs.ClusterStatusSpec{
+				Available:          true,
+				Phase:              specs.ClusterStatusSpec_RUNNING,
+				Ready:              true,
+				ControlplaneReady:  true,
+				KubernetesAPIReady: true,
+				Machines: &specs.Machines{
+					Total:   5,
+					Healthy: 5,
+				},
+			},
+		},
+		{
+			name: "cp not healthy",
+			cpMachineSet: &specs.MachineSetStatusSpec{
+				Phase: specs.MachineSetPhase_Running,
+				Ready: true,
+				Machines: &specs.Machines{
+					Total:   3,
+					Healthy: 3,
+				},
+			},
+			workerMachineSet: &specs.MachineSetStatusSpec{
+				Phase: specs.MachineSetPhase_Running,
+				Ready: true,
+				Machines: &specs.Machines{
+					Total:   2,
+					Healthy: 2,
+				},
+			},
+			cpStatus: &specs.ControlPlaneStatusSpec{
+				Conditions: []*specs.ControlPlaneStatusSpec_Condition{
+					{
+						Type:   specs.ConditionType_Etcd,
+						Reason: "",
+						Status: specs.ControlPlaneStatusSpec_Condition_NotReady,
+					},
+				},
+			},
+			lbStatus: &specs.LoadBalancerStatusSpec{
+				Healthy: false,
+			},
+			expected: &specs.ClusterStatusSpec{
+				Available:          true,
+				Phase:              specs.ClusterStatusSpec_RUNNING,
+				Ready:              true,
+				ControlplaneReady:  false,
+				KubernetesAPIReady: false,
+				Machines: &specs.Machines{
+					Total:   5,
+					Healthy: 5,
+				},
+			},
+		},
+		{
+			name: "scaling up",
+			cpMachineSet: &specs.MachineSetStatusSpec{
+				Phase: specs.MachineSetPhase_ScalingUp,
+				Ready: false,
+				Machines: &specs.Machines{
+					Total:   2,
+					Healthy: 1,
+				},
+			},
+			cpStatus: &specs.ControlPlaneStatusSpec{},
+			lbStatus: &specs.LoadBalancerStatusSpec{
+				Healthy: true,
+			},
+			expected: &specs.ClusterStatusSpec{
+				Available:          true,
+				Phase:              specs.ClusterStatusSpec_SCALING_UP,
+				Ready:              false,
+				ControlplaneReady:  false,
+				KubernetesAPIReady: true,
+				Machines: &specs.Machines{
+					Total:   2,
+					Healthy: 1,
+				},
+			},
+		},
+	} {
+		suite.Run(tt.name, func() {
+			ctx, cancel := context.WithTimeout(suite.ctx, 5*time.Second)
+			defer cancel()
+
+			clusterName := tt.name
+			cluster, _ := suite.createCluster(clusterName, 3, 0)
+
+			if tt.cpMachineSet != nil {
+				machineSetStatus := omni.NewMachineSetStatus(resources.DefaultNamespace, clusterName+"-cp")
+				machineSetStatus.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+				machineSetStatus.Metadata().Labels().Set(omni.LabelControlPlaneRole, "")
+
+				machineSetStatus.TypedSpec().Value = tt.cpMachineSet
+
+				suite.Require().NoError(suite.state.Create(ctx, machineSetStatus))
+			}
+
+			if tt.workerMachineSet != nil {
+				machineSetStatus := omni.NewMachineSetStatus(resources.DefaultNamespace, omni.WorkersResourceID(clusterName))
+				machineSetStatus.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+				machineSetStatus.Metadata().Labels().Set(omni.LabelWorkerRole, "")
+
+				machineSetStatus.TypedSpec().Value = tt.workerMachineSet
+
+				suite.Require().NoError(suite.state.Create(ctx, machineSetStatus))
+			}
+
+			if tt.cpStatus != nil {
+				cpStatus := omni.NewControlPlaneStatus(resources.DefaultNamespace, clusterName+"-cp")
+				cpStatus.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+				cpStatus.TypedSpec().Value = tt.cpStatus
+
+				suite.Require().NoError(suite.state.Create(ctx, cpStatus))
+			}
+
+			if tt.lbStatus != nil {
+				lbStatus := omni.NewLoadBalancerStatus(resources.DefaultNamespace, clusterName)
+				lbStatus.TypedSpec().Value = tt.lbStatus
+
+				suite.Require().NoError(suite.state.Create(ctx, lbStatus))
+			}
+
+			rtestutils.AssertResources(ctx, suite.T(), suite.state, []resource.ID{clusterName},
+				func(status *omni.ClusterStatus, assert *assert.Assertions) {
+					assert.Equal(status.TypedSpec().Value.Available, tt.expected.Available)
+					assert.Equal(status.TypedSpec().Value.Phase, tt.expected.Phase)
+					assert.Equal(status.TypedSpec().Value.ControlplaneReady, tt.expected.ControlplaneReady)
+					assert.Equal(status.TypedSpec().Value.KubernetesAPIReady, tt.expected.KubernetesAPIReady)
+					assert.Equal(status.TypedSpec().Value.Machines, tt.expected.Machines)
+				})
+
+			suite.destroyCluster(cluster)
+
+			rtestutils.AssertNoResource[*omni.ClusterStatus](ctx, suite.T(), suite.state, clusterName)
+		})
+	}
+}
+
+func TestClusterStatusSuite(t *testing.T) {
+	suite.Run(t, new(ClusterStatusSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_test.go b/internal/backend/runtime/omni/controllers/omni/cluster_test.go
new file mode 100644
index 000000000..8b12793e3
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_test.go
@@ -0,0 +1,86 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type ClusterSuite struct {
+	OmniSuite
+}
+
+func (suite *ClusterSuite) TestReconcile() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewClusterController()))
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewMachineSetController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterConfigVersionController()))
+
+	clusterName := "talos-default-1"
+
+	cluster := omni.NewCluster(resources.DefaultNamespace, clusterName)
+
+	machines := make([]*omni.ClusterMachine, 10)
+
+	for i := range machines {
+		machine := omni.NewClusterMachine(
+			resources.DefaultNamespace,
+			fmt.Sprintf("node-%d", i),
+		)
+
+		machine.Metadata().Labels().Set(omni.LabelControlPlaneRole, "")
+		machine.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+
+		machines[i] = machine
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, machine))
+	}
+
+	suite.Assert().NoError(suite.state.Create(suite.ctx, cluster))
+
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewCluster(resources.DefaultNamespace, cluster.Metadata().ID()).Metadata(),
+		func(res *omni.Cluster, assertions *assert.Assertions) {
+			assertions.False(res.Metadata().Finalizers().Empty())
+		},
+	)
+
+	suite.Require().Error(suite.state.Destroy(suite.ctx, cluster.Metadata()))
+
+	for _, machine := range machines {
+		suite.Require().NoError(suite.state.Destroy(suite.ctx, machine.Metadata()))
+	}
+
+	suite.Assert().NoError(retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+		func() error {
+			canDestroy, err := suite.state.Teardown(suite.ctx, cluster.Metadata())
+			if err != nil {
+				return err
+			}
+
+			if !canDestroy {
+				return retry.ExpectedErrorf("the resource is not ready to be destroyed")
+			}
+
+			return retry.ExpectedError(suite.state.Destroy(suite.ctx, cluster.Metadata()))
+		}))
+}
+
+func TestClusterSuite(t *testing.T) {
+	suite.Run(t, new(ClusterSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_uuid.go b/internal/backend/runtime/omni/controllers/omni/cluster_uuid.go
new file mode 100644
index 000000000..474bed8e7
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_uuid.go
@@ -0,0 +1,59 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// ClusterUUIDController manages ClusterUUID resource lifecycle.
+//
+// ClusterUUIDController generates cluster UUID for every cluster.
+type ClusterUUIDController = qtransform.QController[*omni.Cluster, *omni.ClusterUUID]
+
+// NewClusterUUIDController initializes ClusterUUIDController.
+func NewClusterUUIDController() *ClusterUUIDController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.Cluster, *omni.ClusterUUID]{
+			Name: "ClusterUUIDController",
+			MapMetadataFunc: func(cluster *omni.Cluster) *omni.ClusterUUID {
+				return omni.NewClusterUUID(cluster.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(clusterUUID *omni.ClusterUUID) *omni.Cluster {
+				return omni.NewCluster(clusterUUID.Metadata().Namespace(), clusterUUID.Metadata().ID())
+			},
+			TransformFunc: func(_ context.Context, _ controller.Reader, _ *zap.Logger, cluster *omni.Cluster, clusterUUID *omni.ClusterUUID) error {
+				if clusterUUID.TypedSpec().Value.GetUuid() != "" {
+					if existingUUIDLabel, _ := clusterUUID.Metadata().Labels().Get(omni.LabelClusterUUID); existingUUIDLabel != clusterUUID.TypedSpec().Value.GetUuid() {
+						clusterUUID.Metadata().Labels().Set(omni.LabelClusterUUID, clusterUUID.TypedSpec().Value.GetUuid())
+					}
+
+					return nil
+				}
+
+				generatedUUUID, err := uuid.NewRandom()
+				if err != nil {
+					return fmt.Errorf("error generating cluster UUID for cluster '%s': %w", cluster.Metadata().ID(), err)
+				}
+
+				uuidStr := generatedUUUID.String()
+				clusterUUID.TypedSpec().Value.Uuid = uuidStr
+
+				clusterUUID.Metadata().Labels().Set(omni.LabelClusterUUID, uuidStr)
+
+				return nil
+			},
+		},
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_workload_proxy.go b/internal/backend/runtime/omni/controllers/omni/cluster_workload_proxy.go
new file mode 100644
index 000000000..66119d452
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_workload_proxy.go
@@ -0,0 +1,152 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	_ "embed"
+	"fmt"
+	"strings"
+	"text/template"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/hashicorp/go-multierror"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+//go:embed data/kube-service-exposer-config-patch.tmpl.yaml
+var kubeServiceExposerConfigPatchTemplate string
+
+// ClusterWorkloadProxyController is a controller that manages cluster workload proxy setting.
+type ClusterWorkloadProxyController struct {
+	configPatchData string
+}
+
+// Name returns the name of the controller.
+func (ctrl *ClusterWorkloadProxyController) Name() string {
+	return "ClusterWorkloadProxyController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *ClusterWorkloadProxyController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterType,
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *ClusterWorkloadProxyController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.ConfigPatchType,
+			Kind: controller.OutputShared,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *ClusterWorkloadProxyController) Run(ctx context.Context, r controller.Runtime, _ *zap.Logger) error {
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+		}
+
+		tracker := trackResource(r, resources.DefaultNamespace, omni.ConfigPatchType)
+
+		tracker.owner = ctrl.Name()
+
+		clusterList, err := safe.ReaderListAll[*omni.Cluster](ctx, r)
+		if err != nil {
+			return fmt.Errorf("failed to list clusters: %w", err)
+		}
+
+		configPatchData, err := ctrl.getConfigPatchData()
+		if err != nil {
+			return fmt.Errorf("failed to get config patch: %w", err)
+		}
+
+		var errs error
+
+		for iter := clusterList.Iterator(); iter.Next(); {
+			cluster := iter.Value()
+
+			id := fmt.Sprintf("950-cluster-%s-workload-proxying", cluster.Metadata().ID())
+
+			configPatch := omni.NewConfigPatch(resources.DefaultNamespace, id)
+
+			if !cluster.TypedSpec().Value.GetFeatures().GetEnableWorkloadProxy() {
+				if destroyErr := r.Destroy(ctx, configPatch.Metadata()); destroyErr != nil && !state.IsNotFoundError(destroyErr) {
+					errs = multierror.Append(errs, fmt.Errorf("failed to destroy config patch: %w", destroyErr))
+				}
+
+				continue
+			}
+
+			if modifyErr := safe.WriterModify(ctx, r, configPatch, func(patch *omni.ConfigPatch) error {
+				patch.Metadata().Labels().Set(omni.LabelCluster, cluster.Metadata().ID())
+				patch.Metadata().Labels().Set(omni.LabelSystemPatch, "")
+
+				patch.TypedSpec().Value.Data = configPatchData
+
+				return nil
+			}); modifyErr != nil {
+				errs = multierror.Append(errs, fmt.Errorf("failed to modify config patch: %w", modifyErr))
+			}
+
+			tracker.keep(configPatch)
+		}
+
+		if errs != nil {
+			return errs
+		}
+
+		if err = tracker.cleanup(ctx); err != nil {
+			return err
+		}
+
+		r.ResetRestartBackoff()
+	}
+}
+
+func (ctrl *ClusterWorkloadProxyController) getConfigPatchData() (string, error) {
+	if ctrl.configPatchData != "" {
+		return ctrl.configPatchData, nil
+	}
+
+	tmpl, err := template.New("kube-service-exposer-config-patch").Parse(kubeServiceExposerConfigPatchTemplate)
+	if err != nil {
+		return "", fmt.Errorf("failed to parse template: %w", err)
+	}
+
+	type tmplOptions struct {
+		AnnotationKey string
+	}
+
+	opts := tmplOptions{
+		AnnotationKey: ServicePortAnnotationKey,
+	}
+
+	var sb strings.Builder
+
+	if err = tmpl.Execute(&sb, opts); err != nil {
+		return "", fmt.Errorf("failed to execute template: %w", err)
+	}
+
+	ctrl.configPatchData = sb.String()
+
+	return ctrl.configPatchData, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/cluster_workload_proxy_test.go b/internal/backend/runtime/omni/controllers/omni/cluster_workload_proxy_test.go
new file mode 100644
index 000000000..f3ac2e111
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/cluster_workload_proxy_test.go
@@ -0,0 +1,58 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	_ "embed"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type ClusterWorkloadProxySuite struct {
+	OmniSuite
+}
+
+func (suite *ClusterWorkloadProxySuite) TestReconcile() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(&omnictrl.ClusterWorkloadProxyController{}))
+
+	clusterName := "cluster-workload-proxy-test"
+
+	cluster, _ := suite.createCluster(clusterName, 1, 1)
+
+	cluster.TypedSpec().Value.Features = &specs.ClusterSpec_Features{EnableWorkloadProxy: true}
+
+	suite.Require().NoError(suite.state.Update(suite.ctx, cluster))
+
+	configPatchID := fmt.Sprintf("950-cluster-%s-workload-proxying", cluster.Metadata().ID())
+
+	configPatch := omni.NewConfigPatch(resources.DefaultNamespace, configPatchID)
+
+	assertResource(&suite.OmniSuite, configPatch.Metadata(), func(res *omni.ConfigPatch, assertion *assert.Assertions) {
+		assertion.Contains(res.TypedSpec().Value.Data, "omni-kube-service-exposer")
+	})
+
+	cluster.TypedSpec().Value.GetFeatures().EnableWorkloadProxy = false
+
+	suite.Require().NoError(suite.state.Update(suite.ctx, cluster))
+
+	assertNoResource(&suite.OmniSuite, configPatch)
+
+	suite.destroyCluster(cluster)
+}
+
+func TestClusterWorkloadProxySuite(t *testing.T) {
+	suite.Run(t, new(ClusterWorkloadProxySuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/control_plane_status.go b/internal/backend/runtime/omni/controllers/omni/control_plane_status.go
new file mode 100644
index 000000000..e0c192e72
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/control_plane_status.go
@@ -0,0 +1,147 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/xerrors"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/mappers"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/pkg/check"
+)
+
+// ControlPlaneStatusController creates ControlPlaneStatus resource for controlplane MachineSets.
+type ControlPlaneStatusController = qtransform.QController[*omni.MachineSet, *omni.ControlPlaneStatus]
+
+// ControlPlaneCheckTimeout is the timeout for the controlplane checks.
+const ControlPlaneCheckTimeout = 5 * time.Minute
+
+// NewControlPlaneStatusController initializes ControlPlaneStatusController.
+func NewControlPlaneStatusController() *ControlPlaneStatusController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.MachineSet, *omni.ControlPlaneStatus]{
+			Name: "ControlPlaneStatusController",
+			MapMetadataFunc: func(machineSet *omni.MachineSet) *omni.ControlPlaneStatus {
+				return omni.NewControlPlaneStatus(resources.DefaultNamespace, machineSet.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(cpStatus *omni.ControlPlaneStatus) *omni.MachineSet {
+				return omni.NewMachineSet(resources.DefaultNamespace, cpStatus.Metadata().ID())
+			},
+			TransformFunc: func(ctx context.Context, r controller.Reader, _ *zap.Logger, machineSet *omni.MachineSet, cpStatus *omni.ControlPlaneStatus) error {
+				if _, isControlplane := machineSet.Metadata().Labels().Get(omni.LabelControlPlaneRole); !isControlplane {
+					return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("not a controlplane machineset")
+				}
+
+				clusterName, ok := machineSet.Metadata().Labels().Get(omni.LabelCluster)
+				if !ok {
+					return fmt.Errorf("failed to get cluster name from the machine set %s", machineSet.Metadata().ID())
+				}
+
+				cpStatus.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+
+				spec := cpStatus.TypedSpec().Value
+
+				// set a timeout to run the checks
+				ctx, cancel := context.WithTimeout(ctx, ControlPlaneCheckTimeout)
+				defer cancel()
+
+				handlers := []struct {
+					check     func(context.Context, controller.Reader, string) error
+					condition specs.ConditionType
+				}{
+					{
+						condition: specs.ConditionType_WireguardConnection,
+						check:     check.Connection,
+					},
+					{
+						condition: specs.ConditionType_Etcd,
+						check:     check.Etcd,
+					},
+				}
+
+				var (
+					interruptReason string
+					interrupted     bool
+				)
+
+				for _, handler := range handlers {
+					if interrupted {
+						spec.SetCondition(
+							handler.condition,
+							specs.ControlPlaneStatusSpec_Condition_Unknown,
+							specs.ControlPlaneStatusSpec_Condition_Error,
+							interruptReason,
+						)
+
+						continue
+					}
+
+					err := handler.check(ctx, r, clusterName)
+					if err != nil {
+						var checkFail *check.Error
+
+						if errors.As(err, &checkFail) {
+							spec.SetCondition(handler.condition, checkFail.Status, checkFail.Severity, checkFail.Error())
+
+							interrupted = checkFail.Interrupt
+							interruptReason = fmt.Sprintf("The check wasn't run because the condition check %q has failed", handler.condition.String())
+
+							continue
+						}
+
+						return err
+					}
+
+					spec.SetCondition(handler.condition, specs.ControlPlaneStatusSpec_Condition_Ready, specs.ControlPlaneStatusSpec_Condition_Info, "")
+				}
+
+				return nil
+			},
+		},
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperNone[*omni.TalosConfig](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByMachineSetLabelOnlyControlplane[*omni.ClusterMachineStatus, *omni.MachineSet](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByMachineSetLabelOnlyControlplane[*omni.ClusterMachine, *omni.MachineSet](),
+		),
+		qtransform.WithExtraMappedInput(
+			func(ctx context.Context, _ *zap.Logger, r controller.QRuntime, etcdAuditResult *omni.EtcdAuditResult) ([]resource.Pointer, error) {
+				clusterName := etcdAuditResult.Metadata().ID()
+
+				items, err := safe.ReaderListAll[*omni.MachineSet](ctx, r,
+					state.WithLabelQuery(
+						resource.LabelEqual(omni.LabelCluster, clusterName),
+						resource.LabelExists(omni.LabelControlPlaneRole),
+					),
+				)
+				if err != nil {
+					return nil, err
+				}
+
+				return safe.Map(items, func(machineSet *omni.MachineSet) (resource.Pointer, error) {
+					return machineSet.Metadata(), nil
+				})
+			},
+		),
+		qtransform.WithConcurrency(4),
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/data/kms-encryption-config-patch.yaml b/internal/backend/runtime/omni/controllers/omni/data/kms-encryption-config-patch.yaml
new file mode 100644
index 000000000..e2dd0c752
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/data/kms-encryption-config-patch.yaml
@@ -0,0 +1,14 @@
+machine:
+  systemDiskEncryption:
+    state:
+        provider: luks2
+        keys:
+          - kms:
+              endpoint: {{ .KmsEndpoint }}
+            slot: 0
+    ephemeral:
+        provider: luks2
+        keys:
+          - kms:
+              endpoint: {{ .KmsEndpoint }}
+            slot: 0
\ No newline at end of file
diff --git a/internal/backend/runtime/omni/controllers/omni/data/kube-service-exposer-config-patch.tmpl.yaml b/internal/backend/runtime/omni/controllers/omni/data/kube-service-exposer-config-patch.tmpl.yaml
new file mode 100644
index 000000000..790f3ffea
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/data/kube-service-exposer-config-patch.tmpl.yaml
@@ -0,0 +1,60 @@
+cluster:
+  inlineManifests:
+    - name: omni-kube-service-exposer
+      # adapted from: https://github.com/siderolabs/kube-service-exposer/blob/main/deploy/kube-service-exposer.yaml
+      contents: |-
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: ClusterRole
+        metadata:
+          name: omni-kube-service-exposer
+        rules:
+          - apiGroups: [""]
+            resources: ["services"]
+            verbs: ["get", "list", "watch"]
+        ---
+        apiVersion: v1
+        kind: ServiceAccount
+        metadata:
+          name: omni-kube-service-exposer
+          namespace: kube-system
+        ---
+        apiVersion: rbac.authorization.k8s.io/v1
+        kind: ClusterRoleBinding
+        metadata:
+          name: omni-kube-service-exposer
+        roleRef:
+          apiGroup: rbac.authorization.k8s.io
+          kind: ClusterRole
+          name: omni-kube-service-exposer
+        subjects:
+          - kind: ServiceAccount
+            name: omni-kube-service-exposer
+            namespace: kube-system
+        ---
+        apiVersion: apps/v1
+        kind: DaemonSet
+        metadata:
+          name: omni-kube-service-exposer
+          namespace: kube-system
+        spec:
+          selector:
+            matchLabels:
+              app.kubernetes.io/name: omni-kube-service-exposer
+          template:
+            metadata:
+              labels:
+                app.kubernetes.io/name: omni-kube-service-exposer
+            spec:
+              serviceAccountName: omni-kube-service-exposer
+              hostNetwork: true
+              dnsPolicy: ClusterFirstWithHostNet
+              tolerations:
+                - operator: Exists
+              containers:
+                - name: omni-kube-service-exposer
+                  image: ghcr.io/siderolabs/kube-service-exposer:v0.1.1
+                  args:
+                    - --debug=false
+                    - --annotation-key={{ .AnnotationKey }}
+                    # siderolink CIDR
+                    - --bind-cidrs="fdae:41e4:649b:9303::/64"
diff --git a/internal/backend/runtime/omni/controllers/omni/etcd_backup.go b/internal/backend/runtime/omni/controllers/omni/etcd_backup.go
new file mode 100644
index 000000000..47d662997
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/etcd_backup.go
@@ -0,0 +1,448 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/jonboulle/clockwork"
+	"github.com/siderolabs/gen/channel"
+	"github.com/siderolabs/gen/containers"
+	machineapi "github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"go.uber.org/zap"
+	"golang.org/x/sync/errgroup"
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup/store"
+)
+
+// EtcdBackupController manages etcd backups.
+type EtcdBackupController struct {
+	settings EtcdBackupControllerSettings
+
+	manualBackups map[resource.ID]time.Time
+	lastBackup    containers.ConcurrentMap[string, time.Time]
+	parallel      int
+	maxBackupTime time.Duration
+}
+
+// EtcdBackupControllerSettings is a set of parameters for EtcdBackupController.
+type EtcdBackupControllerSettings struct {
+	ClientMaker  ClientMaker
+	StoreFactory store.Factory
+	Clock        clockwork.Clock // can be nil, will be replaced with real clock in that case
+	TickInterval time.Duration   // can be 0 in which case StoreFactory should be [store.DisabledStoreFactory]
+}
+
+// ClientMaker is a function that creates Talos client.
+type ClientMaker func(ctx context.Context, clusterName string) (TalosClient, error)
+
+// NewEtcdBackupController creates new EtcdBackupController with defined uploader.
+func NewEtcdBackupController(s EtcdBackupControllerSettings) (*EtcdBackupController, error) {
+	if s.TickInterval < time.Minute && s.StoreFactory != store.DisabledStoreFactory {
+		return nil, errors.New("tick interval must be at least 1 minute")
+	}
+
+	if s.Clock == nil {
+		s.Clock = clockwork.NewRealClock()
+	}
+
+	return &EtcdBackupController{
+		settings:      s,
+		manualBackups: map[resource.ID]time.Time{},
+		parallel:      5,
+		maxBackupTime: 30 * time.Minute,
+	}, nil
+}
+
+// Name implements controller.Controller interface.
+func (*EtcdBackupController) Name() string {
+	return "EtcdBackupController"
+}
+
+// Inputs implements controller.Controller interface.
+func (*EtcdBackupController) Inputs() []controller.Input {
+	return []controller.Input{
+		safe.Input[*omni.BackupData](controller.InputWeak),
+		safe.Input[*omni.EtcdManualBackup](controller.InputWeak),
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (*EtcdBackupController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.EtcdBackupStatusType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *EtcdBackupController) Run(ctx context.Context, r controller.Runtime, logger *zap.Logger) error {
+	if ctrl.settings.StoreFactory == store.DisabledStoreFactory {
+		logger.Info("etcd backups are disabled")
+
+		return nil
+	}
+
+	logger.Info(
+		"etcd backups are enabled",
+		zap.String("uploader", ctrl.settings.StoreFactory.Description()),
+		zap.Duration("tick_interval", ctrl.settings.TickInterval),
+	)
+
+	for {
+		_, state := channel.TryRecv(r.EventCh())
+		if state != channel.StateRecv {
+			// If we didn't receive any event, wait for tick interval.
+			// We don't drop here if we are getting stream of events, so we don't create unnecessary timers.
+			timer := ctrl.settings.Clock.NewTimer(ctrl.settings.TickInterval)
+
+			select {
+			case <-ctx.Done():
+				return nil
+			case <-r.EventCh():
+			case <-timer.Chan():
+			}
+
+			timer.Stop()
+		}
+
+		err := ctrl.run(ctx, r, logger)
+		if err != nil {
+			if errors.Is(err, store.ErrS3NotInitialized) {
+				continue
+			}
+
+			return fmt.Errorf("failed to run etcd backup controller: %w", err)
+		}
+	}
+}
+
+func (ctrl *EtcdBackupController) run(ctx context.Context, r controller.Runtime, logger *zap.Logger) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	bdl, err := safe.ReaderListAll[*omni.BackupData](ctx, r)
+	if err != nil {
+		return fmt.Errorf("failed to list clusters: %w", err)
+	}
+
+	err = ctrl.cleanup(ctx, r, bdl, logger)
+	if err != nil {
+		return err
+	}
+
+	backupDataList, err := ctrl.findClustersToBackup(ctx, r, bdl, logger)
+	if err != nil {
+		return fmt.Errorf("error while finding clusters to backup: %w", err)
+	}
+
+	if len(backupDataList) == 0 {
+		logger.Debug("no clusters to backup")
+
+		return nil
+	}
+
+	var eg errgroup.Group
+
+	eg.SetLimit(ctrl.parallel)
+
+	type result struct {
+		time      time.Time
+		err       error
+		clusterID string
+	}
+
+	backupResultCh := make(chan result, len(backupDataList))
+
+	for _, backupData := range backupDataList {
+		clusterLogger := logger.With(zap.String("cluster", backupData.Metadata().ID()))
+
+		eg.Go(func() error {
+			localCtx, cancel := context.WithTimeout(ctx, ctrl.maxBackupTime)
+			defer cancel()
+
+			backupErr := ctrl.doBackup(localCtx, backupData, clusterLogger)
+
+			backupResultCh <- result{
+				clusterID: backupData.Metadata().ID(),
+				time:      ctrl.settings.Clock.Now(),
+				err:       backupErr,
+			}
+
+			return nil
+		})
+	}
+
+	err = eg.Wait()
+	if err != nil {
+		return fmt.Errorf("failed to backup clusters: %w", err)
+	}
+
+	close(backupResultCh)
+
+	for backupResultData := range backupResultCh {
+		ctrl.updateBackupStatus(ctx, r, backupResultData.clusterID, backupResultData.time, backupResultData.err, logger)
+	}
+
+	return nil
+}
+
+func (ctrl *EtcdBackupController) cleanup(ctx context.Context, r controller.Runtime, bdl safe.List[*omni.BackupData], logger *zap.Logger) error {
+	ctrl.lastBackup.FilterInPlace(func(uuid string, _ time.Time) bool {
+		idx := bdl.Index(func(backupData *omni.BackupData) bool {
+			return backupData.TypedSpec().Value.ClusterUuid == uuid
+		})
+		if idx >= 0 {
+			return true
+		}
+
+		logger.Info(
+			"cluster backup no longer exists, removing from last backup list",
+			zap.String("uuid", uuid),
+		)
+
+		return false
+	})
+
+	err := cleanupOutputs(ctx, r, func(es *omni.EtcdBackupStatus) bool {
+		return bdl.Index(func(bd *omni.BackupData) bool {
+			return bd.Metadata().ID() == es.Metadata().ID()
+		}) >= 0
+	})
+	if err != nil {
+		return fmt.Errorf("failed to cleanup EtcdBackupStatus outputs: %w", err)
+	}
+
+	return nil
+}
+
+func (ctrl *EtcdBackupController) findClustersToBackup(ctx context.Context, r controller.Runtime, bdl safe.List[*omni.BackupData], logger *zap.Logger) ([]*omni.BackupData, error) {
+	if bdl.Len() == 0 {
+		return nil, nil
+	}
+
+	result := make([]*omni.BackupData, 0, bdl.Len())
+
+	for it := bdl.Iterator(); it.Next(); {
+		backupData := it.Value()
+		clusterID := backupData.Metadata().ID()
+		value := backupData.TypedSpec().Value
+
+		emb, err := safe.ReaderGetByID[*omni.EtcdManualBackup](ctx, r, clusterID)
+		if err != nil && !state.IsNotFoundError(err) {
+			return nil, fmt.Errorf("failed to get manual backup for cluster %q: %w", clusterID, err)
+		}
+
+		if ctrl.shouldManualBackup(emb) {
+			asTime := emb.TypedSpec().Value.GetBackupAt().AsTime()
+
+			logger.Info("doing manual backup", zap.Time("next_backup", asTime), zap.String("cluster", clusterID))
+
+			result = append(result, backupData)
+
+			ctrl.manualBackups[clusterID] = asTime
+
+			continue
+		}
+
+		if backupData.TypedSpec().Value.GetInterval().AsDuration() == 0 {
+			continue
+		}
+
+		latestBackupTime, err := ctrl.latestBackupTime(ctx, backupData.TypedSpec().Value.ClusterUuid)
+		if err != nil {
+			ctrl.updateBackupStatus(ctx, r, clusterID, ctrl.settings.Clock.Now(), err, logger)
+
+			return nil, fmt.Errorf("failed to get latest backup time for cluster %q: %w", clusterID, err)
+		}
+
+		if latestBackupTime.IsZero() {
+			logger.Info("cluster backup is missing, creating new one", zap.String("cluster", clusterID))
+
+			result = append(result, backupData)
+
+			continue
+		}
+
+		if elapsed := ctrl.settings.Clock.Since(latestBackupTime); elapsed >= value.Interval.AsDuration() {
+			result = append(result, backupData)
+		}
+	}
+
+	return result, nil
+}
+
+func (ctrl *EtcdBackupController) shouldManualBackup(emb *omni.EtcdManualBackup) bool {
+	if emb == nil {
+		return false
+	}
+
+	clusterID := emb.Metadata().ID()
+	value := emb.TypedSpec().Value
+
+	if value.GetBackupAt().GetSeconds() == 0 {
+		return false
+	}
+
+	manualBackupAt := value.GetBackupAt().AsTime()
+
+	if lastManualBackup, ok := ctrl.manualBackups[clusterID]; ok && lastManualBackup.Equal(manualBackupAt) {
+		return false
+	}
+
+	timeDiff := ctrl.settings.Clock.Now().Sub(manualBackupAt)
+	if timeDiff >= 10*time.Minute || timeDiff <= -10*time.Minute {
+		return false
+	}
+
+	return true
+}
+
+func (ctrl *EtcdBackupController) latestBackupTime(ctx context.Context, clusterUUID string) (time.Time, error) {
+	if latestBackupTime, ok := ctrl.lastBackup.Get(clusterUUID); ok {
+		return latestBackupTime, nil
+	}
+
+	st, err := ctrl.settings.StoreFactory.GetStore()
+	if err != nil {
+		return time.Time{}, fmt.Errorf("failed to get store: %w", err)
+	}
+
+	iter, err := st.ListBackups(ctx, clusterUUID)
+	if err != nil {
+		return time.Time{}, err
+	}
+
+	lastBackup, ok, err := iter()
+	if err != nil {
+		return time.Time{}, fmt.Errorf("failed to get last backup: %w", err)
+	} else if !ok {
+		return time.Time{}, nil
+	}
+
+	ctrl.lastBackup.Set(clusterUUID, lastBackup.Timestamp)
+
+	return lastBackup.Timestamp, nil
+}
+
+func (ctrl *EtcdBackupController) doBackup(
+	ctx context.Context,
+	backupData *omni.BackupData,
+	logger *zap.Logger,
+) error {
+	clusterName := backupData.Metadata().ID()
+
+	client, err := ctrl.settings.ClientMaker(ctx, clusterName)
+	if err != nil {
+		return fmt.Errorf("failed to create talos client for cluster, skipping cluster backup: %w", err)
+	}
+
+	rdr, err := client.EtcdSnapshot(ctx, &machineapi.EtcdSnapshotRequest{})
+	if err != nil {
+		return fmt.Errorf("failed to start etcd snapshot stream for cluster: %w", err)
+	}
+
+	defer func() {
+		if rdrErr := rdr.Close(); rdrErr != nil {
+			logger.Warn("failed to close etcd snapshot reader", zap.Error(rdrErr))
+		}
+	}()
+
+	now := ctrl.settings.Clock.Now()
+
+	st, err := ctrl.settings.StoreFactory.GetStore()
+	if err != nil {
+		return fmt.Errorf("failed to get store: %w", err)
+	}
+
+	if err := st.Upload(
+		ctx,
+		etcdbackup.Description{
+			Timestamp:   now,
+			ClusterUUID: backupData.TypedSpec().Value.ClusterUuid,
+			ClusterName: clusterName,
+			EncryptionData: etcdbackup.EncryptionData{
+				AESCBCEncryptionSecret:    backupData.TypedSpec().Value.AesCbcEncryptionSecret,
+				SecretboxEncryptionSecret: backupData.TypedSpec().Value.SecretboxEncryptionSecret,
+				EncryptionKey:             backupData.TypedSpec().Value.EncryptionKey,
+			},
+		},
+		rdr,
+	); err != nil {
+		return fmt.Errorf("failed to upload etcd snapshot for cluster: %w", err)
+	}
+
+	ctrl.lastBackup.Set(backupData.TypedSpec().Value.ClusterUuid, now)
+
+	logger.Info(
+		"uploaded etcd snapshot",
+		zap.String("cluster_uuid", backupData.TypedSpec().Value.ClusterUuid),
+		zap.String("snapshot_name", etcdbackup.CreateSnapshotName(now)),
+		zap.Time("ts", now),
+	)
+
+	return nil
+}
+
+func (ctrl *EtcdBackupController) updateBackupStatus(
+	ctx context.Context,
+	r controller.Runtime,
+	clusterID string,
+	backupTime time.Time,
+	backupErr error,
+	logger *zap.Logger,
+) {
+	if backupErr != nil {
+		logger.Warn(
+			"failed to backup cluster",
+			zap.String("cluster", clusterID),
+			zap.Error(backupErr),
+		)
+	}
+
+	err := safe.WriterModify(
+		ctx,
+		r,
+		omni.NewEtcdBackupStatus(clusterID),
+		func(status *omni.EtcdBackupStatus) error {
+			status.TypedSpec().Value.LastBackupAttempt = timestamppb.New(backupTime)
+
+			if backupErr != nil {
+				status.TypedSpec().Value.Error = backupErr.Error()
+				status.TypedSpec().Value.Status = specs.EtcdBackupStatusSpec_Error
+			} else {
+				status.TypedSpec().Value.Error = ""
+				status.TypedSpec().Value.Status = specs.EtcdBackupStatusSpec_Ok
+				status.TypedSpec().Value.LastBackupTime = timestamppb.New(backupTime)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		logger.Warn("failed to update etcd backup status", zap.Error(backupErr))
+	}
+}
+
+// TalosClient is a subset of Talos client.
+type TalosClient interface {
+	EtcdSnapshot(ctx context.Context, req *machineapi.EtcdSnapshotRequest, callOptions ...grpc.CallOption) (io.ReadCloser, error)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/etcd_backup_encryption.go b/internal/backend/runtime/omni/controllers/omni/etcd_backup_encryption.go
new file mode 100644
index 000000000..a059c8b7e
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/etcd_backup_encryption.go
@@ -0,0 +1,67 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"crypto/rand"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// EtcdBackupEncryptionController manages etcd backup encryption data for each cluster.
+//
+// EtcdBackupEncryptionController generates etcd backup encryption key and unique UUID for each cluster.
+type EtcdBackupEncryptionController = qtransform.QController[*omni.ClusterUUID, *omni.EtcdBackupEncryption]
+
+// NewEtcdBackupEncryptionController initializes EtcdBackupEncryptionController.
+func NewEtcdBackupEncryptionController() *EtcdBackupEncryptionController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.ClusterUUID, *omni.EtcdBackupEncryption]{
+			Name: "EtcdBackupEncryptionController",
+			MapMetadataFunc: func(cluster *omni.ClusterUUID) *omni.EtcdBackupEncryption {
+				return omni.NewEtcdBackupEncryption(resources.DefaultNamespace, cluster.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(backupEncryption *omni.EtcdBackupEncryption) *omni.ClusterUUID {
+				return omni.NewClusterUUID(backupEncryption.Metadata().ID())
+			},
+			TransformFunc: func(_ context.Context, _ controller.Reader, logger *zap.Logger, c *omni.ClusterUUID, backupEncryption *omni.EtcdBackupEncryption) error {
+				value := backupEncryption.TypedSpec().Value
+				if len(value.EncryptionKey) != 0 {
+					return nil
+				}
+
+				key, err := generateRandomBytes()
+				if err != nil {
+					return fmt.Errorf("failed to generate random bytes: %w", err)
+				}
+
+				value.EncryptionKey = key
+
+				logger.Info("generated etcd backup encryption key",
+					zap.String("cluster", backupEncryption.Metadata().ID()),
+					zap.String("uuid", c.TypedSpec().Value.Uuid),
+				)
+
+				return nil
+			},
+		},
+	)
+}
+
+func generateRandomBytes() ([]byte, error) {
+	key := make([]byte, 32)
+
+	_, err := rand.Read(key)
+
+	return key, err
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/etcd_backup_overall_status.go b/internal/backend/runtime/omni/controllers/omni/etcd_backup_overall_status.go
new file mode 100644
index 000000000..8364aee4a
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/etcd_backup_overall_status.go
@@ -0,0 +1,104 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// EtcdBackupOverallStatusController is a controller that manages EtcdBackupOverallStatus.
+type EtcdBackupOverallStatusController struct{}
+
+// NewEtcdBackupOverallStatusController initializes EtcdBackupOverallStatusController.
+func NewEtcdBackupOverallStatusController() *EtcdBackupOverallStatusController {
+	return &EtcdBackupOverallStatusController{}
+}
+
+// Name implements controller.Controller interface.
+func (ctrl *EtcdBackupOverallStatusController) Name() string {
+	return "EtcdBackupOverallStatusController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *EtcdBackupOverallStatusController) Inputs() []controller.Input {
+	return []controller.Input{
+		safe.Input[*omni.EtcdBackupStoreStatus](controller.InputWeak),
+		safe.Input[*omni.EtcdBackupStatus](controller.InputWeak),
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *EtcdBackupOverallStatusController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.EtcdBackupOverallStatusType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *EtcdBackupOverallStatusController) Run(ctx context.Context, r controller.Runtime, _ *zap.Logger) error {
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+		}
+
+		storeStatus, err := safe.ReaderGetByID[*omni.EtcdBackupStoreStatus](ctx, r, omni.EtcdBackupStoreStatusID)
+		if err != nil {
+			if state.IsNotFoundError(err) {
+				continue
+			}
+
+			return fmt.Errorf("failed to get etcd backup store status: %w", err)
+		}
+
+		backupStatusList, err := safe.ReaderListAll[*omni.EtcdBackupStatus](ctx, r)
+		if err != nil {
+			return fmt.Errorf("failed to list etcd backup statuses: %w", err)
+		}
+
+		var latestStatus *omni.EtcdBackupStatus
+
+		backupStatusList.ForEach(func(status *omni.EtcdBackupStatus) {
+			if latestStatus == nil || status.Metadata().Updated().After(latestStatus.Metadata().Updated()) {
+				latestStatus = status
+			}
+		})
+
+		err = safe.WriterModify(ctx, r, omni.NewEtcdBackupOverallStatus(), func(output *omni.EtcdBackupOverallStatus) error {
+			output.TypedSpec().Value.ConfigurationName = storeStatus.TypedSpec().Value.ConfigurationName
+			output.TypedSpec().Value.ConfigurationError = storeStatus.TypedSpec().Value.ConfigurationError
+
+			if latestStatus != nil {
+				if output.TypedSpec().Value.LastBackupStatus == nil {
+					output.TypedSpec().Value.LastBackupStatus = &specs.EtcdBackupStatusSpec{}
+				}
+
+				output.TypedSpec().Value.LastBackupStatus.Status = latestStatus.TypedSpec().Value.Status
+				output.TypedSpec().Value.LastBackupStatus.Error = latestStatus.TypedSpec().Value.Error
+				output.TypedSpec().Value.LastBackupStatus.LastBackupTime = latestStatus.TypedSpec().Value.LastBackupTime
+				output.TypedSpec().Value.LastBackupStatus.LastBackupAttempt = latestStatus.TypedSpec().Value.LastBackupAttempt
+			}
+
+			return nil
+		})
+		if err != nil {
+			return fmt.Errorf("failed to modify etcd backup overall status: %w", err)
+		}
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/etcd_backup_test.go b/internal/backend/runtime/omni/controllers/omni/etcd_backup_test.go
new file mode 100644
index 000000000..e1fcc5486
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/etcd_backup_test.go
@@ -0,0 +1,815 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http/httptest"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/johannesboyne/gofakes3"
+	"github.com/johannesboyne/gofakes3/backend/s3mem"
+	"github.com/jonboulle/clockwork"
+	"github.com/siderolabs/gen/containers"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/gen/xtesting/must"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest"
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup/store"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/external"
+	"github.com/siderolabs/omni/internal/pkg/xmocks"
+)
+
+func TestEtcdBackupControllerSuite(t *testing.T) {
+	suite.Run(t, new(EtcdBackupControllerSuite))
+}
+
+type EtcdBackupControllerSuite struct {
+	OmniSuite
+}
+
+func (suite *EtcdBackupControllerSuite) register(ctrl controller.Controller) {
+	suite.Require().NoError(suite.runtime.RegisterController(ctrl))
+}
+
+func (suite *EtcdBackupControllerSuite) qregister(ctrl controller.QController) {
+	suite.Require().NoError(suite.runtime.RegisterQController(ctrl))
+}
+
+func (suite *EtcdBackupControllerSuite) register2(ctrl controller.Controller, err error) {
+	suite.Require().NoError(err)
+	suite.register(ctrl)
+}
+
+func (suite *EtcdBackupControllerSuite) SetupTest() {
+	suite.OmniSuite.SetupTest()
+
+	suite.startRuntime()
+
+	suite.register(omnictrl.NewClusterController())
+	suite.qregister(omnictrl.NewClusterUUIDController())
+	suite.qregister(omnictrl.NewEtcdBackupEncryptionController())
+	suite.qregister(omnictrl.NewSecretsController(suite.fileStoreFactory()))
+	suite.qregister(omnictrl.NewBackupDataController())
+}
+
+func (suite *EtcdBackupControllerSuite) TestEtcdBackup() {
+	fakeclock := fakeClock()
+	sf := suite.fileStoreFactory()
+	clientMock := &talosClientMock{}
+
+	defer clientMock.AssertExpectations(suite.T())
+
+	clientMock.
+		On(xmocks.Name((*talosClientMock).EtcdSnapshot), mock.Anything, mock.Anything, mock.Anything).
+		Return(func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader("Hello World")), nil })
+
+	suite.register2(omnictrl.NewEtcdBackupController(omnictrl.EtcdBackupControllerSettings{
+		ClientMaker: func(context.Context, string) (omnictrl.TalosClient, error) {
+			return clientMock, nil
+		},
+		StoreFactory: sf,
+		Clock:        fakeclock,
+		TickInterval: 10 * time.Minute,
+	}))
+
+	clusterNames := []string{"talos-default-1", "talos-default-2"}
+	clustersData := createClusters(suite, clusterNames, time.Hour)
+	start := fakeclock.Now()
+
+	blockAndAdvance(fakeclock, 11*time.Minute)
+
+	rtestutils.AssertResources(
+		suite.ctx,
+		suite.T(),
+		suite.state,
+		xslices.Map(clustersData, func(cluster *omni.BackupData) resource.ID { return cluster.Metadata().ID() }),
+		func(r *omni.EtcdBackupStatus, assertion *assert.Assertions) {
+			ids := xslices.Map(clustersData, func(cluster *omni.BackupData) resource.ID { return cluster.Metadata().ID() })
+
+			if !slices.Contains(ids, r.Metadata().ID()) {
+				assertion.Failf("unexpected cluster %s", r.Metadata().ID())
+			}
+
+			value := r.TypedSpec().Value
+
+			assertion.Equal(specs.EtcdBackupStatusSpec_Ok, value.Status)
+			assertion.Zero(value.Error)
+			assertion.WithinRange(value.LastBackupTime.AsTime(), start, fakeclock.Now())
+		},
+	)
+
+	// Backups should be created for both clusters since those backups do not exist yet
+	for _, cd := range clustersData {
+		suite.eventuallyFindBackups(sf, cd.Metadata().ID(), 1)
+	}
+
+	blockAndAdvance(fakeclock, time.Hour)
+
+	for _, cd := range clustersData {
+		suite.eventuallyFindBackups(sf, cd.Metadata().ID(), 2)
+	}
+
+	// Destroy the first cluster
+	suite.destroyClusterByID(clustersData[0].Metadata().ID())
+
+	blockAndAdvance(fakeclock, time.Hour)
+
+	suite.eventuallyFindBackups(sf, clustersData[1].Metadata().ID(), 3)
+
+	// Destroy the second cluster
+	suite.destroyClusterByID(clustersData[1].Metadata().ID())
+}
+
+func (suite *EtcdBackupControllerSuite) TestEtcdBackupFactoryFails() {
+	fakeclock := fakeClock()
+	sf := suite.fileStoreFactory()
+	clientMock := &talosClientMock{}
+
+	defer clientMock.AssertExpectations(suite.T())
+
+	clientMock.
+		On(xmocks.Name((*talosClientMock).EtcdSnapshot), mock.Anything, mock.Anything, mock.Anything).
+		Return(func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader("Hello World")), nil }).
+		Times(5)
+
+	var m containers.ConcurrentMap[string, func() (omnictrl.TalosClient, error)]
+
+	clusterNames := []string{"talos-default-1", "talos-default-2", "talos-default-3"}
+
+	for _, clusterName := range clusterNames {
+		m.Set(clusterName, func() (omnictrl.TalosClient, error) {
+			return clientMock, nil
+		})
+	}
+
+	suite.register2(omnictrl.NewEtcdBackupController(omnictrl.EtcdBackupControllerSettings{
+		ClientMaker: func(_ context.Context, clusterName string) (omnictrl.TalosClient, error) {
+			fn, _ := m.Get(clusterName)
+
+			return fn()
+		},
+		StoreFactory: sf,
+		Clock:        fakeclock,
+		TickInterval: 10 * time.Minute,
+	}))
+
+	clustersData := createClusters(suite, clusterNames, time.Hour)
+
+	blockAndAdvance(fakeclock, 11*time.Minute)
+
+	// Backups should be created for both clusters since those backups do not exist yet
+	for _, cluster := range clustersData {
+		suite.eventuallyFindBackups(sf, cluster.Metadata().ID(), 1)
+	}
+
+	start := fakeclock.Now()
+
+	m.Set(clusterNames[0], func() (omnictrl.TalosClient, error) {
+		return nil, errors.New("failed to create client")
+	})
+
+	blockAndAdvance(fakeclock, time.Hour)
+
+	assertResource(
+		&suite.OmniSuite,
+		clustersData[0].Metadata(),
+		func(r *omni.EtcdBackupStatus, assertion *assert.Assertions) {
+			value := r.TypedSpec().Value
+
+			assertion.EqualValuesf(value.Error, "failed to create talos client for cluster, skipping cluster backup: failed to create client", "cluster %s", r.Metadata().ID())
+			assertion.Equalf(specs.EtcdBackupStatusSpec_Error, value.Status, "cluster %s", r.Metadata().ID())
+			assertion.WithinRangef(
+				value.LastBackupAttempt.AsTime(),
+				start,
+				fakeclock.Now(),
+				"cluster %s",
+				r.Metadata().ID(),
+			)
+		},
+	)
+
+	suite.eventuallyFindBackups(sf, clustersData[0].Metadata().ID(), 1)
+	suite.eventuallyFindBackups(sf, clustersData[1].Metadata().ID(), 2)
+
+	for i := range clusterNames {
+		suite.destroyClusterByID(clustersData[i].Metadata().ID())
+	}
+}
+
+func (suite *EtcdBackupControllerSuite) TestDecryptEtcdBackup() {
+	fakeclock := fakeClock()
+	sf := suite.fileStoreFactory()
+	clientMock := &talosClientMock{}
+
+	defer clientMock.AssertExpectations(suite.T())
+
+	clientMock.
+		On(xmocks.Name((*talosClientMock).EtcdSnapshot), mock.Anything, mock.Anything, mock.Anything).
+		Return(func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader("Hello World")), nil })
+
+	suite.register2(omnictrl.NewEtcdBackupController(omnictrl.EtcdBackupControllerSettings{
+		ClientMaker: func(context.Context, string) (omnictrl.TalosClient, error) {
+			return clientMock, nil
+		},
+		StoreFactory: sf,
+		Clock:        fakeclock,
+		TickInterval: 10 * time.Minute,
+	}))
+
+	clusterNames := []string{"talos-default-1"}
+	clusters := createClusters(suite, clusterNames, time.Hour)
+
+	blockAndAdvance(fakeclock, 11*time.Minute)
+
+	clusterBackups := suite.eventuallyFindBackups(sf, clusters[0].Metadata().ID(), 1)
+
+	src := must.Value(clusterBackups[0].Reader())(suite.T())
+
+	suite.T().Cleanup(func() { suite.Require().NoError(src.Close()) })
+
+	decryptedHeader, decrypter := must.Values(crypt.Decrypt(
+		src,
+		clusters[0].TypedSpec().Value.EncryptionKey,
+	))(suite.T())
+
+	suite.Require().EqualValues(
+		clusters[0].TypedSpec().Value.AesCbcEncryptionSecret,
+		decryptedHeader.AESCBCEncryptionSecret,
+	)
+	suite.Require().EqualValues(
+		clusters[0].TypedSpec().Value.SecretboxEncryptionSecret,
+		decryptedHeader.SecretboxEncryptionSecret,
+	)
+	suite.Require().EqualValues("Hello World", string(must.Value(io.ReadAll(decrypter))(suite.T())))
+
+	for i := range clusterNames {
+		suite.destroyClusterByID(clusters[i].Metadata().ID())
+	}
+}
+
+func (suite *EtcdBackupControllerSuite) TestSingleListCall() {
+	fakeclock := fakeClock()
+	sfm := &storeFactoryMock{}
+	sm := &storeMock{}
+
+	defer sfm.AssertExpectations(suite.T())
+	defer sm.AssertExpectations(suite.T())
+
+	ch := make(chan string, 3)
+
+	sfm.On(xmocks.Name((*sfm).GetStore)).Return(sm, nil)
+
+	sm.On(xmocks.Name((*storeMock).ListBackups), mock.Anything, mock.Anything).Return(etcdbackup.InfoIterator(func() (etcdbackup.Info, bool, error) {
+		return etcdbackup.Info{}, false, nil
+	}), nil).Twice()
+	sm.On(xmocks.Name((*storeMock).Upload), mock.Anything, mock.Anything, mock.Anything).Run(func(args mock.Arguments) {
+		ch <- xmocks.GetAs[etcdbackup.Description](args, 1).ClusterName
+		must.Value(io.Copy(io.Discard, xmocks.GetAs[io.Reader](args, 2)))
+	}).Return(nil).Times(3)
+
+	clientMock := &talosClientMock{}
+	defer clientMock.AssertExpectations(suite.T())
+
+	clientMock.
+		On(xmocks.Name((*talosClientMock).EtcdSnapshot), mock.Anything, mock.Anything, mock.Anything).
+		Return(func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader("Hello World")), nil })
+
+	suite.register2(omnictrl.NewEtcdBackupController(omnictrl.EtcdBackupControllerSettings{
+		ClientMaker: func(context.Context, string) (omnictrl.TalosClient, error) {
+			return clientMock, nil
+		},
+		StoreFactory: sfm,
+		Clock:        fakeclock,
+		TickInterval: 10 * time.Minute,
+	}))
+
+	clusterNames := []string{"talos-default-1", "talos-default-2"}
+	clusters := createClusters(suite, clusterNames, time.Hour)
+
+	blockAndAdvance(fakeclock, 11*time.Minute)
+
+	suite.destroyClusterByID(clusters[0].Metadata().ID())
+
+	blockAndAdvance(fakeclock, time.Hour)
+
+	fakeclock.BlockUntil(1)
+
+	for i := range clusterNames {
+		suite.destroyClusterByID(clusters[i].Metadata().ID())
+	}
+}
+
+func (suite *EtcdBackupControllerSuite) TestListBackupsWithExistingData() {
+	clusterNames := []string{"talos-default-1", "talos-default-2"}
+	clusters := createClusters(suite, clusterNames, time.Hour)
+
+	fakeclock := fakeClock()
+	sfm := &storeFactoryMock{}
+	store := &storeMock{}
+
+	defer sfm.AssertExpectations(suite.T())
+	defer store.AssertExpectations(suite.T())
+
+	sfm.On(xmocks.Name((*sfm).GetStore)).Return(store, nil)
+
+	store.
+		On(xmocks.Name((*storeMock).ListBackups), mock.Anything, mock.Anything).
+		Return(toIter([]etcdbackup.Info{
+			{Timestamp: fakeclock.Now().Add(time.Minute), Reader: nil, Size: 0},
+			{Timestamp: fakeclock.Now(), Reader: nil, Size: 0},
+		}), nil).
+		Twice()
+	store.On(xmocks.Name((*storeMock).Upload), mock.Anything, mock.Anything, mock.Anything).Run(func(args mock.Arguments) {
+		must.Value(io.Copy(io.Discard, xmocks.GetAs[io.Reader](args, 2)))
+	}).Return(nil).Twice()
+
+	clientMock := &talosClientMock{}
+	defer clientMock.AssertExpectations(suite.T())
+
+	clientMock.
+		On(xmocks.Name((*talosClientMock).EtcdSnapshot), mock.Anything, mock.Anything, mock.Anything).
+		Return(func() (io.ReadCloser, error) {
+			return io.NopCloser(strings.NewReader("Hello World")), nil
+		})
+
+	suite.register2(omnictrl.NewEtcdBackupController(omnictrl.EtcdBackupControllerSettings{
+		ClientMaker: func(context.Context, string) (omnictrl.TalosClient, error) {
+			return clientMock, nil
+		},
+		StoreFactory: sfm,
+		Clock:        fakeclock,
+		TickInterval: 10 * time.Minute,
+	}))
+
+	blockAndAdvance(fakeclock, 11*time.Minute)
+
+	suite.destroyClusterByID(clusters[0].Metadata().ID())
+
+	blockAndAdvance(fakeclock, time.Hour)
+	blockAndAdvance(fakeclock, time.Hour)
+	fakeclock.BlockUntil(1)
+
+	suite.destroyClusterByID(clusters[1].Metadata().ID())
+}
+
+func (suite *EtcdBackupControllerSuite) TestEtcdManualBackupFindResource() {
+	fakeclock := fakeClock()
+	sf := suite.fileStoreFactory()
+	clientMock := &talosClientMock{}
+
+	suite.stateBuilder.Set(resources.ExternalNamespace, &external.State{
+		CoreState:    suite.state,
+		StoreFactory: sf,
+	})
+
+	defer clientMock.AssertExpectations(suite.T())
+
+	clientMock.
+		On(xmocks.Name((*talosClientMock).EtcdSnapshot), mock.Anything, mock.Anything, mock.Anything).
+		Return(func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader("Hello World")), nil })
+
+	suite.register2(omnictrl.NewEtcdBackupController(omnictrl.EtcdBackupControllerSettings{
+		ClientMaker: func(context.Context, string) (omnictrl.TalosClient, error) {
+			return clientMock, nil
+		},
+		StoreFactory: sf,
+		Clock:        fakeclock,
+		TickInterval: time.Minute,
+	}))
+
+	clusterNames := []string{"talos-default-1"}
+	clustersData := createClusters(suite, clusterNames, 0) // 0 means that automatic backups are disabled
+
+	manualBackup := omni.NewEtcdManualBackup(clustersData[0].Metadata().ID())
+	manualBackup.TypedSpec().Value.BackupAt = timestamppb.New(fakeclock.Now().Add(15 * time.Second))
+
+	err := suite.state.Create(suite.ctx, manualBackup)
+	suite.Require().NoError(err)
+
+	blockAndAdvance(fakeclock, 15*time.Second)
+
+	backups := suite.eventuallyFindBackups(sf, clustersData[0].Metadata().ID(), 1)
+
+	// Should find backups by cluster ID
+
+	backupRes := must.Value(safe.StateListAll[*omni.EtcdBackup](
+		suite.ctx,
+		suite.state,
+		state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterNames[0])),
+	))(suite.T())
+
+	suite.Assert().EqualValues(len(backups), backupRes.Len())
+
+	suite.Assert().Equal(
+		omni.NewEtcdBackup(clusterNames[0], backups[0].Timestamp).Metadata().ID(),
+		backupRes.Get(0).Metadata().ID(),
+	)
+
+	suite.Assert().Equal(backups[0].Snapshot, backupRes.Get(0).TypedSpec().Value.Snapshot)
+	suite.Assert().Equal(backups[0].Timestamp.UTC(), backupRes.Get(0).TypedSpec().Value.CreatedAt.AsTime())
+
+	// Should find backup by backup id
+
+	res := must.Value(safe.StateGetByID[*omni.EtcdBackup](suite.ctx, suite.state, backupRes.Get(0).Metadata().ID()))(suite.T())
+
+	suite.Assert().Equal(backups[0].Snapshot, res.TypedSpec().Value.Snapshot)
+	suite.Assert().Equal(backups[0].Timestamp.UTC(), res.TypedSpec().Value.CreatedAt.AsTime())
+
+	// Should return an error if no query is provided
+
+	_, err = safe.StateList[*omni.EtcdBackup](suite.ctx, suite.state, omni.NewEtcdBackup("", fakeclock.Now()).Metadata())
+	suite.Require().Error(err)
+
+	for _, clusterData := range clustersData {
+		suite.destroyClusterByID(clusterData.Metadata().ID())
+	}
+}
+
+func (suite *EtcdBackupControllerSuite) TestEtcdManualBackup() {
+	fakeclock := fakeClock()
+	sf := suite.fileStoreFactory()
+	clientMock := &talosClientMock{}
+
+	defer clientMock.AssertExpectations(suite.T())
+
+	clientMock.
+		On(xmocks.Name((*talosClientMock).EtcdSnapshot), mock.Anything, mock.Anything, mock.Anything).
+		Return(func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader("Hello World")), nil })
+
+	suite.register2(omnictrl.NewEtcdBackupController(omnictrl.EtcdBackupControllerSettings{
+		ClientMaker: func(context.Context, string) (omnictrl.TalosClient, error) {
+			return clientMock, nil
+		},
+		StoreFactory: sf,
+		Clock:        fakeclock,
+		TickInterval: time.Minute,
+	}))
+
+	clusterNames := []string{"talos-default-1", "talos-default-2"}
+	clustersData := createClusters(suite, clusterNames, 0) // 0 means that automatic backups are disabled
+
+	blockAndAdvance(fakeclock, 15*time.Second)
+
+	assertNoResource(&suite.OmniSuite, omni.NewEtcdBackupStatus(clustersData[0].Metadata().ID()))
+	assertNoResource(&suite.OmniSuite, omni.NewEtcdBackupStatus(clustersData[1].Metadata().ID()))
+
+	manualBackup := omni.NewEtcdManualBackup(clustersData[0].Metadata().ID())
+	manualBackup.TypedSpec().Value.BackupAt = timestamppb.New(fakeclock.Now().Add(15 * time.Second))
+
+	err := suite.state.Create(suite.ctx, manualBackup)
+	suite.Require().NoError(err)
+
+	now := fakeclock.Now()
+
+	assertNoResource(&suite.OmniSuite, omni.NewEtcdBackupStatus(clustersData[0].Metadata().ID()))
+	suite.eventuallyFindBackups(sf, clustersData[0].Metadata().ID(), 0)
+
+	blockAndAdvance(fakeclock, 15*time.Second)
+
+	assertResource(
+		&suite.OmniSuite,
+		clustersData[0].Metadata(),
+		func(r *omni.EtcdBackupStatus, assertion *assert.Assertions) {
+			value := r.TypedSpec().Value
+
+			assertion.Zero(value.Error, "cluster %s", r.Metadata().ID())
+			assertion.Equalf(specs.EtcdBackupStatusSpec_Ok, value.Status, "cluster %s", r.Metadata().ID())
+			assertion.WithinRange(
+				value.LastBackupTime.AsTime(),
+				now,
+				fakeclock.Now(),
+				"cluster %s",
+				r.Metadata().ID(),
+			)
+			assertion.WithinRange(
+				value.LastBackupAttempt.AsTime(),
+				now,
+				fakeclock.Now(),
+				"cluster %s",
+				r.Metadata().ID(),
+			)
+		},
+	)
+
+	suite.eventuallyFindBackups(sf, clustersData[0].Metadata().ID(), 1)
+
+	blockAndAdvance(fakeclock, 10*time.Minute)
+
+	// Should ignore this backup
+	_, err = safe.StateUpdateWithConflicts(suite.ctx, suite.state, manualBackup.Metadata(), func(b *omni.EtcdManualBackup) error {
+		b.TypedSpec().Value.BackupAt = timestamppb.New(fakeclock.Now().Add(-12 * time.Minute))
+
+		return nil
+	})
+	suite.Require().NoError(err)
+
+	suite.eventuallyFindBackups(sf, clustersData[0].Metadata().ID(), 1)
+
+	for _, clusterData := range clustersData {
+		suite.destroyClusterByID(clusterData.Metadata().ID())
+	}
+}
+
+func (suite *EtcdBackupControllerSuite) TestS3Backup() {
+	fakeclock := fakeClock()
+	logger := zaptest.NewLogger(suite.T())
+
+	backend := newFakeBackend(logger)
+	faker := gofakes3.New(backend)
+
+	ts := httptest.NewServer(faker.Server())
+	defer ts.Close()
+
+	const bucket = "test-bucket"
+
+	suite.Require().NoError(backend.CreateBucket(bucket))
+
+	conf := omni.NewEtcdBackupS3Conf()
+	conf.TypedSpec().Value.Bucket = bucket
+	conf.TypedSpec().Value.Region = "us-east-1"
+	conf.TypedSpec().Value.Endpoint = ts.URL
+	conf.TypedSpec().Value.AccessKeyId = "KEY"
+	conf.TypedSpec().Value.SecretAccessKey = "SECRET"
+
+	require.NoError(suite.T(), suite.state.Create(suite.ctx, conf))
+
+	sf := store.NewS3StoreFactory()
+
+	go func() {
+		err := sf.Start(suite.ctx, suite.state, logger)
+		if err != nil {
+			panic(err)
+		}
+	}()
+
+	clientMock := &talosClientMock{}
+
+	defer clientMock.AssertExpectations(suite.T())
+
+	clientMock.
+		On(xmocks.Name((*talosClientMock).EtcdSnapshot), mock.Anything, mock.Anything, mock.Anything).
+		Return(func() (io.ReadCloser, error) { return io.NopCloser(strings.NewReader("Hello World")), nil })
+
+	suite.register2(omnictrl.NewEtcdBackupController(omnictrl.EtcdBackupControllerSettings{
+		ClientMaker: func(context.Context, string) (omnictrl.TalosClient, error) {
+			return clientMock, nil
+		},
+		StoreFactory: sf,
+		Clock:        fakeclock,
+		TickInterval: 10 * time.Minute,
+	}))
+
+	clusterNames := []string{"talos-default-1"}
+	clusters := createClusters(suite, clusterNames, time.Hour)
+
+	now := fakeclock.Now()
+
+	blockAndAdvance(fakeclock, 11*time.Minute)
+
+	assertResource(
+		&suite.OmniSuite,
+		clusters[0].Metadata(),
+		func(r *omni.EtcdBackupStatus, assertion *assert.Assertions) {
+			value := r.TypedSpec().Value
+
+			assertion.Zero(value.Error, "cluster %s", r.Metadata().ID())
+			assertion.Equalf(specs.EtcdBackupStatusSpec_Ok, value.Status, "cluster %s", r.Metadata().ID())
+			assertion.WithinRange(
+				value.LastBackupTime.AsTime(),
+				now,
+				fakeclock.Now(),
+				"cluster %s",
+				r.Metadata().ID(),
+			)
+			assertion.WithinRange(
+				value.LastBackupAttempt.AsTime(),
+				now,
+				fakeclock.Now(),
+				"cluster %s",
+				r.Metadata().ID(),
+			)
+		},
+	)
+
+	buckets := must.Value(backend.ListBuckets())(suite.T())
+
+	for _, b := range buckets {
+		suite.T().Logf("bucket: %s", b.Name)
+	}
+
+	iter, err := must.Value(sf.GetStore())(suite.T()).ListBackups(suite.ctx, clusters[0].TypedSpec().Value.ClusterUuid)
+	suite.Require().NoError(err)
+
+	backups := toSlice(iter, suite.T())
+	suite.Require().Len(backups, 1)
+
+	reader := must.Value(backups[0].Reader())(suite.T())
+
+	suite.T().Cleanup(func() { suite.Require().NoError(reader.Close()) })
+
+	decryptedHeader, decrypter := must.Values(crypt.Decrypt(
+		reader,
+		clusters[0].TypedSpec().Value.EncryptionKey,
+	))(suite.T())
+
+	suite.Require().EqualValues(
+		clusters[0].TypedSpec().Value.AesCbcEncryptionSecret,
+		decryptedHeader.AESCBCEncryptionSecret,
+	)
+	suite.Require().EqualValues(
+		clusters[0].TypedSpec().Value.SecretboxEncryptionSecret,
+		decryptedHeader.SecretboxEncryptionSecret,
+	)
+	suite.Require().EqualValues("Hello World", string(must.Value(io.ReadAll(decrypter))(suite.T())))
+}
+
+func (suite *EtcdBackupControllerSuite) fileStoreFactory() store.Factory {
+	dir := filepath.Join(suite.T().TempDir(), "omni-etcd-backups")
+
+	return store.NewFileStoreStoreFactory(dir)
+}
+
+func (suite *EtcdBackupControllerSuite) eventuallyFindBackups(sf store.Factory, clusterID string, num int) []etcdbackup.Info {
+	var result []etcdbackup.Info
+
+	suite.Require().EventuallyWithT(func(collect *assert.CollectT) {
+		st, err := sf.GetStore()
+		if err != nil {
+			collect.Errorf("failed to get store: %s", err)
+
+			return
+		}
+
+		bd := must.Value(safe.StateGetByID[*omni.BackupData](suite.ctx, suite.state, clusterID))(suite.T())
+		iter := must.Value(st.ListBackups(suite.ctx, bd.TypedSpec().Value.ClusterUuid))(suite.T())
+		result = toSlice(iter, suite.T())
+
+		assert.Len(collect, result, num, "cluster %s", clusterID)
+	}, 15*time.Second, 100*time.Microsecond)
+
+	return result
+}
+
+func createClusters(suite *EtcdBackupControllerSuite, clusterNames []string, backupInterval time.Duration) []*omni.BackupData {
+	return xslices.Map(clusterNames, func(clusterName string) *omni.BackupData {
+		cluster, _ := suite.createCluster(clusterName, 1, 1)
+
+		must.Value(safe.StateUpdateWithConflicts(suite.ctx, suite.state, cluster.Metadata(), func(cl *omni.Cluster) error {
+			cl.TypedSpec().Value.BackupConfiguration = &specs.EtcdBackupConf{Interval: durationpb.New(backupInterval), Enabled: true}
+
+			return nil
+		}))(suite.T())
+
+		var result *omni.BackupData
+
+		assertResource(
+			&suite.OmniSuite,
+			cluster.Metadata(),
+			func(r *omni.BackupData, _ *assert.Assertions) {
+				result = r
+			},
+		)
+
+		return result
+	})
+}
+
+type talosClientMock struct{ mock.Mock }
+
+func (t *talosClientMock) EtcdSnapshot(ctx context.Context, req *machine.EtcdSnapshotRequest, callOptions ...grpc.CallOption) (io.ReadCloser, error) {
+	args := t.Called(ctx, req, callOptions)
+
+	return xmocks.GetAs[func() (io.ReadCloser, error)](args, 0)()
+}
+
+type storeMock struct{ mock.Mock }
+
+func (s *storeMock) ListBackups(ctx context.Context, clusterUUID string) (etcdbackup.InfoIterator, error) {
+	args := s.Called(ctx, clusterUUID)
+
+	return xmocks.Cast2[etcdbackup.InfoIterator, error](args)
+}
+
+func (s *storeMock) Upload(ctx context.Context, descr etcdbackup.Description, r io.Reader) error {
+	args := s.Called(ctx, descr, r)
+
+	return xmocks.GetAs[error](args, 0)
+}
+
+func (s *storeMock) Download(ctx context.Context, clusterUUID []byte, clusterName, snapshotName string) (etcdbackup.BackupData, io.ReadCloser, error) {
+	args := s.Called(ctx, clusterUUID, clusterName, snapshotName)
+
+	return xmocks.Cast3[etcdbackup.BackupData, io.ReadCloser, error](args)
+}
+
+type storeFactoryMock struct{ mock.Mock }
+
+func (s *storeFactoryMock) GetStore() (etcdbackup.Store, error) {
+	args := s.Called()
+
+	return xmocks.Cast2[etcdbackup.Store, error](args)
+}
+
+func (s *storeFactoryMock) Start(ctx context.Context, st state.State, l *zap.Logger) error {
+	args := s.Called(ctx, st, l)
+
+	return xmocks.GetAs[error](args, 0)
+}
+
+func (s *storeFactoryMock) Description() string {
+	return "mock store"
+}
+
+func toIter(infos []etcdbackup.Info) etcdbackup.InfoIterator {
+	return func() (etcdbackup.Info, bool, error) {
+		if len(infos) == 0 {
+			return etcdbackup.Info{}, false, nil
+		}
+
+		info := infos[0]
+		infos = infos[1:]
+
+		return info, true, nil
+	}
+}
+
+func toSlice(iter etcdbackup.InfoIterator, t *testing.T) []etcdbackup.Info {
+	var result []etcdbackup.Info
+
+	for {
+		info, ok := must.Values(iter())(t)
+		if !ok {
+			break
+		}
+
+		result = append(result, info)
+	}
+
+	return result
+}
+
+func fakeClock() clockwork.FakeClock {
+	return clockwork.NewFakeClockAt(time.Unix(0, 0).UTC())
+}
+
+func blockAndAdvance(fc clockwork.FakeClock, duration time.Duration) {
+	fc.BlockUntil(1)
+	fc.Advance(duration)
+}
+
+type fakeBackend struct {
+	*s3mem.Backend
+	logger *zap.Logger
+}
+
+func (f *fakeBackend) ListBuckets() ([]gofakes3.BucketInfo, error) {
+	f.logger.Info("ListBuckets")
+
+	return f.Backend.ListBuckets()
+}
+
+func (f *fakeBackend) BucketExists(name string) (exists bool, err error) {
+	f.logger.Info("BucketExists", zap.String("name", name))
+
+	return f.Backend.BucketExists(name)
+}
+
+func (f *fakeBackend) PutObject(bucketName, key string, meta map[string]string, input io.Reader, size int64) (gofakes3.PutObjectResult, error) {
+	f.logger.Info("PutObject", zap.String("bucket_name", bucketName), zap.String("key", key), zap.Any("meta", meta), zap.Int64("size", size))
+
+	return f.Backend.PutObject(bucketName, key, meta, input, size)
+}
+
+func newFakeBackend(logger *zap.Logger) *fakeBackend {
+	return &fakeBackend{s3mem.New(), logger}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/etcdbackup/etcdbackup.go b/internal/backend/runtime/omni/controllers/omni/etcdbackup/etcdbackup.go
new file mode 100644
index 000000000..2f0888d14
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/etcdbackup/etcdbackup.go
@@ -0,0 +1,80 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package etcdbackup implements is a public part of internal/etcdbackup package.
+package etcdbackup
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// InfoIterator is a function that returns next backup info.
+type InfoIterator func() (Info, bool, error)
+
+// Lister is an interface that is used to list etcd backups.
+type Lister interface {
+	ListBackups(ctx context.Context, clusterUUID string) (InfoIterator, error)
+}
+
+// Store is an interface that is used to upload etcd backups.
+type Store interface {
+	Lister
+	Upload(ctx context.Context, descr Description, r io.Reader) error
+	Download(ctx context.Context, encryptionKey []byte, clusterUUID, snapshotName string) (BackupData, io.ReadCloser, error)
+}
+
+// Description is a data that is used to describe backup.
+type Description struct {
+	Timestamp      time.Time
+	ClusterUUID    string
+	ClusterName    string
+	EncryptionData EncryptionData
+}
+
+// Info describes existing etcd backup that we got from external resources such as S3 or filesystem.
+type Info struct {
+	Timestamp time.Time
+	Reader    func() (io.ReadCloser, error)
+	Snapshot  string
+	Size      int64
+}
+
+// BackupData contains additional data related to the etcd backup.
+type BackupData struct {
+	AESCBCEncryptionSecret    string
+	SecretboxEncryptionSecret string
+}
+
+// EncryptionData contains data required to encrypt etcd backup.
+type EncryptionData struct {
+	AESCBCEncryptionSecret    string
+	SecretboxEncryptionSecret string
+	EncryptionKey             []byte
+}
+
+// CreateSnapshotName creates a name for a snapshot.
+func CreateSnapshotName(timestamp time.Time) string {
+	return fmt.Sprintf("%016X.snapshot", uint64(-timestamp.Unix()))
+}
+
+// ParseSnapshotName parses a snapshot name. Returns backup timestamp and expiration.
+func ParseSnapshotName(name string) (time.Time, error) {
+	reverseTSRaw, found := strings.CutSuffix(name, ".snapshot")
+	if !found {
+		return time.Time{}, fmt.Errorf("failed to parse snapshot %q, invalid suffix", name)
+	}
+
+	reverseTS, err := strconv.ParseUint(reverseTSRaw, 16, 64)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("failed to parse snapshot %q : %w", name, err)
+	}
+
+	return time.Unix(int64(-reverseTS), 0), nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/etcdbackup/etcdbackup_test.go b/internal/backend/runtime/omni/controllers/omni/etcdbackup/etcdbackup_test.go
new file mode 100644
index 000000000..1b4a91e49
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/etcdbackup/etcdbackup_test.go
@@ -0,0 +1,56 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package etcdbackup_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/siderolabs/gen/xtesting/check"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+)
+
+func TestParseSnapshotName(t *testing.T) {
+	date := time.Date(2012, 1, 1, 12, 0, 0, 0, time.UTC).In(time.Local)
+	name := etcdbackup.CreateSnapshotName(date)
+	require.EqualValues(t, "FFFFFFFFB0FFB540.snapshot", name)
+
+	nextDate := date.Add(time.Second)
+	nextName := etcdbackup.CreateSnapshotName(nextDate)
+	require.EqualValues(t, "FFFFFFFFB0FFB53F.snapshot", nextName)
+
+	require.Less(t, nextName, name)
+
+	//nolint:govet
+	tests := map[string]struct {
+		snapshotName string
+		timestamp    time.Time
+		wantErr      check.Check
+	}{
+		"no error": {
+			snapshotName: name,
+			timestamp:    date,
+			wantErr:      check.NoError(),
+		},
+		"empty text": {
+			snapshotName: "",
+			wantErr:      check.EqualError(`failed to parse snapshot "", invalid suffix`),
+		},
+		"letters and numbers": {
+			snapshotName: "FFFFFFFFB0FGB540.snapshot",
+			wantErr:      check.ErrorContains(`: invalid syntax`),
+		},
+	}
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			timestamp, err := etcdbackup.ParseSnapshotName(tt.snapshotName)
+			tt.wantErr(t, err)
+			require.EqualValues(t, tt.timestamp, timestamp)
+		})
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/disabledstore.go b/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/disabledstore.go
new file mode 100644
index 000000000..8d9f9c241
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/disabledstore.go
@@ -0,0 +1,37 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package store
+
+import (
+	"context"
+	"errors"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+)
+
+// DisabledStoreFactory is a disabled store factory.
+var DisabledStoreFactory Factory = &disabledStoreFactory{}
+
+type disabledStoreFactory struct{}
+
+func (d *disabledStoreFactory) GetStore() (etcdbackup.Store, error) {
+	return nil, errors.New("etcd backup store is disabled")
+}
+
+func (d *disabledStoreFactory) Start(ctx context.Context, state state.State, _ *zap.Logger) error {
+	if err := setStatus(ctx, state, "disabled", ""); err != nil {
+		return err
+	}
+
+	<-ctx.Done()
+
+	return nil
+}
+
+func (d *disabledStoreFactory) Description() string { return "disabled store" }
diff --git a/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/filestore.go b/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/filestore.go
new file mode 100644
index 000000000..ed25092e6
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/filestore.go
@@ -0,0 +1,46 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package store
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+type fileStoreFactory struct {
+	store *crypt.Store
+	path  string
+}
+
+// NewFileStoreStoreFactory returns a new file store factory.
+func NewFileStoreStoreFactory(path string) Factory {
+	return &fileStoreFactory{
+		store: crypt.NewStore(fstore.NewFileStore(path)),
+		path:  config.Config.EtcdBackup.LocalPath,
+	}
+}
+
+func (f *fileStoreFactory) GetStore() (etcdbackup.Store, error) { return f.store, nil }
+
+func (f *fileStoreFactory) Start(ctx context.Context, state state.State, _ *zap.Logger) error {
+	if err := setStatus(ctx, state, "local", ""); err != nil {
+		return err
+	}
+
+	<-ctx.Done()
+
+	return nil
+}
+
+func (f *fileStoreFactory) Description() string { return fmt.Sprintf("local store: %s", f.path) }
diff --git a/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/metrics.go b/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/metrics.go
new file mode 100644
index 000000000..f33927c78
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/metrics.go
@@ -0,0 +1,144 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package store
+
+import (
+	"context"
+	"io"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/prometheus/client_golang/prometheus"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+)
+
+// FactoryWithMetrics is a factory for etcd backup stores with metrics.
+type FactoryWithMetrics interface {
+	Factory
+	prometheus.Collector
+}
+
+type factoryWithMetrics struct {
+	factory       Factory
+	uploads       *prometheus.CounterVec
+	downloads     *prometheus.CounterVec
+	uploadBytes   prometheus.Counter
+	downloadBytes prometheus.Counter
+}
+
+func newFactoryWithMetrics(factory Factory) FactoryWithMetrics {
+	return &factoryWithMetrics{
+		factory: factory,
+		uploads: prometheus.NewCounterVec(prometheus.CounterOpts{
+			Name: "omni_etcdbackup_store_uploads_total",
+			Help: "Number of etcd backup uploads",
+		}, []string{"status"}),
+		downloads: prometheus.NewCounterVec(prometheus.CounterOpts{
+			Name: "omni_etcdbackup_store_downloads_total",
+			Help: "Number of etcd backup downloads",
+		}, []string{"status"}),
+		uploadBytes: prometheus.NewCounter(prometheus.CounterOpts{
+			Name: "omni_etcdbackup_store_transferred_bytes_total",
+			Help: "Number of bytes transferred during etcd backup uploads",
+		}),
+		downloadBytes: prometheus.NewCounter(prometheus.CounterOpts{
+			Name: "omni_etcdbackup_store_downloaded_bytes_total",
+			Help: "Number of bytes transferred during etcd backup downloads",
+		}),
+	}
+}
+
+func (s *factoryWithMetrics) Describe(ch chan<- *prometheus.Desc) {
+	prometheus.DescribeByCollect(s, ch)
+}
+
+func (s *factoryWithMetrics) Collect(ch chan<- prometheus.Metric) {
+	s.uploads.Collect(ch)
+	s.downloads.Collect(ch)
+	s.uploadBytes.Collect(ch)
+	s.downloadBytes.Collect(ch)
+}
+
+func (s *factoryWithMetrics) Start(ctx context.Context, state state.State, logger *zap.Logger) error {
+	return s.factory.Start(ctx, state, logger)
+}
+
+func (s *factoryWithMetrics) GetStore() (etcdbackup.Store, error) {
+	store, err := s.factory.GetStore()
+	if err != nil {
+		return nil, err
+	}
+
+	return &storeWithMetrics{
+		store:   store,
+		metrics: s,
+	}, nil
+}
+
+func (s *factoryWithMetrics) Description() string {
+	return s.factory.Description()
+}
+
+type storeWithMetrics struct {
+	store   etcdbackup.Store
+	metrics *factoryWithMetrics
+}
+
+func (s *storeWithMetrics) ListBackups(ctx context.Context, clusterUUID string) (etcdbackup.InfoIterator, error) {
+	return s.store.ListBackups(ctx, clusterUUID)
+}
+
+func (s *storeWithMetrics) Upload(ctx context.Context, descr etcdbackup.Description, r io.Reader) error {
+	err := s.store.Upload(ctx, descr, &readCloserWithMetrics{
+		readCloser: io.NopCloser(r),
+		counter:    s.metrics.uploadBytes,
+	})
+	if err != nil {
+		s.metrics.uploads.WithLabelValues("error").Inc()
+
+		return err
+	}
+
+	s.metrics.uploads.WithLabelValues("success").Inc()
+
+	return nil
+}
+
+func (s *storeWithMetrics) Download(ctx context.Context, encryptionKey []byte, clusterUUID, snapshotName string) (etcdbackup.BackupData, io.ReadCloser, error) {
+	backupData, readCloser, err := s.store.Download(ctx, encryptionKey, clusterUUID, snapshotName)
+	if err != nil {
+		s.metrics.downloads.WithLabelValues("error").Inc()
+
+		return backupData, readCloser, err
+	}
+
+	s.metrics.downloads.WithLabelValues("success").Inc()
+
+	metricsWrapper := readCloserWithMetrics{
+		readCloser: readCloser,
+		counter:    s.metrics.downloadBytes,
+	}
+
+	return backupData, &metricsWrapper, err
+}
+
+type readCloserWithMetrics struct {
+	readCloser io.ReadCloser
+	counter    prometheus.Counter
+}
+
+func (r *readCloserWithMetrics) Read(p []byte) (n int, err error) {
+	n, err = r.readCloser.Read(p)
+
+	r.counter.Add(float64(n))
+
+	return n, err
+}
+
+func (r *readCloserWithMetrics) Close() error {
+	return r.readCloser.Close()
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/s3store.go b/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/s3store.go
new file mode 100644
index 000000000..422a7e603
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/s3store.go
@@ -0,0 +1,224 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package store
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"sync"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awsConfig "github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/credentials/ec2rolecreds"
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/go-pointer"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/s3store"
+)
+
+// S3StoreFactory is a factory for S3 stores.
+type S3StoreFactory struct { //nolint:govet
+	mx     sync.Mutex
+	store  etcdbackup.Store
+	err    error
+	bucket string
+}
+
+// NewS3StoreFactory returns a new S3 store factory.
+func NewS3StoreFactory() Factory {
+	return &S3StoreFactory{}
+}
+
+// ErrS3NotInitialized is returned when the store is not initialized.
+var ErrS3NotInitialized = errors.New("s3 store is not initialized")
+
+// GetStore returns the store and error. If the store is not initialized, it returns [ErrS3NotInitialized].
+func (sf *S3StoreFactory) GetStore() (etcdbackup.Store, error) {
+	sf.mx.Lock()
+	defer sf.mx.Unlock()
+
+	if sf.store == nil && sf.err == nil {
+		return nil, ErrS3NotInitialized
+	}
+
+	return sf.store, sf.err
+}
+
+// Start starts watching the state for [*omni.EtcdBackupS3Conf] updates and updates the store and error accordingly.
+func (sf *S3StoreFactory) Start(ctx context.Context, st state.State, logger *zap.Logger) error {
+	if err := setStatus(ctx, st, "s3", "initializing"); err != nil {
+		return err
+	}
+
+	eventCh := make(chan safe.WrappedStateEvent[*omni.EtcdBackupS3Conf])
+
+	err := safe.StateWatch(ctx, st, omni.NewEtcdBackupS3Conf().Metadata(), eventCh)
+	if err != nil {
+		return fmt.Errorf("failed to watch EtcdBackupS3Conf: %w", err)
+	}
+
+	logger.Debug("s3 store factory started")
+
+	for {
+		select {
+		case <-ctx.Done():
+			if errors.Is(ctx.Err(), context.Canceled) {
+				logger.Debug("s3 store factory context canceled")
+
+				return nil
+			}
+
+			return fmt.Errorf("store factory context error: %w", ctx.Err())
+		case ev := <-eventCh:
+			if err = ev.Error(); err != nil {
+				logger.Error("s3 store factory error", zap.Error(err))
+
+				return fmt.Errorf("s3 store factory error: %w", err)
+			}
+
+			var resource *omni.EtcdBackupS3Conf
+
+			if ev.Type() != state.Destroyed {
+				resource, err = ev.Resource()
+				if err != nil {
+					logger.Error("s3 store: got incorrect resource", zap.Error(err))
+
+					return fmt.Errorf("s3 store: got incorrect resource: %w", err)
+				}
+			}
+
+			err = sf.updateStore(ctx, st, resource, logger)
+			if err != nil {
+				logger.Error("s3 store factory error", zap.Error(err))
+
+				return fmt.Errorf("s3 store factory error: %w", err)
+			}
+		}
+	}
+}
+
+func (sf *S3StoreFactory) updateStore(ctx context.Context, st state.State, resource *omni.EtcdBackupS3Conf, logger *zap.Logger) error {
+	sf.mx.Lock()
+	defer sf.mx.Unlock()
+
+	sf.store = nil
+	sf.err = nil
+	sf.bucket = ""
+
+	if IsEmptyS3Conf(resource) {
+		logger.Debug("s3 store client is now nil")
+
+		return updateS3Status(ctx, st, "not initialized")
+	}
+
+	client, bucket, err := S3ClientFromResource(ctx, resource)
+	if err != nil {
+		sf.err = err
+
+		return updateS3Status(ctx, st, err.Error())
+	}
+
+	sf.store = crypt.NewStore(s3store.NewStore(client, manager.NewUploader(client), bucket))
+	sf.bucket = bucket
+
+	logger.Debug("s3 store client is now set", zap.String("bucket", bucket))
+
+	return updateS3Status(ctx, st, "")
+}
+
+// S3ClientFromResource returns an S3 client and a bucket name.
+func S3ClientFromResource(ctx context.Context, s3Conf *omni.EtcdBackupS3Conf) (*s3.Client, string, error) {
+	bucket := s3Conf.TypedSpec().Value.GetBucket()
+	if bucket == "" {
+		return nil, "", errors.New("bucket must be specified")
+	}
+
+	accessKey := s3Conf.TypedSpec().Value.GetAccessKeyId()
+	secretKey := s3Conf.TypedSpec().Value.GetSecretAccessKey()
+	sessionToken := s3Conf.TypedSpec().Value.GetSessionToken()
+
+	if (accessKey == "" && secretKey != "") || (accessKey != "" && secretKey == "") {
+		return nil, "", errors.New("access key and secret key must be specified together")
+	}
+
+	var opts []func(*awsConfig.LoadOptions) error
+
+	if accessKey == "" && secretKey == "" {
+		opts = append(opts, awsConfig.WithCredentialsProvider(ec2rolecreds.New()))
+	} else {
+		opts = append(opts, awsConfig.WithCredentialsProvider(credentials.NewStaticCredentialsProvider(accessKey, secretKey, sessionToken)))
+	}
+
+	if region := s3Conf.TypedSpec().Value.GetRegion(); region != "" {
+		opts = append(opts, awsConfig.WithRegion(region))
+	}
+
+	if endpoint := s3Conf.TypedSpec().Value.GetEndpoint(); endpoint != "" {
+		if strings.HasPrefix(endpoint, "http://") {
+			opts = append(opts, awsConfig.WithHTTPClient(&http.Client{
+				Transport: &http.Transport{
+					TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+				},
+			}))
+		}
+
+		opts = append(opts, awsConfig.WithEndpointResolverWithOptions(
+			aws.EndpointResolverWithOptionsFunc(func(_, region string, _ ...any) (aws.Endpoint, error) {
+				return aws.Endpoint{URL: endpoint, HostnameImmutable: true, PartitionID: "aws", SigningRegion: region}, nil
+			}),
+		))
+	}
+
+	loadedCfg, err := awsConfig.LoadDefaultConfig(ctx, opts...)
+	if err != nil {
+		return nil, "", fmt.Errorf("failed to load aws config: %w", err)
+	}
+
+	client := s3.NewFromConfig(loadedCfg, func(o *s3.Options) { o.UsePathStyle = true })
+
+	_, err = client.ListObjects(ctx, &s3.ListObjectsInput{Bucket: pointer.To(bucket)})
+	if err != nil {
+		return nil, "", fmt.Errorf("failed to list objects in bucket %q: %w", bucket, err)
+	}
+
+	return client, bucket, nil
+}
+
+// Description returns a description of the store.
+func (sf *S3StoreFactory) Description() string {
+	sf.mx.Lock()
+	defer sf.mx.Unlock()
+
+	return fmt.Sprintf("s3 store: bucket %q", sf.bucket)
+}
+
+// IsEmptyS3Conf returns true if the resource is empty.
+func IsEmptyS3Conf(res *omni.EtcdBackupS3Conf) bool {
+	if res == nil {
+		return true
+	}
+
+	value := res.TypedSpec().Value
+
+	return value.GetAccessKeyId() == "" &&
+		value.GetSecretAccessKey() == "" &&
+		value.GetSessionToken() == "" &&
+		value.GetBucket() == "" &&
+		value.GetRegion() == "" &&
+		value.GetEndpoint() == ""
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/store.go b/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/store.go
new file mode 100644
index 000000000..6e64175f5
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/etcdbackup/store/store.go
@@ -0,0 +1,79 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package store implements a factory for etcd backup stores.
+package store
+
+import (
+	"context"
+	"fmt"
+	"sync"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+// Factory is a factory for etcd backup stores.
+type Factory interface {
+	GetStore() (etcdbackup.Store, error)
+	Start(context.Context, state.State, *zap.Logger) error
+	Description() string
+}
+
+// NewStoreFactory returns a new store factory.
+func NewStoreFactory() (FactoryWithMetrics, error) {
+	return newEtcdBackupStoreFactory()
+}
+
+var newEtcdBackupStoreFactory = sync.OnceValues(func() (FactoryWithMetrics, error) {
+	storageType, err := config.Config.EtcdBackup.GetStorageType()
+	if err != nil {
+		return nil, err
+	}
+
+	var result Factory
+
+	switch storageType {
+	case config.EtcdBackupTypeS3:
+		result = NewS3StoreFactory()
+	case config.EtcdBackupTypeFS:
+		result = NewFileStoreStoreFactory(config.Config.EtcdBackup.LocalPath)
+	case config.EtcdBackupTypeNone:
+		result = DisabledStoreFactory
+	default:
+		return nil, fmt.Errorf("unknown storage type: %q", storageType)
+	}
+
+	return newFactoryWithMetrics(result), nil
+})
+
+func setStatus(ctx context.Context, st state.State, confName, errString string) error {
+	status := omni.NewEtcdBackupStoreStatus()
+	status.TypedSpec().Value.ConfigurationName = confName
+	status.TypedSpec().Value.ConfigurationError = errString
+
+	if err := st.Create(ctx, status); err != nil {
+		return fmt.Errorf("failed to create etcd backup overall status: %w", err)
+	}
+
+	return nil
+}
+
+func updateS3Status(ctx context.Context, st state.State, errString string) error {
+	if _, err := safe.StateUpdateWithConflicts(ctx, st, omni.NewEtcdBackupStoreStatus().Metadata(), func(result *omni.EtcdBackupStoreStatus) error {
+		result.TypedSpec().Value.ConfigurationError = errString
+
+		return nil
+	}); err != nil {
+		return fmt.Errorf("failed to update etcd backup overall status: %w", err)
+	}
+
+	return nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/export_test.go b/internal/backend/runtime/omni/controllers/omni/export_test.go
new file mode 100644
index 000000000..c02209a8c
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/export_test.go
@@ -0,0 +1,30 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/siderolabs/talos/pkg/machinery/compatibility"
+	"github.com/siderolabs/talos/pkg/machinery/config"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+func ForAllCompatibleVersions(
+	talosVersions []string,
+	k8sVersions []*compatibility.KubernetesVersion,
+	fn func(talosVersion string, k8sVersions []string) error,
+) error {
+	return forAllCompatibleVersions(talosVersions, k8sVersions, fn)
+}
+
+func GetMachineSetNodeSortFunction(machineStatuses map[resource.ID]*omni.MachineStatus) func(a, b *omni.MachineSetNode) int {
+	return getSortFunction(machineStatuses)
+}
+
+func StripTalosAPIAccessOSAdminRole(cfg config.Provider) (config.Provider, error) {
+	return stripTalosAPIAccessOSAdminRole(cfg)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/image/client.go b/internal/backend/runtime/omni/controllers/omni/image/client.go
new file mode 100644
index 000000000..92a9205c2
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/image/client.go
@@ -0,0 +1,85 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package image
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+
+	"github.com/siderolabs/talos/pkg/machinery/api/common"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+
+	"github.com/siderolabs/omni/internal/backend/grpc/router"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+)
+
+// Client is the interface for interacting with the container images on a Talos machine.
+type Client interface {
+	ListImagesOnNode(ctx context.Context, cluster, node string) ([]string, error)
+	PullImageToNode(ctx context.Context, cluster, node, image string) error
+}
+
+// TalosImageClient implements kubernetes.ImageClient interface.
+type TalosImageClient struct {
+	TalosClientFactory *talos.ClientFactory
+	NodeResolver       router.NodeResolver
+}
+
+// ListImagesOnNode lists images on a node.
+func (c *TalosImageClient) ListImagesOnNode(ctx context.Context, cluster, node string) ([]string, error) {
+	talosCli, err := c.TalosClientFactory.Get(ctx, cluster)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get talos client: %w", err)
+	}
+
+	nodeAddress := c.NodeResolver.Resolve(cluster, node).Address
+
+	imageListStream, err := talosCli.ImageList(client.WithNode(ctx, nodeAddress), common.ContainerdNamespace_NS_CRI)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list images: %w", err)
+	}
+
+	return c.readImagesFromStream(imageListStream)
+}
+
+func (c *TalosImageClient) readImagesFromStream(stream machine.MachineService_ImageListClient) ([]string, error) {
+	var images []string
+
+	for {
+		item, err := stream.Recv()
+		if err != nil {
+			if errors.Is(err, io.EOF) {
+				return images, nil
+			}
+
+			return nil, fmt.Errorf("error streaming results: %w", err)
+		}
+
+		images = append(images, item.GetName())
+	}
+}
+
+// PullImageToNode pulls the given image to the given node.
+func (c *TalosImageClient) PullImageToNode(ctx context.Context, cluster, node, image string) error {
+	talosCli, err := c.TalosClientFactory.Get(ctx, cluster)
+	if err != nil {
+		return fmt.Errorf("failed to get talos client: %w", err)
+	}
+
+	nodeAddress := c.NodeResolver.Resolve(cluster, node).Address
+	if nodeAddress == "" {
+		return fmt.Errorf("failed to resolve node %q", node)
+	}
+
+	if err = talosCli.ImagePull(client.WithNode(ctx, nodeAddress), common.ContainerdNamespace_NS_CRI, image); err != nil {
+		return fmt.Errorf("failed to pull image %s: %w", image, err)
+	}
+
+	return nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/image/image.go b/internal/backend/runtime/omni/controllers/omni/image/image.go
new file mode 100644
index 000000000..6246764b4
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/image/image.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package image implements operations related to container images on a Talos node.
+package image
diff --git a/internal/backend/runtime/omni/controllers/omni/image_pull_status.go b/internal/backend/runtime/omni/controllers/omni/image_pull_status.go
new file mode 100644
index 000000000..642a9dd9b
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/image_pull_status.go
@@ -0,0 +1,183 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/image"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/task"
+	imagetask "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/task/image"
+)
+
+// ImagePullStatusController manages ImagePullStatus resource lifecycle.
+type ImagePullStatusController struct {
+	runner *task.Runner[imagetask.PullStatusChan, imagetask.PullTaskSpec]
+
+	imageClient image.Client
+}
+
+// NewImagePullStatusController creates new ImagePullStatusController.
+func NewImagePullStatusController(imageClient image.Client) *ImagePullStatusController {
+	return &ImagePullStatusController{
+		imageClient: imageClient,
+	}
+}
+
+// Name implements controller.Controller interface.
+func (ctrl *ImagePullStatusController) Name() string {
+	return "ImagePullStatusController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *ImagePullStatusController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Type:      omni.ImagePullRequestType,
+			Kind:      controller.InputWeak,
+			Namespace: resources.DefaultNamespace,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *ImagePullStatusController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.ImagePullStatusType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *ImagePullStatusController) Run(ctx context.Context, r controller.Runtime, logger *zap.Logger) (retErr error) {
+	ctrl.runner = task.NewEqualRunner[imagetask.PullTaskSpec]()
+	defer ctrl.runner.Stop()
+
+	pullStatusCh := make(chan imagetask.PullStatus)
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case pullStatus := <-pullStatusCh:
+			if err := ctrl.updatePullStatus(ctx, r, pullStatus); err != nil {
+				return err
+			}
+		case <-r.EventCh():
+			if err := ctrl.handleEvent(ctx, r, logger, pullStatusCh); err != nil {
+				return fmt.Errorf("error handling event: %w", err)
+			}
+		}
+
+		r.ResetRestartBackoff()
+	}
+}
+
+func (ctrl *ImagePullStatusController) updatePullStatus(ctx context.Context, r controller.Runtime, pullStatus imagetask.PullStatus) error {
+	if err := safe.WriterModify[*omni.ImagePullStatus](ctx, r,
+		omni.NewImagePullStatus(resources.DefaultNamespace, pullStatus.Request.Metadata().ID()),
+		func(status *omni.ImagePullStatus) error {
+			CopyAllLabels(pullStatus.Request, status)
+
+			status.TypedSpec().Value.LastProcessedNode = pullStatus.Node
+			status.TypedSpec().Value.LastProcessedImage = pullStatus.Image
+			status.TypedSpec().Value.ProcessedCount = uint32(pullStatus.CurrentNum)
+			status.TypedSpec().Value.TotalCount = uint32(pullStatus.TotalNum)
+
+			if pullStatus.Error != nil {
+				status.TypedSpec().Value.LastProcessedError = pullStatus.Error.Error()
+			} else {
+				status.TypedSpec().Value.LastProcessedError = ""
+			}
+
+			status.TypedSpec().Value.RequestVersion = pullStatus.Request.Metadata().Version().String()
+
+			return nil
+		},
+	); err != nil {
+		return fmt.Errorf("error updating ImagePullStatus: %w", err)
+	}
+
+	return nil
+}
+
+func (ctrl *ImagePullStatusController) handleEvent(ctx context.Context, r controller.Runtime, logger *zap.Logger, pullStatusCh chan<- imagetask.PullStatus) error {
+	requests, err := safe.ReaderListAll[*omni.ImagePullRequest](ctx, r)
+	if err != nil {
+		return fmt.Errorf("error listing ImagePullRequest resources: %w", err)
+	}
+
+	statusIDToStatus, err := ctrl.getStatusIDToStatus(ctx, r)
+	if err != nil {
+		return err
+	}
+
+	tracker := trackResource(r, resources.DefaultNamespace, omni.ImagePullStatusType)
+
+	expectedPullTasks := map[string]imagetask.PullTaskSpec{}
+
+	for iter := requests.Iterator(); iter.Next(); {
+		request := iter.Value()
+
+		tracker.keep(request)
+
+		if request.Metadata().Phase() == resource.PhaseTearingDown {
+			continue
+		}
+
+		if ctrl.requestIsAlreadyProcessed(statusIDToStatus, request) {
+			continue
+		}
+
+		expectedPullTasks[request.Metadata().ID()] = imagetask.NewPullTaskSpec(request, ctrl.imageClient)
+	}
+
+	ctrl.runner.Reconcile(ctx, logger, expectedPullTasks, pullStatusCh)
+
+	if err = tracker.cleanup(ctx); err != nil { // clean up the orphaned ImagePullStatuses
+		return fmt.Errorf("error cleaning up stale ImagePullStatus resources: %w", err)
+	}
+
+	return nil
+}
+
+func (ctrl *ImagePullStatusController) getStatusIDToStatus(ctx context.Context, r controller.Runtime) (map[resource.ID]*omni.ImagePullStatus, error) {
+	statuses, err := safe.ReaderListAll[*omni.ImagePullStatus](ctx, r)
+	if err != nil {
+		return nil, fmt.Errorf("error listing ImagePullStatus resources: %w", err)
+	}
+
+	statusMap := make(map[resource.ID]*omni.ImagePullStatus, statuses.Len())
+
+	for iter := statuses.Iterator(); iter.Next(); {
+		status := iter.Value()
+
+		statusMap[status.Metadata().ID()] = status
+	}
+
+	return statusMap, nil
+}
+
+func (ctrl *ImagePullStatusController) requestIsAlreadyProcessed(statusIDToStatus map[resource.ID]*omni.ImagePullStatus, req *omni.ImagePullRequest) bool {
+	sts, ok := statusIDToStatus[req.Metadata().ID()]
+	if !ok {
+		return false
+	}
+
+	stsSpec := sts.TypedSpec().Value
+
+	return stsSpec.RequestVersion == req.Metadata().Version().String() && stsSpec.ProcessedCount == stsSpec.TotalCount
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/image_pull_status_test.go b/internal/backend/runtime/omni/controllers/omni/image_pull_status_test.go
new file mode 100644
index 000000000..303023535
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/image_pull_status_test.go
@@ -0,0 +1,227 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type listImagesRequest struct {
+	cluster string
+	node    string
+}
+
+type pullImageRequest struct {
+	cluster string
+	node    string
+	image   string
+}
+
+type mockImageClient struct {
+	state state.State
+
+	listRequests []listImagesRequest
+	pullRequests []pullImageRequest
+
+	lock sync.Mutex
+}
+
+func (m *mockImageClient) ListImagesOnNode(_ context.Context, cluster, node string) ([]string, error) {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+
+	m.listRequests = append(m.listRequests, listImagesRequest{
+		cluster: cluster,
+		node:    node,
+	})
+
+	return []string{node + "-image-1"}, nil // mimic <node>-image-1 being already on the node
+}
+
+func (m *mockImageClient) PullImageToNode(_ context.Context, cluster, node, image string) error {
+	m.lock.Lock()
+	defer m.lock.Unlock()
+
+	m.pullRequests = append(m.pullRequests, pullImageRequest{
+		cluster: cluster,
+		node:    node,
+		image:   image,
+	})
+
+	return nil
+}
+
+func TestImagePullStatusControllerSuite(t *testing.T) {
+	suite.Run(t, new(ImagePullStatusControllerSuite))
+}
+
+type ImagePullStatusControllerSuite struct {
+	OmniSuite
+
+	imageClient *mockImageClient
+}
+
+func (suite *ImagePullStatusControllerSuite) SetupTest() {
+	suite.OmniSuite.SetupTest()
+
+	suite.startRuntime()
+
+	suite.imageClient = &mockImageClient{
+		state: suite.state,
+	}
+
+	imagePullStatusController := omnictrl.NewImagePullStatusController(suite.imageClient)
+
+	suite.Require().NoError(suite.runtime.RegisterController(imagePullStatusController))
+}
+
+func (suite *ImagePullStatusControllerSuite) TestImagePullStatus() {
+	pr1 := omni.NewImagePullRequest(resources.DefaultNamespace, "pr-1")
+
+	pr1.Metadata().Labels().Set(omni.LabelCluster, "pr-1-cluster")
+
+	pr1.TypedSpec().Value.NodeImageList = []*specs.ImagePullRequestSpec_NodeImageList{
+		{
+			Node:   "node-1",
+			Images: []string{"node-1-image-1", "node-1-image-2"},
+		},
+		{
+			Node:   "node-2",
+			Images: []string{"node-2-image-1", "node-2-image-2", "node-2-image-3"},
+		},
+	}
+
+	pr2 := omni.NewImagePullRequest(resources.DefaultNamespace, "pr-2")
+
+	pr2.Metadata().Labels().Set(omni.LabelCluster, "pr-2-cluster")
+
+	pr2.TypedSpec().Value.NodeImageList = []*specs.ImagePullRequestSpec_NodeImageList{
+		{
+			Node:   "node-3",
+			Images: []string{"node-3-image-1", "node-3-image-2"},
+		},
+	}
+
+	// create two pull requests
+	suite.Require().NoError(suite.state.Create(suite.ctx, pr1))
+	suite.Require().NoError(suite.state.Create(suite.ctx, pr2))
+
+	suite.Require().EventuallyWithT(func(collect *assert.CollectT) {
+		suite.imageClient.lock.Lock()
+		defer suite.imageClient.lock.Unlock()
+
+		// assert that images were listed
+		if assert.Len(collect, suite.imageClient.listRequests, 3) {
+			assert.ElementsMatch(collect, []listImagesRequest{
+				{cluster: "pr-1-cluster", node: "node-1"},
+				{cluster: "pr-1-cluster", node: "node-2"},
+				{cluster: "pr-2-cluster", node: "node-3"},
+			}, suite.imageClient.listRequests)
+		}
+
+		// assert that only the missing images were pulled
+		if assert.Len(collect, suite.imageClient.pullRequests, 4) {
+			assert.ElementsMatch(collect, []pullImageRequest{
+				// node-1-image-1 is already on the node, so it should not be pulled
+				{cluster: "pr-1-cluster", node: "node-1", image: "node-1-image-2"},
+				// node-2-image-1 is already on the node, so it should not be pulled
+				{cluster: "pr-1-cluster", node: "node-2", image: "node-2-image-2"},
+				{cluster: "pr-1-cluster", node: "node-2", image: "node-2-image-3"},
+				// node-3-image-1 is already on the node, so it should not be pulled
+				{cluster: "pr-2-cluster", node: "node-3", image: "node-3-image-2"},
+			}, suite.imageClient.pullRequests)
+		}
+
+		// assert the ImagePullStatus at the end
+
+		sts1, err := safe.StateGet[*omni.ImagePullStatus](suite.ctx, suite.state, omni.NewImagePullStatus(resources.DefaultNamespace, pr1.Metadata().ID()).Metadata())
+		assert.NoError(collect, err)
+
+		if sts1 == nil { // not there yet
+			return
+		}
+
+		sts1Cluster, _ := sts1.Metadata().Labels().Get(omni.LabelCluster)
+		assert.Equal(collect, "pr-1-cluster", sts1Cluster)
+
+		// pr-1 will pull three images, so the version should be 3
+		assert.Equal(collect, "3", sts1.Metadata().Version().String())
+
+		assert.Equal(collect, sts1.TypedSpec().Value.GetRequestVersion(), pr1.Metadata().Version().String())
+		assert.Equal(collect, sts1.TypedSpec().Value.GetLastProcessedNode(), "node-2")
+		assert.Equal(collect, sts1.TypedSpec().Value.GetLastProcessedImage(), "node-2-image-3")
+		assert.Equal(collect, sts1.TypedSpec().Value.GetProcessedCount(), uint32(5)) // the processed count also includes images already on the node
+		assert.Equal(collect, sts1.TypedSpec().Value.GetTotalCount(), uint32(5))     // the total count also includes images already on the node
+		assert.Equal(collect, sts1.TypedSpec().Value.GetLastProcessedError(), "")
+
+		sts2, err := safe.StateGet[*omni.ImagePullStatus](suite.ctx, suite.state, omni.NewImagePullStatus(resources.DefaultNamespace, pr2.Metadata().ID()).Metadata())
+		assert.NoError(collect, err)
+
+		if sts2 == nil { // not there yet
+			return
+		}
+
+		sts2Cluster, _ := sts2.Metadata().Labels().Get(omni.LabelCluster)
+		assert.Equal(collect, "pr-2-cluster", sts2Cluster)
+
+		// pr-2 will pull a single image, so the version should be 1
+		assert.Equal(collect, "1", sts2.Metadata().Version().String())
+
+		assert.Equal(collect, sts2.TypedSpec().Value.GetRequestVersion(), pr2.Metadata().Version().String())
+		assert.Equal(collect, sts2.TypedSpec().Value.GetLastProcessedNode(), "node-3")
+		assert.Equal(collect, sts2.TypedSpec().Value.GetLastProcessedImage(), "node-3-image-2")
+		assert.Equal(collect, sts2.TypedSpec().Value.GetProcessedCount(), uint32(2)) // the processed count also includes images already on the node
+		assert.Equal(collect, sts2.TypedSpec().Value.GetTotalCount(), uint32(2))     // the total count also includes images already on the node
+		assert.Equal(collect, sts2.TypedSpec().Value.GetLastProcessedError(), "")
+	}, 10*time.Second, 500*time.Microsecond)
+
+	// update pr-2 new a new image list and expect it to be processed
+
+	pr2.TypedSpec().Value.NodeImageList = []*specs.ImagePullRequestSpec_NodeImageList{
+		{
+			Node:   "node-4",
+			Images: []string{"node-4-image-1", "node-4-image-2"},
+		},
+	}
+
+	suite.Require().NoError(suite.state.Update(suite.ctx, pr2))
+
+	suite.Require().EventuallyWithT(func(collect *assert.CollectT) {
+		suite.imageClient.lock.Lock()
+		defer suite.imageClient.lock.Unlock()
+
+		if assert.Len(collect, suite.imageClient.listRequests, 4) {
+			assert.Equal(collect, listImagesRequest{cluster: "pr-2-cluster", node: "node-4"}, suite.imageClient.listRequests[3])
+		}
+
+		if assert.Len(collect, suite.imageClient.pullRequests, 5) {
+			assert.Equal(collect, pullImageRequest{cluster: "pr-2-cluster", node: "node-4", image: "node-4-image-2"}, suite.imageClient.pullRequests[4])
+		}
+
+		sts2, err := safe.StateGet[*omni.ImagePullStatus](suite.ctx, suite.state, omni.NewImagePullStatus(resources.DefaultNamespace, pr2.Metadata().ID()).Metadata())
+		assert.NoError(collect, err)
+
+		assert.Equal(collect, sts2.TypedSpec().Value.GetRequestVersion(), pr2.Metadata().Version().String())
+		assert.Equal(collect, sts2.TypedSpec().Value.GetLastProcessedNode(), "node-4")
+		assert.Equal(collect, sts2.TypedSpec().Value.GetLastProcessedImage(), "node-4-image-2")
+		assert.Equal(collect, sts2.TypedSpec().Value.GetProcessedCount(), uint32(2)) // the processed count also includes images already on the node
+		assert.Equal(collect, sts2.TypedSpec().Value.GetTotalCount(), uint32(2))     // the total count also includes images already on the node
+		assert.Equal(collect, sts2.TypedSpec().Value.GetLastProcessedError(), "")
+	}, 10*time.Second, 500*time.Microsecond)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/installation_media.go b/internal/backend/runtime/omni/controllers/omni/installation_media.go
new file mode 100644
index 000000000..de547a6d5
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/installation_media.go
@@ -0,0 +1,400 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/siderolabs/talos/pkg/machinery/constants"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+const (
+	amd64Arch = "amd64"
+	arm64Arch = "arm64"
+	isoType   = "iso"
+	tarType   = "tar"
+	rawType   = "raw"
+	ovaType   = "ova"
+	vhdType   = "vhd"
+	qcowType  = "qcow2"
+)
+
+type installationMediaSpec struct {
+	Name         string
+	Architecture string
+	Profile      string
+	Type         string
+	ContentType  string
+	SBC          bool
+}
+
+var installationMedia = []installationMediaSpec{
+	// ISOs
+	{
+		Name:         "ISO (amd64)",
+		Architecture: amd64Arch,
+		Profile:      "iso",
+		Type:         isoType,
+		ContentType:  "application/x-iso-stream",
+	},
+	{
+		Name:         "ISO (arm64)",
+		Architecture: arm64Arch,
+		Profile:      "iso",
+		Type:         isoType,
+		ContentType:  "application/x-iso-stream",
+	},
+
+	// CloudImages
+	{
+		Name:         "AWS AMI (amd64)",
+		Architecture: amd64Arch,
+		Profile:      "aws",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "AWS AMI (arm64)",
+		Architecture: arm64Arch,
+		Profile:      "aws",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Azure (amd64)",
+		Architecture: amd64Arch,
+		Profile:      "azure",
+		Type:         vhdType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Azure (arm64)",
+		Architecture: arm64Arch,
+		Profile:      "azure",
+		Type:         vhdType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Digital Ocean (amd64)",
+		Architecture: amd64Arch,
+		Profile:      "digital-ocean",
+		Type:         rawType,
+		ContentType:  "application/gzip",
+	},
+	{
+		Name:         "Digital Ocean (arm64)",
+		Architecture: arm64Arch,
+		Profile:      "digital-ocean",
+		Type:         rawType,
+		ContentType:  "application/gzip",
+	},
+	{
+		Name:         "GCP (amd64)",
+		Architecture: amd64Arch,
+		Profile:      "gcp",
+		Type:         rawType + "." + tarType,
+		ContentType:  "application/gzip",
+	},
+	{
+		Name:         "GCP (arm64)",
+		Architecture: arm64Arch,
+		Profile:      "gcp",
+		Type:         rawType + "." + tarType,
+		ContentType:  "application/gzip",
+	},
+	{
+		Name:         "Hetzner Cloud (amd64)",
+		Architecture: amd64Arch,
+		Profile:      "hcloud",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Hetzner Cloud (arm64)",
+		Architecture: arm64Arch,
+		Profile:      "hcloud",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "NoCloud (amd64)",
+		Architecture: amd64Arch,
+		Profile:      "nocloud",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "NoCloud (arm64)",
+		Architecture: arm64Arch,
+		Profile:      "nocloud",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "OpenStack (amd64)",
+		Architecture: amd64Arch,
+		Profile:      "openstack",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "OpenStack (arm64)",
+		Architecture: arm64Arch,
+		Profile:      "openstack",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Scaleway (amd64)",
+		Architecture: amd64Arch,
+		Profile:      "scaleway",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Scaleway (arm64)",
+		Architecture: arm64Arch,
+		Profile:      "scaleway",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "VMWare (amd64)",
+		Architecture: amd64Arch,
+		Profile:      "vmware",
+		Type:         ovaType,
+		ContentType:  "application/ovf",
+	},
+	{
+		Name:         "VMWare (arm64)",
+		Architecture: arm64Arch,
+		Profile:      "vmware",
+		Type:         ovaType,
+		ContentType:  "application/ovf",
+	},
+	{
+		Name:         "Oracle (amd64)",
+		Architecture: amd64Arch,
+		Profile:      "oracle",
+		Type:         qcowType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Oracle (arm64)",
+		Architecture: arm64Arch,
+		Profile:      "oracle",
+		Type:         qcowType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Vultr (amd64)",
+		Architecture: amd64Arch,
+		Profile:      "vultr",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Vultr (arm64)",
+		Architecture: arm64Arch,
+		Profile:      "vultr",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Upcloud (amd64)",
+		Architecture: amd64Arch,
+		Profile:      "upcloud",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Upcloud (arm64)",
+		Architecture: arm64Arch,
+		Profile:      "upcloud",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Generic image (amd64)",
+		Architecture: amd64Arch,
+		Profile:      "metal",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Generic image (arm64)",
+		Architecture: arm64Arch,
+		Profile:      "metal",
+		Type:         rawType,
+		ContentType:  "application/x-xz",
+	},
+
+	// SBC images
+	{
+		Name:         "Banana Pi BPI-M64 (arm64)",
+		Architecture: arm64Arch,
+		Type:         rawType,
+		SBC:          true,
+		Profile:      constants.BoardBananaPiM64,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Jetson Nano",
+		Architecture: arm64Arch,
+		Profile:      constants.BoardJetsonNano,
+		Type:         rawType,
+		SBC:          true,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Libre Computer Profile ALL-H3-CC",
+		Architecture: arm64Arch,
+		Profile:      constants.BoardLibretechAllH3CCH5,
+		Type:         rawType,
+		SBC:          true,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Pine64",
+		Architecture: arm64Arch,
+		Profile:      constants.BoardPine64,
+		Type:         rawType,
+		SBC:          true,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Pine64 Rock64",
+		Architecture: arm64Arch,
+		Profile:      constants.BoardRock64,
+		Type:         rawType,
+		SBC:          true,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Radxa ROCK PI 4",
+		Architecture: arm64Arch,
+		Profile:      constants.BoardRockpi4,
+		Type:         rawType,
+		SBC:          true,
+		ContentType:  "application/x-xz",
+	},
+	{
+		Name:         "Radxa ROCK PI 4C",
+		Architecture: arm64Arch,
+		Profile:      constants.BoardRockpi4c,
+		Type:         rawType,
+		SBC:          true,
+
+		ContentType: "application/x-xz",
+	},
+	{
+		Name:         "Raspberry Pi 4 Model B",
+		Architecture: arm64Arch,
+		Profile:      constants.BoardRPiGeneric,
+		Type:         rawType,
+		SBC:          true,
+		ContentType:  "application/x-xz",
+	},
+}
+
+// InstallationMediaController manages omni.InstallationMedia.
+type InstallationMediaController struct{}
+
+// Name implements controller.Controller interface.
+func (ctrl *InstallationMediaController) Name() string {
+	return "InstallationMediaController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *InstallationMediaController) Inputs() []controller.Input {
+	return []controller.Input{}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *InstallationMediaController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.InstallationMediaType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *InstallationMediaController) Run(ctx context.Context, r controller.Runtime, _ *zap.Logger) error {
+	select {
+	case <-ctx.Done():
+		return nil
+	case <-r.EventCh():
+	}
+
+	tracker := trackResource(r, resources.EphemeralNamespace, omni.InstallationMediaType)
+
+	for _, m := range installationMedia {
+		fname := generateFilename(m)
+
+		err := safe.WriterModify(ctx, r, omni.NewInstallationMedia(resources.EphemeralNamespace, fname.id), func(newMedia *omni.InstallationMedia) error {
+			newMedia.TypedSpec().Value.Architecture = m.Architecture
+			newMedia.TypedSpec().Value.Name = m.Name
+			newMedia.TypedSpec().Value.Profile = m.Profile
+			newMedia.TypedSpec().Value.ContentType = m.ContentType
+			newMedia.TypedSpec().Value.SrcFilePrefix = fname.srcPrefix
+			newMedia.TypedSpec().Value.DestFilePrefix = fmt.Sprintf("%s-omni-%s", fname.srcPrefix, config.Config.Name)
+			newMedia.TypedSpec().Value.Extension = fname.extension
+			newMedia.TypedSpec().Value.NoSecureBoot = m.SBC
+
+			tracker.keep(newMedia)
+
+			return nil
+		})
+		if err != nil {
+			return fmt.Errorf("failed to create installation media resource: %w", err)
+		}
+	}
+
+	return tracker.cleanup(ctx)
+}
+
+type filename struct {
+	id        string
+	srcPrefix string
+	extension string
+}
+
+// Generate filenames for installation media at runtime so we know the account name.
+func generateFilename(m installationMediaSpec) filename {
+	profile := m.Profile
+	if m.Type == "iso" {
+		profile = "metal"
+	}
+
+	if m.SBC {
+		profile = "metal-" + m.Profile
+	}
+
+	extension := m.Type
+
+	switch m.ContentType {
+	case "application/gzip":
+		extension += ".gz"
+	case "application/x-xz":
+		extension += ".xz"
+	}
+
+	return filename{
+		id:        fmt.Sprintf("%s-%s.%s", profile, m.Architecture, extension),
+		srcPrefix: fmt.Sprintf("%s-%s", profile, m.Architecture),
+		extension: extension,
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/blocks/decrypt.go b/internal/backend/runtime/omni/controllers/omni/internal/blocks/decrypt.go
new file mode 100644
index 000000000..02d53bac0
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/blocks/decrypt.go
@@ -0,0 +1,76 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package blocks
+
+import (
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+
+	"filippo.io/age"
+	"golang.org/x/crypto/nacl/secretbox"
+)
+
+// MakeDecrypter decrypts data from reader using the provided key.
+func MakeDecrypter(r io.Reader, key []byte) (io.Reader, error) {
+	identity, err := newNaclIdentity(key)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create identity: %w", err)
+	}
+
+	decrypter, err := age.Decrypt(r, identity)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create decrypter: %w", err)
+	}
+
+	return decrypter, nil
+}
+
+// naclIdentity implements age.Identity interface. Acts as actual header of the encrypted file.
+type naclIdentity struct {
+	encryptionKey [keyLen]byte
+}
+
+func newNaclIdentity(encryptionKey []byte) (*naclIdentity, error) {
+	if len(encryptionKey) != keyLen {
+		return nil, errors.New("encryption key must be 32 bytes")
+	}
+
+	return &naclIdentity{encryptionKey: [keyLen]byte(encryptionKey)}, nil
+}
+
+func (n *naclIdentity) Unwrap(stanzas []*age.Stanza) ([]byte, error) {
+	for _, stanza := range stanzas {
+		if stanza.Type != typeString || len(stanza.Args) != 1 {
+			continue
+		}
+
+		nonce, err := hex.DecodeString(stanza.Args[0])
+		if err != nil {
+			return nil, fmt.Errorf("failed to decode nonce: %w", err)
+		}
+
+		if len(nonce) != nonceLen {
+			return nil, errors.New("nonce must be 24 bytes")
+		}
+
+		decrypted, ok := secretbox.Open(nil, stanza.Body, (*[nonceLen]byte)(nonce), &n.encryptionKey)
+		if !ok {
+			return nil, errors.New("failed to decrypt file key")
+		}
+
+		return decrypted, nil
+	}
+
+	return nil, errors.New("no matching stanza found")
+}
+
+const (
+	keyLen     = 32
+	nonceLen   = 24
+	typeString = "nacl_v1"
+)
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/blocks/encrypt.go b/internal/backend/runtime/omni/controllers/omni/internal/blocks/encrypt.go
new file mode 100644
index 000000000..b14970593
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/blocks/encrypt.go
@@ -0,0 +1,79 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package blocks provides functions for streaming encryption and decryption of
+// generated data blocks.
+package blocks
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+
+	"filippo.io/age"
+	"golang.org/x/crypto/nacl/secretbox"
+)
+
+// MakeEncrypter encrypts provided [io.Writer] data using age protocol.
+func MakeEncrypter(dst io.Writer, key []byte) (io.WriteCloser, error) {
+	nonce := make([]byte, nonceLen)
+
+	_, err := io.ReadFull(NonceReader, nonce)
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate nonce: %w", err)
+	}
+
+	recipient, err := newNaclRecipient(nonce, key)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create recipient: %w", err)
+	}
+
+	encrypter, err := age.Encrypt(dst, recipient)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create encrypter: %w", err)
+	}
+
+	return encrypter, nil
+}
+
+// I tried many different approaches to encrypt etcd backup in streaming mode, but each time I hit a wall with different
+// problems. Creating tamper-proof encoded length of the block and file header were the most difficult parts. At the end
+// I discovered that age tool from Filippo Valsorda can act as a library, and it has all the necessary functionality.
+// Besides, I trust Filippo's crypto skills more than I trust mine.
+
+// naclRecipient implements age.Recipient interface. Acts as actual header of the encrypted file.
+// Interesting side effect - we can use standalone age tool to decrypt our backups.
+type naclRecipient struct {
+	encryptionKey [keyLen]byte
+	nonce         [nonceLen]byte
+}
+
+func newNaclRecipient(nonce []byte, encryptionKey []byte) (*naclRecipient, error) {
+	switch {
+	case len(encryptionKey) != keyLen:
+		return nil, errors.New("encryption key must be 32 bytes")
+	case len(nonce) != nonceLen:
+		return nil, errors.New("nonce must be 24 bytes")
+	}
+
+	return &naclRecipient{nonce: [nonceLen]byte(nonce), encryptionKey: [keyLen]byte(encryptionKey)}, nil
+}
+
+func (n *naclRecipient) Wrap(fileKey []byte) ([]*age.Stanza, error) {
+	sealed := secretbox.Seal(nil, fileKey, &n.nonce, &n.encryptionKey)
+
+	stanza := age.Stanza{
+		Type: typeString,
+		Args: []string{hex.EncodeToString(n.nonce[:])},
+		Body: sealed,
+	}
+
+	return []*age.Stanza{&stanza}, nil
+}
+
+// NonceReader is a nonce generator. It is a variable for testing purposes.
+var NonceReader = rand.Reader
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/blocks/encrypt_test.go b/internal/backend/runtime/omni/controllers/omni/internal/blocks/encrypt_test.go
new file mode 100644
index 000000000..3425c3e18
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/blocks/encrypt_test.go
@@ -0,0 +1,229 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package blocks_test
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/siderolabs/gen/xtesting/check"
+	"github.com/siderolabs/gen/xtesting/must"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/blocks"
+)
+
+const (
+	encryptionKey = "12345678901234567890123456789012"
+)
+
+func TestEncryptDecrypt(t *testing.T) {
+	//nolint:govet
+	type args struct {
+		key []byte
+		rdr io.Reader
+	}
+
+	tests := map[string]struct {
+		args    args
+		wantDst string
+	}{
+		"normal": {
+			args: args{
+				key: []byte(encryptionKey),
+				rdr: strings.NewReader("Sidero"),
+			},
+			wantDst: "Sidero",
+		},
+		"normal double eof": {
+			args: args{
+				key: []byte(encryptionKey),
+				rdr: makeReaderChain(
+					func(p []byte) (n int, err error) { return copy(p, "Sidero"), io.EOF },
+					func([]byte) (n int, err error) { return 0, io.EOF },
+				),
+			},
+			wantDst: "Sidero",
+		},
+		"normal big": {
+			args: args{
+				key: []byte(encryptionKey),
+				rdr: strings.NewReader(strings.Repeat("Sidero", 6_000_000)),
+			},
+			wantDst: strings.Repeat("Sidero", 6_000_000),
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			var encrypted bytes.Buffer
+
+			writer := must.Value(blocks.MakeEncrypter(&encrypted, tt.args.key))(t)
+
+			must.Value(io.Copy(writer, tt.args.rdr))(t)
+			require.NoError(t, writer.Close())
+
+			rdr := must.Value(blocks.MakeDecrypter(&encrypted, tt.args.key))(t)
+
+			require.Equal(t, tt.wantDst, string(must.Value(io.ReadAll(rdr))(t)))
+		})
+	}
+}
+
+func TestEncrypt_Errors(t *testing.T) {
+	old := blocks.NonceReader
+
+	//nolint:govet
+	type args struct {
+		key []byte
+		rdr io.Reader
+	}
+
+	signal := false
+
+	tests := map[string]struct {
+		args      args
+		writer    io.Writer
+		firstErr  check.Check
+		secondErr check.Check
+		before    func()
+	}{
+		"no nonce": {
+			args: args{
+				key: []byte(encryptionKey),
+				rdr: strings.NewReader("Sidero"),
+			},
+			writer:   io.Discard,
+			firstErr: check.ErrorContains("failed to generate nonce"),
+			before:   func() { blocks.NonceReader = makeReaderChain(func([]byte) (int, error) { return 0, io.EOF }) },
+		},
+		"wrong nonce": {
+			args: args{
+				key: []byte(encryptionKey),
+				rdr: strings.NewReader("Sidero"),
+			},
+			writer:   io.Discard,
+			firstErr: check.ErrorContains("failed to generate nonce"),
+			before: func() {
+				blocks.NonceReader = makeReaderChain(
+					func([]byte) (int, error) { return 15, nil },
+					func([]byte) (int, error) { return 0, io.EOF },
+				)
+			},
+		},
+		"wrong key": {
+			args: args{
+				key: []byte("1234567890123456789012345678901"),
+				rdr: strings.NewReader("Sidero"),
+			},
+			writer:   io.Discard,
+			firstErr: check.ErrorContains("encryption key must be 32 bytes"),
+		},
+		"generator with error": {
+			args: args{
+				key: []byte(encryptionKey),
+				rdr: makeReaderChain(
+					func(p []byte) (n int, err error) { return copy(p, "Sidero"), nil },
+					func([]byte) (n int, err error) { return 0, errors.New("test error") },
+				),
+			},
+			writer:    io.Discard,
+			firstErr:  check.NoError(),
+			secondErr: check.ErrorContains("test error"),
+		},
+		"writter with error": {
+			args: args{
+				key: []byte(encryptionKey),
+				rdr: makeReaderChain(
+					func(p []byte) (n int, err error) { return copy(p, "Sidero"), nil },
+					func([]byte) (n int, err error) { return 0, io.EOF },
+				),
+			},
+			writer:   makeWriterChain(func([]byte) (n int, err error) { return 0, errors.New("writer error") }),
+			firstErr: check.ErrorContains("failed to create encrypter: failed to write header"),
+		},
+		"writter with second error": {
+			args: args{
+				key: []byte(encryptionKey),
+				rdr: makeReaderChain(
+					func(p []byte) (n int, err error) { signal = true; return copy(p, "Sidero"), nil }, //nolint:nlreturn
+					func([]byte) (n int, err error) { return 0, io.EOF },
+				),
+			},
+			writer: makeWriterChain(
+				func(p []byte) (n int, err error) {
+					if signal {
+						return 0, errors.New("writer error")
+					}
+
+					return len(p), nil
+				},
+			),
+			firstErr:  check.NoError(),
+			secondErr: check.ErrorContains("writer error"),
+		},
+	}
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			defer func() { blocks.NonceReader = old }()
+
+			if tt.before != nil {
+				tt.before()
+			}
+
+			writer, err := blocks.MakeEncrypter(tt.writer, tt.args.key)
+			tt.firstErr(t, err)
+
+			if writer != nil {
+				tt.secondErr(t, copyNClose(writer, tt.args.rdr))
+			}
+		})
+	}
+}
+
+func copyNClose(closer io.WriteCloser, rdr io.Reader) error {
+	_, err := io.Copy(closer, rdr)
+	if err != nil {
+		return err
+	}
+
+	return closer.Close()
+}
+
+func makeReaderChain(fn ...func(p []byte) (n int, err error)) io.Reader {
+	return &reader{fn: func(p []byte) (n int, err error) { return pop(&fn)(p) }}
+}
+
+type reader struct {
+	fn func(p []byte) (n int, err error)
+}
+
+func (r *reader) Read(p []byte) (n int, err error) { return r.fn(p) }
+
+func makeWriterChain(fn ...func(p []byte) (n int, err error)) io.Writer {
+	return &writer{fn: func(p []byte) (n int, err error) { return pop(&fn)(p) }}
+}
+
+type writer struct {
+	fn func(p []byte) (n int, err error)
+}
+
+func (w *writer) Write(p []byte) (n int, err error) { return w.fn(p) }
+
+// pop pops first element from slice and returns it. If it is the last element, it returns it without changing slice.
+func pop[T any](elems *[]T) T {
+	if len(*elems) == 1 {
+		return (*elems)[0]
+	}
+
+	elem := (*elems)[0]
+	*elems = (*elems)[1:]
+
+	return elem
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/configpatch/configpatch.go b/internal/backend/runtime/omni/controllers/omni/internal/configpatch/configpatch.go
new file mode 100644
index 000000000..ebd514219
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/configpatch/configpatch.go
@@ -0,0 +1,84 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package configpatch provides a helper to lookup config patches by machine/machine-set.
+package configpatch
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// Helper provides a way to lookup config patches by machine/machine-set.
+type Helper struct {
+	allConfigPatches safe.List[*omni.ConfigPatch]
+}
+
+// NewHelper creates a new config patch helper.
+func NewHelper(ctx context.Context, r controller.Reader) (*Helper, error) {
+	allConfigPatches, err := safe.ReaderListAll[*omni.ConfigPatch](ctx, r)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Helper{
+		allConfigPatches: allConfigPatches,
+	}, nil
+}
+
+// Get collects all machine config patches.
+func (h *Helper) Get(machine *omni.ClusterMachine, machineSet *omni.MachineSet) ([]*omni.ConfigPatch, error) {
+	clusterName, ok := machine.Metadata().Labels().Get(omni.LabelCluster)
+	if !ok {
+		return nil, fmt.Errorf("cluster machine %q doesn't have cluster label set", machine.Metadata().ID())
+	}
+
+	clusterPatchList := h.allConfigPatches.FilterLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName))
+
+	machinePatchList := h.allConfigPatches.FilterLabelQuery(resource.LabelEqual(omni.LabelMachine, machine.Metadata().ID()))
+
+	clusterPatches := make([]*omni.ConfigPatch, 0, clusterPatchList.Len())
+	machineSetPatches := make([]*omni.ConfigPatch, 0, clusterPatchList.Len())
+	clusterMachinePatches := make([]*omni.ConfigPatch, 0, clusterPatchList.Len())
+
+	for iter := clusterPatchList.Iterator(); iter.Next(); {
+		patch := iter.Value()
+
+		machineSetName, machineSetOk := patch.Metadata().Labels().Get(omni.LabelMachineSet)
+		clusterMachineName, clusterMachineOk := patch.Metadata().Labels().Get(omni.LabelClusterMachine)
+
+		switch {
+		// machine set patch
+		case machineSetOk && machineSetName == machineSet.Metadata().ID():
+			machineSetPatches = append(machineSetPatches, patch)
+		// cluster machine patch
+		case clusterMachineOk && clusterMachineName == machine.Metadata().ID():
+			clusterMachinePatches = append(clusterMachinePatches, patch)
+		// cluster patch
+		case !machineSetOk && !clusterMachineOk:
+			clusterPatches = append(clusterPatches, patch)
+		}
+	}
+
+	patches := make([]*omni.ConfigPatch, 0, clusterPatchList.Len()+machinePatchList.Len())
+
+	patches = append(patches, clusterPatches...)
+	patches = append(patches, machineSetPatches...)
+	patches = append(patches, clusterMachinePatches...)
+
+	for iter := machinePatchList.Iterator(); iter.Next(); {
+		patch := iter.Value()
+
+		patches = append(patches, patch)
+	}
+
+	return patches, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt/crypt.go b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt/crypt.go
new file mode 100644
index 000000000..61b11e92d
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt/crypt.go
@@ -0,0 +1,94 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package crypt implements encryption and decryption on top of [etcdbackup.Store].
+package crypt
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"golang.org/x/sync/errgroup"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+)
+
+// Store wraps [Store] and encrypts the data from [io.Reader] before passing it to
+// wrapped uploader.
+type Store struct {
+	wrapped etcdbackup.Store
+}
+
+// NewStore initializes [Store].
+func NewStore(wrapped etcdbackup.Store) *Store {
+	return &Store{wrapped: wrapped}
+}
+
+// Upload encrypts the data from [io.Reader] and passes it to wrapped uploader. Implements [Store].
+func (c *Store) Upload(ctx context.Context, descr etcdbackup.Description, r io.Reader) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	eg, ctx := errgroup.WithContext(ctx)
+
+	reader, writer := io.Pipe()
+
+	// Close writer if ctx is canceled, so that EncryptEtcdBackup can unblock and return.
+	context.AfterFunc(ctx, func() { writer.CloseWithError(ctx.Err()) })
+
+	eg.Go(func() error {
+		err := Encrypt(writer, descr.EncryptionData, r)
+		if err != nil {
+			writer.CloseWithError(err)
+
+			return err
+		}
+
+		writer.Close() //nolint:errcheck
+
+		return nil
+	})
+
+	eg.Go(func() error { return c.wrapped.Upload(ctx, descr, reader) })
+
+	if err := eg.Wait(); err != nil {
+		return fmt.Errorf("failed in wrapped uploader: %w", err)
+	}
+
+	return nil
+}
+
+// Download downloads the backup for the given cluster UUID and the snapshot name from the wrapped store
+// and decrypts it using the given encryption key.
+func (c *Store) Download(ctx context.Context, encryptionKey []byte, clusterUUID, snapshotName string) (etcdbackup.BackupData, io.ReadCloser, error) {
+	_, encryptedReader, err := c.wrapped.Download(ctx, encryptionKey, clusterUUID, snapshotName)
+	if err != nil {
+		return etcdbackup.BackupData{}, nil, fmt.Errorf("failed to download backup: %w", err)
+	}
+
+	decryptedData, decryptedReader, err := Decrypt(encryptedReader, encryptionKey)
+	if err != nil {
+		return etcdbackup.BackupData{}, nil, fmt.Errorf("error decrypting backup: %w", err)
+	}
+
+	readCloser := struct {
+		io.Reader
+		io.Closer
+	}{
+		Reader: decryptedReader,
+		Closer: encryptedReader,
+	}
+
+	return etcdbackup.BackupData{
+		AESCBCEncryptionSecret:    decryptedData.AESCBCEncryptionSecret,
+		SecretboxEncryptionSecret: decryptedData.SecretboxEncryptionSecret,
+	}, readCloser, nil
+}
+
+// ListBackups returns a list of backups. Implements [Store].
+func (c *Store) ListBackups(ctx context.Context, uuid string) (etcdbackup.InfoIterator, error) {
+	return c.wrapped.ListBackups(ctx, uuid)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt/decrypt.go b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt/decrypt.go
new file mode 100644
index 000000000..7ffad69f5
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt/decrypt.go
@@ -0,0 +1,88 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package crypt
+
+import (
+	"encoding/binary"
+	"fmt"
+	"io"
+	"unsafe"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/blocks"
+)
+
+// DecryptedData contains data required to restore etcd backup.
+type DecryptedData struct {
+	AESCBCEncryptionSecret    string
+	SecretboxEncryptionSecret string
+}
+
+// Decrypt decrypts etcd backup using age protocol.
+func Decrypt(r io.Reader, key []byte) (DecryptedData, io.Reader, error) {
+	decrypter, err := blocks.MakeDecrypter(r, key)
+	if err != nil {
+		return DecryptedData{}, nil, fmt.Errorf("failed to decrypt backup: %w", err)
+	}
+
+	header, err := readWithLen(decrypter)
+	if err != nil {
+		return DecryptedData{}, nil, fmt.Errorf("failed to read header: %w", err)
+	}
+
+	var hdr specs.EtcdBackupHeader
+
+	err = hdr.UnmarshalVT(header)
+	if err != nil {
+		return DecryptedData{}, nil, fmt.Errorf("failed to unmarshal header: %w", err)
+	}
+
+	if hdr.Version != currentVersion {
+		return DecryptedData{}, nil, fmt.Errorf("unsupported version: %d", hdr.Version)
+	}
+
+	var decryptedData DecryptedData
+
+	raw, err := readWithLen(decrypter)
+	if err != nil {
+		return DecryptedData{}, nil, fmt.Errorf("failed to read aes-cbc: %w", err)
+	}
+
+	decryptedData.AESCBCEncryptionSecret = string(raw)
+
+	raw, err = readWithLen(decrypter)
+	if err != nil {
+		return DecryptedData{}, nil, fmt.Errorf("failed to read secretbox: %w", err)
+	}
+
+	decryptedData.SecretboxEncryptionSecret = string(raw)
+
+	return decryptedData, decrypter, nil
+}
+
+func readWithLen(decrypter io.Reader) ([]byte, error) {
+	var encodedLenRaw [encodedLen]byte
+
+	_, err := io.ReadFull(decrypter, encodedLenRaw[:])
+	if err != nil {
+		return nil, fmt.Errorf("failed to read len: %w", err)
+	}
+
+	encodedLen := binary.BigEndian.Uint64(encodedLenRaw[:])
+	data := make([]byte, encodedLen)
+
+	_, err = io.ReadFull(decrypter, data)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read data: %w", err)
+	}
+
+	return data, nil
+}
+
+const (
+	encodedLen     = unsafe.Sizeof(uint64(0))
+	currentVersion = 1
+)
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt/encrypt.go b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt/encrypt.go
new file mode 100644
index 000000000..c0437827d
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt/encrypt.go
@@ -0,0 +1,75 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package crypt
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+
+	"github.com/siderolabs/gen/ensure"
+	"github.com/siderolabs/go-pointer"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/blocks"
+)
+
+// Encrypt encrypts etcd backup using age protocol.
+func Encrypt(dst io.Writer, descr etcdbackup.EncryptionData, r io.Reader) error {
+	wrt, err := blocks.MakeEncrypter(dst, descr.EncryptionKey)
+	if err != nil {
+		return fmt.Errorf("failed to encrypt backup: %w", err)
+	}
+
+	defer wrt.Close() //nolint:errcheck
+
+	for _, data := range [...][]byte{
+		ensure.Value(pointer.To(specs.EtcdBackupHeader{Version: 1}).MarshalVT()),
+		[]byte(descr.AESCBCEncryptionSecret),
+		[]byte(descr.SecretboxEncryptionSecret),
+	} {
+		err = writeWithSize(wrt, data)
+		if err != nil {
+			return fmt.Errorf("failed to write header: %w", err)
+		}
+	}
+
+	n, err := io.Copy(wrt, r)
+	if err != nil {
+		return fmt.Errorf("failed to copy backup: %w", err)
+	}
+
+	if n == 0 {
+		return errors.New("backup was empty")
+	}
+
+	err = wrt.Close()
+	if err != nil {
+		return fmt.Errorf("failed to close enrypter: %w", err)
+	}
+
+	return nil
+}
+
+func writeWithSize(dst io.Writer, buf []byte) error {
+	var encodedLen [encodedLen]byte
+
+	binary.BigEndian.PutUint64(encodedLen[:], uint64(len(buf)))
+
+	_, err := dst.Write(encodedLen[:])
+	if err != nil {
+		return fmt.Errorf("failed to write len: %w", err)
+	}
+
+	_, err = dst.Write(buf)
+	if err != nil {
+		return fmt.Errorf("failed to write buf: %w", err)
+	}
+
+	return nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt/encrypt_test.go b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt/encrypt_test.go
new file mode 100644
index 000000000..22616f6bb
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt/encrypt_test.go
@@ -0,0 +1,342 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package crypt_test
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/siderolabs/gen/xtesting/check"
+	"github.com/siderolabs/gen/xtesting/must"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/goleak"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/crypt"
+)
+
+const (
+	encryptionKey  = "01234567890123456789012345678901"
+	aesSecret      = "some aes secret"
+	secreboxSecret = "some secretbox secret"
+)
+
+func TestMain(m *testing.M) {
+	goleak.VerifyTestMain(m)
+}
+
+func TestEncrypt(t *testing.T) {
+	//nolint:govet
+	type args struct {
+		encryptionKey []byte
+		secret        string
+		aesKey        string
+		data          string
+	}
+
+	tests := map[string]struct {
+		args args
+	}{
+		"no error": {
+			args: args{
+				encryptionKey: []byte(encryptionKey),
+				aesKey:        aesSecret,
+				secret:        secreboxSecret,
+				data:          "Hello World",
+			},
+		},
+		"empty aes key and secretbox keys": {
+			args: args{
+				encryptionKey: []byte(encryptionKey),
+				aesKey:        "",
+				secret:        "",
+				data:          "Hello World",
+			},
+		},
+		"long sequence": {
+			args: args{
+				encryptionKey: []byte(encryptionKey),
+				aesKey:        aesSecret,
+				secret:        secreboxSecret,
+				data:          strings.Repeat("SIDERO", 1_000_000),
+			},
+		},
+	}
+
+	for name, test := range tests {
+		if !t.Run(name, func(t *testing.T) {
+			var encryptionTarget bytes.Buffer
+
+			err := crypt.Encrypt(&encryptionTarget, etcdbackup.EncryptionData{
+				EncryptionKey:             test.args.encryptionKey,
+				AESCBCEncryptionSecret:    test.args.aesKey,
+				SecretboxEncryptionSecret: test.args.secret,
+			}, strings.NewReader(test.args.data))
+
+			require.NoError(t, err)
+
+			decryptedHeader, decrypter := must.Values(crypt.Decrypt(&encryptionTarget, test.args.encryptionKey))(t)
+
+			require.Equal(t, test.args.aesKey, decryptedHeader.AESCBCEncryptionSecret)
+			require.Equal(t, test.args.secret, decryptedHeader.SecretboxEncryptionSecret)
+			require.Equal(t, test.args.data, string(must.Value(io.ReadAll(decrypter))(t)))
+		}) {
+			return
+		}
+	}
+}
+
+func TestEncrypt_Errors(t *testing.T) {
+	//nolint:govet
+	type args struct {
+		encryptionKey []byte
+		rdr           io.Reader
+	}
+
+	tests := map[string]struct {
+		args     args
+		errCheck check.Check
+	}{
+		"no error": {
+			args: args{
+				encryptionKey: []byte(encryptionKey),
+				rdr:           strings.NewReader("Hello World"),
+			},
+			errCheck: check.NoError(),
+		},
+		"invalid encryption key size": {
+			args: args{
+				encryptionKey: []byte(encryptionKey + "0"),
+			},
+			errCheck: check.ErrorContains("encryption key must be 32 bytes"),
+		},
+		"empty backup": {
+			args: args{
+				encryptionKey: []byte(encryptionKey),
+				rdr:           strings.NewReader(""),
+			},
+			errCheck: check.ErrorContains("backup was empty"),
+		},
+	}
+
+	for name, test := range tests {
+		if !t.Run(name, func(t *testing.T) {
+			var encryptionTarget bytes.Buffer
+
+			err := crypt.Encrypt(&encryptionTarget, etcdbackup.EncryptionData{
+				EncryptionKey:             test.args.encryptionKey,
+				AESCBCEncryptionSecret:    aesSecret,
+				SecretboxEncryptionSecret: secreboxSecret,
+			}, test.args.rdr)
+
+			test.errCheck(t, err)
+		}) {
+			return
+		}
+	}
+}
+
+func TestDecrypt_Errors(t *testing.T) {
+	var encryptionTarget bytes.Buffer
+
+	err := crypt.Encrypt(&encryptionTarget, etcdbackup.EncryptionData{
+		EncryptionKey:             []byte(encryptionKey),
+		AESCBCEncryptionSecret:    aesSecret,
+		SecretboxEncryptionSecret: secreboxSecret,
+	}, strings.NewReader("Hello"))
+
+	require.NoError(t, err)
+
+	encrypted := encryptionTarget.Bytes()
+
+	type args struct {
+		rdr           io.Reader
+		encryptionKey []byte
+	}
+
+	tests := []struct {
+		name     string
+		errCheck check.Check
+		args     args
+	}{
+		{
+			name: "no error",
+			args: args{
+				encryptionKey: []byte(encryptionKey),
+				rdr:           bytes.NewReader(encrypted),
+			},
+			errCheck: check.NoError(),
+		},
+		{
+			name: "invalid encryption key size",
+			args: args{
+				encryptionKey: []byte(encryptionKey + "0"),
+				rdr:           bytes.NewReader(encrypted),
+			},
+			errCheck: check.ErrorContains("encryption key must be 32 bytes"),
+		},
+		{
+			name: "wrong encryption key",
+			args: args{
+				encryptionKey: []byte("01234567890123456789012345678902"),
+				rdr:           bytes.NewReader(encrypted),
+			},
+			errCheck: check.ErrorContains("failed to decrypt file key"),
+		},
+		{
+			name: "empty backup",
+			args: args{
+				encryptionKey: []byte(encryptionKey),
+				rdr:           strings.NewReader(""),
+			},
+			errCheck: check.ErrorContains("failed to read intro"),
+		},
+		{
+			name: "partial backup",
+			args: args{
+				encryptionKey: []byte(encryptionKey),
+				rdr:           bytes.NewReader(encrypted[:len(encrypted)-1]),
+			},
+			errCheck: check.ErrorContains("failed to decrypt and authenticate payload chunk"),
+		},
+		{
+			name: "failed to read len",
+			args: args{
+				encryptionKey: []byte(encryptionKey),
+				rdr:           bytes.NewReader(encrypted[:190]),
+			},
+			errCheck: check.ErrorContains("failed to read len"),
+		},
+		// TODO: I suppose there is case where backup was truncated at exactly block boundary
+		// and we will fail to decrypt it, but I don't know how to test it.
+	}
+
+	for _, tt := range tests {
+		if !t.Run(tt.name, func(t *testing.T) {
+			_, rdr, err := crypt.Decrypt(tt.args.rdr, tt.args.encryptionKey)
+			tt.errCheck(t, err)
+
+			if rdr != nil {
+				_, err := io.ReadAll(rdr)
+				tt.errCheck(t, err)
+			}
+		}) {
+			return
+		}
+	}
+}
+
+func Benchmark_Encrypt(b *testing.B) {
+	b.StopTimer()
+
+	key := []byte(encryptionKey)
+
+	b.ResetTimer()
+	b.ReportAllocs()
+	b.StartTimer()
+
+	data := &repeatReader{data: []byte("SIDERO")}
+
+	for i := 0; i < b.N; i++ {
+		rdr := io.LimitReader(data, 10_000_000)
+
+		err := crypt.Encrypt(io.Discard, etcdbackup.EncryptionData{
+			EncryptionKey:             key,
+			AESCBCEncryptionSecret:    aesSecret,
+			SecretboxEncryptionSecret: secreboxSecret,
+		}, rdr)
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+// repeatReader is used to generate large amount of data.
+// It is not a real reader, it just copies the same data over and over again.
+type repeatReader struct {
+	data []byte
+}
+
+func (r *repeatReader) Read(p []byte) (n int, err error) {
+	total := 0
+
+	for {
+		if len(p) == 0 {
+			return total, nil
+		}
+
+		n = copy(p, r.data)
+		p = p[n:]
+
+		total += n
+	}
+}
+
+func TestCrypt_Upload_Blocked(t *testing.T) {
+	//nolint:govet
+	tests := []struct {
+		name       string
+		blocked    bool
+		errorCheck check.Check
+	}{
+		{
+			name:       "not blocked",
+			blocked:    false,
+			errorCheck: check.NoError(),
+		},
+		{
+			name:       "blocked",
+			blocked:    true,
+			errorCheck: check.ErrorContains("failed in wrapped uploader"),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			encryptor := crypt.NewStore(&backupBlocker{block: tt.blocked})
+
+			ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+			defer cancel()
+
+			err := encryptor.Upload(ctx, etcdbackup.Description{
+				EncryptionData: etcdbackup.EncryptionData{
+					AESCBCEncryptionSecret:    aesSecret,
+					SecretboxEncryptionSecret: secreboxSecret,
+					EncryptionKey:             []byte(encryptionKey),
+				},
+			}, strings.NewReader("Hello World"))
+
+			tt.errorCheck(t, err)
+		})
+	}
+}
+
+type backupBlocker struct {
+	etcdbackup.Store
+	block bool
+}
+
+func (e *backupBlocker) Upload(ctx context.Context, _ etcdbackup.Description, r io.Reader) error {
+	if e.block {
+		<-ctx.Done()
+	}
+
+	_, err := io.Copy(io.Discard, r)
+
+	return err
+}
+
+func (e *backupBlocker) Download(ctx context.Context, _ []byte, _, _ string) (etcdbackup.BackupData, io.ReadCloser, error) {
+	if e.block {
+		<-ctx.Done()
+	}
+
+	return etcdbackup.BackupData{}, io.NopCloser(bytes.NewReader(nil)), nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/etcdbackup.go b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/etcdbackup.go
new file mode 100644
index 000000000..7c66dc8a1
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/etcdbackup.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package etcdbackup provides the backup functions
+package etcdbackup
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/export_test.go b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/export_test.go
new file mode 100644
index 000000000..9fc65ce05
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/export_test.go
@@ -0,0 +1,10 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package fstore
+
+import "io"
+
+func AtomicFileWrite(dst string, r io.Reader) error { return atomicFileWrite(dst, r) }
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/fstore.go b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/fstore.go
new file mode 100644
index 000000000..c86559a68
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/fstore.go
@@ -0,0 +1,78 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package fstore implements a file store for etcd backups.
+package fstore
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+)
+
+// FileStore stores etcd backups in a specified directory. It creates a new file for each backup.
+// It creates full directory tree if it doesn't exist.
+type FileStore struct {
+	dir string
+}
+
+// Upload stores the data from [io.Reader] in a file. Implements [etcdbackup.Store].
+func (store *FileStore) Upload(_ context.Context, descr etcdbackup.Description, r io.Reader) error {
+	dir := filepath.Join(store.dir, descr.ClusterUUID)
+
+	return uploadFile(dir, descr, r)
+}
+
+// Download returns a reader for the backup file. Implements [etcdbackup.Store].
+func (store *FileStore) Download(_ context.Context, _ []byte, clusterUUID, snapshotName string) (etcdbackup.BackupData, io.ReadCloser, error) {
+	dir := filepath.Join(store.dir, clusterUUID)
+
+	readCloser, err := downloadFile(dir, snapshotName)
+
+	return etcdbackup.BackupData{}, readCloser, err
+}
+
+// ListBackups returns a list of backups. Implements [Store].
+func (store *FileStore) ListBackups(_ context.Context, uuid string) (etcdbackup.InfoIterator, error) {
+	storeAbsDir, err := filepath.Abs(store.dir)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get absolute path: %w", err)
+	}
+
+	backupFiles, err := filepath.Glob(filepath.Join(storeAbsDir, uuid, "*.snapshot"))
+	if err != nil {
+		return nil, fmt.Errorf("failed to read dir: %w", err)
+	}
+
+	return func() (etcdbackup.Info, bool, error) {
+		if len(backupFiles) == 0 {
+			return etcdbackup.Info{}, false, nil
+		}
+
+		backupFile := backupFiles[0]
+		backupFiles = backupFiles[1:]
+
+		stat, err := os.Stat(backupFile)
+		if err != nil {
+			return etcdbackup.Info{}, true, fmt.Errorf("failed to get file info: %w", err)
+		}
+
+		timestamp, err := etcdbackup.ParseSnapshotName(stat.Name())
+		if err != nil {
+			return etcdbackup.Info{}, true, fmt.Errorf("failed to parse snapshot name: %w", err)
+		}
+
+		return etcdbackup.Info{
+			Snapshot:  stat.Name(),
+			Timestamp: timestamp,
+			Reader:    func() (io.ReadCloser, error) { return os.Open(backupFile) },
+			Size:      stat.Size(),
+		}, true, nil
+	}, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/fstore_test.go b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/fstore_test.go
new file mode 100644
index 000000000..188805e4d
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/fstore_test.go
@@ -0,0 +1,82 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package fstore_test
+
+import (
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/siderolabs/gen/xtesting/check"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore"
+)
+
+const dir = "testdata"
+
+var filePath = filepath.Join(dir, "test.txt")
+
+func TestAtomicWriteFile(t *testing.T) {
+	tests := []struct { //nolint:govet
+		name         string
+		r            io.Reader
+		errCheck     check.Check
+		continuation func(t *testing.T)
+	}{
+		{
+			name:     "simple file",
+			r:        strings.NewReader("Hello World"),
+			errCheck: check.NoError(),
+			continuation: func(t *testing.T) {
+				file, err := os.ReadFile(filePath)
+				require.NoError(t, err)
+
+				require.Equal(t, "Hello World", string(file))
+
+				entries, err := os.ReadDir(dir)
+				require.NoError(t, err)
+				require.Len(t, entries, 1)
+			},
+		},
+		{
+			name:         "error reader",
+			r:            &errReader{},
+			errCheck:     check.ErrorContains("test error"),
+			continuation: func(*testing.T) {},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			require.NoError(t, os.Mkdir(dir, 0o755))
+
+			t.Cleanup(func() { require.NoError(t, os.RemoveAll(dir)) })
+
+			test.errCheck(t, fstore.AtomicFileWrite(filePath, test.r))
+			test.continuation(t)
+		})
+	}
+}
+
+type errReader struct{ err error }
+
+func (r *errReader) Read(p []byte) (int, error) {
+	if len(p) == 0 {
+		return 0, nil
+	}
+
+	if r.err == nil {
+		r.err = errors.New("test error")
+
+		return copy(p, "Hello World"), nil
+	}
+
+	return 0, r.err
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/fstore_unix.go b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/fstore_unix.go
new file mode 100644
index 000000000..03dcff846
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/fstore_unix.go
@@ -0,0 +1,94 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//go:build unix
+
+package fstore
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+)
+
+// NewFileStore initializes FileStore.
+func NewFileStore(dir string) *FileStore {
+	if dir == "" {
+		panic(errors.New("dir must be specified"))
+	}
+
+	return &FileStore{dir: dir}
+}
+
+func uploadFile(dir string, descr etcdbackup.Description, r io.Reader) error {
+	err := os.MkdirAll(dir, 0o0755)
+	if err != nil {
+		return fmt.Errorf("failed to create dir: %w", err)
+	}
+
+	fullpath := filepath.Join(dir, etcdbackup.CreateSnapshotName(descr.Timestamp))
+
+	return atomicFileWrite(fullpath, r)
+}
+
+func downloadFile(dir string, snapshotName string) (io.ReadCloser, error) {
+	fullpath := filepath.Join(dir, snapshotName)
+
+	f, err := os.Open(fullpath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to open file: %w", err)
+	}
+
+	return f, nil
+}
+
+func atomicFileWrite(dst string, r io.Reader) error {
+	tempfile := dst + ".tmp"
+
+	tmpFile, err := os.OpenFile(tempfile, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0o666)
+	if err != nil {
+		return fmt.Errorf("failed to create file: %w", err)
+	}
+
+	tempFileCloser := sync.OnceValue(tmpFile.Close)
+	tempFileRenamed := false
+
+	defer func() {
+		tempFileCloser() //nolint:errcheck
+
+		if !tempFileRenamed {
+			os.Remove(tempfile) //nolint:errcheck
+		}
+	}()
+
+	_, err = io.Copy(tmpFile, r)
+	if err != nil {
+		return fmt.Errorf("failed to write data: %w", err)
+	}
+
+	err = tmpFile.Sync()
+	if err != nil {
+		return fmt.Errorf("failed to sync data: %w", err)
+	}
+
+	err = tempFileCloser()
+	if err != nil {
+		return fmt.Errorf("failed to close file: %w", err)
+	}
+
+	err = os.Rename(tempfile, dst)
+	if err != nil {
+		return fmt.Errorf("failed to rename file: %w", err)
+	}
+
+	tempFileRenamed = true
+
+	return nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/fstore_windows.go b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/fstore_windows.go
new file mode 100644
index 000000000..0848dd772
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/fstore/fstore_windows.go
@@ -0,0 +1,26 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package fstore
+
+import (
+	"errors"
+	"io"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup"
+)
+
+// NewFileStore initializes FileStore.
+func NewFileStore(dir string) *FileStore {
+	panic("file store is not supported on windows")
+}
+
+func uploadFile(dir string, descr etcdbackup.Description, r io.Reader) error {
+	return errors.New("file store is not supported on windows")
+}
+
+func downloadFile(dir string, snapshotName string) (io.ReadCloser, error) {
+	return nil, errors.New("file store is not supported on windows")
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/s3store/s3store.go b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/s3store/s3store.go
new file mode 100644
index 000000000..610d81b92
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/etcdbackup/s3store/s3store.go
@@ -0,0 +1,125 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package s3store implements [EtcdBackupStore] which stores backups in a specified S3 bucket.
+package s3store
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"path"
+	"strings"
+
+	"github.com/aws/aws-sdk-go-v2/feature/s3/manager"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/google/uuid"
+	"github.com/siderolabs/go-pointer"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+)
+
+// Store stores etcd backups in a specified S3 bucket.
+type Store struct {
+	client  *s3.Client
+	manager *manager.Uploader
+	bucket  string
+}
+
+// NewStore initializes [Store].
+func NewStore(client *s3.Client, manager *manager.Uploader, bucket string) *Store {
+	return &Store{
+		client:  client,
+		manager: manager,
+		bucket:  bucket,
+	}
+}
+
+// Upload stores the data from [io.Reader] in a file. Implements [Store].
+func (s *Store) Upload(ctx context.Context, descr etcdbackup.Description, r io.Reader) error {
+	uploader := manager.NewUploader(s.client)
+
+	_, err := uploader.Upload(ctx, &s3.PutObjectInput{
+		Bucket: pointer.To(s.bucket),
+		Key:    pointer.To(path.Join(descr.ClusterUUID, etcdbackup.CreateSnapshotName(descr.Timestamp))),
+		Body:   r,
+	})
+	if err != nil {
+		return fmt.Errorf("failed to upload backup to s3: %w", err)
+	}
+
+	return nil
+}
+
+// Download downloads the backup with the specified name. Implements [Store].
+func (s *Store) Download(ctx context.Context, _ []byte, clusterUUID, snapshotName string) (etcdbackup.BackupData, io.ReadCloser, error) {
+	result, err := s.client.GetObject(ctx, &s3.GetObjectInput{
+		Bucket: pointer.To(s.bucket),
+		Key:    pointer.To(path.Join(clusterUUID, snapshotName)),
+	})
+	if err != nil {
+		return etcdbackup.BackupData{}, nil, fmt.Errorf("failed to get object: %w", err)
+	}
+
+	return etcdbackup.BackupData{}, result.Body, nil
+}
+
+// ListBackups returns a list of backups. Implements [EtcdBackupStore].
+func (s *Store) ListBackups(ctx context.Context, clusterUUID string) (etcdbackup.InfoIterator, error) {
+	result, err := s.client.ListObjectsV2(ctx, &s3.ListObjectsV2Input{
+		Bucket: pointer.To(s.bucket),
+		Prefix: pointer.To(fmt.Sprintf("%s/", clusterUUID)),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to list backups: %w", err)
+	}
+
+	contents := result.Contents
+
+	return func() (etcdbackup.Info, bool, error) {
+		for {
+			if len(contents) == 0 {
+				return etcdbackup.Info{}, false, nil
+			}
+
+			content := contents[0]
+			contents = contents[1:]
+
+			key := pointer.SafeDeref(content.Key)
+
+			uuidStr, snapshotName, found := strings.Cut(key, "/")
+			if !found {
+				continue
+			}
+
+			_, err := uuid.Parse(uuidStr)
+			if err != nil {
+				continue
+			}
+
+			timestamp, err := etcdbackup.ParseSnapshotName(snapshotName)
+			if err != nil {
+				return etcdbackup.Info{}, true, err
+			}
+
+			return etcdbackup.Info{
+				Snapshot:  snapshotName,
+				Timestamp: timestamp,
+				Reader: func() (io.ReadCloser, error) {
+					result, err := s.client.GetObject(ctx, &s3.GetObjectInput{
+						Bucket: pointer.To(s.bucket),
+						Key:    pointer.To(key),
+					})
+					if err != nil {
+						return nil, fmt.Errorf("failed to get object: %w", err)
+					}
+
+					return result.Body, nil
+				},
+				Size: pointer.SafeDeref(content.Size),
+			}, true, nil
+		}
+	}, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/kubernetes.go b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/kubernetes.go
new file mode 100644
index 000000000..23168f7c5
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/kubernetes.go
@@ -0,0 +1,69 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package kubernetes provides helpers for controller Kubernetes operations.
+package kubernetes
+
+// Component is an enumeration of Kubernetes components.
+type Component string
+
+// Kubernetes components.
+const (
+	APIServer         Component = "kube-apiserver"
+	ControllerManager Component = "kube-controller-manager"
+	Scheduler         Component = "kube-scheduler"
+	Kubelet           Component = "kubelet"
+)
+
+// AllControlPlaneComponents is a list of all Kubernetes controlplane components.
+var AllControlPlaneComponents = []Component{
+	APIServer,
+	ControllerManager,
+	Scheduler,
+}
+
+// Patch returns a patcher for a specific component.
+func (c Component) Patch(version string) Patcher {
+	switch c {
+	case APIServer:
+		return MultiPatcher(patchAPIServer(version), patchKubeProxy(version))
+	case ControllerManager:
+		return patchControllerManager(version)
+	case Scheduler:
+		return patchScheduler(version)
+	case Kubelet:
+		return patchKubelet(version)
+	default:
+		panic("unknown component")
+	}
+}
+
+// Valid returns true if the component is valid.
+func (c Component) Valid() bool {
+	switch c {
+	case APIServer, ControllerManager, Scheduler, Kubelet:
+		return true
+	default:
+		return false
+	}
+}
+
+// Less returns true if the component is less than the other.
+//
+// Order is based on the upgrade order.
+func (c Component) Less(other Component) bool {
+	switch c {
+	case APIServer:
+		return true
+	case ControllerManager:
+		return other != APIServer
+	case Scheduler:
+		return other == Kubelet
+	case Kubelet:
+		return false
+	default:
+		panic("unknown component")
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/kubernetes_test.go b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/kubernetes_test.go
new file mode 100644
index 000000000..a24720eef
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/kubernetes_test.go
@@ -0,0 +1,77 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package kubernetes_test
+
+import (
+	"math/rand"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/siderolabs/talos/pkg/machinery/config"
+	"github.com/siderolabs/talos/pkg/machinery/config/container"
+	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/kubernetes"
+	"github.com/siderolabs/omni/internal/pkg/image"
+)
+
+func TestComponentLess(t *testing.T) {
+	t.Parallel()
+
+	assert.True(t, kubernetes.APIServer.Less(kubernetes.ControllerManager))
+	assert.True(t, kubernetes.ControllerManager.Less(kubernetes.Scheduler))
+	assert.True(t, kubernetes.Scheduler.Less(kubernetes.Kubelet))
+}
+
+func TestComponentPatch(t *testing.T) {
+	t.Parallel()
+
+	assertVersion := func(t *testing.T, v string, ref string) {
+		tag, err := image.GetTag(ref)
+
+		require.NoError(t, err)
+		assert.Equal(t, v, strings.TrimLeft(tag, "v"))
+	}
+
+	componentVersionAssertion := map[kubernetes.Component]func(*testing.T, config.Provider, string){
+		kubernetes.APIServer: func(t *testing.T, cfg config.Provider, v string) {
+			assertVersion(t, v, cfg.Cluster().APIServer().Image())
+			assertVersion(t, v, cfg.Cluster().Proxy().Image())
+		},
+		kubernetes.ControllerManager: func(t *testing.T, cfg config.Provider, v string) {
+			assertVersion(t, v, cfg.Cluster().ControllerManager().Image())
+		},
+		kubernetes.Scheduler: func(t *testing.T, cfg config.Provider, v string) {
+			assertVersion(t, v, cfg.Cluster().Scheduler().Image())
+		},
+		kubernetes.Kubelet: func(t *testing.T, cfg config.Provider, v string) {
+			assertVersion(t, v, cfg.Machine().Kubelet().Image())
+		},
+	}
+
+	for i := 0; i < 10; i++ {
+		t.Run(strconv.Itoa(i), func(t *testing.T) {
+			t.Parallel()
+
+			components := append(slices.Clone(kubernetes.AllControlPlaneComponents), kubernetes.Kubelet)
+			rand.Shuffle(len(components), func(i, j int) {
+				components[i], components[j] = components[j], components[i]
+			})
+
+			v1alpha1Cfg := &v1alpha1.Config{}
+			cfg := container.NewV1Alpha1(v1alpha1Cfg)
+
+			for _, component := range components {
+				component.Patch("1.2.3").Apply(v1alpha1Cfg)
+				componentVersionAssertion[component](t, cfg, "1.2.3")
+			}
+		})
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/machinemap.go b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/machinemap.go
new file mode 100644
index 000000000..4c831c2ee
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/machinemap.go
@@ -0,0 +1,53 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package kubernetes
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// MachineMap keeps a relation between Kubernetes node names and Machine IDs.
+//
+// It helps to connect resources based on Kubernetes data with Omni internals based on machine IDs.
+type MachineMap struct {
+	// both maps are nodename -> machine ID
+	ControlPlanes map[string]string
+	Workers       map[string]string
+}
+
+// NewMachineMap creates a new MachineMap based on ClusterMachineIdentity resources.
+func NewMachineMap(ctx context.Context, r controller.Reader, cluster *omni.Cluster) (*MachineMap, error) {
+	nodenameToMachineMap := MachineMap{
+		ControlPlanes: map[string]string{},
+		Workers:       map[string]string{},
+	}
+
+	clusterMachineIdentities, err := safe.ReaderListAll[*omni.ClusterMachineIdentity](
+		ctx,
+		r,
+		state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID())),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	for iter := clusterMachineIdentities.Iterator(); iter.Next(); {
+		if _, controlplane := iter.Value().Metadata().Labels().Get(omni.LabelControlPlaneRole); controlplane {
+			nodenameToMachineMap.ControlPlanes[iter.Value().TypedSpec().Value.Nodename] = iter.Value().Metadata().ID()
+		} else {
+			nodenameToMachineMap.Workers[iter.Value().TypedSpec().Value.Nodename] = iter.Value().Metadata().ID()
+		}
+	}
+
+	return &nodenameToMachineMap, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/machinemap_test.go b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/machinemap_test.go
new file mode 100644
index 000000000..836ee6dbc
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/machinemap_test.go
@@ -0,0 +1,66 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package kubernetes_test
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/kubernetes"
+)
+
+func TestNewMachineMap(t *testing.T) {
+	t.Parallel()
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+	ctx := context.Background()
+
+	cpNodes := []string{"cp1", "cp2"}
+	workerNodes := []string{"worker1", "worker2"}
+
+	machineID := func(name string) string {
+		return hex.EncodeToString(sha256.New().Sum([]byte(name)))
+	}
+
+	for _, node := range cpNodes {
+		cm := omni.NewClusterMachineIdentity(resources.DefaultNamespace, machineID(node))
+		cm.Metadata().Labels().Set(omni.LabelCluster, "cluster1")
+		cm.Metadata().Labels().Set(omni.LabelControlPlaneRole, "")
+
+		cm.TypedSpec().Value.Nodename = node
+
+		require.NoError(t, st.Create(ctx, cm))
+	}
+
+	for _, node := range workerNodes {
+		cm := omni.NewClusterMachineIdentity(resources.DefaultNamespace, machineID(node))
+		cm.Metadata().Labels().Set(omni.LabelCluster, "cluster1")
+		cm.Metadata().Labels().Set(omni.LabelWorkerRole, "")
+
+		cm.TypedSpec().Value.Nodename = node
+
+		require.NoError(t, st.Create(ctx, cm))
+	}
+
+	cluster := omni.NewCluster(resources.DefaultNamespace, "cluster1")
+
+	machineMap, err := kubernetes.NewMachineMap(ctx, st, cluster)
+	require.NoError(t, err)
+
+	assert.Equal(t, xslices.ToMap(cpNodes, func(n string) (string, string) { return n, machineID(n) }), machineMap.ControlPlanes)
+	assert.Equal(t, xslices.ToMap(workerNodes, func(n string) (string, string) { return n, machineID(n) }), machineMap.Workers)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/patch.go b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/patch.go
new file mode 100644
index 000000000..02a152961
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/patch.go
@@ -0,0 +1,150 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package kubernetes
+
+import (
+	"fmt"
+
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
+	"github.com/siderolabs/talos/pkg/machinery/constants"
+)
+
+// UpgradeStep defines a change to Talos machine configuration which can be applied to fix the Kubernetes version.
+type UpgradeStep struct {
+	MachineID   string
+	Description string
+	Node        string
+	Component   Component
+	Patch       Patcher
+}
+
+// Less returns true if the patch should be applied before the other one.
+//
+// Order is based on the upgrade order.
+func (p UpgradeStep) Less(other UpgradeStep) bool {
+	if p.Component == other.Component {
+		return p.Node < other.Node
+	}
+
+	return p.Component.Less(other.Component)
+}
+
+// Patcher returns the instructions to patch v1alpha1.Config to upgrade a specific component.
+// It also returns the list of images used by it.
+type Patcher struct {
+	Apply      func(*v1alpha1.Config)
+	UsedImages []string
+}
+
+// MultiPatcher combines several patches.
+func MultiPatcher(patchers ...Patcher) Patcher {
+	return Patcher{
+		Apply: func(config *v1alpha1.Config) {
+			for _, patcher := range patchers {
+				patcher.Apply(config)
+			}
+		},
+		UsedImages: xslices.FlatMap(patchers, func(p Patcher) []string {
+			return p.UsedImages
+		}),
+	}
+}
+
+func patchKubelet(version string) Patcher {
+	img := fmt.Sprintf("%s:v%s", constants.KubeletImage, version)
+
+	return Patcher{
+		Apply: func(config *v1alpha1.Config) {
+			if config.MachineConfig == nil {
+				config.MachineConfig = &v1alpha1.MachineConfig{}
+			}
+
+			if config.MachineConfig.MachineKubelet == nil {
+				config.MachineConfig.MachineKubelet = &v1alpha1.KubeletConfig{}
+			}
+
+			config.MachineConfig.MachineKubelet.KubeletImage = img
+		},
+		UsedImages: []string{img},
+	}
+}
+
+func patchAPIServer(version string) Patcher {
+	img := fmt.Sprintf("%s:v%s", constants.KubernetesAPIServerImage, version)
+
+	return Patcher{
+		Apply: func(config *v1alpha1.Config) {
+			if config.ClusterConfig == nil {
+				config.ClusterConfig = &v1alpha1.ClusterConfig{}
+			}
+
+			if config.ClusterConfig.APIServerConfig == nil {
+				config.ClusterConfig.APIServerConfig = &v1alpha1.APIServerConfig{}
+			}
+
+			config.ClusterConfig.APIServerConfig.ContainerImage = img
+		},
+		UsedImages: []string{img},
+	}
+}
+
+func patchControllerManager(version string) Patcher {
+	img := fmt.Sprintf("%s:v%s", constants.KubernetesControllerManagerImage, version)
+
+	return Patcher{
+		Apply: func(config *v1alpha1.Config) {
+			if config.ClusterConfig == nil {
+				config.ClusterConfig = &v1alpha1.ClusterConfig{}
+			}
+
+			if config.ClusterConfig.ControllerManagerConfig == nil {
+				config.ClusterConfig.ControllerManagerConfig = &v1alpha1.ControllerManagerConfig{}
+			}
+
+			config.ClusterConfig.ControllerManagerConfig.ContainerImage = img
+		},
+		UsedImages: []string{img},
+	}
+}
+
+func patchScheduler(version string) Patcher {
+	img := fmt.Sprintf("%s:v%s", constants.KubernetesSchedulerImage, version)
+
+	return Patcher{
+		Apply: func(config *v1alpha1.Config) {
+			if config.ClusterConfig == nil {
+				config.ClusterConfig = &v1alpha1.ClusterConfig{}
+			}
+
+			if config.ClusterConfig.SchedulerConfig == nil {
+				config.ClusterConfig.SchedulerConfig = &v1alpha1.SchedulerConfig{}
+			}
+
+			config.ClusterConfig.SchedulerConfig.ContainerImage = img
+		},
+		UsedImages: []string{img},
+	}
+}
+
+func patchKubeProxy(version string) Patcher {
+	img := fmt.Sprintf("%s:v%s", constants.KubeProxyImage, version)
+
+	return Patcher{
+		Apply: func(config *v1alpha1.Config) {
+			if config.ClusterConfig == nil {
+				config.ClusterConfig = &v1alpha1.ClusterConfig{}
+			}
+
+			if config.ClusterConfig.ProxyConfig == nil {
+				config.ClusterConfig.ProxyConfig = &v1alpha1.ProxyConfig{}
+			}
+
+			config.ClusterConfig.ProxyConfig.ContainerImage = img
+		},
+		UsedImages: []string{img},
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/upgrade.go b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/upgrade.go
new file mode 100644
index 000000000..e13cb31b4
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/upgrade.go
@@ -0,0 +1,186 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package kubernetes
+
+import (
+	"fmt"
+	"slices"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/siderolabs/gen/maps"
+	"github.com/siderolabs/gen/pair"
+	"github.com/siderolabs/gen/xslices"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// UpgradePath defines a path to upgrade Kubernetes components.
+type UpgradePath struct {
+	// AllNodesToRequiredImages is a map of all nodes used by the upgrade path with the images they require.
+	AllNodesToRequiredImages map[string][]string
+
+	// ClusterID is the ID of the cluster.
+	ClusterID resource.ID
+
+	// NotReadyStatus is a string containing the status of the unready components (if any).
+	NotReadyStatus string
+
+	// Steps is a list of steps to apply to correct the versions of Kubernetes components.
+	Steps []UpgradeStep
+
+	// AllNodes is a list of all nodes used by the upgrade path, in the order they appear.
+	AllNodes []string
+
+	// AllComponentsReady indicates if all Kubernetes components are ready.
+	AllComponentsReady bool
+}
+
+// CalculateUpgradePath calculates the upgrade path for the cluster.
+//
+//nolint:gocyclo,cyclop,gocognit
+func CalculateUpgradePath(nodenameToMachineMap *MachineMap, kubernetesStatus *omni.KubernetesStatus, desiredVersion string) *UpgradePath {
+	upgradePath := &UpgradePath{
+		ClusterID: kubernetesStatus.Metadata().ID(),
+	}
+
+	nodeToRequiredImageSet := make(map[string]map[string]struct{})
+
+	addImagesToNode := func(nodeName string, images []string) {
+		if _, ok := nodeToRequiredImageSet[nodeName]; !ok {
+			nodeToRequiredImageSet[nodeName] = make(map[string]struct{})
+
+			upgradePath.AllNodes = append(upgradePath.AllNodes, nodeName)
+		}
+
+		for _, image := range images {
+			nodeToRequiredImageSet[nodeName][image] = struct{}{}
+		}
+	}
+
+	appPatch := func(nodename string, component Component, pending bool) {
+		machineID, ok := nodenameToMachineMap.ControlPlanes[nodename]
+
+		if ok && component.Valid() {
+			patch := component.Patch(desiredVersion)
+
+			addImagesToNode(nodename, patch.UsedImages)
+
+			if pending {
+				upgradePath.Steps = append(upgradePath.Steps, UpgradeStep{
+					MachineID:   machineID,
+					Patch:       patch,
+					Description: fmt.Sprintf("%s: updating %s to %s", nodename, component, desiredVersion),
+					Node:        nodename,
+					Component:   component,
+				})
+			}
+		}
+	}
+
+	kubeletPatch := func(nodename string, pending bool) {
+		machineID, ok := nodenameToMachineMap.ControlPlanes[nodename]
+		if !ok {
+			machineID, ok = nodenameToMachineMap.Workers[nodename]
+		}
+
+		if !ok {
+			return
+		}
+
+		patch := Kubelet.Patch(desiredVersion)
+
+		addImagesToNode(nodename, patch.UsedImages)
+
+		if pending {
+			upgradePath.Steps = append(upgradePath.Steps, UpgradeStep{
+				MachineID:   machineID,
+				Patch:       patch,
+				Description: fmt.Sprintf("%s: updating %s to %s", nodename, Kubelet, desiredVersion),
+				Node:        nodename,
+				Component:   Kubelet,
+			})
+		}
+	}
+
+	unreadyApps := map[pair.Pair[string, Component]]struct{}{}
+
+	for nodename := range nodenameToMachineMap.ControlPlanes {
+		for _, app := range AllControlPlaneComponents {
+			unreadyApps[pair.MakePair(nodename, app)] = struct{}{}
+		}
+	}
+
+	for _, controlPlane := range kubernetesStatus.TypedSpec().Value.StaticPods {
+		for _, app := range controlPlane.StaticPods {
+			if app.Ready {
+				delete(unreadyApps, pair.MakePair(controlPlane.Nodename, Component(app.App)))
+			}
+
+			appPatch(controlPlane.Nodename, Component(app.App), app.Version != desiredVersion)
+		}
+	}
+
+	unreadyNodes := xslices.ToSet(append(maps.Keys(nodenameToMachineMap.ControlPlanes), maps.Keys(nodenameToMachineMap.Workers)...))
+
+	for _, nodeInfo := range kubernetesStatus.TypedSpec().Value.Nodes {
+		if nodeInfo.Ready {
+			delete(unreadyNodes, nodeInfo.Nodename)
+		}
+
+		kubeletPatch(nodeInfo.Nodename, nodeInfo.KubeletVersion != desiredVersion)
+	}
+
+	switch {
+	case len(unreadyNodes) == 0 && len(unreadyApps) == 0:
+		upgradePath.AllComponentsReady = true
+	case len(unreadyApps) > 0:
+		notReadyApps := xslices.Map(maps.Keys(unreadyApps), func(p pair.Pair[string, Component]) string {
+			return fmt.Sprintf("%s/%s", p.F1, p.F2)
+		})
+		slices.Sort(notReadyApps)
+
+		upgradePath.NotReadyStatus = fmt.Sprintf("static pods %q are not ready", notReadyApps)
+
+	case len(unreadyNodes) > 0:
+		notReadyNodes := maps.Keys(unreadyNodes)
+		slices.Sort(notReadyNodes)
+
+		upgradePath.NotReadyStatus = fmt.Sprintf("nodes %q are not ready", notReadyNodes)
+	}
+
+	// try appending patches for not ready apps, as they might not show up, but still require patching
+	for notReadyApp := range unreadyApps {
+		appPatch(notReadyApp.F1, notReadyApp.F2, true)
+	}
+
+	// try appending patches for not ready nodes, as they might not show up, but still require patching
+	for notReadyNode := range unreadyNodes {
+		kubeletPatch(notReadyNode, true)
+	}
+
+	slices.SortFunc(upgradePath.Steps, func(a, b UpgradeStep) int {
+		switch {
+		case a.Less(b):
+			return -1
+		case b.Less(a):
+			return +1
+		default:
+			return 0
+		}
+	})
+
+	upgradePath.AllNodesToRequiredImages = make(map[string][]string, len(nodeToRequiredImageSet))
+
+	// make sure to have deterministic order for the required images
+	for node, requiredImageSet := range nodeToRequiredImageSet {
+		requiredImages := maps.Keys(requiredImageSet)
+		slices.Sort(requiredImages)
+
+		upgradePath.AllNodesToRequiredImages[node] = requiredImages
+	}
+
+	return upgradePath
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/upgrade_test.go b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/upgrade_test.go
new file mode 100644
index 000000000..f14bb5c60
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/upgrade_test.go
@@ -0,0 +1,480 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package kubernetes_test
+
+import (
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/siderolabs/talos/pkg/machinery/constants"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/kubernetes"
+)
+
+//nolint:maintidx
+func TestUpgradePath(t *testing.T) {
+	t.Parallel()
+
+	kubernetesStatus := func(clusterID resource.ID, spec *specs.KubernetesStatusSpec) *omni.KubernetesStatus {
+		r := omni.NewKubernetesStatus(resources.DefaultNamespace, clusterID)
+		r.TypedSpec().Value = spec
+
+		return r
+	}
+
+	requiredImages := func(desiredVersion string, controlPlane bool) []string {
+		images := []string{
+			fmt.Sprintf("%s:v%s", constants.KubeletImage, desiredVersion),
+		}
+
+		if controlPlane {
+			images = append(images,
+				fmt.Sprintf("%s:v%s", constants.KubeProxyImage, desiredVersion),
+				fmt.Sprintf("%s:v%s", constants.KubernetesSchedulerImage, desiredVersion),
+				fmt.Sprintf("%s:v%s", constants.KubernetesAPIServerImage, desiredVersion),
+				fmt.Sprintf("%s:v%s", constants.KubernetesControllerManagerImage, desiredVersion),
+			)
+		}
+
+		slices.Sort(images)
+
+		return images
+	}
+
+	for _, test := range []struct { //nolint:govet
+		name             string
+		machineMap       *kubernetes.MachineMap
+		kubernetesStatus *omni.KubernetesStatus
+		desiredVersion   string
+
+		expected *kubernetes.UpgradePath
+	}{
+		{
+			name: "no upgrade",
+			machineMap: &kubernetes.MachineMap{
+				ControlPlanes: map[string]string{
+					"cp1": "node-cp-1",
+					"cp2": "node-cp-2",
+					"cp3": "node-cp-3",
+				},
+				Workers: map[string]string{
+					"worker1": "node-worker-1",
+				},
+			},
+			kubernetesStatus: kubernetesStatus("cluster1", &specs.KubernetesStatusSpec{
+				Nodes: []*specs.KubernetesStatusSpec_NodeStatus{
+					{
+						Nodename:       "cp1",
+						KubeletVersion: "1.20.1",
+						Ready:          true,
+					},
+					{
+						Nodename:       "cp2",
+						KubeletVersion: "1.20.1",
+						Ready:          true,
+					},
+					{
+						Nodename:       "cp3",
+						KubeletVersion: "1.20.1",
+						Ready:          true,
+					},
+					{
+						Nodename:       "worker1",
+						KubeletVersion: "1.20.1",
+						Ready:          true,
+					},
+				},
+				StaticPods: []*specs.KubernetesStatusSpec_NodeStaticPods{
+					{
+						Nodename: "cp1",
+						StaticPods: []*specs.KubernetesStatusSpec_StaticPodStatus{
+							{
+								App:     "kube-apiserver",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+							{
+								App:     "kube-controller-manager",
+								Version: "1.20.1",
+								Ready:   false,
+							},
+							{
+								App:     "kube-scheduler",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+						},
+					},
+					{
+						Nodename: "cp2",
+						StaticPods: []*specs.KubernetesStatusSpec_StaticPodStatus{
+							{
+								App:     "kube-apiserver",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+							{
+								App:     "kube-controller-manager",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+							{
+								App:     "kube-scheduler",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+						},
+					},
+					{
+						Nodename: "cp3",
+						StaticPods: []*specs.KubernetesStatusSpec_StaticPodStatus{
+							{
+								App:     "kube-apiserver",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+							{
+								App:     "kube-controller-manager",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+							// kube-scheduler is missing
+						},
+					},
+				},
+			}),
+			desiredVersion: "1.20.1",
+			expected: &kubernetes.UpgradePath{
+				ClusterID:          "cluster1",
+				AllComponentsReady: false,
+				NotReadyStatus:     "static pods [\"cp1/kube-controller-manager\" \"cp3/kube-scheduler\"] are not ready",
+				AllNodes:           []string{"cp1", "cp2", "cp3", "worker1"},
+				AllNodesToRequiredImages: map[string][]string{
+					"cp1":     requiredImages("1.20.1", true),
+					"cp2":     requiredImages("1.20.1", true),
+					"cp3":     requiredImages("1.20.1", true),
+					"worker1": requiredImages("1.20.1", false),
+				},
+				Steps: []kubernetes.UpgradeStep{
+					{
+						MachineID:   "node-cp-1",
+						Description: "cp1: updating kube-controller-manager to 1.20.1",
+						Node:        "cp1",
+						Component:   kubernetes.ControllerManager,
+					},
+					{
+						MachineID:   "node-cp-3",
+						Description: "cp3: updating kube-scheduler to 1.20.1",
+						Node:        "cp3",
+						Component:   kubernetes.Scheduler,
+					},
+				},
+			},
+		},
+		{
+			name: "all healthy",
+			machineMap: &kubernetes.MachineMap{
+				ControlPlanes: map[string]string{
+					"cp1": "node-cp-1",
+				},
+				Workers: map[string]string{
+					"worker1": "node-worker-1",
+				},
+			},
+			kubernetesStatus: kubernetesStatus("cluster2", &specs.KubernetesStatusSpec{
+				Nodes: []*specs.KubernetesStatusSpec_NodeStatus{
+					{
+						Nodename:       "cp1",
+						KubeletVersion: "1.20.1",
+						Ready:          true,
+					},
+					{
+						Nodename:       "worker1",
+						KubeletVersion: "1.20.1",
+						Ready:          true,
+					},
+				},
+				StaticPods: []*specs.KubernetesStatusSpec_NodeStaticPods{
+					{
+						Nodename: "cp1",
+						StaticPods: []*specs.KubernetesStatusSpec_StaticPodStatus{
+							{
+								App:     "kube-apiserver",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+							{
+								App:     "kube-controller-manager",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+							{
+								App:     "kube-scheduler",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+						},
+					},
+				},
+			}),
+			desiredVersion: "1.20.1",
+			expected: &kubernetes.UpgradePath{
+				ClusterID:          "cluster2",
+				AllComponentsReady: true,
+				AllNodes:           []string{"cp1", "worker1"},
+				AllNodesToRequiredImages: map[string][]string{
+					"cp1":     requiredImages("1.20.1", true),
+					"worker1": requiredImages("1.20.1", false),
+				},
+			},
+		},
+		{
+			name: "node unhealthy",
+			machineMap: &kubernetes.MachineMap{
+				ControlPlanes: map[string]string{
+					"cp1": "node-cp-1",
+				},
+				Workers: map[string]string{
+					"worker1": "node-worker-1",
+				},
+			},
+			kubernetesStatus: kubernetesStatus("cluster3", &specs.KubernetesStatusSpec{
+				Nodes: []*specs.KubernetesStatusSpec_NodeStatus{
+					{
+						Nodename:       "cp1",
+						KubeletVersion: "1.20.1",
+						Ready:          false,
+					},
+					// worker1 is missing
+				},
+				StaticPods: []*specs.KubernetesStatusSpec_NodeStaticPods{
+					{
+						Nodename: "cp1",
+						StaticPods: []*specs.KubernetesStatusSpec_StaticPodStatus{
+							{
+								App:     "kube-apiserver",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+							{
+								App:     "kube-controller-manager",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+							{
+								App:     "kube-scheduler",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+						},
+					},
+				},
+			}),
+			desiredVersion: "1.20.1",
+			expected: &kubernetes.UpgradePath{
+				ClusterID:          "cluster3",
+				AllComponentsReady: false,
+				NotReadyStatus:     "nodes [\"cp1\" \"worker1\"] are not ready",
+				AllNodes:           []string{"cp1", "worker1"},
+				AllNodesToRequiredImages: map[string][]string{
+					"cp1":     requiredImages("1.20.1", true),
+					"worker1": requiredImages("1.20.1", false),
+				},
+				Steps: []kubernetes.UpgradeStep{
+					{
+						MachineID:   "node-cp-1",
+						Description: "cp1: updating kubelet to 1.20.1",
+						Node:        "cp1",
+						Component:   kubernetes.Kubelet,
+					},
+					{
+						MachineID:   "node-worker-1",
+						Description: "worker1: updating kubelet to 1.20.1",
+						Node:        "worker1",
+						Component:   kubernetes.Kubelet,
+					},
+				},
+			},
+		},
+		{
+			name: "upgrade plan",
+			machineMap: &kubernetes.MachineMap{
+				ControlPlanes: map[string]string{
+					"cp1": "node-cp-1",
+					"cp2": "node-cp-2",
+					"cp3": "node-cp-3",
+				},
+				Workers: map[string]string{
+					"worker1": "node-worker-1",
+				},
+			},
+			kubernetesStatus: kubernetesStatus("cluster4", &specs.KubernetesStatusSpec{
+				Nodes: []*specs.KubernetesStatusSpec_NodeStatus{
+					{
+						Nodename:       "cp1",
+						KubeletVersion: "1.20.2",
+						Ready:          true,
+					},
+					{
+						Nodename:       "cp2",
+						KubeletVersion: "1.20.2",
+						Ready:          true,
+					},
+					{
+						Nodename:       "cp3",
+						KubeletVersion: "1.20.1",
+						Ready:          true,
+					},
+					{
+						Nodename:       "worker1",
+						KubeletVersion: "1.20.1",
+						Ready:          true,
+					},
+				},
+				StaticPods: []*specs.KubernetesStatusSpec_NodeStaticPods{
+					{
+						Nodename: "cp1",
+						StaticPods: []*specs.KubernetesStatusSpec_StaticPodStatus{
+							{
+								App:     "kube-apiserver",
+								Version: "1.20.2",
+								Ready:   true,
+							},
+							{
+								App:     "kube-controller-manager",
+								Version: "1.20.2",
+								Ready:   true,
+							},
+							{
+								App:     "kube-scheduler",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+						},
+					},
+					{
+						Nodename: "cp2",
+						StaticPods: []*specs.KubernetesStatusSpec_StaticPodStatus{
+							{
+								App:     "kube-apiserver",
+								Version: "1.20.2",
+								Ready:   true,
+							},
+							{
+								App:     "kube-controller-manager",
+								Version: "1.20.2",
+								Ready:   true,
+							},
+							{
+								App:     "kube-scheduler",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+						},
+					},
+					{
+						Nodename: "cp3",
+						StaticPods: []*specs.KubernetesStatusSpec_StaticPodStatus{
+							{
+								App:     "kube-apiserver",
+								Version: "1.20.2",
+								Ready:   true,
+							},
+							{
+								App:     "kube-controller-manager",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+							{
+								App:     "kube-scheduler",
+								Version: "1.20.1",
+								Ready:   true,
+							},
+						},
+					},
+				},
+			}),
+			desiredVersion: "1.20.2",
+			expected: &kubernetes.UpgradePath{
+				ClusterID:          "cluster4",
+				AllComponentsReady: true,
+				AllNodes:           []string{"cp1", "cp2", "cp3", "worker1"},
+				AllNodesToRequiredImages: map[string][]string{
+					"cp1":     requiredImages("1.20.2", true),
+					"cp2":     requiredImages("1.20.2", true),
+					"cp3":     requiredImages("1.20.2", true),
+					"worker1": requiredImages("1.20.2", false),
+				},
+				Steps: []kubernetes.UpgradeStep{
+					{
+						MachineID:   "node-cp-3",
+						Description: "cp3: updating kube-controller-manager to 1.20.2",
+						Node:        "cp3",
+						Component:   kubernetes.ControllerManager,
+					},
+					{
+						MachineID:   "node-cp-1",
+						Description: "cp1: updating kube-scheduler to 1.20.2",
+						Node:        "cp1",
+						Component:   kubernetes.Scheduler,
+					},
+					{
+						MachineID:   "node-cp-2",
+						Description: "cp2: updating kube-scheduler to 1.20.2",
+						Node:        "cp2",
+						Component:   kubernetes.Scheduler,
+					},
+					{
+						MachineID:   "node-cp-3",
+						Description: "cp3: updating kube-scheduler to 1.20.2",
+						Node:        "cp3",
+						Component:   kubernetes.Scheduler,
+					},
+					{
+						MachineID:   "node-cp-3",
+						Description: "cp3: updating kubelet to 1.20.2",
+						Node:        "cp3",
+						Component:   kubernetes.Kubelet,
+					},
+					{
+						MachineID:   "node-worker-1",
+						Description: "worker1: updating kubelet to 1.20.2",
+						Node:        "worker1",
+						Component:   kubernetes.Kubelet,
+					},
+				},
+			},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			upgradePath := kubernetes.CalculateUpgradePath(test.machineMap, test.kubernetesStatus, test.desiredVersion)
+			assert.Equal(t, test.expected.AllComponentsReady, upgradePath.AllComponentsReady)
+			assert.Equal(t, test.expected.NotReadyStatus, upgradePath.NotReadyStatus)
+
+			require.Len(t, upgradePath.Steps, len(test.expected.Steps))
+
+			for i := range upgradePath.Steps {
+				assert.Equal(t, test.expected.Steps[i].Component, upgradePath.Steps[i].Component)
+				assert.Equal(t, test.expected.Steps[i].Node, upgradePath.Steps[i].Node)
+				assert.Equal(t, test.expected.Steps[i].MachineID, upgradePath.Steps[i].MachineID)
+				assert.Equal(t, test.expected.Steps[i].Description, upgradePath.Steps[i].Description)
+			}
+
+			// assert the required images
+			assert.Equal(t, test.expected.AllNodes, upgradePath.AllNodes)
+			assert.Equal(t, test.expected.AllNodesToRequiredImages, upgradePath.AllNodesToRequiredImages)
+		})
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/versions.go b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/versions.go
new file mode 100644
index 000000000..0dc6af832
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/versions.go
@@ -0,0 +1,79 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package kubernetes
+
+import (
+	"context"
+	"fmt"
+	"slices"
+
+	"github.com/blang/semver"
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/siderolabs/gen/maps"
+	"github.com/siderolabs/go-kubernetes/kubernetes/upgrade"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/siderolabs/talos/pkg/machinery/compatibility"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// CalculateUpgradeVersions calculates the list of versions available for upgrade.
+func CalculateUpgradeVersions(ctx context.Context, r controller.Reader, currentVersion, talosTag string) ([]string, error) {
+	talosVersion, err := compatibility.ParseTalosVersion(&machine.VersionInfo{
+		Tag: talosTag,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error parsing Talos version: %w", err)
+	}
+
+	k8sVersions, err := safe.ReaderListAll[*omni.KubernetesVersion](ctx, r)
+	if err != nil {
+		return nil, err
+	}
+
+	availableVersions := map[string]semver.Version{}
+
+	for iter := k8sVersions.Iterator(); iter.Next(); {
+		if iter.Value().TypedSpec().Value.Version != currentVersion {
+			availableVersions[iter.Value().TypedSpec().Value.Version], err = semver.ParseTolerant(iter.Value().TypedSpec().Value.Version)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	// skip versions which do not have an upgrade path from the current version
+	for version := range availableVersions {
+		path, err := upgrade.NewPath(currentVersion, version)
+		if err != nil {
+			return nil, err
+		}
+
+		if !path.IsSupported() {
+			delete(availableVersions, version)
+		}
+	}
+
+	// skip versions which are not supported with the current version of Talos
+	for version := range availableVersions {
+		k8sVersion, err := compatibility.ParseKubernetesVersion(version)
+		if err != nil {
+			return nil, err
+		}
+
+		if k8sVersion.SupportedWith(talosVersion) != nil {
+			delete(availableVersions, version)
+		}
+	}
+
+	availableVersionsList := maps.Keys(availableVersions)
+	slices.SortFunc(availableVersionsList, func(a, b string) int {
+		return availableVersions[a].Compare(availableVersions[b])
+	})
+
+	return availableVersionsList, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/versions_test.go b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/versions_test.go
new file mode 100644
index 000000000..71d6cd086
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/kubernetes/versions_test.go
@@ -0,0 +1,76 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package kubernetes_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/kubernetes"
+)
+
+func TestCalculateUpgradeVersions(t *testing.T) {
+	t.Parallel()
+
+	for _, test := range []struct {
+		name           string
+		k8sVersions    []string
+		talosVersion   string
+		currentVersion string
+
+		expected []string
+	}{
+		{
+			name:           "to previous",
+			k8sVersions:    []string{"1.25.0", "1.25.1", "1.25.2", "1.26.0", "1.26.1"},
+			talosVersion:   "1.3.5",
+			currentVersion: "1.26.1",
+			expected:       []string{"1.26.0"},
+		},
+		{
+			name:           "many versions",
+			k8sVersions:    []string{"1.24.0", "1.25.0", "1.25.1", "1.25.2", "1.26.0", "1.26.1", "1.27.0"},
+			talosVersion:   "1.3.5",
+			currentVersion: "1.25.1",
+			expected:       []string{"1.25.0", "1.25.2", "1.26.0", "1.26.1"},
+		},
+		{
+			name:           "no compatible versions",
+			k8sVersions:    []string{"1.22.1", "1.23.1", "1.24.1"},
+			talosVersion:   "1.3.5",
+			currentVersion: "1.22.1", // upgrade path only to 1.23, but Talos 1.3 doesn't support it
+			expected:       nil,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			ctx := context.Background()
+
+			st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+			for _, version := range test.k8sVersions {
+				v := omni.NewKubernetesVersion(resources.DefaultNamespace, version)
+				v.TypedSpec().Value.Version = version
+
+				require.NoError(t, st.Create(ctx, v))
+			}
+
+			versions, err := kubernetes.CalculateUpgradeVersions(ctx, st, test.currentVersion, test.talosVersion)
+			require.NoError(t, err)
+
+			assert.Equal(t, test.expected, versions)
+		})
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/loadbalancer/loadbalancer.go b/internal/backend/runtime/omni/controllers/omni/internal/loadbalancer/loadbalancer.go
new file mode 100644
index 000000000..a5df3f4a7
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/loadbalancer/loadbalancer.go
@@ -0,0 +1,41 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package loadbalancer provides wrappers to run controlplane Kubernetes API loadbalancers.
+package loadbalancer
+
+import (
+	"github.com/siderolabs/go-loadbalancer/controlplane"
+	"github.com/siderolabs/go-loadbalancer/upstream"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+// LoadBalancer is the interface needed by the Manager.
+type LoadBalancer interface {
+	Start(upstreamCh <-chan []string) error
+	Shutdown() error
+	Healthy() (bool, error)
+}
+
+// NewFunc is a function type whose implementation should create a new load balancer.
+type NewFunc func(bindAddress string, bindPort int, logger *zap.Logger) (LoadBalancer, error)
+
+// DefaultNew returns a new load balancer with default settings.
+func DefaultNew(bindAddress string, bindPort int, logger *zap.Logger) (LoadBalancer, error) { //nolint:ireturn
+	return controlplane.NewLoadBalancer(
+		bindAddress,
+		bindPort,
+		logger.WithOptions(zap.IncreaseLevel(zap.ErrorLevel)), // silence the load balancer logs
+		controlplane.WithDialTimeout(config.Config.LoadBalancer.DialTimeout),
+		controlplane.WithKeepAlivePeriod(config.Config.LoadBalancer.KeepAlivePeriod),
+		controlplane.WithTCPUserTimeout(config.Config.LoadBalancer.TCPUserTimeout),
+		controlplane.WithHealthCheckOptions(
+			upstream.WithHealthcheckInterval(config.Config.LoadBalancer.HealthCheckInterval),
+			upstream.WithHealthcheckTimeout(config.Config.LoadBalancer.HealthCheckTimeout),
+		),
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/loadbalancer/manager.go b/internal/backend/runtime/omni/controllers/omni/internal/loadbalancer/manager.go
new file mode 100644
index 000000000..ca4a29334
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/loadbalancer/manager.go
@@ -0,0 +1,140 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package loadbalancer
+
+import (
+	"errors"
+	"fmt"
+
+	"github.com/siderolabs/gen/maps"
+	"github.com/siderolabs/gen/optional"
+	"github.com/siderolabs/gen/xslices"
+	"go.uber.org/zap"
+)
+
+// ID is a loadbalancer ID.
+type ID = string
+
+// Manager manages running loadbalancers.
+type Manager struct {
+	running map[ID]wrapper
+	logger  *zap.Logger
+	newFunc NewFunc
+}
+
+// Spec configures a loadbalancer.
+type Spec struct {
+	BindAddress string
+	BindPort    int
+}
+
+// wrapper wraps a loadbalancer and its upstream channel.
+type wrapper struct {
+	lb          LoadBalancer
+	upstreamCh  chan []string
+	spec        Spec
+	lastHealthy optional.Optional[bool]
+}
+
+// NewManager returns a new loadbalancer manager.
+func NewManager(logger *zap.Logger, newFunc NewFunc) *Manager {
+	return &Manager{
+		running: make(map[ID]wrapper),
+		logger:  logger,
+		newFunc: newFunc,
+	}
+}
+
+// Stop stops all running loadbalancers.
+func (m *Manager) Stop() error {
+	return errors.Join(xslices.Map(maps.Values(m.running), func(w wrapper) error {
+		return w.lb.Shutdown()
+	})...)
+}
+
+// Reconcile by starting/stopping/replacing loadbalancer as needed.
+func (m *Manager) Reconcile(specs map[ID]Spec) error {
+	var allErrors []error
+
+	// stop all loadbalancers that should not be running
+	for id, w := range m.running {
+		if newSpec, ok := specs[id]; !ok || newSpec != w.spec {
+			if !ok {
+				m.logger.Debug("stopping loadbalancer", zap.String("id", id), zap.Int("port", w.spec.BindPort))
+			} else {
+				m.logger.Debug("replacing loadbalancer", zap.String("id", id), zap.Int("port", w.spec.BindPort))
+			}
+
+			if err := w.lb.Shutdown(); err != nil {
+				allErrors = append(allErrors, fmt.Errorf("error stopping %s: %w", id, err))
+			}
+
+			delete(m.running, id)
+		}
+	}
+
+	// start all loadbalancers that should be running
+	for id, spec := range specs {
+		if _, running := m.running[id]; !running {
+			m.logger.Debug("starting loadbalancer", zap.String("id", id), zap.Int("port", spec.BindPort))
+
+			w := wrapper{
+				spec:       spec,
+				upstreamCh: make(chan []string),
+			}
+
+			lb, err := m.newFunc(spec.BindAddress, spec.BindPort, m.logger)
+			if err != nil {
+				allErrors = append(allErrors, fmt.Errorf("error creating loadbalancer %s: %w", id, err))
+
+				continue
+			}
+
+			if err = lb.Start(w.upstreamCh); err != nil {
+				allErrors = append(allErrors, fmt.Errorf("error starting loadbalancer %s: %w", id, err))
+
+				continue
+			}
+
+			w.lb = lb
+			m.running[id] = w
+		}
+	}
+
+	return errors.Join(allErrors...)
+}
+
+// GetHealthStatus compiles the health status of all loadbalancers, returning the diff with previous reported status.
+func (m *Manager) GetHealthStatus() map[ID]bool {
+	status := map[ID]bool{}
+
+	for id, w := range m.running {
+		healthy, err := w.lb.Healthy()
+		if err != nil {
+			m.logger.Error("error getting loadbalancer health", zap.String("id", id), zap.Error(err))
+
+			healthy = false
+		}
+
+		previousHealthy, exists := w.lastHealthy.Get()
+		if !exists || healthy != previousHealthy {
+			status[id] = healthy
+		}
+
+		w.lastHealthy = optional.Some(healthy)
+	}
+
+	return status
+}
+
+// UpdateUpstreams updates the upstreams of all loadbalancers.
+func (m *Manager) UpdateUpstreams(upstreams map[ID][]string) {
+	// running loadbalancers always consume from the channel
+	// also loadbalancers ignore if nothing changed, so we can always send
+	for id, w := range m.running {
+		w.upstreamCh <- upstreams[id]
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/mappers/mappers.go b/internal/backend/runtime/omni/controllers/omni/internal/mappers/mappers.go
new file mode 100644
index 000000000..ddaa12af2
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/mappers/mappers.go
@@ -0,0 +1,80 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package mappers provides Omni-specific mappers for QControllers.
+package mappers
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// MapExtractLabelValue returns a mapper that extracts a label value from a resource, potentially evaluating a condition on labels.
+func MapExtractLabelValue[I generic.ResourceWithRD, O generic.ResourceWithRD](extractableLabel string, labelTerms ...resource.LabelTerm) qtransform.MapperFuncGeneric[I] {
+	var zeroOutput O
+
+	outputNamespace := zeroOutput.ResourceDefinition().DefaultNamespace
+	outputType := zeroOutput.ResourceDefinition().Type
+
+	return func(_ context.Context, _ *zap.Logger, _ controller.QRuntime, i I) ([]resource.Pointer, error) {
+		for _, labelTerm := range labelTerms {
+			if !i.Metadata().Labels().Matches(labelTerm) {
+				return nil, nil
+			}
+		}
+
+		value, ok := i.Metadata().Labels().Get(extractableLabel)
+		if !ok {
+			return nil, nil
+		}
+
+		return []resource.Pointer{resource.NewMetadata(outputNamespace, outputType, value, resource.VersionUndefined)}, nil
+	}
+}
+
+// MapByClusterLabel returns a mapper that extracts a LabelCluster value.
+func MapByClusterLabel[I generic.ResourceWithRD, O generic.ResourceWithRD]() qtransform.MapperFuncGeneric[I] {
+	return MapExtractLabelValue[I, O](omni.LabelCluster)
+}
+
+// MapByClusterLabelOnlyControlplane returns a mapper that extracts a LabelCluster value, but only if the resource has LabelControlPlaneRole.
+func MapByClusterLabelOnlyControlplane[I generic.ResourceWithRD, O generic.ResourceWithRD]() qtransform.MapperFuncGeneric[I] {
+	return MapExtractLabelValue[I, O](omni.LabelCluster, resource.LabelTerm{Key: omni.LabelControlPlaneRole, Op: resource.LabelOpExists})
+}
+
+// MapByMachineSetLabel returns a mapper that extracts a LabelMachineSet value.
+func MapByMachineSetLabel[I generic.ResourceWithRD, O generic.ResourceWithRD]() qtransform.MapperFuncGeneric[I] {
+	return MapExtractLabelValue[I, O](omni.LabelMachineSet)
+}
+
+// MapByMachineSetLabelOnlyControlplane returns a mapper that extracts a LabelMachineSet value, but only if the resource has LabelControlPlaneRole.
+func MapByMachineSetLabelOnlyControlplane[I generic.ResourceWithRD, O generic.ResourceWithRD]() qtransform.MapperFuncGeneric[I] {
+	return MapExtractLabelValue[I, O](omni.LabelMachineSet, resource.LabelTerm{Key: omni.LabelControlPlaneRole, Op: resource.LabelOpExists})
+}
+
+// MapClusterResourceToLabeledResources returns a mapper that maps a cluster resource to all resources with the same cluster label.
+func MapClusterResourceToLabeledResources[I generic.ResourceWithRD, O generic.ResourceWithRD]() qtransform.MapperFuncGeneric[I] {
+	return func(ctx context.Context, _ *zap.Logger, r controller.QRuntime, i I) ([]resource.Pointer, error) {
+		clusterName := i.Metadata().ID()
+
+		items, err := safe.ReaderListAll[O](ctx, r, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)))
+		if err != nil {
+			return nil, err
+		}
+
+		return safe.Map(items, func(item O) (resource.Pointer, error) {
+			return item.Metadata(), nil
+		})
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/talos/schematic.go b/internal/backend/runtime/omni/controllers/omni/internal/talos/schematic.go
new file mode 100644
index 000000000..d73f9a9c0
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/talos/schematic.go
@@ -0,0 +1,49 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package talos
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/siderolabs/image-factory/pkg/constants"
+	"github.com/siderolabs/image-factory/pkg/schematic"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"
+)
+
+// ErrInvalidSchematic means that the machine has extensions installed bypassing the image factory.
+var ErrInvalidSchematic = fmt.Errorf("invalid schematic")
+
+// GetSchematicID calculates schematic using Talos client: reads extensions list and looks up schematic meta
+// extension, or calculates vanilla schematic ID if there's none.
+func GetSchematicID(ctx context.Context, c *client.Client) (string, error) {
+	extensions := map[resource.ID]*runtime.ExtensionStatus{}
+
+	items, err := safe.StateListAll[*runtime.ExtensionStatus](ctx, c.COSI)
+	if err != nil {
+		return "", err
+	}
+
+	items.ForEach(func(status *runtime.ExtensionStatus) {
+		extensions[status.TypedSpec().Metadata.Name] = status
+	})
+
+	schematicExtension, ok := extensions[constants.SchematicIDExtensionName]
+
+	if !ok && len(extensions) > 0 {
+		return "", ErrInvalidSchematic
+	}
+
+	// default schematic
+	if !ok {
+		return (&schematic.Schematic{}).ID()
+	}
+
+	return schematicExtension.TypedSpec().Metadata.Version, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/talos/versions.go b/internal/backend/runtime/omni/controllers/omni/internal/talos/versions.go
new file mode 100644
index 000000000..01c86ae1a
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/talos/versions.go
@@ -0,0 +1,76 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package talos provides helpers for controller Talos operations.
+package talos
+
+import (
+	"context"
+	"fmt"
+	"slices"
+
+	"github.com/blang/semver/v4"
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/siderolabs/gen/maps"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/siderolabs/talos/pkg/machinery/compatibility"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// CalculateUpgradeVersions calculates the list of versions available for upgrade.
+func CalculateUpgradeVersions(ctx context.Context, r controller.Reader, currentVersion, kubernetesVersion string) ([]string, error) {
+	currentTalosVersion, err := compatibility.ParseTalosVersion(&machine.VersionInfo{
+		Tag: currentVersion,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error parsing Talos version: %w", err)
+	}
+
+	talosVersions, err := safe.ReaderListAll[*omni.TalosVersion](ctx, r)
+	if err != nil {
+		return nil, err
+	}
+
+	availableVersions := map[string]semver.Version{}
+
+	for iter := talosVersions.Iterator(); iter.Next(); {
+		if iter.Value().TypedSpec().Value.Version != currentVersion {
+			availableVersions[iter.Value().TypedSpec().Value.Version], err = semver.ParseTolerant(iter.Value().TypedSpec().Value.Version)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	k8sVersion, err := compatibility.ParseKubernetesVersion(kubernetesVersion)
+	if err != nil {
+		return nil, err
+	}
+
+	// skip versions which are not supported with the current version of Kubernetes
+	for version := range availableVersions {
+		var candidate *compatibility.TalosVersion
+
+		candidate, err = compatibility.ParseTalosVersion(&machine.VersionInfo{
+			Tag: version,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("error parsing Talos version: %w", err)
+		}
+
+		if candidate.UpgradeableFrom(currentTalosVersion) != nil || k8sVersion.SupportedWith(candidate) != nil {
+			delete(availableVersions, version)
+		}
+	}
+
+	availableVersionsList := maps.Keys(availableVersions)
+	slices.SortFunc(availableVersionsList, func(a, b string) int {
+		return availableVersions[a].Compare(availableVersions[b])
+	})
+
+	return availableVersionsList, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/task/clustermachine/clustermachine.go b/internal/backend/runtime/omni/controllers/omni/internal/task/clustermachine/clustermachine.go
new file mode 100644
index 000000000..ddcda781f
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/task/clustermachine/clustermachine.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package clustermachine implements a task which collects information from a ClusterMachine (e.g identity).
+package clustermachine
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/task/clustermachine/identity.go b/internal/backend/runtime/omni/controllers/omni/internal/task/clustermachine/identity.go
new file mode 100644
index 000000000..f372089f8
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/task/clustermachine/identity.go
@@ -0,0 +1,322 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package clustermachine
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"strconv"
+	"sync"
+	"time"
+
+	"github.com/blang/semver"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/channel"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+	clientconfig "github.com/siderolabs/talos/pkg/machinery/client/config"
+	"github.com/siderolabs/talos/pkg/machinery/constants"
+	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
+	"github.com/siderolabs/talos/pkg/machinery/resources/etcd"
+	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
+	"github.com/siderolabs/talos/pkg/machinery/resources/secrets"
+	clientv3 "go.etcd.io/etcd/client/v3"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+)
+
+// IdentityCollectorTaskSpec scrapes identity, nodename and etcd members info from the nodes.
+type IdentityCollectorTaskSpec struct {
+	config            *clientconfig.Config
+	configVersion     resource.Version
+	clusterName       string
+	managementAddress string
+	id                resource.ID
+	isControlPlane    bool
+}
+
+// IdentityCollectorChan is a channel for sending cluster machine identity from tasks back to the controller.
+type IdentityCollectorChan chan<- *omni.ClusterMachineIdentity
+
+// NewIdentityCollectorTaskSpec creates new ClusterMachineCollector.
+func NewIdentityCollectorTaskSpec(id resource.ID, config *clientconfig.Config, configVersion resource.Version, address string, isControlPlane bool, clusterName string) IdentityCollectorTaskSpec {
+	return IdentityCollectorTaskSpec{
+		id:                id,
+		config:            config,
+		configVersion:     configVersion,
+		managementAddress: address,
+		isControlPlane:    isControlPlane,
+		clusterName:       clusterName,
+	}
+}
+
+// ID returns the ID of the IdentityCollectorTaskSpec.
+func (spec IdentityCollectorTaskSpec) ID() string {
+	return spec.clusterName + "/" + spec.id
+}
+
+// Equal checks if the IdentityCollectorTaskSpec is equal to the other IdentityCollectorTaskSpec.
+func (spec IdentityCollectorTaskSpec) Equal(other IdentityCollectorTaskSpec) bool {
+	if spec.id != other.id {
+		return false
+	}
+
+	if spec.managementAddress != other.managementAddress {
+		return false
+	}
+
+	if spec.isControlPlane != other.isControlPlane {
+		return false
+	}
+
+	if spec.clusterName != other.clusterName {
+		return false
+	}
+
+	if !spec.configVersion.Equal(other.configVersion) {
+		return false
+	}
+
+	return true
+}
+
+// RunTask runs the identity collector task.
+//
+//nolint:gocyclo,cyclop
+func (spec IdentityCollectorTaskSpec) RunTask(ctx context.Context, _ *zap.Logger, notify IdentityCollectorChan) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	clusterMachineIdentity := omni.NewClusterMachineIdentity(resources.DefaultNamespace, spec.id)
+	clusterMachineIdentity.Metadata().Labels().Set(omni.LabelCluster, spec.clusterName)
+
+	if spec.isControlPlane {
+		clusterMachineIdentity.Metadata().Labels().Set(omni.LabelControlPlaneRole, "")
+	} else {
+		clusterMachineIdentity.Metadata().Labels().Set(omni.LabelWorkerRole, "")
+	}
+
+	client, err := spec.getClient(ctx)
+	if err != nil {
+		return err
+	}
+
+	defer client.Close() //nolint:errcheck
+
+	watchCh := make(chan state.Event)
+
+	// Talos 1.3.0+ supports etcd.MemberID resource, so we can use it to get the member ID
+	// instead of running a loop which queries etcd directly.
+	//
+	// TODO: remove once Omni goes Talos 1.3.0+ only.
+	runLegacyEtcdMemberIDCollector := false
+
+	if spec.isControlPlane {
+		runLegacyEtcdMemberIDCollector, err = spec.shouldRunLegacyEtcdMemberIDCollector(ctx, client)
+		if err != nil {
+			return err
+		}
+	}
+
+	watchedResources := []resource.Resource{
+		cluster.NewIdentity(cluster.NamespaceName, cluster.LocalIdentity),
+		k8s.NewNodename(k8s.NamespaceName, k8s.NodenameID),
+		k8s.NewNodeIP(k8s.NamespaceName, k8s.KubeletID),
+	}
+
+	if spec.isControlPlane && !runLegacyEtcdMemberIDCollector {
+		watchedResources = append(watchedResources, etcd.NewMember(etcd.NamespaceName, etcd.LocalMemberID))
+	}
+
+	for _, watchedResource := range watchedResources {
+		if err = client.COSI.Watch(ctx, watchedResource.Metadata(), watchCh); err != nil {
+			return fmt.Errorf("error watching %s: %w", watchedResource.Metadata().ID(), err)
+		}
+	}
+
+	var wg sync.WaitGroup
+	defer wg.Wait()
+
+	if runLegacyEtcdMemberIDCollector {
+		wg.Add(1)
+
+		go func() {
+			defer wg.Done()
+
+			spec.runLegacyEtcdMemberIDCollector(ctx, client, watchCh) //nolint:errcheck
+		}()
+	}
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case event := <-watchCh:
+			switch event.Type {
+			case state.Errored:
+				return fmt.Errorf("watch failed: %w", event.Error)
+			case state.Bootstrapped, state.Destroyed:
+				// ignore
+			case state.Created, state.Updated:
+				switch r := event.Resource.(type) {
+				case *cluster.Identity:
+					clusterMachineIdentity.TypedSpec().Value.NodeIdentity = r.TypedSpec().NodeID
+				case *k8s.Nodename:
+					clusterMachineIdentity.TypedSpec().Value.Nodename = r.TypedSpec().Nodename
+				case *k8s.NodeIP:
+					clusterMachineIdentity.TypedSpec().Value.NodeIps = xslices.Map(
+						r.TypedSpec().Addresses,
+						netip.Addr.String,
+					)
+				case *etcd.Member:
+					membID, err := etcd.ParseMemberID(r.TypedSpec().MemberID)
+					if err != nil {
+						return fmt.Errorf("error parsing member ID: %w", err)
+					}
+
+					clusterMachineIdentity.TypedSpec().Value.EtcdMemberId = membID
+				}
+
+				channel.SendWithContext(ctx, notify, clusterMachineIdentity)
+			}
+		}
+	}
+}
+
+func (spec IdentityCollectorTaskSpec) shouldRunLegacyEtcdMemberIDCollector(ctx context.Context, client *client.Client) (bool, error) {
+	versionResp, err := client.Version(ctx)
+	if err != nil {
+		return false, fmt.Errorf("error getting version: %w", err)
+	}
+
+	if len(versionResp.Messages) != 1 {
+		return false, fmt.Errorf("unexpected number of version messages: %d", len(versionResp.Messages))
+	}
+
+	talosVersion := versionResp.Messages[0].Version.Tag
+	if parsedVersion, err := semver.ParseTolerant(talosVersion); err == nil {
+		if parsedVersion.LT(semver.MustParse("1.3.0")) {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
+
+func (spec IdentityCollectorTaskSpec) runLegacyEtcdMemberIDCollector(ctx context.Context, client *client.Client, watchCh chan state.Event) error {
+	return retry.Constant(time.Hour, retry.WithUnits(time.Second*5)).RetryWithContext(ctx, func(ctx context.Context) error {
+		memberID, err := spec.getEtcdMemberID(ctx, client)
+		if errors.Is(err, context.Canceled) {
+			return nil
+		}
+
+		if err != nil {
+			return retry.ExpectedError(err)
+		}
+
+		member := etcd.NewMember(etcd.NamespaceName, etcd.LocalMemberID)
+		member.TypedSpec().MemberID = etcd.FormatMemberID(memberID)
+
+		channel.SendWithContext(ctx, watchCh, state.Event{
+			Type:     state.Created,
+			Resource: member,
+		})
+
+		return nil
+	})
+}
+
+func (spec IdentityCollectorTaskSpec) getEtcdMemberID(ctx context.Context, client *client.Client) (uint64, error) {
+	ctx, cancel := context.WithTimeout(ctx, time.Second*5)
+
+	defer cancel()
+
+	var etcdClient *clientv3.Client
+
+	etcdClient, err := spec.getEtcdClient(ctx, client)
+	if err != nil {
+		return 0, err
+	}
+
+	defer etcdClient.Close() //nolint:errcheck
+
+	members, err := etcdClient.Cluster.MemberList(ctx)
+	if err != nil {
+		return 0, err
+	}
+
+	return members.Header.MemberId, nil
+}
+
+func (spec IdentityCollectorTaskSpec) getEtcdClient(ctx context.Context, client *client.Client) (*clientv3.Client, error) {
+	etcdResource, err := safe.StateGet[*secrets.Etcd](ctx, client.COSI, resource.NewMetadata(secrets.NamespaceName, secrets.EtcdType, secrets.EtcdID, resource.VersionUndefined))
+	if err != nil {
+		return nil, err
+	}
+
+	etcd := etcdResource.TypedSpec()
+
+	caCertPool := x509.NewCertPool()
+
+	serverCert, err := etcd.Etcd.GetCert()
+	if err != nil {
+		return nil, err
+	}
+
+	caCertPool.AddCert(serverCert)
+
+	clientCert, err := tls.X509KeyPair(etcd.EtcdAdmin.Crt, etcd.EtcdAdmin.Key)
+	if err != nil {
+		return nil, err
+	}
+
+	tlsConfig := &tls.Config{
+		RootCAs: caCertPool,
+		Certificates: []tls.Certificate{
+			clientCert,
+		},
+	}
+
+	c, err := clientv3.New(clientv3.Config{
+		Endpoints:   []string{net.JoinHostPort(spec.managementAddress, strconv.Itoa(constants.EtcdClientPort))},
+		DialTimeout: 5 * time.Second,
+		TLS:         tlsConfig,
+		Logger:      zap.NewNop(),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error building etcd client: %w", err)
+	}
+
+	return c, nil
+}
+
+func (spec IdentityCollectorTaskSpec) getClient(ctx context.Context) (*client.Client, error) {
+	opts := talos.GetSocketOptions(spec.managementAddress)
+
+	if opts == nil {
+		opts = append(opts, client.WithEndpoints(spec.managementAddress))
+	}
+
+	opts = append(opts, client.WithConfig(spec.config))
+
+	c, err := client.New(ctx, opts...)
+	if err != nil {
+		return nil, err
+	}
+
+	return c, err
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/task/image/image.go b/internal/backend/runtime/omni/controllers/omni/internal/task/image/image.go
new file mode 100644
index 000000000..5e3cf8e9c
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/task/image/image.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package image implements a task which pulls images to a node.
+package image
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/task/image/pulltask.go b/internal/backend/runtime/omni/controllers/omni/internal/task/image/pulltask.go
new file mode 100644
index 000000000..94c13d4ff
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/task/image/pulltask.go
@@ -0,0 +1,224 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package image
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/hashicorp/go-multierror"
+	"github.com/siderolabs/gen/channel"
+	"github.com/siderolabs/gen/xslices"
+	"go.uber.org/zap"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/image"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/task"
+)
+
+const (
+	listImagesTimeout = 15 * time.Second
+	pullImageTimeout  = 5 * time.Minute
+)
+
+// PullTaskSpec represents the spec of an image pull task.
+type PullTaskSpec struct {
+	request *omni.ImagePullRequest
+
+	imageClient image.Client
+}
+
+// NewPullTaskSpec creates new PullTaskSpec.
+func NewPullTaskSpec(request *omni.ImagePullRequest, imageClient image.Client) PullTaskSpec {
+	return PullTaskSpec{
+		request:     request,
+		imageClient: imageClient,
+	}
+}
+
+// ID returns the ID of the pull task.
+func (p PullTaskSpec) ID() task.ID {
+	return p.request.Metadata().ID()
+}
+
+// RunTask runs the pull task.
+func (p PullTaskSpec) RunTask(ctx context.Context, _ *zap.Logger, pullStatusCh PullStatusChan) error {
+	var (
+		currentNum, totalNum      int
+		currentNode, currentImage string
+		currentError              error
+		skipFinalEvent            bool
+	)
+
+	// make sure to call the callback at least once - even if there is
+	// no image to be pulled or if there was an error early on
+	defer func() {
+		if !skipFinalEvent {
+			channel.SendWithContext(ctx, pullStatusCh, PullStatus{
+				Request:    p.request,
+				Node:       currentNode,
+				Image:      currentImage,
+				CurrentNum: currentNum,
+				TotalNum:   totalNum,
+				Error:      currentError,
+			})
+		}
+	}()
+
+	clusterID, ok := p.request.Metadata().Labels().Get(omni.LabelCluster)
+	if !ok {
+		return fmt.Errorf("missing cluster label on %q", p.request.Metadata())
+	}
+
+	nodeImageInfoMap, err := p.getNodeImageInfos(ctx, p.request, clusterID)
+	if err != nil {
+		return err
+	}
+
+	for _, imageList := range p.request.TypedSpec().Value.GetNodeImageList() {
+		totalNum += len(imageList.Images)
+	}
+
+	var errs error
+
+	for _, imageList := range p.request.TypedSpec().Value.GetNodeImageList() {
+		currentNode = imageList.Node
+
+		for _, img := range imageList.Images {
+			currentImage = img
+			currentNum++
+
+			if nodeImageInfoMap.shouldPull(imageList.Node, img) {
+				currentError = p.pullImage(ctx, clusterID, imageList.Node, img)
+
+				errs = multierror.Append(errs, currentError)
+
+				skipFinalEvent = true // we are already sending an event, so no need to send one at the end
+
+				if !channel.SendWithContext(ctx, pullStatusCh, PullStatus{
+					Request:    p.request,
+					Node:       currentNode,
+					Image:      currentImage,
+					CurrentNum: currentNum,
+					TotalNum:   totalNum,
+					Error:      currentError,
+				}) {
+					return errs
+				}
+			}
+		}
+	}
+
+	return errs
+}
+
+// Equal returns true if the pull task spec is equal to the other pull task spec.
+func (p PullTaskSpec) Equal(other PullTaskSpec) bool {
+	if p.request.Metadata().ID() != other.request.Metadata().ID() {
+		return false
+	}
+
+	nodeImageList := p.request.TypedSpec().Value.GetNodeImageList()
+	otherNodeImageList := other.request.TypedSpec().Value.GetNodeImageList()
+
+	if len(nodeImageList) != len(otherNodeImageList) {
+		return false
+	}
+
+	for i, imageList := range nodeImageList {
+		otherImageList := otherNodeImageList[i]
+
+		if imageList.Node != otherImageList.Node {
+			return false
+		}
+
+		if !slices.Equal(imageList.Images, otherImageList.Images) {
+			return false
+		}
+	}
+
+	return true
+}
+
+func (p PullTaskSpec) pullImage(ctx context.Context, clusterID resource.ID, node, image string) error {
+	ctx, cancel := context.WithTimeout(ctx, pullImageTimeout)
+	defer cancel()
+
+	if err := p.imageClient.PullImageToNode(ctx, clusterID, node, image); err != nil {
+		return fmt.Errorf("failed to pull image %q to node %q", image, node)
+	}
+
+	return nil
+}
+
+func (p PullTaskSpec) getNodeImageInfos(ctx context.Context, request *omni.ImagePullRequest, clusterID string) (nodeImageInfos, error) {
+	nodeToNodeImageInfo := make(map[string]nodeImageInfo)
+
+	for _, images := range request.TypedSpec().Value.GetNodeImageList() {
+		if _, exists := nodeToNodeImageInfo[images.Node]; exists {
+			continue
+		}
+
+		imageSet, err := p.getImageSetOnNode(ctx, clusterID, images.Node)
+		if err != nil {
+			return nodeImageInfos{}, err
+		}
+
+		nodeToNodeImageInfo[images.Node] = imageSet
+	}
+
+	return nodeImageInfos{nodeToNodeImageInfo: nodeToNodeImageInfo}, nil
+}
+
+func (p PullTaskSpec) getImageSetOnNode(ctx context.Context, clusterID resource.ID, node string) (nodeImageInfo, error) {
+	ctx, cancel := context.WithTimeout(ctx, listImagesTimeout)
+	defer cancel()
+
+	images, err := p.imageClient.ListImagesOnNode(ctx, clusterID, node)
+	if err != nil {
+		if status.Code(err) == codes.Unimplemented {
+			return nodeImageInfo{
+				supportsImagePull: false,
+			}, nil
+		}
+
+		return nodeImageInfo{}, fmt.Errorf("failed to list images on node %q: %w", node, err)
+	}
+
+	return nodeImageInfo{
+		existingImageSet:  xslices.ToSet(images),
+		supportsImagePull: true,
+	}, nil
+}
+
+type nodeImageInfo struct {
+	existingImageSet  map[string]struct{}
+	supportsImagePull bool
+}
+
+type nodeImageInfos struct {
+	nodeToNodeImageInfo map[string]nodeImageInfo
+}
+
+func (i *nodeImageInfos) shouldPull(node, image string) bool {
+	imageSet, ok := i.nodeToNodeImageInfo[node]
+	if !ok {
+		return false
+	}
+
+	if !imageSet.supportsImagePull {
+		return false
+	}
+
+	_, exists := imageSet.existingImageSet[image]
+
+	return !exists
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/task/image/status.go b/internal/backend/runtime/omni/controllers/omni/internal/task/image/status.go
new file mode 100644
index 000000000..de4df6968
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/task/image/status.go
@@ -0,0 +1,21 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package image
+
+import "github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+
+// PullStatusChan is a channel for sending PullStatus from tasks back to the controller.
+type PullStatusChan chan<- PullStatus
+
+// PullStatus represents the status of a pull operation.
+type PullStatus struct {
+	Error      error
+	Request    *omni.ImagePullRequest
+	Node       string
+	Image      string
+	CurrentNum int
+	TotalNum   int
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/task/machine/helpers.go b/internal/backend/runtime/omni/controllers/omni/internal/task/machine/helpers.go
new file mode 100644
index 000000000..192fa8fce
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/task/machine/helpers.go
@@ -0,0 +1,37 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package machine
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+)
+
+func forEachResource[T resource.Resource](
+	ctx context.Context,
+	c *client.Client,
+	namespace resource.Namespace,
+	resourceType resource.Type,
+	callback func(T) error,
+) error {
+	items, err := safe.StateList[T](ctx, c.COSI, resource.NewMetadata(namespace, resourceType, "", resource.VersionUndefined))
+	if err != nil {
+		return err
+	}
+
+	iter := items.Iterator()
+
+	for iter.Next() {
+		if err = callback(iter.Value()); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/task/machine/machine.go b/internal/backend/runtime/omni/controllers/omni/internal/task/machine/machine.go
new file mode 100644
index 000000000..c9bba2274
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/task/machine/machine.go
@@ -0,0 +1,350 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package machine implements a task which collects information from a Machine (either joined to a cluster or not).
+package machine
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/channel"
+	"github.com/siderolabs/gen/maps"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+	"github.com/siderolabs/talos/pkg/machinery/resources/hardware"
+	"github.com/siderolabs/talos/pkg/machinery/resources/network"
+	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"
+	"go.uber.org/zap"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+)
+
+// Info contains information gathered about a machine.
+type Info struct { //nolint:govet
+	TalosVersion  *string
+	Arch          *string
+	MachineLabels *omni.MachineLabels
+
+	Hostname        *string
+	Domainname      *string
+	Addresses       []string
+	DefaultGateways []string
+	NetworkLinks    []*specs.MachineStatusSpec_NetworkStatus_NetworkLinkStatus
+	ImageLabels     map[string]string
+
+	Processors    []*specs.MachineStatusSpec_HardwareStatus_Processor
+	MemoryModules []*specs.MachineStatusSpec_HardwareStatus_MemoryModule
+	Blockdevices  []*specs.MachineStatusSpec_HardwareStatus_BlockDevice
+
+	PlatformMetadata *specs.MachineStatusSpec_PlatformMetadata
+	Schematic        *specs.MachineStatusSpec_Schematic
+
+	LastError       error
+	MachineID       string
+	MaintenanceMode bool
+	NoAccess        bool
+}
+
+// InfoChan is a channel for sending machine info from tasks back to the controller.
+type InfoChan chan<- Info
+
+// CollectTaskSpec describes a task to collect machine information.
+type CollectTaskSpec struct {
+	_ [0]func() // make uncomparable
+
+	TalosConfig   *omni.TalosConfig
+	MachineLabels *omni.MachineLabels
+	Endpoint      string
+	MachineID     string
+
+	MaintenanceMode bool
+}
+
+func resourceEqual[T any, S interface {
+	resource.Resource
+	*T
+}](a, b S) bool {
+	if a == nil && b == nil {
+		return true
+	}
+
+	if a == nil || b == nil {
+		return false
+	}
+
+	return resource.Equal(a, b)
+}
+
+// Equal compares two task specs for the same machine.
+//
+// If the task spec changes, the task will be restarted.
+func (spec CollectTaskSpec) Equal(other CollectTaskSpec) bool {
+	if spec.Endpoint != other.Endpoint || spec.MaintenanceMode != other.MaintenanceMode {
+		return false
+	}
+
+	if !resourceEqual(spec.TalosConfig, other.TalosConfig) {
+		return false
+	}
+
+	return resourceEqual(spec.MachineLabels, other.MachineLabels)
+}
+
+// ID returns the task ID.
+func (spec CollectTaskSpec) ID() string {
+	return spec.MachineID
+}
+
+func (spec CollectTaskSpec) sendInfo(ctx context.Context, info Info, notifyCh InfoChan, err error) bool {
+	info.MaintenanceMode = spec.MaintenanceMode
+	info.MachineID = spec.MachineID
+
+	if err != nil {
+		switch {
+		case spec.MaintenanceMode && status.Code(err) == codes.Unavailable && strings.Contains(err.Error(), "tls: bad certificate") ||
+			strings.Contains(err.Error(), "tls: certificate required") ||
+			strings.Contains(err.Error(), "x509: certificate signed by unknown authority"):
+			info.NoAccess = true
+			info.LastError = errors.New("service expects the machine to run the maintenance mode, but the machine requires a certificate")
+		case strings.Contains(err.Error(), "transport: authentication handshake failed: tls: failed to verify certificate: x509: certificate has expired"):
+			info.NoAccess = true
+
+			info.LastError = errors.New("the machine time is out of sync")
+		case strings.Contains(err.Error(), "connect: network is unreachable") ||
+			strings.Contains(err.Error(), "connect: no route to host"):
+			// skip these types of errors as they are most likely caused by Wireguard not being ready
+		default:
+			info.LastError = errors.New("unknown error")
+		}
+	}
+
+	return channel.SendWithContext(ctx, notifyCh, info)
+}
+
+// RunTask runs the machine info collect task.
+//
+// It creates either a maintenance Talos API client or a regular one (depends on the spec).
+//
+// It subscribes to resource updates and polls for resources that can't be watched.
+//
+//nolint:gocyclo,cyclop,gocognit
+func (spec CollectTaskSpec) RunTask(ctx context.Context, _ *zap.Logger, notifyCh InfoChan) error {
+	var (
+		c   *client.Client
+		err error
+	)
+
+	opts := talos.GetSocketOptions(spec.Endpoint)
+
+	if spec.MaintenanceMode {
+		opts = append(opts, client.WithTLSConfig(insecureTLSConfig), client.WithEndpoints(spec.Endpoint))
+
+		c, err = client.New(ctx, opts...)
+	} else {
+		if spec.TalosConfig == nil {
+			return errors.New("no talosconfig, and not in maintenance mode")
+		}
+
+		config := omni.NewTalosClientConfig(spec.TalosConfig, spec.Endpoint)
+
+		opts = append(opts, client.WithConfig(config))
+
+		c, err = client.New(ctx, opts...)
+	}
+
+	if err != nil {
+		return fmt.Errorf("error building Talos API client: %w", err)
+	}
+
+	defer c.Close() //nolint:errcheck
+
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	const (
+		disksPollInterval = 5 * time.Minute
+		minPolInterval    = time.Second
+	)
+
+	disksTicker := time.NewTicker(disksPollInterval)
+	defer disksTicker.Stop()
+
+	pollTicker := time.NewTicker(minPolInterval)
+	defer pollTicker.Stop()
+
+	watchCh := make(chan state.Event)
+
+	// query all resources to start watching only resources that are defined for running version of talos
+	resources, err := safe.StateList[*meta.ResourceDefinition](ctx, c.COSI, resource.NewMetadata(meta.NamespaceName, meta.ResourceDefinitionType, "", resource.VersionUndefined))
+	if err != nil {
+		// this is the first request to the Talos API
+		// if it fails we handle it and update the machine status with the request error
+		if !spec.sendInfo(ctx, Info{}, notifyCh, err) {
+			return nil
+		}
+
+		return fmt.Errorf("failed to list resource definitions: %w", err)
+	}
+
+	registeredTypes := map[resource.Type]struct{}{}
+
+	resources.ForEach(func(rd *meta.ResourceDefinition) {
+		registeredTypes[rd.TypedSpec().Type] = struct{}{}
+	})
+
+	// as Talos < 1.3.0 doesn't support Bootstrapped event, we use a mixed approach:
+	// watch is used to trigger polling on changes to the resources
+	watchers := map[resource.Type]struct {
+		filterFunc func(r resource.Resource) bool
+		namespace  resource.Namespace
+	}{
+		// NB: keep in sync with machinePollers
+		network.HostnameStatusType: {
+			namespace: network.NamespaceName,
+		},
+		network.LinkStatusType: {
+			namespace:  network.NamespaceName,
+			filterFunc: typedFilter(filterNetworkLinks),
+		},
+		network.RouteStatusType: {
+			namespace:  network.NamespaceName,
+			filterFunc: typedFilter(filterRoutes),
+		},
+		network.NodeAddressType: {
+			namespace:  network.NamespaceName,
+			filterFunc: typedFilter(filterAddresses(spec.MaintenanceMode)),
+		},
+		hardware.ProcessorType: {
+			namespace: hardware.NamespaceName,
+		},
+		hardware.MemoryModuleType: {
+			namespace: hardware.NamespaceName,
+		},
+		runtime.PlatformMetadataType: {
+			namespace: runtime.NamespaceName,
+		},
+		runtime.MetaKeyType: {
+			namespace: runtime.NamespaceName,
+		},
+		runtime.ExtensionStatusType: {
+			namespace: runtime.NamespaceName,
+		},
+	}
+
+	for resourceType, watcher := range watchers {
+		if _, registered := registeredTypes[resourceType]; !registered {
+			continue
+		}
+
+		if err = c.COSI.WatchKind(ctx, resource.NewMetadata(watcher.namespace, resourceType, "", resource.VersionUndefined), watchCh); err != nil {
+			return fmt.Errorf("error watching COSI resource: %w", err)
+		}
+	}
+
+	dirtyPollers := map[string]struct{}{}
+
+	// mark everything as dirty on start
+	for k := range machinePollers {
+		dirtyPollers[k] = struct{}{}
+	}
+
+	for k := range resourcePollers {
+		if _, ok := registeredTypes[k]; !ok {
+			continue
+		}
+
+		dirtyPollers[k] = struct{}{}
+	}
+
+	for {
+		if len(dirtyPollers) > 0 {
+			info, err := spec.poll(ctx, c, maps.Keys(dirtyPollers))
+
+			if !spec.sendInfo(ctx, info, notifyCh, err) {
+				return nil
+			}
+
+			if err != nil {
+				return fmt.Errorf("poll failed %w", err)
+			}
+
+			dirtyPollers = map[string]struct{}{}
+		}
+
+	waitLoop:
+		for {
+			select {
+			case <-ctx.Done():
+				return nil
+			case <-disksTicker.C:
+				// poll disks as we have no way to watch for changes
+				dirtyPollers["disks"] = struct{}{}
+			case <-pollTicker.C:
+				break waitLoop
+			case event := <-watchCh:
+				switch event.Type {
+				case state.Errored:
+					return fmt.Errorf("error watching COSI resource: %w", event.Error)
+				case state.Bootstrapped:
+					// ignore
+				case state.Created, state.Updated, state.Destroyed:
+					markAsDirty := true
+
+					if watchers[event.Resource.Metadata().Type()].filterFunc != nil && !resource.IsTombstone(event.Resource) { // can't run filter for tombstones
+						markAsDirty = watchers[event.Resource.Metadata().Type()].filterFunc(event.Resource)
+					}
+
+					if markAsDirty {
+						dirtyPollers[event.Resource.Metadata().Type()] = struct{}{}
+					}
+				}
+			}
+		}
+	}
+}
+
+func (spec CollectTaskSpec) poll(ctx context.Context, c *client.Client, pollers []string) (Info, error) {
+	info := Info{
+		// set this early to make pollers act on the maintenance/normal mode
+		MaintenanceMode: spec.MaintenanceMode,
+		// set this early to make pollers act on the machine labels
+		MachineLabels: spec.MachineLabels,
+	}
+
+	for _, poller := range pollers {
+		if err := poll(ctx, poller, c, &info); err != nil {
+			return info, err
+		}
+	}
+
+	return info, nil
+}
+
+var insecureTLSConfig = &tls.Config{
+	InsecureSkipVerify: true,
+}
+
+func typedFilter[T resource.Resource](fn func(T) bool) func(r resource.Resource) bool {
+	return func(r resource.Resource) bool {
+		arg, ok := r.(T)
+		if !ok {
+			return false
+		}
+
+		return fn(arg)
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/task/machine/poll.go b/internal/backend/runtime/omni/controllers/omni/internal/task/machine/poll.go
new file mode 100644
index 000000000..dca89272e
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/task/machine/poll.go
@@ -0,0 +1,342 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package machine
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+
+	"github.com/siderolabs/gen/value"
+	"github.com/siderolabs/go-pointer"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+	"github.com/siderolabs/talos/pkg/machinery/nethelpers"
+	"github.com/siderolabs/talos/pkg/machinery/resources/hardware"
+	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
+	"github.com/siderolabs/talos/pkg/machinery/resources/network"
+	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"
+	"google.golang.org/grpc/codes"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	omnimeta "github.com/siderolabs/omni/client/pkg/meta"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/talos"
+)
+
+type machinePollFunction func(ctx context.Context, c *client.Client, info *Info) error
+
+var resourcePollers = map[string]machinePollFunction{
+	network.HostnameStatusType:   pollHostname,
+	network.RouteStatusType:      pollRoutes,
+	network.NodeAddressType:      pollAddresses,
+	network.LinkStatusType:       pollNetworkLinks,
+	hardware.ProcessorType:       pollProcessors,
+	hardware.MemoryModuleType:    pollMemory,
+	runtime.PlatformMetadataType: pollPlatformMetadata,
+	runtime.MetaKeyType:          pollMeta,
+	runtime.ExtensionStatusType:  pollExtensions,
+}
+
+var machinePollers = map[string]machinePollFunction{
+	"version": pollVersion,
+	"disks":   pollDisks,
+}
+
+var allPollers = merged(resourcePollers, machinePollers)
+
+func merged[K comparable, V any](m1, m2 map[K]V) map[K]V {
+	res := maps.Clone(m1)
+
+	maps.Copy(res, m2)
+
+	return res
+}
+
+func poll(ctx context.Context, poller string, c *client.Client, info *Info) error {
+	f, ok := allPollers[poller]
+	if !ok {
+		panic(fmt.Sprintf("unknown poller %q", poller))
+	}
+
+	return f(ctx, c, info)
+}
+
+func pollVersion(ctx context.Context, c *client.Client, info *Info) error {
+	versionResp, err := c.Version(ctx)
+	if err != nil && client.StatusCode(err) != codes.Unimplemented {
+		return err
+	}
+
+	for _, msg := range versionResp.GetMessages() {
+		info.TalosVersion = pointer.To(msg.GetVersion().GetTag())
+		info.Arch = pointer.To(msg.GetVersion().GetArch())
+	}
+
+	return nil
+}
+
+func pollHostname(ctx context.Context, c *client.Client, info *Info) error {
+	return forEachResource(
+		ctx,
+		c,
+		network.NamespaceName,
+		network.HostnameStatusType,
+		func(r *network.HostnameStatus) error {
+			info.Hostname = pointer.To(r.TypedSpec().Hostname)
+			info.Domainname = pointer.To(r.TypedSpec().Domainname)
+
+			return nil
+		})
+}
+
+func filterAddresses(maintenanceMode bool) func(r *network.NodeAddress) bool {
+	if maintenanceMode {
+		return func(r *network.NodeAddress) bool {
+			return r.Metadata().ID() == network.NodeAddressCurrentID
+		}
+	}
+
+	return func(r *network.NodeAddress) bool {
+		return r.Metadata().ID() == network.FilteredNodeAddressID(network.NodeAddressCurrentID, k8s.NodeAddressFilterNoK8s)
+	}
+}
+
+func pollAddresses(ctx context.Context, c *client.Client, info *Info) error {
+	return forEachResource(
+		ctx,
+		c,
+		network.NamespaceName,
+		network.NodeAddressType,
+		func(r *network.NodeAddress) error {
+			if info.MaintenanceMode {
+				// in maintenance mode, there is no Kubernetes, and filtered addresses
+				if r.Metadata().ID() != network.NodeAddressCurrentID {
+					return nil
+				}
+			} else {
+				// in normal mode, use filtered addresses (without Kubernetes)
+				if r.Metadata().ID() != network.FilteredNodeAddressID(network.NodeAddressCurrentID, k8s.NodeAddressFilterNoK8s) {
+					return nil
+				}
+			}
+
+			info.Addresses = make([]string, 0, len(r.TypedSpec().Addresses))
+
+			for _, addr := range r.TypedSpec().Addresses {
+				// skip SideroLink addresses
+				if network.IsULA(addr.Addr(), network.ULASideroLink) {
+					continue
+				}
+
+				info.Addresses = append(info.Addresses, addr.String())
+			}
+
+			return nil
+		})
+}
+
+func filterRoutes(r *network.RouteStatus) bool {
+	return value.IsZero(r.TypedSpec().Destination) && r.TypedSpec().Gateway.IsValid() && r.TypedSpec().Scope == nethelpers.ScopeGlobal
+}
+
+func pollRoutes(ctx context.Context, c *client.Client, info *Info) error {
+	info.DefaultGateways = nil
+
+	return forEachResource(
+		ctx,
+		c,
+		network.NamespaceName,
+		network.RouteStatusType,
+		func(r *network.RouteStatus) error {
+			if value.IsZero(r.TypedSpec().Destination) && r.TypedSpec().Gateway.IsValid() && r.TypedSpec().Scope == nethelpers.ScopeGlobal {
+				info.DefaultGateways = append(info.DefaultGateways, r.TypedSpec().Gateway.String())
+			}
+
+			return nil
+		})
+}
+
+func filterNetworkLinks(r *network.LinkStatus) bool {
+	return r.TypedSpec().Physical()
+}
+
+func pollNetworkLinks(ctx context.Context, c *client.Client, info *Info) error {
+	info.NetworkLinks = nil
+
+	return forEachResource(
+		ctx,
+		c,
+		network.NamespaceName,
+		network.LinkStatusType,
+		func(r *network.LinkStatus) error {
+			if !r.TypedSpec().Physical() {
+				return nil
+			}
+
+			info.NetworkLinks = append(info.NetworkLinks, &specs.MachineStatusSpec_NetworkStatus_NetworkLinkStatus{
+				LinuxName:       r.Metadata().ID(),
+				HardwareAddress: r.TypedSpec().HardwareAddr.String(),
+				SpeedMbps:       uint32(r.TypedSpec().SpeedMegabits),
+				LinkUp:          r.TypedSpec().LinkState,
+				Description:     fmt.Sprintf("%s %s", r.TypedSpec().Vendor, r.TypedSpec().Product),
+			})
+
+			return nil
+		})
+}
+
+func pollProcessors(ctx context.Context, c *client.Client, info *Info) error {
+	info.Processors = nil
+
+	return forEachResource(
+		ctx,
+		c,
+		hardware.NamespaceName,
+		hardware.ProcessorType,
+		func(r *hardware.Processor) error {
+			if r.TypedSpec().CoreCount == 0 || r.TypedSpec().MaxSpeed == 0 {
+				return nil
+			}
+
+			info.Processors = append(info.Processors, &specs.MachineStatusSpec_HardwareStatus_Processor{
+				CoreCount:    r.TypedSpec().CoreCount,
+				ThreadCount:  r.TypedSpec().ThreadCount,
+				Frequency:    r.TypedSpec().MaxSpeed,
+				Manufacturer: r.TypedSpec().Manufacturer,
+				Description:  fmt.Sprintf("%s %s", r.TypedSpec().Manufacturer, r.TypedSpec().ProductName),
+			})
+
+			return nil
+		})
+}
+
+func pollMemory(ctx context.Context, c *client.Client, info *Info) error {
+	info.MemoryModules = nil
+
+	return forEachResource(
+		ctx,
+		c,
+		hardware.NamespaceName,
+		hardware.MemoryModuleType,
+		func(r *hardware.MemoryModule) error {
+			if r.TypedSpec().Size == 0 {
+				return nil
+			}
+
+			info.MemoryModules = append(info.MemoryModules, &specs.MachineStatusSpec_HardwareStatus_MemoryModule{
+				SizeMb:      r.TypedSpec().Size,
+				Description: r.TypedSpec().Manufacturer,
+			})
+
+			return nil
+		})
+}
+
+func pollPlatformMetadata(ctx context.Context, c *client.Client, info *Info) error {
+	return forEachResource(
+		ctx,
+		c,
+		runtime.NamespaceName,
+		runtime.PlatformMetadataType,
+		func(r *runtime.PlatformMetadata) error {
+			info.PlatformMetadata = &specs.MachineStatusSpec_PlatformMetadata{
+				Platform:     r.TypedSpec().Platform,
+				Hostname:     r.TypedSpec().Hostname,
+				Region:       r.TypedSpec().Region,
+				Zone:         r.TypedSpec().Zone,
+				InstanceType: r.TypedSpec().InstanceType,
+				InstanceId:   r.TypedSpec().InstanceID,
+				ProviderId:   r.TypedSpec().ProviderID,
+				Spot:         r.TypedSpec().Spot,
+			}
+
+			return nil
+		})
+}
+
+func pollDisks(ctx context.Context, c *client.Client, info *Info) error {
+	info.Blockdevices = nil
+
+	disksResp, err := c.Disks(ctx)
+	if err != nil {
+		return err
+	}
+
+	for _, msg := range disksResp.GetMessages() {
+		for _, disk := range msg.GetDisks() {
+			info.Blockdevices = append(info.Blockdevices, &specs.MachineStatusSpec_HardwareStatus_BlockDevice{
+				Size:       disk.GetSize(),
+				Model:      disk.GetModel(),
+				LinuxName:  disk.GetDeviceName(),
+				Name:       disk.GetName(),
+				Serial:     disk.GetSerial(),
+				Uuid:       disk.GetUuid(),
+				Wwid:       disk.GetWwid(),
+				Type:       disk.GetType().String(),
+				BusPath:    disk.GetBusPath(),
+				SystemDisk: disk.GetSystemDisk(),
+			})
+		}
+	}
+
+	return nil
+}
+
+func pollMeta(ctx context.Context, c *client.Client, info *Info) error {
+	return forEachResource(
+		ctx,
+		c,
+		runtime.NamespaceName,
+		runtime.MetaKeyType,
+		func(metaKey *runtime.MetaKey) error {
+			if metaKey.Metadata().ID() != runtime.MetaKeyTagToID(omnimeta.LabelsMeta) {
+				return nil
+			}
+
+			imageLabels, err := omnimeta.ParseLabels([]byte(metaKey.TypedSpec().Value))
+			if err != nil {
+				return err
+			}
+
+			labels := imageLabels.Labels
+
+			// fallback to legacy labels
+			if labels == nil {
+				labels = imageLabels.LegacyLabels
+			}
+
+			// filter out labels which are already defined in the machine labels resource
+			if labels != nil && info.MachineLabels != nil {
+				for _, k := range info.MachineLabels.Metadata().Labels().Keys() {
+					delete(labels, k)
+				}
+			}
+
+			info.ImageLabels = labels
+
+			return nil
+		})
+}
+
+func pollExtensions(ctx context.Context, c *client.Client, info *Info) error {
+	machineSchematic := &specs.MachineStatusSpec_Schematic{}
+	info.Schematic = machineSchematic
+
+	var err error
+
+	machineSchematic.Id, err = talos.GetSchematicID(ctx, c)
+	if err != nil {
+		if errors.Is(err, talos.ErrInvalidSchematic) {
+			machineSchematic.Invalid = true
+
+			return nil
+		}
+
+		return err
+	}
+
+	return nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/task/runner.go b/internal/backend/runtime/omni/controllers/omni/internal/task/runner.go
new file mode 100644
index 000000000..d5e857a17
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/task/runner.go
@@ -0,0 +1,73 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package task
+
+import (
+	"context"
+
+	"go.uber.org/zap"
+)
+
+// EqualityFunc is used to compare two task specs.
+type EqualityFunc[T any] func(x, y T) bool
+
+// Runner manages running tasks.
+type Runner[T any, S Spec[T]] struct {
+	running      map[ID]*Task[T, S]
+	equalityFunc EqualityFunc[S]
+}
+
+// NewRunner creates a new task runner.
+func NewRunner[T any, S Spec[T]](equalityFunc EqualityFunc[S]) *Runner[T, S] {
+	if equalityFunc == nil {
+		panic("equalityFunc must not be nil")
+	}
+
+	return &Runner[T, S]{
+		running:      make(map[ID]*Task[T, S]),
+		equalityFunc: equalityFunc,
+	}
+}
+
+// NewEqualRunner creates a new task runner from spec with Equal method.
+func NewEqualRunner[S EqualSpec[T, S], T any]() *Runner[T, S] {
+	return NewRunner[T, S](func(x, y S) bool { return x.Equal(y) })
+}
+
+// Stop all running tasks.
+func (runner *Runner[T, S]) Stop() {
+	for _, task := range runner.running {
+		task.Stop()
+	}
+}
+
+// Reconcile running tasks.
+func (runner *Runner[T, S]) Reconcile(ctx context.Context, logger *zap.Logger, shouldRun map[ID]S, in T) {
+	// stop running tasks which shouldn't run
+	for id := range runner.running {
+		if _, exists := shouldRun[id]; !exists {
+			logger.Debug("stopping task", zap.String("task", id))
+
+			runner.running[id].Stop()
+			delete(runner.running, id)
+		} else if !runner.equalityFunc(shouldRun[id], runner.running[id].Spec()) {
+			logger.Debug("replacing task", zap.String("task", id))
+
+			runner.running[id].Stop()
+			delete(runner.running, id)
+		}
+	}
+
+	// start tasks which aren't running
+	for id := range shouldRun {
+		if _, exists := runner.running[id]; !exists {
+			runner.running[id] = New(logger, shouldRun[id], in)
+
+			logger.Debug("starting task", zap.String("task", id))
+			runner.running[id].Start(ctx)
+		}
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/task/runner_test.go b/internal/backend/runtime/omni/controllers/omni/internal/task/runner_test.go
new file mode 100644
index 000000000..52723fe89
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/task/runner_test.go
@@ -0,0 +1,74 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package task_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/task"
+)
+
+func TestRunner(t *testing.T) {
+	t.Parallel()
+
+	logger := zaptest.NewLogger(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	assert := assert.New(t)
+
+	in := &taskInputMock{
+		commandCh: make(chan taskCommand),
+	}
+
+	assertTask := func(id string, expectedRunning bool) {
+		assert.Eventually(func() bool {
+			running, _ := in.runningTasks.Get(id)
+
+			return running == expectedRunning
+		}, time.Second, time.Millisecond)
+	}
+
+	runner := task.NewRunner(func(a, b taskSpec) bool {
+		return a == b
+	})
+
+	runner.Reconcile(ctx, logger, nil, in)
+
+	runner.Reconcile(ctx, logger, map[task.ID]taskSpec{
+		"task1": "task1",
+		"task2": "task2",
+	}, in)
+
+	assertTask("task1", true)
+	assertTask("task2", true)
+
+	runner.Reconcile(ctx, logger, map[task.ID]taskSpec{
+		"task2": "task2",
+	}, in)
+
+	assertTask("task1", false)
+	assertTask("task2", true)
+
+	runner.Reconcile(ctx, logger, map[task.ID]taskSpec{
+		"task2": "task3", // a bit of hack with different IDs to test the replace logic
+		"task4": "task4",
+	}, in)
+
+	assertTask("task2", false)
+	assertTask("task3", true)
+	assertTask("task4", true)
+
+	runner.Stop()
+
+	assertTask("task3", false)
+	assertTask("task4", false)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/task/task.go b/internal/backend/runtime/omni/controllers/omni/internal/task/task.go
new file mode 100644
index 000000000..cfcf7843c
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/task/task.go
@@ -0,0 +1,114 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package task implements generic controller tasks running in goroutines.
+package task
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"go.uber.org/zap"
+)
+
+// ID is a task ID.
+type ID = string
+
+// Spec configures a task.
+type Spec[T any] interface {
+	ID() ID
+	RunTask(ctx context.Context, logger *zap.Logger, in T) error
+}
+
+// Task is a generic controller task that can run in a goroutine with restarts and panic handling.
+type Task[T any, S Spec[T]] struct {
+	spec S
+	in   T
+
+	logger *zap.Logger
+	cancel context.CancelFunc
+	wg     sync.WaitGroup
+}
+
+// New creates a new task.
+func New[T any, S Spec[T]](logger *zap.Logger, spec S, in T) *Task[T, S] {
+	return &Task[T, S]{
+		spec:   spec,
+		in:     in,
+		logger: logger.With(zap.String("task", spec.ID())),
+	}
+}
+
+// Spec returns the task spec.
+func (task *Task[T, S]) Spec() S {
+	return task.spec
+}
+
+// Start the task in a separate goroutine.
+func (task *Task[T, S]) Start(ctx context.Context) {
+	task.wg.Add(1)
+
+	ctx, task.cancel = context.WithCancel(ctx)
+
+	go func() {
+		defer task.wg.Done()
+
+		task.runWithRestarts(ctx)
+	}()
+}
+
+func (task *Task[T, S]) runWithRestarts(ctx context.Context) {
+	backoff := backoff.NewExponentialBackOff()
+
+	// disable number of retries limit
+	backoff.MaxElapsedTime = 0
+
+	for ctx.Err() == nil {
+		err := task.runWithPanicHandler(ctx)
+
+		// finished without an error
+		if err == nil {
+			return
+		}
+
+		interval := backoff.NextBackOff()
+
+		task.logger.Error("restarting task", zap.Duration("interval", interval), zap.Error(err))
+
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(interval):
+		}
+	}
+}
+
+func (task *Task[T, S]) runWithPanicHandler(ctx context.Context) (err error) { //nolint:nonamedreturns
+	defer func() {
+		if p := recover(); p != nil {
+			err = fmt.Errorf("panic: %v", p)
+
+			task.logger.Error("task panicked", zap.Stack("stack"), zap.Error(err))
+		}
+	}()
+
+	return task.spec.RunTask(ctx, task.logger, task.in)
+}
+
+// Stop the task waiting for it to finish.
+func (task *Task[T, S]) Stop() {
+	task.cancel()
+
+	task.wg.Wait()
+}
+
+// EqualSpec is like [Spec] but it requires an Equal method from the spec.
+type EqualSpec[T any, S Spec[T]] interface {
+	Spec[T]
+	Equal(S) bool
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/internal/task/task_test.go b/internal/backend/runtime/omni/controllers/omni/internal/task/task_test.go
new file mode 100644
index 000000000..7c0b5e5df
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/internal/task/task_test.go
@@ -0,0 +1,98 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package task_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/siderolabs/gen/containers"
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/task"
+)
+
+type taskCommand struct {
+	returnWithError error
+	panicNow        bool
+}
+
+type taskInputMock struct {
+	commandCh    chan taskCommand
+	runningTasks containers.ConcurrentMap[task.ID, bool]
+}
+
+type taskSpec task.ID
+
+func (spec taskSpec) ID() task.ID {
+	return task.ID(spec)
+}
+
+func (spec taskSpec) RunTask(ctx context.Context, _ *zap.Logger, in *taskInputMock) error {
+	in.runningTasks.Set(task.ID(spec), true)
+	defer in.runningTasks.Set(task.ID(spec), false)
+
+	select {
+	case <-ctx.Done():
+		return nil
+	case cmd := <-in.commandCh:
+		if cmd.panicNow {
+			panic("panic")
+		}
+
+		return cmd.returnWithError
+	}
+}
+
+func TestTask(t *testing.T) {
+	t.Parallel()
+
+	logger := zaptest.NewLogger(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	assert := assert.New(t)
+
+	in := &taskInputMock{
+		commandCh: make(chan taskCommand),
+	}
+
+	assertTask := func(id string, expectedRunning bool) {
+		assert.Eventually(func() bool {
+			running, _ := in.runningTasks.Get(id)
+
+			return running == expectedRunning
+		}, 3*time.Second, time.Millisecond)
+	}
+
+	t1 := task.New(logger, taskSpec("task1"), in)
+	t1.Start(ctx)
+
+	assertTask("task1", true)
+
+	// should restart on panic
+	in.commandCh <- taskCommand{
+		panicNow: true,
+	}
+
+	assertTask("task1", false)
+	assertTask("task1", true)
+
+	// short restart on error
+	in.commandCh <- taskCommand{
+		returnWithError: errors.New("failed"),
+	}
+
+	assertTask("task1", false)
+	assertTask("task1", true)
+
+	t1.Stop()
+	assertTask("task1", false)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/key_pruner.go b/internal/backend/runtime/omni/controllers/omni/key_pruner.go
new file mode 100644
index 000000000..40b381076
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/key_pruner.go
@@ -0,0 +1,130 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/benbjohnson/clock"
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+)
+
+// KeyPrunerController is a controller which periodically prunes expired public keys.
+type KeyPrunerController struct {
+	clock clock.Clock
+
+	interval time.Duration
+}
+
+// Option is a functional option for KeyPrunerController.
+type Option func(*KeyPrunerController)
+
+// WithClock sets the clock to use for the controller.
+func WithClock(clock clock.Clock) Option {
+	return func(k *KeyPrunerController) {
+		k.clock = clock
+	}
+}
+
+// NewKeyPrunerController initializes a new KeyPrunerController.
+func NewKeyPrunerController(interval time.Duration, opts ...Option) *KeyPrunerController {
+	result := &KeyPrunerController{interval: interval}
+
+	for _, opt := range opts {
+		opt(result)
+	}
+
+	if result.clock == nil {
+		result.clock = clock.New()
+	}
+
+	return result
+}
+
+// Name implements controller.Controller interface.
+func (*KeyPrunerController) Name() string {
+	return "KeyPrunerController"
+}
+
+// Inputs implements controller.Controller interface.
+func (k *KeyPrunerController) Inputs() []controller.Input {
+	// no inputs
+	return nil
+}
+
+// Outputs implements controller.Controller interface.
+func (k *KeyPrunerController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: auth.PublicKeyType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (k *KeyPrunerController) Run(ctx context.Context, runtime controller.Runtime, logger *zap.Logger) error {
+	ticker := k.clock.Ticker(k.interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-runtime.EventCh():
+			logger.Info("running key pruner")
+
+			err := k.run(ctx, runtime, logger)
+			if err != nil {
+				return fmt.Errorf("error running key pruner: %w", err)
+			}
+		case <-ticker.C:
+			err := k.run(ctx, runtime, logger)
+			if err != nil {
+				return fmt.Errorf("error running key pruner: %w", err)
+			}
+		}
+	}
+}
+
+func (k *KeyPrunerController) run(ctx context.Context, runtime controller.Runtime, logger *zap.Logger) error {
+	list, err := safe.ReaderListAll[*auth.PublicKey](ctx, runtime)
+	if err != nil {
+		return err
+	}
+
+	for it := list.Iterator(); it.Next(); {
+		v := it.Value()
+		md := v.Metadata()
+		publicKeySpec := v.TypedSpec().Value
+
+		if k.clock.Now().Before(publicKeySpec.Expiration.AsTime()) {
+			continue
+		}
+
+		logger.Info("removing expired public key", zap.String("id", md.ID()), zap.Time("expiration", publicKeySpec.Expiration.AsTime()))
+
+		err := runtime.Destroy(ctx, md)
+		if state.IsOwnerConflictError(err) {
+			// probably empty owner, trying to remove it again
+			err = runtime.Destroy(ctx, md)
+			if err != nil {
+				logger.Error("error destroying key with empty owner", zap.String("id", md.ID()), zap.Error(err))
+			}
+		} else if err != nil {
+			logger.Error("error destroying key", zap.String("id", md.ID()), zap.Error(err))
+		}
+	}
+
+	return nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/key_pruner_test.go b/internal/backend/runtime/omni/controllers/omni/key_pruner_test.go
new file mode 100644
index 000000000..7736412e4
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/key_pruner_test.go
@@ -0,0 +1,75 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/benbjohnson/clock"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/go-pointer"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	authres "github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+func TestKeyPrunerSuite(t *testing.T) {
+	suite.Run(t, new(KeyPrunerSuite))
+}
+
+type KeyPrunerSuite struct {
+	OmniSuite
+}
+
+const defaultExpirationTime = 8 * time.Second
+
+func (suite *KeyPrunerSuite) setup() *clock.Mock {
+	fakeClock := clock.NewMock()
+	fakeClock.Set(time.Now())
+
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(
+		omnictrl.NewKeyPrunerController(1*time.Second, omnictrl.WithClock(fakeClock)),
+	))
+
+	return fakeClock
+}
+
+func (suite *KeyPrunerSuite) TestRemoveExpiredKey() {
+	fakeClock := suite.setup()
+
+	publicKey := authres.NewPublicKey(resources.DefaultNamespace, testID)
+	publicKey.TypedSpec().Value.Confirmed = true
+	publicKey.TypedSpec().Value.Expiration = timestamppb.New(fakeClock.Now().Add(defaultExpirationTime))
+
+	fakeClock.Add(4 * time.Second)
+
+	publicKey2 := authres.NewPublicKey(resources.DefaultNamespace, "testID2")
+	publicKey2.TypedSpec().Value.Confirmed = true
+	publicKey2.TypedSpec().Value.Expiration = timestamppb.New(fakeClock.Now().Add(defaultExpirationTime))
+
+	suite.Assert().NoError(suite.state.Create(suite.ctx, publicKey, state.WithCreateOwner(pointer.To(omnictrl.KeyPrunerController{}).Name())))
+	suite.Assert().NoError(suite.state.Create(suite.ctx, publicKey2, state.WithCreateOwner(pointer.To(omnictrl.KeyPrunerController{}).Name())))
+
+	assertResource(&suite.OmniSuite, publicKey.Metadata(), func(*authres.PublicKey, *assert.Assertions) {})
+
+	fakeClock.Add(3 * time.Second)
+
+	assertResource(&suite.OmniSuite, publicKey.Metadata(), func(*authres.PublicKey, *assert.Assertions) {})
+
+	fakeClock.Add(2 * time.Second)
+
+	assertNoResource(&suite.OmniSuite, publicKey)
+
+	// Check that second key is not removed
+	assertResource(&suite.OmniSuite, publicKey2.Metadata(), func(*authres.PublicKey, *assert.Assertions) {})
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/kubeconfig.go b/internal/backend/runtime/omni/controllers/omni/kubeconfig.go
new file mode 100644
index 000000000..650cf8802
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/kubeconfig.go
@@ -0,0 +1,106 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/controller/generic/transform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/xerrors"
+	"go.uber.org/zap"
+	"k8s.io/client-go/rest"
+	"k8s.io/client-go/tools/clientcmd"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
+	"github.com/siderolabs/omni/internal/pkg/certs"
+)
+
+// KubeconfigController creates omni.ClusterSecrets for each input omni.Cluster.
+//
+// KubeconfigController generates and stores cluster wide secrets.
+type KubeconfigController = qtransform.QController[*omni.ClusterSecrets, *omni.Kubeconfig]
+
+// NewKubeconfigController instantiates the Kubeconfig controller.
+func NewKubeconfigController(certificateValidity time.Duration) *KubeconfigController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.ClusterSecrets, *omni.Kubeconfig]{
+			Name: "KubeconfigController",
+			MapMetadataFunc: func(secrets *omni.ClusterSecrets) *omni.Kubeconfig {
+				return omni.NewKubeconfig(resources.DefaultNamespace, secrets.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(kubeconfig *omni.Kubeconfig) *omni.ClusterSecrets {
+				return omni.NewClusterSecrets(resources.DefaultNamespace, kubeconfig.Metadata().ID())
+			},
+			TransformFunc: func(ctx context.Context, r controller.Reader, logger *zap.Logger, secrets *omni.ClusterSecrets, kubeconfig *omni.Kubeconfig) error {
+				lbConfig, err := safe.ReaderGetByID[*omni.LoadBalancerConfig](ctx, r, secrets.Metadata().ID())
+				if err != nil {
+					if state.IsNotFoundError(err) {
+						return xerrors.NewTagged[transform.SkipReconcileTag](err)
+					}
+
+					return nil
+				}
+
+				var staleCertificate bool
+
+				if len(kubeconfig.TypedSpec().Value.Data) > 0 {
+					var cfg *rest.Config
+
+					cfg, err = clientcmd.RESTConfigFromKubeConfig(kubeconfig.TypedSpec().Value.Data)
+					if err != nil {
+						return fmt.Errorf("error parsing Kubernetes API config: %w", err)
+					}
+
+					staleCertificate, err = certs.IsPEMEncodedCertificateStale(cfg.CertData, certificateValidity)
+					if err != nil {
+						return fmt.Errorf("error checking Kubernetes API certificate: %w", err)
+					}
+				}
+
+				// should always call UpdateInputsVersions to update the annotations, due to short-circuiting
+				if !UpdateInputsVersions[resource.Resource](kubeconfig, secrets, lbConfig) && !staleCertificate {
+					return nil
+				}
+
+				if staleCertificate {
+					logger.Info("Kubernetes API certificate for cluster is stale, refreshing", zap.String("cluster", secrets.Metadata().ID()))
+				}
+
+				kubeconfig.TypedSpec().Value.Data, err = certs.GenerateKubeconfig(secrets, lbConfig, certificateValidity)
+				if err != nil {
+					return fmt.Errorf("error generating Kubernetes API config: %w", err)
+				}
+
+				return nil
+			},
+		},
+		qtransform.WithExtraMappedInput(
+			func(ctx context.Context, _ *zap.Logger, r controller.QRuntime, _ *system.CertRefreshTick) ([]resource.Pointer, error) {
+				// on cert refresh, queue updates for all clusters
+				secrets, err := safe.ReaderListAll[*omni.ClusterSecrets](ctx, r)
+				if err != nil {
+					return nil, err
+				}
+
+				return safe.Map(secrets, func(secret *omni.ClusterSecrets) (resource.Pointer, error) {
+					return secret.Metadata(), nil
+				})
+			},
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.LoadBalancerConfig, *omni.ClusterSecrets](),
+		),
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/kubeconfig_test.go b/internal/backend/runtime/omni/controllers/omni/kubeconfig_test.go
new file mode 100644
index 000000000..c9ac8b684
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/kubeconfig_test.go
@@ -0,0 +1,94 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"k8s.io/client-go/tools/clientcmd"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type KubeconfigSuite struct {
+	OmniSuite
+}
+
+func (suite *KubeconfigSuite) TestReconcile() {
+	require := suite.Require()
+
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewSecretsController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewClusterLoadBalancerController(1000, 2000)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewKubeconfigController(2 * time.Second)))
+
+	siderolinkConfig := siderolink.NewConfig(resources.DefaultNamespace)
+	siderolinkConfig.TypedSpec().Value.ServerAddress = "fa87::1"
+	require.NoError(suite.state.Create(suite.ctx, siderolinkConfig))
+
+	clusterName := "talos-default-3"
+
+	cluster := omni.NewCluster(resources.DefaultNamespace, clusterName)
+	cluster.TypedSpec().Value.TalosVersion = "1.2.0"
+	require.NoError(suite.state.Create(suite.ctx, cluster))
+
+	machineSet := omni.NewMachineSet(resources.DefaultNamespace, omni.ControlPlanesResourceID(cluster.Metadata().ID()))
+
+	machineSet.Metadata().Labels().Set(omni.LabelControlPlaneRole, "")
+	machineSet.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+
+	require.NoError(suite.state.Create(suite.ctx, machineSet))
+
+	var firstKubeconfig []byte
+
+	config := omni.NewKubeconfig(resources.DefaultNamespace, clusterName)
+	assertResource(
+		&suite.OmniSuite,
+		*config.Metadata(),
+		func(res *omni.Kubeconfig, _ *assert.Assertions) {
+			spec := res.TypedSpec().Value
+
+			_, err := clientcmd.RESTConfigFromKubeConfig(spec.Data)
+			suite.Require().NoError(err)
+
+			firstKubeconfig = spec.Data
+		},
+	)
+
+	// wait 1 second so that the certificate is 50% stale
+	time.Sleep(1 * time.Second)
+
+	// issue a refresh tick
+	suite.Require().NoError(suite.state.Create(suite.ctx, system.NewCertRefreshTick(resources.EphemeralNamespace, "refresh")))
+
+	assertResource(
+		&suite.OmniSuite,
+		*config.Metadata(),
+		func(res *omni.Kubeconfig, assertions *assert.Assertions) {
+			spec := res.TypedSpec().Value
+
+			// cert should be refreshed
+			assertions.NotEqual(firstKubeconfig, spec.Data)
+		},
+	)
+
+	rtestutils.Destroy[*omni.Cluster](suite.ctx, suite.T(), suite.state, []resource.ID{cluster.Metadata().ID()})
+	assertNoResource(&suite.OmniSuite, config)
+}
+
+func TestKubeconfigSuite(t *testing.T) {
+	suite.Run(t, new(KubeconfigSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/kubernetes_status.go b/internal/backend/runtime/omni/controllers/omni/kubernetes_status.go
new file mode 100644
index 000000000..355092e46
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/kubernetes_status.go
@@ -0,0 +1,751 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"bytes"
+	"cmp"
+	"compress/gzip"
+	"context"
+	"encoding/base64"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"io"
+	"slices"
+	"strconv"
+	"strings"
+	"sync/atomic"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/hashicorp/go-multierror"
+	"github.com/siderolabs/gen/channel"
+	"github.com/siderolabs/gen/maps"
+	"github.com/siderolabs/gen/optional"
+	"go.uber.org/zap"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/util/rand"
+	"k8s.io/client-go/informers"
+	"k8s.io/client-go/tools/cache"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime/kubernetes"
+	"github.com/siderolabs/omni/internal/pkg/config"
+	"github.com/siderolabs/omni/internal/pkg/image"
+)
+
+const (
+	// ServiceLabelAnnotationKey is the annotation to define the human-readable label of Kubernetes Services to expose them to Omni.
+	//
+	// tsgen:ServiceLabelAnnotationKey
+	ServiceLabelAnnotationKey = "omni-kube-service-exposer.sidero.dev/label"
+
+	// ServicePortAnnotationKey is the annotation to define the port of Kubernetes Services to expose them to Omni.
+	//
+	// tsgen:ServicePortAnnotationKey
+	ServicePortAnnotationKey = "omni-kube-service-exposer.sidero.dev/port"
+
+	// ServiceIconAnnotationKey is the annotation to define the icon of Kubernetes Services to expose them to Omni.
+	//
+	// tsgen:ServiceIconAnnotationKey
+	ServiceIconAnnotationKey = "omni-kube-service-exposer.sidero.dev/icon"
+)
+
+// KubernetesStatusController manages KubernetesStatus resource lifecycle.
+//
+// KubernetesStatusController plays the role of machine discovery.
+type KubernetesStatusController struct {
+	watchers map[string]*kubernetesWatcher
+}
+
+// Name implements controller.Controller interface.
+func (ctrl *KubernetesStatusController) Name() string {
+	return "KubernetesStatusController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *KubernetesStatusController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterSecretsType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.LoadBalancerStatusType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.KubeconfigType,
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *KubernetesStatusController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.KubernetesStatusType,
+			Kind: controller.OutputExclusive,
+		},
+		{
+			Type: omni.ExposedServiceType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+type kubernetesWatcherNotify struct {
+	status           *specs.KubernetesStatusSpec
+	cluster          string
+	servicesOptional optional.Optional[[]*corev1.Service]
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *KubernetesStatusController) Run(ctx context.Context, r controller.Runtime, logger *zap.Logger) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	ctrl.watchers = map[string]*kubernetesWatcher{}
+
+	defer func() {
+		for _, w := range ctrl.watchers {
+			w.stop()
+		}
+
+		ctrl.watchers = nil
+	}()
+
+	notifyCh := make(chan kubernetesWatcherNotify)
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+			if err := ctrl.reconcileRunners(ctx, r, logger, notifyCh); err != nil {
+				return fmt.Errorf("error reconciling runners: %w", err)
+			}
+		case ev := <-notifyCh:
+			if _, running := ctrl.watchers[ev.cluster]; !running {
+				// skip notifications for not running watchers (notification came late)
+				continue
+			}
+
+			if services, servicesUpdated := ev.servicesOptional.Get(); servicesUpdated {
+				if err := ctrl.updateExposedServices(ctx, r, ev.cluster, services, logger); err != nil {
+					return fmt.Errorf("error updating exposed services: %w", err)
+				}
+
+				continue
+			}
+
+			// services are not updated, which means the update was a status update.
+
+			if err := safe.WriterModify(ctx, r, omni.NewKubernetesStatus(resources.DefaultNamespace, ev.cluster),
+				func(r *omni.KubernetesStatus) error {
+					r.Metadata().Labels().Set(omni.LabelCluster, ev.cluster)
+
+					if ev.status.Nodes != nil {
+						r.TypedSpec().Value.Nodes = ev.status.Nodes
+					}
+
+					if ev.status.StaticPods != nil {
+						r.TypedSpec().Value.StaticPods = ev.status.StaticPods
+					}
+
+					return nil
+				}); err != nil {
+				return fmt.Errorf("error updating kubernetes status: %w", err)
+			}
+		}
+	}
+}
+
+func (ctrl *KubernetesStatusController) updateExposedServices(ctx context.Context, r controller.Runtime, cluster string, services []*corev1.Service, logger *zap.Logger) error {
+	tracker := trackResource(r, resources.DefaultNamespace, omni.ExposedServiceType, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, cluster)))
+
+	usedAliases := make(map[string]struct{})
+
+	for _, service := range services {
+		svcID := service.Name + "." + service.Namespace
+		svcLogger := logger.With(zap.String("service", svcID))
+
+		exposedService := omni.NewExposedService(resources.DefaultNamespace, cluster+"/"+svcID)
+
+		port, err := strconv.Atoi(service.Annotations[ServicePortAnnotationKey])
+		if err != nil || port < 1 || port > 65535 {
+			svcLogger.Warn("invalid port on Service", zap.String("port", service.Annotations[ServicePortAnnotationKey]))
+
+			tracker.keep(exposedService)
+
+			continue
+		}
+
+		label, labelOk := service.Annotations[ServiceLabelAnnotationKey]
+		if !labelOk {
+			label = service.Name + "." + service.Namespace
+		}
+
+		icon, err := ctrl.parseIcon(service.Annotations[ServiceIconAnnotationKey])
+		if err != nil {
+			svcLogger.Debug("invalid icon on Service", zap.Error(err))
+		}
+
+		var alias string
+
+		if err = safe.WriterModify(ctx, r, exposedService, func(res *omni.ExposedService) error {
+			res.Metadata().Labels().Set(omni.LabelCluster, cluster)
+
+			if _, aliasExists := res.Metadata().Labels().Get(omni.LabelExposedServiceAlias); !aliasExists {
+				// alias is not set, resource is being created, not updated - generate an alias
+				generatedAlias, generateErr := ctrl.generateExposedServiceAlias(ctx, r, usedAliases)
+				if generateErr != nil {
+					return fmt.Errorf("error generating exposed service alias: %w", generateErr)
+				}
+
+				res.Metadata().Labels().Set(omni.LabelExposedServiceAlias, generatedAlias)
+			}
+
+			alias, _ = res.Metadata().Labels().Get(omni.LabelExposedServiceAlias)
+
+			res.TypedSpec().Value.Port = uint32(port)
+			res.TypedSpec().Value.Label = label
+			res.TypedSpec().Value.IconBase64 = icon
+
+			return nil
+		}); err != nil {
+			return fmt.Errorf("error updating exposed service: %w", err)
+		}
+
+		usedAliases[alias] = struct{}{}
+
+		tracker.keep(exposedService)
+	}
+
+	return tracker.cleanup(ctx)
+}
+
+func (ctrl *KubernetesStatusController) parseIcon(iconBase64 string) (string, error) {
+	if iconBase64 == "" {
+		return "", nil
+	}
+
+	iconBytes, err := base64.StdEncoding.DecodeString(iconBase64)
+	if err != nil {
+		return "", fmt.Errorf("error decoding icon: %w", err)
+	}
+
+	extractGzip := func(data []byte) ([]byte, error) {
+		reader, readerErr := gzip.NewReader(bytes.NewReader(data))
+		if readerErr != nil {
+			return nil, fmt.Errorf("error creating gzip reader: %w", readerErr)
+		}
+
+		defer reader.Close() //nolint:errcheck
+
+		return io.ReadAll(reader)
+	}
+
+	extractedBytes, err := extractGzip(iconBytes)
+	if err == nil {
+		// svg is probably not compressed
+		iconBytes = extractedBytes
+	}
+
+	isValidXML := func(data []byte) bool {
+		decoder := xml.NewDecoder(bytes.NewReader(data))
+
+		for {
+			if decodeErr := decoder.Decode(new(interface{})); decodeErr != nil {
+				return errors.Is(decodeErr, io.EOF)
+			}
+		}
+	}
+
+	if !isValidXML(iconBytes) {
+		return "", errors.New("icon is not a valid SVG")
+	}
+
+	return base64.StdEncoding.EncodeToString(iconBytes), nil
+}
+
+func (ctrl *KubernetesStatusController) generateExposedServiceAlias(ctx context.Context, r controller.Runtime, exclude map[string]struct{}) (string, error) {
+	attempts := 100
+
+	for i := 0; i < attempts; i++ {
+		alias := rand.String(6)
+
+		if _, ok := exclude[alias]; ok {
+			continue
+		}
+
+		existing, err := safe.ReaderListAll[*omni.ExposedService](ctx, r, state.WithLabelQuery(resource.LabelEqual(omni.LabelExposedServiceAlias, alias)))
+		if err != nil {
+			return "", err
+		}
+
+		if existing.Len() == 0 {
+			return alias, nil
+		}
+	}
+
+	return "", fmt.Errorf("failed to generate exposed service alias after %d attempts", attempts)
+}
+
+//nolint:gocyclo,cyclop
+func (ctrl *KubernetesStatusController) reconcileRunners(ctx context.Context, r controller.Runtime, logger *zap.Logger, notifyCh chan<- kubernetesWatcherNotify) error {
+	secrets, err := safe.ReaderListAll[*omni.ClusterSecrets](ctx, r)
+	if err != nil {
+		return err
+	}
+
+	lbStatus, err := safe.ReaderListAll[*omni.LoadBalancerStatus](ctx, r)
+	if err != nil {
+		return err
+	}
+
+	secretsPresent := map[string]struct{}{}
+
+	for iter := secrets.Iterator(); iter.Next(); {
+		secretsPresent[iter.Value().Metadata().ID()] = struct{}{}
+	}
+
+	lbHealthy := map[string]struct{}{}
+	lbStopped := map[string]struct{}{}
+
+	for iter := lbStatus.Iterator(); iter.Next(); {
+		if iter.Value().TypedSpec().Value.Healthy {
+			lbHealthy[iter.Value().Metadata().ID()] = struct{}{}
+		}
+
+		if iter.Value().TypedSpec().Value.Stopped {
+			lbStopped[iter.Value().Metadata().ID()] = struct{}{}
+		}
+	}
+
+	// stop watchers where secrets are gone (cluster deleted?) and remove the corresponding status resources
+	for cluster, w := range ctrl.watchers {
+		_, hasSecrets := secretsPresent[cluster]
+		_, isStopped := lbStopped[cluster]
+
+		reason := "cluster deleted"
+		if isStopped {
+			reason = "cluster is offline"
+		}
+
+		if !hasSecrets || isStopped {
+			w.stop()
+
+			delete(ctrl.watchers, cluster)
+
+			logger.Info("stopped watcher for cluster", zap.String("cluster", cluster), zap.String("reason", reason))
+		}
+	}
+
+	// start watchers (if not already running) for clusters which have secrets, lb healthy and not stopped
+	for cluster := range secretsPresent {
+		_, lbHealthy := lbHealthy[cluster]
+		if !lbHealthy {
+			continue
+		}
+
+		if _, isStopped := lbStopped[cluster]; isStopped {
+			continue
+		}
+
+		_, alreadyRunning := ctrl.watchers[cluster]
+		if alreadyRunning {
+			continue
+		}
+
+		if err = ctrl.startWatcher(ctx, logger, cluster, notifyCh); err != nil {
+			return fmt.Errorf("failed to start watcher for the cluster:%w", err)
+		}
+
+		logger.Info("started watcher for cluster", zap.String("cluster", cluster))
+	}
+
+	// cleanup kubernetes statuses for clusters which do not have secrets
+	statuses, err := safe.ReaderListAll[*omni.KubernetesStatus](ctx, r)
+	if err != nil {
+		return err
+	}
+
+	for iter := statuses.Iterator(); iter.Next(); {
+		cluster := iter.Value().Metadata().ID()
+
+		if _, ok := secretsPresent[cluster]; ok {
+			continue
+		}
+
+		if err := r.Destroy(ctx, omni.NewKubernetesStatus(resources.DefaultNamespace, cluster).Metadata()); err != nil {
+			return fmt.Errorf("error destroying kubernetes status: %w", err)
+		}
+	}
+
+	// cleanup exposed services for clusters which do not have secrets
+	if err := ctrl.cleanupExposedServices(ctx, r, secretsPresent); err != nil {
+		return fmt.Errorf("error destroying exposed services: %w", err)
+	}
+
+	return nil
+}
+
+func (ctrl *KubernetesStatusController) cleanupExposedServices(ctx context.Context, r controller.Runtime, keepClustersSet map[string]struct{}) error {
+	exposedServices, err := safe.ReaderListAll[*omni.ExposedService](ctx, r)
+	if err != nil {
+		return fmt.Errorf("error listing exposed services: %w", err)
+	}
+
+	var multiErr error
+
+	for iter := exposedServices.Iterator(); iter.Next(); {
+		exposedService := iter.Value()
+
+		exposedServiceCluster, ok := exposedService.Metadata().Labels().Get(omni.LabelCluster)
+		if !ok {
+			continue
+		}
+
+		if _, ok = keepClustersSet[exposedServiceCluster]; ok {
+			continue
+		}
+
+		if destroyErr := r.Destroy(ctx, exposedService.Metadata()); destroyErr != nil {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("error destroying exposed service: %w", destroyErr))
+		}
+	}
+
+	return multiErr
+}
+
+var controlplanePodSelector = func() labels.Selector {
+	sel, err := labels.Parse("tier=control-plane,k8s-app in (kube-apiserver,kube-controller-manager,kube-scheduler)")
+	if err != nil {
+		panic(err)
+	}
+
+	return sel
+}()
+
+func (ctrl *KubernetesStatusController) startWatcher(ctx context.Context, logger *zap.Logger, cluster string, notifyCh chan<- kubernetesWatcherNotify) error {
+	type kubernetesClient interface {
+		GetClient(ctx context.Context, cluster string) (*kubernetes.Client, error)
+	}
+
+	r, err := runtime.LookupInterface[kubernetesClient](kubernetes.Name)
+	if err != nil {
+		return err
+	}
+
+	client, err := r.GetClient(ctx, cluster)
+	if err != nil {
+		return err
+	}
+
+	w := &kubernetesWatcher{
+		logger:  logger,
+		cluster: cluster,
+		client:  client, // keep the reference to the client to prevent it from being garbage collected
+	}
+
+	w.nodeFactory = informers.NewSharedInformerFactory(w.client.Clientset(), 0)
+
+	if _, err = w.nodeFactory.Core().V1().Nodes().Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    func(_ any) { w.nodesSync(ctx, notifyCh) },
+		UpdateFunc: func(_ any, _ any) { w.nodesSync(ctx, notifyCh) },
+		DeleteFunc: func(_ any) { w.nodesSync(ctx, notifyCh) },
+	}); err != nil {
+		return err
+	}
+
+	w.podFactory = informers.NewSharedInformerFactoryWithOptions(w.client.Clientset(), 0,
+		informers.WithNamespace("kube-system"),
+		informers.WithTweakListOptions(func(options *metav1.ListOptions) {
+			options.LabelSelector = controlplanePodSelector.String()
+		}),
+	)
+
+	if _, err = w.podFactory.Core().V1().Pods().Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    func(_ any) { w.podsSync(ctx, notifyCh) },
+		UpdateFunc: func(_ any, _ any) { w.podsSync(ctx, notifyCh) },
+		DeleteFunc: func(_ any) { w.podsSync(ctx, notifyCh) },
+	}); err != nil {
+		return err
+	}
+
+	ctx, w.ctxCancel = context.WithCancel(ctx)
+
+	w.nodeFactory.Start(ctx.Done())
+	w.podFactory.Start(ctx.Done())
+
+	go func() {
+		w.nodeFactory.WaitForCacheSync(ctx.Done())
+		w.nodesSynced.Store(true)
+
+		w.nodesSync(ctx, notifyCh)
+	}()
+
+	go func() {
+		w.podFactory.WaitForCacheSync(ctx.Done())
+		w.podsSynced.Store(true)
+
+		w.podsSync(ctx, notifyCh)
+	}()
+
+	if config.Config.WorkloadProxying.Enabled {
+		w.serviceFactory = informers.NewSharedInformerFactory(w.client.Clientset(), 0)
+
+		if _, err = w.serviceFactory.Core().V1().Services().Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+			AddFunc: func(obj any) { filterExposedServiceEvents(obj, nil, logger, func() { w.servicesSync(ctx, notifyCh) }) },
+			UpdateFunc: func(oldObj, newObj any) {
+				filterExposedServiceEvents(newObj, oldObj, logger, func() { w.servicesSync(ctx, notifyCh) })
+			},
+			DeleteFunc: func(obj any) { filterExposedServiceEvents(obj, nil, logger, func() { w.servicesSync(ctx, notifyCh) }) },
+		}); err != nil {
+			return err
+		}
+
+		w.serviceFactory.Start(ctx.Done())
+
+		go func() {
+			w.serviceFactory.WaitForCacheSync(ctx.Done())
+			w.servicesSynced.Store(true)
+
+			w.servicesSync(ctx, notifyCh)
+		}()
+	}
+
+	ctrl.watchers[cluster] = w
+
+	return nil
+}
+
+type kubernetesWatcher struct {
+	logger         *zap.Logger
+	client         *kubernetes.Client
+	nodeFactory    informers.SharedInformerFactory
+	podFactory     informers.SharedInformerFactory
+	serviceFactory informers.SharedInformerFactory
+	ctxCancel      context.CancelFunc
+	cluster        string
+	nodesSynced    atomic.Bool
+	podsSynced     atomic.Bool
+	servicesSynced atomic.Bool
+}
+
+func (w *kubernetesWatcher) stop() {
+	w.ctxCancel()
+	w.nodeFactory.Shutdown()
+	w.podFactory.Shutdown()
+}
+
+func (w *kubernetesWatcher) nodesSync(ctx context.Context, notifyCh chan<- kubernetesWatcherNotify) {
+	if !w.nodesSynced.Load() {
+		return
+	}
+
+	w.logger.Debug("nodes sync event", zap.String("cluster", w.cluster))
+
+	nodes, err := w.nodeFactory.Core().V1().Nodes().Lister().List(labels.Everything())
+	if err != nil {
+		w.logger.Error("nodes list failed", zap.String("cluster", w.cluster), zap.Error(err))
+	}
+
+	status := &specs.KubernetesStatusSpec{}
+	status.Nodes = make([]*specs.KubernetesStatusSpec_NodeStatus, len(nodes))
+
+	for i, node := range nodes {
+		status.Nodes[i] = &specs.KubernetesStatusSpec_NodeStatus{
+			Nodename:       node.Name,
+			KubeletVersion: strings.TrimLeft(node.Status.NodeInfo.KubeletVersion, "v"),
+		}
+
+		for _, condition := range node.Status.Conditions {
+			if condition.Type == corev1.NodeReady {
+				status.Nodes[i].Ready = condition.Status == corev1.ConditionTrue
+			}
+		}
+	}
+
+	slices.SortFunc(status.Nodes, func(a, b *specs.KubernetesStatusSpec_NodeStatus) int {
+		return cmp.Compare(a.Nodename, b.Nodename)
+	})
+
+	channel.SendWithContext(ctx, notifyCh,
+		kubernetesWatcherNotify{
+			cluster: w.cluster,
+			status:  status,
+		})
+}
+
+func (w *kubernetesWatcher) podsSync(ctx context.Context, notifyCh chan<- kubernetesWatcherNotify) {
+	if !w.podsSynced.Load() {
+		return
+	}
+
+	w.logger.Debug("pods sync event", zap.String("cluster", w.cluster))
+
+	pods, err := w.podFactory.Core().V1().Pods().Lister().List(controlplanePodSelector)
+	if err != nil {
+		w.logger.Error("pods list failed", zap.String("cluster", w.cluster), zap.Error(err))
+	}
+
+	status := &specs.KubernetesStatusSpec{}
+
+	podsByNode := map[string][]*corev1.Pod{}
+
+	for _, pod := range pods {
+		podsByNode[pod.Spec.NodeName] = append(podsByNode[pod.Spec.NodeName], pod)
+	}
+
+	nodes := maps.Keys(podsByNode)
+	slices.Sort(nodes)
+
+	status.StaticPods = make([]*specs.KubernetesStatusSpec_NodeStaticPods, 0, len(nodes))
+
+	for _, node := range nodes {
+		nodeStaticPods := &specs.KubernetesStatusSpec_NodeStaticPods{
+			Nodename:   node,
+			StaticPods: make([]*specs.KubernetesStatusSpec_StaticPodStatus, 0, len(podsByNode[node])),
+		}
+
+		for _, pod := range podsByNode[node] {
+			staticPod := &specs.KubernetesStatusSpec_StaticPodStatus{
+				App: pod.Labels["k8s-app"],
+			}
+
+			for _, container := range pod.Spec.Containers {
+				if container.Name != staticPod.App {
+					continue
+				}
+
+				tag, err := image.GetTag(container.Image)
+				if err != nil {
+					w.logger.Error("failed to get image tag", zap.String("cluster", w.cluster), zap.Error(err), zap.String("image", container.Image))
+
+					continue
+				}
+
+				staticPod.Version = strings.TrimLeft(tag, "v")
+
+				break
+			}
+
+			for _, condition := range pod.Status.Conditions {
+				if condition.Type == corev1.PodReady {
+					staticPod.Ready = condition.Status == corev1.ConditionTrue
+				}
+			}
+
+			nodeStaticPods.StaticPods = append(nodeStaticPods.StaticPods, staticPod)
+		}
+
+		slices.SortFunc(nodeStaticPods.StaticPods, func(a, b *specs.KubernetesStatusSpec_StaticPodStatus) int {
+			return cmp.Compare(a.App, b.App)
+		})
+
+		status.StaticPods = append(status.StaticPods, nodeStaticPods)
+	}
+
+	channel.SendWithContext(ctx, notifyCh,
+		kubernetesWatcherNotify{
+			cluster: w.cluster,
+			status:  status,
+		})
+}
+
+func (w *kubernetesWatcher) servicesSync(ctx context.Context, notifyCh chan<- kubernetesWatcherNotify) {
+	if !w.servicesSynced.Load() {
+		return
+	}
+
+	w.logger.Debug("services sync event", zap.String("cluster", w.cluster))
+
+	services, err := w.serviceFactory.Core().V1().Services().Lister().List(labels.Everything())
+	if err != nil {
+		w.logger.Error("services list failed", zap.String("cluster", w.cluster), zap.Error(err))
+	}
+
+	// filter out non-exposed services
+	services = slices.DeleteFunc(services, func(service *corev1.Service) bool {
+		return !IsExposedServiceEvent(service, nil, w.logger)
+	})
+
+	channel.SendWithContext(ctx, notifyCh,
+		kubernetesWatcherNotify{
+			cluster:          w.cluster,
+			servicesOptional: optional.Some(services),
+		})
+}
+
+func filterExposedServiceEvents(k8sObject, oldK8sObject any, logger *zap.Logger, syncFunc func()) {
+	if IsExposedServiceEvent(k8sObject, oldK8sObject, logger) {
+		syncFunc()
+	}
+}
+
+// IsExposedServiceEvent returns true if there is a change on the Kubernetes Services
+// that is relevant to the ExposedServices, i.e., they need to be re-synced.
+//
+// oldObj is nil for add and delete events, and non-nil for update events.
+func IsExposedServiceEvent(k8sObject, oldK8sObject any, logger *zap.Logger) bool {
+	isExposedService := func(obj any) bool {
+		service, ok := obj.(*corev1.Service)
+		if !ok {
+			logger.Warn("unexpected type", zap.String("type", fmt.Sprintf("%T", obj)))
+
+			return false
+		}
+
+		// check for ServicePortAnnotationKey annotation - the only annotation required for the exposed services
+		_, isAnnotated := service.GetObjectMeta().GetAnnotations()[ServicePortAnnotationKey]
+
+		return isAnnotated
+	}
+
+	if k8sObject == nil {
+		logger.Warn("unexpected nil k8sObject")
+
+		return false
+	}
+
+	// this is an add or delete event
+	if oldK8sObject == nil {
+		return isExposedService(k8sObject)
+	}
+
+	// this is an update event
+
+	// if neither of the old or new objects is an exposed service, there is no change
+	if !isExposedService(k8sObject) && !isExposedService(oldK8sObject) {
+		return false
+	}
+
+	oldAnnotations := oldK8sObject.(*corev1.Service).GetObjectMeta().GetAnnotations() //nolint:forcetypeassert
+	newAnnotations := k8sObject.(*corev1.Service).GetObjectMeta().GetAnnotations()    //nolint:forcetypeassert
+
+	for _, key := range []string{ServiceLabelAnnotationKey, ServicePortAnnotationKey, ServiceIconAnnotationKey} {
+		if oldAnnotations[key] != newAnnotations[key] {
+			return true
+		}
+	}
+
+	// no change in exposed service related annotations
+	return false
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/kubernetes_status_test.go b/internal/backend/runtime/omni/controllers/omni/kubernetes_status_test.go
new file mode 100644
index 000000000..bc0d260fc
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/kubernetes_status_test.go
@@ -0,0 +1,113 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/zap/zaptest"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+func TestIsExposedServiceEvent(t *testing.T) {
+	t.Parallel()
+
+	for _, tt := range []struct { //nolint:govet
+		name          string
+		obj           any
+		oldObj        any
+		expectChanged bool
+	}{
+		{
+			name:          "add/remove unrelated service",
+			expectChanged: false,
+			obj: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Annotations: map[string]string{
+						"foo": "bar",
+					},
+				},
+			},
+		},
+		{
+			name:          "add/remove service - missing port annotation",
+			expectChanged: false,
+			obj: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Annotations: map[string]string{
+						omni.ServiceLabelAnnotationKey: "foo",
+						omni.ServiceIconAnnotationKey:  "bar",
+					},
+				},
+			},
+		},
+		{
+			name:          "add/remove service - exposed",
+			expectChanged: true,
+			obj: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Annotations: map[string]string{
+						omni.ServicePortAnnotationKey: "8080",
+					},
+				},
+			},
+		},
+		{
+			name:          "update service - no change in exposed service annotations",
+			expectChanged: false,
+			obj: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Annotations: map[string]string{
+						omni.ServicePortAnnotationKey:  "8080",
+						omni.ServiceLabelAnnotationKey: "foo",
+					},
+				},
+				Spec: corev1.ServiceSpec{ClusterIP: "10.0.0.1"},
+			},
+			oldObj: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Annotations: map[string]string{
+						omni.ServicePortAnnotationKey:  "8080",
+						omni.ServiceLabelAnnotationKey: "foo",
+					},
+				},
+				Spec: corev1.ServiceSpec{ClusterIP: "10.0.0.2"},
+			},
+		},
+		{
+			name:          "update service - change in exposed service annotations",
+			expectChanged: true,
+			obj: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Annotations: map[string]string{
+						omni.ServicePortAnnotationKey:  "8080",
+						omni.ServiceLabelAnnotationKey: "foo",
+					},
+				},
+			},
+			oldObj: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Annotations: map[string]string{
+						omni.ServicePortAnnotationKey:  "8080",
+						omni.ServiceLabelAnnotationKey: "bar", // different label
+					},
+				},
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			changed := omni.IsExposedServiceEvent(tt.obj, tt.oldObj, zaptest.NewLogger(t))
+
+			assert.Equal(t, tt.expectChanged, changed)
+		})
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/kubernetes_upgrade_manifest_status.go b/internal/backend/runtime/omni/controllers/omni/kubernetes_upgrade_manifest_status.go
new file mode 100644
index 000000000..8139c5e35
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/kubernetes_upgrade_manifest_status.go
@@ -0,0 +1,264 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/go-kubernetes/kubernetes/manifests"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+	"go.uber.org/zap"
+	"google.golang.org/grpc/codes"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/client-go/rest"
+
+	"github.com/siderolabs/omni/client/api/common"
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime/kubernetes"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/mappers"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+)
+
+// KubernetesUpgradeManifestStatusController keeps information about bootstrap manifests being out of sync.
+type KubernetesUpgradeManifestStatusController = qtransform.QController[*omni.ClusterSecrets, *omni.KubernetesUpgradeManifestStatus]
+
+// KubernetesUpgradeManifestStatusControllerName is the name of KubernetesUpgradeManifestStatusController.
+const KubernetesUpgradeManifestStatusControllerName = "KubernetesUpgradeManifestStatusController"
+
+// ManifestDryRunSyncTimeout is the timeout for dry run syncing manifests.
+const ManifestDryRunSyncTimeout = 5 * time.Minute
+
+// NewKubernetesUpgradeManifestStatusController initializes KubernetesUpgradeManifestStatusController.
+//
+//nolint:gocognit,cyclop,gocyclo,maintidx
+func NewKubernetesUpgradeManifestStatusController() *KubernetesUpgradeManifestStatusController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.ClusterSecrets, *omni.KubernetesUpgradeManifestStatus]{
+			Name: KubernetesUpgradeManifestStatusControllerName,
+			MapMetadataFunc: func(upgradeStatus *omni.ClusterSecrets) *omni.KubernetesUpgradeManifestStatus {
+				return omni.NewKubernetesUpgradeManifestStatus(resources.DefaultNamespace, upgradeStatus.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(manifestStatus *omni.KubernetesUpgradeManifestStatus) *omni.ClusterSecrets {
+				return omni.NewClusterSecrets(resources.DefaultNamespace, manifestStatus.Metadata().ID())
+			},
+			TransformFunc: func(ctx context.Context, r controller.Reader, logger *zap.Logger, clusterSecrets *omni.ClusterSecrets, manifestStatus *omni.KubernetesUpgradeManifestStatus) error {
+				clusterID := clusterSecrets.Metadata().ID()
+
+				loadbalancerStatus, err := safe.ReaderGet[*omni.LoadBalancerStatus](ctx, r, omni.NewLoadBalancerStatus(resources.DefaultNamespace, clusterID).Metadata())
+				if err != nil && !state.IsNotFoundError(err) {
+					return fmt.Errorf("failed to get loadbalancer status: %w", err)
+				}
+
+				// lb not ready
+				if loadbalancerStatus == nil || !loadbalancerStatus.TypedSpec().Value.Healthy {
+					return nil
+				}
+
+				clusterStatus, err := safe.ReaderGet[*omni.ClusterStatus](ctx, r, omni.NewClusterStatus(resources.DefaultNamespace, clusterID).Metadata())
+				if err != nil && !state.IsNotFoundError(err) {
+					return fmt.Errorf("failed to get cluster status: %w", err)
+				}
+
+				if clusterStatus == nil {
+					return nil
+				}
+
+				if !clusterStatus.TypedSpec().Value.Ready || clusterStatus.TypedSpec().Value.Phase != specs.ClusterStatusSpec_RUNNING {
+					return nil
+				}
+
+				if !clusterStatus.TypedSpec().Value.HasConnectedControlPlanes {
+					return nil
+				}
+
+				k8sUpgradeStatus, err := safe.ReaderGet[*omni.KubernetesUpgradeStatus](ctx, r, omni.NewKubernetesUpgradeStatus(resources.DefaultNamespace, clusterID).Metadata())
+				if err != nil && !state.IsNotFoundError(err) {
+					return fmt.Errorf("failed to get kubernetes upgrade status: %w", err)
+				}
+
+				// k8s upgrade not ready
+				if k8sUpgradeStatus == nil || k8sUpgradeStatus.TypedSpec().Value.Phase != specs.KubernetesUpgradeStatusSpec_Done {
+					return nil
+				}
+
+				talosUpgradeStatus, err := safe.ReaderGet[*omni.TalosUpgradeStatus](ctx, r, omni.NewTalosUpgradeStatus(resources.DefaultNamespace, clusterID).Metadata())
+				if err != nil && !state.IsNotFoundError(err) {
+					return fmt.Errorf("failed to get talos upgrade status: %w", err)
+				}
+
+				// talos upgrade not ready
+				if talosUpgradeStatus == nil || talosUpgradeStatus.TypedSpec().Value.Phase != specs.TalosUpgradeStatusSpec_Done {
+					return nil
+				}
+
+				// get the controlplane machine set status
+				machineSetStatuses, err := safe.ReaderList[*omni.MachineSetStatus](ctx, r, omni.NewMachineSetStatus(resources.DefaultNamespace, "").Metadata(),
+					state.WithLabelQuery(
+						resource.LabelEqual(omni.LabelCluster, clusterID),
+						resource.LabelExists(omni.LabelControlPlaneRole),
+					))
+				if err != nil {
+					return fmt.Errorf("failed to get machine set status: %w", err)
+				}
+
+				if machineSetStatuses.Len() != 1 {
+					// unexpected, but log an error skip it
+					logger.Error("unexpected number of controlplane machine sets", zap.String("cluster", clusterID), zap.Int("count", machineSetStatuses.Len()))
+
+					return nil
+				}
+
+				controlplaneMachineSetStatus := machineSetStatuses.Get(0)
+
+				// skip checking bootstrap manifests if none of the following changed:
+				// - kubernetes upgrade status (Kubernetes version)
+				// - talos upgrade status (Talos version)
+				// - controlplane machine set aggregated config hash (controlplane ConfigPatches)
+				if !UpdateInputsAnnotation(
+					manifestStatus,
+					k8sUpgradeStatus.Metadata().Version().String(),
+					talosUpgradeStatus.Metadata().Version().String(),
+					controlplaneMachineSetStatus.TypedSpec().Value.ConfigHash,
+				) {
+					logger.Debug("skipping bootstrap manifests check", zap.String("cluster", clusterID))
+
+					return nil
+				}
+
+				// we are ready to perform manifest checks, set a global timeout for the operation
+				ctx, err = r.ContextWithTeardown(ctx, omni.NewMachineSet(resources.DefaultNamespace, controlplaneMachineSetStatus.Metadata().ID()).Metadata())
+				if err != nil {
+					return fmt.Errorf("failed to set teardown context: %w", err)
+				}
+
+				ctx, cancel := context.WithTimeout(ctx, ManifestDryRunSyncTimeout)
+				defer cancel()
+
+				logger.Info("performing bootstrap manifests check", zap.String("cluster", clusterID))
+
+				// now we are ready to perform manifest checks
+				type talosClientProvider interface {
+					GetClient(ctx context.Context, clusterName string) (*talos.Client, error)
+				}
+
+				talosRuntime, err := runtime.LookupInterface[talosClientProvider](talos.Name)
+				if err != nil {
+					return err
+				}
+
+				talosClient, err := talosRuntime.GetClient(ctx, clusterID)
+				if err != nil {
+					return fmt.Errorf("failed to get talos client: %w", err)
+				}
+
+				manifestStatus.TypedSpec().Value.OutOfSync = 0
+				manifestStatus.TypedSpec().Value.LastFatalError = ""
+
+				bootstrapManifests, err := manifests.GetBootstrapManifests(ctx, talosClient.COSI, nil)
+				if err != nil {
+					switch client.StatusCode(err) { //nolint:exhaustive
+					case codes.ResourceExhausted:
+						// bootstrap manifests are too large, log, but don't fail the controller
+						logger.Error("failed to get bootstrap manifests", zap.String("cluster", clusterID), zap.Error(err))
+						manifestStatus.TypedSpec().Value.LastFatalError = err.Error()
+
+						return nil
+					case codes.Unavailable:
+						if strings.Contains(err.Error(), "x509: certificate has expired or is not yet valid") {
+							// time is out of sync badly on the machine, no reason to keep trying
+							logger.Error("failed to get bootstrap manifests", zap.String("cluster", clusterID), zap.Error(err))
+							manifestStatus.TypedSpec().Value.LastFatalError = err.Error()
+
+							return nil
+						}
+					}
+
+					return fmt.Errorf("failed to get manifests: %w", err)
+				}
+
+				type kubernetesConfigurator interface {
+					GetKubeconfig(ctx context.Context, context *common.Context) (*rest.Config, error)
+				}
+
+				kubernetesRuntime, err := runtime.LookupInterface[kubernetesConfigurator](kubernetes.Name)
+				if err != nil {
+					return err
+				}
+
+				cfg, err := kubernetesRuntime.GetKubeconfig(ctx, &common.Context{Name: clusterID})
+				if err != nil {
+					return fmt.Errorf("failed to get kubeconfig: %w", err)
+				}
+
+				errCh := make(chan error, 1)
+				resultCh := make(chan manifests.SyncResult)
+
+				go func() {
+					errCh <- manifests.Sync(ctx, bootstrapManifests, cfg, true, resultCh)
+				}()
+
+				for {
+					select {
+					case err := <-errCh:
+						if err != nil {
+							if apierrors.IsInvalid(err) || apierrors.IsBadRequest(err) || apierrors.IsForbidden(err) || apierrors.IsRequestEntityTooLargeError(err) || webhookError(err) {
+								// bootstrap manifests are invalid, log, but don't fail the controller
+								logger.Error("failed to sync bootstrap manifests", zap.String("cluster", clusterID), zap.Error(err))
+								manifestStatus.TypedSpec().Value.LastFatalError = err.Error()
+
+								return nil
+							}
+
+							return fmt.Errorf("failed to dry run sync manifests: %w", err)
+						}
+
+						return nil
+					case result := <-resultCh:
+						if !result.Skipped {
+							manifestStatus.TypedSpec().Value.OutOfSync++
+						}
+					}
+				}
+			},
+		},
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.LoadBalancerStatus, *omni.ClusterSecrets](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.ClusterStatus, *omni.ClusterSecrets](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.KubernetesUpgradeStatus, *omni.ClusterSecrets](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.TalosUpgradeStatus, *omni.ClusterSecrets](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByClusterLabelOnlyControlplane[*omni.MachineSetStatus, *omni.ClusterSecrets](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperNone[*omni.MachineSet](),
+		),
+		qtransform.WithConcurrency(4),
+	)
+}
+
+func webhookError(err error) bool {
+	msg := err.Error()
+
+	return strings.Contains(msg, "failed calling webhook") || strings.Contains(msg, "failed to call webhook")
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/kubernetes_upgrade_status.go b/internal/backend/runtime/omni/controllers/omni/kubernetes_upgrade_status.go
new file mode 100644
index 000000000..3e45af00e
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/kubernetes_upgrade_status.go
@@ -0,0 +1,392 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/xerrors"
+	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
+	"go.uber.org/zap"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/kubernetes"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/mappers"
+)
+
+// KubernetesUpgradeStatusController manages KubernetesUpgradeStatus performing a Kubernetes upgrade.
+//
+// KubernetesUpgradeStatusController upgrades Kubernetes component versions in the cluster.
+type KubernetesUpgradeStatusController = qtransform.QController[*omni.Cluster, *omni.KubernetesUpgradeStatus]
+
+// KubernetesUpgradeStatusControllerName is the name of KubernetesUpgradeStatusController.
+const KubernetesUpgradeStatusControllerName = "KubernetesUpgradeStatusController"
+
+// NewKubernetesUpgradeStatusController initializes KubernetesUpgradeStatusController.
+//
+//nolint:gocognit,cyclop,gocyclo,maintidx
+func NewKubernetesUpgradeStatusController() *KubernetesUpgradeStatusController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.Cluster, *omni.KubernetesUpgradeStatus]{
+			Name: KubernetesUpgradeStatusControllerName,
+			MapMetadataFunc: func(cluster *omni.Cluster) *omni.KubernetesUpgradeStatus {
+				return omni.NewKubernetesUpgradeStatus(resources.DefaultNamespace, cluster.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(upgradeStatus *omni.KubernetesUpgradeStatus) *omni.Cluster {
+				return omni.NewCluster(resources.DefaultNamespace, upgradeStatus.Metadata().ID())
+			},
+			TransformExtraOutputFunc: func(ctx context.Context, r controller.ReaderWriter, _ *zap.Logger, cluster *omni.Cluster, upgradeStatus *omni.KubernetesUpgradeStatus) error {
+				kubernetesStatus, err := safe.ReaderGet[*omni.KubernetesStatus](ctx, r, omni.NewKubernetesStatus(resources.DefaultNamespace, cluster.Metadata().ID()).Metadata())
+				if err != nil {
+					if state.IsNotFoundError(err) {
+						return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+					}
+
+					return err
+				}
+
+				// if not reverting to the previous successful version, perform pre-checks on each step
+				versionMismatch := cluster.TypedSpec().Value.KubernetesVersion != upgradeStatus.TypedSpec().Value.LastUpgradeVersion
+
+				if versionMismatch {
+					// set the status to 'upgrading' if there is a version mismatch
+					upgradeStatus.TypedSpec().Value.Phase = specs.KubernetesUpgradeStatusSpec_Upgrading
+					upgradeStatus.TypedSpec().Value.CurrentUpgradeVersion = cluster.TypedSpec().Value.KubernetesVersion
+				} else {
+					upgradeStatus.TypedSpec().Value.CurrentUpgradeVersion = ""
+				}
+
+				clusterStatus, err := safe.ReaderGet[*omni.ClusterStatus](ctx, r, omni.NewClusterStatus(resources.DefaultNamespace, cluster.Metadata().ID()).Metadata())
+				if err != nil {
+					if state.IsNotFoundError(err) {
+						return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+					}
+
+					return err
+				}
+
+				if clusterStatus.TypedSpec().Value.Phase != specs.ClusterStatusSpec_RUNNING || !clusterStatus.TypedSpec().Value.Ready {
+					// if the cluster is not ready, and doing "normal" upgrade, set the status to 'waiting for the cluster to be ready'
+					if versionMismatch {
+						if upgradeStatus.TypedSpec().Value.Phase == specs.KubernetesUpgradeStatusSpec_Upgrading {
+							upgradeStatus.TypedSpec().Value.Status = "waiting for the cluster to be ready"
+						}
+
+						return nil
+					}
+
+					// if performing a revert while a cluster is not ready, force all components to be not ready, as Kubernetes status might not be correctly gathered
+					for _, node := range kubernetesStatus.TypedSpec().Value.Nodes {
+						node.Ready = false
+					}
+
+					for _, nodePods := range kubernetesStatus.TypedSpec().Value.StaticPods {
+						for _, pod := range nodePods.StaticPods {
+							pod.Ready = false
+						}
+					}
+				}
+
+				// build a mapping of nodenames to machine IDs
+				nodenameToMachineMap, err := kubernetes.NewMachineMap(ctx, r, cluster)
+				if err != nil {
+					return fmt.Errorf("failed to build nodename to machine map: %w", err)
+				}
+
+				// check if all Kubernetes components are ready
+				upgradePath := kubernetes.CalculateUpgradePath(nodenameToMachineMap, kubernetesStatus, cluster.TypedSpec().Value.KubernetesVersion)
+
+				upgradeStatus.Metadata().Labels().Set(omni.LabelCluster, cluster.Metadata().ID())
+
+				switch {
+				case len(upgradePath.Steps) == 0 && upgradePath.AllComponentsReady:
+					// upgrade fully completed
+					upgradeStatus.TypedSpec().Value.Phase = specs.KubernetesUpgradeStatusSpec_Done
+					upgradeStatus.TypedSpec().Value.Step = ""
+					upgradeStatus.TypedSpec().Value.Status = ""
+					upgradeStatus.TypedSpec().Value.Error = ""
+					upgradeStatus.TypedSpec().Value.LastUpgradeVersion = cluster.TypedSpec().Value.KubernetesVersion
+					upgradeStatus.TypedSpec().Value.CurrentUpgradeVersion = ""
+				case len(upgradePath.Steps) > 0 && !versionMismatch && upgradeStatus.TypedSpec().Value.Phase != specs.KubernetesUpgradeStatusSpec_Done:
+					// reverting an upgrade (?)
+					var applied bool
+
+					applied, err = applyUpgradePatches(ctx, r, cluster, upgradePath.Steps...)
+					if err != nil {
+						return err
+					}
+
+					if applied {
+						upgradeStatus.TypedSpec().Value.Phase = specs.KubernetesUpgradeStatusSpec_Reverting
+						upgradeStatus.TypedSpec().Value.Step = "reverting the change"
+						upgradeStatus.TypedSpec().Value.Status = ""
+						upgradeStatus.TypedSpec().Value.Error = ""
+					}
+				case len(upgradePath.Steps) > 0 && upgradePath.AllComponentsReady:
+					prePullStatus, prePullDone, prePullErr := updateImagePullRequest(ctx, r, upgradePath)
+					if prePullErr != nil {
+						return prePullErr
+					}
+
+					if !prePullDone {
+						if prePullStatus == nil {
+							return nil // there is no ImagePullStatus for the current version of the ImagePullRequest yet
+						}
+
+						processedError := prePullStatus.TypedSpec().Value.GetLastProcessedError()
+						if processedError != "" {
+							upgradeStatus.TypedSpec().Value.Step = fmt.Sprintf("failed to pull %q", prePullStatus.TypedSpec().Value.GetLastProcessedImage())
+						} else {
+							upgradeStatus.TypedSpec().Value.Step = fmt.Sprintf("pulled %q", prePullStatus.TypedSpec().Value.GetLastProcessedImage())
+						}
+
+						upgradeStatus.TypedSpec().Value.Phase = specs.KubernetesUpgradeStatusSpec_Upgrading
+						upgradeStatus.TypedSpec().Value.Status = fmt.Sprintf("pre-pulling images (%d/%d)",
+							prePullStatus.TypedSpec().Value.GetProcessedCount(),
+							prePullStatus.TypedSpec().Value.GetTotalCount())
+						upgradeStatus.TypedSpec().Value.Error = processedError
+
+						return nil
+					}
+
+					// ready to apply the next patch
+					patch := upgradePath.Steps[0]
+
+					var skip bool
+
+					skip, err = skipLocked(ctx, r, patch, upgradeStatus)
+					if err != nil {
+						return err
+					}
+
+					if skip {
+						return nil
+					}
+
+					upgradeStatus.TypedSpec().Value.Phase = specs.KubernetesUpgradeStatusSpec_Upgrading
+					upgradeStatus.TypedSpec().Value.Step = patch.Description
+					upgradeStatus.TypedSpec().Value.Status = "waiting for a restart"
+					upgradeStatus.TypedSpec().Value.Error = ""
+
+					if _, err = applyUpgradePatches(ctx, r, cluster, patch); err != nil {
+						return err
+					}
+				case !upgradePath.AllComponentsReady:
+					upgradeStatus.TypedSpec().Value.Status = upgradePath.NotReadyStatus
+					upgradeStatus.TypedSpec().Value.Error = ""
+				default:
+					upgradeStatus.TypedSpec().Value.Phase = specs.KubernetesUpgradeStatusSpec_Unknown
+				}
+
+				if upgradeStatus.TypedSpec().Value.Phase == specs.KubernetesUpgradeStatusSpec_Done {
+					// upgrade is done, so calculate the upgrade versions
+					upgradeStatus.TypedSpec().Value.UpgradeVersions, err = kubernetes.CalculateUpgradeVersions(
+						ctx, r, upgradeStatus.TypedSpec().Value.LastUpgradeVersion, cluster.TypedSpec().Value.TalosVersion)
+					if err != nil {
+						return err
+					}
+				} else {
+					// upgrade is going, or failed, so clear the upgrade versions
+					upgradeStatus.TypedSpec().Value.UpgradeVersions = nil
+				}
+
+				return nil
+			},
+			FinalizerRemovalExtraOutputFunc: func(ctx context.Context, r controller.ReaderWriter, _ *zap.Logger, cluster *omni.Cluster) error {
+				// drop any config patches created by this controller
+				configPatches, err := safe.ReaderListAll[*omni.ConfigPatch](ctx, r, state.WithLabelQuery(
+					resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID()),
+				))
+				if err != nil {
+					return err
+				}
+
+				for cpIter := configPatches.Iterator(); cpIter.Next(); {
+					if cpIter.Value().Metadata().Owner() == KubernetesUpgradeStatusControllerName {
+						if err = r.Destroy(ctx, cpIter.Value().Metadata()); err != nil {
+							return err
+						}
+					}
+				}
+
+				// drop any ImagePullRequests created by this controller
+				imagePullRequests, err := safe.ReaderListAll[*omni.ImagePullRequest](ctx, r, state.WithLabelQuery(
+					resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID()),
+				))
+				if err != nil {
+					return err
+				}
+
+				for iprIter := imagePullRequests.Iterator(); iprIter.Next(); {
+					if iprIter.Value().Metadata().Owner() == KubernetesUpgradeStatusControllerName {
+						if err = r.Destroy(ctx, iprIter.Value().Metadata()); err != nil {
+							return err
+						}
+					}
+				}
+
+				return nil
+			},
+		},
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.ClusterStatus, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.KubernetesStatus, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.ImagePullStatus, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			func(ctx context.Context, _ *zap.Logger, r controller.QRuntime, _ *omni.KubernetesVersion) ([]resource.Pointer, error) {
+				// reconcile all clusters on KubernetesVersion changes
+				clusters, err := safe.ReaderListAll[*omni.Cluster](ctx, r)
+				if err != nil {
+					return nil, err
+				}
+
+				return safe.Map(clusters, func(cluster *omni.Cluster) (resource.Pointer, error) {
+					return cluster.Metadata(), nil
+				})
+			},
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByClusterLabel[*omni.ClusterMachineIdentity, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByClusterLabel[*omni.MachineSetNode, *omni.Cluster](),
+		),
+		qtransform.WithExtraOutputs(
+			controller.Output{
+				Type: omni.ConfigPatchType,
+				Kind: controller.OutputShared,
+			},
+			controller.Output{
+				Type: omni.ImagePullRequestType,
+				Kind: controller.OutputShared,
+			},
+		),
+		qtransform.WithConcurrency(2),
+	)
+}
+
+func updateImagePullRequest(ctx context.Context, r controller.ReaderWriter, upgradePath *kubernetes.UpgradePath) (sts *omni.ImagePullStatus, done bool, err error) {
+	request, err := safe.WriterModifyWithResult[*omni.ImagePullRequest](ctx, r, omni.NewImagePullRequest(resources.DefaultNamespace, upgradePath.ClusterID), func(r *omni.ImagePullRequest) error {
+		var nodeImageList []*specs.ImagePullRequestSpec_NodeImageList
+
+		for _, node := range upgradePath.AllNodes {
+			nodeImageList = append(nodeImageList,
+				&specs.ImagePullRequestSpec_NodeImageList{
+					Node:   node,
+					Images: upgradePath.AllNodesToRequiredImages[node],
+				},
+			)
+		}
+
+		r.Metadata().Labels().Set(omni.LabelCluster, upgradePath.ClusterID)
+
+		r.TypedSpec().Value.NodeImageList = nodeImageList
+
+		return nil
+	})
+	if err != nil {
+		return nil, false, fmt.Errorf("failed to update ImagePullRequest: %w", err)
+	}
+
+	sts, err = safe.ReaderGet[*omni.ImagePullStatus](ctx, r, omni.NewImagePullStatus(resources.DefaultNamespace, upgradePath.ClusterID).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, false, nil
+		}
+
+		return nil, false, fmt.Errorf("failed to get ImagePullStatus: %w", err)
+	}
+
+	versionMatch := request.Metadata().Version().String() == sts.TypedSpec().Value.GetRequestVersion()
+	if !versionMatch {
+		return nil, false, nil
+	}
+
+	done = sts.TypedSpec().Value.GetProcessedCount() == sts.TypedSpec().Value.GetTotalCount()
+
+	return sts, done, nil
+}
+
+func applyUpgradePatches(ctx context.Context, r controller.Writer, cluster *omni.Cluster, patches ...kubernetes.UpgradeStep) (bool, error) {
+	anyPatchApplied := false
+
+	for _, patch := range patches {
+		if err := safe.WriterModify(ctx, r,
+			omni.NewConfigPatch(resources.DefaultNamespace, fmt.Sprintf("900-cm-%s-kubernetes-upgrade", patch.MachineID)),
+			func(configPatch *omni.ConfigPatch) error {
+				var cfg v1alpha1.Config
+
+				if configPatch.TypedSpec().Value.Data != "" {
+					if err := yaml.Unmarshal([]byte(configPatch.TypedSpec().Value.Data), &cfg); err != nil {
+						return err
+					}
+				}
+
+				oldCfg := cfg.DeepCopy()
+
+				patch.Patch.Apply(&cfg)
+
+				// patch is already applied, skip it
+				if reflect.DeepEqual(oldCfg, cfg) {
+					return nil
+				}
+
+				configPatch.Metadata().Labels().Set(omni.LabelCluster, cluster.Metadata().ID())
+				configPatch.Metadata().Labels().Set(omni.LabelClusterMachine, patch.MachineID)
+				configPatch.Metadata().Labels().Set(omni.LabelSystemPatch, "")
+
+				data, err := yaml.Marshal(cfg)
+				if err != nil {
+					return err
+				}
+
+				configPatch.TypedSpec().Value.Data = string(data)
+
+				anyPatchApplied = true
+
+				return nil
+			}); err != nil {
+			return false, err
+		}
+	}
+
+	return anyPatchApplied, nil
+}
+
+func skipLocked(ctx context.Context, r controller.Reader, patch kubernetes.UpgradeStep, upgradeStatus *omni.KubernetesUpgradeStatus) (bool, error) {
+	machineSetNode, err := r.Get(ctx, resource.NewMetadata(resources.DefaultNamespace, omni.MachineSetNodeType, patch.MachineID, resource.VersionUndefined))
+	if err != nil && !state.IsNotFoundError(err) {
+		return false, err
+	}
+
+	if machineSetNode != nil {
+		if _, locked := machineSetNode.Metadata().Annotations().Get(omni.MachineLocked); locked {
+			upgradeStatus.TypedSpec().Value.Phase = specs.KubernetesUpgradeStatusSpec_Upgrading
+			upgradeStatus.TypedSpec().Value.Step = patch.Description
+			upgradeStatus.TypedSpec().Value.Status = "waiting for machine to be unlocked"
+			upgradeStatus.TypedSpec().Value.Error = ""
+
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/loadbalancer.go b/internal/backend/runtime/omni/controllers/omni/loadbalancer.go
new file mode 100644
index 000000000..8941a16ac
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/loadbalancer.go
@@ -0,0 +1,216 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/loadbalancer"
+)
+
+// LoadBalancerController starts, stops and updates the statuses of load balancers.
+type LoadBalancerController struct {
+	NewLoadBalancer loadbalancer.NewFunc
+
+	loadBalancers *loadbalancer.Manager
+}
+
+// Name returns the name of the controller.
+func (ctrl *LoadBalancerController) Name() string {
+	return "LoadBalancerController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *LoadBalancerController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.LoadBalancerConfigType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterStatusType,
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *LoadBalancerController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.LoadBalancerStatusType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *LoadBalancerController) Run(ctx context.Context, r controller.Runtime, logger *zap.Logger) error {
+	if ctrl.NewLoadBalancer == nil {
+		ctrl.NewLoadBalancer = loadbalancer.DefaultNew
+	}
+
+	ctrl.loadBalancers = loadbalancer.NewManager(logger, ctrl.NewLoadBalancer)
+
+	defer func() {
+		if err := ctrl.loadBalancers.Stop(); err != nil {
+			logger.Error("error shutting down load balancers", zap.Error(err))
+		}
+	}()
+
+	ticker := time.NewTicker(time.Second * 10)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+			if err := ctrl.reconcileLoadBalancers(ctx, r, logger); err != nil {
+				return err
+			}
+
+			// reconcile health statuses immediately on lb config changes
+			if err := ctrl.updateHealthStatus(ctx, r); err != nil {
+				return err
+			}
+		case <-ticker.C:
+			if err := ctrl.updateHealthStatus(ctx, r); err != nil {
+				return err
+			}
+		}
+
+		r.ResetRestartBackoff()
+	}
+}
+
+func (ctrl *LoadBalancerController) reconcileLoadBalancers(ctx context.Context, r controller.Runtime, logger *zap.Logger) error {
+	// list loadBalancers
+	list, err := safe.ReaderListAll[*omni.LoadBalancerConfig](ctx, r)
+	if err != nil {
+		return fmt.Errorf("error listing load balancer resources: %w", err)
+	}
+
+	// figure out which loadBalancers should run
+	shouldRun := make(map[loadbalancer.ID]loadbalancer.Spec, list.Len())
+	endpoints := make(map[loadbalancer.ID][]string, list.Len())
+	stopped := map[loadbalancer.ID]struct{}{}
+
+	for iter := list.Iterator(); iter.Next(); {
+		item := iter.Value()
+
+		var clusterStatus *omni.ClusterStatus
+
+		clusterStatus, err = safe.ReaderGet[*omni.ClusterStatus](ctx, r, omni.NewClusterStatus(
+			resources.DefaultNamespace,
+			item.Metadata().ID(),
+		).Metadata())
+		if err != nil {
+			if state.IsNotFoundError(err) {
+				continue
+			}
+
+			return err
+		}
+
+		if !clusterStatus.TypedSpec().Value.HasConnectedControlPlanes {
+			logger.Debug("skip running load balancer for the cluster with no connected control plane machines", zap.String("cluster", item.Metadata().ID()))
+
+			stopped[item.Metadata().ID()] = struct{}{}
+
+			continue
+		}
+
+		lbSpec := item.TypedSpec().Value
+
+		var bindPort int
+
+		bindPort, err = strconv.Atoi(lbSpec.BindPort)
+		if err != nil {
+			return fmt.Errorf("failed to parse port %q as int: %w", lbSpec.BindPort, err)
+		}
+
+		shouldRun[item.Metadata().ID()] = loadbalancer.Spec{
+			BindAddress: "0.0.0.0",
+			BindPort:    bindPort,
+		}
+
+		endpoints[item.Metadata().ID()] = lbSpec.Endpoints
+	}
+
+	if err = ctrl.loadBalancers.Reconcile(shouldRun); err != nil {
+		// don't fail hard to keep other loadbalancers running
+		logger.Error("error reconciling load balancers", zap.Error(err))
+	}
+
+	ctrl.loadBalancers.UpdateUpstreams(endpoints)
+
+	// Clean up statuses of load balancers that have been deleted or stopped.
+	statuses, err := safe.ReaderListAll[*omni.LoadBalancerStatus](ctx, r)
+	if err != nil {
+		return fmt.Errorf("error listing resources: %w", err)
+	}
+
+	for iter := statuses.Iterator(); iter.Next(); {
+		cfg := iter.Value()
+		id := cfg.Metadata().ID()
+
+		if _, ok := stopped[id]; ok {
+			if err := safe.WriterModify(ctx, r, omni.NewLoadBalancerStatus(resources.DefaultNamespace, id), func(status *omni.LoadBalancerStatus) error {
+				status.Metadata().Labels().Set(omni.LabelCluster, id)
+
+				status.TypedSpec().Value.Stopped = true
+				status.TypedSpec().Value.Healthy = false
+
+				return nil
+			}); err != nil {
+				return fmt.Errorf("error modifying load balancer resource: %w", err)
+			}
+
+			// keep the status
+			continue
+		}
+
+		if _, ok := shouldRun[id]; ok {
+			continue
+		}
+
+		if err := r.Destroy(ctx, cfg.Metadata()); err != nil {
+			return fmt.Errorf("error deleting load balancer config '%s' error: %w", id, err)
+		}
+	}
+
+	return nil
+}
+
+func (ctrl *LoadBalancerController) updateHealthStatus(ctx context.Context, r controller.Runtime) error {
+	for id, healthy := range ctrl.loadBalancers.GetHealthStatus() {
+		if err := safe.WriterModify(ctx, r, omni.NewLoadBalancerStatus(resources.DefaultNamespace, id), func(status *omni.LoadBalancerStatus) error {
+			status.Metadata().Labels().Set(omni.LabelCluster, id)
+
+			status.TypedSpec().Value.Stopped = false
+			status.TypedSpec().Value.Healthy = healthy
+
+			return nil
+		}); err != nil {
+			return fmt.Errorf("error modifying load balancer resource: %w", err)
+		}
+	}
+
+	return nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/loadbalancer_test.go b/internal/backend/runtime/omni/controllers/omni/loadbalancer_test.go
new file mode 100644
index 000000000..954162f6f
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/loadbalancer_test.go
@@ -0,0 +1,395 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"strconv"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	omniresources "github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/loadbalancer"
+)
+
+type mockLoadBalancer struct {
+	startMethodCalled    chan struct{}
+	shutdownMethodCalled chan struct{}
+	upstreamsCh          chan []string
+	ctxCancel            context.CancelFunc
+	wg                   sync.WaitGroup
+}
+
+func (lb *mockLoadBalancer) Start(upstreamCh <-chan []string) error {
+	var ctx context.Context
+	ctx, lb.ctxCancel = context.WithCancel(context.Background())
+
+	lb.wg.Add(2)
+
+	go func() {
+		defer lb.wg.Done()
+
+		select {
+		case lb.startMethodCalled <- struct{}{}:
+		case <-ctx.Done():
+			return
+		}
+	}()
+
+	go func() {
+		defer lb.wg.Done()
+
+		var upstreams []string
+
+		for {
+			// copy upstreams from the channel so that the writing goroutine isn't blocked
+			select {
+			case upstreams = <-upstreamCh:
+			case <-ctx.Done():
+				return
+			}
+
+			// write copied upstreams to mock load balancer
+		restart:
+			select {
+			case upstreams = <-upstreamCh:
+				goto restart
+			case lb.upstreamsCh <- upstreams:
+			case <-ctx.Done():
+				return
+			}
+		}
+	}()
+
+	return nil
+}
+
+func (lb *mockLoadBalancer) Shutdown() error {
+	lb.ctxCancel()
+	lb.wg.Wait()
+
+	go func() {
+		lb.shutdownMethodCalled <- struct{}{}
+	}()
+
+	return nil
+}
+
+func (lb *mockLoadBalancer) Healthy() (bool, error) {
+	return true, nil
+}
+
+type LoadBalancerSuite struct {
+	OmniSuite
+}
+
+func TestLoadBalancerSuite(t *testing.T) {
+	suite.Run(t, new(LoadBalancerSuite))
+}
+
+func expectSignal[T comparable](suite *LoadBalancerSuite, signalChan <-chan T, expectedSignal T) {
+	select {
+	case receivedSignal := <-signalChan:
+		suite.Assert().Equal(expectedSignal, receivedSignal)
+	case <-time.After(3 * time.Second):
+		suite.FailNow("expected Signal %#v on channel %#v", signalChan, expectedSignal)
+	}
+}
+
+type newLoadBalancerSignature struct {
+	bindAddress string
+	bindPort    int
+}
+
+func (suite *LoadBalancerSuite) setupMock() (<-chan *mockLoadBalancer, <-chan newLoadBalancerSignature) {
+	mockCh := make(chan *mockLoadBalancer)
+	newLoadBalancerMethodCalled := make(chan newLoadBalancerSignature)
+
+	newMockFunc := func(bindAddress string, bindPort int, _ *zap.Logger) (loadbalancer.LoadBalancer, error) {
+		mock := &mockLoadBalancer{
+			startMethodCalled:    make(chan struct{}),
+			shutdownMethodCalled: make(chan struct{}),
+			upstreamsCh:          make(chan []string),
+		}
+
+		go func() {
+			newLoadBalancerMethodCalled <- newLoadBalancerSignature{
+				bindAddress: bindAddress,
+				bindPort:    bindPort,
+			}
+		}()
+
+		mockCh <- mock
+
+		return mock, nil
+	}
+
+	suite.newLoadBalancerSetup(newMockFunc)
+
+	return mockCh, newLoadBalancerMethodCalled
+}
+
+func (suite *LoadBalancerSuite) TestLoadBalancers() {
+	mockCh, newLoadBalancerMethodCalled := suite.setupMock()
+
+	suite.startRuntime()
+
+	createLoadBalancer := func(bindPort int) {
+		loadBalancer := omniresources.NewLoadBalancerConfig(resources.DefaultNamespace, strconv.Itoa(bindPort))
+		loadBalancer.TypedSpec().Value.BindPort = strconv.Itoa(bindPort)
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, loadBalancer))
+
+		clusterStatus := omniresources.NewClusterStatus(resources.DefaultNamespace, strconv.Itoa(bindPort))
+		clusterStatus.TypedSpec().Value.HasConnectedControlPlanes = true
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, clusterStatus))
+	}
+
+	bindPort1 := 20000
+	bindPort2 := 12345
+	bindPort3 := 11111
+
+	createLoadBalancer(bindPort1)
+
+	lb1 := <-mockCh
+
+	expectSignal(suite, newLoadBalancerMethodCalled, newLoadBalancerSignature{
+		bindAddress: "0.0.0.0",
+		bindPort:    bindPort1,
+	})
+	expectSignal(suite, lb1.startMethodCalled, struct{}{})
+
+	createLoadBalancer(bindPort2)
+
+	lb2 := <-mockCh
+
+	expectSignal(suite, newLoadBalancerMethodCalled, newLoadBalancerSignature{
+		bindAddress: "0.0.0.0",
+		bindPort:    bindPort2,
+	})
+	expectSignal(suite, lb2.startMethodCalled, struct{}{})
+
+	createLoadBalancer(bindPort3)
+
+	lb3 := <-mockCh
+
+	expectSignal(suite, newLoadBalancerMethodCalled, newLoadBalancerSignature{
+		bindAddress: "0.0.0.0",
+		bindPort:    bindPort3,
+	})
+	expectSignal(suite, lb3.startMethodCalled, struct{}{})
+
+	suite.assertStatus(strconv.Itoa(bindPort1), true, false)
+	suite.assertStatus(strconv.Itoa(bindPort2), true, false)
+	suite.assertStatus(strconv.Itoa(bindPort3), true, false)
+
+	// update cluster status to not have connected control planes
+	clusterStatus1, err := safe.StateUpdateWithConflicts(
+		suite.ctx, suite.state,
+		omniresources.NewClusterStatus(resources.DefaultNamespace, strconv.Itoa(bindPort1)).Metadata(),
+		func(r *omniresources.ClusterStatus) error {
+			r.TypedSpec().Value.HasConnectedControlPlanes = false
+
+			return nil
+		})
+	suite.Require().NoError(err)
+
+	// the loadbalancer should be stopped
+	expectSignal(suite, lb1.shutdownMethodCalled, struct{}{})
+
+	suite.assertStatus(strconv.Itoa(bindPort1), false, true)
+
+	// update cluster status to have connected control planes again
+	clusterStatus1.TypedSpec().Value.HasConnectedControlPlanes = true
+	suite.Require().NoError(suite.state.Update(suite.ctx, clusterStatus1))
+
+	// the loadbalancer should be started again
+	lb1 = <-mockCh
+
+	expectSignal(suite, newLoadBalancerMethodCalled, newLoadBalancerSignature{
+		bindAddress: "0.0.0.0",
+		bindPort:    bindPort1,
+	})
+	expectSignal(suite, lb1.startMethodCalled, struct{}{})
+
+	suite.assertStatus(strconv.Itoa(bindPort1), true, false)
+
+	suite.ctxCancel()
+	suite.wg.Wait()
+
+	expectSignal(suite, lb1.shutdownMethodCalled, struct{}{})
+	expectSignal(suite, lb2.shutdownMethodCalled, struct{}{})
+	expectSignal(suite, lb3.shutdownMethodCalled, struct{}{})
+}
+
+func (suite *LoadBalancerSuite) newLoadBalancerSetup(newLoadBalancerFunc loadbalancer.NewFunc) {
+	suite.Require().NoError(
+		suite.runtime.RegisterController(
+			&omni.LoadBalancerController{
+				NewLoadBalancer: newLoadBalancerFunc,
+			},
+		),
+	)
+}
+
+func (suite *LoadBalancerSuite) assertStatus(id string, expectedHealthy, expectedStopped bool) {
+	assertResource(
+		&suite.OmniSuite,
+		*omniresources.NewLoadBalancerStatus(resources.DefaultNamespace, id).Metadata(),
+		func(res *omniresources.LoadBalancerStatus, assertions *assert.Assertions) {
+			lbStatus := res.TypedSpec().Value
+			assertions.Equal(expectedHealthy, lbStatus.Healthy)
+			assertions.Equal(expectedStopped, lbStatus.Stopped)
+		},
+	)
+}
+
+func (suite *LoadBalancerSuite) TestChangeAddress() {
+	mockCh, newLoadBalancerMethodCalled := suite.setupMock()
+
+	suite.startRuntime()
+
+	const testID = ""
+
+	loadBalancer := omniresources.NewLoadBalancerConfig(resources.DefaultNamespace, testID)
+	expectedBindPort := 20000
+	loadBalancer.TypedSpec().Value.BindPort = strconv.Itoa(expectedBindPort)
+	suite.Require().NoError(suite.state.Create(suite.ctx, loadBalancer))
+
+	clusterStatus := omniresources.NewClusterStatus(resources.DefaultNamespace, testID)
+	clusterStatus.TypedSpec().Value.HasConnectedControlPlanes = true
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, clusterStatus))
+
+	mock := <-mockCh
+
+	expectSignal(suite, newLoadBalancerMethodCalled, newLoadBalancerSignature{
+		bindAddress: "0.0.0.0",
+		bindPort:    expectedBindPort,
+	})
+	expectSignal(suite, mock.startMethodCalled, struct{}{})
+	suite.assertStatus(testID, true, false)
+
+	newExpectedBindPort := 123123
+
+	_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, loadBalancer.Metadata(), func(r *omniresources.LoadBalancerConfig) error {
+		spec := r.TypedSpec().Value
+		spec.BindPort = strconv.Itoa(newExpectedBindPort)
+
+		return nil
+	})
+	suite.Require().NoError(err)
+
+	expectSignal(suite, mock.shutdownMethodCalled, struct{}{})
+
+	mock = <-mockCh
+
+	expectSignal(suite, newLoadBalancerMethodCalled, newLoadBalancerSignature{
+		bindAddress: "0.0.0.0",
+		bindPort:    newExpectedBindPort,
+	})
+	expectSignal(suite, mock.startMethodCalled, struct{}{})
+
+	assertResource(
+		&suite.OmniSuite,
+		*omniresources.NewLoadBalancerStatus(resources.EphemeralNamespace, testID).Metadata(),
+		func(res *omniresources.LoadBalancerStatus, assertions *assert.Assertions) {
+			lbStatus := res.TypedSpec().Value
+
+			assertions.True(lbStatus.Healthy)
+		},
+	)
+
+	suite.ctxCancel()
+	suite.wg.Wait()
+
+	expectSignal(suite, mock.shutdownMethodCalled, struct{}{})
+}
+
+func (suite *LoadBalancerSuite) TestStopLoadBalancer() {
+	mockCh, _ := suite.setupMock()
+
+	suite.startRuntime()
+
+	const testID = ""
+
+	loadBalancer := omniresources.NewLoadBalancerConfig(resources.DefaultNamespace, testID)
+	expectedBindPort := 20000
+	loadBalancer.TypedSpec().Value.BindPort = strconv.Itoa(expectedBindPort)
+	suite.Require().NoError(suite.state.Create(suite.ctx, loadBalancer))
+
+	clusterStatus := omniresources.NewClusterStatus(resources.DefaultNamespace, testID)
+	clusterStatus.TypedSpec().Value.HasConnectedControlPlanes = true
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, clusterStatus))
+
+	mock := <-mockCh
+
+	suite.assertStatus(testID, true, false)
+
+	suite.Assert().NoError(suite.state.Destroy(suite.ctx, loadBalancer.Metadata()))
+
+	expectSignal(suite, mock.shutdownMethodCalled, struct{}{})
+
+	suite.assertNoResource(*omniresources.NewLoadBalancerStatus(resources.DefaultNamespace, testID).Metadata())
+}
+
+func (suite *LoadBalancerSuite) TestUpdateUpstreams() {
+	mockCh, _ := suite.setupMock()
+
+	suite.startRuntime()
+
+	const testID = ""
+
+	loadBalancer := omniresources.NewLoadBalancerConfig(resources.DefaultNamespace, testID)
+	expectedBindPort := 20000
+	loadBalancer.TypedSpec().Value.BindPort = strconv.Itoa(expectedBindPort)
+	loadBalancer.TypedSpec().Value.Endpoints = []string{
+		"testEndpoint",
+	}
+	suite.Require().NoError(suite.state.Create(suite.ctx, loadBalancer))
+
+	clusterStatus := omniresources.NewClusterStatus(resources.DefaultNamespace, testID)
+	clusterStatus.TypedSpec().Value.HasConnectedControlPlanes = true
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, clusterStatus))
+
+	mock := <-mockCh
+	assertUpstreams := func(expectedUpstreams ...string) {
+		select {
+		case <-time.After(time.Second):
+			suite.FailNow("timeout")
+		case upstreamList := <-mock.upstreamsCh:
+			suite.Assert().Equal(expectedUpstreams, upstreamList)
+		}
+	}
+
+	assertUpstreams("testEndpoint")
+
+	suite.assertStatus(testID, true, false)
+
+	_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, loadBalancer.Metadata(), func(r *omniresources.LoadBalancerConfig) error {
+		spec := r.TypedSpec().Value
+		spec.Endpoints = append(spec.Endpoints, "newEndpoint")
+
+		return nil
+	})
+	suite.Require().NoError(err)
+
+	assertUpstreams("testEndpoint", "newEndpoint")
+
+	suite.ctxCancel()
+	suite.wg.Wait()
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine.go b/internal/backend/runtime/omni/controllers/omni/machine.go
new file mode 100644
index 000000000..dd7a4ba3b
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine.go
@@ -0,0 +1,56 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"net/netip"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+)
+
+// MachineController creates omni.Machines based on siderolink.Link resources.
+//
+// MachineController plays the role of machine discovery.
+type MachineController = qtransform.QController[*siderolink.Link, *omni.Machine]
+
+// NewMachineController instanciates the machine controller.
+func NewMachineController() *MachineController {
+	return qtransform.NewQController(
+		qtransform.Settings[*siderolink.Link, *omni.Machine]{
+			Name: "MachineController",
+			MapMetadataFunc: func(link *siderolink.Link) *omni.Machine {
+				return omni.NewMachine(resources.DefaultNamespace, link.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(machine *omni.Machine) *siderolink.Link {
+				return siderolink.NewLink(resources.DefaultNamespace, machine.Metadata().ID(), nil)
+			},
+			TransformFunc: func(_ context.Context, _ controller.Reader, _ *zap.Logger, link *siderolink.Link, machine *omni.Machine) error {
+				// convert SideroLink subnet to an IP address
+				ipPrefix, err := netip.ParsePrefix(link.TypedSpec().Value.NodeSubnet)
+				if err != nil {
+					return err
+				}
+
+				spec := machine.TypedSpec().Value
+
+				spec.ManagementAddress = ipPrefix.Addr().String()
+				spec.Connected = link.TypedSpec().Value.Connected
+
+				machine.Metadata().Labels().Set(omni.MachineAddressLabel, spec.ManagementAddress)
+
+				return nil
+			},
+		},
+		qtransform.WithConcurrency(4),
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_config_gen_options.go b/internal/backend/runtime/omni/controllers/omni/machine_config_gen_options.go
new file mode 100644
index 000000000..77dcd5bd2
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_config_gen_options.go
@@ -0,0 +1,67 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+//tsgen:installDiskMinSize
+const installDiskMinSize = 5e9 // 5GB
+
+// MachineConfigGenOptionsController creates a patch that configures machine install disk automatically.
+type MachineConfigGenOptionsController = qtransform.QController[*omni.MachineStatus, *omni.MachineConfigGenOptions]
+
+// NewMachineConfigGenOptionsController initializes MachineConfigGenOptionsController.
+func NewMachineConfigGenOptionsController() *MachineConfigGenOptionsController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.MachineStatus, *omni.MachineConfigGenOptions]{
+			Name: "MachineConfigGenOptionsController",
+			MapMetadataFunc: func(machineStatus *omni.MachineStatus) *omni.MachineConfigGenOptions {
+				return omni.NewMachineConfigGenOptions(resources.DefaultNamespace, machineStatus.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(machineConfigGenOptions *omni.MachineConfigGenOptions) *omni.MachineStatus {
+				return omni.NewMachineStatus(resources.DefaultNamespace, machineConfigGenOptions.Metadata().ID())
+			},
+			TransformFunc: func(_ context.Context, _ controller.Reader, _ *zap.Logger, machineStatus *omni.MachineStatus, options *omni.MachineConfigGenOptions) error {
+				GenInstallConfig(machineStatus, options)
+
+				return nil
+			},
+		},
+		qtransform.WithIgnoreTeardownUntil(), // keep the resource until everyone else is done with Machine
+	)
+}
+
+// GenInstallConfig creates a config patch with an automatically picked install disk.
+func GenInstallConfig(machineStatus *omni.MachineStatus, configPatch *omni.MachineConfigGenOptions) {
+	if machineStatus.TypedSpec().Value.Hardware == nil {
+		return
+	}
+
+	installDisk := omni.GetMachineStatusSystemDisk(machineStatus)
+
+	diskSize := ^uint64(0)
+
+	if installDisk == "" {
+		for _, disk := range machineStatus.TypedSpec().Value.Hardware.Blockdevices {
+			if disk.Size >= installDiskMinSize && disk.Size < diskSize {
+				installDisk = disk.LinuxName
+
+				diskSize = disk.Size
+			}
+		}
+	}
+
+	configPatch.TypedSpec().Value.InstallDisk = installDisk
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_labels_test.go b/internal/backend/runtime/omni/controllers/omni/machine_labels_test.go
new file mode 100644
index 000000000..2033e427d
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_labels_test.go
@@ -0,0 +1,73 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type MachineLabelsSuite struct {
+	OmniSuite
+}
+
+func (suite *MachineLabelsSuite) TestLabelsReconcile() {
+	require := suite.Require()
+
+	suite.ctx, suite.ctxCancel = context.WithTimeout(suite.ctx, time.Second*5)
+
+	suite.startRuntime()
+
+	require.NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineStatusController()))
+
+	machineStatus := omni.NewMachineStatus(
+		resources.DefaultNamespace, "machine",
+	)
+
+	require.NoError(suite.state.Create(suite.ctx, machineStatus))
+
+	labels := omni.NewMachineLabels(resources.DefaultNamespace, "machine")
+	labels.Metadata().Labels().Set("my-awesome-label", "value")
+
+	require.NoError(suite.state.Create(suite.ctx, labels))
+
+	assertResource(
+		&suite.OmniSuite,
+		machineStatus.Metadata(),
+		func(res *omni.MachineStatus, assertions *assert.Assertions) {
+			for _, label := range res.Metadata().Labels().Keys() {
+				actual, exists := res.Metadata().Labels().Get(label)
+				expected, _ := labels.Metadata().Labels().Get(label)
+
+				assertions.True(exists)
+				assertions.Equal(expected, actual)
+			}
+		})
+
+	rtestutils.Destroy[*omni.MachineLabels](suite.ctx, suite.T(), suite.state, []resource.ID{labels.Metadata().ID()})
+	assertNoResource(&suite.OmniSuite, labels)
+
+	assertResource(
+		&suite.OmniSuite,
+		machineStatus.Metadata(),
+		func(res *omni.MachineStatus, assertions *assert.Assertions) {
+			assertions.True(res.Metadata().Labels().Empty())
+		})
+}
+
+func TestMachineLabelsSuite(t *testing.T) {
+	suite.Run(t, new(MachineLabelsSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_set.go b/internal/backend/runtime/omni/controllers/omni/machine_set.go
new file mode 100644
index 000000000..1dcd37da0
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_set.go
@@ -0,0 +1,49 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller/generic/cleanup"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// MachineSetController manages MachineSet resource lifecycle.
+type MachineSetController = cleanup.Controller[*omni.MachineSet]
+
+// NewMachineSetController returns a new MachineSet controller.
+func NewMachineSetController() *MachineSetController {
+	return cleanup.NewController(
+		cleanup.Settings[*omni.MachineSet]{
+			Name: "MachineSetController",
+			Handler: cleanup.Combine(
+				cleanup.RemoveOutputs[*omni.MachineSetNode](func(machineSet *omni.MachineSet) state.ListOption {
+					return state.WithLabelQuery(resource.LabelEqual(omni.LabelMachineSet, machineSet.Metadata().ID()))
+				}),
+
+				withFinalizerCheck(cleanup.RemoveOutputs[*omni.ConfigPatch](func(machineSet *omni.MachineSet) state.ListOption {
+					clusterName, _ := machineSet.Metadata().Labels().Get(omni.LabelCluster)
+
+					return state.WithLabelQuery(
+						resource.LabelEqual(omni.LabelCluster, clusterName),
+						resource.LabelEqual(omni.LabelMachineSet, machineSet.Metadata().ID()),
+					)
+				}), func(machineSet *omni.MachineSet) error {
+					_, ok := machineSet.Metadata().Labels().Get(omni.LabelCluster)
+					if !ok {
+						return fmt.Errorf("machine set doesn't have %q label", omni.LabelCluster)
+					}
+
+					return nil
+				}),
+			),
+		},
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_set_destroy_status.go b/internal/backend/runtime/omni/controllers/omni/machine_set_destroy_status.go
new file mode 100644
index 000000000..baa1c4187
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_set_destroy_status.go
@@ -0,0 +1,130 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/gertd/go-pluralize"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// MachineSetDestroyStatusController manages MachineSet resource lifecycle.
+type MachineSetDestroyStatusController struct{}
+
+// Name implements controller.Controller interface.
+func (ctrl *MachineSetDestroyStatusController) Name() string {
+	return "MachineSetDestroyStatusController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *MachineSetDestroyStatusController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Type:      omni.MachineSetType,
+			Kind:      controller.InputDestroyReady,
+			Namespace: resources.DefaultNamespace,
+		},
+		{
+			Type:      omni.ClusterMachineStatusType,
+			Kind:      controller.InputWeak,
+			Namespace: resources.DefaultNamespace,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *MachineSetDestroyStatusController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.MachineSetDestroyStatusType,
+			Kind: controller.OutputExclusive,
+		},
+		{
+			Type: omni.MachineSetType,
+			Kind: controller.OutputShared,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+//
+//nolint:dupl
+func (ctrl *MachineSetDestroyStatusController) Run(ctx context.Context, r controller.Runtime, _ *zap.Logger) error {
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+		}
+
+		tracker := trackResource(r, resources.EphemeralNamespace, omni.MachineSetDestroyStatusType)
+
+		machineSets, err := safe.ReaderListAll[*omni.MachineSet](ctx, r)
+		if err != nil {
+			return fmt.Errorf("error listing Machine Set resources: %w", err)
+		}
+
+		for iter := machineSets.Iterator(); iter.Next(); {
+			machineSet := iter.Value()
+
+			if machineSet.Metadata().Phase() != resource.PhaseTearingDown {
+				continue
+			}
+
+			tracker.keep(machineSet)
+
+			if err = ctrl.collectDestroyStatus(ctx, machineSet, r); err != nil {
+				return err
+			}
+
+			if machineSet.Metadata().Finalizers().Empty() {
+				if err = r.Destroy(ctx, machineSet.Metadata(), controller.WithOwner("")); err != nil {
+					if state.IsNotFoundError(err) {
+						continue
+					}
+
+					return fmt.Errorf("failed to destroy cluster: %w", err)
+				}
+			}
+		}
+
+		if err = tracker.cleanup(ctx); err != nil {
+			return err
+		}
+	}
+}
+
+func (ctrl *MachineSetDestroyStatusController) collectDestroyStatus(ctx context.Context, machineSet *omni.MachineSet, r controller.Runtime) error {
+	var err error
+
+	machines, err := r.List(ctx, omni.NewClusterMachineStatus(resources.DefaultNamespace, machineSet.Metadata().ID()).Metadata(),
+		state.WithLabelQuery(resource.LabelEqual(
+			omni.LabelMachineSet, machineSet.Metadata().ID()),
+		),
+	)
+	if err != nil {
+		return err
+	}
+
+	remainingMachines := len(machines.Items)
+
+	return safe.WriterModify(ctx, r, omni.NewMachineSetDestroyStatus(resources.EphemeralNamespace, machineSet.Metadata().ID()), func(status *omni.MachineSetDestroyStatus) error {
+		status.TypedSpec().Value.Phase = fmt.Sprintf("Destroying: %s",
+			pluralize.NewClient().Pluralize("machine", remainingMachines, true),
+		)
+
+		return nil
+	})
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_set_etcd_audit.go b/internal/backend/runtime/omni/controllers/omni/machine_set_etcd_audit.go
new file mode 100644
index 000000000..81c73f612
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_set_etcd_audit.go
@@ -0,0 +1,571 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"maps"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/blang/semver"
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	xmaps "github.com/siderolabs/gen/maps"
+	"github.com/siderolabs/gen/optional"
+	"github.com/siderolabs/gen/xerrors"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+	"github.com/siderolabs/talos/pkg/machinery/constants"
+	"github.com/siderolabs/talos/pkg/machinery/resources/etcd"
+	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/mappers"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+)
+
+// MachineSetEtcdAuditController runs etcd audit for control plane machine sets.
+// It tracks and removes the orphaned etcd members.
+type MachineSetEtcdAuditController = qtransform.QController[*omni.MachineSet, *omni.EtcdAuditResult]
+
+// NewMachineSetEtcdAuditController initializes MachineSetEtcdAuditController.
+//
+// memberRemoveTimeout defines the interval between two checks: member is removed if two consequent checks mark it as orphaned.
+func NewMachineSetEtcdAuditController(talosClientFactory *talos.ClientFactory, memberRemoveTimeout time.Duration) *MachineSetEtcdAuditController {
+	var (
+		requeueAfterDuration = memberRemoveTimeout + time.Second
+		auditor              = etcdAuditor{
+			talosClientFactory:       talosClientFactory,
+			memberRemoveTimeout:      memberRemoveTimeout,
+			requeueAfterDuration:     requeueAfterDuration,
+			clusterToOrphanedMembers: map[string]map[uint64]time.Time{},
+		}
+	)
+
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.MachineSet, *omni.EtcdAuditResult]{
+			Name: "MachineSetEtcdAuditController",
+			MapMetadataOptionalFunc: func(machineSet *omni.MachineSet) optional.Optional[*omni.EtcdAuditResult] {
+				cluster, ok := machineSet.Metadata().Labels().Get(omni.LabelCluster)
+				if !ok {
+					return optional.None[*omni.EtcdAuditResult]()
+				}
+
+				if _, isCP := machineSet.Metadata().Labels().Get(omni.LabelControlPlaneRole); !isCP {
+					return optional.None[*omni.EtcdAuditResult]()
+				}
+
+				return optional.Some(omni.NewEtcdAuditResult(resources.DefaultNamespace, cluster))
+			},
+			UnmapMetadataFunc: func(etcdAuditResult *omni.EtcdAuditResult) *omni.MachineSet {
+				return omni.NewMachineSet(resources.DefaultNamespace, omni.ControlPlanesResourceID(etcdAuditResult.Metadata().ID()))
+			},
+			TransformFunc: func(ctx context.Context, r controller.Reader, logger *zap.Logger, machineSet *omni.MachineSet, etcdAuditResult *omni.EtcdAuditResult) error {
+				logger.Debug("etcd audit: running for machine set", zap.String("machine_set", machineSet.Metadata().ID()))
+
+				cluster, ok := machineSet.Metadata().Labels().Get(omni.LabelCluster)
+				if !ok {
+					return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("machine set %q has no cluster label", machineSet.Metadata().ID())
+				}
+
+				logger = logger.With(zap.String("cluster", cluster))
+
+				clusterStatus, err := safe.ReaderGet[*omni.ClusterStatus](ctx, r, omni.NewClusterStatus(resources.DefaultNamespace, cluster).Metadata())
+				if err != nil {
+					if state.IsNotFoundError(err) {
+						return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("no ClusterStatus found for cluster %q: %w", cluster, err)
+					}
+
+					return fmt.Errorf("error getting cluster status for cluster %q: %w", cluster, err)
+				}
+
+				if !clusterStatus.TypedSpec().Value.HasConnectedControlPlanes {
+					return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("machine set %q has no connected control planes", machineSet.Metadata().ID())
+				}
+
+				talosCli, err := auditor.getClient(ctx, r, cluster)
+				if err != nil {
+					return err
+				}
+
+				orphanMemberSet, err := auditor.auditEtcd(ctx, r, talosCli, cluster, machineSet, logger)
+				if err != nil {
+					return err
+				}
+
+				// update the orphan member set with the found orphans
+				membersToRemove := auditor.updateOrphanMembers(cluster, orphanMemberSet, logger)
+
+				// there are no orphans, no need to requeue
+				if len(orphanMemberSet) == 0 {
+					return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("no orphaned etcd members")
+				}
+
+				// there are orphans, but none of them are ready to be removed yet, requeue
+				if len(membersToRemove) == 0 {
+					// return an error here instead of a simple Requeue request, so that the etcdAuditResult stays unchanged
+					return controller.NewRequeueErrorf(requeueAfterDuration, "no orphaned etcd members ready to be removed, requeue")
+				}
+
+				removedMembers := make([]uint64, 0, len(membersToRemove))
+
+				for _, member := range membersToRemove {
+					if err = auditor.removeMember(ctx, talosCli, cluster, member); err != nil {
+						logger.Error("etcd audit: failed to remove orphan", zap.Error(err), zap.String("id", etcd.FormatMemberID(member)))
+
+						continue
+					}
+
+					logger.Info("etcd audit: removed orphan", zap.String("id", etcd.FormatMemberID(member)))
+
+					removedMembers = append(removedMembers, member)
+				}
+
+				if len(removedMembers) == 0 {
+					// no members were removed in this run - skip updating the etcdAuditResult and requeue with an error
+					return controller.NewRequeueErrorf(requeueAfterDuration, "failed to remove any of the orphaned etcd members")
+				}
+
+				// there was at least one removed member
+
+				slices.Sort(removedMembers)
+
+				etcdAuditResult.TypedSpec().Value.EtcdMemberIds = removedMembers
+
+				if len(removedMembers) < len(membersToRemove) {
+					// not all members were removed - requeue the audit without an explicit error, so that etcdAuditResult will still be updated with the last removed members
+					return controller.NewRequeueInterval(requeueAfterDuration)
+				}
+
+				// all orphans were removed successfully
+				return nil
+			},
+		},
+		qtransform.WithExtraMappedInput(
+			// Map the cluster ID to the control planes machine set resource ID:
+			// Example: my-cluster -> my-cluster-control-planes
+			func(_ context.Context, _ *zap.Logger, _ controller.QRuntime, cs *omni.ClusterStatus) ([]resource.Pointer, error) {
+				id := omni.ControlPlanesResourceID(cs.Metadata().ID())
+
+				return []resource.Pointer{omni.NewMachineSet(cs.Metadata().Namespace(), id).Metadata()}, nil
+			},
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByMachineSetLabel[*omni.MachineSetNode, *omni.MachineSet](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByMachineSetLabel[*omni.ClusterMachineStatus, *omni.MachineSet](),
+		),
+		qtransform.WithExtraMappedDestroyReadyInput(
+			mappers.MapByMachineSetLabel[*omni.ClusterMachine, *omni.MachineSet](),
+		),
+		qtransform.WithExtraMappedInput(
+			// Map the cluster ID to the control planes machine set resource ID:
+			// Example: my-cluster -> my-cluster-control-planes
+			func(_ context.Context, _ *zap.Logger, _ controller.QRuntime, tc *omni.TalosConfig) ([]resource.Pointer, error) {
+				id := omni.ControlPlanesResourceID(tc.Metadata().ID())
+
+				return []resource.Pointer{omni.NewMachineSet(tc.Metadata().Namespace(), id).Metadata()}, nil
+			},
+		),
+		qtransform.WithConcurrency(4),
+	)
+}
+
+// etcdAuditor provides various functionality to audit etcd members.
+type etcdAuditor struct {
+	talosClientFactory *talos.ClientFactory
+
+	clusterToOrphanedMembers     map[string]map[uint64]time.Time
+	clusterToOrphanedMembersLock sync.Mutex
+
+	memberRemoveTimeout  time.Duration
+	requeueAfterDuration time.Duration
+}
+
+func (auditor *etcdAuditor) updateOrphanMembers(cluster string, currentOrphanedMembers map[uint64]struct{}, logger *zap.Logger) (membersToRemove []uint64) {
+	auditor.clusterToOrphanedMembersLock.Lock()
+	defer auditor.clusterToOrphanedMembersLock.Unlock()
+
+	// log the previous orphans that are no longer orphans after the check is done
+	noMoreOrphansSet := xslices.ToSetFunc(xmaps.Keys(auditor.clusterToOrphanedMembers[cluster]), etcd.FormatMemberID)
+	defer func() {
+		// remove all orphans that are still orphans
+		for orphan := range auditor.clusterToOrphanedMembers[cluster] {
+			delete(noMoreOrphansSet, etcd.FormatMemberID(orphan))
+		}
+
+		if len(noMoreOrphansSet) > 0 {
+			noMoreOrphans := xmaps.Keys(noMoreOrphansSet)
+
+			slices.Sort(noMoreOrphans)
+
+			logger.Info("etcd audit: mark members as no longer orphaned", zap.Strings("members", noMoreOrphans))
+		}
+	}()
+
+	// no orphans at the current check, cluster is ok, remove it from the map
+	if len(currentOrphanedMembers) == 0 {
+		delete(auditor.clusterToOrphanedMembers, cluster)
+
+		return nil
+	}
+
+	// initialize the orphaned member set for the cluster if it does not exist
+	if _, ok := auditor.clusterToOrphanedMembers[cluster]; !ok {
+		auditor.clusterToOrphanedMembers[cluster] = map[uint64]time.Time{}
+	}
+
+	// remove the existing orphans which are not orphans anymore
+	for existingOrphanedMember := range auditor.clusterToOrphanedMembers[cluster] {
+		if _, ok := currentOrphanedMembers[existingOrphanedMember]; !ok {
+			delete(auditor.clusterToOrphanedMembers[cluster], existingOrphanedMember)
+		}
+	}
+
+	// add new orphans with orphanedAt timestamp of now
+	for orphanedMember := range currentOrphanedMembers {
+		if _, ok := auditor.clusterToOrphanedMembers[cluster][orphanedMember]; !ok {
+			auditor.clusterToOrphanedMembers[cluster][orphanedMember] = time.Now()
+		}
+	}
+
+	// filter the orphans which have stayed as orphans long enough, so they can be removed
+	membersToRemove = make([]uint64, 0, len(auditor.clusterToOrphanedMembers[cluster]))
+
+	for orphanedMember, orphanedAt := range auditor.clusterToOrphanedMembers[cluster] {
+		if time.Since(orphanedAt) >= auditor.memberRemoveTimeout {
+			membersToRemove = append(membersToRemove, orphanedMember)
+		}
+	}
+
+	return membersToRemove
+}
+
+// auditEtcd returns the set of orphaned members.
+func (auditor *etcdAuditor) auditEtcd(ctx context.Context, r controller.Reader, cli *talos.Client, cluster string, machineSet *omni.MachineSet, logger *zap.Logger) (map[uint64]struct{}, error) {
+	members := map[uint64]struct{}{}
+
+	listCtx, cancel := context.WithTimeout(ctx, time.Second*10)
+	defer cancel()
+
+	response, err := cli.EtcdMemberList(listCtx, &machine.EtcdMemberListRequest{})
+	if err != nil {
+		return nil, fmt.Errorf("error listing etcd members for cluster %q: %w", cluster, err)
+	}
+
+	for _, memberList := range response.Messages {
+		for _, member := range memberList.Members {
+			members[member.Id] = struct{}{}
+		}
+	}
+
+	list, err := safe.ReaderListAll[*omni.ClusterMachine](
+		ctx,
+		r,
+		state.WithLabelQuery(resource.LabelEqual(omni.LabelMachineSet, machineSet.Metadata().ID())),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("error listing cluster machines for cluster %q: %w", cluster, err)
+	}
+
+	// skip etcd audit if no cluster machines were found
+	if list.Len() == 0 {
+		return nil, nil //nolint:nilnil
+	}
+
+	if err = auditor.ensureSupportedVersion(ctx, cli, cluster); err != nil {
+		return nil, err
+	}
+
+	filteredMembers := maps.Clone(members)
+	machineIDToMemberID := make(map[string]string, list.Len())
+
+	for iter := list.Iterator(); iter.Next(); {
+		machineID := iter.Value().Metadata().ID()
+
+		memberID, err := auditor.auditMember(ctx, r, machineID, cluster)
+		if err != nil {
+			return nil, err
+		}
+
+		if memberID != 0 {
+			delete(filteredMembers, memberID)
+
+			machineIDToMemberID[machineID] = etcd.FormatMemberID(memberID)
+		} else {
+			machineIDToMemberID[machineID] = "(none)"
+		}
+	}
+
+	if len(filteredMembers) > 0 {
+		allMembers := xmaps.KeysFunc(members, etcd.FormatMemberID)
+		orphanedMembers := xmaps.KeysFunc(filteredMembers, etcd.FormatMemberID)
+
+		slices.Sort(allMembers)
+		slices.Sort(orphanedMembers)
+
+		logger.Info(
+			"etcd audit: found orphans",
+			zap.Strings("all_members", allMembers),
+			zap.Strings("orphaned_members", orphanedMembers),
+			zap.Any("machine_id_to_member_id", machineIDToMemberID),
+		)
+	}
+
+	return filteredMembers, nil
+}
+
+// auditMember audits the etcd member in the given machine. It returns the member ID if it is ok (not an orphan).
+func (auditor *etcdAuditor) auditMember(ctx context.Context, r controller.Reader, machine, clusterName string) (uint64, error) {
+	cli, err := auditor.getNodeClient(ctx, r, clusterName, machine)
+	if err != nil {
+		return 0, err
+	}
+
+	defer cli.Close() //nolint:errcheck
+
+	ctx, cancel := context.WithTimeout(ctx, time.Second*10)
+
+	defer cancel()
+
+	var (
+		hasEtcdDirectory bool
+		ephemeralMounted bool
+		etcdMember       *etcd.Member
+	)
+
+	if hasEtcdDirectory, err = auditor.checkEtcdDirectory(ctx, cli); err != nil {
+		return 0, err
+	}
+
+	if ephemeralMounted, err = auditor.checkEphemeralMount(ctx, cli); err != nil {
+		return 0, err
+	}
+
+	if etcdMember, err = auditor.getEtcdMember(ctx, cli); err != nil {
+		return 0, err
+	}
+
+	// skip audit for the member that doesn't have etcd running
+	if !hasEtcdDirectory && etcdMember == nil {
+		return 0, nil
+	}
+
+	if !ephemeralMounted {
+		requeueErr := fmt.Errorf("etcd audit skipped: machine %q from cluster %q doesn't have ephemeral partition mounted", machine, clusterName)
+
+		return 0, controller.NewRequeueError(requeueErr, auditor.requeueAfterDuration)
+	}
+
+	if hasEtcdDirectory && etcdMember == nil {
+		requeueErr := fmt.Errorf("etcd audit skipped: machine %q from cluster %q still joining the cluster", machine, clusterName)
+
+		return 0, controller.NewRequeueError(requeueErr, auditor.requeueAfterDuration)
+	}
+
+	id, err := etcd.ParseMemberID(etcdMember.TypedSpec().MemberID)
+	if err != nil {
+		return 0, fmt.Errorf("error parsing member ID: %w", err)
+	}
+
+	return id, nil
+}
+
+func (auditor *etcdAuditor) removeMember(ctx context.Context, cli *talos.Client, cluster string, memberID uint64) error {
+	ctx, cancel := context.WithTimeout(ctx, time.Second*10)
+	defer cancel()
+
+	if err := cli.EtcdRemoveMemberByID(ctx, &machine.EtcdRemoveMemberByIDRequest{
+		MemberId: memberID,
+	}); err != nil {
+		return err
+	}
+
+	auditor.clusterToOrphanedMembersLock.Lock()
+	defer auditor.clusterToOrphanedMembersLock.Unlock()
+
+	delete(auditor.clusterToOrphanedMembers[cluster], memberID)
+
+	if len(auditor.clusterToOrphanedMembers[cluster]) == 0 {
+		delete(auditor.clusterToOrphanedMembers, cluster)
+	}
+
+	return nil
+}
+
+func (auditor *etcdAuditor) getNodeClient(ctx context.Context, r controller.Reader, cluster, id string) (*client.Client, error) {
+	clusterMachineStatus, err := safe.ReaderGet[*omni.ClusterMachineStatus](ctx, r, omni.NewClusterMachineStatus(resources.DefaultNamespace, id).Metadata())
+	if err != nil {
+		return nil, err
+	}
+
+	talosConfig, err := safe.ReaderGet[*omni.TalosConfig](ctx, r, omni.NewTalosConfig(resources.DefaultNamespace, cluster).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, xerrors.NewTaggedf[qtransform.SkipReconcileTag]("talosconfig for cluster %q is not found: %w", cluster, err)
+		}
+
+		return nil, fmt.Errorf("cluster %q failed to get talosconfig: %w", cluster, err)
+	}
+
+	if clusterMachineStatus.TypedSpec().Value.ManagementAddress == "" {
+		return nil, xerrors.NewTaggedf[qtransform.SkipReconcileTag]("machine %q doesn't have management address", id)
+	}
+
+	endpoints := []string{clusterMachineStatus.TypedSpec().Value.ManagementAddress}
+
+	opts := talos.GetSocketOptions(clusterMachineStatus.TypedSpec().Value.ManagementAddress)
+
+	if opts == nil {
+		opts = append(opts, client.WithEndpoints(clusterMachineStatus.TypedSpec().Value.ManagementAddress))
+	}
+
+	opts = append(opts, client.WithConfig(omni.NewTalosClientConfig(talosConfig, endpoints...)))
+
+	result, err := client.New(ctx, opts...)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create client to machine %q: %w", id, err)
+	}
+
+	return result, nil
+}
+
+func (auditor *etcdAuditor) getClient(ctx context.Context, r controller.Reader, cluster string) (*talos.Client, error) {
+	c, err := auditor.talosClientFactory.Get(ctx, cluster)
+	if err != nil {
+		if talos.IsClientNotReadyError(err) {
+			return nil, xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+		}
+
+		return nil, fmt.Errorf("error getting talos client for cluster %q: %w", cluster, err)
+	}
+
+	connected, err := c.Connected(ctx, r)
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+		}
+
+		return nil, fmt.Errorf("error checking if client is connected: %w", err)
+	}
+
+	if !connected {
+		return nil, xerrors.NewTaggedf[qtransform.SkipReconcileTag]("the cluster is not available")
+	}
+
+	return c, nil
+}
+
+func (auditor *etcdAuditor) ensureSupportedVersion(ctx context.Context, c *talos.Client, clusterName string) error {
+	ctx, cancel := context.WithTimeout(ctx, time.Second*10)
+	defer cancel()
+
+	resp, err := c.Version(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to get versions, cluster %q: %w", clusterName, err)
+	}
+
+	for _, m := range resp.Messages {
+		v := strings.TrimLeft(m.Version.Tag, "v")
+
+		var version semver.Version
+
+		hostname := "*"
+
+		if m.Metadata != nil {
+			hostname = m.Metadata.Hostname
+		}
+
+		version, err = semver.Parse(v)
+		if err != nil {
+			return fmt.Errorf("failed to get versions, machine %q, cluster %q: %w", hostname, clusterName, err)
+		}
+
+		if !version.GE(semver.MustParse("1.3.0")) {
+			return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("etcd audit is not supported, machine %q, cluster %q: Talos version %s < 1.3.0", hostname, clusterName, v)
+		}
+	}
+
+	return nil
+}
+
+func (auditor *etcdAuditor) checkEtcdDirectory(ctx context.Context, client *client.Client) (bool, error) {
+	ctx, cancel := context.WithTimeout(ctx, time.Second*10)
+	defer cancel()
+
+	checkNotExists := func(err error) error {
+		if strings.Contains(err.Error(), "no such file or directory") {
+			return nil
+		}
+
+		return fmt.Errorf("error listing etcd directory: %w", err)
+	}
+
+	list, err := client.LS(ctx, &machine.ListRequest{Root: "/var/lib/etcd/member"})
+	if err != nil {
+		return false, checkNotExists(err)
+	}
+
+	info, err := list.Recv()
+	if err != nil {
+		if errors.Is(err, io.EOF) {
+			return false, nil
+		}
+
+		return false, checkNotExists(err)
+	}
+
+	if info.Metadata != nil && info.Metadata.Error != "" {
+		return false, fmt.Errorf("error checking etcd directory %q", info.Metadata.Error)
+	}
+
+	return true, nil
+}
+
+func (auditor *etcdAuditor) checkEphemeralMount(ctx context.Context, client *client.Client) (bool, error) {
+	ctx, cancel := context.WithTimeout(ctx, time.Second*10)
+	defer cancel()
+
+	_, err := safe.StateGet[*runtime.MountStatus](ctx, client.COSI, runtime.NewMountStatus(runtime.NamespaceName, constants.EphemeralPartitionLabel).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return false, nil
+		}
+
+		return false, fmt.Errorf("error checking ephemeral mount: %w", err)
+	}
+
+	return true, nil
+}
+
+func (auditor *etcdAuditor) getEtcdMember(ctx context.Context, client *client.Client) (*etcd.Member, error) {
+	ctx, cancel := context.WithTimeout(ctx, time.Second*10)
+	defer cancel()
+
+	member, err := safe.StateGet[*etcd.Member](ctx, client.COSI, etcd.NewMember(etcd.NamespaceName, etcd.LocalMemberID).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, nil //nolint:nilnil
+		}
+
+		return nil, fmt.Errorf("error getting etcd member: %w", err)
+	}
+
+	return member, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_set_etcd_audit_test.go b/internal/backend/runtime/omni/controllers/omni/machine_set_etcd_audit_test.go
new file mode 100644
index 000000000..8dcf35109
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_set_etcd_audit_test.go
@@ -0,0 +1,534 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	stdruntime "runtime"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/google/uuid"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/siderolabs/talos/pkg/machinery/resources/etcd"
+	talosruntime "github.com/siderolabs/talos/pkg/machinery/resources/runtime"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/pkg/check"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+)
+
+type MachineSetEtcdAuditSuite struct {
+	OmniSuite
+	clientFactory *talos.ClientFactory
+	resources     []resource.Resource
+}
+
+func (suite *MachineSetEtcdAuditSuite) createMachineSet(clusterName string, machineSetName string, machines []string) (map[string]*machineService, *omni.MachineSet) {
+	cluster := omni.NewCluster(resources.DefaultNamespace, clusterName)
+
+	services := map[string]*machineService{}
+
+	cluster.TypedSpec().Value.TalosVersion = "1.2.2"
+	cluster.TypedSpec().Value.KubernetesVersion = "1.25.0"
+
+	suite.createResource(cluster)
+
+	clusterStatus := omni.NewClusterStatus(resources.DefaultNamespace, clusterName)
+
+	clusterStatus.TypedSpec().Value.Available = true
+	clusterStatus.TypedSpec().Value.HasConnectedControlPlanes = true
+
+	suite.createResource(clusterStatus)
+
+	machineSet := omni.NewMachineSet(resources.DefaultNamespace, machineSetName)
+	machineSet.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+	machineSet.Metadata().Labels().Set(omni.LabelControlPlaneRole, "")
+
+	machineSet.TypedSpec().Value.UpdateStrategy = specs.MachineSetSpec_Rolling
+
+	config := omni.NewTalosConfig(resources.DefaultNamespace, clusterName)
+
+	suite.createResource(config)
+
+	for _, machine := range machines {
+		services[machine] = suite.createClusterMachineStatus(machine, clusterName, machineSet)
+
+		msn := omni.NewMachineSetNode(resources.DefaultNamespace, machine, machineSet)
+
+		suite.createResource(msn)
+	}
+
+	suite.createResource(machineSet)
+
+	return services, machineSet
+}
+
+func (suite *MachineSetEtcdAuditSuite) createClusterMachineStatus(machine, clusterName string, machineSet *omni.MachineSet) *machineService {
+	serverSuffix := uuid.NewString()
+
+	// If the OS is macOS, trim the random server suffix to avoid hitting the 108 char unix socket path limit
+	if stdruntime.GOOS == "darwin" {
+		serverSuffix = serverSuffix[:6]
+	}
+
+	service, err := suite.newServer(serverSuffix)
+
+	suite.Require().NoError(err)
+
+	clusterMachineStatus := omni.NewClusterMachineStatus(resources.DefaultNamespace, machine)
+	clusterMachineStatus.TypedSpec().Value.ManagementAddress = unixSocket + service.address
+
+	clusterMachineStatus.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+	clusterMachineStatus.Metadata().Labels().Set(omni.LabelControlPlaneRole, "")
+	clusterMachineStatus.Metadata().Labels().Set(omni.LabelMachineSet, machineSet.Metadata().ID())
+
+	suite.createResource(clusterMachineStatus)
+
+	return service
+}
+
+func (suite *MachineSetEtcdAuditSuite) SetupTest() {
+	suite.OmniSuite.SetupTest()
+
+	logger := zaptest.NewLogger(suite.T())
+
+	suite.clientFactory = talos.NewClientFactory(suite.state, logger)
+
+	if _, err := runtime.Get(talos.Name); err != nil {
+		runtime.Install(talos.Name, talos.New(suite.clientFactory, logger))
+	}
+
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterEndpointController()))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewMachineSetEtcdAuditController(
+		suite.clientFactory,
+		time.Millisecond*100,
+	)))
+}
+
+func (suite *MachineSetEtcdAuditSuite) TearDownTest() {
+	suite.cleanupResources()
+
+	suite.OmniSuite.TearDownTest()
+}
+
+func (suite *MachineSetEtcdAuditSuite) TestEtcdAudit() {
+	machines := []string{
+		"n1",
+		"n2",
+		"n3",
+	}
+
+	extraMembers := []*machine.EtcdMember{
+		{
+			Id:       1,
+			Hostname: "n1",
+		},
+		{
+			Id:       2,
+			Hostname: "n2",
+		},
+		{
+			Id:       3,
+			Hostname: "n3",
+		},
+		{
+			Id:       4,
+			Hostname: "n4",
+		},
+	}
+
+	//nolint:govet
+	for _, tt := range []struct {
+		setup   func(*omni.MachineSet)
+		name    string
+		members []*machine.EtcdMember
+		check   func(*machineService) error
+	}{
+		{
+			name:    "unchanged",
+			members: extraMembers,
+			check: func(machineService *machineService) error {
+				time.Sleep(time.Millisecond * 500)
+				machineService.lock.Lock()
+				defer machineService.lock.Unlock()
+
+				members := machineService.etcdMembers.Messages[0].Members
+
+				if len(members) != 4 {
+					return retry.ExpectedErrorf("expected to have 4 etcd members got %d", len(members))
+				}
+
+				return nil
+			},
+		},
+		{
+			name:    "cleanedUp",
+			members: extraMembers,
+			setup: func(ms *omni.MachineSet) {
+				for _, id := range machines {
+					cm := omni.NewClusterMachine(resources.DefaultNamespace, id)
+					cm.Metadata().Labels().Set(omni.LabelMachineSet, ms.Metadata().ID())
+					suite.createResource(cm)
+				}
+			},
+			check: func(machineService *machineService) error {
+				machineService.lock.Lock()
+				defer machineService.lock.Unlock()
+
+				members := machineService.etcdMembers.Messages[0].Members
+				if len(members) != 3 {
+					return retry.ExpectedErrorf("expected to have 3 etcd members got %d", len(members))
+				}
+
+				return nil
+			},
+		},
+	} {
+		if !suite.T().Run(tt.name, func(t *testing.T) {
+			suite.cleanupResources()
+
+			clusterName := "etcd_audit/" + tt.name
+
+			services, machineSet := suite.createMachineSet(clusterName, tt.name, machines)
+
+			primary := services[machines[0]]
+
+			primary.lock.Lock()
+			primary.etcdMembers = &machine.EtcdMemberListResponse{
+				Messages: []*machine.EtcdMembers{
+					{
+						Members: tt.members,
+					},
+				},
+			}
+			primary.lock.Unlock()
+
+			for i, m := range machines {
+				suite.Require().NoError(services[m].state.Create(suite.ctx, talosruntime.NewMountStatus(talosruntime.NamespaceName, "EPHEMERAL")))
+				member := etcd.NewMember(etcd.NamespaceName, etcd.LocalMemberID)
+				member.TypedSpec().MemberID = etcd.FormatMemberID(uint64(i + 1))
+
+				suite.Require().NoError(services[m].state.Create(suite.ctx, member))
+			}
+
+			if tt.setup != nil {
+				tt.setup(machineSet)
+			}
+
+			assert.NoError(t, retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(func() error {
+				return tt.check(primary)
+			}))
+		}) {
+			break
+		}
+	}
+}
+
+//nolint:maintidx
+func (suite *MachineSetEtcdAuditSuite) TestEtcdStatus() {
+	var (
+		services   map[string]*machineService
+		machineSet *omni.MachineSet
+	)
+
+	members := map[string]uint64{
+		"n1": 1,
+		"n2": 2,
+		"n3": 3,
+		"n4": 4,
+	}
+
+	allMembers := []*machine.EtcdMember{
+		{
+			Id:       members["n1"],
+			Hostname: "n1",
+		},
+		{
+			Id:       members["n2"],
+			Hostname: "n2",
+		},
+		{
+			Id:       members["n3"],
+			Hostname: "n3",
+		},
+	}
+
+	extraEtcdMembers := []*machine.EtcdMember{
+		{
+			Id:       members["n1"],
+			Hostname: "n1",
+		},
+		{
+			Id:       members["n2"],
+			Hostname: "n2",
+		},
+		{
+			Id:       members["n3"],
+			Hostname: "n3",
+		},
+		{
+			Id:       members["n4"],
+			Hostname: "n4",
+		},
+	}
+
+	machines := []string{
+		"n1",
+		"n2",
+		"n3",
+	}
+
+	initIdentities := func(items ...string) {
+		for _, m := range items {
+			identity := omni.NewClusterMachineIdentity(resources.DefaultNamespace, m)
+			identity.TypedSpec().Value.EtcdMemberId = members[m]
+
+			suite.createResource(identity)
+		}
+	}
+
+	setConnected := func(items ...string) {
+		for _, m := range items {
+			status := omni.NewClusterMachineStatus(resources.DefaultNamespace, m)
+
+			_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, status.Metadata(), func(res *omni.ClusterMachineStatus) error {
+				res.Metadata().Labels().Set(omni.MachineStatusLabelConnected, "")
+
+				return nil
+			})
+
+			suite.Require().NoError(err)
+		}
+	}
+
+	setServiceListResponse := func(response *machine.ServiceListResponse, items ...string) {
+		for _, m := range items {
+			svc, ok := services[m]
+			suite.Require().Truef(ok, "the machine %q is not set up in the tests", m)
+
+			svc.setServiceList(response)
+		}
+	}
+
+	etcdRunning := &machine.ServiceListResponse{
+		Messages: []*machine.ServiceList{
+			{
+				Services: []*machine.ServiceInfo{
+					{
+						Id: "etcd",
+						Health: &machine.ServiceHealth{
+							Healthy: true,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	etcdDown := &machine.ServiceListResponse{
+		Messages: []*machine.ServiceList{
+			{
+				Services: []*machine.ServiceInfo{
+					{
+						Id: "etcd",
+						Health: &machine.ServiceHealth{
+							Healthy: false,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	//nolint:govet
+	for _, tt := range []struct {
+		setup   func(string)
+		name    string
+		members []*machine.EtcdMember
+		check   func(*testing.T, *check.EtcdStatusResult, error)
+	}{
+		{
+			name:    "identity not found",
+			members: allMembers,
+			check: func(t *testing.T, _ *check.EtcdStatusResult, err error) {
+				require.Error(t, err)
+			},
+		},
+		{
+			name:    "healthy",
+			members: allMembers,
+			setup: func(string) {
+				initIdentities(machines...)
+				setConnected(machines...)
+				setServiceListResponse(etcdRunning, machines...)
+			},
+			check: func(t *testing.T, esr *check.EtcdStatusResult, err error) {
+				require.NoError(t, err)
+
+				require.Equal(t, 3, esr.HealthyMembers, "unhealthy, %#v", esr.Members)
+			},
+		},
+		{
+			name:    "2 of 3 reachable, etcd down",
+			members: allMembers,
+			setup: func(string) {
+				initIdentities(machines...)
+				setConnected(machines...)
+				setServiceListResponse(etcdRunning, machines[:2]...)
+				setServiceListResponse(etcdDown, machines[2])
+			},
+			check: func(t *testing.T, esr *check.EtcdStatusResult, err error) {
+				require.NoError(t, err)
+
+				require.Equal(t, 2, esr.HealthyMembers, "unhealthy, %#v", esr.Members)
+				require.False(t, esr.Members[etcd.FormatMemberID(3)].Healthy, "the machine %q was expected to be unhealthy", machines[2])
+			},
+		},
+		{
+			name:    "2 of 4 reachable, identity not ready for a machine",
+			members: allMembers,
+			setup: func(clusterName string) {
+				initIdentities(machines...)
+				setConnected(machines...)
+				setServiceListResponse(etcdRunning, machines[:2]...)
+				setServiceListResponse(etcdDown, machines[2])
+
+				suite.createClusterMachineStatus("n4", clusterName, machineSet)
+			},
+			check: func(t *testing.T, esr *check.EtcdStatusResult, err error) {
+				require.NoError(t, err)
+
+				require.Equal(t, 2, esr.HealthyMembers, "unhealthy, %#v", esr.Members)
+				require.False(t, esr.Members[etcd.FormatMemberID(3)].Healthy, "the machine %q was expected to be unhealthy", machines[2])
+
+				require.Len(t, esr.Members, 3)
+			},
+		},
+		{
+			name:    "3 of 4 reachable, non-member is not connected",
+			members: allMembers,
+			setup: func(clusterName string) {
+				initIdentities(machines...)
+				setConnected(machines...)
+				setServiceListResponse(etcdRunning, machines...)
+
+				suite.createClusterMachineStatus("n4", clusterName, machineSet)
+			},
+			check: func(t *testing.T, esr *check.EtcdStatusResult, err error) {
+				require.NoError(t, err)
+
+				require.Equal(t, 3, esr.HealthyMembers, "unhealthy, %#v", esr.Members)
+				require.Len(t, esr.Members, 3)
+			},
+		},
+		{
+			name:    "4 of 4 reachable, but splitbrain",
+			members: allMembers,
+			setup: func(clusterName string) {
+				initIdentities(machines...)
+				setConnected(machines...)
+				setServiceListResponse(etcdRunning, machines...)
+
+				services["n4"] = suite.createClusterMachineStatus("n4", clusterName, machineSet)
+				setConnected("n4")
+				initIdentities("n4")
+				setServiceListResponse(etcdRunning, "n4")
+			},
+			check: func(t *testing.T, esr *check.EtcdStatusResult, err error) {
+				require.NoError(t, err)
+
+				require.Equal(t, 3, esr.HealthyMembers, "unhealthy, %#v", esr.Members)
+				require.Len(t, esr.Members, 3)
+			},
+		},
+		{
+			name:    "extra etcd member",
+			members: extraEtcdMembers,
+			setup: func(string) {
+				initIdentities(machines...)
+				setConnected(machines...)
+				setServiceListResponse(etcdRunning, machines...)
+			},
+			check: func(t *testing.T, _ *check.EtcdStatusResult, err error) {
+				require.Error(t, err)
+			},
+		},
+	} {
+		if !suite.T().Run(tt.name, func(t *testing.T) {
+			suite.cleanupResources()
+
+			clusterName := "etcd_status/" + tt.name
+
+			services, machineSet = suite.createMachineSet(clusterName, tt.name, machines)
+
+			primary := services[machines[0]]
+
+			primary.lock.Lock()
+			primary.etcdMembers = &machine.EtcdMemberListResponse{
+				Messages: []*machine.EtcdMembers{
+					{
+						Members: tt.members,
+					},
+				},
+			}
+			primary.lock.Unlock()
+
+			for i, m := range machines {
+				member := etcd.NewMember(etcd.NamespaceName, etcd.LocalMemberID)
+				member.TypedSpec().MemberID = etcd.FormatMemberID(uint64(i + 1))
+
+				require.NoError(t, services[m].state.Create(suite.ctx, member))
+			}
+
+			if tt.setup != nil {
+				tt.setup(clusterName)
+			}
+
+			status, err := check.EtcdStatus(suite.ctx, suite.state, machineSet)
+			tt.check(t, status, err)
+		}) {
+			break
+		}
+	}
+}
+
+func (suite *MachineSetEtcdAuditSuite) createResource(res resource.Resource) {
+	suite.Require().NoError(suite.state.Create(suite.ctx, res))
+
+	suite.resources = append(suite.resources, res)
+}
+
+func (suite *MachineSetEtcdAuditSuite) cleanupResources() {
+	for _, r := range suite.resources {
+		_, err := suite.state.Teardown(suite.ctx, r.Metadata())
+		suite.Require().NoError(err)
+
+		_, err = suite.state.WatchFor(suite.ctx, r.Metadata(), state.WithFinalizerEmpty())
+		suite.Require().NoError(err)
+
+		suite.Require().NoError(suite.state.Destroy(suite.ctx, r.Metadata()))
+	}
+
+	suite.resources = nil
+}
+
+func TestMachineSetEtcdAuditSuite(t *testing.T) {
+	suite.Run(t, new(MachineSetEtcdAuditSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_set_node.go b/internal/backend/runtime/omni/controllers/omni/machine_set_node.go
new file mode 100644
index 000000000..07f4785df
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_set_node.go
@@ -0,0 +1,303 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+	"math"
+	"slices"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/cosi/labels"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// MachineSetNodeController manages MachineSetNode resource lifecycle.
+//
+// MachineSetNodeController creates and deletes cluster machines, handles rolling updates.
+type MachineSetNodeController struct{}
+
+// Name implements controller.Controller interface.
+func (ctrl *MachineSetNodeController) Name() string {
+	return "MachineSetNodeController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *MachineSetNodeController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.MachineSetType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.MachineType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.MachineStatusType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.MachineClassType,
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *MachineSetNodeController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.MachineSetNodeType,
+			Kind: controller.OutputShared,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *MachineSetNodeController) Run(ctx context.Context, r controller.Runtime, logger *zap.Logger) error {
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+		}
+
+		list, err := safe.ReaderListAll[*omni.MachineSet](ctx, r)
+		if err != nil {
+			return fmt.Errorf("error listing machine sets: %w", err)
+		}
+
+		allMachineSetNodes, err := safe.ReaderListAll[*omni.MachineSetNode](ctx, r)
+		if err != nil {
+			return err
+		}
+
+		allMachines, err := safe.ReaderListAll[*omni.Machine](ctx, r)
+		if err != nil {
+			return err
+		}
+
+		machineMap := map[resource.ID]*omni.Machine{}
+
+		allMachines.ForEach(func(machine *omni.Machine) {
+			machineMap[machine.Metadata().ID()] = machine
+		})
+
+		allMachineStatuses, err := safe.ReaderListAll[*omni.MachineStatus](ctx, r)
+		if err != nil {
+			return err
+		}
+
+		machineStatusMap := map[resource.ID]*omni.MachineStatus{}
+
+		allMachineStatuses.ForEach(func(ms *omni.MachineStatus) {
+			if m, ok := machineMap[ms.Metadata().ID()]; !ok || m.Metadata().Phase() == resource.PhaseTearingDown {
+				return
+			}
+
+			machineStatusMap[ms.Metadata().ID()] = ms
+		})
+
+		visited := map[resource.ID]struct{}{}
+
+		err = list.ForEachErr(func(machineSet *omni.MachineSet) error {
+			return ctrl.reconcileMachineSet(ctx, r, machineSet, allMachineStatuses, allMachineSetNodes, machineStatusMap, visited, logger)
+		})
+		if err != nil {
+			return err
+		}
+
+		err = allMachineSetNodes.ForEachErr(func(machineSetNode *omni.MachineSetNode) error {
+			if machineSetNode.Metadata().Owner() != ctrl.Name() {
+				return nil
+			}
+
+			machineSet, ok := machineSetNode.Metadata().Labels().Get(omni.LabelMachineSet)
+			if !ok {
+				return nil
+			}
+
+			machine, machineExists := machineMap[machineSetNode.Metadata().ID()]
+
+			if _, ok = visited[machineSet]; ok && machineExists && machine.Metadata().Phase() != resource.PhaseTearingDown {
+				return nil
+			}
+
+			return r.Destroy(ctx, machineSetNode.Metadata())
+		})
+		if err != nil {
+			return err
+		}
+	}
+}
+
+func (ctrl *MachineSetNodeController) reconcileMachineSet(
+	ctx context.Context,
+	r controller.Runtime,
+	machineSet *omni.MachineSet,
+	allMachineStatuses safe.List[*omni.MachineStatus],
+	allMachineSetNodes safe.List[*omni.MachineSetNode],
+	machineStatusMap map[resource.ID]*omni.MachineStatus,
+	visited map[resource.ID]struct{},
+	logger *zap.Logger,
+) error {
+	var err error
+
+	spec := machineSet.TypedSpec()
+	if spec.Value.MachineClass == nil || machineSet.Metadata().Phase() == resource.PhaseTearingDown {
+		return nil
+	}
+
+	visited[machineSet.Metadata().ID()] = struct{}{}
+
+	machineClassCfg := spec.Value.MachineClass
+
+	var machineClass *omni.MachineClass
+
+	machineClass, err = safe.ReaderGet[*omni.MachineClass](ctx, r, omni.NewMachineClass(resources.DefaultNamespace, machineClassCfg.Name).Metadata())
+	if err != nil {
+		return err
+	}
+
+	existingMachineSetNodes := allMachineSetNodes.FilterLabelQuery(resource.LabelEqual(omni.LabelMachineSet, machineSet.Metadata().ID()))
+
+	switch machineClassCfg.AllocationType {
+	case specs.MachineSetSpec_MachineClass_Unlimited:
+		return ctrl.createNodes(ctx, r, machineSet, machineClass, allMachineStatuses, math.MaxInt32)
+	case specs.MachineSetSpec_MachineClass_Static:
+		diff := int(machineClassCfg.MachineCount) - existingMachineSetNodes.Len()
+
+		if diff == 0 {
+			return nil
+		}
+
+		if diff < 0 {
+			logger.Info("scaling machine set down", zap.Int("pending", -diff), zap.String("machine_set", machineSet.Metadata().ID()))
+
+			return ctrl.deleteNodes(ctx, r, existingMachineSetNodes, machineStatusMap, -diff)
+		}
+
+		logger.Info("scaling machine set up", zap.Int("pending", diff), zap.String("machine_set", machineSet.Metadata().ID()))
+
+		return ctrl.createNodes(ctx, r, machineSet, machineClass, allMachineStatuses, diff)
+	}
+
+	return nil
+}
+
+func (ctrl *MachineSetNodeController) createNodes(
+	ctx context.Context,
+	r controller.Runtime,
+	machineSet *omni.MachineSet,
+	machineClass *omni.MachineClass,
+	allMachineStatuses safe.List[*omni.MachineStatus],
+	count int,
+) error {
+	selectors, err := labels.ParseSelectors(machineClass.TypedSpec().Value.MatchLabels)
+	if err != nil {
+		return err
+	}
+
+	created := 0
+
+	for _, selector := range selectors {
+		selector.Terms = append(selector.Terms, resource.LabelTerm{
+			Key: omni.MachineStatusLabelAvailable,
+			Op:  resource.LabelOpExists,
+		})
+
+		availableMachineClassMachines := allMachineStatuses.FilterLabelQuery(resource.RawLabelQuery(selector))
+
+		for i := 0; i < availableMachineClassMachines.Len(); i++ {
+			id := availableMachineClassMachines.Get(i).Metadata().ID()
+
+			if err := r.Create(ctx, omni.NewMachineSetNode(resources.DefaultNamespace, id, machineSet)); err != nil {
+				if state.IsConflictError(err) {
+					continue
+				}
+
+				return err
+			}
+
+			created++
+			if created == count {
+				return nil
+			}
+		}
+	}
+
+	return nil
+}
+
+func (ctrl *MachineSetNodeController) deleteNodes(
+	ctx context.Context,
+	r controller.Runtime,
+	machineSetNodes safe.List[*omni.MachineSetNode],
+	machineStatuses map[string]*omni.MachineStatus,
+	count int,
+) error {
+	usedMachineSetNodes, err := safe.Map(machineSetNodes, func(m *omni.MachineSetNode) (*omni.MachineSetNode, error) {
+		return m, nil
+	})
+	if err != nil {
+		return err
+	}
+
+	slices.SortStableFunc(usedMachineSetNodes, getSortFunction(machineStatuses))
+
+	for i := 0; i < count; i++ {
+		if i >= len(usedMachineSetNodes) {
+			return nil
+		}
+
+		if err := r.Destroy(ctx, usedMachineSetNodes[i].Metadata()); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func getSortFunction(machineStatuses map[resource.ID]*omni.MachineStatus) func(a, b *omni.MachineSetNode) int {
+	return func(a, b *omni.MachineSetNode) int {
+		ms1, ok1 := machineStatuses[a.Metadata().ID()]
+		ms2, ok2 := machineStatuses[b.Metadata().ID()]
+
+		if !ok1 && ok2 {
+			return -1
+		}
+
+		if ok1 && !ok2 {
+			return 1
+		}
+
+		_, disconnected1 := ms1.Metadata().Labels().Get(omni.MachineStatusLabelDisconnected)
+		_, disconnected2 := ms2.Metadata().Labels().Get(omni.MachineStatusLabelDisconnected)
+
+		if disconnected1 && !disconnected2 {
+			return -1
+		}
+
+		if !disconnected1 && disconnected2 {
+			return 1
+		}
+
+		return a.Metadata().Created().Compare(b.Metadata().Created())
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_set_node_test.go b/internal/backend/runtime/omni/controllers/omni/machine_set_node_test.go
new file mode 100644
index 000000000..f39268cf6
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_set_node_test.go
@@ -0,0 +1,216 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"fmt"
+	"slices"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/kvutils"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type MachineSetNodeSuite struct {
+	OmniSuite
+	machinesOffset int
+}
+
+func newMachineClass(selectors ...string) *omni.MachineClass {
+	id := uuid.New().String()
+
+	cls := omni.NewMachineClass(resources.DefaultNamespace, id)
+	cls.TypedSpec().Value.MatchLabels = selectors
+
+	return cls
+}
+
+func (suite *MachineSetNodeSuite) createMachines(labels ...map[string]string) []*omni.MachineStatus {
+	res := make([]*omni.MachineStatus, 0, len(labels))
+
+	for i, l := range labels {
+		id := fmt.Sprintf("machine%d", suite.machinesOffset+i)
+
+		machine := omni.NewMachine(resources.DefaultNamespace, id)
+
+		machineStatus := omni.NewMachineStatus(resources.DefaultNamespace, id)
+
+		machineStatus.Metadata().Labels().Do(func(temp kvutils.TempKV) {
+			for k, v := range l {
+				temp.Set(k, v)
+			}
+		})
+
+		res = append(res, machineStatus)
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, machineStatus))
+		suite.Require().NoError(suite.state.Create(suite.ctx, machine))
+	}
+
+	suite.machinesOffset += len(res)
+
+	return res
+}
+
+func (suite *MachineSetNodeSuite) TestReconcile() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(&omnictrl.MachineSetNodeController{}))
+
+	machines := suite.createMachines(
+		map[string]string{
+			omni.MachineStatusLabelArch:      "amd64",
+			omni.MachineStatusLabelAvailable: "",
+		},
+		map[string]string{
+			omni.MachineStatusLabelAvailable: "",
+		},
+		map[string]string{},
+		map[string]string{
+			omni.MachineStatusLabelCPU:       "AMD",
+			omni.MachineStatusLabelAvailable: "",
+		},
+	)
+
+	machineSet := omni.NewMachineSet(resources.DefaultNamespace, "auto")
+
+	assertMachineSetNode := func(machine *omni.MachineStatus) {
+		assertResource[*omni.MachineSetNode](
+			&suite.OmniSuite,
+			omni.NewMachineSetNode(
+				resources.DefaultNamespace,
+				machine.Metadata().ID(),
+				machineSet).Metadata(),
+			func(*omni.MachineSetNode, *assert.Assertions) {},
+		)
+	}
+
+	assertNoMachineSetNode := func(machine *omni.MachineStatus) {
+		assertNoResource[*omni.MachineSetNode](
+			&suite.OmniSuite,
+			omni.NewMachineSetNode(
+				resources.DefaultNamespace,
+				machine.Metadata().ID(),
+				machineSet),
+		)
+	}
+
+	machineSet.Metadata().Labels().Set(omni.LabelCluster, "cluster1")
+	machineSet.Metadata().Labels().Set(omni.LabelWorkerRole, "")
+
+	machineClass := newMachineClass(fmt.Sprintf("%s==amd64", omni.MachineStatusLabelArch))
+
+	machineSet.TypedSpec().Value.MachineClass = &specs.MachineSetSpec_MachineClass{
+		Name:         machineClass.Metadata().ID(),
+		MachineCount: 5,
+	}
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, machineClass))
+	suite.Require().NoError(suite.state.Create(suite.ctx, machineSet))
+
+	assertMachineSetNode(machines[0])
+
+	machineClass = newMachineClass(fmt.Sprintf("%s==AMD", omni.MachineStatusLabelCPU))
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, machineClass))
+
+	machineSet.TypedSpec().Value.MachineClass.Name = machineClass.Metadata().ID()
+
+	suite.Require().NoError(suite.state.Update(suite.ctx, machineSet))
+
+	// no changes after updating machine set machine class
+	assertNoMachineSetNode(machines[3])
+	assertMachineSetNode(machines[0])
+
+	machineSet.TypedSpec().Value.MachineClass.MachineCount = 0
+
+	suite.Require().NoError(suite.state.Update(suite.ctx, machineSet))
+
+	// scale down to 0 should remove machine set node
+	assertNoMachineSetNode(machines[0])
+
+	machineSet.TypedSpec().Value.MachineClass.MachineCount = 3
+
+	suite.Require().NoError(suite.state.Update(suite.ctx, machineSet))
+
+	// scale back up to 3 after changing the machine class
+	// should create a machine set node for the 3rd machine
+	assertMachineSetNode(machines[3])
+	assertNoMachineSetNode(machines[0])
+
+	// add more machines and wait for the controller to scale up
+	machines = append(machines, suite.createMachines(
+		map[string]string{
+			omni.MachineStatusLabelCPU:       "AMD",
+			omni.MachineStatusLabelAvailable: "",
+		},
+		map[string]string{
+			omni.MachineStatusLabelCPU: "AMD",
+		},
+		map[string]string{
+			omni.MachineStatusLabelCPU:       "AMD",
+			omni.MachineStatusLabelAvailable: "",
+		},
+	)...)
+
+	assertMachineSetNode(machines[4])
+	assertMachineSetNode(machines[6])
+	assertNoMachineSetNode(machines[5])
+
+	suite.Require().NoError(suite.state.Destroy(suite.ctx, omni.NewMachine(resources.DefaultNamespace, machines[4].Metadata().ID()).Metadata()))
+
+	assertNoMachineSetNode(machines[4])
+}
+
+func TestSortFunction(t *testing.T) {
+	machineStatuses := map[resource.ID]*omni.MachineStatus{}
+	machineSetNodes := make([]*omni.MachineSetNode, 0, 10)
+
+	for i := 0; i < 10; i++ {
+		id := strconv.Itoa(i)
+
+		machineStatuses[id] = omni.NewMachineStatus(resources.DefaultNamespace, id)
+
+		machineSetNode := omni.NewMachineSetNode(resources.DefaultNamespace, id, omni.NewMachineSet(resources.DefaultNamespace, "ms"))
+		machineSetNode.Metadata().SetCreated(time.Now())
+
+		machineSetNodes = append(machineSetNodes, machineSetNode)
+	}
+
+	slices.SortStableFunc(machineSetNodes, omnictrl.GetMachineSetNodeSortFunction(machineStatuses))
+
+	require := require.New(t)
+
+	for i := 0; i < len(machineSetNodes)-1; i++ {
+		require.Equal(-1, machineSetNodes[i].Metadata().Created().Compare(machineSetNodes[i+1].Metadata().Created()))
+	}
+
+	machineStatuses["9"].Metadata().Labels().Set(omni.MachineStatusLabelDisconnected, "")
+
+	slices.SortStableFunc(machineSetNodes, omnictrl.GetMachineSetNodeSortFunction(machineStatuses))
+
+	machineStatuses["2"].Metadata().Labels().Set(omni.MachineStatusLabelDisconnected, "")
+
+	slices.SortStableFunc(machineSetNodes, omnictrl.GetMachineSetNodeSortFunction(machineStatuses))
+
+	require.Equal("2", machineSetNodes[0].Metadata().ID())
+	require.Equal("9", machineSetNodes[1].Metadata().ID())
+}
+
+func TestMachineSetNodeSuite(t *testing.T) {
+	suite.Run(t, new(MachineSetNodeSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_set_status.go b/internal/backend/runtime/omni/controllers/omni/machine_set_status.go
new file mode 100644
index 000000000..f16227f02
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_set_status.go
@@ -0,0 +1,1174 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/tls"
+	"encoding/hex"
+	"fmt"
+	"net"
+	"net/url"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/hashicorp/go-multierror"
+	serverpb "github.com/siderolabs/discovery-api/api/v1alpha1/server/pb"
+	"github.com/siderolabs/gen/pair"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/talos/pkg/machinery/constants"
+	"go.uber.org/zap"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime/kubernetes"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/configpatch"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/pkg/check"
+)
+
+type machineWithPatches = pair.Pair[*omni.ClusterMachine, *omni.ClusterMachineConfigPatches]
+
+// MachineSetStatusController manages MachineSetStatus resource lifecycle.
+//
+// MachineSetStatusController creates and deletes cluster machines, handles rolling updates.
+type MachineSetStatusController struct {
+	discoveryClient serverpb.ClusterClient
+}
+
+// Name implements controller.Controller interface.
+func (ctrl *MachineSetStatusController) Name() string {
+	return "MachineSetStatusController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *MachineSetStatusController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.MachineSetType,
+			Kind:      controller.InputStrong,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.MachineSetNodeType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterMachineStatusType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterMachineType,
+			Kind:      controller.InputDestroyReady,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ControlPlaneStatusType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ConfigPatchType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterMachineConfigStatusType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterSecretsType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterMachineIdentityType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.LoadBalancerStatusType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.MachineType,
+			Kind:      controller.InputStrong,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.TalosConfigType,
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *MachineSetStatusController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.MachineSetStatusType,
+			Kind: controller.OutputExclusive,
+		},
+		{
+			Type: omni.ClusterMachineType,
+			Kind: controller.OutputShared,
+		},
+		{
+			Type: omni.ClusterMachineConfigPatchesType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+//
+//nolint:gocognit,gocyclo,cyclop
+func (ctrl *MachineSetStatusController) Run(ctx context.Context, r controller.Runtime, logger *zap.Logger) error {
+	conn, err := ctrl.createDiscoveryClient(ctx)
+	if err != nil {
+		return fmt.Errorf("error creating discovery client: %w", err)
+	}
+
+	defer func() {
+		if err = conn.Close(); err != nil {
+			logger.Error("error closing discovery client connection", zap.Error(err))
+		}
+	}()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+		}
+
+		list, err := safe.ReaderListAll[*omni.MachineSet](ctx, r)
+		if err != nil {
+			return fmt.Errorf("error listing machine sets: %w", err)
+		}
+
+		allClusterMachines, err := safe.ReaderListAll[*omni.ClusterMachine](ctx, r)
+		if err != nil {
+			return fmt.Errorf("error listing all cluster machines: %w", err)
+		}
+
+		configPatchHelper, err := configpatch.NewHelper(ctx, r)
+		if err != nil {
+			return fmt.Errorf("error creating config patch helper: %w", err)
+		}
+
+		tracker := trackResource(r, resources.DefaultNamespace, omni.MachineSetStatusType)
+
+		var multiErr error
+
+		for iter := list.Iterator(); iter.Next(); {
+			// process a single machine set capturing the error
+			if err = func(iter safe.ListIterator[*omni.MachineSet], logger *zap.Logger) error {
+				machineSet := iter.Value()
+				machineSetStatus := omni.NewMachineSetStatus(resources.DefaultNamespace, machineSet.Metadata().ID())
+
+				tracker.keep(machineSet)
+
+				if machineSet.Metadata().Phase() != resource.PhaseTearingDown {
+					if err = r.AddFinalizer(ctx, machineSet.Metadata(), ctrl.Name()); err != nil {
+						return fmt.Errorf("error adding finalizer to machine set %q: %w", machineSet.Metadata().ID(), err)
+					}
+				}
+
+				clusterName, ok := machineSet.Metadata().Labels().Get(omni.LabelCluster)
+				if ok {
+					logger = logger.With(zap.String("cluster", clusterName))
+				}
+
+				logger = logger.With(zap.String("machineset", machineSet.Metadata().ID()))
+
+				setErr := safe.WriterModify(ctx, r, machineSetStatus, func(status *omni.MachineSetStatus) error {
+					CopyLabels(machineSet, machineSetStatus, omni.LabelCluster, omni.LabelControlPlaneRole, omni.LabelWorkerRole)
+
+					if machineSet.Metadata().Phase() == resource.PhaseTearingDown {
+						status.TypedSpec().Value.Phase = specs.MachineSetPhase_Destroying
+						status.TypedSpec().Value.Ready = false
+						status.TypedSpec().Value.Machines = &specs.Machines{
+							Total:   0,
+							Healthy: 0,
+						}
+
+						machineErr := ctrl.destroyMachinesNoWait(ctx, r, logger, machineSet, allClusterMachines)
+						if machineErr != nil {
+							return fmt.Errorf(
+								"error destroying machines (no wait), phase %q, ready %t: %w",
+								status.TypedSpec().Value.GetPhase(),
+								status.TypedSpec().Value.GetReady(),
+								err,
+							)
+						}
+
+						return nil
+					}
+
+					var machines safe.List[*omni.MachineSetNode]
+
+					machines, err = safe.ReaderListAll[*omni.MachineSetNode](
+						ctx,
+						r,
+						state.WithLabelQuery(resource.LabelEqual(omni.LabelMachineSet, machineSet.Metadata().ID())),
+					)
+					if err != nil {
+						return fmt.Errorf(
+							"error listing machine set nodes, phase %q, ready %t: %w",
+							status.TypedSpec().Value.GetPhase(),
+							status.TypedSpec().Value.GetReady(),
+							err,
+						)
+					}
+
+					if err = ctrl.reconcileMachines(ctx, r, logger, machines, machineSet, status, allClusterMachines, configPatchHelper); err != nil {
+						return fmt.Errorf(
+							"error reconciling machines, phase %q, ready %t: %w",
+							status.TypedSpec().Value.GetPhase(),
+							status.TypedSpec().Value.GetReady(),
+							err,
+						)
+					}
+
+					return nil
+				})
+				if setErr != nil {
+					return fmt.Errorf("error modifying machine set %q: %w", machineSet.Metadata().ID(), err)
+				}
+
+				return nil
+			}(iter, logger); err != nil {
+				multiErr = multierror.Append(multiErr, fmt.Errorf("reconcile of machine set %q failed: %w", iter.Value().Metadata().ID(), err))
+			}
+		}
+
+		if multiErr != nil {
+			return multiErr
+		}
+
+		if err = tracker.cleanup(ctx); err != nil {
+			return err
+		}
+
+		r.ResetRestartBackoff()
+	}
+}
+
+//nolint:gocognit,gocyclo,cyclop
+func (ctrl *MachineSetStatusController) updateStatus(
+	ctx context.Context,
+	r controller.Runtime,
+	machineSetNodes safe.List[*omni.MachineSetNode],
+	clusterMachines map[resource.ID]*omni.ClusterMachine,
+	machineSet *omni.MachineSet,
+	machineSetStatus *omni.MachineSetStatus,
+) error {
+	spec := machineSetStatus.TypedSpec().Value
+
+	list, err := safe.ReaderListAll[*omni.ClusterMachineStatus](
+		ctx,
+		r,
+		state.WithLabelQuery(resource.LabelEqual(omni.LabelMachineSet, machineSet.Metadata().ID())),
+	)
+	if err != nil {
+		return fmt.Errorf("error listing cluster machines: %w", err)
+	}
+
+	spec.Phase = specs.MachineSetPhase_Running
+	spec.Error = ""
+	spec.Machines = &specs.Machines{}
+
+	spec.Machines.Requested = uint32(machineSetNodes.Len())
+
+	// requested machines is max(manuallyAllocatedMachines, machineClassMachineCount)
+	// if machine class allocation type is not static it falls back to the actual machineSetNodes count
+	// then we first compare number of machine set nodes against the number of requested machines
+	// if they match we compare the number of cluster machines against the number of machine set nodes
+	machineClass := machineSet.TypedSpec().Value.MachineClass
+	if machineClass != nil && machineClass.AllocationType == specs.MachineSetSpec_MachineClass_Static {
+		spec.Machines.Requested = machineClass.MachineCount
+	}
+
+	spec.MachineClass = machineClass
+
+	switch {
+	case machineSetNodes.Len() < int(spec.Machines.Requested):
+		spec.Phase = specs.MachineSetPhase_ScalingUp
+	case machineSetNodes.Len() > int(spec.Machines.Requested):
+		spec.Phase = specs.MachineSetPhase_ScalingDown
+	case list.Len() < machineSetNodes.Len():
+		spec.Phase = specs.MachineSetPhase_ScalingUp
+	case len(clusterMachines) > machineSetNodes.Len():
+		spec.Phase = specs.MachineSetPhase_ScalingDown
+	}
+
+	if isControlPlane(machineSet) && machineSetNodes.Len() == 0 {
+		spec.Phase = specs.MachineSetPhase_Failed
+		spec.Error = "control plane machine set must have at least one node"
+	}
+
+	clusterMachineStatuses := map[resource.ID]*omni.ClusterMachineStatus{}
+
+	for iter := list.Iterator(); iter.Next(); {
+		clusterMachineStatus := iter.Value()
+
+		clusterMachineStatuses[clusterMachineStatus.Metadata().ID()] = clusterMachineStatus
+
+		if spec.Phase == specs.MachineSetPhase_Running {
+			if clusterMachineStatus.TypedSpec().Value.GetConfigApplyStatus() == specs.ConfigApplyStatus_PENDING {
+				spec.Phase = specs.MachineSetPhase_Reconfiguring
+			}
+		}
+	}
+
+	for _, clusterMachine := range clusterMachines {
+		spec.Machines.Total++
+
+		if clusterMachineStatus := clusterMachineStatuses[clusterMachine.Metadata().ID()]; clusterMachineStatus != nil {
+			if clusterMachineStatus.TypedSpec().Value.Stage == specs.ClusterMachineStatusSpec_RUNNING && clusterMachineStatus.TypedSpec().Value.Ready {
+				spec.Machines.Healthy++
+			}
+
+			if _, ok := clusterMachineStatus.Metadata().Labels().Get(omni.MachineStatusLabelConnected); ok {
+				spec.Machines.Connected++
+			}
+		}
+	}
+
+	spec.Ready = spec.Phase == specs.MachineSetPhase_Running
+
+	if !spec.Ready {
+		return nil
+	}
+
+	configHashHasher := sha256.New()
+
+	for iter := machineSetNodes.Iterator(); iter.Next(); {
+		machineSetNode := iter.Value()
+
+		clusterMachine := clusterMachines[machineSetNode.Metadata().ID()]
+		clusterMachineStatus := clusterMachineStatuses[machineSetNode.Metadata().ID()]
+
+		if clusterMachine == nil || clusterMachineStatus == nil {
+			spec.Ready = false
+			spec.Phase = specs.MachineSetPhase_ScalingUp
+
+			return nil
+		}
+
+		clusterMachineStatusSpec := clusterMachineStatus.TypedSpec().Value
+
+		if clusterMachineStatusSpec.Stage != specs.ClusterMachineStatusSpec_RUNNING {
+			spec.Ready = false
+
+			return nil
+		}
+
+		if !clusterMachineStatusSpec.Ready {
+			spec.Ready = false
+
+			return nil
+		}
+
+		configStatus, err := safe.ReaderGet[*omni.ClusterMachineConfigStatus](
+			ctx,
+			r,
+			omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, machineSetNode.Metadata().ID()).Metadata(),
+		)
+		if err != nil && !state.IsNotFoundError(err) {
+			return fmt.Errorf(
+				"error getting cluster machine config status for node %q: %w",
+				machineSetNode.Metadata().ID(),
+				err,
+			)
+		}
+
+		if configStatus != nil {
+			configHashHasher.Write([]byte(configStatus.TypedSpec().Value.ClusterMachineConfigSha256))
+		}
+
+		if configStatus == nil || isOutdated(clusterMachine, configStatus) {
+			spec.Ready = false
+
+			return nil
+		}
+	}
+
+	// combined hash of all cluster machine config hashes
+	spec.ConfigHash = hex.EncodeToString(configHashHasher.Sum(nil))
+
+	return nil
+}
+
+func (ctrl *MachineSetStatusController) reconcileMachines(
+	ctx context.Context,
+	r controller.Runtime,
+	logger *zap.Logger,
+	expectedNodes safe.List[*omni.MachineSetNode],
+	machineSet *omni.MachineSet,
+	machineSetStatus *omni.MachineSetStatus,
+	allClusterMachines safe.List[*omni.ClusterMachine],
+	configPatchHelper *configpatch.Helper,
+) error {
+	clusterMachines := allClusterMachines.FilterLabelQuery(resource.LabelEqual(omni.LabelMachineSet, machineSet.Metadata().ID()))
+
+	expectedNodesMap := map[resource.ID]*omni.MachineSetNode{}
+
+	expectedNodes.ForEach(func(node *omni.MachineSetNode) { expectedNodesMap[node.Metadata().ID()] = node })
+
+	clusterName, ok := machineSet.Metadata().Labels().Get(omni.LabelCluster)
+	if !ok {
+		return fmt.Errorf("failed to determine machine set %q cluster", machineSet.Metadata().ID())
+	}
+
+	cluster, err := safe.ReaderGet[*omni.Cluster](
+		ctx,
+		r,
+		omni.NewCluster(resources.DefaultNamespace, clusterName).Metadata(),
+	)
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			logger.Info("cluster doesn't exist: skip machines reconcile call")
+
+			return nil
+		}
+
+		return fmt.Errorf("failed to get cluster spec %q: %w", clusterName, err)
+	}
+
+	var tearingDownMachines []*omni.ClusterMachine
+
+	currentClusterMachines := map[resource.ID]*omni.ClusterMachine{}
+
+	clusterMachines.ForEach(func(clusterMachine *omni.ClusterMachine) {
+		currentClusterMachines[clusterMachine.Metadata().ID()] = clusterMachine
+
+		if clusterMachine.Metadata().Phase() == resource.PhaseTearingDown {
+			tearingDownMachines = append(tearingDownMachines, clusterMachine)
+		}
+	})
+
+	if err = ctrl.updateStatus(ctx, r, expectedNodes, currentClusterMachines, machineSet, machineSetStatus); err != nil {
+		return fmt.Errorf("failed to update machine set status: %w", err)
+	}
+
+	createMachines, err := ctrl.getMachinesToCreate(cluster, machineSet, currentClusterMachines, expectedNodes, configPatchHelper)
+	if err != nil {
+		return fmt.Errorf("failed to get machines to create: %w", err)
+	}
+
+	if len(createMachines) != 0 {
+		err = ctrl.updateMachines(ctx, r, logger, createMachines, true)
+		if err != nil {
+			return fmt.Errorf("failed to create machines: %w", err)
+		}
+
+		return nil
+	}
+
+	loadbalancerInfo, err := safe.ReaderGet[*omni.LoadBalancerStatus](
+		ctx,
+		r,
+		omni.NewLoadBalancerStatus(resources.DefaultNamespace, clusterName).Metadata(),
+	)
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			logger.Info("load balancer status is unknown: skip machines update/destroy")
+
+			return nil
+		}
+
+		return fmt.Errorf("failed to get load balancer status: %w", err)
+	}
+
+	// skip the rest if found any machine which is being torn down
+	if len(tearingDownMachines) > 0 {
+		err = ctrl.destroyMachines(ctx, r, logger, machineSet, tearingDownMachines)
+		if err != nil {
+			return fmt.Errorf("failed to destroy machines: %w", err)
+		}
+
+		return nil
+	}
+
+	updateMachines, err := ctrl.getMachinesToUpdate(ctx, r, cluster, machineSet, currentClusterMachines, expectedNodes, configPatchHelper)
+	if err != nil {
+		return fmt.Errorf("failed to get machines to update: %w", err)
+	}
+
+	if len(updateMachines) > 0 {
+		err = ctrl.updateMachines(ctx, r, logger, updateMachines, false)
+		if err != nil {
+			return fmt.Errorf("failed to update machines: %w", err)
+		}
+
+		return nil
+	}
+
+	// skip the rest if Kubernetes is not up
+	if !loadbalancerInfo.TypedSpec().Value.Healthy {
+		logger.Info("loadbalancer is not healthy: skip destroy flow")
+
+		return nil
+	}
+
+	destroyMachines, err := ctrl.getMachinesToDestroy(ctx, r, machineSet, clusterMachines, expectedNodesMap)
+	if err != nil {
+		return fmt.Errorf("failed to get machines to destroy: %w", err)
+	}
+
+	if len(destroyMachines) == 0 {
+		return nil
+	}
+
+	err = ctrl.destroyMachines(ctx, r, logger, machineSet, destroyMachines)
+	if err != nil {
+		return fmt.Errorf("failed to destroy machines: %w", err)
+	}
+
+	return nil
+}
+
+func (ctrl *MachineSetStatusController) getMachinesToCreate(
+	cluster *omni.Cluster,
+	machineSet *omni.MachineSet,
+	currentClusterMachines map[resource.ID]*omni.ClusterMachine,
+	expectedMachines safe.List[*omni.MachineSetNode],
+	configPatchHelper *configpatch.Helper,
+) ([]machineWithPatches, error) {
+	var clusterMachines []machineWithPatches
+
+	for iter := expectedMachines.Iterator(); iter.Next(); {
+		machineSetNode := iter.Value()
+
+		if _, ok := currentClusterMachines[machineSetNode.Metadata().ID()]; !ok {
+			clusterMachine := omni.NewClusterMachine(resources.DefaultNamespace, machineSetNode.Metadata().ID())
+			clusterMachineConfigPatches := omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, machineSetNode.Metadata().ID())
+
+			item := pair.MakePair(clusterMachine, clusterMachineConfigPatches)
+
+			CopyLabels(machineSet, clusterMachineConfigPatches, omni.LabelCluster, omni.LabelWorkerRole, omni.LabelControlPlaneRole)
+			CopyLabels(machineSet, clusterMachine, omni.LabelCluster, omni.LabelWorkerRole, omni.LabelControlPlaneRole)
+
+			clusterMachine.Metadata().Labels().Set(omni.LabelMachineSet, machineSet.Metadata().ID())
+			clusterMachineConfigPatches.Metadata().Labels().Set(omni.LabelMachineSet, machineSet.Metadata().ID())
+
+			_, err := ctrl.updateClusterMachine(cluster, item, machineSet, configPatchHelper)
+			if err != nil {
+				return nil, fmt.Errorf("failed to update cluster machine: %w", err)
+			}
+
+			clusterMachines = append(clusterMachines, item)
+		}
+	}
+
+	return clusterMachines, nil
+}
+
+//nolint:gocognit
+func (ctrl *MachineSetStatusController) getMachinesToUpdate(
+	ctx context.Context,
+	r controller.Runtime,
+	cluster *omni.Cluster,
+	machineSet *omni.MachineSet,
+	currentClusterMachines map[resource.ID]*omni.ClusterMachine,
+	expectedMachines safe.List[*omni.MachineSetNode],
+	configPatchHelper *configpatch.Helper,
+) ([]machineWithPatches, error) {
+	var outdatedMachines int
+
+	configStatuses := map[resource.ID]*omni.ClusterMachineConfigStatus{}
+
+	if err := expectedMachines.ForEachErr(func(machineSetNode *omni.MachineSetNode) error {
+		configStatus, err := safe.ReaderGet[*omni.ClusterMachineConfigStatus](
+			ctx,
+			r,
+			omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, machineSetNode.Metadata().ID()).Metadata(),
+		)
+		if err != nil {
+			outdatedMachines++
+
+			if state.IsNotFoundError(err) {
+				return nil
+			}
+
+			return fmt.Errorf(
+				"failed to get cluster machine node %q config status: %w",
+				machineSetNode.Metadata().ID(),
+				err,
+			)
+		}
+
+		configStatuses[configStatus.Metadata().ID()] = configStatus
+
+		clusterMachine := currentClusterMachines[configStatus.Metadata().ID()]
+
+		if isOutdated(clusterMachine, configStatus) {
+			outdatedMachines++
+		}
+
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+
+	maxParallelism := 0
+	if machineSet.TypedSpec().Value.GetUpdateStrategy() == specs.MachineSetSpec_Rolling {
+		maxParallelism = max(1, int(machineSet.TypedSpec().Value.GetUpdateStrategyConfig().GetRolling().GetMaxParallelism()))
+	}
+
+	if isControlPlane(machineSet) {
+		maxParallelism = 1
+	}
+
+	var items []machineWithPatches
+
+	for iter := expectedMachines.Iterator(); iter.Next(); {
+		machineSetNode := iter.Value()
+
+		// machine is locked, skip the machine
+		if _, locked := machineSetNode.Metadata().Annotations().Get(omni.MachineLocked); locked {
+			continue
+		}
+
+		clusterMachine, ok := currentClusterMachines[machineSetNode.Metadata().ID()]
+		if !ok {
+			continue
+		}
+
+		configStatus, ok := configStatuses[clusterMachine.Metadata().ID()]
+
+		// is the latest machine config applied to the machine?
+		outdated := !ok || isOutdated(clusterMachine, configStatus)
+
+		item := pair.MakePair(clusterMachine, omni.NewClusterMachineConfigPatches(clusterMachine.Metadata().Namespace(), clusterMachine.Metadata().ID()))
+
+		// are there any outstanding config patches to be applied?
+		updated, err := ctrl.updateClusterMachine(cluster, item, machineSet, configPatchHelper)
+		if err != nil {
+			return nil, fmt.Errorf("failed to update cluster machine: %w", err)
+		}
+
+		// machine config patches are up-to-date, skip the machine
+		if !updated {
+			continue
+		}
+
+		// the current machine needs to be updated
+		switch machineSet.TypedSpec().Value.UpdateStrategy {
+		case specs.MachineSetSpec_Rolling:
+			// return if we have reached the max parallelism for rolling strategy
+			if len(items) >= maxParallelism {
+				return items, nil
+			}
+
+			// normal mode - there are no outdated machines, so simply add the current machine to the list, as it has a pending update
+			if outdatedMachines == 0 {
+				items = append(items, item)
+
+				continue
+			}
+
+			// prioritization mode - there are outdated machines:
+			// add the current machine (which has a pending update) to the list only if it is one of the outdated ones
+			// this handles the case of a "broken" config patch which never applies
+			if outdated {
+				items = append(items, item)
+			}
+		case specs.MachineSetSpec_Unset:
+			items = append(items, item)
+		}
+	}
+
+	return items, nil
+}
+
+func (ctrl *MachineSetStatusController) getMachinesToDestroy(
+	ctx context.Context,
+	r controller.Runtime,
+	machineSet *omni.MachineSet,
+	currentClusterMachines safe.List[*omni.ClusterMachine],
+	expectedMachines map[resource.ID]*omni.MachineSetNode,
+) ([]*omni.ClusterMachine, error) {
+	var clusterMachines []*omni.ClusterMachine
+
+	machineSetSpec := machineSet.TypedSpec().Value
+	maxParallelism := 0
+	rolling := false
+
+	// if the machine set has a rolling update strategy, use it
+	if machineSetSpec.GetUpdateStrategy() == specs.MachineSetSpec_Rolling {
+		rolling = true
+		maxParallelism = max(1, int(machineSetSpec.GetDeleteStrategyConfig().GetRolling().GetMaxParallelism())) // if the max parallelism is not set (is zero), use 1
+	}
+
+	// if this is a control plane machine set, override the strategy to always use rolling strategy with max parallelism of 1
+	if isControlPlane(machineSet) {
+		rolling = true
+		maxParallelism = 1
+	}
+
+	for iter := currentClusterMachines.Iterator(); iter.Next(); {
+		clusterMachine := iter.Value()
+
+		if rolling && len(clusterMachines) >= maxParallelism {
+			break
+		}
+
+		if _, ok := expectedMachines[clusterMachine.Metadata().ID()]; !ok {
+			clusterMachines = append(clusterMachines, clusterMachine)
+		}
+	}
+
+	if len(clusterMachines) == 0 {
+		return clusterMachines, nil
+	}
+
+	if isControlPlane(machineSet) {
+		// block removing all machines for control plane machine set
+		if len(clusterMachines) == currentClusterMachines.Len() {
+			return nil, nil
+		}
+
+		status, err := check.EtcdStatus(ctx, r, machineSet)
+		if err != nil {
+			return nil, err
+		}
+
+		if err = check.CanScaleDown(status, clusterMachines[0]); err != nil {
+			return nil, err
+		}
+	}
+
+	return clusterMachines, nil
+}
+
+func (ctrl *MachineSetStatusController) updateMachines(
+	ctx context.Context,
+	r controller.Runtime,
+	logger *zap.Logger,
+	machinesWithPatches []machineWithPatches,
+	created bool,
+) error {
+	action := "update"
+	if created {
+		action = "create"
+	}
+
+	logger.Info(fmt.Sprintf("%s machines", action), zap.Strings("machines", xslices.Map(machinesWithPatches, func(m machineWithPatches) string { return m.F1.Metadata().ID() })))
+
+	for _, pair := range machinesWithPatches {
+		clusterMachine := pair.F1
+
+		clusterName, ok := clusterMachine.Metadata().Labels().Get(omni.LabelCluster)
+		if !ok {
+			return fmt.Errorf("cluster machine update doesn't have %s label", omni.LabelCluster)
+		}
+
+		if err := safe.WriterModify(ctx, r, omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, clusterMachine.Metadata().ID()),
+			func(res *omni.ClusterMachineConfigPatches) error {
+				// update the value
+				res.TypedSpec().Value.Patches = pair.F2.TypedSpec().Value.Patches
+
+				return nil
+			},
+		); err != nil {
+			return err
+		}
+
+		if err := safe.WriterModify(ctx, r, clusterMachine, func(res *omni.ClusterMachine) error {
+			// don't update the ClusterMachine if it's still owned by another cluster
+			currentClusterName, ok := res.Metadata().Labels().Get(omni.LabelCluster)
+			if ok && currentClusterName != clusterName {
+				return nil
+			}
+
+			// update the labels
+			CopyAllLabels(clusterMachine, res)
+
+			// update the annotations to make sure that inputResourceVersion gets updated
+			CopyAllAnnotations(clusterMachine, res)
+
+			if res.TypedSpec().Value.KubernetesVersion == "" {
+				res.TypedSpec().Value.KubernetesVersion = clusterMachine.TypedSpec().Value.KubernetesVersion
+			}
+
+			return nil
+		}); err != nil {
+			return fmt.Errorf("error updating cluster machine %q: %w", clusterMachine.Metadata().ID(), err)
+		}
+
+		// hold the Machine via the finalizer
+		if err := r.AddFinalizer(
+			ctx,
+			omni.NewMachine(resources.DefaultNamespace, clusterMachine.Metadata().ID()).Metadata(),
+			ctrl.Name(),
+		); err != nil {
+			return fmt.Errorf(
+				"error adding finalizer to machine %q in cluster %q: %w",
+				clusterMachine.Metadata().ID(),
+				clusterName,
+				err,
+			)
+		}
+
+		if created {
+			logger.Info("added the machine to the machine set",
+				zap.String("machine", clusterMachine.Metadata().ID()),
+			)
+		}
+	}
+
+	return nil
+}
+
+func (ctrl *MachineSetStatusController) destroyMachines(ctx context.Context, r controller.Runtime, logger *zap.Logger, machineSet *omni.MachineSet, clusterMachines []*omni.ClusterMachine) error {
+	var err error
+
+	logger.Info("destroy machines", zap.Strings("machines", xslices.Map(clusterMachines, func(m *omni.ClusterMachine) string { return m.Metadata().ID() })))
+
+	clusterName, ok := machineSet.Metadata().Labels().Get(omni.LabelCluster)
+	if !ok {
+		return fmt.Errorf("failed to determine cluster name of the machine set %s", machineSet.Metadata().ID())
+	}
+
+	secrets, err := safe.ReaderGet[*omni.ClusterSecrets](ctx, r, omni.NewClusterSecrets(
+		resources.DefaultNamespace,
+		clusterName,
+	).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil
+		}
+
+		return fmt.Errorf("failed to get cluster %q secrets: %w", clusterName, err)
+	}
+
+	bundle, err := omni.ToSecretsBundle(secrets)
+	if err != nil {
+		return fmt.Errorf("failed to convert cluster %q secrets to bundle: %w", clusterName, err)
+	}
+
+	nodeNameOccurences, clusterMachineIdentities, err := ctrl.getClusterMachineIdentities(ctx, r, clusterName)
+	if err != nil {
+		return err
+	}
+
+	for _, clusterMachine := range clusterMachines {
+		var (
+			ready bool
+			err   error
+		)
+
+		clusterMachineIdentity := clusterMachineIdentities[clusterMachine.Metadata().ID()]
+
+		if ready, err = r.Teardown(ctx, clusterMachine.Metadata()); err != nil {
+			return fmt.Errorf(
+				"error tearing down machine %q in cluster %q: %w",
+				clusterMachine.Metadata().ID(),
+				clusterName,
+				err,
+			)
+		}
+
+		if !ready {
+			continue
+		}
+
+		if _, ok := machineSet.Metadata().Labels().Get(omni.LabelSkipTeardown); !ok && clusterMachineIdentity != nil && nodeNameOccurences[clusterMachineIdentity.TypedSpec().Value.Nodename] == 1 {
+			if err = ctrl.teardownNode(ctx, clusterMachine, clusterMachineIdentity); err != nil {
+				return fmt.Errorf("error tearing down node %q: %w", clusterMachineIdentity.TypedSpec().Value.Nodename, err)
+			}
+		}
+
+		if _, ok := machineSet.Metadata().Labels().Get(omni.LabelSkipTeardown); !ok && clusterMachineIdentity != nil {
+			if err = ctrl.deleteMember(ctx, r, bundle.Cluster.ID, clusterMachine); err != nil {
+				return fmt.Errorf(
+					"error deleting member %q: %w",
+					clusterMachineIdentity.TypedSpec().Value.Nodename,
+					err,
+				)
+			}
+		}
+
+		// release the Machine finalizer
+		if err = r.RemoveFinalizer(
+			ctx,
+			omni.NewMachine(resources.DefaultNamespace, clusterMachine.Metadata().ID()).Metadata(),
+			ctrl.Name(),
+		); err != nil {
+			return fmt.Errorf(
+				"error removing finalizer from machine %q: %w",
+				clusterMachine.Metadata().ID(),
+				err,
+			)
+		}
+
+		if err = ctrl.destroyMachine(ctx, r, clusterMachine); err != nil {
+			return fmt.Errorf("error destroying machine %q: %w", clusterMachine.Metadata().ID(), err)
+		}
+
+		logger.Info("removed the machine from the machine set gracefully",
+			zap.String("machine", clusterMachine.Metadata().ID()),
+		)
+	}
+
+	return nil
+}
+
+func (ctrl *MachineSetStatusController) deleteMember(
+	ctx context.Context,
+	r controller.Runtime,
+	clusterID string,
+	clusterMachine *omni.ClusterMachine,
+) error {
+	clusterMachineIdentity, err := safe.ReaderGet[*omni.ClusterMachineIdentity](
+		ctx,
+		r,
+		omni.NewClusterMachineIdentity(resources.DefaultNamespace, clusterMachine.Metadata().ID()).Metadata(),
+	)
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil
+		}
+
+		return fmt.Errorf("error getting identity: %w", err)
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, time.Second*5)
+	defer cancel()
+
+	_, err = ctrl.discoveryClient.AffiliateDelete(ctx, &serverpb.AffiliateDeleteRequest{
+		ClusterId:   clusterID,
+		AffiliateId: clusterMachineIdentity.TypedSpec().Value.NodeIdentity,
+	})
+	if err != nil {
+		return fmt.Errorf(
+			"error deleting member %q: %w",
+			clusterMachineIdentity.TypedSpec().Value.NodeIdentity,
+			err,
+		)
+	}
+
+	return nil
+}
+
+func (ctrl *MachineSetStatusController) updateClusterMachine(
+	cluster *omni.Cluster,
+	pair machineWithPatches,
+	machineSet *omni.MachineSet,
+	configPatchHelper *configpatch.Helper,
+) (bool, error) {
+	clusterMachine, clusterMachineConfigPatches := pair.F1, pair.F2
+
+	patches, err := configPatchHelper.Get(clusterMachine, machineSet)
+	if err != nil {
+		return false, err
+	}
+
+	if !UpdateInputsVersions(clusterMachine, patches...) && clusterMachine.TypedSpec().Value.KubernetesVersion != "" {
+		return false, nil
+	}
+
+	patchesRaw := make([]string, 0, len(patches))
+	for _, p := range patches {
+		patchesRaw = append(patchesRaw, p.TypedSpec().Value.Data)
+	}
+
+	clusterMachineConfigPatches.TypedSpec().Value.Patches = patchesRaw
+	clusterMachine.TypedSpec().Value.KubernetesVersion = cluster.TypedSpec().Value.KubernetesVersion // this will only be applied once
+
+	return true, nil
+}
+
+func (ctrl *MachineSetStatusController) destroyMachine(ctx context.Context, r controller.Runtime, clusterMachine *omni.ClusterMachine) error {
+	configPatches := omni.NewClusterMachineConfigPatches(clusterMachine.Metadata().Namespace(), clusterMachine.Metadata().ID())
+
+	if err := r.Destroy(ctx, configPatches.Metadata()); err != nil && !state.IsNotFoundError(err) {
+		return err
+	}
+
+	if err := r.Destroy(ctx, clusterMachine.Metadata()); err != nil && !state.IsNotFoundError(err) {
+		return err
+	}
+
+	return nil
+}
+
+// destroyMachinesNoWait kicks in when the machine is in tearing down phase.
+// it removes all machines without waiting for them to be healthy, ignores upgrade strategy.
+func (ctrl *MachineSetStatusController) destroyMachinesNoWait(
+	ctx context.Context,
+	r controller.Runtime,
+	logger *zap.Logger,
+	machineSet *omni.MachineSet,
+	allClusterMachines safe.List[*omni.ClusterMachine],
+) error {
+	list := allClusterMachines.FilterLabelQuery(resource.LabelEqual(omni.LabelMachineSet, machineSet.Metadata().ID()))
+
+	removeFinalizer := true
+
+	for iter := list.Iterator(); iter.Next(); {
+		ready, err := r.Teardown(ctx, iter.Value().Metadata())
+		if err != nil {
+			return fmt.Errorf("error tearing down machine %q: %w", iter.Value().Metadata().ID(), err)
+		}
+
+		if iter.Value().Metadata().Phase() == resource.PhaseRunning {
+			// if it's the first time we attempt a tear down
+			logger.Info("tearing down the machine from the machine set (no wait)",
+				zap.String("machine", iter.Value().Metadata().ID()),
+			)
+		}
+
+		if !ready {
+			removeFinalizer = false
+
+			continue
+		}
+
+		// release the Machine finalizer
+		if err = r.RemoveFinalizer(
+			ctx,
+			omni.NewMachine(resources.DefaultNamespace, iter.Value().Metadata().ID()).Metadata(),
+			ctrl.Name(),
+		); err != nil {
+			return fmt.Errorf("error removing finalizer from machine %q: %w", iter.Value().Metadata().ID(), err)
+		}
+
+		if err = ctrl.destroyMachine(ctx, r, iter.Value()); err != nil {
+			return fmt.Errorf("error destroying machine %q: %w", iter.Value().Metadata().ID(), err)
+		}
+
+		logger.Info("removed the machine from the machine set (no wait)",
+			zap.String("machine", iter.Value().Metadata().ID()),
+		)
+	}
+
+	if removeFinalizer {
+		err := r.RemoveFinalizer(ctx, machineSet.Metadata(), ctrl.Name())
+		if err != nil {
+			return fmt.Errorf("error removing finalizer from machine set %q: %w", machineSet.Metadata().ID(), err)
+		}
+
+		return nil
+	}
+
+	return nil
+}
+
+func (ctrl *MachineSetStatusController) teardownNode(
+	ctx context.Context,
+	clusterMachine *omni.ClusterMachine,
+	clusterMachineIdentity *omni.ClusterMachineIdentity,
+) error {
+	clusterName, ok := clusterMachine.Metadata().Labels().Get(omni.LabelCluster)
+	if !ok {
+		return fmt.Errorf("cluster machine %s doesn't have cluster label set", clusterMachine.Metadata().ID())
+	}
+
+	type kubeRuntime interface {
+		GetClient(ctx context.Context, cluster string) (*kubernetes.Client, error)
+	}
+
+	k8s, err := runtime.LookupInterface[kubeRuntime](kubernetes.Name)
+	if err != nil {
+		return err
+	}
+
+	k8sClient, err := k8s.GetClient(ctx, clusterName)
+	if err != nil {
+		return fmt.Errorf("error getting kubernetes client for cluster %q: %w", clusterName, err)
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, time.Second*5)
+	defer cancel()
+
+	nodename := clusterMachineIdentity.TypedSpec().Value.Nodename
+
+	err = k8sClient.Clientset().CoreV1().Nodes().Delete(ctx, nodename, metav1.DeleteOptions{})
+	if err != nil && !apierrors.IsNotFound(err) {
+		return fmt.Errorf("error deleting node %q in cluster %q: %w", nodename, clusterName, err)
+	}
+
+	return nil
+}
+
+func (ctrl *MachineSetStatusController) createDiscoveryClient(ctx context.Context) (*grpc.ClientConn, error) {
+	u, err := url.Parse(constants.DefaultDiscoveryServiceEndpoint)
+	if err != nil {
+		return nil, err
+	}
+
+	discoveryConn, err := grpc.DialContext(ctx, net.JoinHostPort(u.Host, "443"),
+		grpc.WithTransportCredentials(
+			credentials.NewTLS(&tls.Config{}),
+		),
+		grpc.WithSharedWriteBuffer(true),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	ctrl.discoveryClient = serverpb.NewClusterClient(discoveryConn)
+
+	return discoveryConn, nil
+}
+
+func isOutdated(clusterMachine *omni.ClusterMachine, configStatus *omni.ClusterMachineConfigStatus) bool {
+	return configStatus.TypedSpec().Value.ClusterMachineVersion != clusterMachine.Metadata().Version().String() || configStatus.TypedSpec().Value.LastConfigError != ""
+}
+
+func (ctrl *MachineSetStatusController) getClusterMachineIdentities(
+	ctx context.Context,
+	r controller.Runtime,
+	clusterName string,
+) (map[string]int, map[string]*omni.ClusterMachineIdentity, error) {
+	list, err := safe.ReaderListAll[*omni.ClusterMachineIdentity](
+		ctx,
+		r,
+		state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterName)),
+	)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error listing cluster %q machine identities: %w", clusterName, err)
+	}
+
+	nodeNameOccurences := map[string]int{}
+	clusterMachineIdentities := map[string]*omni.ClusterMachineIdentity{}
+
+	list.ForEach(func(res *omni.ClusterMachineIdentity) {
+		clusterMachineIdentities[res.Metadata().ID()] = res
+		nodeNameOccurences[res.TypedSpec().Value.Nodename]++
+	})
+
+	return nodeNameOccurences, clusterMachineIdentities, nil
+}
+
+func isControlPlane(res resource.Resource) bool {
+	_, found := res.Metadata().Labels().Get(omni.LabelControlPlaneRole)
+
+	return found
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_set_status_test.go b/internal/backend/runtime/omni/controllers/omni/machine_set_status_test.go
new file mode 100644
index 000000000..52eb7c96f
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_set_status_test.go
@@ -0,0 +1,950 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/pair"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/siderolabs/talos/pkg/machinery/config"
+	talossecrets "github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type MachineSetStatusSuite struct {
+	OmniSuite
+}
+
+func (suite *MachineSetStatusSuite) createMachineSet(clusterName string, machineSetName string, machines []string, patches ...string) *omni.MachineSet {
+	opts := xslices.Map(patches, withPatch)
+
+	return suite.createMachineSetWithOpts(clusterName, machineSetName, machines, opts...)
+}
+
+func (suite *MachineSetStatusSuite) createMachineSetWithOpts(clusterName string, machineSetName string, machines []string, opts ...option) *omni.MachineSet {
+	options := initOptions(&options{healthy: true}, opts...)
+	cluster := omni.NewCluster(resources.DefaultNamespace, clusterName)
+
+	cluster.TypedSpec().Value.TalosVersion = "1.2.1"
+	cluster.TypedSpec().Value.KubernetesVersion = "1.25.0"
+
+	err := suite.state.Create(suite.ctx, cluster)
+	if !state.IsConflictError(err) {
+		suite.Require().NoError(err)
+	}
+
+	clusterStatus := omni.NewClusterStatus(resources.DefaultNamespace, clusterName)
+
+	clusterStatus.TypedSpec().Value.Available = true
+
+	err = suite.state.Create(suite.ctx, clusterStatus)
+	if !state.IsConflictError(err) {
+		suite.Require().NoError(err)
+	}
+
+	secrets := omni.NewClusterSecrets(resources.DefaultNamespace, clusterName)
+
+	bundle, err := talossecrets.NewBundle(talossecrets.NewClock(), config.TalosVersionCurrent)
+	suite.Require().NoError(err)
+
+	data, err := json.Marshal(bundle)
+	suite.Require().NoError(err)
+
+	secrets.TypedSpec().Value.Data = data
+
+	err = suite.state.Create(suite.ctx, secrets)
+	if !state.IsConflictError(err) {
+		suite.Require().NoError(err)
+	}
+
+	machineSet := omni.NewMachineSet(resources.DefaultNamespace, machineSetName)
+	machineSet.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+	machineSet.Metadata().Labels().Set(omni.LabelSkipTeardown, "")
+	spec := machineSet.TypedSpec().Value
+
+	loadbalancer := omni.NewLoadBalancerStatus(resources.DefaultNamespace, clusterName)
+	loadbalancer.TypedSpec().Value.Healthy = options.healthy
+
+	err = suite.state.Create(suite.ctx, loadbalancer)
+	if !state.IsConflictError(err) {
+		suite.Require().NoError(err)
+	}
+
+	patchName := fmt.Sprintf("%s-patch-default", machineSetName)
+
+	for i, patch := range options.patches {
+		extraPatchName := fmt.Sprintf("%s-patch-extra%d", machineSetName, i)
+
+		extraPatch := omni.NewConfigPatch(
+			resources.DefaultNamespace, extraPatchName,
+			pair.MakePair(omni.LabelCluster, clusterName),
+			pair.MakePair(omni.LabelMachineSet, machineSetName),
+		)
+
+		extraPatch.TypedSpec().Value.Data = patch
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, extraPatch))
+	}
+
+	spec.UpdateStrategy = specs.MachineSetSpec_Rolling
+	if options.maxUpdateParallelism > 0 {
+		spec.UpdateStrategyConfig = &specs.MachineSetSpec_UpdateStrategyConfig{
+			Rolling: &specs.MachineSetSpec_RollingUpdateStrategyConfig{
+				MaxParallelism: options.maxUpdateParallelism,
+			},
+		}
+	}
+
+	if options.maxDeleteParallelism > 0 {
+		spec.DeleteStrategy = specs.MachineSetSpec_Rolling
+		spec.DeleteStrategyConfig = &specs.MachineSetSpec_UpdateStrategyConfig{
+			Rolling: &specs.MachineSetSpec_RollingUpdateStrategyConfig{
+				MaxParallelism: options.maxDeleteParallelism,
+			},
+		}
+	}
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, machineSet))
+
+	patch1 := omni.NewConfigPatch(resources.DefaultNamespace, patchName, pair.MakePair(omni.LabelCluster, clusterName))
+
+	patch1.TypedSpec().Value.Data = `machine:
+  network:
+    kubespan:
+      enabled: true`
+
+	err = suite.state.Create(suite.ctx, patch1)
+	if !state.IsConflictError(err) {
+		suite.Require().NoError(err)
+	}
+
+	for _, machine := range machines {
+		mchn := omni.NewMachine(resources.DefaultNamespace, machine)
+		mchn.TypedSpec().Value.ManagementAddress = suite.socketConnectionString
+
+		err = suite.state.Create(suite.ctx, mchn)
+		if !state.IsConflictError(err) {
+			suite.Require().NoError(err)
+		}
+
+		machineStatus := omni.NewMachineStatus(resources.DefaultNamespace, machine)
+
+		machineStatus.TypedSpec().Value.ManagementAddress = suite.socketConnectionString
+		machineStatus.TypedSpec().Value.Connected = true
+
+		machineStatus.TypedSpec().Value.Cluster = clusterName
+		machineStatus.TypedSpec().Value.Role = specs.MachineStatusSpec_CONTROL_PLANE
+
+		err = suite.state.Create(suite.ctx, machineStatus)
+		if !state.IsConflictError(err) {
+			suite.Require().NoError(err)
+		}
+
+		msn := omni.NewMachineSetNode(resources.DefaultNamespace, machine, machineSet)
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, msn))
+
+		clusterMachineIdentity := omni.NewClusterMachineIdentity(resources.DefaultNamespace, machine)
+
+		err = suite.state.Create(suite.ctx, clusterMachineIdentity)
+		if !state.IsConflictError(err) {
+			suite.Require().NoError(err)
+		}
+	}
+
+	return machineSet
+}
+
+//nolint:unparam
+func (suite *MachineSetStatusSuite) updateStage(nodes []string, stage specs.ClusterMachineStatusSpec_Stage, ready bool) {
+	for _, node := range nodes {
+		cms := omni.NewClusterMachineStatus(resources.DefaultNamespace, node)
+		spec := cms.TypedSpec().Value
+
+		spec.Ready = ready
+		spec.Stage = stage
+
+		machine, err := suite.state.Get(suite.ctx, resource.NewMetadata(
+			resources.DefaultNamespace,
+			omni.ClusterMachineType,
+			cms.Metadata().ID(),
+			resource.VersionUndefined,
+		))
+		suite.Require().NoError(err)
+
+		omnictrl.CopyLabels(machine, cms, omni.LabelControlPlaneRole, omni.LabelCluster, omni.LabelMachineSet, omni.LabelWorkerRole)
+
+		err = suite.state.Create(suite.ctx, cms)
+		if state.IsConflictError(err) {
+			_, err = safe.StateUpdateWithConflicts(suite.ctx, suite.state, cms.Metadata(), func(res *omni.ClusterMachineStatus) error {
+				res.TypedSpec().Value = cms.TypedSpec().Value
+
+				omnictrl.CopyLabels(machine, res, omni.LabelControlPlaneRole, omni.LabelCluster, omni.LabelMachineSet, omni.LabelWorkerRole)
+
+				return nil
+			})
+
+			suite.Assert().NoError(err)
+		}
+	}
+}
+
+func (suite *MachineSetStatusSuite) syncConfig(nodes []string) {
+	for _, node := range nodes {
+		machine, err := suite.state.Get(suite.ctx, resource.NewMetadata(
+			resources.DefaultNamespace,
+			omni.ClusterMachineType,
+			node,
+			resource.VersionUndefined,
+		))
+		suite.Assert().NoError(err)
+
+		cmcs := omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, node)
+		spec := cmcs.TypedSpec().Value
+		spec.ClusterMachineVersion = machine.Metadata().Version().String()
+
+		omnictrl.CopyLabels(machine, cmcs, omni.LabelControlPlaneRole, omni.LabelCluster, omni.LabelMachineSet, omni.LabelWorkerRole)
+
+		err = suite.state.Create(suite.ctx, cmcs)
+		if state.IsConflictError(err) {
+			_, err = safe.StateUpdateWithConflicts(suite.ctx, suite.state, cmcs.Metadata(), func(res *omni.ClusterMachineConfigStatus) error {
+				res.TypedSpec().Value = cmcs.TypedSpec().Value
+				res.TypedSpec().Value.ClusterMachineVersion = machine.Metadata().Version().String()
+
+				omnictrl.CopyLabels(machine, res, omni.LabelControlPlaneRole, omni.LabelCluster, omni.LabelMachineSet, omni.LabelWorkerRole)
+
+				return nil
+			})
+
+			suite.Assert().NoError(err)
+		}
+	}
+}
+
+func (suite *MachineSetStatusSuite) SetupTest() {
+	suite.OmniSuite.SetupTest()
+
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(&omnictrl.MachineSetStatusController{}))
+
+	// create siderolink config as it's endpoint is used while generating kubernetes endpoint
+	siderolink := siderolink.NewConfig(resources.DefaultNamespace)
+	siderolink.TypedSpec().Value.WireguardEndpoint = "0.0.0.0"
+
+	if err := suite.state.Create(suite.ctx, siderolink); err != nil && !state.IsConflictError(err) {
+		suite.Assert().NoError(err)
+	}
+}
+
+// TestScaleUp verifies that scaling the machine set up is never blocked.
+// Checks the state of created ClusterMachines.
+func (suite *MachineSetStatusSuite) TestScaleUp() {
+	clusterName := "scale-up"
+
+	machines := []string{
+		"node1",
+		"node2",
+		"node3",
+	}
+
+	machineSet := suite.createMachineSet(clusterName, "machine-set-scale-up", machines)
+
+	suite.assertMachinesState(machines, clusterName, machineSet.Metadata().ID())
+
+	suite.updateStage(machines, specs.ClusterMachineStatusSpec_RUNNING, true)
+
+	suite.assertMachineSetPhase(machineSet, *specs.MachineSetPhase_Running.Enum())
+}
+
+// TestScaleDown create a machine set with 3 machines
+// which are not running. Immediately try to scale down.
+// Scale down should be blocked until the machines become ready.
+// Make all machines ready, check that machines count went to 2 and the machine set is ready.
+func (suite *MachineSetStatusSuite) TestScaleDown() {
+	clusterName := "scale-down"
+
+	machines := []string{
+		"scaledown-1",
+		"scaledown-2",
+		"scaledown-3",
+	}
+
+	// We create machine with "Healthy=false" status, so that state.Destroy will not work.
+	machineSet := suite.createMachineSetWithOpts(clusterName, "machine-set-scale-down", machines, withHealthy(false))
+
+	suite.assertMachinesState(machines, clusterName, machineSet.Metadata().ID())
+
+	suite.Require().NoError(suite.state.Destroy(
+		suite.ctx,
+		resource.NewMetadata(resources.DefaultNamespace, omni.MachineSetNodeType, machines[0], resource.VersionUndefined),
+	))
+
+	suite.assertMachineSetPhase(machineSet, specs.MachineSetPhase_ScalingUp)
+
+	expectedMachines := []string{"scaledown-1", "scaledown-2", "scaledown-3"}
+
+	suite.assertMachinesState(expectedMachines, clusterName, machineSet.Metadata().ID())
+
+	loadbalancer := omni.NewLoadBalancerStatus(resources.DefaultNamespace, clusterName)
+	_, err := safe.StateUpdateWithConflicts(
+		suite.ctx,
+		suite.state,
+		loadbalancer.Metadata(),
+		func(r *omni.LoadBalancerStatus) error {
+			r.TypedSpec().Value.Healthy = true
+
+			return nil
+		},
+	)
+	suite.Require().NoError(err)
+
+	suite.updateStage(expectedMachines, specs.ClusterMachineStatusSpec_RUNNING, true)
+
+	suite.assertMachineSetPhase(machineSet, specs.MachineSetPhase_Running)
+
+	suite.Assert().NoError(retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+		suite.assertNoResource(*omni.NewClusterMachine(resources.DefaultNamespace, expectedMachines[0]).Metadata()),
+	))
+
+	// this should be destroyed by the cluster machine status controller, simulate it here
+	suite.Assert().NoError(suite.state.Destroy(suite.ctx, omni.NewClusterMachineStatus(resources.DefaultNamespace, expectedMachines[0]).Metadata()))
+
+	suite.assertMachineSetPhase(machineSet, specs.MachineSetPhase_Running)
+}
+
+// TestScaleDownWithMaxParallelism tests scale down behaves correctly when max parallelism is set in a worker machine set.
+func (suite *MachineSetStatusSuite) TestScaleDownWithMaxParallelism() {
+	clusterName := "cluster-test-scale-down-max-parallelism"
+	numMachines := 8
+	machines := make([]string, 0, numMachines)
+
+	for i := 0; i < numMachines; i++ {
+		machines = append(machines, fmt.Sprintf("node-test-scale-down-max-parallelism-%02d", i))
+	}
+
+	machineSet := suite.createMachineSetWithOpts(clusterName, "machine-set-test-scale-down-max-parallelism", machines, withMaxDeleteParallelism(3))
+
+	// initially, each machine must have a single config patch
+	for _, m := range machines {
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachine(resources.DefaultNamespace, m).Metadata(),
+			func(machine *omni.ClusterMachine, assertions *assert.Assertions) {
+				assertions.NoError(suite.assertLabels(machine, omni.LabelCluster, clusterName, omni.LabelMachineSet, machineSet.Metadata().ID()))
+			},
+		)
+	}
+
+	clusterMachineList, err := safe.StateListAll[*omni.ClusterMachine](suite.ctx, suite.state, state.WithLabelQuery(resource.LabelEqual(omni.LabelMachineSet, machineSet.Metadata().ID())))
+	suite.Require().NoError(err)
+
+	clusterMachineList.ForEach(func(clusterMachine *omni.ClusterMachine) {
+		_, err = safe.StateUpdateWithConflicts(suite.ctx, suite.state, clusterMachine.Metadata(), func(r *omni.ClusterMachine) error {
+			r.Metadata().Finalizers().Add("test-finalizer")
+
+			return nil
+		}, state.WithUpdateOwner(clusterMachine.Metadata().Owner()))
+		suite.Require().NoError(err)
+	})
+
+	watchCh := make(chan safe.WrappedStateEvent[*omni.ClusterMachine])
+
+	err = safe.StateWatchKind(suite.ctx, suite.state, omni.NewClusterMachine(resources.DefaultNamespace, "").Metadata(), watchCh)
+	suite.Require().NoError(err)
+
+	for _, machine := range machines[1:] {
+		suite.Require().NoError(suite.state.Destroy(suite.ctx, omni.NewMachineSetNode(resources.DefaultNamespace, machine, machineSet).Metadata()))
+	}
+
+	getTearingDownClusterMachines := func() []*omni.ClusterMachine {
+		list, err := safe.StateListAll[*omni.ClusterMachine](suite.ctx, suite.state, state.WithLabelQuery(resource.LabelEqual(omni.LabelMachineSet, machineSet.Metadata().ID())))
+		suite.Require().NoError(err)
+
+		tearingDown := make([]*omni.ClusterMachine, 0, list.Len())
+
+		list.ForEach(func(clusterMachine *omni.ClusterMachine) {
+			if clusterMachine.Metadata().Phase() == resource.PhaseTearingDown {
+				tearingDown = append(tearingDown, clusterMachine)
+			}
+		})
+
+		return tearingDown
+	}
+
+	expectTearingDownMachines := func(num int) {
+		suite.EventuallyWithT(func(collect *assert.CollectT) {
+			assert.Equal(collect, num, len(getTearingDownClusterMachines()))
+		}, 2*time.Second, 100*time.Millisecond)
+
+		// wait for a second, then ensure that the number has not changed, i.e., we didn't go over the max parallelism and deleted too many at once
+		timer := time.NewTimer(1 * time.Second)
+		defer timer.Stop()
+
+		select {
+		case <-suite.ctx.Done():
+			suite.Require().NoError(suite.ctx.Err())
+		case <-timer.C:
+		}
+
+		suite.Require().Equal(num, len(getTearingDownClusterMachines()))
+	}
+
+	unblockAndDestroyTearingDownMachines := func() {
+		for _, clusterMachine := range getTearingDownClusterMachines() {
+			_, err := safe.StateUpdateWithConflicts[*omni.ClusterMachine](suite.ctx, suite.state, clusterMachine.Metadata(), func(res *omni.ClusterMachine) error {
+				res.Metadata().Finalizers().Remove("test-finalizer")
+
+				return nil
+			}, state.WithUpdateOwner(clusterMachine.Metadata().Owner()), state.WithExpectedPhaseAny())
+			suite.Require().NoError(err)
+
+			rtestutils.AssertNoResource[*omni.ClusterMachine](suite.ctx, suite.T(), suite.state, clusterMachine.Metadata().ID())
+		}
+	}
+
+	// 1st batch: three machines should be tearing down at once, as max delete parallelism is set to 3
+	expectTearingDownMachines(3)
+
+	// unblock the machines by clearing their test finalizer and wait for them to be destroyed
+	unblockAndDestroyTearingDownMachines()
+
+	// 2nd batch: three machines should be tearing down at once, as max delete parallelism is set to 3
+	expectTearingDownMachines(3)
+
+	// unblock the machines by clearing their test finalizer and wait for them to be destroyed
+	unblockAndDestroyTearingDownMachines()
+
+	// 3rd batch: only a single machine should be tearing down, as max delete parallelism is set to 3 and there is only one machine left
+	expectTearingDownMachines(1)
+
+	// unblock the machines by clearing their test finalizer and wait for them to be destroyed
+	unblockAndDestroyTearingDownMachines()
+}
+
+func (suite *MachineSetStatusSuite) TestConfigUpdate() {
+	clusterName := "patch-party"
+
+	machines := []string{
+		"patched1",
+		"patched2",
+		"patched3",
+	}
+
+	machineSet := suite.createMachineSet(clusterName, "machine-set-scale-up", machines, `machine:
+  install:
+    disk: /dev/vdb`)
+
+	// initially, each machine must have 2 config patches
+	for _, m := range machines {
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachine(resources.DefaultNamespace, m).Metadata(),
+			func(machine *omni.ClusterMachine, assertions *assert.Assertions) {
+				assertions.NoError(suite.assertLabels(machine, omni.LabelCluster, clusterName, omni.LabelMachineSet, machineSet.Metadata().ID()))
+			},
+		)
+
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, m).Metadata(),
+			func(res *omni.ClusterMachineConfigPatches, assertions *assert.Assertions) {
+				assertions.Len(res.TypedSpec().Value.Patches, 2, "expected to have 2 machine patches in the ClusterMachine")
+			},
+		)
+	}
+
+	suite.assertMachinesState(machines, clusterName, machineSet.Metadata().ID())
+
+	// mark machines except machine[2] as running
+	suite.updateStage(machines[:2], specs.ClusterMachineStatusSpec_RUNNING, true)
+	suite.syncConfig(machines[:2])
+
+	// create a ClusterMachine-level patch for the running machine[0]
+	machinePatch := omni.NewConfigPatch(
+		resources.DefaultNamespace,
+		machines[0]+"-cluster-machine",
+		pair.MakePair(omni.LabelCluster, clusterName),
+		pair.MakePair(omni.LabelClusterMachine, machines[0]),
+	)
+
+	machinePatch.TypedSpec().Value.Data = `machine:
+  network:
+   hostname: the-running-node-cluster-machine-patch`
+
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machinePatch))
+
+	// create a Machine-level patch for the running machine[0]
+	machinePatch = omni.NewConfigPatch(
+		resources.DefaultNamespace,
+		machines[0]+"-machine",
+		pair.MakePair(omni.LabelMachine, machines[0]),
+	)
+
+	machinePatch.TypedSpec().Value.Data = `machine:
+  network:
+   hostname: the-running-node-machine-patch`
+
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machinePatch))
+
+	time.Sleep(time.Millisecond * 200)
+
+	// the running machine[0] should still have the old list of patches, because there is a non-running machine[2]
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, machines[0]).Metadata(),
+		func(res *omni.ClusterMachineConfigPatches, assertions *assert.Assertions) {
+			assertions.Len(res.TypedSpec().Value.Patches, 2, "the machine was updated while it shouldn't be")
+		},
+	)
+
+	// create a ClusterMachine-level patch for the machine[2] which is still not ready
+	machinePatch = omni.NewConfigPatch(resources.DefaultNamespace, machines[2],
+		pair.MakePair(omni.LabelCluster, clusterName),
+		pair.MakePair(omni.LabelClusterMachine, machines[2]),
+	)
+
+	machinePatch.TypedSpec().Value.Data = `machine:
+  network:
+    hostname: the-pending-node`
+
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machinePatch))
+
+	// the non-running machine[2] should be updated to have the new patch
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, machines[2]).Metadata(),
+		func(res *omni.ClusterMachineConfigPatches, assertions *assert.Assertions) {
+			assertions.Len(res.TypedSpec().Value.Patches, 3, "expected to have 3 machine patches in the ClusterMachine but found %d", len(res.TypedSpec().Value.Patches))
+		},
+	)
+
+	// mark the non-running machine[2] as running & ready, which should trigger the running machine[0] to be updated
+	suite.updateStage(machines[2:], specs.ClusterMachineStatusSpec_RUNNING, true)
+	suite.syncConfig(machines[2:])
+
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, machines[0]).Metadata(),
+		func(res *omni.ClusterMachineConfigPatches, assertions *assert.Assertions) {
+			patches := res.TypedSpec().Value.Patches
+			assertions.Len(patches, 4, "expected to have 4 machine patches in the ClusterMachine but found %d", len(patches))
+		},
+	)
+}
+
+// TestConfigUpdateWithMaxParallelism tests if config updates are batched correctly when max parallelism is set in a worker machine set.
+func (suite *MachineSetStatusSuite) TestConfigUpdateWithMaxParallelism() {
+	clusterName := "cluster-test-update-max-parallelism"
+	numMachines := 8
+	machines := make([]string, 0, numMachines)
+
+	for i := 0; i < numMachines; i++ {
+		machines = append(machines, fmt.Sprintf("node-test-update-max-parallelism-%02d", i))
+	}
+
+	machineSet := suite.createMachineSetWithOpts(clusterName, "machine-set-test-update-max-parallelism", machines, withMaxUpdateParallelism(3))
+
+	// initially, each machine must have a single config patch
+	for _, m := range machines {
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachine(resources.DefaultNamespace, m).Metadata(),
+			func(machine *omni.ClusterMachine, assertions *assert.Assertions) {
+				assertions.NoError(suite.assertLabels(machine, omni.LabelCluster, clusterName, omni.LabelMachineSet, machineSet.Metadata().ID()))
+			},
+		)
+
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, m).Metadata(),
+			func(res *omni.ClusterMachineConfigPatches, assertions *assert.Assertions) {
+				assertions.Len(res.TypedSpec().Value.Patches, 1, "unexpected number of patches in the ClusterMachine")
+			},
+		)
+	}
+
+	watchCh := make(chan safe.WrappedStateEvent[*omni.ClusterMachineConfigPatches])
+
+	err := safe.StateWatchKind(suite.ctx, suite.state, omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, "").Metadata(), watchCh)
+	suite.Require().NoError(err)
+
+	suite.assertMachinesState(machines, clusterName, machineSet.Metadata().ID())
+
+	// mark all machines as running
+	suite.updateStage(machines, specs.ClusterMachineStatusSpec_RUNNING, true)
+	suite.syncConfig(machines)
+
+	machineSetPatch := omni.NewConfigPatch(resources.DefaultNamespace, machineSet.Metadata().ID()+"-patch",
+		pair.MakePair(omni.LabelCluster, clusterName), pair.MakePair(omni.LabelMachineSet, machineSet.Metadata().ID()))
+	machineSetPatch.TypedSpec().Value.Data = `{"machine":{"env":{"AAA":"BBB"}}}`
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, machineSetPatch))
+
+	expectEvents := func(num int) []resource.ID {
+		ids := make([]resource.ID, 0, num)
+
+		for i := 0; i < num; i++ {
+			var event safe.WrappedStateEvent[*omni.ClusterMachineConfigPatches]
+
+			select {
+			case <-suite.ctx.Done():
+				suite.Require().NoError(suite.ctx.Err())
+			case event = <-watchCh:
+			}
+
+			var res *omni.ClusterMachineConfigPatches
+
+			res, err = event.Resource()
+			suite.Require().NoError(err)
+
+			suite.Len(res.TypedSpec().Value.Patches, 2, "unexpected number of patches in the ClusterMachine")
+
+			ids = append(ids, res.Metadata().ID())
+		}
+
+		return ids
+	}
+
+	expectNoEvent := func(d time.Duration) {
+		timer := time.NewTimer(d)
+		defer timer.Stop()
+
+		select {
+		case <-suite.ctx.Done():
+			suite.Require().NoError(suite.ctx.Err())
+		case event := <-watchCh:
+			suite.Failf("unexpected event", "got event %+v", event)
+		case <-timer.C:
+		}
+	}
+
+	// expect 3 events, as maxParallelism is 3
+	updatedIDs := expectEvents(3)
+
+	// batch complete, do not expect any more events - assert by waiting for 2 seconds
+	expectNoEvent(2 * time.Second)
+
+	// sync configs of the machines updated on the 1st batch
+	// this will also trigger the next batch, as it updates the ClusterMachineConfigStatuses
+	// and they are also inputs for the controller
+	suite.syncConfig(updatedIDs)
+
+	// expect 3 more events
+	updatedIDs = expectEvents(3)
+
+	// batch complete, do not expect any more events - assert by waiting for 2 seconds
+	expectNoEvent(2 * time.Second)
+
+	// trigger the next batch
+	suite.syncConfig(updatedIDs)
+
+	// expect only 2 more events, as there are only 2 machines left to update
+	expectEvents(2)
+}
+
+func (suite *MachineSetStatusSuite) TestTeardown() {
+	machines := []string{
+		"n1",
+		"n2",
+		"n3",
+	}
+
+	for _, tt := range []struct {
+		setup func(*omni.MachineSet)
+		name  string
+	}{
+		{
+			name: "scalingUp",
+			setup: func(machineSet *omni.MachineSet) {
+				suite.assertMachineSetPhase(machineSet, specs.MachineSetPhase_ScalingUp)
+			},
+		},
+		{
+			name: "scalingDown",
+			setup: func(machineSet *omni.MachineSet) {
+				suite.updateStage(machines, specs.ClusterMachineStatusSpec_RUNNING, true)
+				suite.assertMachineSetPhase(machineSet, specs.MachineSetPhase_Running)
+
+				// add a finalizer to ClusterMachine to simulate that machines is being deleted
+				suite.Require().NoError(suite.state.AddFinalizer(
+					suite.ctx,
+					resource.NewMetadata(resources.DefaultNamespace, omni.ClusterMachineType, machines[0], resource.VersionUndefined),
+					"test",
+				))
+
+				suite.Require().NoError(suite.state.Destroy(
+					suite.ctx,
+					resource.NewMetadata(resources.DefaultNamespace, omni.MachineSetNodeType, machines[0], resource.VersionUndefined),
+				))
+
+				suite.assertMachineSetPhase(machineSet, specs.MachineSetPhase_ScalingDown)
+
+				suite.Require().NoError(suite.state.RemoveFinalizer(
+					suite.ctx,
+					resource.NewMetadata(resources.DefaultNamespace, omni.ClusterMachineType, machines[0], resource.VersionUndefined),
+					"test",
+				))
+			},
+		},
+		{
+			name: "ready",
+			setup: func(machineSet *omni.MachineSet) {
+				suite.updateStage(machines, specs.ClusterMachineStatusSpec_RUNNING, true)
+				suite.assertMachineSetPhase(machineSet, specs.MachineSetPhase_Running)
+			},
+		},
+	} {
+		if !suite.Run(tt.name, func() {
+			clusterName := "teardown"
+
+			machineSet := suite.createMachineSet(clusterName, "machine-set-teardown", machines)
+			suite.assertMachinesState(machines, clusterName, machineSet.Metadata().ID())
+
+			tt.setup(machineSet)
+
+			suite.Assert().NoError(retry.Constant(5*time.Second, retry.WithUnits(100*time.Millisecond)).Retry(
+				func() error {
+					ready, err := suite.state.Teardown(suite.ctx, machineSet.Metadata())
+					if err != nil {
+						return err
+					}
+
+					if !ready {
+						return retry.ExpectedErrorf("the machine set is not ready to be destroyed yet")
+					}
+
+					return nil
+				},
+			))
+
+			suite.Assert().NoError(suite.state.Destroy(suite.ctx, machineSet.Metadata()))
+			for _, machine := range machines {
+				if err := suite.state.Destroy(suite.ctx,
+					resource.NewMetadata(resources.DefaultNamespace, omni.MachineSetNodeType, machine, resource.VersionUndefined),
+				); err != nil && !state.IsNotFoundError(err) {
+					suite.Require().NoError(err)
+				}
+			}
+		}) {
+			break
+		}
+	}
+}
+
+// TestMachineLocks verifies machine locks block patch updates, deletions, do not block cluster deletion.
+func (suite *MachineSetStatusSuite) TestMachineLocks() {
+	clusterName := "cluster-locks"
+
+	machines := []string{
+		"node01",
+		"node02",
+		"node03",
+	}
+
+	machineSet := suite.createMachineSet(clusterName, "machine-set-locks", machines)
+
+	suite.assertMachinesState(machines, clusterName, machineSet.Metadata().ID())
+
+	suite.updateStage(machines, specs.ClusterMachineStatusSpec_RUNNING, true)
+
+	machineSetNode := omni.NewMachineSetNode(resources.DefaultNamespace, machines[1], machineSet)
+
+	_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, machineSetNode.Metadata(), func(ms *omni.MachineSetNode) error {
+		ms.Metadata().Annotations().Set(omni.MachineLocked, "")
+
+		return nil
+	})
+
+	suite.Require().NoError(err)
+
+	patch := omni.NewConfigPatch(
+		resources.DefaultNamespace,
+		machineSet.Metadata().ID()+"-patch",
+		pair.MakePair(
+			omni.LabelCluster, clusterName,
+		),
+		pair.MakePair(
+			omni.LabelMachineSet, machineSet.Metadata().ID(),
+		),
+	)
+
+	patch.TypedSpec().Value.Data = `cluster:
+  allowSchedulingOnControlPlanes: true`
+
+	suite.Assert().NoError(suite.state.Create(suite.ctx, patch))
+
+	var eg errgroup.Group
+
+	ctx, cancel := context.WithTimeout(suite.ctx, time.Second*10)
+	defer func() {
+		cancel()
+
+		suite.Require().NoError(eg.Wait())
+	}()
+
+	eg.Go(func() error {
+		events := make(chan safe.WrappedStateEvent[*omni.ClusterMachine])
+
+		if e := safe.StateWatchKind(ctx, suite.state, omni.NewClusterMachine(resources.DefaultNamespace, "").Metadata(), events); e != nil {
+			return e
+		}
+
+		for {
+			select {
+			case <-ctx.Done():
+				return suite.ctx.Err()
+			case <-events:
+			}
+
+			suite.syncConfig(machines)
+		}
+	})
+
+	suite.assertMachinePatches(machines, func(machine *omni.ClusterMachineConfigPatches, assertions *assert.Assertions) {
+		if machine.Metadata().ID() == machines[1] {
+			assertions.Lenf(machine.TypedSpec().Value.Patches, 1, "machine %s is locked but was updated", machine.Metadata().ID())
+
+			return
+		}
+
+		assertions.Lenf(machine.TypedSpec().Value.Patches, 2, "machine %s is not locked but was not updated", machine.Metadata().ID())
+	})
+
+	_, err = safe.StateUpdateWithConflicts(ctx, suite.state, machineSetNode.Metadata(), func(res *omni.MachineSetNode) error {
+		res.Metadata().Annotations().Delete(omni.MachineLocked)
+
+		return nil
+	})
+
+	suite.Require().NoError(err)
+
+	suite.assertMachinePatches(machines, func(machine *omni.ClusterMachineConfigPatches, assertions *assert.Assertions) {
+		assertions.Lenf(machine.TypedSpec().Value.Patches, 2, "machine %s is not locked but was not updated", machine.Metadata().ID())
+	})
+}
+
+func (suite *MachineSetStatusSuite) assertLabels(res resource.Resource, labels ...string) error {
+	if len(labels)%2 != 0 {
+		return errors.New("the number of label params must be even")
+	}
+
+	for i := 0; i < len(labels); i += 2 {
+		value, ok := res.Metadata().Labels().Get(labels[i])
+		if !ok {
+			return fmt.Errorf("the label %s doesn't exist in the resource %s", labels[i], res.Metadata())
+		}
+
+		if labels[i+1] != value {
+			return fmt.Errorf("the label %s expected to be %s, got %s", labels[i], labels[i+1], value)
+		}
+	}
+
+	return nil
+}
+
+func (suite *MachineSetStatusSuite) assertMachinesState(machines []string, clusterName, machineSetName string) {
+	suite.assertMachines(machines, func(machine *omni.ClusterMachine, assertions *assert.Assertions) {
+		assertions.NoError(suite.assertLabels(machine, omni.LabelCluster, clusterName, omni.LabelMachineSet, machineSetName))
+	})
+
+	suite.assertMachinePatches(machines, func(res *omni.ClusterMachineConfigPatches, assertions *assert.Assertions) {
+		assertions.NotEmpty(res.TypedSpec().Value.Patches, "expected to have machine patches in the ClusterMachine")
+	})
+}
+
+func (suite *MachineSetStatusSuite) assertMachines(machines []string, check func(machine *omni.ClusterMachine, assertions *assert.Assertions)) {
+	for _, m := range machines {
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachine(resources.DefaultNamespace, m).Metadata(),
+			check,
+		)
+	}
+}
+
+func (suite *MachineSetStatusSuite) assertMachinePatches(machines []string, check func(machine *omni.ClusterMachineConfigPatches, assertions *assert.Assertions)) {
+	for _, m := range machines {
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, m).Metadata(),
+			check,
+		)
+	}
+}
+
+func (suite *MachineSetStatusSuite) assertMachineSetPhase(machineSet *omni.MachineSet, expectedPhase specs.MachineSetPhase) {
+	ctx, cancel := context.WithTimeout(suite.ctx, 10*time.Second)
+	defer cancel()
+
+	rtestutils.AssertResources(ctx, suite.T(), suite.state, []resource.ID{machineSet.Metadata().ID()}, func(machineSet *omni.MachineSetStatus, assert *assert.Assertions) {
+		assert.Equal(expectedPhase, machineSet.TypedSpec().Value.Phase)
+	})
+}
+
+func TestMachineSetStatusSuite(t *testing.T) {
+	suite.Run(t, new(MachineSetStatusSuite))
+}
+
+type options struct {
+	patches              []string
+	healthy              bool
+	maxUpdateParallelism uint32
+	maxDeleteParallelism uint32
+}
+
+type option func(*options)
+
+func withPatch(patch string) option {
+	return func(o *options) {
+		o.patches = append(o.patches, patch)
+	}
+}
+
+func withHealthy(healthy bool) option {
+	return func(o *options) {
+		o.healthy = healthy
+	}
+}
+
+func withMaxUpdateParallelism(maxUpdateParallelism uint32) option {
+	return func(o *options) {
+		o.maxUpdateParallelism = maxUpdateParallelism
+	}
+}
+
+func withMaxDeleteParallelism(maxDeleteParallelism uint32) option {
+	return func(o *options) {
+		o.maxDeleteParallelism = maxDeleteParallelism
+	}
+}
+
+func initOptions[T any, Fn ~func(*T)](t *T, fns ...Fn) *T {
+	for _, fn := range fns {
+		fn(t)
+	}
+
+	return t
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_status.go b/internal/backend/runtime/omni/controllers/omni/machine_status.go
new file mode 100644
index 000000000..521a5741b
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_status.go
@@ -0,0 +1,411 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/kvutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	cosistate "github.com/cosi-project/runtime/pkg/state"
+	machineapi "github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/task"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/task/machine"
+)
+
+// MachineStatusController manages omni.MachineStatuses based on information from Talos API.
+type MachineStatusController struct {
+	runner *task.Runner[machine.InfoChan, machine.CollectTaskSpec]
+}
+
+// Name implements controller.Controller interface.
+func (ctrl *MachineStatusController) Name() string {
+	return "MachineStatusController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *MachineStatusController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.MachineType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.ClusterMachineType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.TalosConfigType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.MachineStatusSnapshotType,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.MachineLabelsType,
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *MachineStatusController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.MachineStatusType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *MachineStatusController) Run(ctx context.Context, r controller.Runtime, logger *zap.Logger) error {
+	ctrl.runner = task.NewEqualRunner[machine.CollectTaskSpec]()
+	defer ctrl.runner.Stop()
+
+	notifyCh := make(chan machine.Info)
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+			if err := ctrl.reconcileCollectors(ctx, r, logger, notifyCh); err != nil {
+				return err
+			}
+		case event := <-notifyCh:
+			if err := ctrl.handleNotification(ctx, r, event); err != nil {
+				return err
+			}
+		}
+
+		r.ResetRestartBackoff()
+	}
+}
+
+//nolint:gocognit,gocyclo,cyclop
+func (ctrl *MachineStatusController) reconcileCollectors(ctx context.Context, r controller.Runtime, logger *zap.Logger, notifyCh machine.InfoChan) error {
+	// list machines
+	list, err := safe.ReaderListAll[*omni.Machine](ctx, r)
+	if err != nil {
+		return fmt.Errorf("error listing machines: %w", err)
+	}
+
+	tracker := trackResource(r, resources.DefaultNamespace, omni.MachineStatusType)
+
+	// figure out which collectors should run
+	shouldRun := map[string]machine.CollectTaskSpec{}
+	machines := map[resource.ID]*omni.Machine{}
+	connectedMachines := 0
+	machineLabels := map[resource.ID]*omni.MachineLabels{}
+	reportingEvents := map[string]struct{}{}
+
+	for iter := list.Iterator(); iter.Next(); {
+		item := iter.Value()
+		machineSpec := item.TypedSpec().Value
+
+		var labels *omni.MachineLabels
+
+		labels, err = safe.ReaderGet[*omni.MachineLabels](ctx, r,
+			resource.NewMetadata(resources.DefaultNamespace, omni.MachineLabelsType, item.Metadata().ID(), resource.VersionUndefined))
+		if err != nil {
+			if !cosistate.IsNotFoundError(err) {
+				return err
+			}
+		}
+
+		machineLabels[item.Metadata().ID()] = labels
+
+		if item.Metadata().Phase() == resource.PhaseTearingDown {
+			continue
+		}
+
+		tracker.keep(item)
+
+		var clusterMachine resource.Resource
+
+		clusterMachine, err = r.Get(ctx, resource.NewMetadata(resources.DefaultNamespace, omni.ClusterMachineType, item.Metadata().ID(), resource.VersionUndefined))
+		if err != nil && !cosistate.IsNotFoundError(err) {
+			return err
+		}
+
+		var cluster string
+
+		if clusterMachine != nil {
+			var ok bool
+			cluster, ok = clusterMachine.Metadata().Labels().Get(omni.LabelCluster)
+
+			if !ok {
+				logger.Warn("The cluster machine is created without the cluster")
+			}
+		}
+
+		var talosConfig *omni.TalosConfig
+
+		if cluster != "" {
+			talosConfig, err = safe.ReaderGet[*omni.TalosConfig](ctx, r, resource.NewMetadata(
+				resources.DefaultNamespace, omni.TalosConfigType, cluster, resource.VersionUndefined,
+			))
+
+			if err != nil && !cosistate.IsNotFoundError(err) {
+				return err
+			}
+		}
+
+		var machineStatusSnapshot *omni.MachineStatusSnapshot
+		machineStatusSnapshot, err = safe.ReaderGet[*omni.MachineStatusSnapshot](ctx, r, resource.NewMetadata(
+			resources.DefaultNamespace,
+			omni.MachineStatusSnapshotType,
+			item.Metadata().ID(),
+			resource.VersionUndefined,
+		))
+
+		if err != nil && !cosistate.IsNotFoundError(err) {
+			return err
+		}
+
+		var maintenanceStage bool
+
+		if machineStatusSnapshot != nil {
+			maintenanceStage = machineStatusSnapshot.TypedSpec().Value.MachineStatus.Stage == machineapi.MachineStatusEvent_MAINTENANCE
+			reportingEvents[item.Metadata().ID()] = struct{}{}
+		}
+
+		if machineSpec.Connected {
+			shouldRun[item.Metadata().ID()] = machine.CollectTaskSpec{
+				Endpoint:        machineSpec.ManagementAddress,
+				TalosConfig:     talosConfig,
+				MaintenanceMode: talosConfig == nil || maintenanceStage,
+				MachineID:       item.Metadata().ID(),
+				MachineLabels:   labels,
+			}
+
+			connectedMachines++
+		}
+
+		machines[item.Metadata().ID()] = item
+	}
+
+	ctrl.runner.Reconcile(ctx, logger, shouldRun, notifyCh)
+
+	if err = tracker.cleanup(ctx); err != nil {
+		return err
+	}
+
+	for id := range machines {
+		if err = safe.WriterModify(ctx, r, omni.NewMachineStatus(resources.DefaultNamespace, id), func(m *omni.MachineStatus) error {
+			spec := m.TypedSpec().Value
+
+			connected := machines[id].TypedSpec().Value.Connected
+
+			spec.Connected = connected
+
+			if connected {
+				m.Metadata().Labels().Set(omni.MachineStatusLabelConnected, "")
+				m.Metadata().Labels().Delete(omni.MachineStatusLabelDisconnected)
+			} else {
+				m.Metadata().Labels().Delete(omni.MachineStatusLabelConnected)
+				m.Metadata().Labels().Set(omni.MachineStatusLabelDisconnected, "")
+			}
+
+			if _, ok := reportingEvents[id]; ok {
+				m.Metadata().Labels().Set(omni.MachineStatusLabelReportingEvents, "")
+			} else {
+				m.Metadata().Labels().Delete(omni.MachineStatusLabelReportingEvents)
+			}
+
+			if shouldRun[id].Endpoint != "" {
+				spec.ManagementAddress = shouldRun[id].Endpoint
+			}
+
+			var clusterMachine *omni.ClusterMachine
+
+			clusterMachine, err = safe.ReaderGet[*omni.ClusterMachine](ctx, r, resource.NewMetadata(resources.DefaultNamespace, omni.ClusterMachineType, id, resource.VersionUndefined))
+			if err != nil {
+				if !cosistate.IsNotFoundError(err) {
+					return err
+				}
+			}
+
+			CopyUserLabels(m, ctrl.mergeLabels(m, machineLabels[m.Metadata().ID()]))
+
+			omni.MachineStatusReconcileLabels(m)
+
+			return ctrl.setClusterRelation(clusterMachine, m)
+		}); err != nil && !cosistate.IsPhaseConflictError(err) {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (ctrl *MachineStatusController) mergeLabels(m *omni.MachineStatus, machineLabels *omni.MachineLabels) map[string]string {
+	labels := map[string]string{}
+
+	if m.TypedSpec().Value.ImageLabels != nil {
+		for k, v := range m.TypedSpec().Value.ImageLabels {
+			labels[k] = v
+		}
+	}
+
+	if machineLabels != nil {
+		for k, v := range machineLabels.Metadata().Labels().Raw() {
+			labels[k] = v
+		}
+	}
+
+	return labels
+}
+
+func (ctrl *MachineStatusController) setClusterRelation(clusterMachine *omni.ClusterMachine, machineStatus *omni.MachineStatus) error {
+	if clusterMachine == nil {
+		machineStatus.TypedSpec().Value.Cluster = ""
+		machineStatus.TypedSpec().Value.Role = specs.MachineStatusSpec_NONE
+
+		machineStatus.Metadata().Labels().Set(omni.MachineStatusLabelAvailable, "")
+
+		machineStatus.Metadata().Labels().Delete(omni.LabelCluster)
+
+		return nil
+	}
+
+	labels := clusterMachine.Metadata().Labels()
+
+	cluster, clusterOk := labels.Get(omni.LabelCluster)
+	if !clusterOk {
+		return fmt.Errorf("malformed ClusterMachine resource: no %q label, cluster ownership unknown", omni.LabelCluster)
+	}
+
+	machineStatus.TypedSpec().Value.Cluster = cluster
+
+	_, controlPlane := labels.Get(omni.LabelControlPlaneRole)
+	_, worker := labels.Get(omni.LabelWorkerRole)
+
+	machineStatus.Metadata().Labels().Set(omni.LabelCluster, cluster)
+
+	switch {
+	case controlPlane:
+		machineStatus.TypedSpec().Value.Role = specs.MachineStatusSpec_CONTROL_PLANE
+	case worker:
+		machineStatus.TypedSpec().Value.Role = specs.MachineStatusSpec_WORKER
+	default:
+		return fmt.Errorf("malformed ClusterMachine resource: no %q or %q label, role unknown", omni.LabelControlPlaneRole, omni.LabelWorkerRole)
+	}
+
+	machineStatus.Metadata().Labels().Delete(omni.MachineStatusLabelAvailable)
+
+	return nil
+}
+
+//nolint:gocognit,gocyclo,cyclop
+func (ctrl *MachineStatusController) handleNotification(ctx context.Context, r controller.Runtime, event machine.Info) error {
+	if err := safe.WriterModify(ctx, r, omni.NewMachineStatus(resources.DefaultNamespace, event.MachineID), func(m *omni.MachineStatus) error {
+		spec := m.TypedSpec().Value
+
+		if event.LastError != nil {
+			spec.LastError = event.LastError.Error()
+		} else {
+			spec.LastError = ""
+		}
+
+		if event.TalosVersion != nil {
+			spec.TalosVersion = *event.TalosVersion
+		}
+
+		if spec.Network == nil {
+			spec.Network = &specs.MachineStatusSpec_NetworkStatus{}
+		}
+
+		if event.Hostname != nil {
+			spec.Network.Hostname = *event.Hostname
+		}
+
+		if event.Domainname != nil {
+			spec.Network.Domainname = *event.Domainname
+		}
+
+		if event.Addresses != nil {
+			spec.Network.Addresses = event.Addresses
+		}
+
+		if event.DefaultGateways != nil {
+			spec.Network.DefaultGateways = event.DefaultGateways
+		}
+
+		if event.NetworkLinks != nil {
+			spec.Network.NetworkLinks = event.NetworkLinks
+		}
+
+		if spec.Hardware == nil {
+			spec.Hardware = &specs.MachineStatusSpec_HardwareStatus{}
+		}
+
+		if event.Arch != nil {
+			spec.Hardware.Arch = *event.Arch
+		}
+
+		if event.Processors != nil {
+			spec.Hardware.Processors = event.Processors
+		}
+
+		if event.MemoryModules != nil {
+			spec.Hardware.MemoryModules = event.MemoryModules
+		}
+
+		if event.Blockdevices != nil {
+			spec.Hardware.Blockdevices = event.Blockdevices
+		}
+
+		if event.PlatformMetadata != nil {
+			spec.PlatformMetadata = event.PlatformMetadata
+		}
+
+		if event.ImageLabels != nil {
+			spec.ImageLabels = event.ImageLabels
+
+			m.Metadata().Labels().Do(func(temp kvutils.TempKV) {
+				for key, value := range spec.ImageLabels {
+					temp.Set(key, value)
+				}
+			})
+		}
+
+		if event.NoAccess {
+			m.Metadata().Labels().Set(omni.MachineStatusLabelInvalidState, "")
+		} else {
+			m.Metadata().Labels().Delete(omni.MachineStatusLabelInvalidState)
+		}
+
+		if event.Schematic != nil {
+			spec.Schematic = event.Schematic
+		}
+
+		spec.Maintenance = event.MaintenanceMode
+
+		omni.MachineStatusReconcileLabels(m)
+
+		return nil
+	}); err != nil && !cosistate.IsPhaseConflictError(err) {
+		return fmt.Errorf("error modifying resource: %w", err)
+	}
+
+	return nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_status_link.go b/internal/backend/runtime/omni/controllers/omni/machine_status_link.go
new file mode 100644
index 000000000..daf78431c
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_status_link.go
@@ -0,0 +1,184 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/hashicorp/go-multierror"
+	"go.uber.org/zap"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	siderolinkmanager "github.com/siderolabs/omni/internal/pkg/siderolink"
+)
+
+// NewMachineStatusLinkController creates new MachineStatusLinkController.
+func NewMachineStatusLinkController(linkCounterDeltaCh <-chan siderolinkmanager.LinkCounterDeltas) *MachineStatusLinkController {
+	return &MachineStatusLinkController{
+		deltaCh: linkCounterDeltaCh,
+	}
+}
+
+// MachineStatusLinkController joins [omni.MachineStatus] and link counter deltas from SideroLink manager into one virtual resource which will
+// be stored in [resources.EphemeralNamespace].
+type MachineStatusLinkController struct {
+	deltaCh <-chan siderolinkmanager.LinkCounterDeltas
+}
+
+// Name implements controller.Controller interface.
+func (ctrl *MachineStatusLinkController) Name() string {
+	return "MachineStatusLinkController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *MachineStatusLinkController) Inputs() []controller.Input {
+	return []controller.Input{
+		safe.Input[*omni.MachineStatus](controller.InputWeak),
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *MachineStatusLinkController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.MachineStatusLinkType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *MachineStatusLinkController) Run(ctx context.Context, rt controller.Runtime, _ *zap.Logger) error {
+	for {
+		var deltas siderolinkmanager.LinkCounterDeltas
+
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-rt.EventCh():
+		case deltas = <-ctrl.deltaCh:
+		}
+
+		rt.StartTrackingOutputs()
+
+		msList, err := safe.ReaderListAll[*omni.MachineStatus](ctx, rt)
+		if err != nil {
+			return fmt.Errorf("error listing MachineStatus resources: %w", err)
+		}
+
+		for iter := msList.Iterator(); iter.Next(); {
+			ms := iter.Value()
+
+			if ms.Metadata().Phase() == resource.PhaseTearingDown {
+				continue
+			}
+
+			emptyResource := omni.NewMachineStatusLink(resources.MetricsNamespace, ms.Metadata().ID())
+
+			err = safe.WriterModify(ctx, rt, emptyResource, func(msl *omni.MachineStatusLink) error {
+				// Just copy labels and metadata from MachineStatus resource.
+				// This should be safe since Labels are copy-on-write.
+				*msl.Metadata().Labels() = *ms.Metadata().Labels()
+
+				msl.TypedSpec().Value.MessageStatus = ms.TypedSpec().Value
+				msl.TypedSpec().Value.MachineCreatedAt = ms.Metadata().Created().Unix()
+
+				if delta, ok := deltas[ms.Metadata().ID()]; ok {
+					if msl.TypedSpec().Value.SiderolinkCounter == nil {
+						msl.TypedSpec().Value.SiderolinkCounter = &specs.SiderolinkCounterSpec{}
+					}
+
+					msl.TypedSpec().Value.SiderolinkCounter.BytesReceived += delta.BytesReceived
+					msl.TypedSpec().Value.SiderolinkCounter.BytesSent += delta.BytesSent
+					msl.TypedSpec().Value.SiderolinkCounter.LastAlive = pickTime(delta.LastAlive, msl.TypedSpec().Value.SiderolinkCounter.LastAlive)
+				}
+
+				return nil
+			})
+			if err != nil {
+				return fmt.Errorf("error creating MachineStatusLink (id: %s) resource: %w", ms.Metadata().ID(), err)
+			}
+		}
+
+		if err = safe.CleanupOutputs[*omni.MachineStatusLink](ctx, rt); err != nil {
+			return fmt.Errorf("error cleaning up MachineStatusLink resources: %w", err)
+		}
+	}
+}
+
+// Almost exact copy from transform.Controller, only as a standalone function.
+func cleanupOutputs[T generic.ResourceWithRD](
+	ctx context.Context,
+	r controller.Runtime,
+	hasActiveInput func(T) bool,
+) error {
+	outputList, err := safe.ReaderListAll[T](ctx, r)
+	if err != nil {
+		return fmt.Errorf("error listing output resources: %w", err)
+	}
+
+	var multiErr error
+
+	for it := outputList.Iterator(); it.Next(); {
+		out := it.Value()
+
+		// always attempt clean up of tearing down outputs, even if there is a matching input
+		// in the case that output phase is tearing down, while touched is true, actually
+		// output belongs to a previous generation of the input resource with the same ID, so the output
+		// should be torn down first before the new output is created
+		if out.Metadata().Phase() != resource.PhaseTearingDown {
+			// this output was touched (has active input), skip it
+			if hasActiveInput(out) {
+				continue
+			}
+		}
+
+		ready, err := r.Teardown(ctx, out.Metadata())
+		if err != nil {
+			multiErr = multierror.Append(multiErr, err)
+
+			continue
+		}
+
+		if !ready {
+			// still some finalizers left on the output, controller will be re-triggered
+			continue
+		}
+
+		if err = r.Destroy(ctx, out.Metadata()); err != nil {
+			multiErr = multierror.Append(multiErr, err)
+
+			continue
+		}
+	}
+
+	return multiErr
+}
+
+func pickTime(newAlive time.Time, lastAlive *timestamppb.Timestamp) *timestamppb.Timestamp {
+	if newAlive.IsZero() {
+		return lastAlive
+	}
+
+	if lastAlive == nil || !lastAlive.IsValid() {
+		return timestamppb.New(newAlive)
+	}
+
+	if newAlive.After(lastAlive.AsTime()) {
+		return timestamppb.New(newAlive)
+	}
+
+	return lastAlive
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_status_link_test.go b/internal/backend/runtime/omni/controllers/omni/machine_status_link_test.go
new file mode 100644
index 000000000..ad855505b
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_status_link_test.go
@@ -0,0 +1,204 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller/generic"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+	siderolinkmanager "github.com/siderolabs/omni/internal/pkg/siderolink"
+)
+
+type MachineStatusLinkSuite struct {
+	OmniSuite
+	deltaCh chan siderolinkmanager.LinkCounterDeltas
+}
+
+const testID2 = "testID2"
+
+func (suite *MachineStatusLinkSuite) SetupTest() {
+	suite.OmniSuite.SetupTest()
+
+	suite.startRuntime()
+
+	suite.deltaCh = make(chan siderolinkmanager.LinkCounterDeltas)
+
+	suite.Require().NoError(suite.runtime.RegisterController(&omnictrl.MachineStatusController{}))
+	suite.Require().NoError(suite.runtime.RegisterController(omnictrl.NewMachineStatusLinkController(suite.deltaCh)))
+}
+
+func (suite *MachineStatusLinkSuite) TestBasicMachineOnAndOff() {
+	machine := omni.NewMachine(resources.DefaultNamespace, testID)
+	machine.TypedSpec().Value.Connected = true
+
+	suite.create(machine)
+
+	assertResource(
+		&suite.OmniSuite,
+		makeMD[*omni.MachineStatusLink](testID),
+		func(status *omni.MachineStatusLink, asrt *assert.Assertions) {
+			statusVal := status.TypedSpec().Value
+
+			asrt.True(statusVal.GetMessageStatus().GetConnected())
+		},
+	)
+
+	suite.deltaCh <- siderolinkmanager.LinkCounterDeltas{
+		testID: siderolinkmanager.LinkCounterDelta{
+			BytesSent:     15,
+			BytesReceived: 20,
+			LastAlive:     time.Unix(1257894000, 0),
+		},
+	}
+
+	assertResource(
+		&suite.OmniSuite,
+		makeMD[*omni.MachineStatusLink](testID),
+		func(status *omni.MachineStatusLink, asrt *assert.Assertions) {
+			statusVal := status.TypedSpec().Value
+
+			asrt.True(statusVal.GetMessageStatus().GetConnected())
+			asrt.EqualValues(15, statusVal.GetSiderolinkCounter().GetBytesSent())
+			asrt.EqualValues(20, statusVal.GetSiderolinkCounter().GetBytesReceived())
+			asrt.EqualValues(1257894000, statusVal.GetSiderolinkCounter().GetLastAlive().AsTime().Unix())
+		},
+	)
+
+	suite.destroy(machine)
+
+	msl := omni.NewMachineStatusLink(resources.MetricsNamespace, testID)
+
+	assertNoResource(&suite.OmniSuite, msl)
+}
+
+func (suite *MachineStatusLinkSuite) TestTwoMachines() {
+	machine1 := omni.NewMachine(resources.DefaultNamespace, testID)
+	machine1.TypedSpec().Value.Connected = true
+
+	suite.create(machine1)
+
+	assertResource(
+		&suite.OmniSuite,
+		makeMD[*omni.MachineStatusLink](testID),
+		func(status *omni.MachineStatusLink, asrt *assert.Assertions) {
+			statusVal := status.TypedSpec().Value
+
+			asrt.True(statusVal.GetMessageStatus().GetConnected())
+		},
+	)
+
+	suite.deltaCh <- siderolinkmanager.LinkCounterDeltas{
+		testID: siderolinkmanager.LinkCounterDelta{
+			BytesSent:     15,
+			BytesReceived: 20,
+			LastAlive:     time.Unix(1257894000, 0),
+		},
+	}
+
+	assertResource(
+		&suite.OmniSuite,
+		makeMD[*omni.MachineStatusLink](testID),
+		func(status *omni.MachineStatusLink, asrt *assert.Assertions) {
+			statusVal := status.TypedSpec().Value
+
+			asrt.True(statusVal.GetMessageStatus().GetConnected())
+			asrt.EqualValues(15, statusVal.GetSiderolinkCounter().GetBytesSent())
+			asrt.EqualValues(20, statusVal.GetSiderolinkCounter().GetBytesReceived())
+			asrt.EqualValues(1257894000, statusVal.GetSiderolinkCounter().GetLastAlive().AsTime().Unix())
+		},
+	)
+
+	machine2 := omni.NewMachine(resources.DefaultNamespace, testID2)
+	machine2.TypedSpec().Value.Connected = true
+
+	suite.create(machine2)
+	suite.destroy(machine1)
+
+	assertNoResource(&suite.OmniSuite, omni.NewMachineStatusLink(resources.MetricsNamespace, testID))
+
+	assertResource(
+		&suite.OmniSuite,
+		makeMD[*omni.MachineStatusLink](testID2),
+		func(status *omni.MachineStatusLink, asrt *assert.Assertions) {
+			statusVal := status.TypedSpec().Value
+
+			asrt.True(statusVal.GetMessageStatus().GetConnected())
+		},
+	)
+
+	suite.deltaCh <- siderolinkmanager.LinkCounterDeltas{
+		testID2: siderolinkmanager.LinkCounterDelta{
+			BytesSent:     16,
+			BytesReceived: 21,
+			LastAlive:     time.Unix(1257894001, 0),
+		},
+	}
+
+	assertResource(
+		&suite.OmniSuite,
+		makeMD[*omni.MachineStatusLink](testID2),
+		func(status *omni.MachineStatusLink, asrt *assert.Assertions) {
+			statusVal := status.TypedSpec().Value
+
+			asrt.True(statusVal.GetMessageStatus().GetConnected())
+			asrt.EqualValues(16, statusVal.GetSiderolinkCounter().GetBytesSent())
+			asrt.EqualValues(21, statusVal.GetSiderolinkCounter().GetBytesReceived())
+			asrt.EqualValues(1257894001, statusVal.GetSiderolinkCounter().GetLastAlive().AsTime().Unix())
+		},
+	)
+
+	suite.deltaCh <- siderolinkmanager.LinkCounterDeltas{
+		testID2: siderolinkmanager.LinkCounterDelta{
+			BytesSent:     1,
+			BytesReceived: 1,
+			LastAlive:     time.Unix(1257894002, 0),
+		},
+	}
+
+	assertResource(
+		&suite.OmniSuite,
+		makeMD[*omni.MachineStatusLink](testID2),
+		func(status *omni.MachineStatusLink, asrt *assert.Assertions) {
+			statusVal := status.TypedSpec().Value
+
+			asrt.True(statusVal.GetMessageStatus().GetConnected())
+			asrt.EqualValues(17, statusVal.GetSiderolinkCounter().GetBytesSent())
+			asrt.EqualValues(22, statusVal.GetSiderolinkCounter().GetBytesReceived())
+			asrt.EqualValues(1257894002, statusVal.GetSiderolinkCounter().GetLastAlive().AsTime().Unix())
+		},
+	)
+}
+
+func (suite *MachineStatusLinkSuite) create(res resource.Resource) {
+	suite.Require().NoError(suite.state.Create(suite.ctx, res))
+}
+
+func (suite *MachineStatusLinkSuite) destroy(res resource.Resource) {
+	suite.Require().NoError(suite.state.Destroy(suite.ctx, res.Metadata()))
+}
+
+func makeMD[T generic.ResourceWithRD](id resource.ID) resource.Metadata {
+	var zero T
+
+	return resource.NewMetadata(
+		zero.ResourceDefinition().DefaultNamespace,
+		zero.ResourceDefinition().Type,
+		id,
+		resource.VersionUndefined,
+	)
+}
+
+func TestMachineStatusLinkSuiteSuite(t *testing.T) {
+	suite.Run(t, new(MachineStatusLinkSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_status_metrics.go b/internal/backend/runtime/omni/controllers/omni/machine_status_metrics.go
new file mode 100644
index 000000000..04cd22f19
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_status_metrics.go
@@ -0,0 +1,147 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/prometheus/client_golang/prometheus"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// MachineStatusMetricsController provides metrics based on ClusterStatus.
+//
+//nolint:govet
+type MachineStatusMetricsController struct {
+	versionsMu  sync.Mutex
+	versionsMap map[string]int
+
+	metricsOnce                 sync.Once
+	metricNumMachines           prometheus.Gauge
+	metricNumConnectedMachines  prometheus.Gauge
+	metricNumMachinesPerVersion *prometheus.Desc
+}
+
+// Name implements controller.Controller interface.
+func (ctrl *MachineStatusMetricsController) Name() string {
+	return "MachineStatusMetricsController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *MachineStatusMetricsController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Namespace: resources.DefaultNamespace,
+			Type:      omni.MachineStatusType,
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *MachineStatusMetricsController) Outputs() []controller.Output {
+	return nil
+}
+
+func (ctrl *MachineStatusMetricsController) initMetrics() {
+	ctrl.metricsOnce.Do(func() {
+		ctrl.metricNumMachines = prometheus.NewGauge(prometheus.GaugeOpts{
+			Name: "omni_machines",
+			Help: "Number of machines in the instance.",
+		})
+
+		ctrl.metricNumConnectedMachines = prometheus.NewGauge(prometheus.GaugeOpts{
+			Name: "omni_connected_machines",
+			Help: "Number of machines in the instance that are connected.",
+		})
+
+		ctrl.metricNumMachinesPerVersion = prometheus.NewDesc(
+			"omni_machines_version",
+			"Number of machines in the instance by version.",
+			[]string{"talos_version"},
+			nil,
+		)
+	})
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *MachineStatusMetricsController) Run(ctx context.Context, r controller.Runtime, _ *zap.Logger) error {
+	ctrl.initMetrics()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+		}
+
+		list, err := safe.ReaderListAll[*omni.MachineStatus](
+			ctx,
+			r,
+		)
+		if err != nil {
+			return err
+		}
+
+		var machines, connectedMachines int
+
+		ctrl.versionsMu.Lock()
+		ctrl.versionsMap = map[string]int{}
+
+		for iter := list.Iterator(); iter.Next(); {
+			machines++
+
+			if iter.Value().TypedSpec().Value.Connected {
+				connectedMachines++
+			}
+
+			if iter.Value().TypedSpec().Value.TalosVersion != "" {
+				ctrl.versionsMap[iter.Value().TypedSpec().Value.TalosVersion]++
+			}
+		}
+
+		ctrl.versionsMu.Unlock()
+
+		ctrl.metricNumMachines.Set(float64(machines))
+		ctrl.metricNumConnectedMachines.Set(float64(connectedMachines))
+
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-time.After(10 * time.Second): // don't reconcile too often, as metrics are not scraped that often
+		}
+	}
+}
+
+// Describe implements prom.Collector interface.
+func (ctrl *MachineStatusMetricsController) Describe(ch chan<- *prometheus.Desc) {
+	prometheus.DescribeByCollect(ctrl, ch)
+}
+
+// Collect implements prom.Collector interface.
+func (ctrl *MachineStatusMetricsController) Collect(ch chan<- prometheus.Metric) {
+	ctrl.initMetrics()
+
+	ctrl.versionsMu.Lock()
+
+	for version, count := range ctrl.versionsMap {
+		ch <- prometheus.MustNewConstMetric(ctrl.metricNumMachinesPerVersion, prometheus.GaugeValue, float64(count), version)
+	}
+
+	ctrl.versionsMu.Unlock()
+
+	ctrl.metricNumMachines.Collect(ch)
+	ctrl.metricNumConnectedMachines.Collect(ch)
+}
+
+var _ prometheus.Collector = &MachineStatusMetricsController{}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_status_test.go b/internal/backend/runtime/omni/controllers/omni/machine_status_test.go
new file mode 100644
index 000000000..18b6941f8
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_status_test.go
@@ -0,0 +1,310 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/siderolabs/image-factory/pkg/constants"
+	"github.com/siderolabs/image-factory/pkg/schematic"
+	machineapi "github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/siderolabs/talos/pkg/machinery/extensions"
+	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/meta"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type MachineStatusSuite struct {
+	OmniSuite
+}
+
+func (suite *MachineStatusSuite) setup() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterController(&omnictrl.MachineStatusController{}))
+}
+
+const testID = "testID"
+
+func (suite *MachineStatusSuite) TestMachineConnected() {
+	suite.setup()
+
+	// given
+	machine := omni.NewMachine(resources.DefaultNamespace, testID)
+	machine.TypedSpec().Value.Connected = true
+
+	// when
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machine))
+
+	// then
+	rtestutils.AssertResource(suite.ctx, suite.T(), suite.state, testID, func(status *omni.MachineStatus, assert *assert.Assertions) {
+		statusVal := status.TypedSpec().Value
+
+		suite.Truef(statusVal.Connected, "not connected")
+
+		_, ok := status.Metadata().Labels().Get(omni.MachineStatusLabelConnected)
+		assert.Truef(ok, "connected label not set")
+	})
+
+	// check that the connected label is removed again, if the machine becomes disconnected.
+	_, err := safe.StateUpdateWithConflicts(context.Background(), suite.state,
+		resource.NewMetadata(resources.DefaultNamespace, omni.MachineType, testID, resource.VersionUndefined), func(res *omni.Machine) error {
+			res.TypedSpec().Value.Connected = false
+
+			return nil
+		})
+	suite.Assert().NoError(err)
+
+	rtestutils.AssertResource(suite.ctx, suite.T(), suite.state, testID, func(status *omni.MachineStatus, assert *assert.Assertions) {
+		statusVal := status.TypedSpec().Value
+
+		assert.Falsef(statusVal.Connected, "should not be connected anymore")
+
+		_, ok := status.Metadata().Labels().Get(omni.MachineStatusLabelConnected)
+		assert.Falsef(ok, "connected label should not be set anymore")
+	})
+}
+
+func (suite *MachineStatusSuite) TestMachineReportingEvents() {
+	suite.setup()
+
+	// given
+	machine := omni.NewMachine(resources.DefaultNamespace, testID)
+
+	machineStatusSnapshot := omni.NewMachineStatusSnapshot(resources.DefaultNamespace, testID)
+	machineStatusSnapshot.TypedSpec().Value = &specs.MachineStatusSnapshotSpec{
+		MachineStatus: &machineapi.MachineStatusEvent{},
+	}
+
+	// when
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machine))
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machineStatusSnapshot))
+
+	// then
+	rtestutils.AssertResource(suite.ctx, suite.T(), suite.state, testID, func(status *omni.MachineStatus, assert *assert.Assertions) {
+		_, ok := status.Metadata().Labels().Get(omni.MachineStatusLabelReportingEvents)
+		assert.Truef(ok, "reporting-events label not set")
+	})
+
+	suite.Assert().NoError(suite.state.Destroy(context.Background(), resource.NewMetadata(resources.DefaultNamespace, omni.MachineStatusSnapshotType, testID, resource.VersionUndefined)))
+
+	rtestutils.AssertResource(suite.ctx, suite.T(), suite.state, testID, func(status *omni.MachineStatus, assert *assert.Assertions) {
+		_, ok := status.Metadata().Labels().Get(omni.MachineStatusLabelReportingEvents)
+		assert.Falsef(ok, "reporting-events label should not be set anymore")
+	})
+}
+
+func (suite *MachineStatusSuite) TestMachineUserLabels() {
+	suite.setup()
+
+	machine := omni.NewMachine(resources.DefaultNamespace, testID)
+	spec := machine.TypedSpec().Value
+
+	spec.Connected = true
+	spec.ManagementAddress = suite.socketConnectionString
+
+	metaKey := runtime.NewMetaKey(runtime.NamespaceName, runtime.MetaKeyTagToID(meta.LabelsMeta))
+
+	labels := meta.ImageLabels{
+		Labels: map[string]string{
+			"label1": "value1",
+		},
+	}
+
+	d, err := labels.Encode()
+	suite.Require().NoError(err)
+
+	metaKey.TypedSpec().Value = string(d)
+
+	suite.Require().NoError(suite.machineService.state.Create(suite.ctx, metaKey))
+
+	machineStatusSnapshot := omni.NewMachineStatusSnapshot(resources.DefaultNamespace, testID)
+	machineStatusSnapshot.TypedSpec().Value = &specs.MachineStatusSnapshotSpec{
+		MachineStatus: &machineapi.MachineStatusEvent{},
+	}
+
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machine))
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machineStatusSnapshot))
+
+	ctx, cancel := context.WithTimeout(suite.ctx, time.Second*5)
+	defer cancel()
+
+	// first let's see if initial labels get populated in the resource spec
+
+	rtestutils.AssertResource(ctx, suite.T(), suite.state, testID, func(status *omni.MachineStatus, assert *assert.Assertions) {
+		assert.NotNilf(status.TypedSpec().Value.ImageLabels, "initial labels not loaded")
+
+		val, ok := status.Metadata().Labels().Get("label1")
+		assert.Truef(ok, "label1 is not set in the initial labels")
+		assert.EqualValues("value1", val)
+	})
+
+	// now create user labels and see how it merges initial and user labels
+
+	machineLabels := omni.NewMachineLabels(resources.DefaultNamespace, testID)
+	machineLabels.Metadata().Labels().Set("test", "")
+
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machineLabels))
+
+	rtestutils.AssertResource(ctx, suite.T(), suite.state, testID, func(status *omni.MachineStatus, assert *assert.Assertions) {
+		val, ok := status.Metadata().Labels().Get("label1")
+		assert.Truef(ok, "label1 is not set in the initial labels")
+		assert.EqualValues("value1", val)
+
+		val, ok = status.Metadata().Labels().Get("test")
+		assert.Truef(ok, "label1 is not set in the initial labels")
+		assert.EqualValues("", val)
+	})
+
+	// overwrite initial label value
+
+	_, err = safe.StateUpdateWithConflicts[*omni.MachineLabels](ctx, suite.state, machineLabels.Metadata(), func(ml *omni.MachineLabels) error {
+		ml.Metadata().Labels().Set("label1", "gasp")
+
+		return nil
+	})
+
+	suite.Require().NoError(err)
+
+	rtestutils.AssertResource(ctx, suite.T(), suite.state, testID, func(status *omni.MachineStatus, assert *assert.Assertions) {
+		val, ok := status.Metadata().Labels().Get("label1")
+		assert.Truef(ok, "label1 doesn't exist")
+		assert.EqualValues("gasp", val)
+	})
+
+	// reverts back to initial when the machine labels resource gets removed
+
+	suite.Require().NoError(suite.state.Destroy(ctx, machineLabels.Metadata()))
+
+	rtestutils.AssertResource(ctx, suite.T(), suite.state, testID, func(status *omni.MachineStatus, assert *assert.Assertions) {
+		val, ok := status.Metadata().Labels().Get("label1")
+		assert.Truef(ok, "label1 doesn't exist")
+		assert.EqualValues("value1", val)
+	})
+
+	machineLabels.Metadata().Labels().Set("label2", "aaa")
+
+	suite.Assert().NoError(suite.state.Create(suite.ctx, machineLabels))
+
+	_, err = safe.StateUpdateWithConflicts(ctx, suite.machineService.state, metaKey.Metadata(), func(res *runtime.MetaKey) error {
+		labels.Labels["label1"] = "updated"
+		labels.Labels["label2"] = "override"
+
+		d, err = labels.Encode()
+		if err != nil {
+			return err
+		}
+
+		res.TypedSpec().Value = string(d)
+
+		return nil
+	})
+
+	suite.Require().NoError(err)
+
+	rtestutils.AssertResource(ctx, suite.T(), suite.state, testID, func(status *omni.MachineStatus, assert *assert.Assertions) {
+		val, ok := status.Metadata().Labels().Get("label1")
+		assert.Truef(ok, "label1 doesn't exist")
+		assert.EqualValues("updated", val)
+
+		val, ok = status.Metadata().Labels().Get("label2")
+		assert.Truef(ok, "label2 doesn't exist")
+		assert.EqualValues("aaa", val)
+	})
+}
+
+func (suite *MachineStatusSuite) TestMachineSchematic() {
+	suite.setup()
+
+	machine := omni.NewMachine(resources.DefaultNamespace, testID)
+	spec := machine.TypedSpec().Value
+
+	spec.Connected = true
+	spec.ManagementAddress = suite.socketConnectionString
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, machine))
+
+	defaultSchematic, err := (&schematic.Schematic{}).ID()
+	suite.Require().NoError(err)
+
+	for _, tt := range []struct {
+		expected   *specs.MachineStatusSpec_Schematic
+		name       string
+		extensions []*runtime.ExtensionStatusSpec
+	}{
+		{
+			name: "just schematic id",
+			extensions: []*runtime.ExtensionStatusSpec{
+				{
+					Metadata: extensions.Metadata{
+						Name:        "schematic",
+						Version:     "1234",
+						Description: constants.SchematicIDExtensionName,
+					},
+				},
+			},
+			expected: &specs.MachineStatusSpec_Schematic{
+				Id: "1234",
+			},
+		},
+		{
+			name: "invalid",
+			extensions: []*runtime.ExtensionStatusSpec{
+				{
+					Metadata: extensions.Metadata{
+						Name:        "unknown",
+						Version:     "1",
+						Description: "unknown",
+					},
+				},
+			},
+			expected: &specs.MachineStatusSpec_Schematic{
+				Invalid: true,
+			},
+		},
+		{
+			name: "vanilla autodetect",
+			expected: &specs.MachineStatusSpec_Schematic{
+				Id: defaultSchematic,
+			},
+		},
+	} {
+		suite.T().Run(tt.name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(suite.ctx, time.Second*5)
+			defer cancel()
+
+			rtestutils.DestroyAll[*runtime.ExtensionStatus](ctx, t, suite.machineService.state)
+
+			for _, spec := range tt.extensions {
+				res := runtime.NewExtensionStatus(runtime.NamespaceName, spec.Metadata.Description)
+
+				res.TypedSpec().Image = spec.Image
+				res.TypedSpec().Metadata = spec.Metadata
+
+				suite.Require().NoError(suite.machineService.state.Create(ctx, res))
+			}
+
+			rtestutils.AssertResource(ctx, t, suite.state, testID, func(status *omni.MachineStatus, assert *assert.Assertions) {
+				assert.EqualValues(tt.expected, status.TypedSpec().Value.Schematic)
+			})
+		})
+	}
+}
+
+func TestMachineStatusSuite(t *testing.T) {
+	suite.Run(t, new(MachineStatusSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/machine_test.go b/internal/backend/runtime/omni/controllers/omni/machine_test.go
new file mode 100644
index 000000000..dc6eab4e6
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/machine_test.go
@@ -0,0 +1,66 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type MachineSuite struct {
+	OmniSuite
+}
+
+func (suite *MachineSuite) TestReconcile() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewMachineController()))
+
+	link1 := siderolink.NewLink(siderolink.Namespace, "nodeID1", &specs.SiderolinkSpec{
+		NodePublicKey: "HDAvKeXJAzYtOCaXPLWGASM2BgatwAnCSxrdcwXBxRk=",
+		NodeSubnet:    netip.MustParsePrefix("fdae:41e4:649b:9303:7396:c9b3:213a:a86f/64").String(),
+	})
+	suite.Require().NoError(suite.state.Create(suite.ctx, link1))
+
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewMachine(resources.DefaultNamespace, link1.Metadata().ID()).Metadata(),
+		func(res *omni.Machine, _ *assert.Assertions) {
+			require.Equal(suite.T(), "fdae:41e4:649b:9303:7396:c9b3:213a:a86f", res.TypedSpec().Value.ManagementAddress)
+		},
+	)
+
+	link2 := siderolink.NewLink(siderolink.Namespace, "nodeID2", &specs.SiderolinkSpec{
+		NodePublicKey: "U522JKmQy/99NeMZa537ZHDlkJPv1SYaK0n8NTKIn3w=",
+		NodeSubnet:    netip.MustParsePrefix("fdae:41e4:649b:9303:648e:f4a7:8ca4:ac75/64").String(),
+	})
+
+	suite.Assert().NoError(suite.assertNoResource(*omni.NewMachine(resources.DefaultNamespace, link2.Metadata().ID()).Metadata())())
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, link2))
+
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewMachine(resources.DefaultNamespace, link2.Metadata().ID()).Metadata(),
+		func(res *omni.Machine, _ *assert.Assertions) {
+			require.Equal(suite.T(), "fdae:41e4:649b:9303:648e:f4a7:8ca4:ac75", res.TypedSpec().Value.ManagementAddress)
+		},
+	)
+}
+
+func TestMachineSuite(t *testing.T) {
+	suite.Run(t, new(MachineSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/omni.go b/internal/backend/runtime/omni/controllers/omni/omni.go
new file mode 100644
index 000000000..696220011
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/omni.go
@@ -0,0 +1,252 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package omni contains controllers that are managing Omni resources: Machines, Clusters, etc..
+package omni
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic"
+	"github.com/cosi-project/runtime/pkg/controller/generic/cleanup"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/kvutils"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/xslices"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+const inputResourceVersionAnnotation = "inputResourceVersion"
+
+// UpdateInputsVersions generates a hash of the resource by combining its inputs.
+func UpdateInputsVersions[T resource.Resource](out resource.Resource, inputs ...T) bool {
+	return UpdateInputsAnnotation(out, xslices.Map(inputs, func(input T) string {
+		return fmt.Sprintf("%s/%s@%s", input.Metadata().Type(), input.Metadata().ID(), input.Metadata().Version())
+	})...)
+}
+
+// UpdateInputsAnnotation updates the annotation with the input resource version and returns if it has changed.
+func UpdateInputsAnnotation(out resource.Resource, versions ...string) bool {
+	hash := sha256.New()
+
+	for i, version := range versions {
+		if i > 0 {
+			hash.Write([]byte(","))
+		}
+
+		hash.Write([]byte(version))
+	}
+
+	inVersion := hex.EncodeToString(hash.Sum(nil))
+
+	version, found := out.Metadata().Annotations().Get(inputResourceVersionAnnotation)
+
+	if found && version == inVersion {
+		return false
+	}
+
+	out.Metadata().Annotations().Set(inputResourceVersionAnnotation, inVersion)
+
+	return true
+}
+
+func trackResource(r controller.ReaderWriter, ns resource.Namespace, resourceType resource.Type, listOptions ...state.ListOption) *resourceTracker {
+	return &resourceTracker{
+		touched:     map[string]struct{}{},
+		listMD:      resource.NewMetadata(ns, resourceType, "", resource.VersionUndefined),
+		listOptions: listOptions,
+		r:           r,
+	}
+}
+
+type resourceTracker struct {
+	owner                 string
+	r                     controller.ReaderWriter
+	beforeDestroyCallback func(resource.Resource) error
+	touched               map[resource.ID]struct{}
+	listOptions           []state.ListOption
+	listMD                resource.Metadata
+}
+
+func (rt *resourceTracker) keep(res resource.Resource) {
+	rt.touched[res.Metadata().ID()] = struct{}{}
+}
+
+func (rt *resourceTracker) getItemsToDestroy(ctx context.Context) ([]resource.Resource, error) {
+	var resources []resource.Resource
+
+	list, err := rt.r.List(ctx, rt.listMD, rt.listOptions...)
+	if err != nil {
+		return nil, fmt.Errorf("error listing resources: %w", err)
+	}
+
+	for _, res := range list.Items {
+		if _, ok := rt.touched[res.Metadata().ID()]; !ok {
+			resources = append(resources, res)
+		}
+	}
+
+	return resources, nil
+}
+
+func (rt *resourceTracker) cleanup(ctx context.Context) error {
+	items, err := rt.getItemsToDestroy(ctx)
+	if err != nil {
+		return fmt.Errorf("error getting items to destroy: %w", err)
+	}
+
+	for _, res := range items {
+		if rt.owner != "" && res.Metadata().Owner() != rt.owner {
+			continue
+		}
+
+		var ready bool
+
+		if ready, err = rt.r.Teardown(ctx, res.Metadata()); err != nil {
+			return fmt.Errorf("error tearing down resource '%s': %w", res.Metadata().ID(), err)
+		}
+
+		if !ready {
+			continue
+		}
+
+		if rt.beforeDestroyCallback != nil {
+			if err = rt.beforeDestroyCallback(res); err != nil {
+				return fmt.Errorf("error running before destroy callback for resource '%s': %w", res.Metadata().ID(), err)
+			}
+		}
+
+		if err = rt.r.Destroy(ctx, res.Metadata()); err != nil {
+			return fmt.Errorf("error destroying resource '%s': %w", res.Metadata().ID(), err)
+		}
+	}
+
+	return nil
+}
+
+// BeforeDestroy register the callback which is called before destroying the resource.
+func (rt *resourceTracker) BeforeDestroy(f func(res resource.Resource) error) {
+	rt.beforeDestroyCallback = f
+}
+
+// CopyAllLabels copies all labels from one resource to another.
+func CopyAllLabels(src, dst resource.Resource) {
+	dst.Metadata().Labels().Do(func(tmp kvutils.TempKV) {
+		for key, value := range src.Metadata().Labels().Raw() {
+			tmp.Set(key, value)
+		}
+	})
+}
+
+// CopyLabels copies the labels from one resource to another.
+func CopyLabels(src, dst resource.Resource, keys ...string) {
+	dst.Metadata().Labels().Do(func(tmp kvutils.TempKV) {
+		for _, key := range keys {
+			if label, ok := src.Metadata().Labels().Get(key); ok {
+				tmp.Set(key, label)
+			}
+		}
+	})
+}
+
+// CopyAllAnnotations copies all annotations from one resource to another.
+func CopyAllAnnotations(src, dst resource.Resource) {
+	dst.Metadata().Annotations().Do(func(tmp kvutils.TempKV) {
+		for key, value := range src.Metadata().Annotations().Raw() {
+			tmp.Set(key, value)
+		}
+	})
+}
+
+// CopyAnnotations copies annotations from one resource to another.
+func CopyAnnotations(src, dst resource.Resource, annotations ...string) {
+	dst.Metadata().Annotations().Do(func(tmp kvutils.TempKV) {
+		for _, key := range annotations {
+			if label, ok := src.Metadata().Annotations().Get(key); ok {
+				tmp.Set(key, label)
+			}
+		}
+	})
+}
+
+// CopyUserLabels copies all user labels from one resource to another.
+// It removes all user labels on the target that are not present in the source resource.
+// System labels are not copied.
+func CopyUserLabels(target resource.Resource, labels map[string]string) {
+	ClearUserLabels(target)
+
+	if len(labels) == 0 {
+		return
+	}
+
+	target.Metadata().Labels().Do(func(tmp kvutils.TempKV) {
+		for key, value := range labels {
+			if strings.HasPrefix(key, omni.SystemLabelPrefix) {
+				continue
+			}
+
+			tmp.Set(key, value)
+		}
+	})
+}
+
+// ClearUserLabels removes all user labels from the resource.
+func ClearUserLabels(res resource.Resource) {
+	res.Metadata().Labels().Do(func(tmp kvutils.TempKV) {
+		for key := range res.Metadata().Labels().Raw() {
+			if strings.HasPrefix(key, omni.SystemLabelPrefix) {
+				continue
+			}
+
+			tmp.Delete(key)
+		}
+	})
+}
+
+// withFinalizerCheck wraps a [cleanup.Handler] with a check that needs to pass before the handler is called.
+func withFinalizerCheck[Input generic.ResourceWithRD](handler cleanup.Handler[Input], check func(input Input) error) cleanup.Handler[Input] {
+	return &cleanupChecker[Input]{
+		next:  handler,
+		check: check,
+	}
+}
+
+type cleanupChecker[Input generic.ResourceWithRD] struct {
+	next  cleanup.Handler[Input]
+	check func(input Input) error
+}
+
+// FinalizerRemoval implements [cleanup.Handler].
+// It first runs the check, and only if it passes, it calls the underlying handler's FinalizerRemoval.
+func (c cleanupChecker[Input]) FinalizerRemoval(ctx context.Context, r controller.Runtime, logger *zap.Logger, input Input) error {
+	if err := c.check(input); err != nil {
+		logger.Warn("failed to cleanup outputs for resource", zap.Error(err), zap.String("resource_id", input.Metadata().ID()))
+
+		return nil
+	}
+
+	if err := c.next.FinalizerRemoval(ctx, r, logger, input); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// Inputs implements [cleanup.Handler].
+func (c cleanupChecker[Input]) Inputs() []controller.Input {
+	return c.next.Inputs()
+}
+
+// Outputs implements [cleanup.Handler].
+func (c cleanupChecker[Input]) Outputs() []controller.Output {
+	return c.next.Outputs()
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/omni_test.go b/internal/backend/runtime/omni/controllers/omni/omni_test.go
new file mode 100644
index 000000000..dc5020f97
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/omni_test.go
@@ -0,0 +1,620 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	stdruntime "runtime"
+	"slices"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	cosiv1alpha1 "github.com/cosi-project/runtime/api/v1alpha1"
+	"github.com/cosi-project/runtime/pkg/controller/runtime"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/cosi-project/runtime/pkg/state/protobuf/server"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/siderolabs/talos/pkg/machinery/api/storage"
+	"github.com/siderolabs/talos/pkg/machinery/resources/etcd"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/zap/zaptest"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/emptypb"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	rt "github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime/kubernetes"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+const (
+	testInstallDisk  = "/dev/vda"
+	TalosVersion     = "1.3.0"
+	unixSocket       = "unix://"
+	defaultSchematic = "376567988ad370138ad8b2698212367b8edcb69b5fd68c80be1f2ec7d603b4ba"
+)
+
+//nolint:govet
+type machineService struct {
+	lock sync.Mutex
+
+	machine.UnimplementedMachineServiceServer
+	storage.UnimplementedStorageServiceServer
+
+	etcdMembers             *machine.EtcdMemberListResponse
+	resetChan               chan *machine.ResetRequest
+	applyRequests           []*machine.ApplyConfigurationRequest
+	bootstrapRequests       []*machine.BootstrapRequest
+	upgradeRequests         []*machine.UpgradeRequest
+	resetRequests           []*machine.ResetRequest
+	etcdRecoverRequestCount atomic.Uint64
+	files                   map[string][]string
+	serviceList             *machine.ServiceListResponse
+	etcdLeaveClusterHandler func(context.Context, *machine.EtcdLeaveClusterRequest) (*machine.EtcdLeaveClusterResponse, error)
+
+	address string
+	state   state.State
+}
+
+func (ms *machineService) getUpgradeRequests() []*machine.UpgradeRequest {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	return slices.Clone(ms.upgradeRequests)
+}
+
+func (ms *machineService) clearUpgradeRequests() {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	ms.upgradeRequests = nil
+}
+
+func (ms *machineService) ApplyConfiguration(_ context.Context, req *machine.ApplyConfigurationRequest) (*machine.ApplyConfigurationResponse, error) {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	ms.applyRequests = append(ms.applyRequests, req)
+
+	return &machine.ApplyConfigurationResponse{
+		Messages: []*machine.ApplyConfiguration{
+			{
+				Mode: machine.ApplyConfigurationRequest_NO_REBOOT,
+			},
+		},
+	}, nil
+}
+
+func (ms *machineService) getApplyRequests() []*machine.ApplyConfigurationRequest {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	return ms.applyRequests
+}
+
+func (ms *machineService) Bootstrap(_ context.Context, req *machine.BootstrapRequest) (*machine.BootstrapResponse, error) {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	ms.bootstrapRequests = append(ms.bootstrapRequests, req)
+
+	return &machine.BootstrapResponse{}, nil
+}
+
+func (ms *machineService) getBootstrapRequests() []*machine.BootstrapRequest {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	return ms.bootstrapRequests
+}
+
+func (ms *machineService) Reset(_ context.Context, req *machine.ResetRequest) (*machine.ResetResponse, error) {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	ms.resetRequests = append(ms.resetRequests, req)
+
+	select {
+	case ms.resetChan <- req:
+	default:
+	}
+
+	return &machine.ResetResponse{}, nil
+}
+
+func (ms *machineService) getResetRequests() []*machine.ResetRequest {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	return ms.resetRequests
+}
+
+func (ms *machineService) EtcdMemberList(context.Context, *machine.EtcdMemberListRequest) (*machine.EtcdMemberListResponse, error) {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	if ms.etcdMembers == nil {
+		return nil, status.Error(codes.Unavailable, "member list is not initialized yet")
+	}
+
+	return ms.etcdMembers, nil
+}
+
+func (ms *machineService) EtcdForfeitLeadership(context.Context, *machine.EtcdForfeitLeadershipRequest) (*machine.EtcdForfeitLeadershipResponse, error) {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	return &machine.EtcdForfeitLeadershipResponse{}, nil
+}
+
+func (ms *machineService) EtcdLeaveCluster(ctx context.Context, req *machine.EtcdLeaveClusterRequest) (*machine.EtcdLeaveClusterResponse, error) {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	if ms.etcdLeaveClusterHandler != nil {
+		return ms.etcdLeaveClusterHandler(ctx, req)
+	}
+
+	return &machine.EtcdLeaveClusterResponse{}, nil
+}
+
+func (ms *machineService) EtcdRemoveMember(_ context.Context, req *machine.EtcdRemoveMemberRequest) (*machine.EtcdRemoveMemberResponse, error) {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	for _, msg := range ms.etcdMembers.Messages {
+		for i, member := range msg.Members {
+			if member.Hostname == req.Member {
+				msg.Members = append(msg.Members[:i], msg.Members[i+1:]...)
+
+				return &machine.EtcdRemoveMemberResponse{}, nil
+			}
+		}
+	}
+
+	return nil, fmt.Errorf("member with hostname %s not found", req.Member)
+}
+
+func (ms *machineService) EtcdRemoveMemberByID(_ context.Context, req *machine.EtcdRemoveMemberByIDRequest) (*machine.EtcdRemoveMemberByIDResponse, error) {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	for _, msg := range ms.etcdMembers.Messages {
+		for i, member := range msg.Members {
+			if member.Id == req.MemberId {
+				msg.Members = append(msg.Members[:i], msg.Members[i+1:]...)
+
+				return &machine.EtcdRemoveMemberByIDResponse{}, nil
+			}
+		}
+	}
+
+	return nil, fmt.Errorf("member with id %s not found", etcd.FormatMemberID(req.MemberId))
+}
+
+func (ms *machineService) EtcdRecover(serv machine.MachineService_EtcdRecoverServer) error {
+	ms.etcdRecoverRequestCount.Add(1)
+
+	return serv.SendAndClose(&machine.EtcdRecoverResponse{})
+}
+
+func (ms *machineService) List(req *machine.ListRequest, serv machine.MachineService_ListServer) error {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	for _, f := range ms.files[req.GetRoot()] {
+		if err := serv.Send(&machine.FileInfo{
+			Name: f,
+		}); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (ms *machineService) Upgrade(_ context.Context, request *machine.UpgradeRequest) (*machine.UpgradeResponse, error) {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	ms.upgradeRequests = append(ms.upgradeRequests, request)
+
+	return &machine.UpgradeResponse{}, nil
+}
+
+func (ms *machineService) Disks(context.Context, *emptypb.Empty) (*storage.DisksResponse, error) {
+	return &storage.DisksResponse{}, nil
+}
+
+func (ms *machineService) Version(context.Context, *emptypb.Empty) (*machine.VersionResponse, error) {
+	return &machine.VersionResponse{
+		Messages: []*machine.Version{
+			{
+				Version: &machine.VersionInfo{
+					Tag: "v" + TalosVersion,
+				},
+			},
+		},
+	}, nil
+}
+
+func (ms *machineService) setServiceList(value *machine.ServiceListResponse) {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	ms.serviceList = value
+}
+
+func (ms *machineService) ServiceList(context.Context, *emptypb.Empty) (*machine.ServiceListResponse, error) {
+	ms.lock.Lock()
+	defer ms.lock.Unlock()
+
+	if (ms.serviceList) == nil {
+		return nil, status.Errorf(codes.Internal, "service list is not mocked")
+	}
+
+	return ms.serviceList, nil
+}
+
+type OmniSuite struct { //nolint:govet
+	suite.Suite
+
+	state        state.State
+	stateBuilder dynamicStateBuilder
+
+	runtime *runtime.Runtime
+	wg      sync.WaitGroup
+
+	ctx       context.Context //nolint:containedctx
+	ctxCancel context.CancelFunc
+
+	grpcServers            []*grpc.Server
+	socketPath             string
+	socketConnectionString string
+
+	machineService *machineService
+
+	statesMu sync.Mutex
+	states   map[string]*server.State
+}
+
+// Start a mock gRPC server on the unix socket which is using a temp file,
+// to avoid clashing with other parallel test runs.
+// This server is used as a fake endpoint for each node we create for the cluster.
+// The single server is used for all nodes.
+func (suite *OmniSuite) newServer(suffix string, opts ...grpc.ServerOption) (*machineService, error) {
+	address := suite.socketPath + suffix
+
+	listener, err := net.Listen("unix", address)
+	if err != nil {
+		return nil, err
+	}
+
+	machineServer := grpc.NewServer(opts...)
+	suite.grpcServers = append(suite.grpcServers, machineServer)
+
+	st, err := newTalosState(suite.ctx)
+	suite.Require().NoError(err)
+
+	machineService := &machineService{
+		resetChan: make(chan *machine.ResetRequest, 10),
+		address:   address,
+		state:     st,
+	}
+
+	suite.statesMu.Lock()
+	defer suite.statesMu.Unlock()
+
+	if suite.states == nil {
+		suite.states = make(map[string]*server.State)
+	}
+
+	resourceState := server.NewState(machineService.state)
+
+	machine.RegisterMachineServiceServer(machineServer, machineService)
+	storage.RegisterStorageServiceServer(machineServer, machineService)
+	cosiv1alpha1.RegisterStateServer(machineServer, resourceState)
+
+	go func() {
+		for {
+			err := machineServer.Serve(listener)
+			if err == nil || errors.Is(err, grpc.ErrServerStopped) {
+				break
+			}
+		}
+	}()
+
+	return machineService, nil
+}
+
+func (suite *OmniSuite) SetupTest() {
+	suite.ctx, suite.ctxCancel = context.WithTimeout(context.Background(), 20*time.Second)
+
+	suite.stateBuilder = dynamicStateBuilder{m: map[resource.Namespace]state.CoreState{}}
+
+	suite.state = state.WrapCore(namespaced.NewState(suite.stateBuilder.Builder))
+
+	var err error
+
+	logger := zaptest.NewLogger(suite.T())
+
+	suite.runtime, err = runtime.NewRuntime(suite.state, logger)
+	suite.Require().NoError(err)
+
+	k8s, err := kubernetes.New(suite.state)
+	suite.Require().NoError(err)
+	rt.Install(kubernetes.Name, k8s)
+
+	if stdruntime.GOOS == "darwin" {
+		var temp string
+
+		// check if OS is macOS, because of 108 byte limit on unix socket path
+		// apply custom folder creation logic
+		temp, err = os.MkdirTemp("", "test-*****")
+		suite.Require().NoError(err)
+
+		suite.T().Cleanup(func() {
+			suite.Require().NoError(os.RemoveAll(temp))
+		})
+
+		suite.socketPath = filepath.Join(temp, "socket")
+	} else {
+		suite.socketPath = filepath.Join(suite.T().TempDir(), "socket")
+	}
+
+	suite.socketConnectionString = unixSocket + suite.socketPath
+	suite.machineService, err = suite.newServer("")
+	suite.Require().NoError(err)
+}
+
+func (suite *OmniSuite) startRuntime() {
+	suite.wg.Add(1)
+
+	go func() {
+		defer suite.wg.Done()
+
+		suite.Assert().NoError(suite.runtime.Run(suite.ctx))
+	}()
+}
+
+func (suite *OmniSuite) assertNoResource(md resource.Metadata) func() error {
+	return func() error {
+		_, err := suite.state.Get(suite.ctx, md)
+		if err == nil {
+			return retry.ExpectedErrorf("resource %s still exists", md)
+		}
+
+		if state.IsNotFoundError(err) {
+			return nil
+		}
+
+		return err
+	}
+}
+
+func (suite *OmniSuite) TearDownTest() {
+	suite.T().Log("tear down")
+
+	suite.ctxCancel()
+
+	suite.wg.Wait()
+
+	for _, s := range suite.grpcServers {
+		s.Stop()
+	}
+}
+
+func assertResource[R rtestutils.ResourceWithRD](suite *OmniSuite, md interface{ ID() resource.ID }, assertionFunc func(r R, assertion *assert.Assertions)) {
+	rtestutils.AssertResources(suite.ctx, suite.T(), suite.state, []resource.ID{md.ID()}, assertionFunc)
+}
+
+func assertNoResource[R rtestutils.ResourceWithRD](suite *OmniSuite, r R) {
+	rtestutils.AssertNoResource[R](suite.ctx, suite.T(), suite.state, r.Metadata().ID())
+}
+
+func (suite *OmniSuite) createCluster(clusterName string, controlPlanes, workers int) (*omni.Cluster, []*omni.ClusterMachine) {
+	cluster := omni.NewCluster(resources.DefaultNamespace, clusterName)
+	cluster.TypedSpec().Value.TalosVersion = TalosVersion
+	cluster.TypedSpec().Value.KubernetesVersion = "1.24.1"
+
+	machines := make([]*omni.ClusterMachine, controlPlanes+workers)
+
+	cpMachineSet := omni.NewMachineSet(resources.DefaultNamespace, omni.ControlPlanesResourceID(clusterName))
+	workersMachineSet := omni.NewMachineSet(resources.DefaultNamespace, omni.WorkersResourceID(clusterName))
+
+	cpMachineSet.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+	cpMachineSet.Metadata().Labels().Set(omni.LabelControlPlaneRole, "")
+
+	workersMachineSet.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+	workersMachineSet.Metadata().Labels().Set(omni.LabelWorkerRole, "")
+
+	cpMachineSet.TypedSpec().Value.UpdateStrategy = specs.MachineSetSpec_Rolling
+	workersMachineSet.TypedSpec().Value.UpdateStrategy = specs.MachineSetSpec_Rolling
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, cpMachineSet))
+	suite.Require().NoError(suite.state.Create(suite.ctx, workersMachineSet))
+
+	for i := range machines {
+		clusterMachine := omni.NewClusterMachine(
+			resources.DefaultNamespace,
+			fmt.Sprintf("%s-node-%d", clusterName, i),
+		)
+
+		clusterMachineConfigPatches := omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, clusterMachine.Metadata().ID())
+		clusterMachineConfigPatches.TypedSpec().Value.Patches = []string{
+			`machine:
+      install:
+        disk: ` + testInstallDisk,
+		}
+
+		clusterMachine.TypedSpec().Value.KubernetesVersion = cluster.TypedSpec().Value.KubernetesVersion
+
+		var machineSetNode *omni.MachineSetNode
+
+		machineStatus := omni.NewMachineStatus(
+			resources.DefaultNamespace,
+			clusterMachine.Metadata().ID(),
+		)
+
+		machineState := omni.NewMachine(
+			resources.DefaultNamespace,
+			clusterMachine.Metadata().ID(),
+		)
+
+		machineStatus.TypedSpec().Value.ManagementAddress = suite.socketConnectionString
+		machineStatus.TypedSpec().Value.Schematic = &specs.MachineStatusSpec_Schematic{
+			Id: defaultSchematic,
+		}
+
+		if i < controlPlanes {
+			clusterMachine.Metadata().Labels().Set(omni.LabelControlPlaneRole, "")
+			clusterMachine.Metadata().Labels().Set(omni.LabelMachineSet, cpMachineSet.Metadata().ID())
+
+			machineStatus.TypedSpec().Value.Role = specs.MachineStatusSpec_CONTROL_PLANE
+
+			machineSetNode = omni.NewMachineSetNode(resources.DefaultNamespace, clusterMachine.Metadata().ID(), cpMachineSet)
+		} else {
+			clusterMachine.Metadata().Labels().Set(omni.LabelWorkerRole, "")
+			clusterMachine.Metadata().Labels().Set(omni.LabelMachineSet, workersMachineSet.Metadata().ID())
+
+			machineStatus.TypedSpec().Value.Role = specs.MachineStatusSpec_WORKER
+
+			machineSetNode = omni.NewMachineSetNode(resources.DefaultNamespace, clusterMachine.Metadata().ID(), workersMachineSet)
+		}
+
+		clusterMachine.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+
+		machineStatus.TypedSpec().Value.Cluster = clusterName
+
+		machines[i] = clusterMachine
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, clusterMachineConfigPatches))
+		suite.Require().NoError(suite.state.Create(suite.ctx, clusterMachine))
+		suite.Require().NoError(suite.state.Create(suite.ctx, machineStatus))
+		suite.Require().NoError(suite.state.Create(suite.ctx, machineState))
+		suite.Require().NoError(suite.state.Create(suite.ctx, machineSetNode))
+	}
+
+	// create loadbalancer lbConfig as it's port is used while generating kubernetes endpoint
+	lbConfig := omni.NewLoadBalancerConfig(resources.DefaultNamespace, clusterName)
+	lbConfig.TypedSpec().Value.BindPort = "6443"
+	lbConfig.TypedSpec().Value.SiderolinkEndpoint = "https://siderolink:6443"
+
+	if err := suite.state.Create(suite.ctx, lbConfig); err != nil && !state.IsConflictError(err) {
+		suite.Assert().NoError(err)
+	}
+
+	suite.Assert().NoError(suite.state.Create(suite.ctx, cluster))
+
+	return cluster, machines
+}
+
+func (suite *OmniSuite) destroyCluster(cluster *omni.Cluster) {
+	suite.destroyClusterByID(cluster.Metadata().ID())
+}
+
+func (suite *OmniSuite) destroyClusterByID(clusterID string) {
+	ctx, cancel := context.WithTimeout(suite.ctx, 10*time.Second)
+	defer cancel()
+
+	list, err := safe.StateListAll[*omni.ClusterMachine](ctx, suite.state,
+		state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterID)),
+	)
+
+	suite.Require().NoError(err)
+
+	for iter := list.Iterator(); iter.Next(); {
+		rtestutils.Destroy[*omni.MachineSetNode](ctx, suite.T(), suite.state, []string{iter.Value().Metadata().ID()})
+		rtestutils.Destroy[*omni.ClusterMachine](ctx, suite.T(), suite.state, []string{iter.Value().Metadata().ID()})
+		rtestutils.Destroy[*omni.ClusterMachineConfigPatches](ctx, suite.T(), suite.state, []string{iter.Value().Metadata().ID()})
+		rtestutils.Destroy[*omni.MachineStatus](ctx, suite.T(), suite.state, []string{iter.Value().Metadata().ID()})
+		rtestutils.Destroy[*omni.Machine](ctx, suite.T(), suite.state, []string{iter.Value().Metadata().ID()})
+	}
+
+	machineSets, err := safe.StateListAll[*omni.MachineSet](ctx, suite.state,
+		state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, clusterID)),
+	)
+
+	suite.Require().NoError(err)
+
+	for iter := machineSets.Iterator(); iter.Next(); {
+		rtestutils.Destroy[*omni.MachineSet](ctx, suite.T(), suite.state, []string{iter.Value().Metadata().ID()})
+	}
+
+	rtestutils.Destroy[*omni.Cluster](ctx, suite.T(), suite.state, []string{clusterID})
+
+	assertNoResource[*omni.BackupData](suite, omni.NewBackupData(clusterID))
+	assertNoResource[*omni.EtcdBackupStatus](suite, omni.NewEtcdBackupStatus(clusterID))
+}
+
+func TestUpdateInputsVersions(t *testing.T) {
+	out := omni.NewCluster("default", "test")
+
+	in := []resource.Resource{omni.NewMachine("default", "test1"), omni.NewMachine("default", "test2")}
+
+	assert.True(t, omnictrl.UpdateInputsVersions(out, in...))
+
+	v, _ := out.Metadata().Annotations().Get("inputResourceVersion")
+	assert.Equal(t, "a7a451e614fc3b4a7241798235001fea271c7ad5493c392f0a012104379bdb89", v)
+
+	assert.False(t, omnictrl.UpdateInputsVersions(out, in...))
+
+	in = append(in, omni.NewClusterMachine("default", "cm1"))
+
+	assert.True(t, omnictrl.UpdateInputsVersions(out, in...))
+
+	v, _ = out.Metadata().Annotations().Get("inputResourceVersion")
+	assert.Equal(t, "df4af53c3caf7ae4c0446bcf8b854ed3f5740a47eab0e5151f1962a4a4d52f6f", v)
+}
+
+type dynamicStateBuilder struct { //nolint:govet
+	mx sync.Mutex
+	m  map[resource.Namespace]state.CoreState
+}
+
+func (b *dynamicStateBuilder) Builder(ns resource.Namespace) state.CoreState {
+	b.mx.Lock()
+	defer b.mx.Unlock()
+
+	if s, ok := b.m[ns]; ok {
+		return s
+	}
+
+	s := inmem.Build(ns)
+
+	b.m[ns] = s
+
+	return s
+}
+
+func (b *dynamicStateBuilder) Set(ns resource.Namespace, state state.CoreState) {
+	b.mx.Lock()
+	defer b.mx.Unlock()
+
+	if _, ok := b.m[ns]; ok {
+		panic(fmt.Errorf("state for namespace %s already exists", ns))
+	}
+
+	b.m[ns] = state
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/ongoing_task.go b/internal/backend/runtime/omni/controllers/omni/ongoing_task.go
new file mode 100644
index 000000000..7b4f6ad42
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/ongoing_task.go
@@ -0,0 +1,155 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// OngoingTaskController manages omni.OngoingTask.
+type OngoingTaskController struct{}
+
+// Name implements controller.Controller interface.
+func (ctrl *OngoingTaskController) Name() string {
+	return "OngoingTaskController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *OngoingTaskController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Type:      omni.ClusterDestroyStatusType,
+			Namespace: resources.DefaultNamespace,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Type:      omni.TalosUpgradeStatusType,
+			Namespace: resources.DefaultNamespace,
+			Kind:      controller.InputWeak,
+		},
+		{
+			Type:      omni.KubernetesUpgradeStatusType,
+			Namespace: resources.DefaultNamespace,
+			Kind:      controller.InputWeak,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *OngoingTaskController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.OngoingTaskType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *OngoingTaskController) Run(ctx context.Context, r controller.Runtime, _ *zap.Logger) error {
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+		}
+
+		tracker := trackResource(r, resources.EphemeralNamespace, omni.OngoingTaskType)
+
+		destroyStatuses, err := safe.ReaderListAll[*omni.ClusterDestroyStatus](ctx, r)
+		if err != nil {
+			return err
+		}
+
+		talosUpgradeStatuses, err := safe.ReaderListAll[*omni.TalosUpgradeStatus](ctx, r)
+		if err != nil {
+			return err
+		}
+
+		kubernetesUpgradeStatuses, err := safe.ReaderListAll[*omni.KubernetesUpgradeStatus](ctx, r)
+		if err != nil {
+			return err
+		}
+
+		if err = destroyStatuses.ForEachErr(func(s *omni.ClusterDestroyStatus) error {
+			id := fmt.Sprintf("%s-destroy", s.Metadata().ID())
+
+			task := omni.NewOngoingTask(resources.EphemeralNamespace, id)
+
+			tracker.keep(task)
+
+			return safe.WriterModify(ctx, r, task, func(res *omni.OngoingTask) error {
+				res.TypedSpec().Value.Title = "Destroying Cluster " + s.Metadata().ID()
+				res.TypedSpec().Value.Details = &specs.OngoingTaskSpec_Destroy{
+					Destroy: s.TypedSpec().Value,
+				}
+
+				return nil
+			})
+		}); err != nil {
+			return err
+		}
+
+		if err = talosUpgradeStatuses.ForEachErr(func(s *omni.TalosUpgradeStatus) error {
+			if s.TypedSpec().Value.Status == "" {
+				return nil
+			}
+
+			id := fmt.Sprintf("%s-talos-update", s.Metadata().ID())
+
+			task := omni.NewOngoingTask(resources.EphemeralNamespace, id)
+
+			tracker.keep(task)
+
+			return safe.WriterModify(ctx, r, task, func(res *omni.OngoingTask) error {
+				res.TypedSpec().Value.Title = "Updating Cluster " + s.Metadata().ID()
+				res.TypedSpec().Value.Details = &specs.OngoingTaskSpec_TalosUpgrade{
+					TalosUpgrade: s.TypedSpec().Value,
+				}
+
+				return nil
+			})
+		}); err != nil {
+			return err
+		}
+
+		if err = kubernetesUpgradeStatuses.ForEachErr(func(s *omni.KubernetesUpgradeStatus) error {
+			if s.TypedSpec().Value.Step == "" {
+				return nil
+			}
+
+			id := fmt.Sprintf("%s-kubernetes-update", s.Metadata().ID())
+
+			task := omni.NewOngoingTask(resources.EphemeralNamespace, id)
+
+			tracker.keep(task)
+
+			return safe.WriterModify(ctx, r, task, func(res *omni.OngoingTask) error {
+				res.TypedSpec().Value.Title = "Updating Cluster " + s.Metadata().ID()
+				res.TypedSpec().Value.Details = &specs.OngoingTaskSpec_KubernetesUpgrade{
+					KubernetesUpgrade: s.TypedSpec().Value,
+				}
+
+				return nil
+			})
+		}); err != nil {
+			return err
+		}
+
+		if err = tracker.cleanup(ctx); err != nil {
+			return err
+		}
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/redacted_cluster_machine_config.go b/internal/backend/runtime/omni/controllers/omni/redacted_cluster_machine_config.go
new file mode 100644
index 000000000..60e0bdef9
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/redacted_cluster_machine_config.go
@@ -0,0 +1,63 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/siderolabs/crypto/x509"
+	"github.com/siderolabs/talos/pkg/machinery/config/configloader"
+	"github.com/siderolabs/talos/pkg/machinery/config/encoder"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// RedactedClusterMachineConfigController manages machine configurations for each ClusterMachine.
+//
+// RedactedClusterMachineConfigController generates machine configuration for each created machine.
+type RedactedClusterMachineConfigController = qtransform.QController[*omni.ClusterMachineConfig, *omni.RedactedClusterMachineConfig]
+
+// NewRedactedClusterMachineConfigController initializes RedactedClusterMachineConfigController.
+func NewRedactedClusterMachineConfigController() *RedactedClusterMachineConfigController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.ClusterMachineConfig, *omni.RedactedClusterMachineConfig]{
+			Name: "RedactedClusterMachineConfigController",
+			MapMetadataFunc: func(cmc *omni.ClusterMachineConfig) *omni.RedactedClusterMachineConfig {
+				return omni.NewRedactedClusterMachineConfig(resources.DefaultNamespace, cmc.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(cmcr *omni.RedactedClusterMachineConfig) *omni.ClusterMachineConfig {
+				return omni.NewClusterMachineConfig(resources.DefaultNamespace, cmcr.Metadata().ID())
+			},
+			TransformFunc: func(_ context.Context, _ controller.Reader, _ *zap.Logger, cmc *omni.ClusterMachineConfig, cmcr *omni.RedactedClusterMachineConfig) error {
+				data := cmc.TypedSpec().Value.GetData()
+
+				if data == nil {
+					cmcr.TypedSpec().Value.Data = ""
+
+					return nil
+				}
+
+				config, err := configloader.NewFromBytes(cmc.TypedSpec().Value.GetData())
+				if err != nil {
+					return err
+				}
+
+				redactedData, err := config.RedactSecrets(x509.Redacted).EncodeBytes(encoder.WithComments(encoder.CommentsDisabled))
+				if err != nil {
+					return err
+				}
+
+				cmcr.TypedSpec().Value.Data = string(redactedData)
+
+				return nil
+			},
+		},
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/redacted_cluster_machine_config_test.go b/internal/backend/runtime/omni/controllers/omni/redacted_cluster_machine_config_test.go
new file mode 100644
index 000000000..09795e467
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/redacted_cluster_machine_config_test.go
@@ -0,0 +1,73 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/siderolabs/crypto/x509"
+	"github.com/siderolabs/talos/pkg/machinery/config/generate"
+	"github.com/siderolabs/talos/pkg/machinery/config/machine"
+	"github.com/siderolabs/talos/pkg/machinery/constants"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type RedactedClusterMachineConfigSuite struct {
+	OmniSuite
+}
+
+func (suite *RedactedClusterMachineConfigSuite) TestReconcile() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewClusterMachineConfigController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewRedactedClusterMachineConfigController()))
+
+	id := "test"
+
+	cmc := omni.NewClusterMachineConfig(resources.DefaultNamespace, id)
+
+	cmc.TypedSpec().Value.Data = suite.generateConfig()
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, cmc))
+
+	rtestutils.AssertResources(suite.ctx, suite.T(), suite.state, []string{id},
+		func(rcmc *omni.RedactedClusterMachineConfig, assert *assert.Assertions) {
+			assert.Contains(rcmc.TypedSpec().Value.Data, x509.Redacted)
+		},
+	)
+
+	rtestutils.Destroy[*omni.ClusterMachineConfig](suite.ctx, suite.T(), suite.state, []resource.ID{id})
+
+	rtestutils.AssertNoResource[*omni.RedactedClusterMachineConfig](suite.ctx, suite.T(), suite.state, id)
+}
+
+func (suite *RedactedClusterMachineConfigSuite) generateConfig() []byte {
+	input, err := generate.NewInput(
+		"does-not-matter",
+		"https://doesntmatter:6443",
+		constants.DefaultKubernetesVersion,
+	)
+	suite.Require().NoError(err)
+
+	config, err := input.Config(machine.TypeControlPlane)
+	suite.Require().NoError(err)
+
+	data, err := config.Bytes()
+	suite.Require().NoError(err)
+
+	return data
+}
+
+func TestRedactedClusterMachineConfigSuite(t *testing.T) {
+	suite.Run(t, new(RedactedClusterMachineConfigSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/saml_assertion.go b/internal/backend/runtime/omni/controllers/omni/saml_assertion.go
new file mode 100644
index 000000000..2bd1292c5
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/saml_assertion.go
@@ -0,0 +1,79 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+)
+
+// SAMLAssertionController manages SAMLAssertion resource lifecycle.
+type SAMLAssertionController struct{}
+
+// Name implements controller.Controller interface.
+func (ctrl *SAMLAssertionController) Name() string {
+	return "SAMLAssertionController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *SAMLAssertionController) Inputs() []controller.Input {
+	return []controller.Input{
+		{
+			Type:      auth.SAMLAssertionType,
+			Kind:      controller.InputWeak,
+			Namespace: resources.DefaultNamespace,
+		},
+	}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *SAMLAssertionController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: auth.SAMLAssertionType,
+			Kind: controller.OutputShared,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *SAMLAssertionController) Run(ctx context.Context, r controller.Runtime, _ *zap.Logger) error {
+	ticker := time.NewTicker(time.Hour)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-r.EventCh():
+		case <-ticker.C:
+		}
+
+		sessions, err := safe.ReaderListAll[*auth.SAMLAssertion](ctx, r)
+		if err != nil {
+			return fmt.Errorf("error listing Cluster resources: %w", err)
+		}
+
+		for iter := sessions.Iterator(); iter.Next(); {
+			assertion := iter.Value()
+
+			if time.Since(assertion.Metadata().Created()) > time.Hour*24 {
+				err = r.Destroy(ctx, assertion.Metadata(), controller.WithOwner(""))
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/secrets.go b/internal/backend/runtime/omni/controllers/omni/secrets.go
new file mode 100644
index 000000000..96a712e49
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/secrets.go
@@ -0,0 +1,165 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/xerrors"
+	"github.com/siderolabs/talos/pkg/machinery/config"
+	talossecrets "github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup/store"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/mappers"
+)
+
+// SecretsController creates omni.ClusterSecrets for each inputed omni.Cluster.
+//
+// SecretsController generates and stores cluster wide secrets.
+type SecretsController = qtransform.QController[*omni.Cluster, *omni.ClusterSecrets]
+
+// NewSecretsController instantiates the secrets controller.
+func NewSecretsController(etcdBackupStoreFactory store.Factory) *SecretsController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.Cluster, *omni.ClusterSecrets]{
+			Name: "SecretsController",
+			MapMetadataFunc: func(cluster *omni.Cluster) *omni.ClusterSecrets {
+				return omni.NewClusterSecrets(resources.DefaultNamespace, cluster.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(secrets *omni.ClusterSecrets) *omni.Cluster {
+				return omni.NewCluster(resources.DefaultNamespace, secrets.Metadata().ID())
+			},
+			TransformFunc: func(ctx context.Context, r controller.Reader, _ *zap.Logger, cluster *omni.Cluster, secrets *omni.ClusterSecrets) error {
+				if len(secrets.TypedSpec().Value.GetData()) != 0 {
+					// cluster already has secrets, skipping
+					return nil
+				}
+
+				versionContract, err := config.ParseContractFromVersion("v" + cluster.TypedSpec().Value.TalosVersion)
+				if err != nil {
+					return err
+				}
+
+				cpMachineSet, err := safe.ReaderGetByID[*omni.MachineSet](ctx, r, omni.ControlPlanesResourceID(cluster.Metadata().ID()))
+				if err != nil {
+					if state.IsNotFoundError(err) { // need to wait for control plane to be created, so we can decide if we need to get secrets from an etcd backup or not
+						return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+					}
+
+					return err
+				}
+
+				bundle, err := talossecrets.NewBundle(talossecrets.NewFixedClock(time.Now()), versionContract)
+				if err != nil {
+					return fmt.Errorf("error generating secrets: %w", err)
+				}
+
+				bootstrapSpec := cpMachineSet.TypedSpec().Value.GetBootstrapSpec()
+				if bootstrapSpec != nil {
+					var backupData etcdbackup.BackupData
+
+					backupData, err = getBackupDataFromBootstrapSpec(ctx, r, etcdBackupStoreFactory, bootstrapSpec)
+					if err != nil {
+						return err
+					}
+
+					bundle.Secrets.AESCBCEncryptionSecret = backupData.AESCBCEncryptionSecret
+					bundle.Secrets.SecretboxEncryptionSecret = backupData.SecretboxEncryptionSecret
+				}
+
+				data, err := json.Marshal(bundle)
+				if err != nil {
+					return fmt.Errorf("error marshaling secrets: %w", err)
+				}
+
+				secrets.TypedSpec().Value.Data = data
+
+				return nil
+			},
+			FinalizerRemovalFunc: func(ctx context.Context, r controller.Reader, _ *zap.Logger, cluster *omni.Cluster) error {
+				clusterMachines, err := r.List(
+					ctx,
+					resource.NewMetadata(resources.DefaultNamespace, omni.ClusterMachineType, "", resource.VersionUndefined),
+					state.WithLabelQuery(
+						resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID()),
+					),
+				)
+				if err != nil {
+					return err
+				}
+
+				if len(clusterMachines.Items) != 0 {
+					// cluster still has machines, skipping
+					return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("cluster %q still has machines", cluster.Metadata().ID())
+				}
+
+				return nil
+			},
+		},
+		qtransform.WithExtraMappedInput(
+			mappers.MapByClusterLabel[*omni.ClusterMachine, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByClusterLabelOnlyControlplane[*omni.MachineSet, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			// no need to requeue anything, just allow the controller to read data (when restoring from another cluster backup)
+			qtransform.MapperNone[*omni.ClusterUUID](),
+		),
+		qtransform.WithExtraMappedInput(
+			// no need to requeue anything, just allow the controller to read data (when restoring from another cluster backup)
+			qtransform.MapperNone[*omni.BackupData](),
+		),
+	)
+}
+
+func getBackupDataFromBootstrapSpec(ctx context.Context, r controller.Reader, etcdBackupStoreFactory store.Factory, spec *specs.MachineSetSpec_BootstrapSpec) (etcdbackup.BackupData, error) {
+	backupStore, err := etcdBackupStoreFactory.GetStore()
+	if err != nil {
+		return etcdbackup.BackupData{}, fmt.Errorf("failed to get backup store: %w", err)
+	}
+
+	clusterUUIDList, err := safe.ReaderListAll[*omni.ClusterUUID](ctx, r, state.WithLabelQuery(resource.LabelEqual(omni.LabelClusterUUID, spec.GetClusterUuid())))
+	if err != nil {
+		return etcdbackup.BackupData{}, fmt.Errorf("failed to list cluster UUIDs for cluster %q: %w", spec.GetClusterUuid(), err)
+	}
+
+	if clusterUUIDList.Len() == 0 {
+		return etcdbackup.BackupData{}, fmt.Errorf("cluster UUID %q not found", spec.GetClusterUuid())
+	} else if clusterUUIDList.Len() > 1 {
+		return etcdbackup.BackupData{}, fmt.Errorf("multiple cluster UUIDs found for cluster %q", spec.GetClusterUuid())
+	}
+
+	clusterUUID := clusterUUIDList.Get(0)
+	clusterID := clusterUUID.Metadata().ID()
+
+	backupData, err := safe.ReaderGetByID[*omni.BackupData](ctx, r, clusterID)
+	if err != nil {
+		return etcdbackup.BackupData{}, fmt.Errorf("failed to get backup data for cluster %q: %w", clusterID, err)
+	}
+
+	downloadedBackupData, readCloser, err := backupStore.Download(ctx, backupData.TypedSpec().Value.GetEncryptionKey(), spec.GetClusterUuid(), spec.GetSnapshot())
+	if err != nil {
+		return etcdbackup.BackupData{}, fmt.Errorf("failed to download backup data for cluster %q: %w", clusterID, err)
+	}
+
+	defer readCloser.Close() //nolint:errcheck
+
+	return downloadedBackupData, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/secrets_test.go b/internal/backend/runtime/omni/controllers/omni/secrets_test.go
new file mode 100644
index 000000000..a04433049
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/secrets_test.go
@@ -0,0 +1,158 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+)
+
+type ClusterSecretsSuite struct {
+	OmniSuite
+}
+
+func (suite *ClusterSecretsSuite) TestNewSecrets() {
+	require := suite.Require()
+
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewSecretsController(nil)))
+
+	cluster := omni.NewCluster(resources.DefaultNamespace, "clusterID")
+	cluster.TypedSpec().Value.TalosVersion = "1.2.3"
+	require.NoError(suite.state.Create(suite.ctx, cluster))
+
+	machineSet := omni.NewMachineSet(resources.DefaultNamespace, omni.ControlPlanesResourceID(cluster.Metadata().ID()))
+	require.NoError(suite.state.Create(suite.ctx, machineSet))
+
+	var foundClusterSecrets *omni.ClusterSecrets
+
+	// The only test I could think at this time, was simply to test bundle existence.
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewClusterSecrets(resources.DefaultNamespace, cluster.Metadata().ID()).Metadata(),
+		func(res *omni.ClusterSecrets, _ *assert.Assertions) {
+			foundClusterSecrets = res
+			clusterSecretsSpec := foundClusterSecrets.TypedSpec().Value
+			suite.Require().NotEmpty(clusterSecretsSpec.GetData())
+
+			var bundle secrets.Bundle
+			err := json.Unmarshal(clusterSecretsSpec.Data, &bundle)
+			suite.Require().NoError(err)
+			suite.Require().NotEmpty(bundle)
+		})
+
+	// Check that we can get cluster secrets by metadata.
+	assertResource(
+		&suite.OmniSuite,
+		*foundClusterSecrets.Metadata(),
+		func(*omni.ClusterSecrets, *assert.Assertions) {},
+	)
+
+	// Check that cluster secrets will be removed when cluster is removed.
+	rtestutils.Destroy[*omni.Cluster](suite.ctx, suite.T(), suite.state, []resource.ID{cluster.Metadata().ID()})
+	assertNoResource(&suite.OmniSuite, foundClusterSecrets)
+}
+
+type mockBackupStore struct{}
+
+func (m *mockBackupStore) ListBackups(context.Context, string) (etcdbackup.InfoIterator, error) {
+	return nil, nil
+}
+
+func (m *mockBackupStore) Upload(context.Context, etcdbackup.Description, io.Reader) error {
+	return nil
+}
+
+func (m *mockBackupStore) Download(context.Context, []byte, string, string) (etcdbackup.BackupData, io.ReadCloser, error) {
+	return etcdbackup.BackupData{
+		AESCBCEncryptionSecret:    "aes-cbc-test",
+		SecretboxEncryptionSecret: "secretbox-test",
+	}, io.NopCloser(bytes.NewReader(nil)), nil
+}
+
+type mockBackupStoreFactory struct{}
+
+func (m *mockBackupStoreFactory) GetStore() (etcdbackup.Store, error) { return &mockBackupStore{}, nil }
+
+func (m *mockBackupStoreFactory) Start(context.Context, state.State, *zap.Logger) error { return nil }
+
+func (m *mockBackupStoreFactory) Description() string { return "" }
+
+func (suite *ClusterSecretsSuite) TestSecretsFromBackup() {
+	require := suite.Require()
+
+	suite.startRuntime()
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewSecretsController(&mockBackupStoreFactory{})))
+
+	cluster := omni.NewCluster(resources.DefaultNamespace, "clusterID")
+	cluster.TypedSpec().Value.TalosVersion = "1.2.3"
+
+	require.NoError(suite.state.Create(suite.ctx, cluster))
+
+	// create ClusterUUID, as it will be looked up by SecretsController to find the source cluster ID
+	clusterUUID := omni.NewClusterUUID(cluster.Metadata().ID())
+	clusterUUID.TypedSpec().Value.Uuid = "test-uuid"
+
+	clusterUUID.Metadata().Labels().Set(omni.LabelClusterUUID, "test-uuid")
+
+	require.NoError(suite.state.Create(suite.ctx, clusterUUID))
+
+	// create BackupData, as it will be looked up by SecretsController to get the encryption key
+	backupData := omni.NewBackupData(cluster.Metadata().ID())
+
+	require.NoError(suite.state.Create(suite.ctx, backupData))
+
+	machineSet := omni.NewMachineSet(resources.DefaultNamespace, omni.ControlPlanesResourceID(cluster.Metadata().ID()))
+	machineSet.TypedSpec().Value.BootstrapSpec = &specs.MachineSetSpec_BootstrapSpec{
+		ClusterUuid: "test-uuid",
+		Snapshot:    "test-snapshot",
+	}
+
+	require.NoError(suite.state.Create(suite.ctx, machineSet))
+
+	var foundClusterSecrets *omni.ClusterSecrets
+
+	// The only test I could think at this time, was simply to test bundle existence.
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewClusterSecrets(resources.DefaultNamespace, cluster.Metadata().ID()).Metadata(),
+		func(res *omni.ClusterSecrets, _ *assert.Assertions) {
+			foundClusterSecrets = res
+			clusterSecretsSpec := foundClusterSecrets.TypedSpec().Value
+			suite.Require().NotEmpty(clusterSecretsSpec.GetData())
+
+			var bundle secrets.Bundle
+			err := json.Unmarshal(clusterSecretsSpec.Data, &bundle)
+			suite.Require().NoError(err)
+			suite.Require().NotEmpty(bundle)
+
+			// assert that the AES-CBC and Secretbox encryption secrets are set to the values from the backup data
+			suite.Require().Equal("aes-cbc-test", bundle.Secrets.AESCBCEncryptionSecret)
+			suite.Require().Equal("secretbox-test", bundle.Secrets.SecretboxEncryptionSecret)
+		})
+}
+
+func TestClusterSecretsSuite(t *testing.T) {
+	suite.Run(t, new(ClusterSecretsSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/talos_extensions.go b/internal/backend/runtime/omni/controllers/omni/talos_extensions.go
new file mode 100644
index 000000000..8430e8504
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/talos_extensions.go
@@ -0,0 +1,86 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/siderolabs/gen/xerrors"
+	"github.com/siderolabs/image-factory/pkg/client"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+// TalosExtensionsController creates omni.TalosExtensions for each omni.TalosVersion.
+//
+// TalosExtensionsController generates information about Talos extensions available for a Talos version.
+type TalosExtensionsController = qtransform.QController[*omni.TalosVersion, *omni.TalosExtensions]
+
+// NewTalosExtensionsController instantiates the TalosExtensions controller.
+func NewTalosExtensionsController() *TalosExtensionsController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.TalosVersion, *omni.TalosExtensions]{
+			Name: "TalosExtensionsController",
+			MapMetadataFunc: func(version *omni.TalosVersion) *omni.TalosExtensions {
+				return omni.NewTalosExtensions(resources.DefaultNamespace, version.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(r *omni.TalosExtensions) *omni.TalosVersion {
+				return omni.NewTalosVersion(resources.DefaultNamespace, r.Metadata().ID())
+			},
+			TransformFunc: func(ctx context.Context, _ controller.Reader, _ *zap.Logger, version *omni.TalosVersion, extensionsResource *omni.TalosExtensions) error {
+				factoryClient, err := client.New(config.Config.ImageFactoryBaseURL)
+				if err != nil {
+					return fmt.Errorf("failed to get image factory client %w", err)
+				}
+
+				versions, err := factoryClient.Versions(ctx)
+				if err != nil {
+					return fmt.Errorf("failed to get existing image factory Talos versions %w", err)
+				}
+
+				hasVersion := slices.Index(versions, version.Metadata().ID()) != -1
+
+				// skip fetching Talos extensions for a version which isn't registered in the image factory
+				if !hasVersion {
+					return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("version %q is not registered in the image factory", version.Metadata().ID())
+				}
+
+				extensionsVersions, err := factoryClient.ExtensionsVersions(ctx, version.TypedSpec().Value.Version)
+				if err != nil {
+					return controller.NewRequeueErrorf(time.Minute*5, "failed to get extension versions from the image factory %w", err)
+				}
+
+				extensionsResource.TypedSpec().Value.Items = make([]*specs.TalosExtensionsSpec_Info, 0, len(extensionsVersions))
+
+				for _, ev := range extensionsVersions {
+					info := &specs.TalosExtensionsSpec_Info{
+						Name:        ev.Name,
+						Digest:      ev.Digest,
+						Ref:         ev.Ref,
+						Author:      ev.Author,
+						Description: ev.Description,
+					}
+
+					_, info.Version, _ = strings.Cut(ev.Ref, ":")
+
+					extensionsResource.TypedSpec().Value.Items = append(extensionsResource.TypedSpec().Value.Items, info)
+				}
+
+				return nil
+			},
+		},
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/talos_extensions_test.go b/internal/backend/runtime/omni/controllers/omni/talos_extensions_test.go
new file mode 100644
index 000000000..d28eecce6
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/talos_extensions_test.go
@@ -0,0 +1,202 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/julienschmidt/httprouter"
+	"github.com/siderolabs/image-factory/pkg/client"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+//nolint:govet
+type imageFactoryMock struct {
+	listener           net.Listener
+	talosVersions      []string
+	extensionsVersions map[string][]client.ExtensionInfo
+	eg                 errgroup.Group
+	address            string
+}
+
+func (m *imageFactoryMock) run() error {
+	var err error
+
+	m.listener, err = net.Listen("tcp", ":0")
+	if err != nil {
+		return err
+	}
+
+	m.address = fmt.Sprintf("http://%s", m.listener.Addr().String())
+
+	return nil
+}
+
+func (m *imageFactoryMock) serve(ctx context.Context) {
+	router := httprouter.New()
+	router.GET("/version/:version/extensions/official", m.handleVersions)
+	router.GET("/versions", m.handleTalosVersions)
+
+	server := http.Server{
+		Handler: router,
+	}
+
+	m.eg.Go(func() error {
+		if err := server.Serve(m.listener); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			return err
+		}
+
+		return nil
+	})
+
+	m.eg.Go(func() error {
+		<-ctx.Done()
+
+		innerContext, cancel := context.WithTimeout(ctx, time.Second)
+
+		defer cancel()
+
+		return server.Shutdown(innerContext)
+	})
+}
+
+func (m *imageFactoryMock) handleTalosVersions(rw http.ResponseWriter, _ *http.Request, _ httprouter.Params) {
+	rw.WriteHeader(http.StatusOK)
+
+	resp, err := json.Marshal(m.talosVersions)
+	if err != nil {
+		rw.WriteHeader(http.StatusInternalServerError)
+		rw.Write([]byte(err.Error())) //nolint:errcheck
+
+		return
+	}
+
+	rw.Write(resp) //nolint:errcheck
+}
+
+func (m *imageFactoryMock) handleVersions(rw http.ResponseWriter, _ *http.Request, params httprouter.Params) {
+	version := params.ByName("version")
+
+	versions, ok := m.extensionsVersions[version]
+	if !ok {
+		rw.WriteHeader(http.StatusInternalServerError)
+		rw.Write([]byte("version not supported")) //nolint:errcheck
+
+		return
+	}
+
+	rw.Header().Add("Content-Type", "application/json")
+
+	resp, err := json.Marshal(versions)
+	if err != nil {
+		rw.WriteHeader(http.StatusInternalServerError)
+		rw.Write([]byte(err.Error())) //nolint:errcheck
+
+		return
+	}
+
+	rw.Write(resp) //nolint:errcheck
+}
+
+type TalosExtensionsSuite struct {
+	OmniSuite
+}
+
+func (suite *TalosExtensionsSuite) TestReconcile() {
+	ctx, cancel := context.WithTimeout(suite.ctx, time.Second*5)
+	defer cancel()
+
+	factory := imageFactoryMock{
+		extensionsVersions: map[string][]client.ExtensionInfo{
+			"v1.6.0": {
+				{
+					Name:        "siderolabs/hello-world-service",
+					Ref:         "github.com/siderolabs/hello-world-service:v1.6.0",
+					Digest:      "aaaa",
+					Author:      "Sidero Labs",
+					Description: "This system extension provides an example Talos extension service.",
+				},
+			},
+			"v200.0.0": {
+				{
+					Name:   "siderolabs/hello-future",
+					Ref:    "github.com/siderolabs/hello-future:v200.0.0",
+					Digest: "aaaa",
+				},
+			},
+		},
+	}
+	suite.Require().NoError(factory.run())
+
+	factory.serve(ctx)
+
+	defer func() {
+		cancel()
+
+		factory.eg.Wait() //nolint:errcheck
+	}()
+
+	config.Config.ImageFactoryBaseURL = factory.address
+
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosExtensionsController()))
+
+	versions := []string{
+		"v0.14.0", "v1.6.0", "v200.0.0",
+	}
+
+	factory.talosVersions = versions[1:]
+
+	for _, v := range versions {
+		version := omni.NewTalosVersion(resources.DefaultNamespace, v)
+		version.TypedSpec().Value.Version = v
+
+		suite.Require().NoError(suite.state.Create(ctx, version))
+	}
+
+	rtestutils.AssertNoResource[*omni.TalosExtensions](ctx, suite.T(), suite.state, versions[0])
+
+	rtestutils.AssertResources(ctx, suite.T(), suite.state, versions[1:], func(res *omni.TalosExtensions, assert *assert.Assertions) {
+		assert.Len(res.TypedSpec().Value.Items, 1, "no extensions for version %s", res.Metadata().ID())
+		manifest := res.TypedSpec().Value.Items[0]
+
+		switch res.Metadata().ID() {
+		case "v1.6.0":
+			assert.EqualValues("Sidero Labs", manifest.Author)
+			assert.EqualValues("This system extension provides an example Talos extension service.", manifest.Description)
+			assert.EqualValues("aaaa", manifest.Digest)
+			assert.EqualValues("v1.6.0", manifest.Version)
+			assert.EqualValues("siderolabs/hello-world-service", manifest.Name)
+			assert.EqualValues("github.com/siderolabs/hello-world-service:v1.6.0", manifest.Ref)
+			// no info in the manifests, should still be in the list but without additional info
+		case "v200.0.0":
+			assert.EqualValues("v200.0.0", manifest.Version)
+			assert.EqualValues("siderolabs/hello-future", manifest.Name)
+			assert.EqualValues("aaaa", manifest.Digest)
+			assert.EqualValues("", manifest.Description)
+		}
+	})
+}
+
+func TestTalosExtensionsSuite(t *testing.T) {
+	suite.Run(t, new(TalosExtensionsSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/talos_test.go b/internal/backend/runtime/omni/controllers/omni/talos_test.go
new file mode 100644
index 000000000..affb4d895
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/talos_test.go
@@ -0,0 +1,197 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/cosi-project/runtime/pkg/state/registry"
+	"github.com/siderolabs/talos/pkg/machinery/resources/cluster"
+	"github.com/siderolabs/talos/pkg/machinery/resources/config"
+	"github.com/siderolabs/talos/pkg/machinery/resources/cri"
+	"github.com/siderolabs/talos/pkg/machinery/resources/etcd"
+	"github.com/siderolabs/talos/pkg/machinery/resources/files"
+	"github.com/siderolabs/talos/pkg/machinery/resources/hardware"
+	"github.com/siderolabs/talos/pkg/machinery/resources/k8s"
+	"github.com/siderolabs/talos/pkg/machinery/resources/kubeaccess"
+	"github.com/siderolabs/talos/pkg/machinery/resources/kubespan"
+	"github.com/siderolabs/talos/pkg/machinery/resources/network"
+	"github.com/siderolabs/talos/pkg/machinery/resources/perf"
+	"github.com/siderolabs/talos/pkg/machinery/resources/runtime"
+	"github.com/siderolabs/talos/pkg/machinery/resources/secrets"
+	"github.com/siderolabs/talos/pkg/machinery/resources/siderolink"
+	"github.com/siderolabs/talos/pkg/machinery/resources/time"
+	"github.com/siderolabs/talos/pkg/machinery/resources/v1alpha1"
+)
+
+// newTalosState creates State.
+func newTalosState(ctx context.Context) (state.State, error) {
+	state := state.WrapCore(namespaced.NewState(
+		func(ns string) state.CoreState {
+			return inmem.NewStateWithOptions(
+				inmem.WithHistoryInitialCapacity(8),
+				inmem.WithHistoryMaxCapacity(1024),
+				inmem.WithHistoryGap(4),
+			)(ns)
+		},
+	))
+	namespaceRegistry := registry.NewNamespaceRegistry(state)
+	resourceRegistry := registry.NewResourceRegistry(state)
+
+	if err := namespaceRegistry.RegisterDefault(ctx); err != nil {
+		return nil, err
+	}
+
+	if err := resourceRegistry.RegisterDefault(ctx); err != nil {
+		return nil, err
+	}
+
+	// register Talos namespaces
+	for _, ns := range []struct {
+		name        string
+		description string
+	}{
+		{v1alpha1.NamespaceName, "Talos v1alpha1 subsystems glue resources."},
+		{cluster.NamespaceName, "Cluster configuration and discovery resources."},
+		{cluster.RawNamespaceName, "Cluster unmerged raw resources."},
+		{config.NamespaceName, "Talos node configuration."},
+		{etcd.NamespaceName, "etcd resources."},
+		{files.NamespaceName, "Files and file-like resources."},
+		{hardware.NamespaceName, "Hardware resources."},
+		{k8s.NamespaceName, "Kubernetes all node types resources."},
+		{k8s.ControlPlaneNamespaceName, "Kubernetes control plane resources."},
+		{kubespan.NamespaceName, "KubeSpan resources."},
+		{network.NamespaceName, "Networking resources."},
+		{network.ConfigNamespaceName, "Networking configuration resources."},
+		{cri.NamespaceName, "CRI Seccomp resources."},
+		{secrets.NamespaceName, "Resources with secret material."},
+		{perf.NamespaceName, "Stats resources."},
+	} {
+		if err := namespaceRegistry.Register(ctx, ns.name, ns.description); err != nil {
+			return nil, err
+		}
+	}
+
+	// register Talos resources
+	for _, r := range []meta.ResourceWithRD{
+		&cluster.Affiliate{},
+		&cluster.Config{},
+		&cluster.Identity{},
+		&cluster.Info{},
+		&cluster.Member{},
+		&config.MachineConfig{},
+		&config.MachineType{},
+		&cri.SeccompProfile{},
+		&etcd.Config{},
+		&etcd.PKIStatus{},
+		&etcd.Spec{},
+		&etcd.Member{},
+		&files.EtcFileSpec{},
+		&files.EtcFileStatus{},
+		&hardware.Processor{},
+		&hardware.MemoryModule{},
+		&hardware.SystemInformation{},
+		&k8s.AdmissionControlConfig{},
+		&k8s.AuditPolicyConfig{},
+		&k8s.APIServerConfig{},
+		&k8s.KubePrismEndpoints{},
+		&k8s.ConfigStatus{},
+		&k8s.ControllerManagerConfig{},
+		&k8s.Endpoint{},
+		&k8s.ExtraManifestsConfig{},
+		&k8s.KubeletConfig{},
+		&k8s.KubeletLifecycle{},
+		&k8s.KubeletSpec{},
+		&k8s.KubePrismConfig{},
+		&k8s.KubePrismStatuses{},
+		&k8s.Manifest{},
+		&k8s.ManifestStatus{},
+		&k8s.BootstrapManifestsConfig{},
+		&k8s.NodeCordonedSpec{},
+		&k8s.NodeIP{},
+		&k8s.NodeIPConfig{},
+		&k8s.NodeLabelSpec{},
+		&k8s.Nodename{},
+		&k8s.NodeStatus{},
+		&k8s.NodeTaintSpec{},
+		&k8s.SchedulerConfig{},
+		&k8s.StaticPod{},
+		&k8s.StaticPodServerStatus{},
+		&k8s.StaticPodStatus{},
+		&k8s.SecretsStatus{},
+		&kubeaccess.Config{},
+		&kubespan.Config{},
+		&kubespan.Endpoint{},
+		&kubespan.Identity{},
+		&kubespan.PeerSpec{},
+		&kubespan.PeerStatus{},
+		&network.AddressStatus{},
+		&network.AddressSpec{},
+		&network.DeviceConfigSpec{},
+		&network.HardwareAddr{},
+		&network.HostnameStatus{},
+		&network.HostnameSpec{},
+		&network.LinkRefresh{},
+		&network.LinkStatus{},
+		&network.LinkSpec{},
+		&network.NodeAddress{},
+		&network.NodeAddressFilter{},
+		&network.OperatorSpec{},
+		&network.ProbeSpec{},
+		&network.ProbeStatus{},
+		&network.ResolverStatus{},
+		&network.ResolverSpec{},
+		&network.RouteStatus{},
+		&network.RouteSpec{},
+		&network.Status{},
+		&network.TimeServerStatus{},
+		&network.TimeServerSpec{},
+		&perf.CPU{},
+		&perf.Memory{},
+		&runtime.DevicesStatus{},
+		&runtime.EventSinkConfig{},
+		&runtime.ExtensionStatus{},
+		&runtime.KernelModuleSpec{},
+		&runtime.KernelParamSpec{},
+		&runtime.KernelParamDefaultSpec{},
+		&runtime.KernelParamStatus{},
+		&runtime.KmsgLogConfig{},
+		&runtime.MaintenanceServiceConfig{},
+		&runtime.MaintenanceServiceRequest{},
+		&runtime.MachineStatus{},
+		&runtime.MetaKey{},
+		&runtime.MountStatus{},
+		&runtime.PlatformMetadata{},
+		&runtime.SecurityState{},
+		&secrets.API{},
+		&secrets.CertSAN{},
+		&secrets.Etcd{},
+		&secrets.EtcdRoot{},
+		&secrets.Kubelet{},
+		&secrets.Kubernetes{},
+		&secrets.KubernetesDynamicCerts{},
+		&secrets.KubernetesRoot{},
+		&secrets.MaintenanceServiceCerts{},
+		&secrets.MaintenanceRoot{},
+		&secrets.OSRoot{},
+		&secrets.Trustd{},
+		&siderolink.Config{},
+		&time.Status{},
+		&v1alpha1.AcquireConfigSpec{},
+		&v1alpha1.AcquireConfigStatus{},
+		&v1alpha1.Service{},
+	} {
+		if err := resourceRegistry.Register(ctx, r); err != nil {
+			return nil, err
+		}
+	}
+
+	return state, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/talos_upgrade_status.go b/internal/backend/runtime/omni/controllers/omni/talos_upgrade_status.go
new file mode 100644
index 000000000..c1853bbdf
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/talos_upgrade_status.go
@@ -0,0 +1,595 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/xerrors"
+	"github.com/siderolabs/gen/xslices"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/mappers"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/internal/talos"
+)
+
+var errMachineLocked = errors.New("machine locked")
+
+// TalosUpgradeStatusController manages TalosUpgradeStatus performing a Talos upgrade.
+//
+// TalosUpgradeStatusController upgrades Kubernetes component versions in the cluster.
+type TalosUpgradeStatusController = qtransform.QController[*omni.Cluster, *omni.TalosUpgradeStatus]
+
+// TalosUpgradeStatusControllerName is the name of TalosUpgradeStatusController.
+const TalosUpgradeStatusControllerName = "TalosUpgradeStatusController"
+
+// NewTalosUpgradeStatusController initializes TalosUpgradeStatusController.
+//
+//nolint:gocognit
+func NewTalosUpgradeStatusController() *TalosUpgradeStatusController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.Cluster, *omni.TalosUpgradeStatus]{
+			Name: TalosUpgradeStatusControllerName,
+			MapMetadataFunc: func(cluster *omni.Cluster) *omni.TalosUpgradeStatus {
+				return omni.NewTalosUpgradeStatus(resources.DefaultNamespace, cluster.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(upgradeStatus *omni.TalosUpgradeStatus) *omni.Cluster {
+				return omni.NewCluster(resources.DefaultNamespace, upgradeStatus.Metadata().ID())
+			},
+			TransformExtraOutputFunc: func(ctx context.Context, r controller.ReaderWriter, logger *zap.Logger, cluster *omni.Cluster, upgradeStatus *omni.TalosUpgradeStatus) error {
+				if cluster.Metadata().Phase() == resource.PhaseTearingDown {
+					return nil
+				}
+
+				clusterMachines, err := safe.ReaderListAll[*omni.ClusterMachine](ctx, r, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID())))
+				if err != nil {
+					return err
+				}
+
+				if err = cleanupResources(ctx, r, clusterMachines); err != nil {
+					return err
+				}
+
+				machineSetNodes, err := safe.ReaderListAll[*omni.MachineSetNode](ctx, r, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID())))
+				if err != nil {
+					return err
+				}
+
+				if err = populateEmptySchematics(ctx, r, cluster); err != nil {
+					return err
+				}
+
+				return reconcileTalosUpdateStatus(ctx, r, logger, upgradeStatus, cluster, clusterMachines, machineSetNodes)
+			},
+			FinalizerRemovalExtraOutputFunc: func(ctx context.Context, r controller.ReaderWriter, _ *zap.Logger, cluster *omni.Cluster) error {
+				clusterMachines, err := safe.ReaderListAll[*omni.ClusterMachine](ctx, r, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID())))
+				if err != nil {
+					return err
+				}
+
+				if err = cleanupResources(ctx, r, clusterMachines); err != nil {
+					return err
+				}
+
+				if clusterMachines.Len() != 0 {
+					// cluster still has machines, skipping
+					return xerrors.NewTaggedf[qtransform.SkipReconcileTag]("cluster %q still has machines", cluster.Metadata().ID())
+				}
+
+				return nil
+			},
+		},
+		qtransform.WithExtraMappedInput(
+			func(ctx context.Context, _ *zap.Logger, r controller.QRuntime, _ *omni.TalosVersion) ([]resource.Pointer, error) {
+				// reconcile all clusters TalosUpgradeStatus on TalosVersion changes
+				clusters, err := safe.ReaderListAll[*omni.Cluster](ctx, r)
+				if err != nil {
+					return nil, err
+				}
+
+				return safe.Map(clusters, func(cluster *omni.Cluster) (resource.Pointer, error) {
+					return cluster.Metadata(), nil
+				})
+			},
+		),
+		qtransform.WithExtraMappedInput(
+			qtransform.MapperSameID[*omni.ClusterStatus, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByClusterLabel[*omni.ClusterMachineIdentity, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByClusterLabel[*omni.MachineSetNode, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByClusterLabel[*omni.ClusterMachine, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			mappers.MapByClusterLabel[*omni.MachineStatus, *omni.Cluster](),
+		),
+		qtransform.WithExtraMappedInput(
+			func(ctx context.Context, _ *zap.Logger, r controller.QRuntime, res *omni.SchematicConfiguration) ([]resource.Pointer, error) {
+				var target resource.Pointer
+
+				switch res.TypedSpec().Value.Target {
+				case specs.SchematicConfigurationSpec_Unknown:
+					return nil, nil
+				case specs.SchematicConfigurationSpec_Cluster:
+					return []resource.Pointer{omni.NewCluster(resources.DefaultNamespace, res.Metadata().ID()).Metadata()}, nil
+				case specs.SchematicConfigurationSpec_MachineSet:
+					target = omni.NewMachineSet(resources.DefaultNamespace, res.Metadata().ID()).Metadata()
+				case specs.SchematicConfigurationSpec_ClusterMachine:
+					target = omni.NewClusterMachine(resources.DefaultNamespace, res.Metadata().ID()).Metadata()
+				}
+
+				schematicTarget, err := r.Get(ctx, target)
+				if err != nil {
+					if state.IsNotFoundError(err) {
+						return nil, nil
+					}
+
+					return nil, err
+				}
+
+				clusterName, ok := schematicTarget.Metadata().Labels().Get(omni.LabelCluster)
+				if !ok {
+					return nil, nil
+				}
+
+				return []resource.Pointer{
+					omni.NewCluster(resources.DefaultNamespace, clusterName).Metadata(),
+				}, nil
+			},
+		),
+		qtransform.WithExtraMappedInput(
+			func(ctx context.Context, _ *zap.Logger, r controller.QRuntime, cmcs *omni.ClusterMachineConfigStatus) ([]resource.Pointer, error) {
+				cm, err := safe.ReaderGetByID[*omni.ClusterMachine](ctx, r, cmcs.Metadata().ID())
+				if err != nil {
+					if state.IsNotFoundError(err) {
+						return nil, nil
+					}
+
+					return nil, err
+				}
+
+				clusterName, ok := cm.Metadata().Labels().Get(omni.LabelCluster)
+				if !ok {
+					return nil, nil
+				}
+
+				return []resource.Pointer{omni.NewCluster(resources.DefaultNamespace, clusterName).Metadata()}, nil
+			},
+		),
+		qtransform.WithExtraOutputs(
+			controller.Output{
+				Type: omni.ClusterMachineTalosVersionType,
+				Kind: controller.OutputShared,
+			},
+		),
+	)
+}
+
+func updateMachines(
+	ctx context.Context,
+	r controller.ReaderWriter,
+	logger *zap.Logger,
+	upgradeStatus *omni.TalosUpgradeStatus,
+	machinesToUpdate []*omni.ClusterMachineTalosVersion,
+	machineSetNodes safe.List[*omni.MachineSetNode],
+) (string, error) {
+	var machineToUpdate *omni.ClusterMachineTalosVersion
+
+	slices.SortStableFunc(machinesToUpdate, func(a, b *omni.ClusterMachineTalosVersion) int {
+		return a.Metadata().Created().Compare(b.Metadata().Created())
+	})
+
+	lockedMachines := map[resource.ID]struct{}{}
+
+	machineSetNodes.ForEach(func(machine *omni.MachineSetNode) {
+		if _, locked := machine.Metadata().Annotations().Get(omni.MachineLocked); locked {
+			lockedMachines[machine.Metadata().ID()] = struct{}{}
+		}
+	})
+
+	for _, machine := range machinesToUpdate {
+		machineToUpdate = machine
+
+		if _, locked := lockedMachines[machineToUpdate.Metadata().ID()]; !locked {
+			break
+		}
+	}
+
+	id, err := getMachineName(ctx, r, machineToUpdate.Metadata().ID())
+	if err != nil {
+		return "", err
+	}
+
+	if _, locked := lockedMachines[machineToUpdate.Metadata().ID()]; locked {
+		upgradeStatus.TypedSpec().Value.Status = "upgrade paused"
+		upgradeStatus.TypedSpec().Value.Step = fmt.Sprintf("waiting for the machine %s to be unlocked", id)
+
+		return "", errMachineLocked
+	}
+
+	if err := updateMachine(ctx, r, logger, machineToUpdate); err != nil {
+		return "", err
+	}
+
+	return id, nil
+}
+
+func getMachineName(ctx context.Context, r controller.ReaderWriter, id resource.ID) (string, error) {
+	identity, err := safe.ReaderGet[*omni.ClusterMachineIdentity](ctx, r, omni.NewClusterMachineIdentity(resources.DefaultNamespace, id).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return id, nil
+		}
+
+		return "", err
+	}
+
+	if identity.TypedSpec().Value.Nodename == "" {
+		return id, nil
+	}
+
+	return identity.TypedSpec().Value.Nodename, nil
+}
+
+//nolint:gocognit,cyclop,gocyclo,maintidx
+func reconcileTalosUpdateStatus(ctx context.Context, r controller.ReaderWriter,
+	logger *zap.Logger,
+	upgradeStatus *omni.TalosUpgradeStatus, cluster *omni.Cluster,
+	clusterMachines safe.List[*omni.ClusterMachine],
+	machineSetNodes safe.List[*omni.MachineSetNode],
+) error {
+	talosVersion := cluster.TypedSpec().Value.TalosVersion
+
+	// if not reverting to the previous successful version, perform pre-checks on each step
+	versionMismatch := talosVersion != upgradeStatus.TypedSpec().Value.LastUpgradeVersion
+
+	var schematicUpdates bool
+
+	if versionMismatch {
+		// set the status to 'upgrading' if there is a version mismatch
+		upgradeStatus.TypedSpec().Value.Phase = specs.TalosUpgradeStatusSpec_Upgrading
+		upgradeStatus.TypedSpec().Value.CurrentUpgradeVersion = talosVersion
+	} else {
+		upgradeStatus.TypedSpec().Value.CurrentUpgradeVersion = ""
+	}
+
+	var (
+		machinesToUpdate []*omni.ClusterMachineTalosVersion
+		configsReady     = true
+		err              error
+	)
+
+	clusterStatus, err := safe.ReaderGet[*omni.ClusterStatus](ctx, r, omni.NewClusterStatus(resources.DefaultNamespace, cluster.Metadata().ID()).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return xerrors.NewTagged[qtransform.SkipReconcileTag](err)
+		}
+
+		return err
+	}
+
+	for iter := clusterMachines.Iterator(); iter.Next(); {
+		machine := iter.Value()
+
+		if machine.Metadata().Phase() == resource.PhaseTearingDown {
+			continue
+		}
+
+		var schematicID string
+
+		schematicID, err = getDesiredSchematic(ctx, r, machine)
+		if err != nil {
+			return err
+		}
+
+		var clusterMachineTalosVersion *omni.ClusterMachineTalosVersion
+
+		clusterMachineTalosVersion, err = getOrCreateResource(ctx, r, machine, talosVersion, schematicID)
+		if err != nil {
+			return err
+		}
+
+		if !machine.Metadata().Finalizers().Has(TalosUpgradeStatusControllerName) {
+			if err = r.AddFinalizer(ctx, machine.Metadata(), TalosUpgradeStatusControllerName); err != nil {
+				return err
+			}
+		}
+
+		var configStatus *omni.ClusterMachineConfigStatus
+
+		configStatus, err = safe.ReaderGet[*omni.ClusterMachineConfigStatus](ctx, r, omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, machine.Metadata().ID()).Metadata())
+		if err != nil && !state.IsNotFoundError(err) {
+			return err
+		}
+
+		schematicOutdated := clusterMachineTalosVersion.TypedSpec().Value.SchematicId != schematicID
+
+		resourceNeedsUpdate := clusterMachineTalosVersion.TypedSpec().Value.TalosVersion != talosVersion || schematicOutdated
+
+		if schematicOutdated {
+			schematicUpdates = true
+
+			upgradeStatus.TypedSpec().Value.Phase = specs.TalosUpgradeStatusSpec_Upgrading
+		}
+
+		clusterMachineTalosVersion.TypedSpec().Value.TalosVersion = talosVersion
+		clusterMachineTalosVersion.TypedSpec().Value.SchematicId = schematicID
+
+		switch {
+		// if the machine doesn't have the config status or config sha, it means we can update it's version immediately
+		// as the machine is not configured yet
+		case configStatus == nil || configStatus.TypedSpec().Value.ClusterMachineConfigSha256 == "":
+			if err = updateMachine(ctx, r, logger, clusterMachineTalosVersion); err != nil {
+				return err
+			}
+
+			fallthrough
+		case configStatus.TypedSpec().Value.LastConfigError != "":
+			configsReady = false
+		}
+
+		if !configsReady {
+			continue
+		}
+
+		if resourceNeedsUpdate || configStatus.TypedSpec().Value.TalosVersion != talosVersion ||
+			configStatus.TypedSpec().Value.SchematicId != schematicID {
+			machinesToUpdate = append(machinesToUpdate, clusterMachineTalosVersion)
+		}
+	}
+
+	upgradeStatus.Metadata().Labels().Set(omni.LabelCluster, cluster.Metadata().ID())
+
+	if len(machinesToUpdate) == 0 {
+		upgradeStatus.TypedSpec().Value.Phase = specs.TalosUpgradeStatusSpec_Done
+		upgradeStatus.TypedSpec().Value.Status = ""
+		upgradeStatus.TypedSpec().Value.Step = ""
+		upgradeStatus.TypedSpec().Value.CurrentUpgradeVersion = ""
+		upgradeStatus.TypedSpec().Value.LastUpgradeVersion = talosVersion
+
+		// upgrade is done, so calculate the upgrade versions
+		upgradeStatus.TypedSpec().Value.UpgradeVersions, err = talos.CalculateUpgradeVersions(
+			ctx, r, upgradeStatus.TypedSpec().Value.LastUpgradeVersion, cluster.TypedSpec().Value.KubernetesVersion)
+		if err != nil {
+			return err
+		}
+
+		return nil
+	}
+
+	// upgrade is going, or failed, so clear the upgrade versions
+	upgradeStatus.TypedSpec().Value.UpgradeVersions = nil
+
+	if clusterStatus.TypedSpec().Value.Phase != specs.ClusterStatusSpec_RUNNING || !clusterStatus.TypedSpec().Value.Ready || !configsReady {
+		// if the cluster set is not ready, and doing "normal" upgrade, set the status to 'waiting for the cluster set to be ready'
+		if versionMismatch {
+			if upgradeStatus.TypedSpec().Value.Phase == specs.TalosUpgradeStatusSpec_Upgrading &&
+				upgradeStatus.TypedSpec().Value.Status == "" {
+				upgradeStatus.TypedSpec().Value.Status = "waiting for the cluster to be ready"
+			}
+
+			return nil
+		}
+	}
+
+	controlPlanes := xslices.Filter(machinesToUpdate, func(res *omni.ClusterMachineTalosVersion) bool {
+		_, matches := res.Metadata().Labels().Get(omni.LabelControlPlaneRole)
+
+		return matches
+	})
+
+	workers := xslices.Filter(machinesToUpdate, func(res *omni.ClusterMachineTalosVersion) bool {
+		_, matches := res.Metadata().Labels().Get(omni.LabelWorkerRole)
+
+		return matches
+	})
+
+	totalMachines := clusterMachines.Len()
+	pendingMachines := totalMachines - len(machinesToUpdate) + 1
+
+	if versionMismatch || schematicUpdates {
+		upgradeStatus.TypedSpec().Value.Status = fmt.Sprintf("updating machines %d/%d", pendingMachines, totalMachines)
+	} else {
+		upgradeStatus.TypedSpec().Value.Phase = specs.TalosUpgradeStatusSpec_Reverting
+		upgradeStatus.TypedSpec().Value.Status = fmt.Sprintf("reverting update %d/%d", pendingMachines, totalMachines)
+	}
+
+	for _, machines := range [][]*omni.ClusterMachineTalosVersion{controlPlanes, workers} {
+		if len(machines) > 0 {
+			machine, err := updateMachines(ctx, r, logger, upgradeStatus, machines, machineSetNodes)
+			if err != nil {
+				if errors.Is(err, errMachineLocked) {
+					return nil
+				}
+
+				return err
+			}
+
+			upgradeStatus.TypedSpec().Value.Step = fmt.Sprintf("current machine %s", machine)
+
+			break
+		}
+	}
+
+	return nil
+}
+
+func getOrCreateResource(ctx context.Context, r controller.ReaderWriter, machine *omni.ClusterMachine, talosVersion, schematicID string) (*omni.ClusterMachineTalosVersion, error) {
+	res := omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, machine.Metadata().ID())
+
+	clusterMachineTalosVersion, err := safe.ReaderGet[*omni.ClusterMachineTalosVersion](ctx, r, res.Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			if err = createInitialTalosVersion(ctx, r, machine, talosVersion, schematicID); err != nil {
+				return nil, err
+			}
+
+			return safe.ReaderGet[*omni.ClusterMachineTalosVersion](ctx, r, res.Metadata())
+		}
+
+		return nil, err
+	}
+
+	return clusterMachineTalosVersion, nil
+}
+
+func updateMachine(ctx context.Context, r controller.ReaderWriter, logger *zap.Logger, version *omni.ClusterMachineTalosVersion) error {
+	return safe.WriterModify(
+		ctx,
+		r,
+		version,
+		func(res *omni.ClusterMachineTalosVersion) error {
+			logger.Info("update desired Talos version or schematic",
+				zap.String("machine", version.Metadata().ID()),
+				zap.String("from_schematic", res.TypedSpec().Value.SchematicId),
+				zap.String("to_schematic", version.TypedSpec().Value.SchematicId),
+				zap.String("from_version", res.TypedSpec().Value.TalosVersion),
+				zap.String("to_version", version.TypedSpec().Value.TalosVersion),
+			)
+
+			res.TypedSpec().Value = version.TypedSpec().Value
+
+			return nil
+		},
+	)
+}
+
+func createInitialTalosVersion(ctx context.Context, r controller.ReaderWriter, machine *omni.ClusterMachine, talosVersion, schematicID string) error {
+	res := omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, machine.Metadata().ID())
+
+	CopyAllLabels(machine, res)
+
+	res.TypedSpec().Value.TalosVersion = talosVersion
+	res.TypedSpec().Value.SchematicId = schematicID
+
+	return r.Create(ctx, res)
+}
+
+func cleanupResources(ctx context.Context, r controller.ReaderWriter, clusterMachines safe.List[*omni.ClusterMachine]) error {
+	return clusterMachines.ForEachErr(func(clusterMachine *omni.ClusterMachine) error {
+		if clusterMachine.Metadata().Phase() == resource.PhaseRunning {
+			return nil
+		}
+
+		if err := r.Destroy(ctx, omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, clusterMachine.Metadata().ID()).Metadata()); err != nil && !state.IsNotFoundError(err) {
+			return err
+		}
+
+		if clusterMachine.Metadata().Finalizers().Has(TalosUpgradeStatusControllerName) {
+			return r.RemoveFinalizer(ctx, clusterMachine.Metadata(), TalosUpgradeStatusControllerName)
+		}
+
+		return nil
+	})
+}
+
+func getDesiredSchematic(ctx context.Context, r controller.ReaderWriter, machine *omni.ClusterMachine) (string, error) {
+	clusterName, ok := machine.Metadata().Labels().Get(omni.LabelCluster)
+	if !ok {
+		return "", fmt.Errorf("cluster machine %q doesn't have cluster label set", machine.Metadata().ID())
+	}
+
+	machineSet, ok := machine.Metadata().Labels().Get(omni.LabelMachineSet)
+	if !ok {
+		return "", fmt.Errorf("cluster machine %q doesn't have machine set label set", machine.Metadata().ID())
+	}
+
+	for _, res := range []struct {
+		id     string
+		target specs.SchematicConfigurationSpec_Target
+	}{
+		{
+			id:     machine.Metadata().ID(),
+			target: specs.SchematicConfigurationSpec_ClusterMachine,
+		},
+		{
+			id:     machineSet,
+			target: specs.SchematicConfigurationSpec_MachineSet,
+		},
+		{
+			id:     clusterName,
+			target: specs.SchematicConfigurationSpec_Cluster,
+		},
+	} {
+		schematic, err := safe.ReaderGet[*omni.SchematicConfiguration](ctx, r, omni.NewSchematicConfiguration(resources.DefaultNamespace, res.id).Metadata())
+		if err != nil {
+			if state.IsNotFoundError(err) {
+				continue
+			}
+
+			return "", err
+		}
+
+		if schematic.TypedSpec().Value.Target != res.target {
+			continue
+		}
+
+		return schematic.TypedSpec().Value.SchematicId, nil
+	}
+
+	ms, err := safe.ReaderGet[*omni.MachineStatus](ctx, r, omni.NewMachineStatus(resources.DefaultNamespace, machine.Metadata().ID()).Metadata())
+	if err != nil {
+		return "", err
+	}
+
+	if ms.TypedSpec().Value.Schematic == nil {
+		return "", nil
+	}
+
+	return ms.TypedSpec().Value.Schematic.Id, nil
+}
+
+// populateEmptySchematics iterates all cluster machine talos versions for the cluster and if they have an empty schematic, populates
+// it with the value stored in the machine status resource.
+func populateEmptySchematics(ctx context.Context, r controller.ReaderWriter, cluster *omni.Cluster) error {
+	clusterMachineTalosVersions, err := safe.ReaderListAll[*omni.ClusterMachineTalosVersion](ctx, r, state.WithLabelQuery(
+		resource.LabelEqual(omni.LabelCluster, cluster.Metadata().ID()),
+	))
+	if err != nil {
+		return err
+	}
+
+	return clusterMachineTalosVersions.ForEachErr(func(clusterMachineTalosVersion *omni.ClusterMachineTalosVersion) error {
+		if clusterMachineTalosVersion.TypedSpec().Value.SchematicId != "" {
+			return nil
+		}
+
+		machineStatus, err := safe.ReaderGetByID[*omni.MachineStatus](ctx, r, clusterMachineTalosVersion.Metadata().ID())
+		if err != nil {
+			if state.IsNotFoundError(err) {
+				return nil
+			}
+
+			return err
+		}
+
+		schematic := machineStatus.TypedSpec().Value.Schematic
+		if schematic == nil {
+			return nil
+		}
+
+		return safe.WriterModify(ctx, r, clusterMachineTalosVersion, func(res *omni.ClusterMachineTalosVersion) error {
+			res.TypedSpec().Value.SchematicId = schematic.Id
+
+			return nil
+		})
+	})
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/talos_upgrade_status_test.go b/internal/backend/runtime/omni/controllers/omni/talos_upgrade_status_test.go
new file mode 100644
index 000000000..7921b1df4
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/talos_upgrade_status_test.go
@@ -0,0 +1,322 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type TalosUpgradeStatusSuite struct {
+	OmniSuite
+}
+
+func (suite *TalosUpgradeStatusSuite) TestReconcile() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosUpgradeStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterController(&omnictrl.MachineSetStatusController{}))
+
+	clusterName := "talos-upgrade-cluster"
+
+	cluster, machines := suite.createCluster(clusterName, 3, 1)
+
+	clusterStatus := omni.NewClusterStatus(resources.DefaultNamespace, clusterName)
+	clusterStatus.TypedSpec().Value.Available = true
+	clusterStatus.TypedSpec().Value.Ready = true
+	clusterStatus.TypedSpec().Value.Phase = specs.ClusterStatusSpec_RUNNING
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, clusterStatus))
+
+	for _, res := range machines {
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, res.Metadata().ID()).Metadata(),
+			func(version *omni.ClusterMachineTalosVersion, assertions *assert.Assertions) {
+				versionSpec := version.TypedSpec().Value
+
+				assertions.Equal(cluster.TypedSpec().Value.TalosVersion, versionSpec.TalosVersion)
+			},
+		)
+
+		configStatus := omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, res.Metadata().ID())
+		configStatus.TypedSpec().Value.ClusterMachineConfigSha256 = "aaaa"
+		configStatus.TypedSpec().Value.TalosVersion = cluster.TypedSpec().Value.TalosVersion
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, configStatus))
+	}
+
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewTalosUpgradeStatus(resources.DefaultNamespace, clusterName).Metadata(),
+		func(res *omni.TalosUpgradeStatus, assertions *assert.Assertions) {
+			assertions.Equal(TalosVersion, res.TypedSpec().Value.LastUpgradeVersion)
+		},
+	)
+
+	_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, clusterStatus.Metadata(), func(res *omni.ClusterStatus) error {
+		res.TypedSpec().Value.Ready = false
+
+		return nil
+	})
+
+	suite.Require().NoError(err)
+
+	_, err = safe.StateUpdateWithConflicts(suite.ctx, suite.state, cluster.Metadata(), func(res *omni.Cluster) error {
+		res.TypedSpec().Value.TalosVersion = "1.3.6"
+
+		return nil
+	})
+
+	suite.Require().NoError(err)
+
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewTalosUpgradeStatus(resources.DefaultNamespace, clusterName).Metadata(),
+		func(res *omni.TalosUpgradeStatus, assertions *assert.Assertions) {
+			assertions.Equal("waiting for the cluster to be ready", res.TypedSpec().Value.Status)
+			assertions.Equal("1.3.6", res.TypedSpec().Value.CurrentUpgradeVersion)
+			assertions.Equal(TalosVersion, res.TypedSpec().Value.LastUpgradeVersion)
+		},
+	)
+
+	_, err = safe.StateUpdateWithConflicts(suite.ctx, suite.state, clusterStatus.Metadata(), func(res *omni.ClusterStatus) error {
+		res.TypedSpec().Value.Ready = true
+
+		return nil
+	})
+
+	suite.Require().NoError(err)
+
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewTalosUpgradeStatus(resources.DefaultNamespace, clusterName).Metadata(),
+		func(res *omni.TalosUpgradeStatus, assertions *assert.Assertions) {
+			assertions.Equal("updating machines 1/4", res.TypedSpec().Value.Status)
+			assertions.Equal("1.3.6", res.TypedSpec().Value.CurrentUpgradeVersion)
+			assertions.Equal(TalosVersion, res.TypedSpec().Value.LastUpgradeVersion)
+		},
+	)
+
+	schematicConfig := omni.NewSchematicConfiguration(resources.DefaultNamespace, machines[1].Metadata().ID())
+	schematicConfig.TypedSpec().Value.SchematicId = "abcd"
+	schematicConfig.TypedSpec().Value.Target = specs.SchematicConfigurationSpec_ClusterMachine
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, schematicConfig))
+
+	for i := 0; i < len(machines); i++ {
+		var versions safe.List[*omni.ClusterMachineTalosVersion]
+
+		versions, err = safe.StateListAll[*omni.ClusterMachineTalosVersion](suite.ctx, suite.state)
+		suite.Require().NoError(err)
+
+		for iter := versions.Iterator(); iter.Next(); {
+			configStatus := omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, iter.Value().Metadata().ID())
+			configStatus.TypedSpec().Value.ClusterMachineConfigSha256 = "aaaa"
+
+			_, err = safe.StateUpdateWithConflicts(suite.ctx, suite.state, configStatus.Metadata(), func(res *omni.ClusterMachineConfigStatus) error {
+				res.TypedSpec().Value.TalosVersion = iter.Value().TypedSpec().Value.TalosVersion
+				res.TypedSpec().Value.SchematicId = iter.Value().TypedSpec().Value.SchematicId
+
+				return nil
+			})
+
+			suite.Require().NoError(err)
+		}
+
+		assertResource(
+			&suite.OmniSuite,
+			omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, machines[i].Metadata().ID()).Metadata(),
+			func(res *omni.ClusterMachineTalosVersion, assertions *assert.Assertions) {
+				assertions.NotEmpty(res.TypedSpec().Value.SchematicId)
+
+				schematicID := defaultSchematic
+
+				if i == 1 {
+					schematicID = "abcd"
+				}
+
+				assertions.Equal(schematicID, res.TypedSpec().Value.SchematicId)
+			},
+		)
+
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewTalosUpgradeStatus(resources.DefaultNamespace, clusterName).Metadata(),
+			func(res *omni.TalosUpgradeStatus, assertions *assert.Assertions) {
+				if i < len(machines)-1 {
+					assertions.Equal(fmt.Sprintf("updating machines %d/4", i+2), res.TypedSpec().Value.Status)
+					assertions.Equal("1.3.6", res.TypedSpec().Value.CurrentUpgradeVersion)
+					assertions.Equal(TalosVersion, res.TypedSpec().Value.LastUpgradeVersion)
+					assertions.Equal(specs.TalosUpgradeStatusSpec_Upgrading, res.TypedSpec().Value.Phase)
+				} else {
+					assertions.Empty(res.TypedSpec().Value.Step)
+					assertions.Empty(res.TypedSpec().Value.Error)
+					assertions.Empty(res.TypedSpec().Value.Status)
+					assertions.Empty(res.TypedSpec().Value.CurrentUpgradeVersion)
+					assertions.Equal("1.3.6", res.TypedSpec().Value.LastUpgradeVersion)
+					assertions.Equal(specs.TalosUpgradeStatusSpec_Done, res.TypedSpec().Value.Phase)
+				}
+			},
+		)
+	}
+
+	rtestutils.Destroy[*omni.ClusterMachine](suite.ctx, suite.T(), suite.state, []resource.ID{machines[0].Metadata().ID()})
+
+	assertNoResource(
+		&suite.OmniSuite,
+		omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, machines[0].Metadata().ID()),
+	)
+
+	suite.destroyCluster(cluster)
+
+	for _, res := range machines {
+		assertNoResource(
+			&suite.OmniSuite,
+			omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, res.Metadata().ID()),
+		)
+	}
+}
+
+// TestUpdateVersionsMaintenance checks that machines' Talos version can be updated immediately
+// if a machine is still running in the maintenance mode.
+func (suite *TalosUpgradeStatusSuite) TestUpdateVersionsMaintenance() {
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosUpgradeStatusController()))
+	suite.Require().NoError(suite.runtime.RegisterController(&omnictrl.MachineSetStatusController{}))
+
+	clusterName := "talos-upgrade-cluster"
+
+	cluster, machines := suite.createCluster(clusterName, 3, 1)
+
+	clusterStatus := omni.NewClusterStatus(resources.DefaultNamespace, clusterName)
+	clusterStatus.TypedSpec().Value.Available = true
+	clusterStatus.TypedSpec().Value.Ready = false
+	clusterStatus.TypedSpec().Value.Phase = specs.ClusterStatusSpec_SCALING_UP
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, clusterStatus))
+
+	for i, res := range machines {
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, res.Metadata().ID()).Metadata(),
+			func(version *omni.ClusterMachineTalosVersion, assertions *assert.Assertions) {
+				versionSpec := version.TypedSpec().Value
+
+				assertions.Equal(cluster.TypedSpec().Value.TalosVersion, versionSpec.TalosVersion)
+			},
+		)
+
+		configStatus := omni.NewClusterMachineConfigStatus(resources.DefaultNamespace, res.Metadata().ID())
+
+		if i != 0 {
+			configStatus.TypedSpec().Value.ClusterMachineConfigSha256 = "bbbb"
+		}
+
+		configStatus.TypedSpec().Value.TalosVersion = cluster.TypedSpec().Value.TalosVersion
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, configStatus))
+	}
+
+	_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, cluster.Metadata(), func(res *omni.Cluster) error {
+		res.TypedSpec().Value.TalosVersion = "1.5.5"
+
+		return nil
+	})
+
+	suite.Require().NoError(err)
+
+	for i, res := range machines {
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, res.Metadata().ID()).Metadata(),
+			func(version *omni.ClusterMachineTalosVersion, assertions *assert.Assertions) {
+				versionSpec := version.TypedSpec().Value
+
+				expectedVersion := cluster.TypedSpec().Value.TalosVersion
+				if i == 0 {
+					expectedVersion = "1.5.5"
+				}
+
+				assertions.Equal(expectedVersion, versionSpec.TalosVersion)
+			},
+		)
+	}
+}
+
+func (suite *TalosUpgradeStatusSuite) TestReconcileLocked() {
+	suite.startRuntime()
+
+	clusterName := "talos-upgrade-locked"
+
+	cluster, machines := suite.createCluster(clusterName, 3, 1)
+
+	clusterStatus := omni.NewClusterStatus(resources.DefaultNamespace, clusterName)
+	clusterStatus.TypedSpec().Value.Available = true
+	clusterStatus.TypedSpec().Value.Ready = true
+	clusterStatus.TypedSpec().Value.Phase = specs.ClusterStatusSpec_RUNNING
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, clusterStatus))
+
+	for _, res := range machines {
+		_, err := safe.StateUpdateWithConflicts(suite.ctx, suite.state, resource.NewMetadata(resources.DefaultNamespace, omni.MachineSetNodeType, res.Metadata().ID(), resource.VersionUndefined), func(
+			r *omni.MachineSetNode,
+		) error {
+			r.Metadata().Annotations().Set(omni.MachineLocked, "")
+
+			return nil
+		})
+
+		suite.Require().NoError(err)
+
+		cmtv := omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, res.Metadata().ID())
+
+		cmtv.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+
+		cmtv.TypedSpec().Value.TalosVersion = cluster.TypedSpec().Value.TalosVersion
+
+		suite.Require().NoError(suite.state.Create(suite.ctx, cmtv, state.WithCreateOwner(omnictrl.NewTalosUpgradeStatusController().ControllerName)))
+	}
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosUpgradeStatusController()))
+
+	for _, res := range machines {
+		assertResource(
+			&suite.OmniSuite,
+			*omni.NewClusterMachineTalosVersion(resources.DefaultNamespace, res.Metadata().ID()).Metadata(),
+			func(version *omni.ClusterMachineTalosVersion, assertions *assert.Assertions) {
+				versionSpec := version.TypedSpec().Value
+
+				assertions.Equal(defaultSchematic, versionSpec.SchematicId)
+			},
+		)
+	}
+
+	assertResource(
+		&suite.OmniSuite,
+		*omni.NewTalosUpgradeStatus(resources.DefaultNamespace, clusterName).Metadata(),
+		func(res *omni.TalosUpgradeStatus, assertions *assert.Assertions) {
+			assertions.Equal(specs.TalosUpgradeStatusSpec_Done, res.TypedSpec().Value.Phase)
+		},
+	)
+}
+
+func TestTalosUpgradeStatusSuite(t *testing.T) {
+	suite.Run(t, new(TalosUpgradeStatusSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/talosconfig.go b/internal/backend/runtime/omni/controllers/omni/talosconfig.go
new file mode 100644
index 000000000..975a28284
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/talosconfig.go
@@ -0,0 +1,84 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/controller/generic/qtransform"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/siderolabs/talos/pkg/machinery/role"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
+	"github.com/siderolabs/omni/internal/pkg/certs"
+)
+
+// TalosConfigController creates omni.ClusterSecrets for each input omni.Cluster.
+//
+// TalosConfigController generates and stores cluster wide secrets.
+type TalosConfigController = qtransform.QController[*omni.ClusterSecrets, *omni.TalosConfig]
+
+// NewTalosConfigController instantiates the talosconfig controller.
+func NewTalosConfigController(certificateValidity time.Duration) *TalosConfigController {
+	return qtransform.NewQController(
+		qtransform.Settings[*omni.ClusterSecrets, *omni.TalosConfig]{
+			Name: "TalosConfigController",
+			MapMetadataFunc: func(secrets *omni.ClusterSecrets) *omni.TalosConfig {
+				return omni.NewTalosConfig(resources.DefaultNamespace, secrets.Metadata().ID())
+			},
+			UnmapMetadataFunc: func(talosConfig *omni.TalosConfig) *omni.ClusterSecrets {
+				return omni.NewClusterSecrets(resources.DefaultNamespace, talosConfig.Metadata().ID())
+			},
+			TransformFunc: func(_ context.Context, _ controller.Reader, logger *zap.Logger, secrets *omni.ClusterSecrets, talosConfig *omni.TalosConfig) error {
+				staleCertificate, err := certs.IsBase64EncodedCertificateStale(talosConfig.TypedSpec().Value.Crt, certificateValidity)
+				if err != nil {
+					return fmt.Errorf("error checking Talos API certificate: %w", err)
+				}
+
+				// should always call UpdateInputsVersions to update the annotations, due to short-circuiting
+				if !UpdateInputsVersions(talosConfig, secrets) && !staleCertificate {
+					return nil
+				}
+
+				if staleCertificate {
+					logger.Info("Talos API certificate for cluster is stale, refreshing", zap.String("cluster", secrets.Metadata().ID()))
+				}
+
+				clientCert, CA, err := certs.TalosAPIClientCertificateFromSecrets(secrets, certificateValidity, role.MakeSet(role.Admin))
+				if err != nil {
+					return err
+				}
+
+				talosConfig.TypedSpec().Value.Ca = base64.StdEncoding.EncodeToString(CA)
+				talosConfig.TypedSpec().Value.Crt = base64.StdEncoding.EncodeToString(clientCert.Crt)
+				talosConfig.TypedSpec().Value.Key = base64.StdEncoding.EncodeToString(clientCert.Key)
+
+				return nil
+			},
+		},
+		qtransform.WithExtraMappedInput(
+			func(ctx context.Context, _ *zap.Logger, r controller.QRuntime, _ *system.CertRefreshTick) ([]resource.Pointer, error) {
+				// on cert refresh, queue updates for all clusters
+				secrets, err := safe.ReaderListAll[*omni.ClusterSecrets](ctx, r)
+				if err != nil {
+					return nil, err
+				}
+
+				return safe.Map(secrets, func(secret *omni.ClusterSecrets) (resource.Pointer, error) {
+					return secret.Metadata(), nil
+				})
+			},
+		),
+	)
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/talosconfig_test.go b/internal/backend/runtime/omni/controllers/omni/talosconfig_test.go
new file mode 100644
index 000000000..14e2f436a
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/talosconfig_test.go
@@ -0,0 +1,100 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+	clientconfig "github.com/siderolabs/talos/pkg/machinery/client/config"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+type TalosConfigSuite struct {
+	OmniSuite
+}
+
+func (suite *TalosConfigSuite) TestReconcile() {
+	require := suite.Require()
+
+	suite.startRuntime()
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewSecretsController(nil)))
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosConfigController(2 * time.Second)))
+
+	clusterName := "talos-default-2"
+
+	cluster := omni.NewCluster(resources.DefaultNamespace, clusterName)
+	cluster.TypedSpec().Value.TalosVersion = "1.2.0"
+	require.NoError(suite.state.Create(suite.ctx, cluster))
+
+	machineSet := omni.NewMachineSet(resources.DefaultNamespace, omni.ControlPlanesResourceID(cluster.Metadata().ID()))
+
+	machineSet.Metadata().Labels().Set(omni.LabelControlPlaneRole, "")
+	machineSet.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+
+	require.NoError(suite.state.Create(suite.ctx, machineSet))
+
+	var firstCrt string
+
+	config := omni.NewTalosConfig(resources.DefaultNamespace, clusterName)
+	assertResource(
+		&suite.OmniSuite,
+		*config.Metadata(),
+		func(res *omni.TalosConfig, _ *assert.Assertions) {
+			spec := res.TypedSpec().Value
+
+			cfg := &clientconfig.Config{
+				Context: clusterName,
+				Contexts: map[string]*clientconfig.Context{
+					clusterName: {
+						Endpoints: []string{"127.0.0.1"},
+						CA:        spec.Ca,
+						Crt:       spec.Crt,
+						Key:       spec.Key,
+					},
+				},
+			}
+			_, err := client.New(suite.ctx, client.WithConfig(cfg))
+			suite.Require().NoError(err)
+
+			firstCrt = spec.Crt
+		},
+	)
+
+	// wait 1 second so that the certificate is 50% stale
+	time.Sleep(1 * time.Second)
+
+	// issue a refresh tick
+	suite.Require().NoError(suite.state.Create(suite.ctx, system.NewCertRefreshTick(resources.EphemeralNamespace, "refresh")))
+
+	assertResource(
+		&suite.OmniSuite,
+		*config.Metadata(),
+		func(res *omni.TalosConfig, assertions *assert.Assertions) {
+			spec := res.TypedSpec().Value
+
+			// cert should be refreshed
+			assertions.NotEqual(firstCrt, spec.Crt)
+		},
+	)
+
+	rtestutils.Destroy[*omni.Cluster](suite.ctx, suite.T(), suite.state, []resource.ID{cluster.Metadata().ID()})
+	assertNoResource(&suite.OmniSuite, config)
+}
+
+func TestTalosConfigSuite(t *testing.T) {
+	suite.Run(t, new(TalosConfigSuite))
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/versions.go b/internal/backend/runtime/omni/controllers/omni/versions.go
new file mode 100644
index 000000000..3d510e6ae
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/versions.go
@@ -0,0 +1,306 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/blang/semver"
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/siderolabs/talos/pkg/machinery/compatibility"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/config"
+	consts "github.com/siderolabs/omni/internal/pkg/constants"
+	"github.com/siderolabs/omni/internal/pkg/registry"
+)
+
+var (
+	// minK8sVersion sets minimum Kubernetes version for building the list of versions.
+	minK8sVersion = semver.MustParse(consts.MinKubernetesVersion)
+	// minTalosVersion sets minimum Talos version for building the list of versions.
+	minTalosVersion = semver.MustParse(consts.MinTalosVersion)
+)
+
+// VersionRefreshInterval is the interval in which the kubernetes version is refreshed.
+const VersionRefreshInterval = 15 * time.Minute
+
+// VersionsController creates omni.KubernetesVersions and omni.TalosVersions by scanning container registry.
+type VersionsController struct{}
+
+// Name implements controller.Controller interface.
+func (ctrl *VersionsController) Name() string {
+	return "VersionsController"
+}
+
+// Inputs implements controller.Controller interface.
+func (ctrl *VersionsController) Inputs() []controller.Input {
+	return []controller.Input{}
+}
+
+// Outputs implements controller.Controller interface.
+func (ctrl *VersionsController) Outputs() []controller.Output {
+	return []controller.Output{
+		{
+			Type: omni.KubernetesVersionType,
+			Kind: controller.OutputExclusive,
+		},
+		{
+			Type: omni.TalosVersionType,
+			Kind: controller.OutputExclusive,
+		},
+	}
+}
+
+// Run implements controller.Controller interface.
+func (ctrl *VersionsController) Run(ctx context.Context, r controller.Runtime, logger *zap.Logger) error {
+	ticker := time.NewTicker(VersionRefreshInterval)
+	defer ticker.Stop()
+
+	if err := ctrl.reconcileAllVersions(ctx, r, logger); err != nil {
+		return err
+	}
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-ticker.C:
+		}
+
+		if err := ctrl.reconcileAllVersions(ctx, r, logger); err != nil {
+			return err
+		}
+
+		r.ResetRestartBackoff()
+	}
+}
+
+func (ctrl *VersionsController) reconcileAllVersions(ctx context.Context, r controller.Runtime, logger *zap.Logger) error {
+	k8sVersions, err := ctrl.reconcileKubernetesVersions(ctx, r, logger)
+	if err != nil {
+		return err
+	}
+
+	parsedK8sVersions, err := ctrl.parseK8sVersions(k8sVersions)
+	if err != nil {
+		return err
+	}
+
+	if err = ctrl.reconcileTalosVersions(ctx, r, parsedK8sVersions, logger); err != nil {
+		return fmt.Errorf("error reconciling Talos versions: %w", err)
+	}
+
+	return nil
+}
+
+var allowedPreVersionStrings = map[string]struct{}{
+	"alpha": {},
+	"beta":  {},
+}
+
+func (ctrl *VersionsController) getVersionsAfter(ctx context.Context, source string, min semver.Version, includePreReleaseVersions bool) ([]string, error) {
+	versions, err := registry.UpgradeCandidates(ctx, source)
+	if err != nil {
+		return nil, err
+	}
+
+	res := make([]string, 0, len(versions))
+
+	for _, currentVersion := range versions {
+		currentVersion = strings.TrimLeft(currentVersion, "v")
+
+		var ver semver.Version
+
+		ver, err = semver.ParseTolerant(currentVersion)
+		if err != nil {
+			continue
+		}
+
+		// skip pre-release versions
+		if len(ver.Pre) > 0 {
+			if !includePreReleaseVersions {
+				continue
+			}
+
+			if len(ver.Pre) != 2 {
+				continue
+			}
+
+			if _, ok := allowedPreVersionStrings[ver.Pre[0].VersionStr]; !ok {
+				continue
+			}
+
+			if !ver.Pre[1].IsNumeric() {
+				continue
+			}
+		}
+
+		if ver.LT(min) {
+			continue
+		}
+
+		res = append(res, currentVersion)
+	}
+
+	return res, nil
+}
+
+func forAllCompatibleVersions(
+	talosVersions []string,
+	k8sVersions []*compatibility.KubernetesVersion,
+	fn func(talosVersion string, k8sVersions []string) error,
+) error {
+	// Create a map of Kubernetes versions to Kubernetes parsed versions. It should be faster in sort.Slice below.
+	versionsToVersions := make(map[string]semver.Version, len(k8sVersions))
+
+	for _, v := range k8sVersions {
+		k8sVersion := v.String()
+
+		result, err := semver.Parse(k8sVersion)
+		if err != nil {
+			return fmt.Errorf("error parsing Kubernetes version %q: %w", k8sVersion, err)
+		}
+
+		versionsToVersions[k8sVersion] = result
+	}
+
+	// We can preallocate it once, and clone for each WriterModify call - saving some capacity.
+	compatibleK8sVersions := make([]string, 0, len(k8sVersions))
+
+	for _, v := range talosVersions {
+		parsedTalosVersion, err := compatibility.ParseTalosVersion(&machine.VersionInfo{Tag: v})
+		if err != nil {
+			return err
+		}
+
+		compatibleK8sVersions = compatibleK8sVersions[:0]
+
+		for _, k8sVersion := range k8sVersions {
+			if supportErr := k8sVersion.SupportedWith(parsedTalosVersion); supportErr == nil {
+				compatibleK8sVersions = append(compatibleK8sVersions, k8sVersion.String())
+			}
+		}
+
+		if len(compatibleK8sVersions) == 0 {
+			continue
+		}
+
+		slices.SortFunc(compatibleK8sVersions, func(a, b string) int {
+			version1, ok := versionsToVersions[a]
+			if !ok {
+				return 0
+			}
+
+			version2, ok := versionsToVersions[b]
+			if !ok {
+				return 0
+			}
+
+			return version1.Compare(version2)
+		})
+
+		if err = fn(v, slices.Clone(compatibleK8sVersions)); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (ctrl *VersionsController) reconcileTalosVersions(ctx context.Context, r controller.Runtime, k8sVersions []*compatibility.KubernetesVersion, logger *zap.Logger) error {
+	tracker := trackResource(r, resources.DefaultNamespace, omni.TalosVersionType)
+
+	talosVersions, err := ctrl.getVersionsAfter(ctx, config.Config.TalosRegistry, minTalosVersion, config.Config.EnableTalosPreReleaseVersions)
+	if err != nil {
+		return err
+	}
+
+	talosVersions = xslices.FilterInPlace(talosVersions, func(v string) bool {
+		_, denylisted := consts.DenylistedTalosVersions[v]
+
+		return !denylisted
+	})
+
+	err = forAllCompatibleVersions(talosVersions, k8sVersions, func(talosVer string, compatibleK8sVersions []string) error {
+		talosVersion := omni.NewTalosVersion(resources.DefaultNamespace, talosVer)
+		if writeErr := safe.WriterModify(ctx, r, talosVersion, func(res *omni.TalosVersion) error {
+			res.TypedSpec().Value.Version = talosVer
+			res.TypedSpec().Value.CompatibleKubernetesVersions = compatibleK8sVersions
+
+			return nil
+		}); writeErr != nil {
+			return writeErr
+		}
+
+		tracker.keep(talosVersion)
+
+		return nil
+	})
+	if err != nil {
+		return err
+	}
+
+	logger.Info("reconciled Talos versions")
+
+	return tracker.cleanup(ctx)
+}
+
+func (ctrl *VersionsController) reconcileKubernetesVersions(ctx context.Context, r controller.Runtime, logger *zap.Logger) ([]string, error) {
+	tracker := trackResource(r, resources.DefaultNamespace, omni.KubernetesVersionType)
+
+	versions, err := ctrl.getVersionsAfter(ctx, config.Config.KubernetesRegistry, minK8sVersion, false)
+	if err != nil {
+		return nil, err
+	}
+
+	for _, v := range versions {
+		k8sVersion := omni.NewKubernetesVersion(resources.DefaultNamespace, v)
+
+		if err = safe.WriterModify(ctx, r, k8sVersion, func(res *omni.KubernetesVersion) error {
+			res.TypedSpec().Value.Version = v
+
+			return nil
+		}); err != nil {
+			return nil, err
+		}
+
+		tracker.keep(k8sVersion)
+	}
+
+	logger.Info("reconciled Kubernetes versions")
+
+	err = tracker.cleanup(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	return versions, nil
+}
+
+func (ctrl *VersionsController) parseK8sVersions(versions []string) ([]*compatibility.KubernetesVersion, error) {
+	res := make([]*compatibility.KubernetesVersion, 0, len(versions))
+
+	for _, k8sVersion := range versions {
+		parsedVersion, err := compatibility.ParseKubernetesVersion(k8sVersion)
+		if err != nil {
+			return nil, err
+		}
+
+		res = append(res, parsedVersion)
+	}
+
+	return res, nil
+}
diff --git a/internal/backend/runtime/omni/controllers/omni/versions_test.go b/internal/backend/runtime/omni/controllers/omni/versions_test.go
new file mode 100644
index 000000000..13a00d0ec
--- /dev/null
+++ b/internal/backend/runtime/omni/controllers/omni/versions_test.go
@@ -0,0 +1,103 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"testing"
+
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/talos/pkg/machinery/compatibility"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+func Benchmark_ForAllCompatibleVersions(b *testing.B) {
+	b.StopTimer()
+
+	talosVersions := []string{
+		"1.3.0",
+		"1.3.1",
+		"1.3.2",
+		"1.3.3",
+		"1.3.4",
+		"1.3.5",
+		"1.3.6",
+		"1.3.7",
+		"1.4.0",
+		"1.4.1",
+		"1.4.4",
+		"1.4.5",
+		"1.4.6",
+		"1.4.7",
+	}
+
+	k8sVersionsStrings := []string{
+		"1.24.0",
+		"1.24.1",
+		"1.24.2",
+		"1.24.3",
+		"1.24.4",
+		"1.24.5",
+		"1.24.6",
+		"1.24.7",
+		"1.24.8",
+		"1.24.9",
+		"1.24.10",
+		"1.24.11",
+		"1.24.12",
+		"1.24.13",
+		"1.24.14",
+		"1.24.15",
+		"1.24.16",
+		"1.25.0",
+		"1.25.1",
+		"1.25.2",
+		"1.25.3",
+		"1.25.4",
+		"1.25.5",
+		"1.25.6",
+		"1.25.7",
+		"1.25.8",
+		"1.25.9",
+		"1.25.10",
+		"1.25.11",
+		"1.25.12",
+		"1.26.0",
+		"1.26.1",
+		"1.26.2",
+		"1.26.3",
+		"1.26.4",
+		"1.26.5",
+		"1.26.6",
+		"1.26.7",
+		"1.27.0",
+		"1.27.1",
+		"1.27.2",
+		"1.27.3",
+		"1.27.4",
+	}
+
+	k8sVersions := xslices.Map(k8sVersionsStrings, func(k8sVersion string) *compatibility.KubernetesVersion {
+		version, err := compatibility.ParseKubernetesVersion(k8sVersion)
+		if err != nil {
+			panic(err)
+		}
+
+		return version
+	})
+
+	b.ReportAllocs()
+	b.StartTimer()
+
+	for i := 0; i < b.N; i++ {
+		err := omni.ForAllCompatibleVersions(talosVersions, k8sVersions, func(string, []string) error {
+			return nil
+		})
+		if err != nil {
+			b.Fatal(err)
+		}
+	}
+}
diff --git a/internal/backend/runtime/omni/export_test.go b/internal/backend/runtime/omni/export_test.go
new file mode 100644
index 000000000..3e797400f
--- /dev/null
+++ b/internal/backend/runtime/omni/export_test.go
@@ -0,0 +1,75 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	clientv3 "go.etcd.io/etcd/client/v3"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup/store"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/validated"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+func BuildEtcdPersistentState(ctx context.Context, params *config.Params, logger *zap.Logger, f func(context.Context, namespaced.StateBuilder) error) error {
+	return buildEtcdPersistentState(ctx, params, logger, f)
+}
+
+func GetEmbeddedEtcdClient(ctx context.Context, params *config.EtcdParams, logger *zap.Logger, f func(context.Context, *clientv3.Client) error) error {
+	return getEmbeddedEtcdClient(ctx, params, logger, f)
+}
+
+func EtcdElections(ctx context.Context, client *clientv3.Client, electionKey string, logger *zap.Logger, f func(ctx context.Context, client *clientv3.Client) error) error {
+	return etcdElections(ctx, client, electionKey, logger, f)
+}
+
+func ClusterVersionValidationOptions(st state.State) []validated.StateOption {
+	return clusterValidationOptions(st)
+}
+
+func RelationLabelsValidationOptions() []validated.StateOption {
+	return relationLabelsValidationOptions()
+}
+
+func MachineSetValidationOptions(st state.State, etcdBackupStoreFactory store.Factory) []validated.StateOption {
+	return machineSetValidationOptions(st, etcdBackupStoreFactory)
+}
+
+func MachineSetNodeValidationOptions(st state.State) []validated.StateOption {
+	return machineSetNodeValidationOptions(st)
+}
+
+func IdentityValidationOptions() []validated.StateOption {
+	return identityValidationOptions()
+}
+
+func ExposedServiceValidationOptions() []validated.StateOption {
+	return exposedServiceValidationOptions()
+}
+
+func ConfigPatchValidationOptions(st state.State) []validated.StateOption {
+	return configPatchValidationOptions(st)
+}
+
+func EtcdManualBackupValidationOptions() []validated.StateOption {
+	return etcdManualBackupValidationOptions()
+}
+
+func SAMLLabelRuleValidationOptions() []validated.StateOption {
+	return samlLabelRuleValidationOptions()
+}
+
+func S3ConfigValidationOptions() []validated.StateOption {
+	return s3ConfigValidationOptions()
+}
+
+func SchematicConfigurationValidationOptions() []validated.StateOption {
+	return schematicConfigurationValidationOptions()
+}
diff --git a/internal/backend/runtime/omni/external/state.go b/internal/backend/runtime/omni/external/state.go
new file mode 100644
index 000000000..581b57742
--- /dev/null
+++ b/internal/backend/runtime/omni/external/state.go
@@ -0,0 +1,328 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package external provides an external state implementation.
+package external
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/channel"
+	"github.com/siderolabs/gen/pair/ordered"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup/store"
+)
+
+// State is an external state implementation which provides external resources.
+// External resources are not stored in the backend, but are generated on the fly from the things we got
+// from the external storage (S3 or filesystem).
+type State struct {
+	CoreState    state.CoreState
+	StoreFactory store.Factory
+}
+
+// Get implements [state.CoreState] interface.
+func (s *State) Get(ctx context.Context, pointer resource.Pointer, opts ...state.GetOption) (resource.Resource, error) {
+	if pointer.Type() != omni.EtcdBackupType || pointer.Namespace() != resources.ExternalNamespace {
+		return nil, makeUnsupportedError(fmt.Errorf("unsupported resource type for get %q", pointer))
+	}
+
+	if len(opts) > 0 {
+		return nil, makeUnsupportedError(errors.New("no get options are supported"))
+	}
+
+	id, err := extractClusterID(pointer.ID())
+	if err != nil {
+		return nil, makeValidationError(err)
+	}
+
+	list, err := s.List(ctx, pointer, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, id)))
+	if err != nil {
+		return nil, err
+	}
+
+	if len(list.Items) == 0 {
+		return nil, makeNotFoundError(fmt.Errorf("etcd backup %q for cluster %q not found", pointer.ID(), id))
+	}
+
+	typedList := safe.NewList[*omni.EtcdBackup](list)
+
+	res, ok := typedList.Find(func(backup *omni.EtcdBackup) bool { return backup.Metadata().ID() == pointer.ID() })
+	if !ok {
+		return nil, makeNotFoundError(fmt.Errorf("etcd backup %q for cluster %q not found", pointer.ID(), id))
+	}
+
+	return res, nil
+}
+
+func extractClusterID(id resource.ID) (string, error) {
+	idx := strings.LastIndex(id, "-")
+	if idx == -1 {
+		return "", fmt.Errorf("invalid ID %q", id)
+	}
+
+	_, err := strconv.Atoi(id[idx+1:])
+	if err != nil {
+		return "", fmt.Errorf("invalid timestamp in ID %q: %w", id, err)
+	}
+
+	return id[:idx], nil
+}
+
+// List implements [state.CoreState] interface.
+func (s *State) List(ctx context.Context, kind resource.Kind, opts ...state.ListOption) (resource.List, error) {
+	if kind.Type() != omni.EtcdBackupType || kind.Namespace() != resources.ExternalNamespace {
+		return resource.List{}, makeUnsupportedError(fmt.Errorf("unsupported resource kind for list %q", kind))
+	}
+
+	parsed, err := parseListOptions(opts)
+	if err != nil {
+		return resource.List{}, makeValidationError(err)
+	}
+
+	clusterUUID, err := safe.StateGetByID[*omni.ClusterUUID](ctx, s.CoreState, parsed.ClusterID)
+	if err != nil {
+		return resource.List{}, fmt.Errorf("failed to get cluster UUID by ID: %w", err)
+	}
+
+	st, err := s.StoreFactory.GetStore()
+	if err != nil {
+		return resource.List{}, fmt.Errorf("failed to get store: %w", err)
+	}
+
+	iter, err := st.ListBackups(ctx, clusterUUID.TypedSpec().Value.Uuid)
+	if err != nil {
+		return resource.List{}, fmt.Errorf("failed to list backups for cluster %q: %w", parsed.ClusterID, err)
+	}
+
+	var result []resource.Resource
+
+	for i := 0; i < 1000; i++ { // limit max number of iterations to 1000 for now
+		info, more, err := iter()
+		if err != nil {
+			return resource.List{}, fmt.Errorf("failed to get the next backup: %w", err)
+		}
+
+		if !more {
+			break
+		}
+
+		etcdBackup := omni.NewEtcdBackup(clusterUUID.Metadata().ID(), info.Timestamp)
+		etcdBackup.TypedSpec().Value.Snapshot = info.Snapshot
+		etcdBackup.TypedSpec().Value.CreatedAt = timestamppb.New(info.Timestamp)
+		etcdBackup.TypedSpec().Value.Size = uint64(info.Size)
+		etcdBackup.Metadata().Labels().Set(omni.LabelClusterUUID, clusterUUID.TypedSpec().Value.Uuid)
+		etcdBackup.Metadata().Labels().Set(omni.LabelCluster, clusterUUID.Metadata().ID())
+
+		result = append(result, etcdBackup)
+	}
+
+	return resource.List{Items: result}, nil
+}
+
+func parseListOptions(opts []state.ListOption) (parsedListOptions, error) {
+	opt := fromOpts(opts...)
+
+	var result parsedListOptions
+
+	if opt.IDQuery.Regexp != nil {
+		return result, errors.New("ID query is not supported")
+	}
+
+	for _, q := range opt.LabelQueries {
+		for _, t := range q.Terms {
+			keyOp := ordered.MakePair(t.Key, t.Op)
+
+			switch keyOp {
+			case ordered.MakePair(omni.LabelCluster, resource.LabelOpEqual):
+				if len(t.Value) == 0 || t.Value[0] == "" {
+					return result, fmt.Errorf("empty value for %q is not supported", t.Key)
+				}
+
+				result.ClusterID = t.Value[0]
+			default:
+				return result, fmt.Errorf("unsupported label query term %v", keyOp)
+			}
+		}
+	}
+
+	if result.ClusterID == "" {
+		return result, errors.New("cluster ID must be specified in query")
+	}
+
+	return result, nil
+}
+
+type parsedListOptions struct {
+	ClusterID string
+}
+
+// WatchKind implements [state.CoreState] interface.
+func (s *State) WatchKind(ctx context.Context, kind resource.Kind, ch chan<- state.Event, opts ...state.WatchKindOption) error {
+	if kind.Type() != omni.EtcdBackupType || kind.Namespace() != resources.ExternalNamespace {
+		return makeUnsupportedError(fmt.Errorf("unsupported resource kind for watch %q", kind))
+	}
+
+	convertedOpts, err := convertOpts(opts)
+	if err != nil {
+		return makeUnsupportedError(err)
+	}
+
+	go func() {
+		list, err := s.List(ctx, kind, convertedOpts...)
+		if err != nil {
+			channel.SendWithContext(ctx, ch, state.Event{
+				Error: fmt.Errorf("list error: %w", err),
+				Type:  state.Errored,
+			})
+
+			return
+		}
+
+		for _, item := range list.Items {
+			if !channel.SendWithContext(ctx, ch, state.Event{
+				Resource: item,
+				Type:     state.Created,
+			}) {
+				return
+			}
+		}
+
+		if !channel.SendWithContext(ctx, ch, state.Event{Type: state.Bootstrapped}) {
+			return
+		}
+	}()
+
+	return nil
+}
+
+func convertOpts(opts []state.WatchKindOption) ([]state.ListOption, error) {
+	if len(opts) == 0 {
+		return nil, nil
+	}
+
+	wo := fromOpts(opts...)
+
+	switch {
+	case !wo.BootstrapContents:
+		return nil, errors.New("should pass WithBootstrapContents option")
+	case wo.TailEvents != 0:
+		return nil, errors.New("tail events is not supported")
+	case wo.IDQuery.Regexp != nil:
+		return nil, errors.New("ID query is not supported")
+	case wo.UnmarshalOptions.SkipProtobufUnmarshal:
+		return nil, errors.New("skip protobuf unmarshal is not supported")
+	}
+
+	var result []state.ListOption
+
+	for _, q := range wo.LabelQueries {
+		for _, term := range q.Terms {
+			keyOp := ordered.MakePair(term.Key, term.Op)
+
+			switch keyOp {
+			case ordered.MakePair(omni.LabelCluster, resource.LabelOpEqual):
+				if len(term.Value) == 0 || term.Value[0] == "" {
+					return nil, fmt.Errorf("empty value for %q is not supported", term.Key)
+				}
+
+				result = append(result, state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, term.Value[0])))
+			default:
+				return nil, fmt.Errorf("unsupported label query term %v", keyOp)
+			}
+		}
+	}
+
+	if len(result) == 0 {
+		return nil, errors.New("cluster ID must be specified in query")
+	}
+
+	return result, nil
+}
+
+// Watch implements [state.CoreState] interface.
+func (*State) Watch(context.Context, resource.Pointer, chan<- state.Event, ...state.WatchOption) error {
+	return makeUnsupportedError(errors.New("watch is not supported"))
+}
+
+// Create implements [state.CoreState] interface. It is not supported.
+func (*State) Create(context.Context, resource.Resource, ...state.CreateOption) error {
+	return makeUnsupportedError(errors.New("create is not supported"))
+}
+
+// Update implements [state.CoreState] interface. It is not supported.
+func (*State) Update(context.Context, resource.Resource, ...state.UpdateOption) error {
+	return makeUnsupportedError(errors.New("update is not supported"))
+}
+
+// Destroy implements [state.CoreState] interface. It is not supported.
+func (*State) Destroy(context.Context, resource.Pointer, ...state.DestroyOption) error {
+	return makeUnsupportedError(errors.New("destroy is not supported"))
+}
+
+// WatchKindAggregated implements [state.CoreState] interface. It is not supported.
+func (*State) WatchKindAggregated(context.Context, resource.Kind, chan<- []state.Event, ...state.WatchKindOption) error {
+	return makeUnsupportedError(errors.New("watch kind aggregated is not supported"))
+}
+
+type notFoundError struct{ err error }
+
+func (e *notFoundError) Error() string {
+	return fmt.Sprintf("resource doesn't exist: %v", e.err)
+}
+
+func (*notFoundError) NotFoundError() {}
+
+func makeNotFoundError(err error) error {
+	return &notFoundError{err}
+}
+
+type unsupportedError struct{ err error }
+
+func (u *unsupportedError) Error() string {
+	return fmt.Sprintf("unsupported resource type: %v", u.err)
+}
+
+func (*unsupportedError) UnsupportedError() {}
+
+func makeUnsupportedError(err error) error {
+	return &unsupportedError{
+		err,
+	}
+}
+
+type validationError struct{ err error }
+
+func (e *validationError) Error() string {
+	return fmt.Sprintf("failed to validate: %v", e.err)
+}
+
+func (*validationError) ValidationError() {}
+
+func makeValidationError(err error) error {
+	return &validationError{
+		err,
+	}
+}
+
+func fromOpts[T any, F ~func(*T)](opts ...F) T {
+	var result T
+
+	for _, opt := range opts {
+		opt(&result)
+	}
+
+	return result
+}
diff --git a/internal/backend/runtime/omni/external/state_test.go b/internal/backend/runtime/omni/external/state_test.go
new file mode 100644
index 000000000..c76900f5a
--- /dev/null
+++ b/internal/backend/runtime/omni/external/state_test.go
@@ -0,0 +1,311 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package external_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"regexp"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/google/uuid"
+	"github.com/siderolabs/gen/pair"
+	"github.com/siderolabs/gen/xtesting/check"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup/store"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/external"
+)
+
+func TestStateList(t *testing.T) {
+	uuidStr1 := uuid.New().String()
+
+	happyResult := []pair.Pair[resource.ID, time.Time]{
+		pair.MakePair("cluster1-30", time.Unix(30, 0)),
+		pair.MakePair("cluster1-15", time.Unix(15, 0)),
+	}
+
+	etcdBackupPtr := omni.NewEtcdBackup("", time.Time{}).Metadata()
+
+	tests := map[string]struct {
+		kind         resource.Kind
+		opts         []state.ListOption
+		coreState    state.CoreState
+		storeFactory store.Factory
+
+		errCheck check.Check
+		result   []pair.Pair[resource.ID, time.Time]
+	}{
+		"list all backups": {
+			kind: etcdBackupPtr,
+			opts: []state.ListOption{
+				state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, "cluster1")),
+			},
+			coreState: &coreState{
+				m: map[resource.ID]pair.Pair[*omni.ClusterUUID, error]{
+					"cluster1": pair.MakePair(makeClusterUUID("cluster1", uuidStr1), error(nil)),
+				},
+			},
+			storeFactory: &backupStore{
+				m: map[string]pair.Pair[etcdbackup.InfoIterator, error]{
+					uuidStr1: pair.MakePair(makeIter(happyResult[0], happyResult[1]), error(nil)),
+				},
+			},
+			errCheck: check.NoError(),
+			result:   happyResult,
+		},
+		"no query": {
+			kind:     etcdBackupPtr,
+			errCheck: check.EqualError("failed to validate: cluster ID must be specified in query"),
+		},
+		"no cluster ID in query": {
+			kind: etcdBackupPtr,
+			opts: []state.ListOption{
+				state.WithIDQuery(resource.IDRegexpMatch(regexp.MustCompile(".*"))),
+			},
+			errCheck: check.EqualError("failed to validate: ID query is not supported"),
+		},
+		"unsupported label query": {
+			kind: etcdBackupPtr,
+			opts: []state.ListOption{
+				state.WithLabelQuery(resource.LabelExists("foo")),
+			},
+			errCheck: check.ErrorContains("failed to validate: unsupported label query term"),
+		},
+		"incorrect type": {
+			kind: omni.NewEtcdBackupStatus("").Metadata(),
+			opts: []state.ListOption{
+				state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, "cluster1")),
+			},
+			errCheck: check.EqualError(`unsupported resource type: unsupported resource kind for list "EtcdBackupStatuses.omni.sidero.dev(default/@undefined)"`),
+		},
+		"empty cluster id": {
+			kind: etcdBackupPtr,
+			opts: []state.ListOption{
+				state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, "")),
+			},
+			errCheck: check.ErrorContains(`failed to validate: empty value for "omni.sidero.dev/cluster" is not supported`),
+		},
+		"cluster uuid not found": {
+			kind: etcdBackupPtr,
+			opts: []state.ListOption{
+				state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, "cluster1")),
+			},
+			coreState: &coreState{
+				m: map[resource.ID]pair.Pair[*omni.ClusterUUID, error]{
+					"cluster1": pair.MakePair((*omni.ClusterUUID)(nil), errors.New("cluster not found")),
+				},
+			},
+			errCheck: check.EqualError("failed to get cluster UUID by ID: cluster not found"),
+		},
+		"list backups returns error": {
+			kind: etcdBackupPtr,
+			opts: []state.ListOption{
+				state.WithLabelQuery(resource.LabelEqual(omni.LabelCluster, "cluster1")),
+			},
+			coreState: &coreState{
+				m: map[resource.ID]pair.Pair[*omni.ClusterUUID, error]{
+					"cluster1": pair.MakePair(makeClusterUUID("cluster1", uuidStr1), error(nil)),
+				},
+			},
+			storeFactory: &backupStore{
+				m: map[string]pair.Pair[etcdbackup.InfoIterator, error]{
+					uuidStr1: pair.MakePair(makeIter(), errors.New("list backups error")),
+				},
+			},
+			errCheck: check.EqualError(`failed to list backups for cluster "cluster1": list backups error`),
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			s := &external.State{
+				CoreState:    tt.coreState,
+				StoreFactory: tt.storeFactory,
+			}
+
+			list, err := s.List(context.Background(), tt.kind, tt.opts...)
+			tt.errCheck(t, err)
+
+			if len(list.Items) != len(tt.result) {
+				t.Fatalf("unexpected list length %d, expected %d", len(list.Items), len(tt.result))
+			}
+
+			l := safe.NewList[*omni.EtcdBackup](list)
+			for i := 0; i < len(tt.result); i++ {
+				backup := l.Get(i)
+
+				assert.Equal(t, tt.result[i].F1, backup.Metadata().ID())
+				assert.Equal(t, tt.result[i].F2.UTC(), backup.TypedSpec().Value.CreatedAt.AsTime().UTC())
+			}
+		})
+	}
+}
+
+func TestStateGet(t *testing.T) {
+	uuidStr1 := uuid.New().String()
+
+	happyResult := []pair.Pair[resource.ID, time.Time]{
+		pair.MakePair("cluster1-30", time.Unix(30, 0)),
+		pair.MakePair("cluster1-15", time.Unix(15, 0)),
+	}
+
+	tests := map[string]struct { //nolint:govet
+		pointer      resource.Pointer
+		opts         []state.GetOption
+		coreState    state.CoreState
+		storeFactory store.Factory
+
+		errCheck check.Check
+		result   pair.Pair[resource.ID, time.Time]
+	}{
+		"get backup": {
+			pointer: omni.NewEtcdBackup("cluster1", happyResult[0].F2).Metadata(),
+			coreState: &coreState{
+				m: map[resource.ID]pair.Pair[*omni.ClusterUUID, error]{
+					"cluster1": pair.MakePair(makeClusterUUID("cluster1", uuidStr1), error(nil)),
+				},
+			},
+			storeFactory: &backupStore{
+				m: map[string]pair.Pair[etcdbackup.InfoIterator, error]{
+					uuidStr1: pair.MakePair(makeIter(happyResult[0], happyResult[1]), error(nil)),
+				},
+			},
+			errCheck: check.NoError(),
+			result:   happyResult[0],
+		},
+		"opts": {
+			pointer:  omni.NewEtcdBackup("cluster1", happyResult[0].F2).Metadata(),
+			opts:     []state.GetOption{state.WithGetUnmarshalOptions(nil)},
+			errCheck: check.EqualError("unsupported resource type: no get options are supported"),
+		},
+		"incorrect type": {
+			pointer:  omni.NewEtcdBackupStatus("").Metadata(),
+			errCheck: check.EqualError(`unsupported resource type: unsupported resource type for get "EtcdBackupStatuses.omni.sidero.dev(default/@undefined)"`),
+		},
+		"not found": {
+			pointer: omni.NewEtcdBackup("cluster1", happyResult[0].F2).Metadata(),
+			coreState: &coreState{
+				m: map[resource.ID]pair.Pair[*omni.ClusterUUID, error]{
+					"cluster1": pair.MakePair(makeClusterUUID("cluster1", uuidStr1), error(nil)),
+				},
+			},
+			storeFactory: &backupStore{
+				m: map[string]pair.Pair[etcdbackup.InfoIterator, error]{
+					uuidStr1: pair.MakePair(makeIter(), error(nil)),
+				},
+			},
+			errCheck: check.EqualError(`resource doesn't exist: etcd backup "cluster1-30" for cluster "cluster1" not found`),
+		},
+		"not found in result": {
+			pointer: omni.NewEtcdBackup("cluster1", happyResult[0].F2).Metadata(),
+			coreState: &coreState{
+				m: map[resource.ID]pair.Pair[*omni.ClusterUUID, error]{
+					"cluster1": pair.MakePair(makeClusterUUID("cluster1", uuidStr1), error(nil)),
+				},
+			},
+			storeFactory: &backupStore{
+				m: map[string]pair.Pair[etcdbackup.InfoIterator, error]{
+					uuidStr1: pair.MakePair(makeIter(happyResult[1]), error(nil)),
+				},
+			},
+			errCheck: check.EqualError(`resource doesn't exist: etcd backup "cluster1-30" for cluster "cluster1" not found`),
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			s := &external.State{
+				CoreState:    tt.coreState,
+				StoreFactory: tt.storeFactory,
+			}
+
+			backup, err := s.Get(context.Background(), tt.pointer, tt.opts...)
+			tt.errCheck(t, err)
+
+			if err == nil {
+				res := backup.(*omni.EtcdBackup) //nolint:forcetypeassert,errcheck
+
+				assert.Equal(t, tt.result.F1, backup.Metadata().ID())
+				assert.Equal(t, tt.result.F2.UTC(), res.TypedSpec().Value.CreatedAt.AsTime().UTC())
+			}
+		})
+	}
+}
+
+//nolint:unparam
+func makeClusterUUID(clusterID string, uuidStr string) *omni.ClusterUUID {
+	result := omni.NewClusterUUID(clusterID)
+	result.TypedSpec().Value.Uuid = uuidStr
+
+	return result
+}
+
+type coreState struct {
+	state.CoreState
+
+	m map[resource.ID]pair.Pair[*omni.ClusterUUID, error]
+}
+
+func (c *coreState) Get(_ context.Context, ptr resource.Pointer, opts ...state.GetOption) (resource.Resource, error) {
+	if ptr.Namespace() != resources.DefaultNamespace && ptr.Type() != omni.ClusterUUIDType {
+		panic(fmt.Errorf("unexpected namespace %q or type %q", ptr.Namespace(), ptr.Type()))
+	}
+
+	if len(opts) > 0 {
+		panic(fmt.Errorf("unexpected options %v", opts))
+	}
+
+	if res, ok := c.m[ptr.ID()]; ok {
+		return res.F1, res.F2
+	}
+
+	panic(fmt.Errorf("unexpected ID %q", ptr.ID()))
+}
+
+type backupStore struct {
+	etcdbackup.Store
+	store.Factory
+
+	m map[string]pair.Pair[etcdbackup.InfoIterator, error]
+}
+
+func (b *backupStore) ListBackups(_ context.Context, clusterUUID string) (etcdbackup.InfoIterator, error) {
+	if res, ok := b.m[clusterUUID]; ok {
+		return res.F1, res.F2
+	}
+
+	panic(fmt.Errorf("unexpected cluster UUID %q", clusterUUID))
+}
+
+func (b *backupStore) GetStore() (etcdbackup.Store, error) {
+	return b, nil
+}
+
+func makeIter(slc ...pair.Pair[resource.ID, time.Time]) etcdbackup.InfoIterator {
+	return func() (etcdbackup.Info, bool, error) {
+		if len(slc) == 0 {
+			return etcdbackup.Info{}, false, nil
+		}
+
+		result := slc[0]
+		slc = slc[1:]
+
+		return etcdbackup.Info{
+			Timestamp: result.F2,
+			Reader:    nil,
+			Size:      0,
+		}, true, nil
+	}
+}
diff --git a/internal/backend/runtime/omni/loader.go b/internal/backend/runtime/omni/loader.go
new file mode 100644
index 000000000..f24734ccd
--- /dev/null
+++ b/internal/backend/runtime/omni/loader.go
@@ -0,0 +1,280 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"regexp"
+	"strings"
+
+	vault "github.com/hashicorp/vault/api"
+	auth "github.com/hashicorp/vault/api/auth/kubernetes"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/keyprovider"
+)
+
+// Loader is an interface that returns a private key.
+type Loader interface {
+	PrivateKey() (keyprovider.PrivateKeyData, error)
+}
+
+// NewLoader parses the source string and returns a Loader.
+// The source string can be one of the following:
+//
+//	vault://secret/omni-account/etcdEnc
+//
+//		    Use VAULT_ADDR and VAULT_TOKEN for auth, and grab the private key from "secret" KVv2 store at the "omni-account/etcdEnc" path.
+//
+//		    OR
+//
+//		    If "VAULT_K8S_ROLE" env set, use Kubernetes Service Account auth with the default token, and the private key in the "secret" KVv2 store at the "omni-account/etcEnc" path.
+//
+//	 vault://@/path/to/token:/secret/omni-account/etcdEnc
+//
+//			If "VAULT_K8S_ROLE" env set, use Kubernetes Service Account auth with the token at "/path/to/token", and the private key in the "secret" KVv2 store at the "omni-account/etcEnc" path.
+//
+//	 file:///path/to/file
+//
+//			path to a private key file
+func NewLoader(source string, logger *zap.Logger) (Loader, error) {
+	if source == "" {
+		return nil, errors.New("private key source is not set")
+	}
+
+	switch {
+	case os.Getenv("VAULT_K8S_ROLE") != "" && (vaultMatcher.MatchString(source) || vaultTokenMatcher.MatchString(source)):
+		return makeVaultK8sLoader(source, os.Getenv("VAULT_K8S_ROLE"), logger)
+	case vaultMatcher.MatchString(source):
+		return makeVaultHTTPLoader(source, logger)
+	case strings.HasPrefix(source, "file://"):
+		return makeFileLoader(source, logger)
+	}
+
+	return nil, fmt.Errorf("unknown private key source '%s'", source)
+}
+
+func makeFileLoader(source string, logger *zap.Logger) (Loader, error) {
+	source = strings.TrimPrefix(source, "file://")
+	if source == "" {
+		return nil, errors.New("file source is not set")
+	}
+
+	return &FileLoader{Filepath: source, logger: logger}, nil
+}
+
+// FileLoader loads a private key from a file.
+type FileLoader struct {
+	logger *zap.Logger
+
+	Filepath string
+}
+
+// PrivateKey loads a private key from a file.
+func (f *FileLoader) PrivateKey() (keyprovider.PrivateKeyData, error) {
+	privateKey, err := os.ReadFile(f.Filepath)
+	if err != nil {
+		return keyprovider.PrivateKeyData{}, fmt.Errorf("failed to read private key file '%s': %w", f.Filepath, err)
+	}
+
+	data, err := keyprovider.MakePrivateKeyData(string(privateKey))
+	if err != nil {
+		return keyprovider.PrivateKeyData{}, fmt.Errorf("failed to make private key data: %w", err)
+	}
+
+	return data, nil
+}
+
+func makeVaultHTTPLoader(source string, logger *zap.Logger) (Loader, error) {
+	matched := vaultMatcher.FindStringSubmatch(source)
+	if len(matched) != 3 {
+		return nil, errors.New("failed to parse vault-url source")
+	}
+
+	mount := matched[1]
+	secretPath := matched[2]
+
+	token, ok := os.LookupEnv("VAULT_TOKEN")
+	if !ok {
+		return nil, errors.New("VAULT_TOKEN is not set")
+	}
+
+	addr, ok := os.LookupEnv("VAULT_ADDR")
+	if !ok {
+		return nil, errors.New("VAULT_ADDR is not set")
+	}
+
+	return &VaultHTTPLoader{
+		logger:     logger,
+		Token:      token,
+		Address:    addr,
+		Mount:      mount,
+		SecretPath: secretPath,
+	}, nil
+}
+
+// VaultHTTPLoader loads a private key from a Vault HTTP endpoint.
+type VaultHTTPLoader struct {
+	logger *zap.Logger
+
+	Token      string
+	Address    string
+	Mount      string
+	SecretPath string
+}
+
+// PrivateKey loads a private key from a Vault instance using Kubernetes authentication.
+func (v *VaultHTTPLoader) PrivateKey() (keyprovider.PrivateKeyData, error) {
+	config := vault.DefaultConfig()
+	config.Address = v.Address
+
+	client, err := vault.NewClient(config)
+	if err != nil {
+		return keyprovider.PrivateKeyData{}, fmt.Errorf("failed to create vault client: %w", err)
+	}
+
+	client.SetToken(v.Token)
+
+	v.logger.Info(
+		"loading private key using Vault HTTP api",
+		zap.String("address", v.Address),
+		zap.String("mount_path", v.Mount),
+		zap.String("secret_path", v.SecretPath),
+	)
+
+	return loadKeyData(client, v.Mount, v.SecretPath)
+}
+
+func makeVaultK8sLoader(source string, role string, logger *zap.Logger) (Loader, error) {
+	var (
+		tokenPath  string
+		mount      string
+		secretPath string
+	)
+
+	if matched := vaultTokenMatcher.FindStringSubmatch(source); len(matched) == 4 {
+		tokenPath = matched[1]
+		mount = matched[2]
+		secretPath = matched[3]
+	} else if matched := vaultMatcher.FindStringSubmatch(source); len(matched) == 3 {
+		mount = matched[1]
+		secretPath = matched[2]
+	} else {
+		return nil, errors.New("failed to parse k8s vault source")
+	}
+
+	return &VaultK8sLoader{
+		Role:       role,
+		TokenPath:  tokenPath,
+		Mount:      mount,
+		SecretPath: secretPath,
+		logger:     logger,
+	}, nil
+}
+
+// VaultK8sLoader loads a private key from a Vault instance using Kubernetes authentication.
+type VaultK8sLoader struct {
+	logger *zap.Logger
+
+	Role       string
+	TokenPath  string
+	Mount      string
+	SecretPath string
+}
+
+// PrivateKey loads a private key from a Vault instance using Kubernetes authentication.
+func (v *VaultK8sLoader) PrivateKey() (keyprovider.PrivateKeyData, error) {
+	client, err := vault.NewClient(nil)
+	if err != nil {
+		return keyprovider.PrivateKeyData{}, fmt.Errorf("failed to create vault client: %w", err)
+	}
+
+	var opts []auth.LoginOption
+	if v.TokenPath != "" {
+		opts = append(opts, auth.WithServiceAccountTokenPath(v.TokenPath))
+	}
+
+	k8sAuth, err := auth.NewKubernetesAuth(
+		v.Role,
+		opts...,
+	)
+	if err != nil {
+		return keyprovider.PrivateKeyData{}, fmt.Errorf("failed to create k8s auth: %w", err)
+	}
+
+	authInfo, err := client.Auth().Login(context.TODO(), k8sAuth)
+	if err != nil {
+		return keyprovider.PrivateKeyData{}, fmt.Errorf("unable to log in with Kubernetes auth: %w", err)
+	}
+
+	if authInfo == nil {
+		return keyprovider.PrivateKeyData{}, errors.New("no auth info was returned after login")
+	}
+
+	v.logger.Info(
+		"loading private key using k8s Vault",
+		zap.String("role", v.Role),
+		zap.String("mount_path", v.Mount),
+		zap.String("secret_path", v.SecretPath),
+	)
+
+	return loadKeyData(client, v.Mount, v.SecretPath)
+}
+
+func loadKeyData(client *vault.Client, mount string, secretPath string) (keyprovider.PrivateKeyData, error) {
+	secret, err := client.KVv2(mount).Get(context.Background(), secretPath)
+	if err != nil {
+		return keyprovider.PrivateKeyData{}, fmt.Errorf("failed to get omni private key: %w", err)
+	}
+
+	extractor := func() (string, bool) {
+		// vault can return either a simple string or a []any{string, string, string}.
+		privateKey, ok := secret.Data["private-key"].(string)
+		if ok {
+			return privateKey, true
+		}
+
+		// it's not a simple string, so it's probably a []any{string, string, string}.
+		slc, ok := secret.Data["private-key"].([]any)
+		if !ok {
+			return "", false
+		}
+
+		var sb strings.Builder
+
+		for _, v := range slc {
+			privateKey, ok = v.(string)
+			if !ok {
+				return "", false
+			}
+
+			sb.WriteString(privateKey)
+			sb.WriteByte('\n')
+		}
+
+		return sb.String(), sb.Len() > 0
+	}
+
+	privateKey, ok := extractor()
+	if !ok {
+		return keyprovider.PrivateKeyData{}, errors.New("failed to get omni private key")
+	}
+
+	data, err := keyprovider.MakePrivateKeyData(privateKey)
+	if err != nil {
+		return keyprovider.PrivateKeyData{}, fmt.Errorf("failed to make private key data: %w", err)
+	}
+
+	return data, nil
+}
+
+var (
+	vaultTokenMatcher = regexp.MustCompile(`vault://@([a-zA-Z0-9-/]+):/([a-zA-Z0-9-]+)/([a-zA-Z0-9-/]+)`)
+	vaultMatcher      = regexp.MustCompile(`vault://([a-zA-Z0-9-]+)/([a-zA-Z0-9-/]+)`)
+)
diff --git a/internal/backend/runtime/omni/loader_test.go b/internal/backend/runtime/omni/loader_test.go
new file mode 100644
index 000000000..25ee4f6f0
--- /dev/null
+++ b/internal/backend/runtime/omni/loader_test.go
@@ -0,0 +1,181 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni"
+)
+
+func TestNewLoader(t *testing.T) {
+	type args struct {
+		source string
+	}
+
+	tests := map[string]struct {
+		want func(*testing.T, omni.Loader, error)
+		pre  func(*testing.T)
+		args args
+	}{
+		"empty source": {
+			args: args{
+				source: "",
+			},
+			want: errString("private key source is not set"),
+		},
+		"file loader": {
+			args: args{
+				source: "file:///some/file/private/key",
+			},
+			want: equalTo(&omni.FileLoader{Filepath: "/some/file/private/key"}),
+		},
+		"file loader with empty file": {
+			args: args{
+				source: "file://",
+			},
+			want: errString("file source is not set"),
+		},
+		"vault http no params": {
+			args: args{
+				source: "vault://",
+			},
+			want: errString("unknown private key source 'vault://'"),
+		},
+		"vault http with empty mount": {
+			args: args{
+				source: "vault:///some/path",
+			},
+			want: errString("unknown private key source 'vault:///some/path'"),
+		},
+		"vault http with empty secretPath": {
+			args: args{
+				source: "vault://some/",
+			},
+			want: errString("unknown private key source 'vault://some/'"),
+		},
+		"vault http no env set": {
+			args: args{
+				source: "vault://mount/some-path",
+			},
+			want: errString("VAULT_TOKEN is not set"),
+		},
+		"vault http not fully env set": {
+			args: args{
+				source: "vault://mount/some-path",
+			},
+			pre: func(t *testing.T) {
+				t.Setenv("VAULT_TOKEN", "some-token")
+			},
+			want: errString("VAULT_ADDR is not set"),
+		},
+		"vault http": {
+			args: args{
+				source: "vault://mount/some-path",
+			},
+			pre: func(t *testing.T) {
+				t.Setenv("VAULT_TOKEN", "some-token")
+				t.Setenv("VAULT_ADDR", "http://127.0.0.1:8200")
+			},
+			want: equalTo(&omni.VaultHTTPLoader{
+				Token:      "some-token",
+				Address:    "http://127.0.0.1:8200",
+				Mount:      "mount",
+				SecretPath: "some-path",
+			}),
+		},
+		"incorrect k8s vault": {
+			args: args{
+				source: "vault://k8s-role://omni-account-etcdEnc",
+			},
+			want: errString("unknown private key source 'vault://k8s-role://omni-account-etcdEnc'"),
+		},
+		"vault-k8s empty role": {
+			args: args{
+				source: "vault://:/secret/omni-account-etcdEnc",
+			},
+			want: errString("unknown private key source 'vault://:/secret/omni-account-etcdEnc'"),
+		},
+		"k8s vault": {
+			pre: func(t *testing.T) {
+				t.Setenv("VAULT_K8S_ROLE", "k8s-role")
+			},
+			args: args{
+				source: "vault://secret/omni/account/etcdEnc",
+			},
+			want: equalTo(&omni.VaultK8sLoader{
+				Role:       "k8s-role",
+				Mount:      "secret",
+				SecretPath: "omni/account/etcdEnc",
+			}),
+		},
+		"k8s vault with path": {
+			pre: func(t *testing.T) {
+				t.Setenv("VAULT_K8S_ROLE", "k8s-role")
+			},
+			args: args{
+				source: "vault://@/path/to/token:/secret/omni/account/etcdEnc",
+			},
+			want: equalTo(&omni.VaultK8sLoader{
+				Role:       "k8s-role",
+				TokenPath:  "/path/to/token",
+				Mount:      "secret",
+				SecretPath: "omni/account/etcdEnc",
+			}),
+		},
+		"unknown source": {
+			args: args{
+				source: "vault-k9s://my-role:/path/to/token",
+			},
+			want: errString("unknown private key source 'vault-k9s://my-role:/path/to/token'"),
+		},
+	}
+
+	for name, tt := range tests {
+		t.Run(name, func(t *testing.T) {
+			if tt.pre != nil {
+				tt.pre(t)
+			}
+
+			got, err := omni.NewLoader(tt.args.source, zaptest.NewLogger(t))
+			tt.want(t, got, err)
+		})
+	}
+}
+
+func equalTo(expected omni.Loader) func(*testing.T, omni.Loader, error) {
+	return func(t *testing.T, actual omni.Loader, err error) {
+		require.NoError(t, err)
+
+		if !cmp.Equal(expected, actual, IgnoreUnexported(expected)) {
+			t.Fatal(cmp.Diff(expected, actual, IgnoreUnexported(expected)))
+		}
+	}
+}
+
+func errString(expectedErr string) func(*testing.T, omni.Loader, error) {
+	return func(t *testing.T, _ omni.Loader, err error) {
+		require.EqualError(t, err, expectedErr)
+	}
+}
+
+func IgnoreUnexported(vals ...any) cmp.Option {
+	return cmpopts.IgnoreUnexported(xslices.Map(vals, func(v any) any {
+		val := reflect.ValueOf(v)
+		if val.Kind() == reflect.Ptr {
+			val = val.Elem()
+		}
+
+		return val.Interface()
+	})...)
+}
diff --git a/internal/backend/runtime/omni/migration/compat.go b/internal/backend/runtime/omni/migration/compat.go
new file mode 100644
index 000000000..83776766d
--- /dev/null
+++ b/internal/backend/runtime/omni/migration/compat.go
@@ -0,0 +1,90 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package migration
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// getConfigPatches collects all machine config patches.
+func getConfigPatches(ctx context.Context, r controller.Reader, machine resource.Resource, machineSet *omni.MachineSet, prefix string) ([]*omni.ConfigPatch, error) {
+	clusterName, ok := machine.Metadata().Labels().Get(prefix + deprecatedCluster)
+	if !ok {
+		return nil, fmt.Errorf("cluster machine %q doesn't have cluster label set", machine.Metadata().ID())
+	}
+
+	clusterPatchList, err := safe.ReaderListAll[*omni.ConfigPatch](
+		ctx,
+		r,
+		state.WithLabelQuery(resource.LabelEqual(prefix+deprecatedCluster, clusterName)),
+	)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"cluster name %q, error listing cluster config patches: %w",
+			clusterName,
+			err,
+		)
+	}
+
+	machinePatchList, err := safe.ReaderListAll[*omni.ConfigPatch](
+		ctx,
+		r,
+		state.WithLabelQuery(resource.LabelEqual(prefix+"machine", machine.Metadata().ID())),
+	)
+	if err != nil {
+		return nil, fmt.Errorf(
+			"cluster name %q, cluster machine %q, error listing machine config patches: %w",
+			clusterName,
+			machine.Metadata().ID(),
+			err,
+		)
+	}
+
+	clusterPatches := make([]*omni.ConfigPatch, 0, clusterPatchList.Len())
+	machineSetPatches := make([]*omni.ConfigPatch, 0, clusterPatchList.Len())
+	clusterMachinePatches := make([]*omni.ConfigPatch, 0, clusterPatchList.Len())
+
+	for iter := clusterPatchList.Iterator(); iter.Next(); {
+		patch := iter.Value()
+
+		machineSetName, machineSetOk := patch.Metadata().Labels().Get(prefix + "machine-set")
+		clusterMachineName, clusterMachineOk := patch.Metadata().Labels().Get(prefix + "cluster-machine")
+
+		switch {
+		// machine set patch
+		case machineSetOk && machineSetName == machineSet.Metadata().ID():
+			machineSetPatches = append(machineSetPatches, patch)
+		// cluster machine patch
+		case clusterMachineOk && clusterMachineName == machine.Metadata().ID():
+			clusterMachinePatches = append(clusterMachinePatches, patch)
+		// cluster patch
+		case !machineSetOk && !clusterMachineOk:
+			clusterPatches = append(clusterPatches, patch)
+		}
+	}
+
+	patches := make([]*omni.ConfigPatch, 0, clusterPatchList.Len()+machinePatchList.Len())
+
+	patches = append(patches, clusterPatches...)
+	patches = append(patches, machineSetPatches...)
+	patches = append(patches, clusterMachinePatches...)
+
+	for iter := machinePatchList.Iterator(); iter.Next(); {
+		patch := iter.Value()
+
+		patches = append(patches, patch)
+	}
+
+	return patches, nil
+}
diff --git a/internal/backend/runtime/omni/migration/helpers.go b/internal/backend/runtime/omni/migration/helpers.go
new file mode 100644
index 000000000..a4eb56002
--- /dev/null
+++ b/internal/backend/runtime/omni/migration/helpers.go
@@ -0,0 +1,74 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package migration
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+)
+
+func reconcileConfigInputs(ctx context.Context, st state.State, item *omni.ClusterMachine, withGenOptions bool) error {
+	config := omni.NewClusterMachineConfig(resources.DefaultNamespace, item.Metadata().ID())
+
+	_, err := st.Get(ctx, config.Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil
+		}
+
+		return err
+	}
+
+	// update input versions on the cluster machine config to avoid it's reconciliation
+	clusterName, ok := item.Metadata().Labels().Get(omni.LabelCluster)
+	if !ok {
+		return nil
+	}
+
+	res := []resource.Resource{
+		omni.NewClusterSecrets(resources.DefaultNamespace, clusterName),
+		item,
+		omni.NewLoadBalancerConfig(resources.DefaultNamespace, clusterName),
+		omni.NewCluster(resources.DefaultNamespace, clusterName),
+		omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, item.Metadata().ID()),
+	}
+
+	if withGenOptions {
+		res = append(res, omni.NewMachineConfigGenOptions(resources.DefaultNamespace, item.Metadata().ID()))
+	}
+
+	inputs := make([]resource.Resource, 0, len(res))
+
+	for _, res := range res {
+		res, err = st.Get(ctx, res.Metadata())
+		if err != nil {
+			if state.IsNotFoundError(err) {
+				return nil
+			}
+
+			return err
+		}
+
+		inputs = append(inputs, res)
+	}
+
+	_, err = safe.StateUpdateWithConflicts(ctx, st, config.Metadata(), func(machineConfig *omni.ClusterMachineConfig) error {
+		omnictrl.UpdateInputsVersions(machineConfig, inputs...)
+
+		machineConfig.TypedSpec().Value.ClusterMachineVersion = item.Metadata().Version().String()
+
+		return nil
+	}, state.WithUpdateOwner(omnictrl.NewClusterMachineConfigController(nil).Name()), state.WithExpectedPhaseAny())
+
+	return err
+}
diff --git a/internal/backend/runtime/omni/migration/manager.go b/internal/backend/runtime/omni/migration/manager.go
new file mode 100644
index 000000000..f4fe08664
--- /dev/null
+++ b/internal/backend/runtime/omni/migration/manager.go
@@ -0,0 +1,220 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package migration
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
+)
+
+// Callback represents a single migration callback.
+type Callback func(ctx context.Context, state state.State, logger *zap.Logger) error
+
+type migration struct {
+	callback Callback
+	name     string
+}
+
+// Manager runs COSI state migrations.
+type Manager struct {
+	state      state.State
+	logger     *zap.Logger
+	migrations []*migration
+}
+
+// NewManager creates new Manager.
+func NewManager(state state.State, logger *zap.Logger) *Manager {
+	return &Manager{
+		state:  state,
+		logger: logger,
+		migrations: []*migration{
+			// The order of migrations is important.
+			{
+				callback: clusterInfo,
+				name:     "clusterInfo",
+			},
+			{
+				callback: deprecateClusterMachineTemplates,
+				name:     "deprecateClusterMachineTemplates",
+			},
+			{
+				callback: clusterMachinesToMachineSets,
+				name:     "clusterMachinesToMachineSets",
+			},
+			{
+				callback: changePublicKeyOwner,
+				name:     "changePublicKeyOwner",
+			},
+			{
+				callback: addDefaultScopesToUsers,
+				name:     "addDefaultScopesToUsers",
+			},
+			{
+				callback: setRollingStrategyOnControlPlaneMachineSets,
+				name:     "setRollingStrategyOnControlPlaneMachineSets",
+			},
+			{
+				callback: updateConfigPatchLabels,
+				name:     "updateConfigPatchLabels",
+			},
+			{
+				callback: updateMachineFinalizers,
+				name:     "updateMachineFinalizers",
+			},
+			{
+				callback: labelConfigPatches,
+				name:     "labelConfigPatches",
+			},
+			{
+				callback: updateMachineStatusClusterRelations,
+				name:     "updateMachineStatusClusterRelations",
+			},
+			// re-run the following 3 migrations as 'V2' as there was a problem with concurrent Omni instances running
+			{
+				callback: updateMachineFinalizers,
+				name:     "updateMachineFinalizersV2",
+			},
+			{
+				callback: labelConfigPatches,
+				name:     "labelConfigPatchesV2",
+			},
+			{
+				callback: updateMachineStatusClusterRelations,
+				name:     "updateMachineStatusClusterRelationsV2",
+			},
+			{
+				callback: addServiceAccountScopesToUsers,
+				name:     "addServiceAccountScopesToUsers",
+			},
+			{
+				callback: clusterInstallImageToTalosVersion,
+				name:     "clusterInstallImageToTalosVersion",
+			},
+			{
+				callback: migrateLabels,
+				name:     "migrateLabels",
+			},
+			{
+				callback: dropOldLabels,
+				name:     "dropOldLabels",
+			},
+			{
+				callback: convertScopesToRoles,
+				name:     "convertScopesToRoles",
+			},
+			{
+				callback: lowercaseAllIdentities,
+				name:     "lowercaseAllIdentities",
+			},
+			{
+				callback: removeConfigPatchesFromClusterMachines,
+				name:     "removeConfigPatchesFromClusterMachines",
+			},
+			{
+				callback: machineInstallDiskPatches,
+				name:     "machineInstallDiskPatches",
+			},
+			{
+				callback: siderolinkCounters,
+				name:     "siderolinkCounters",
+			},
+			{
+				callback: fixClusterTalosVersionOwnership,
+				name:     "fixClusterTalosVersionOwnership",
+			},
+		},
+	}
+}
+
+// Options represents Manager options.
+type Options struct {
+	filter     func(string) bool
+	maxVersion int
+}
+
+// Option represents Manager option.
+type Option func(*Options)
+
+// WithFilter allows to filter migrations to run.
+func WithFilter(filter func(string) bool) Option {
+	return func(o *Options) {
+		o.filter = filter
+	}
+}
+
+// WithMaxVersion allows limiting the maximum migration version.
+func WithMaxVersion(version int) Option {
+	return func(o *Options) {
+		o.maxVersion = version
+	}
+}
+
+// Run COSI state migrations.
+func (m *Manager) Run(ctx context.Context, opt ...Option) error {
+	opts := Options{}
+
+	for _, o := range opt {
+		o(&opts)
+	}
+
+	var currentVersion uint64
+
+	version, err := safe.StateGet[*system.DBVersion](
+		ctx,
+		m.state,
+		system.NewDBVersion(resources.DefaultNamespace, system.DBVersionID).Metadata(),
+	)
+	if err != nil {
+		if !state.IsNotFoundError(err) {
+			return err
+		}
+	}
+
+	if version == nil {
+		version = system.NewDBVersion(resources.DefaultNamespace, system.DBVersionID)
+
+		if err = m.state.Create(ctx, version); err != nil {
+			return err
+		}
+	}
+
+	currentVersion = version.TypedSpec().Value.Version
+
+	if opts.maxVersion == 0 {
+		opts.maxVersion = len(m.migrations)
+	}
+
+	if len(m.migrations) < int(currentVersion) {
+		return fmt.Errorf("the current version of Omni is too old to run with the current DB version: %d", currentVersion)
+	}
+
+	for i, migration := range m.migrations[currentVersion:opts.maxVersion] {
+		if opts.filter != nil && !opts.filter(migration.name) {
+			continue
+		}
+
+		if err = migration.callback(ctx, m.state, m.logger); err != nil {
+			return fmt.Errorf("migration %s failed: %w", migration.name, err)
+		}
+
+		if _, err = safe.StateUpdateWithConflicts(ctx, m.state, version.Metadata(), func(dbVer *system.DBVersion) error {
+			dbVer.TypedSpec().Value.Version = currentVersion + uint64(i+1)
+
+			return nil
+		}); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
diff --git a/internal/backend/runtime/omni/migration/migration.go b/internal/backend/runtime/omni/migration/migration.go
new file mode 100644
index 000000000..e1556ca81
--- /dev/null
+++ b/internal/backend/runtime/omni/migration/migration.go
@@ -0,0 +1,52 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package migration COSI state migration management utilities.
+package migration
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+)
+
+func createOrUpdate[T resource.Resource](ctx context.Context, s state.State, res T, update func(T) error, owner string, updateOpts ...state.UpdateOption) error {
+	if err := update(res); err != nil {
+		return err
+	}
+
+	for key, value := range res.Metadata().Labels().Raw() {
+		res.Metadata().Labels().Set(key, value)
+	}
+
+	var createOpts []state.CreateOption
+
+	if owner != "" {
+		createOpts = append(createOpts, state.WithCreateOwner(owner))
+		updateOpts = append(updateOpts, state.WithUpdateOwner(owner))
+	}
+
+	err := s.Create(ctx, res, createOpts...)
+	if err == nil {
+		return nil
+	}
+
+	if !state.IsConflictError(err) {
+		return err
+	}
+
+	if _, err := safe.StateUpdateWithConflicts(ctx, s, res.Metadata(), update, updateOpts...); err != nil {
+		// ignore phase conflicts
+		if state.IsPhaseConflictError(err) {
+			return nil
+		}
+
+		return err
+	}
+
+	return nil
+}
diff --git a/internal/backend/runtime/omni/migration/migration_test.go b/internal/backend/runtime/omni/migration/migration_test.go
new file mode 100644
index 000000000..947a58fc7
--- /dev/null
+++ b/internal/backend/runtime/omni/migration/migration_test.go
@@ -0,0 +1,1188 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package migration_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller/runtime"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/google/uuid"
+	"github.com/siderolabs/gen/pair"
+	"github.com/siderolabs/gen/xslices"
+	"github.com/siderolabs/go-pointer"
+	"github.com/siderolabs/talos/pkg/machinery/config/types/v1alpha1"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest"
+	"google.golang.org/protobuf/types/known/timestamppb"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	authres "github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/migration"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/auth/scope"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+type MigrationSuite struct {
+	suite.Suite
+	state   state.State
+	manager *migration.Manager
+	logger  *zap.Logger
+}
+
+type machine struct {
+	labels map[string]string
+	name   resource.ID
+	patch  string
+}
+
+const (
+	testConfigPatch = `machine:
+  network:
+    hostname: debug`
+	testInstallDisk = "/dev/vda"
+)
+
+func (suite *MigrationSuite) assertLabel(res resource.Resource, key, value string) {
+	label, ok := res.Metadata().Labels().Get(key)
+	suite.Require().Truef(ok, "the label %s is not set on %s", key, res.Metadata())
+	suite.Require().Equal(value, label)
+}
+
+func (suite *MigrationSuite) SetupTest() {
+	suite.state = state.WrapCore(namespaced.NewState(inmem.Build))
+
+	suite.logger = zaptest.NewLogger(suite.T())
+
+	suite.manager = migration.NewManager(suite.state, suite.logger)
+}
+
+func (suite *MigrationSuite) TestClusterInfo() {
+	ctx := context.Background()
+
+	cluster, machine := suite.createCluster(ctx, "c1")
+
+	suite.Require().NoError(suite.manager.Run(ctx), migration.WithFilter(
+		func(name string) bool {
+			return name == "clusterInfo"
+		},
+	))
+
+	var err error
+
+	cluster, err = safe.StateGet[*omni.Cluster](ctx, suite.state, cluster.Metadata())
+
+	suite.Require().NoError(err)
+
+	version, err := omni.GetInstallImage(constants.TalosRegistry, constants.ImageFactoryBaseURL, "", cluster.TypedSpec().Value.TalosVersion)
+
+	suite.Require().NoError(err)
+
+	suite.Require().Equal(
+		machine.TypedSpec().Value.InstallImage,
+		version,
+	)
+
+	suite.Require().Equal(
+		machine.TypedSpec().Value.KubernetesVersion,
+		cluster.TypedSpec().Value.KubernetesVersion,
+	)
+
+	cluster, _ = suite.createCluster(ctx, "c2")
+
+	// This shouldn't happen: create old version of the cluster again and see it not being updated
+	// as the DB version is already up-to-date.
+	suite.Require().NoError(suite.manager.Run(ctx), migration.WithFilter(
+		func(name string) bool {
+			return name == "clusterInfo"
+		},
+	))
+
+	cluster, err = safe.StateGet[*omni.Cluster](ctx, suite.state, cluster.Metadata())
+
+	suite.Require().NoError(err)
+
+	suite.Require().Equal(
+		"",
+		cluster.TypedSpec().Value.InstallImage, //nolint:staticcheck
+	)
+
+	suite.Require().Equal(
+		"",
+		cluster.TypedSpec().Value.KubernetesVersion,
+	)
+}
+
+func (suite *MigrationSuite) TestConfigPatches() {
+	ctx := context.Background()
+
+	_, machine := suite.createCluster(ctx, "c1")
+
+	suite.Require().NoError(suite.manager.Run(ctx, migration.WithMaxVersion(15)))
+
+	list, err := safe.StateListAll[*omni.ConfigPatch](
+		ctx,
+		suite.state,
+		state.WithLabelQuery(resource.LabelEqual("cluster", "c1")),
+	)
+
+	suite.Require().Greater(list.Len(), 1)
+
+	diskPatch := list.Get(0)
+	userPatch := list.Get(1)
+
+	suite.Require().NoError(err)
+	suite.assertLabel(diskPatch, "cluster", "c1")
+	suite.assertLabel(diskPatch, "cluster-machine", machine.Metadata().ID())
+
+	config := v1alpha1.Config{}
+	suite.Require().NoError(yaml.Unmarshal([]byte(diskPatch.TypedSpec().Value.Data), &config))
+
+	suite.Require().Equal(testInstallDisk, config.MachineConfig.MachineInstall.InstallDisk)
+
+	suite.Require().NoError(err)
+	suite.assertLabel(userPatch, "cluster", "c1")
+	suite.assertLabel(userPatch, "cluster-machine", machine.Metadata().ID())
+
+	suite.Require().Equal(
+		testConfigPatch,
+		userPatch.TypedSpec().Value.Data,
+	)
+}
+
+func (suite *MigrationSuite) Test_changePublicKeyOwner() {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	keys := []*authres.PublicKey{
+		authres.NewPublicKey(resources.DefaultNamespace, "test1"),
+		authres.NewPublicKey(resources.DefaultNamespace, "test2"),
+		authres.NewPublicKey(resources.DefaultNamespace, "test3"),
+	}
+
+	for _, key := range keys[:2] {
+		suite.Require().NoError(suite.state.Create(ctx, key))
+	}
+
+	for _, key := range keys[2:] {
+		suite.Require().NoError(suite.state.Create(
+			ctx,
+			key,
+			state.WithCreateOwner(pointer.To(omnictrl.KeyPrunerController{}).Name())),
+		)
+	}
+
+	// test migration in isolation
+	suite.Require().NoError(suite.manager.Run(ctx, migration.WithFilter(func(name string) bool {
+		return name == "changePublicKeyOwner"
+	})))
+
+	keyVerifier := func(key *authres.PublicKey, expectedVersion int) {
+		result, err := safe.StateGet[*authres.PublicKey](ctx, suite.state, key.Metadata())
+		suite.Require().NoError(err)
+		suite.Require().Equal(pointer.To(omnictrl.KeyPrunerController{}).Name(), result.Metadata().Owner())
+		suite.Require().EqualValues(result.Metadata().Version().Value(), expectedVersion)
+	}
+
+	for _, key := range keys[:2] {
+		keyVerifier(key, 2)
+	}
+
+	for _, key := range keys[2:] {
+		keyVerifier(key, 1)
+	}
+}
+
+func (suite *MigrationSuite) TestMachineSets() {
+	ctx := context.Background()
+
+	cluster := suite.createClusterWithMachines(ctx, "c1", []machine{
+		{
+			name: "m1",
+			labels: map[string]string{
+				"role-controlplane": "",
+			},
+		},
+		{
+			name: "m2",
+			labels: map[string]string{
+				"role-controlplane": "",
+			},
+		},
+		{
+			name: "m3",
+			labels: map[string]string{
+				"role-controlplane": "",
+			},
+		},
+		{
+			name: "m4",
+			labels: map[string]string{
+				"role-worker": "",
+			},
+		},
+	}, true)
+
+	suite.Require().NoError(suite.manager.Run(ctx, migration.WithMaxVersion(15)))
+
+	var err error
+
+	controlPlane, err := safe.StateGet[*omni.MachineSet](ctx, suite.state, resource.NewMetadata(
+		resources.DefaultNamespace,
+		omni.MachineSetType,
+		omni.ControlPlanesResourceID(cluster.Metadata().ID()),
+		resource.VersionUndefined,
+	))
+
+	suite.Require().NoError(err)
+
+	var machines []string
+
+	{
+		var list safe.List[*omni.MachineSetNode]
+
+		list, err = safe.StateListAll[*omni.MachineSetNode](
+			ctx,
+			suite.state,
+			state.WithLabelQuery(
+				resource.LabelEqual(omni.LabelMachineSet, controlPlane.Metadata().ID()),
+			),
+		)
+
+		suite.Require().NoError(err)
+
+		for iter := list.Iterator(); iter.Next(); {
+			machines = append(machines, iter.Value().Metadata().ID())
+		}
+	}
+
+	suite.Require().Equal(
+		[]string{"c1.m1", "c1.m2", "c1.m3"},
+		machines,
+	)
+
+	machineSet, err := safe.StateGet[*omni.MachineSet](ctx, suite.state, resource.NewMetadata(
+		resources.DefaultNamespace,
+		omni.MachineSetType,
+		omni.WorkersResourceID(cluster.Metadata().ID()),
+		resource.VersionUndefined,
+	))
+
+	suite.Require().NoError(err)
+
+	{
+		list, err := safe.StateListAll[*omni.MachineSetNode](
+			ctx,
+			suite.state,
+			state.WithLabelQuery(
+				resource.LabelEqual(omni.LabelMachineSet, machineSet.Metadata().ID()),
+			),
+		)
+
+		suite.Require().NoError(err)
+
+		machines = make([]string, 0, list.Len())
+
+		for iter := list.Iterator(); iter.Next(); {
+			machines = append(machines, iter.Value().Metadata().ID())
+		}
+	}
+
+	suite.Require().Equal(
+		[]string{"c1.m4"},
+		machines,
+	)
+
+	for i, m := range []string{"c1.m1", "c1.m2", "c1.m3", "c1.m4"} {
+		machine, err := safe.StateGet[*omni.ClusterMachine](ctx, suite.state, omni.NewClusterMachine(resources.DefaultNamespace, m).Metadata())
+		suite.Require().NoError(err)
+		suite.assertLabel(machine, "cluster", "c1")
+
+		if i < 3 {
+			suite.assertLabel(machine, "role-controlplane", "")
+			suite.assertLabel(machine, "machine-set", omni.ControlPlanesResourceID("c1"))
+		} else {
+			suite.assertLabel(machine, "role-worker", "")
+			suite.assertLabel(machine, "machine-set", omni.WorkersResourceID("c1"))
+		}
+	}
+}
+
+func (suite *MigrationSuite) TestClusterInfoTearingDown() {
+	ctx := context.Background()
+
+	cluster, _ := suite.createCluster(ctx, "c1", "finzlier")
+
+	_, err := suite.state.Teardown(ctx, cluster.Metadata())
+	suite.Require().NoError(err)
+
+	suite.Require().NoError(suite.manager.Run(ctx, migration.WithMaxVersion(15)))
+}
+
+func (suite *MigrationSuite) createCluster(ctx context.Context, name string, finalizers ...string) (*omni.Cluster, *omni.ClusterMachineTemplate) {
+	cluster := omni.NewCluster(resources.DefaultNamespace, name)
+	machine := omni.NewClusterMachineTemplate(resources.DefaultNamespace, fmt.Sprintf("%s.uuid", name))
+	machine.TypedSpec().Value.Patch = testConfigPatch
+	machine.TypedSpec().Value.InstallDisk = testInstallDisk
+
+	for _, finalizer := range finalizers {
+		cluster.Metadata().Finalizers().Add(finalizer)
+	}
+
+	machine.TypedSpec().Value.InstallImage = "ghcr.io/siderolabs/installer:v1.1.3"
+	machine.TypedSpec().Value.KubernetesVersion = "1.24.1"
+
+	machine.Metadata().Labels().Set("cluster", cluster.Metadata().ID())
+	machine.Metadata().Labels().Set("role-controlplane", "")
+
+	machine.Metadata().Finalizers().Add("finalizer")
+
+	suite.Require().NoError(suite.state.Create(ctx, cluster))
+	suite.Require().NoError(suite.state.Create(ctx, machine))
+
+	return cluster, machine
+}
+
+func (suite *MigrationSuite) createClusterWithMachines(ctx context.Context, name string, machines []machine, withTemplates bool, finalizers ...string) *omni.Cluster {
+	cluster := omni.NewCluster(resources.DefaultNamespace, name)
+
+	for _, m := range machines {
+		id := fmt.Sprintf("%s.%s", name, m.name)
+		machine := omni.NewClusterMachine(resources.DefaultNamespace, id)
+		machine.TypedSpec().Value.KubernetesVersion = "v1.24.0"
+
+		machine.Metadata().Labels().Set("cluster", cluster.Metadata().ID())
+		machine.Metadata().Finalizers().Add(omnictrl.NewClusterMachineConfigController(nil).Name())
+
+		if withTemplates {
+			template := omni.NewClusterMachineTemplate(resources.DefaultNamespace, fmt.Sprintf("%s.%s", name, m.name))
+			template.TypedSpec().Value.Patch = m.patch
+			template.TypedSpec().Value.InstallDisk = testInstallDisk
+			template.TypedSpec().Value.InstallImage = "ghcr.io/siderolabs/installer:v1.1.1"
+			template.TypedSpec().Value.KubernetesVersion = "1.24.1"
+			template.Metadata().Labels().Set("cluster", cluster.Metadata().ID())
+
+			for label, value := range m.labels {
+				template.Metadata().Labels().Set(label, value)
+			}
+
+			suite.Require().NoError(suite.state.Create(ctx, template))
+		} else {
+			cluster.TypedSpec().Value.InstallImage = "ghcr.io/siderolabs/installer:v1.1.1" //nolint:staticcheck
+		}
+
+		for label, value := range m.labels {
+			machine.Metadata().Labels().Set(label, value)
+		}
+
+		suite.Require().NoError(suite.state.Create(ctx, machine))
+	}
+
+	for _, finalizer := range finalizers {
+		cluster.Metadata().Finalizers().Add(finalizer)
+	}
+
+	suite.Require().NoError(suite.state.Create(ctx, cluster))
+
+	return cluster
+}
+
+func (suite *MigrationSuite) TestUserDefaultScopes() {
+	var err error
+
+	ctx := context.Background()
+
+	user1 := authres.NewUser(resources.DefaultNamespace, "user1")
+
+	user2 := authres.NewUser(resources.DefaultNamespace, "user2")
+
+	user3 := authres.NewUser(resources.DefaultNamespace, "user3")
+	user3.TypedSpec().Value.Scopes = []string{"scopeExisting1", "scopeExisting2"} //nolint:staticcheck
+
+	suite.Require().NoError(suite.state.Create(ctx, user1))
+	suite.Require().NoError(suite.state.Create(ctx, user2))
+	suite.Require().NoError(suite.state.Create(ctx, user3))
+
+	// test migration in isolation
+	suite.Require().NoError(suite.manager.Run(ctx, migration.WithFilter(func(name string) bool {
+		return name == "addDefaultScopesToUsers"
+	})))
+
+	user1, err = safe.StateGet[*authres.User](ctx, suite.state, user1.Metadata())
+	suite.Require().NoError(err)
+
+	user2, err = safe.StateGet[*authres.User](ctx, suite.state, user2.Metadata())
+	suite.Require().NoError(err)
+
+	user3, err = safe.StateGet[*authres.User](ctx, suite.state, user3.Metadata())
+	suite.Require().NoError(err)
+
+	assert.Equal(suite.T(), scope.NewScopes(scope.UserDefaultScopes...).Strings(), user1.TypedSpec().Value.GetScopes())
+	assert.Equal(suite.T(), scope.NewScopes(scope.UserDefaultScopes...).Strings(), user2.TypedSpec().Value.GetScopes())
+	assert.Equal(suite.T(), []string{"scopeExisting1", "scopeExisting2"}, user3.TypedSpec().Value.GetScopes())
+}
+
+func (suite *MigrationSuite) TestRollingStrategyOnControlPlaneMachineSets() {
+	var err error
+
+	ctx := context.Background()
+
+	controlPlaneMachineSet := omni.NewMachineSet(resources.DefaultNamespace, "control-plane-set")
+	controlPlaneMachineSet.Metadata().Labels().Set("role-controlplane", "")
+
+	workerMachineSet := omni.NewMachineSet(resources.DefaultNamespace, "worker-set")
+	workerMachineSet.Metadata().Labels().Set("role-worker", "")
+
+	suite.Require().NoError(suite.state.Create(ctx, controlPlaneMachineSet))
+	suite.Require().NoError(suite.state.Create(ctx, workerMachineSet))
+
+	suite.Require().NoError(suite.manager.Run(ctx, migration.WithMaxVersion(15)))
+
+	controlPlaneMachineSet, err = safe.StateGet[*omni.MachineSet](ctx, suite.state, controlPlaneMachineSet.Metadata())
+	suite.Require().NoError(err)
+
+	workerMachineSet, err = safe.StateGet[*omni.MachineSet](ctx, suite.state, workerMachineSet.Metadata())
+	suite.Require().NoError(err)
+
+	suite.Assert().Equal(specs.MachineSetSpec_Rolling, controlPlaneMachineSet.TypedSpec().Value.GetUpdateStrategy())
+	suite.Assert().Equal(specs.MachineSetSpec_Unset, workerMachineSet.TypedSpec().Value.GetUpdateStrategy())
+}
+
+func (suite *MigrationSuite) TestUpdateConfigPatchLabels() {
+	var err error
+
+	ctx := context.Background()
+
+	cluster := omni.NewCluster(resources.DefaultNamespace, "cluster")
+	cluster.TypedSpec().Value.InstallImage = fmt.Sprintf("%s:v%s", config.Config.TalosRegistry, constants.DefaultTalosVersion) //nolint:staticcheck
+
+	machineSet := omni.NewMachineSet(resources.DefaultNamespace, "machine-set")
+	machineSet.Metadata().Labels().Set("cluster", cluster.Metadata().ID())
+
+	clusterMachine := omni.NewClusterMachine(resources.DefaultNamespace, "cluster-machine")
+	clusterMachine.Metadata().Labels().Set("cluster", cluster.Metadata().ID())
+
+	clusterConfigPatch := omni.NewConfigPatch(
+		resources.DefaultNamespace,
+		"config-patch-1",
+		pair.MakePair("cluster-name", cluster.Metadata().ID()),
+	)
+
+	machineSetConfigPatchWithCluster := omni.NewConfigPatch(resources.DefaultNamespace, "config-patch-2",
+		pair.MakePair("cluster-name", cluster.Metadata().ID()),
+		pair.MakePair("machine-set-name", machineSet.Metadata().ID()),
+	)
+
+	machineSetConfigPatchWithoutCluster := omni.NewConfigPatch(
+		resources.DefaultNamespace,
+		"config-patch-3",
+		pair.MakePair("machine-set-name", machineSet.Metadata().ID()),
+	)
+
+	clusterMachineConfigPatchWithCluster := omni.NewConfigPatch(resources.DefaultNamespace, "config-patch-4",
+		pair.MakePair("cluster-name", cluster.Metadata().ID()),
+		pair.MakePair("machine-uuid", clusterMachine.Metadata().ID()),
+	)
+
+	clusterMachineConfigPatchWithoutCluster := omni.NewConfigPatch(
+		resources.DefaultNamespace,
+		"config-patch-5",
+		pair.MakePair("machine-uuid", clusterMachine.Metadata().ID()),
+	)
+
+	suite.Require().NoError(suite.state.Create(ctx, cluster))
+	suite.Require().NoError(suite.state.Create(ctx, machineSet))
+	suite.Require().NoError(suite.state.Create(ctx, clusterMachine))
+	suite.Require().NoError(suite.state.Create(ctx, clusterConfigPatch))
+	suite.Require().NoError(suite.state.Create(ctx, machineSetConfigPatchWithCluster))
+	suite.Require().NoError(suite.state.Create(ctx, machineSetConfigPatchWithoutCluster))
+	suite.Require().NoError(suite.state.Create(ctx, clusterMachineConfigPatchWithCluster))
+	suite.Require().NoError(suite.state.Create(ctx, clusterMachineConfigPatchWithoutCluster))
+
+	suite.Require().NoError(suite.manager.Run(ctx, migration.WithMaxVersion(15)))
+
+	clusterConfigPatch, err = safe.StateGet[*omni.ConfigPatch](ctx, suite.state, clusterConfigPatch.Metadata())
+	suite.Require().NoError(err)
+
+	machineSetConfigPatchWithCluster, err = safe.StateGet[*omni.ConfigPatch](ctx, suite.state, machineSetConfigPatchWithCluster.Metadata())
+	suite.Require().NoError(err)
+
+	machineSetConfigPatchWithoutCluster, err = safe.StateGet[*omni.ConfigPatch](ctx, suite.state, machineSetConfigPatchWithoutCluster.Metadata())
+	suite.Require().NoError(err)
+
+	clusterMachineConfigPatchWithCluster, err = safe.StateGet[*omni.ConfigPatch](ctx, suite.state, clusterMachineConfigPatchWithCluster.Metadata())
+	suite.Require().NoError(err)
+
+	clusterMachineConfigPatchWithoutCluster, err = safe.StateGet[*omni.ConfigPatch](ctx, suite.state, clusterMachineConfigPatchWithoutCluster.Metadata())
+	suite.Require().NoError(err)
+
+	for _, configPatch := range []*omni.ConfigPatch{
+		clusterConfigPatch,
+		machineSetConfigPatchWithCluster,
+		machineSetConfigPatchWithoutCluster,
+		clusterMachineConfigPatchWithCluster,
+		clusterMachineConfigPatchWithoutCluster,
+	} {
+		suite.Assert().Equal("cluster", configPatch.Metadata().Labels().Raw()["cluster"])
+
+		_, ok := configPatch.Metadata().Labels().Get("cluster-name")
+		suite.Assert().False(ok)
+	}
+
+	for _, configPatch := range []*omni.ConfigPatch{machineSetConfigPatchWithCluster, machineSetConfigPatchWithoutCluster} {
+		suite.Assert().Equal("machine-set", configPatch.Metadata().Labels().Raw()["machine-set"])
+
+		_, ok := configPatch.Metadata().Labels().Get("machine-set-name")
+		suite.Assert().False(ok)
+	}
+
+	for _, configPatch := range []*omni.ConfigPatch{clusterMachineConfigPatchWithCluster, clusterMachineConfigPatchWithoutCluster} {
+		suite.Assert().Equal("cluster-machine", configPatch.Metadata().Labels().Raw()["cluster-machine"])
+
+		_, ok := configPatch.Metadata().Labels().Get("machine-uuid")
+		suite.Assert().False(ok)
+	}
+}
+
+func (suite *MigrationSuite) TestMigrateMachineFinalizers() {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	m1 := omni.NewMachine(resources.DefaultNamespace, "m1")
+	m2 := omni.NewMachine(resources.DefaultNamespace, "m2")
+	m3 := omni.NewMachine(resources.DefaultNamespace, "m3")
+
+	m1.Metadata().Finalizers().Add("ClusterMachineStatusController")
+	m2.Metadata().Finalizers().Add("ClusterMachineStatusController")
+
+	for _, m := range []*omni.Machine{m1, m2, m3} {
+		suite.Require().NoError(suite.state.Create(ctx, m))
+	}
+
+	_, err := suite.state.Teardown(ctx, m2.Metadata())
+	suite.Require().NoError(err)
+
+	cm1 := omni.NewClusterMachine(resources.DefaultNamespace, "m1")
+	cm3 := omni.NewClusterMachine(resources.DefaultNamespace, "m3")
+
+	for _, cm := range []*omni.ClusterMachine{cm1, cm3} {
+		suite.Require().NoError(suite.state.Create(ctx, cm))
+	}
+
+	suite.Require().NoError(suite.manager.Run(ctx, migration.WithMaxVersion(15)))
+
+	m1, err = safe.StateGet[*omni.Machine](ctx, suite.state, m1.Metadata())
+	suite.Require().NoError(err)
+
+	// no old finalizer
+	suite.Assert().True(m1.Metadata().Finalizers().Add("ClusterMachineStatusController"))
+
+	// new finalizer is set
+	suite.Assert().True(m1.Metadata().Finalizers().Remove("MachineSetStatusController"))
+
+	m2, err = safe.StateGet[*omni.Machine](ctx, suite.state, m2.Metadata())
+	suite.Require().NoError(err)
+
+	// no old and new finalizers (as no ClusterMachine exists)
+	suite.Assert().True(m2.Metadata().Finalizers().Add("ClusterMachineStatusController"))
+	suite.Assert().False(m2.Metadata().Finalizers().Remove("MachineSetStatusController"))
+}
+
+func (suite *MigrationSuite) TestMigrateConfigPatchLabels() {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	p1 := omni.NewConfigPatch(resources.DefaultNamespace, "000-p1")
+	p2 := omni.NewConfigPatch(resources.DefaultNamespace, "001-p2")
+
+	for _, p := range []*omni.ConfigPatch{p1, p2} {
+		suite.Require().NoError(suite.state.Create(ctx, p))
+	}
+
+	suite.Require().NoError(suite.manager.Run(ctx, migration.WithMaxVersion(15)))
+
+	var err error
+
+	p1, err = safe.StateGet[*omni.ConfigPatch](ctx, suite.state, p1.Metadata())
+	suite.Require().NoError(err)
+
+	_, ok := p1.Metadata().Labels().Get("system-patch")
+	suite.Require().Truef(ok, "the label %s is not set on patch with 000- prefix", "system-patch")
+
+	p2, err = safe.StateGet[*omni.ConfigPatch](ctx, suite.state, p2.Metadata())
+	suite.Require().NoError(err)
+
+	_, ok = p2.Metadata().Labels().Get("system-patch")
+	suite.Require().Falsef(ok, "the label %s is set on patch with 001- prefix", "system-patch")
+}
+
+func (suite *MigrationSuite) TestUpdateMachineStatusClusterRelations() {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	msControlPlane := omni.NewMachineStatus(resources.DefaultNamespace, "msControlPlane")
+	msControlPlane.Metadata().Labels().Set("cluster", "c1")
+	msControlPlane.Metadata().Labels().Set("role-controlplane", "")
+
+	suite.Require().NoError(suite.state.Create(ctx, msControlPlane, state.WithCreateOwner("some-owner")))
+
+	msAvailable := omni.NewMachineStatus(resources.DefaultNamespace, "msAvailable")
+
+	suite.Require().NoError(suite.state.Create(ctx, msAvailable))
+
+	msTearingDown := omni.NewMachineStatus(resources.DefaultNamespace, "msTearingDown")
+	msTearingDown.Metadata().Labels().Set("cluster", "c1")
+
+	msTearingDown.Metadata().SetPhase(resource.PhaseTearingDown)
+
+	suite.Require().NoError(suite.state.Create(ctx, msTearingDown))
+
+	suite.Require().NoError(suite.manager.Run(ctx, migration.WithMaxVersion(15)))
+
+	var err error
+
+	msControlPlane, err = safe.StateGet[*omni.MachineStatus](ctx, suite.state, msControlPlane.Metadata())
+	suite.Require().NoError(err)
+
+	// cluster label should disappear
+	_, msControlPlaneClusterOk := msControlPlane.Metadata().Labels().Get("cluster")
+	suite.Assert().False(msControlPlaneClusterOk, "the label %q is still set on machine status", "cluster")
+
+	// control plane role label should disappear
+	_, msControlPlaneRoleOk := msControlPlane.Metadata().Labels().Get("role-controlplane")
+	suite.Assert().False(msControlPlaneRoleOk, "the label %q is still set on machine status", "role-controlplane")
+
+	// available label shouldn't be there
+	_, msControlPlaneAvailableOk := msControlPlane.Metadata().Labels().Get("available")
+	suite.Assert().False(msControlPlaneAvailableOk, "the label %q is unexpectedly set on machine status", "available")
+
+	// owner should be unchanged
+	suite.Assert().Equal("some-owner", msControlPlane.Metadata().Owner())
+
+	// cluster field should be set
+	suite.Assert().Equal("c1", msControlPlane.TypedSpec().Value.Cluster)
+
+	// role field should be set to control plane
+	suite.Assert().Equal(specs.MachineStatusSpec_CONTROL_PLANE, msControlPlane.TypedSpec().Value.Role)
+
+	msAvailable, err = safe.StateGet[*omni.MachineStatus](ctx, suite.state, msAvailable.Metadata())
+	suite.Require().NoError(err)
+
+	// cluster label should disappear
+	_, msAvailableClusterOk := msAvailable.Metadata().Labels().Get("cluster")
+	suite.Assert().False(msAvailableClusterOk, "the label %q is unexpectedly set on machine status", "cluster")
+
+	// available label should be set
+	_, msAvailableOk := msAvailable.Metadata().Labels().Get("available")
+	suite.Assert().True(msAvailableOk, "the label %q is not set on machine status", "available")
+
+	msTearingDown, err = safe.StateGet[*omni.MachineStatus](ctx, suite.state, msTearingDown.Metadata())
+	suite.Require().NoError(err)
+
+	// the labels on the tearing down machine status should be left untouched
+	_, msTearingDownClusterOk := msTearingDown.Metadata().Labels().Get("cluster")
+	suite.Assert().True(msTearingDownClusterOk, "the label %q is not set on machine status", "cluster")
+}
+
+//nolint:staticcheck
+func (suite *MigrationSuite) TestAddServiceAccountScopesToUsers() {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	id := uuid.New().String()
+
+	user1 := authres.NewUser(resources.DefaultNamespace, fmt.Sprintf("user1-%s", id))
+	user1.TypedSpec().Value.Scopes = scope.NewScopes(scope.ClusterAny, scope.MachineRead).Strings()
+
+	user2 := authres.NewUser(resources.DefaultNamespace, fmt.Sprintf("user2-%s", id))
+	user2.TypedSpec().Value.Scopes = scope.NewScopes(scope.UserAny).Strings()
+
+	publicKey1 := authres.NewPublicKey(resources.DefaultNamespace, fmt.Sprintf("publicKey1-%s", id))
+	publicKey1.TypedSpec().Value.Scopes = scope.NewScopes(scope.ClusterAny).Strings()
+
+	publicKey2 := authres.NewPublicKey(resources.DefaultNamespace, fmt.Sprintf("publicKey2-%s", id))
+
+	suite.Require().NoError(suite.state.Create(ctx, user1))
+	suite.Require().NoError(suite.state.Create(ctx, user2))
+	suite.Require().NoError(suite.state.Create(ctx, publicKey1))
+	suite.Require().NoError(suite.state.Create(ctx, publicKey2))
+
+	// test migration in isolation
+	suite.Require().NoError(suite.manager.Run(ctx, migration.WithFilter(func(name string) bool {
+		return name == "addServiceAccountScopesToUsers"
+	})))
+
+	user1, err := safe.StateGet[*authres.User](ctx, suite.state, user1.Metadata())
+	suite.Require().NoError(err)
+
+	suite.Assert().Equal(scope.NewScopes(scope.ClusterAny, scope.MachineRead, scope.ServiceAccountAny).Strings(), user1.TypedSpec().Value.Scopes)
+
+	user2, err = safe.StateGet[*authres.User](ctx, suite.state, user2.Metadata())
+	suite.Require().NoError(err)
+
+	suite.Assert().Equal(scope.NewScopes(scope.UserAny, scope.ServiceAccountAny).Strings(), user2.TypedSpec().Value.Scopes)
+
+	publicKey1, err = safe.StateGet[*authres.PublicKey](ctx, suite.state, publicKey1.Metadata())
+	suite.Require().NoError(err)
+
+	suite.Assert().Equal(scope.NewScopes(scope.ClusterAny, scope.ServiceAccountAny).Strings(), publicKey1.TypedSpec().Value.Scopes)
+
+	publicKey2, err = safe.StateGet[*authres.PublicKey](ctx, suite.state, publicKey2.Metadata())
+	suite.Require().NoError(err)
+
+	suite.Assert().Equal(scope.NewScopes(scope.ServiceAccountAny).Strings(), publicKey2.TypedSpec().Value.Scopes)
+}
+
+func (suite *MigrationSuite) TestMigrateLabels() {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	id := uuid.New().String()
+
+	machineStatus := omni.NewClusterMachineStatus(resources.DefaultNamespace, "__1")
+	machineStatus.Metadata().Labels().Set("role-controlplane", "")
+	machineStatus.Metadata().Labels().Set("cluster", "cluster5")
+	suite.Require().NoError(suite.state.Create(ctx, machineStatus))
+
+	machineStatus = omni.NewClusterMachineStatus(resources.DefaultNamespace, id)
+	machineStatus.Metadata().Labels().Set("role-worker", "")
+	machineStatus.Metadata().Labels().Set("cluster", "cluster1")
+	suite.Require().NoError(suite.state.Create(ctx, machineStatus))
+
+	machineLabels := omni.NewMachineLabels(resources.DefaultNamespace, id)
+	machineLabels.Metadata().Labels().Set("user-label", "value")
+	suite.Require().NoError(suite.state.Create(ctx, machineLabels))
+
+	suite.Require().NoError(suite.manager.Run(ctx, migration.WithFilter(func(name string) bool {
+		return name == "migrateLabels" || name == "dropOldLabels"
+	})))
+
+	updatedMachineStatus, err := suite.state.Get(ctx, machineStatus.Metadata())
+	suite.Require().NoError(err)
+
+	_, ok := updatedMachineStatus.Metadata().Labels().Get(omni.LabelWorkerRole)
+	suite.Require().True(ok)
+
+	cluster, ok := updatedMachineStatus.Metadata().Labels().Get(omni.LabelCluster)
+	suite.Require().True(ok)
+	suite.Require().Equal("cluster1", cluster)
+
+	updatedMachineLabels, err := suite.state.Get(ctx, machineLabels.Metadata())
+	suite.Require().NoError(err)
+
+	userLabel, ok := updatedMachineLabels.Metadata().Labels().Get("user-label")
+	suite.Require().True(ok)
+	suite.Require().Equal("value", userLabel)
+
+	_, ok = updatedMachineStatus.Metadata().Labels().Get("cluster")
+	suite.Require().False(ok)
+}
+
+//nolint:staticcheck
+func (suite *MigrationSuite) TestConvertScopesToRoles() {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	userWithNoScopes := authres.NewUser(resources.DefaultNamespace, fmt.Sprintf("userWithNoScopes-%s", uuid.New().String()))
+	userWithNoScopes.TypedSpec().Value.Scopes = []string{}
+
+	userWithReadScopes := authres.NewUser(resources.DefaultNamespace, fmt.Sprintf("userWithReadScopes-%s", uuid.New().String()))
+	userWithReadScopes.TypedSpec().Value.Scopes = scope.NewScopes(scope.MachineRead, scope.ClusterRead).Strings()
+
+	userWithModifyScopes := authres.NewUser(resources.DefaultNamespace, fmt.Sprintf("userWithModifyScopes-%s", uuid.New().String()))
+	userWithModifyScopes.TypedSpec().Value.Scopes = scope.NewScopes(scope.ClusterModify).Strings()
+
+	userWithUserMgmtScopes := authres.NewUser(resources.DefaultNamespace, fmt.Sprintf("userWithUserMgmtScopes-%s", uuid.New().String()))
+	userWithUserMgmtScopes.TypedSpec().Value.Scopes = scope.NewScopes(scope.UserRead).Strings()
+
+	userWithServiceAccountScopes := authres.NewUser(resources.DefaultNamespace, fmt.Sprintf("userWithServiceAccountScopes-%s", uuid.New().String()))
+	userWithServiceAccountScopes.TypedSpec().Value.Scopes = scope.NewScopes(scope.ServiceAccountCreate).Strings()
+
+	pubKeyWithNoScopes := authres.NewPublicKey(resources.DefaultNamespace, fmt.Sprintf("pubKeyWithNoScopes-%s", uuid.New().String()))
+	pubKeyWithNoScopes.TypedSpec().Value.Scopes = []string{}
+
+	pubKeyWithReadScopes := authres.NewPublicKey(resources.DefaultNamespace, fmt.Sprintf("pubKeyWithReadScopes-%s", uuid.New().String()))
+	pubKeyWithReadScopes.TypedSpec().Value.Scopes = scope.NewScopes(scope.MachineRead, scope.ClusterRead).Strings()
+
+	pubKeyWithModifyScopes := authres.NewPublicKey(resources.DefaultNamespace, fmt.Sprintf("pubKeyWithModifyScopes-%s", uuid.New().String()))
+	pubKeyWithModifyScopes.TypedSpec().Value.Scopes = scope.NewScopes(scope.ClusterModify).Strings()
+
+	pubKeyWithUserMgmtScopes := authres.NewPublicKey(resources.DefaultNamespace, fmt.Sprintf("pubKeyWithUserMgmtScopes-%s", uuid.New().String()))
+	pubKeyWithUserMgmtScopes.TypedSpec().Value.Scopes = scope.NewScopes(scope.UserRead).Strings()
+
+	pubKeyWithServiceAccountScopes := authres.NewPublicKey(resources.DefaultNamespace, fmt.Sprintf("pubKeyWithServiceAccountScopes-%s", uuid.New().String()))
+	pubKeyWithServiceAccountScopes.TypedSpec().Value.Scopes = scope.NewScopes(scope.ServiceAccountCreate).Strings()
+
+	suite.Require().NoError(suite.state.Create(ctx, userWithNoScopes))
+	suite.Require().NoError(suite.state.Create(ctx, userWithReadScopes))
+	suite.Require().NoError(suite.state.Create(ctx, userWithModifyScopes))
+	suite.Require().NoError(suite.state.Create(ctx, userWithUserMgmtScopes))
+	suite.Require().NoError(suite.state.Create(ctx, userWithServiceAccountScopes))
+
+	suite.Require().NoError(suite.state.Create(ctx, pubKeyWithNoScopes))
+	suite.Require().NoError(suite.state.Create(ctx, pubKeyWithReadScopes))
+	suite.Require().NoError(suite.state.Create(ctx, pubKeyWithModifyScopes))
+	suite.Require().NoError(suite.state.Create(ctx, pubKeyWithUserMgmtScopes))
+	suite.Require().NoError(suite.state.Create(ctx, pubKeyWithServiceAccountScopes))
+
+	suite.Require().NoError(suite.manager.Run(ctx, migration.WithFilter(func(name string) bool {
+		return name == "convertScopesToRoles"
+	})))
+
+	updatedUserWithNoScopes, err := safe.StateGet[*authres.User](ctx, suite.state, userWithNoScopes.Metadata())
+	suite.Require().NoError(err)
+
+	updatedUserWithReadScopes, err := safe.StateGet[*authres.User](ctx, suite.state, userWithReadScopes.Metadata())
+	suite.Require().NoError(err)
+
+	updatedUserWithModifyScopes, err := safe.StateGet[*authres.User](ctx, suite.state, userWithModifyScopes.Metadata())
+	suite.Require().NoError(err)
+
+	updatedUserWithUserMgmtScopes, err := safe.StateGet[*authres.User](ctx, suite.state, userWithUserMgmtScopes.Metadata())
+	suite.Require().NoError(err)
+
+	updatedUserWithServiceAccountScopes, err := safe.StateGet[*authres.User](ctx, suite.state, userWithServiceAccountScopes.Metadata())
+	suite.Require().NoError(err)
+
+	updatedPubKeyWithNoScopes, err := safe.StateGet[*authres.PublicKey](ctx, suite.state, pubKeyWithNoScopes.Metadata())
+	suite.Require().NoError(err)
+
+	updatedPubKeyWithReadScopes, err := safe.StateGet[*authres.PublicKey](ctx, suite.state, pubKeyWithReadScopes.Metadata())
+	suite.Require().NoError(err)
+
+	updatedPubKeyWithModifyScopes, err := safe.StateGet[*authres.PublicKey](ctx, suite.state, pubKeyWithModifyScopes.Metadata())
+	suite.Require().NoError(err)
+
+	updatedPubKeyWithUserMgmtScopes, err := safe.StateGet[*authres.PublicKey](ctx, suite.state, pubKeyWithUserMgmtScopes.Metadata())
+	suite.Require().NoError(err)
+
+	updatedPubKeyWithServiceAccountScopes, err := safe.StateGet[*authres.PublicKey](ctx, suite.state, pubKeyWithServiceAccountScopes.Metadata())
+	suite.Require().NoError(err)
+
+	suite.Require().Equal(string(role.None), updatedUserWithNoScopes.TypedSpec().Value.Role)
+	suite.Require().Equal(string(role.None), updatedPubKeyWithNoScopes.TypedSpec().Value.Role)
+
+	suite.Require().Equal(string(role.Reader), updatedUserWithReadScopes.TypedSpec().Value.Role)
+	suite.Require().Equal(string(role.Reader), updatedPubKeyWithReadScopes.TypedSpec().Value.Role)
+
+	suite.Require().Equal(string(role.Operator), updatedUserWithModifyScopes.TypedSpec().Value.Role)
+	suite.Require().Equal(string(role.Operator), updatedPubKeyWithModifyScopes.TypedSpec().Value.Role)
+
+	suite.Require().Equal(string(role.Admin), updatedUserWithUserMgmtScopes.TypedSpec().Value.Role)
+	suite.Require().Equal(string(role.Admin), updatedPubKeyWithUserMgmtScopes.TypedSpec().Value.Role)
+
+	suite.Require().Equal(string(role.Admin), updatedUserWithServiceAccountScopes.TypedSpec().Value.Role)
+	suite.Require().Equal(string(role.Admin), updatedPubKeyWithServiceAccountScopes.TypedSpec().Value.Role)
+}
+
+func (suite *MigrationSuite) TestLowercaseEmails() {
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	identityUppercase := authres.NewIdentity(resources.DefaultNamespace, "USER@a.com")
+	identityUppercase.TypedSpec().Value.UserId = "123"
+	identityUppercase.Metadata().Labels().Set("user-id", "123")
+
+	identityConflict := authres.NewIdentity(resources.DefaultNamespace, "B@a.com")
+	identityConflict.TypedSpec().Value.UserId = "555"
+	identityUnchanged := authres.NewIdentity(resources.DefaultNamespace, "b@a.com")
+	identityUnchanged.TypedSpec().Value.UserId = "111"
+
+	identityOverwrite := authres.NewIdentity(resources.DefaultNamespace, "C@a.com")
+	identityOverwrite.TypedSpec().Value.UserId = "ABC"
+	identityOverwritten := authres.NewIdentity(resources.DefaultNamespace, "c@a.com")
+	identityOverwritten.TypedSpec().Value.UserId = "eee"
+
+	publicKey := authres.NewPublicKey(resources.DefaultNamespace, "1")
+	publicKey.TypedSpec().Value.Identity = &specs.Identity{
+		Email: "USER@a.com",
+	}
+
+	danglingPublicKey := authres.NewPublicKey(resources.DefaultNamespace, "2")
+
+	suite.Require().NoError(suite.state.Create(ctx, identityUppercase))
+	suite.Require().NoError(suite.state.Create(ctx, identityConflict))
+	suite.Require().NoError(suite.state.Create(ctx, identityUnchanged))
+	suite.Require().NoError(suite.state.Create(ctx, identityOverwritten))
+	suite.Require().NoError(suite.state.Create(ctx, identityOverwrite))
+
+	suite.Require().NoError(suite.state.Create(ctx, publicKey))
+	// Run shouldn't fail if it finds this invalid public key
+	suite.Require().NoError(suite.state.Create(ctx, danglingPublicKey))
+
+	suite.Require().NoError(suite.manager.Run(ctx))
+
+	// USER@a.com was dropped
+	_, err := safe.ReaderGet[*authres.Identity](ctx, suite.state, identityUppercase.Metadata())
+	suite.Require().Error(err)
+
+	// USER@a.com should be replaced by user@a.com
+	identity, err := safe.ReaderGet[*authres.Identity](ctx, suite.state, authres.NewIdentity(resources.DefaultNamespace, "user@a.com").Metadata())
+	suite.Require().NoError(err)
+
+	suite.Require().Equal(identityUppercase.TypedSpec().Value.UserId, identity.TypedSpec().Value.UserId)
+	suite.Require().True(identityUppercase.Metadata().Labels().Equal(*identity.Metadata().Labels()))
+
+	// b@a.com should not be replaced as it's newer than B@a.com
+	identity, err = safe.ReaderGet[*authres.Identity](ctx, suite.state, authres.NewIdentity(resources.DefaultNamespace, "b@a.com").Metadata())
+	suite.Require().NoError(err)
+
+	_, err = safe.ReaderGet[*authres.Identity](ctx, suite.state, authres.NewIdentity(resources.DefaultNamespace, "B@a.com").Metadata())
+	suite.Require().Error(err)
+
+	suite.Require().Equal(identityUnchanged.TypedSpec().Value.UserId, identity.TypedSpec().Value.UserId)
+
+	// public key that belongs to email USER@a.com should be updated to point to user@a.com
+	key, err := safe.ReaderGet[*authres.PublicKey](ctx, suite.state, publicKey.Metadata())
+	suite.Require().NoError(err)
+	suite.Require().Equal("user@a.com", key.TypedSpec().Value.Identity.Email)
+
+	// c@a.com is overwritten by C@a.com as it has older creation time
+	// should have a new spec with the new user id
+	identity, err = safe.ReaderGet[*authres.Identity](ctx, suite.state, authres.NewIdentity(resources.DefaultNamespace, "c@a.com").Metadata())
+	suite.Require().NoError(err)
+	suite.Require().Equal(identityOverwrite.TypedSpec().Value.UserId, identity.TypedSpec().Value.UserId)
+}
+
+func (suite *MigrationSuite) TestPatchesExtraction() {
+	ctx := context.Background()
+
+	clusterName := "patches"
+	machines := []machine{
+		{
+			name: "m1",
+			labels: map[string]string{
+				"role-controlplane": "",
+			},
+		},
+		{
+			name: "m2",
+			labels: map[string]string{
+				"role-controlplane": "",
+			},
+		},
+		{
+			name: "m3",
+			labels: map[string]string{
+				"role-controlplane": "",
+			},
+		},
+		{
+			name: "m4",
+			labels: map[string]string{
+				"role-worker": "",
+			},
+		},
+	}
+
+	suite.createClusterWithMachines(ctx, clusterName, machines, true)
+
+	createResources := []pair.Pair[string, resource.Resource]{
+		pair.MakePair[string, resource.Resource]((&omnictrl.LoadBalancerController{}).Name(), omni.NewLoadBalancerConfig(resources.DefaultNamespace, clusterName)),
+		pair.MakePair[string, resource.Resource]("", omni.NewClusterSecrets(resources.DefaultNamespace, clusterName)),
+	}
+
+	createResources = append(createResources, xslices.Map(machines, func(m machine) pair.Pair[string, resource.Resource] {
+		return pair.MakePair[string, resource.Resource](omnictrl.NewClusterMachineConfigController(nil).Name(), omni.NewClusterMachineConfig(resources.DefaultNamespace, clusterName+"."+m.name))
+	})...)
+
+	for _, res := range createResources {
+		suite.Require().NoError(res.F2.Metadata().SetOwner(res.F1))
+		suite.Require().NoError(suite.state.Create(ctx, res.F2, state.WithCreateOwner(res.F1)))
+	}
+
+	suite.Require().NoError(suite.manager.Run(ctx))
+
+	for _, m := range []string{"patches.m1", "patches.m2", "patches.m3", "patches.m4"} {
+		patches, err := safe.StateGet[*omni.ClusterMachineConfigPatches](ctx, suite.state, omni.NewClusterMachineConfigPatches(resources.DefaultNamespace, m).Metadata())
+		suite.Require().NoError(err)
+		suite.assertLabel(patches, omni.SystemLabelPrefix+"cluster", "patches")
+		suite.Require().Len(patches.TypedSpec().Value.Patches, 1)
+
+		config, err := safe.StateGet[*omni.ClusterMachineConfig](ctx, suite.state, omni.NewClusterMachineConfig(resources.DefaultNamespace, m).Metadata())
+		suite.Require().NoError(err)
+
+		_, ok := config.Metadata().Annotations().Get("inputResourceVersion")
+		suite.Require().True(ok)
+	}
+}
+
+func (suite *MigrationSuite) TestInstallDiskPatchMigration() {
+	ctx := context.Background()
+
+	clusterName := "patches"
+	machines := []machine{
+		{
+			name: "m1",
+			labels: map[string]string{
+				"role-worker": "",
+			},
+		},
+	}
+
+	version := system.NewDBVersion(resources.DefaultNamespace, system.DBVersionID)
+	version.TypedSpec().Value.Version = 1
+
+	suite.Require().NoError(suite.state.Create(ctx, version))
+
+	suite.createClusterWithMachines(ctx, clusterName, machines, false)
+
+	m1 := "patches.m1"
+
+	m1Status := omni.NewMachineStatus(resources.DefaultNamespace, m1)
+	m1Status.TypedSpec().Value.Hardware = &specs.MachineStatusSpec_HardwareStatus{
+		Blockdevices: []*specs.MachineStatusSpec_HardwareStatus_BlockDevice{
+			{
+				LinuxName: "/dev/vdb",
+				Size:      8e9,
+			},
+		},
+	}
+
+	lbStatus := omni.NewLoadBalancerStatus(resources.DefaultNamespace, clusterName)
+	lbStatus.TypedSpec().Value.Healthy = true
+
+	machineSet := omni.NewMachineSet(
+		resources.DefaultNamespace,
+		omni.WorkersResourceID(clusterName),
+	)
+	machineSet.Metadata().Labels().Set(omni.LabelCluster, clusterName)
+	machineSet.Metadata().Labels().Set(omni.LabelControlPlaneRole, "")
+
+	clusterConfigVersion := omni.NewClusterConfigVersion(resources.DefaultNamespace, clusterName)
+	clusterConfigVersion.TypedSpec().Value.Version = "v1.4"
+
+	createResources := []pair.Pair[string, resource.Resource]{
+		pair.MakePair[string, resource.Resource]((&omnictrl.LoadBalancerController{}).Name(), omni.NewLoadBalancerConfig(resources.DefaultNamespace, clusterName)),
+		pair.MakePair[string, resource.Resource]((&omnictrl.LoadBalancerController{}).Name(), lbStatus),
+		pair.MakePair[string, resource.Resource]("", omni.NewClusterSecrets(resources.DefaultNamespace, clusterName)),
+		pair.MakePair[string, resource.Resource]("", m1Status),
+		pair.MakePair[string, resource.Resource]("", omni.NewMachine(resources.DefaultNamespace, m1)),
+		pair.MakePair[string, resource.Resource]("", omni.NewMachineSetNode(resources.DefaultNamespace, m1, machineSet)),
+		pair.MakePair[string, resource.Resource]("", clusterConfigVersion),
+	}
+
+	createResources = append(createResources, xslices.Map(machines, func(m machine) pair.Pair[string, resource.Resource] {
+		return pair.MakePair[string, resource.Resource](omnictrl.NewClusterMachineConfigController(nil).Name(), omni.NewClusterMachineConfig(resources.DefaultNamespace, clusterName+"."+m.name))
+	})...)
+
+	for _, res := range createResources {
+		suite.Require().NoError(res.F2.Metadata().SetOwner(res.F1))
+		suite.Require().NoError(suite.state.Create(ctx, res.F2, state.WithCreateOwner(res.F1)))
+	}
+
+	suite.Require().NoError(suite.manager.Run(ctx))
+
+	options, err := safe.StateGet[*omni.MachineConfigGenOptions](ctx, suite.state, omni.NewMachineConfigGenOptions(resources.DefaultNamespace, m1).Metadata())
+	suite.Require().NoError(err)
+	suite.Require().Equal("/dev/vdb", options.TypedSpec().Value.InstallDisk)
+
+	config, err := safe.StateGet[*omni.ClusterMachineConfig](ctx, suite.state, omni.NewClusterMachineConfig(resources.DefaultNamespace, m1).Metadata())
+	suite.Require().NoError(err)
+
+	_, ok := config.Metadata().Annotations().Get("inputResourceVersion")
+	suite.Require().True(ok)
+
+	oldVer := config.Metadata().Version()
+
+	// run controllers and verify that the config resource hasn't changed
+	runtime, err := runtime.NewRuntime(suite.state, suite.logger)
+	suite.Require().NoError(err)
+
+	suite.Require().NoError(runtime.RegisterQController(omnictrl.NewMachineConfigGenOptionsController()))
+	suite.Require().NoError(runtime.RegisterQController(omnictrl.NewClusterMachineConfigController(nil)))
+
+	runCtx, cancel := context.WithTimeout(ctx, time.Second)
+	defer cancel()
+
+	err = runtime.Run(runCtx)
+	if !errors.Is(err, context.Canceled) {
+		suite.Require().NoError(err)
+	}
+
+	config, err = safe.StateGet[*omni.ClusterMachineConfig](ctx, suite.state, omni.NewClusterMachineConfig(resources.DefaultNamespace, m1).Metadata())
+	suite.Require().NoError(err)
+
+	suite.Require().Equal(oldVer, config.Metadata().Version())
+}
+
+func (suite *MigrationSuite) TestSiderolinkCounterMigration() {
+	ctx := context.Background()
+
+	version := system.NewDBVersion(resources.DefaultNamespace, system.DBVersionID)
+	version.TypedSpec().Value.Version = 1
+	suite.Require().NoError(suite.state.Create(ctx, version))
+
+	counter := siderolink.NewDeprecatedLinkCounter(resources.MetricsNamespace, "test")
+	counter.TypedSpec().Value.BytesReceived = 100
+	counter.TypedSpec().Value.BytesSent = 200
+	counter.TypedSpec().Value.LastAlive = timestamppb.Now()
+	suite.Require().NoError(suite.state.Create(ctx, counter))
+
+	suite.Require().NoError(suite.manager.Run(ctx))
+
+	msl, err := safe.StateGet[*omni.MachineStatusLink](ctx, suite.state, omni.NewMachineStatusLink(resources.MetricsNamespace, "test").Metadata())
+	suite.Require().NoError(err)
+
+	suite.Require().Equal(counter.TypedSpec().Value.BytesReceived, msl.TypedSpec().Value.SiderolinkCounter.BytesReceived)
+	suite.Require().Equal(counter.TypedSpec().Value.BytesSent, msl.TypedSpec().Value.SiderolinkCounter.BytesSent)
+	suite.Require().Equal(counter.TypedSpec().Value.LastAlive.AsTime(), msl.TypedSpec().Value.SiderolinkCounter.LastAlive.AsTime())
+
+	_, err = safe.StateGet[*siderolink.DeprecatedLinkCounter](ctx, suite.state, counter.Metadata())
+	suite.Require().Error(err)
+	suite.Require().True(state.IsNotFoundError(err))
+}
+
+func (suite *MigrationSuite) TestFixClusterConfigVersionOwnership() {
+	ctx := context.Background()
+
+	version := system.NewDBVersion(resources.DefaultNamespace, system.DBVersionID)
+	version.TypedSpec().Value.Version = 1
+	suite.Require().NoError(suite.state.Create(ctx, version))
+
+	c1 := omni.NewClusterConfigVersion(resources.DefaultNamespace, "1")
+	c2 := omni.NewClusterConfigVersion(resources.DefaultNamespace, "2")
+
+	expectedName := "ClusterConfigVersionController"
+
+	suite.Require().NoError(suite.state.Create(ctx, c1, state.WithCreateOwner("ClusterController")))
+	suite.Require().NoError(suite.state.Create(ctx, c2, state.WithCreateOwner(expectedName)))
+
+	suite.Require().NoError(suite.manager.Run(ctx))
+
+	var err error
+
+	c1, err = safe.StateGet[*omni.ClusterConfigVersion](ctx, suite.state, c1.Metadata())
+	suite.Require().NoError(err)
+
+	c2, err = safe.StateGet[*omni.ClusterConfigVersion](ctx, suite.state, c2.Metadata())
+	suite.Require().NoError(err)
+
+	suite.Require().Equal(expectedName, c1.Metadata().Owner())
+	suite.Require().Equal(expectedName, c2.Metadata().Owner())
+}
+
+func TestMigrationSuite(t *testing.T) {
+	suite.Run(t, new(MigrationSuite))
+}
diff --git a/internal/backend/runtime/omni/migration/migrations.go b/internal/backend/runtime/omni/migration/migrations.go
new file mode 100644
index 000000000..e78f2d527
--- /dev/null
+++ b/internal/backend/runtime/omni/migration/migrations.go
@@ -0,0 +1,1024 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package migration
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/kvutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/google/uuid"
+	"github.com/siderolabs/gen/pair"
+	"go.uber.org/zap"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/registry"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/auth/scope"
+	"github.com/siderolabs/omni/internal/pkg/image"
+)
+
+const (
+	deprecatedControlPlaneRole = "role-controlplane"
+	deprecatedWorkerRole       = "role-worker"
+	deprecatedCluster          = "cluster"
+)
+
+// populate Kubernetes versions and Talos versions ClusterMachineTemplates in the Cluster resources.
+func clusterInfo(ctx context.Context, s state.State, _ *zap.Logger) error {
+	list, err := safe.StateListAll[*omni.Cluster](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	for iter := list.Iterator(); iter.Next(); {
+		item := iter.Value().TypedSpec()
+
+		if item.Value.InstallImage == "" || item.Value.KubernetesVersion == "" { //nolint:staticcheck
+			_, err = safe.StateUpdateWithConflicts(ctx, s, iter.Value().Metadata(), func(c *omni.Cluster) error {
+				var items safe.List[*omni.ClusterMachineTemplate]
+
+				items, err = safe.ReaderListAll[*omni.ClusterMachineTemplate](
+					ctx,
+					s,
+					state.WithLabelQuery(resource.LabelEqual(deprecatedCluster, c.Metadata().ID())),
+				)
+				if err != nil {
+					return err
+				}
+
+				if items.Len() == 0 {
+					return nil
+				}
+
+				machine := items.Get(0)
+				c.TypedSpec().Value.InstallImage = machine.TypedSpec().Value.InstallImage //nolint:staticcheck
+				c.TypedSpec().Value.KubernetesVersion = machine.TypedSpec().Value.KubernetesVersion
+
+				return nil
+			})
+			if err != nil {
+				if state.IsPhaseConflictError(err) {
+					continue
+				}
+
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func deprecateClusterMachineTemplates(ctx context.Context, s state.State, _ *zap.Logger) error {
+	list, err := safe.StateListAll[*omni.ClusterMachineTemplate](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	for iter := list.Iterator(); iter.Next(); {
+		item := iter.Value().TypedSpec()
+
+		// generate user patch if it is defined
+		if item.Value.Patch != "" {
+			patch := omni.NewConfigPatch(resources.DefaultNamespace, fmt.Sprintf("500-%s", uuid.New()),
+				pair.MakePair("machine-uuid", iter.Value().Metadata().ID()),
+			)
+
+			omnictrl.CopyLabels(iter.Value(), patch, deprecatedCluster)
+
+			if err = createOrUpdate(ctx, s, patch, func(p *omni.ConfigPatch) error {
+				p.TypedSpec().Value.Data = item.Value.Patch
+
+				return nil
+			}, ""); err != nil {
+				return err
+			}
+		}
+
+		// generate install disk patch
+		patch := omni.NewConfigPatch(
+			resources.DefaultNamespace,
+			fmt.Sprintf("000-%s", uuid.New()),
+			pair.MakePair("machine-uuid", iter.Value().Metadata().ID()),
+		)
+
+		omnictrl.CopyLabels(iter.Value(), patch, deprecatedCluster)
+
+		if err = createOrUpdate(ctx, s, patch, func(p *omni.ConfigPatch) error {
+			var config struct {
+				MachineConfig struct {
+					MachineInstall struct {
+						InstallDisk string `yaml:"disk"`
+					} `yaml:"install"`
+				} `yaml:"machine"`
+			}
+
+			config.MachineConfig.MachineInstall.InstallDisk = item.Value.InstallDisk
+
+			var data []byte
+			data, err = yaml.Marshal(config)
+			if err != nil {
+				return err
+			}
+
+			p.TypedSpec().Value.Data = string(data)
+			p.Metadata().Labels().Set("machine-uuid", iter.Value().Metadata().ID())
+
+			return nil
+		}, ""); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func clusterMachinesToMachineSets(ctx context.Context, s state.State, logger *zap.Logger) error {
+	list, err := safe.StateListAll[*omni.ClusterMachine](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	machineSets := map[string]*omni.MachineSet{}
+
+	// first gather all machines from the database and create backup data
+	for iter := list.Iterator(); iter.Next(); {
+		item := iter.Value()
+
+		labels := item.Metadata().Labels()
+
+		clusterName, ok := labels.Get(deprecatedCluster)
+		if !ok {
+			logger.Warn("orphaned cluster machine", zap.String("id", item.Metadata().String()))
+
+			continue
+		}
+
+		machineSetID := omni.WorkersResourceID(clusterName)
+
+		if _, ok = item.Metadata().Labels().Get(deprecatedControlPlaneRole); ok {
+			machineSetID = omni.ControlPlanesResourceID(clusterName)
+		}
+
+		if _, ok = machineSets[machineSetID]; !ok {
+			machineSets[machineSetID] = omni.NewMachineSet(resources.DefaultNamespace, machineSetID)
+
+			omnictrl.CopyLabels(item, machineSets[machineSetID], deprecatedCluster, deprecatedWorkerRole, deprecatedControlPlaneRole)
+		}
+
+		var patches []*omni.ConfigPatch
+
+		patches, err = getConfigPatches(ctx, s, item, machineSets[machineSetID], "")
+		if err != nil {
+			return err
+		}
+
+		_, err = safe.StateUpdateWithConflicts(ctx, s, item.Metadata(), func(res *omni.ClusterMachine) error {
+			res.Metadata().Labels().Set("machine-set", machineSetID)
+
+			omnictrl.UpdateInputsVersions(res, patches...)
+
+			return res.Metadata().SetOwner((&omnictrl.MachineSetStatusController{}).Name())
+		}, state.WithExpectedPhaseAny(), state.WithUpdateOwner(item.Metadata().Owner()))
+		if err != nil {
+			return err
+		}
+
+		machineSetNode := omni.NewMachineSetNode(resources.DefaultNamespace, item.Metadata().ID(), machineSets[machineSetID])
+		if err = createOrUpdate(ctx, s, machineSetNode, func(res *omni.MachineSetNode) error {
+			omnictrl.CopyLabels(machineSetNode, res, deprecatedCluster, deprecatedWorkerRole)
+
+			res.TypedSpec().Value = machineSetNode.TypedSpec().Value
+
+			return nil
+		}, "", state.WithExpectedPhaseAny()); err != nil {
+			return err
+		}
+	}
+
+	for _, ms := range machineSets {
+		if err = createOrUpdate(ctx, s, ms, func(res *omni.MachineSet) error {
+			omnictrl.CopyLabels(ms, res, deprecatedCluster, deprecatedWorkerRole)
+
+			res.TypedSpec().Value = ms.TypedSpec().Value
+
+			return nil
+		}, "", state.WithExpectedPhaseAny()); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func changePublicKeyOwner(ctx context.Context, s state.State, logger *zap.Logger) error {
+	logger = logger.With(zap.String("migration", "changePublicKeyOwner"))
+
+	list, err := safe.StateListAll[*auth.PublicKey](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	for iter := list.Iterator(); iter.Next(); {
+		item := iter.Value()
+
+		if item.Metadata().Owner() != "" {
+			continue
+		}
+
+		logger.Info("updating public key with empty owner", zap.String("id", item.Metadata().String()))
+
+		_, err = safe.StateUpdateWithConflicts(ctx, s, item.Metadata(), func(res *auth.PublicKey) error {
+			return res.Metadata().SetOwner((&omnictrl.KeyPrunerController{}).Name())
+		}, state.WithExpectedPhaseAny(), state.WithUpdateOwner(item.Metadata().Owner()))
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func addDefaultScopesToUsers(ctx context.Context, s state.State, logger *zap.Logger) error {
+	logger = logger.With(zap.String("migration", "addDefaultScopesToUsers"))
+
+	list, err := safe.StateListAll[*auth.User](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	scopes := scope.NewScopes(scope.UserDefaultScopes...).Strings()
+
+	for iter := list.Iterator(); iter.Next(); {
+		user := iter.Value()
+
+		if len(user.TypedSpec().Value.GetScopes()) == 0 {
+			logger.Info("adding scopes to user",
+				zap.String("id", user.Metadata().String()), zap.Strings("scopes", scopes),
+			)
+
+			_, err = safe.StateUpdateWithConflicts(ctx, s, user.Metadata(), func(u *auth.User) error {
+				u.TypedSpec().Value.Scopes = scopes //nolint:staticcheck
+
+				return nil
+			}, state.WithExpectedPhaseAny())
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func setRollingStrategyOnControlPlaneMachineSets(ctx context.Context, s state.State, logger *zap.Logger) error {
+	logger = logger.With(zap.String("migration", "setRollingStrategyOnControlPlaneMachineSets"))
+
+	list, err := safe.StateListAll[*omni.MachineSet](
+		ctx,
+		s,
+		state.WithLabelQuery(resource.LabelExists(deprecatedControlPlaneRole)),
+	)
+	if err != nil {
+		return err
+	}
+
+	for iter := list.Iterator(); iter.Next(); {
+		machineSet := iter.Value()
+
+		if machineSet.Metadata().Phase() == resource.PhaseTearingDown {
+			continue
+		}
+
+		if machineSet.TypedSpec().Value.GetUpdateStrategy() == specs.MachineSetSpec_Unset {
+			logger.Info("setting rolling update strategy on control plane machine set",
+				zap.String("id", machineSet.Metadata().String()),
+			)
+
+			_, err = safe.StateUpdateWithConflicts(ctx, s, machineSet.Metadata(), func(ms *omni.MachineSet) error {
+				ms.TypedSpec().Value.UpdateStrategy = specs.MachineSetSpec_Rolling
+
+				return nil
+			})
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func updateConfigPatchLabels(ctx context.Context, s state.State, _ *zap.Logger) error {
+	clusterMachineList, err := safe.StateListAll[*omni.ClusterMachine](
+		ctx,
+		s,
+	)
+	if err != nil {
+		return err
+	}
+
+	clusterMachineToCluster := map[resource.ID]resource.ID{}
+
+	for iter := clusterMachineList.Iterator(); iter.Next(); {
+		clusterMachine := iter.Value()
+
+		cluster, _ := clusterMachine.Metadata().Labels().Get(deprecatedCluster)
+		clusterMachineToCluster[clusterMachine.Metadata().ID()] = cluster
+	}
+
+	machineSetList, err := safe.StateListAll[*omni.MachineSet](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	machineSetToCluster := map[resource.ID]resource.ID{}
+
+	for iter := machineSetList.Iterator(); iter.Next(); {
+		machineSet := iter.Value()
+
+		cluster, _ := machineSet.Metadata().Labels().Get(deprecatedCluster)
+		machineSetToCluster[machineSet.Metadata().ID()] = cluster
+	}
+
+	configPatchList, err := safe.StateListAll[*omni.ConfigPatch](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	for iter := configPatchList.Iterator(); iter.Next(); {
+		_, err = safe.StateUpdateWithConflicts(ctx, s, iter.Value().Metadata(), func(patch *omni.ConfigPatch) error {
+			labels := patch.Metadata().Labels()
+
+			clusterName, clusterNameOk := labels.Get("cluster-name")
+			if clusterNameOk {
+				labels.Set(deprecatedCluster, clusterName)
+				labels.Delete("cluster-name")
+			}
+
+			machineSet, machineSetOk := labels.Get("machine-set-name")
+			if machineSetOk {
+				labels.Set("machine-set", machineSet)
+				labels.Delete("machine-set-name")
+
+				cluster := machineSetToCluster[machineSet]
+				if cluster != "" {
+					labels.Set(deprecatedCluster, cluster)
+				}
+			}
+
+			clusterMachine, clusterMachineOk := labels.Get("machine-uuid")
+			if clusterMachineOk {
+				labels.Set("cluster-machine", clusterMachine)
+				labels.Delete("machine-uuid")
+
+				cluster := clusterMachineToCluster[clusterMachine]
+				if cluster != "" {
+					labels.Set(deprecatedCluster, cluster)
+				}
+			}
+
+			return nil
+		}, state.WithExpectedPhaseAny())
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// migrate finalizer on the Machine from 'ClusterMachineStatusController' to 'MachineSetStatusController'.
+func updateMachineFinalizers(ctx context.Context, s state.State, logger *zap.Logger) error {
+	logger = logger.With(zap.String("migration", "updateMachineFinalizers"))
+
+	machineList, err := safe.StateListAll[*omni.Machine](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	for iter := machineList.Iterator(); iter.Next(); {
+		machine := iter.Value()
+
+		if machine.Metadata().Finalizers().Add("ClusterMachineStatusController") {
+			// no finalizer, skip it
+			continue
+		}
+
+		cms, err := safe.StateGet[*omni.ClusterMachine](ctx, s, omni.NewClusterMachine(resources.DefaultNamespace, machine.Metadata().ID()).Metadata())
+		if err != nil && !state.IsNotFoundError(err) {
+			return err
+		}
+
+		if err = s.RemoveFinalizer(ctx, machine.Metadata(), "ClusterMachineStatusController"); err != nil {
+			return err
+		}
+
+		if cms != nil {
+			if err = s.AddFinalizer(ctx, machine.Metadata(), "MachineSetStatusController"); err != nil {
+				return err
+			}
+		}
+
+		logger.Info("updated machine finalizers", zap.String("machine", machine.Metadata().ID()))
+	}
+
+	return nil
+}
+
+func labelConfigPatches(ctx context.Context, s state.State, _ *zap.Logger) error {
+	patchList, err := safe.StateListAll[*omni.ConfigPatch](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	for iter := patchList.Iterator(); iter.Next(); {
+		patch := iter.Value()
+
+		// if the patch is prefixed with 000- then it's install disk patch and it should be updated with appropriate labels
+		if strings.HasPrefix(patch.Metadata().ID(), "000-") {
+			if _, err = safe.StateUpdateWithConflicts(ctx, s, patch.Metadata(), func(res *omni.ConfigPatch) error {
+				res.Metadata().Labels().Set("system-patch", "")
+
+				return nil
+			}); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func updateMachineStatusClusterRelations(ctx context.Context, s state.State, _ *zap.Logger) error {
+	msList, err := safe.StateListAll[*omni.MachineStatus](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	for iter := msList.Iterator(); iter.Next(); {
+		ms := iter.Value()
+
+		if ms.Metadata().Phase() == resource.PhaseTearingDown {
+			continue
+		}
+
+		_, err = safe.StateUpdateWithConflicts(ctx, s, ms.Metadata(), func(res *omni.MachineStatus) error {
+			labels := res.Metadata().Labels()
+			spec := res.TypedSpec().Value
+
+			cluster, ok := labels.Get(deprecatedCluster)
+			if !ok {
+				cluster = spec.Cluster
+			}
+
+			if cluster == "" {
+				labels.Delete(deprecatedControlPlaneRole)
+				labels.Delete(deprecatedWorkerRole)
+
+				labels.Set("available", "")
+
+				return nil
+			}
+
+			spec.Cluster = cluster
+
+			_, controlPlane := res.Metadata().Labels().Get(deprecatedControlPlaneRole)
+			if controlPlane {
+				spec.Role = specs.MachineStatusSpec_CONTROL_PLANE
+			}
+
+			_, worker := labels.Get(deprecatedWorkerRole)
+			if worker {
+				spec.Role = specs.MachineStatusSpec_WORKER
+			}
+
+			labels.Delete(deprecatedCluster)
+			labels.Delete(deprecatedControlPlaneRole)
+			labels.Delete(deprecatedWorkerRole)
+
+			return nil
+		}, state.WithUpdateOwner(ms.Metadata().Owner()))
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+//nolint:staticcheck
+func addServiceAccountScopesToUsers(ctx context.Context, s state.State, _ *zap.Logger) error {
+	userList, err := safe.StateListAll[*auth.User](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	for iter := userList.Iterator(); iter.Next(); {
+		user := iter.Value()
+
+		_, err = safe.StateUpdateWithConflicts(ctx, s, user.Metadata(), func(u *auth.User) error {
+			if !slices.ContainsFunc(u.TypedSpec().Value.Scopes, func(s string) bool {
+				return s == scope.ServiceAccountAny.String()
+			}) {
+				u.TypedSpec().Value.Scopes = append(u.TypedSpec().Value.Scopes, scope.ServiceAccountAny.String())
+			}
+
+			return nil
+		}, state.WithUpdateOwner(user.Metadata().Owner()))
+		if err != nil {
+			return err
+		}
+	}
+
+	publicKeyList, err := safe.StateListAll[*auth.PublicKey](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	for iter := publicKeyList.Iterator(); iter.Next(); {
+		key := iter.Value()
+
+		_, err = safe.StateUpdateWithConflicts(ctx, s, key.Metadata(), func(pk *auth.PublicKey) error {
+			pk.TypedSpec().Value.Scopes = append(pk.TypedSpec().Value.Scopes, scope.ServiceAccountAny.String())
+
+			return nil
+		}, state.WithUpdateOwner(key.Metadata().Owner()))
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func clusterInstallImageToTalosVersion(ctx context.Context, s state.State, _ *zap.Logger) error {
+	clusterList, err := safe.StateListAll[*omni.Cluster](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	for iter := clusterList.Iterator(); iter.Next(); {
+		cluster := iter.Value()
+
+		if cluster.Metadata().Phase() != resource.PhaseRunning {
+			continue
+		}
+
+		_, err = safe.StateUpdateWithConflicts(ctx, s, cluster.Metadata(), func(res *omni.Cluster) error {
+			var version string
+
+			version, err = image.GetTag(res.TypedSpec().Value.InstallImage) //nolint:staticcheck
+			if err != nil {
+				return fmt.Errorf("failed to migrate %s to the new scheme, install image %q: %w", cluster.Metadata(), res.TypedSpec().Value.InstallImage, err) //nolint:staticcheck
+			}
+
+			res.TypedSpec().Value.TalosVersion = strings.TrimLeft(version, "v")
+
+			return nil
+		})
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func migrateLabels(ctx context.Context, s state.State, _ *zap.Logger) error {
+	for _, r := range registry.Resources {
+		definition := r.ResourceDefinition()
+
+		if definition.DefaultNamespace != resources.DefaultNamespace ||
+			definition.Type == omni.MachineLabelsType ||
+			definition.Type == auth.IdentityType ||
+			definition.Type == auth.UserType {
+			continue
+		}
+
+		list, err := s.List(ctx, resource.NewMetadata(definition.DefaultNamespace, definition.Type, "", resource.VersionUndefined))
+		if err != nil {
+			return err
+		}
+
+		for _, r := range list.Items {
+			_, err = s.UpdateWithConflicts(ctx, r.Metadata(), func(res resource.Resource) error {
+				for label, value := range res.Metadata().Labels().Raw() {
+					if !strings.HasPrefix(label, omni.SystemLabelPrefix) {
+						res.Metadata().Labels().Set(omni.SystemLabelPrefix+label, value)
+					}
+				}
+
+				return nil
+			}, state.WithExpectedPhaseAny(), state.WithUpdateOwner(r.Metadata().Owner()))
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func dropOldLabels(ctx context.Context, s state.State, _ *zap.Logger) error {
+	dropLabels := map[string]struct{}{
+		"address":                   {},
+		"arch":                      {},
+		"available":                 {},
+		"cluster":                   {},
+		"cluster-machine":           {},
+		"connected":                 {},
+		"cores":                     {},
+		"cpu":                       {},
+		"disconnected":              {},
+		"hostname":                  {},
+		"instance":                  {},
+		"machine":                   {},
+		"machine-set":               {},
+		"machine-set-skip-teardown": {},
+		"mem":                       {},
+		"net":                       {},
+		"node-name":                 {},
+		"platform":                  {},
+		"region":                    {},
+		"reporting-events":          {},
+		"role-controlplane":         {},
+		"role-worker":               {},
+		"storage":                   {},
+		"system-patch":              {},
+		"zone":                      {},
+	}
+
+	for _, r := range registry.Resources {
+		definition := r.ResourceDefinition()
+
+		if definition.DefaultNamespace != resources.DefaultNamespace ||
+			definition.Type == omni.MachineLabelsType {
+			continue
+		}
+
+		list, err := s.List(ctx, resource.NewMetadata(definition.DefaultNamespace, definition.Type, "", resource.VersionUndefined))
+		if err != nil {
+			return err
+		}
+
+		for _, r := range list.Items {
+			_, err = s.UpdateWithConflicts(ctx, r.Metadata(), func(res resource.Resource) error {
+				res.Metadata().Labels().Do(func(kvutils.TempKV) {
+					for label, value := range res.Metadata().Labels().Raw() {
+						_, ok := dropLabels[label]
+						if !ok {
+							continue
+						}
+
+						copiedValue, exists := res.Metadata().Labels().Get(omni.SystemLabelPrefix + label)
+						if !exists || copiedValue != value {
+							continue
+						}
+
+						res.Metadata().Labels().Delete(label)
+					}
+				})
+
+				return nil
+			}, state.WithExpectedPhaseAny(), state.WithUpdateOwner(r.Metadata().Owner()))
+			if err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}
+
+func convertScopesToRoles(ctx context.Context, st state.State, _ *zap.Logger) error {
+	scopesToRole := func(scopes scope.Scopes) role.Role {
+		scopeList := scopes.List()
+		if len(scopeList) == 0 {
+			return role.None
+		}
+
+		readOnly := true
+
+		// a scope with any kind of access to the users or to the service accounts implies being an admin
+		for _, s := range scopeList {
+			if s.Object == scope.ObjectUser || s.Object == scope.ObjectServiceAccount {
+				return role.Admin
+			}
+
+			if s.Action != scope.ActionRead {
+				readOnly = false
+			}
+		}
+
+		if readOnly {
+			return role.Reader
+		}
+
+		return role.Operator
+	}
+
+	// users
+	userList, err := safe.StateListAll[*auth.User](ctx, st)
+	if err != nil {
+		return fmt.Errorf("failed to list users: %w", err)
+	}
+
+	for iter := userList.Iterator(); iter.Next(); {
+		item := iter.Value()
+
+		if _, err = safe.StateUpdateWithConflicts(ctx, st, item.Metadata(), func(user *auth.User) error {
+			scopes, scopesErr := scope.ParseScopes(user.TypedSpec().Value.GetScopes())
+			if scopesErr != nil {
+				return fmt.Errorf("failed to parse scopes: %w", scopesErr)
+			}
+
+			user.TypedSpec().Value.Role = string(scopesToRole(scopes))
+
+			return nil
+		}, state.WithExpectedPhaseAny(), state.WithUpdateOwner(item.Metadata().Owner())); err != nil {
+			return fmt.Errorf("failed to update user %q: %w", item.Metadata(), err)
+		}
+	}
+
+	// public keys
+	pubKeyList, err := safe.StateListAll[*auth.PublicKey](ctx, st)
+	if err != nil {
+		return fmt.Errorf("failed to list public keys: %w", err)
+	}
+
+	for iter := pubKeyList.Iterator(); iter.Next(); {
+		item := iter.Value()
+
+		if _, err = safe.StateUpdateWithConflicts(ctx, st, item.Metadata(), func(pubKey *auth.PublicKey) error {
+			scopes, scopesErr := scope.ParseScopes(pubKey.TypedSpec().Value.GetScopes())
+			if scopesErr != nil {
+				return fmt.Errorf("failed to parse scopes: %w", scopesErr)
+			}
+
+			pubKey.TypedSpec().Value.Role = string(scopesToRole(scopes))
+
+			return nil
+		}, state.WithExpectedPhaseAny(), state.WithUpdateOwner(item.Metadata().Owner())); err != nil {
+			return fmt.Errorf("failed to update public key %q: %w", item.Metadata(), err)
+		}
+	}
+
+	return nil
+}
+
+func lowercaseAllIdentities(ctx context.Context, st state.State, _ *zap.Logger) error {
+	identities, err := safe.StateListAll[*auth.Identity](ctx, st)
+	if err != nil {
+		return fmt.Errorf("failed to list users: %w", err)
+	}
+
+	migrated := map[string]struct{}{}
+
+	if err = identities.ForEachErr(func(identity *auth.Identity) error {
+		id := identity.Metadata().ID()
+		lowercase := strings.ToLower(id)
+
+		if id == lowercase {
+			return nil
+		}
+
+		var existing *auth.Identity
+
+		existing, err = safe.ReaderGet[*auth.Identity](ctx, st, auth.NewIdentity(identity.Metadata().Namespace(), lowercase).Metadata())
+		if err != nil && !state.IsNotFoundError(err) {
+			return err
+		}
+
+		switch {
+		case existing == nil:
+			res := auth.NewIdentity(identity.Metadata().Namespace(), lowercase)
+			omnictrl.CopyAllLabels(identity, res)
+
+			res.TypedSpec().Value = identity.TypedSpec().Value
+
+			if err = st.Create(ctx, res); err != nil {
+				return err
+			}
+		case existing.Metadata().Created().After(identity.Metadata().Created()):
+		default:
+			if _, err = safe.StateUpdateWithConflicts(ctx, st, existing.Metadata(), func(res *auth.Identity) error {
+				omnictrl.CopyAllLabels(identity, res)
+
+				res.TypedSpec().Value = identity.TypedSpec().Value
+
+				return nil
+			}); err != nil {
+				return err
+			}
+		}
+
+		if err = st.Destroy(ctx, identity.Metadata()); err != nil {
+			return err
+		}
+
+		migrated[id] = struct{}{}
+
+		return nil
+	}); err != nil {
+		return err
+	}
+
+	if len(migrated) == 0 {
+		return nil
+	}
+
+	var keys safe.List[*auth.PublicKey]
+
+	keys, err = safe.StateListAll[*auth.PublicKey](ctx, st)
+	if err != nil {
+		return fmt.Errorf("failed to list users: %w", err)
+	}
+
+	return keys.ForEachErr(func(k *auth.PublicKey) error {
+		if k.TypedSpec().Value.Identity == nil {
+			return nil
+		}
+
+		if _, ok := migrated[k.TypedSpec().Value.Identity.Email]; !ok {
+			return nil
+		}
+
+		_, err = safe.StateUpdateWithConflicts(ctx, st, k.Metadata(), func(res *auth.PublicKey) error {
+			res.TypedSpec().Value.Identity.Email = strings.ToLower(res.TypedSpec().Value.Identity.Email)
+
+			return nil
+		}, state.WithExpectedPhaseAny(), state.WithUpdateOwner((&omnictrl.KeyPrunerController{}).Name()))
+
+		return err
+	})
+}
+
+func removeConfigPatchesFromClusterMachines(ctx context.Context, st state.State, _ *zap.Logger) error {
+	items, err := safe.ReaderListAll[*omni.ClusterMachine](
+		ctx,
+		st,
+	)
+	if err != nil {
+		return err
+	}
+
+	return items.ForEachErr(func(item *omni.ClusterMachine) error {
+		owner := (&omnictrl.MachineSetStatusController{}).Name()
+
+		err = createOrUpdate(ctx, st, omni.NewClusterMachineConfigPatches(item.Metadata().Namespace(), item.Metadata().ID()),
+			func(res *omni.ClusterMachineConfigPatches) error {
+				omnictrl.CopyAllLabels(item, res)
+
+				machineSet, ok := item.Metadata().Labels().Get(omni.SystemLabelPrefix + "machine-set")
+				if !ok {
+					return nil
+				}
+
+				var patches []*omni.ConfigPatch
+
+				patches, err = getConfigPatches(ctx, st, item, omni.NewMachineSet(resources.DefaultNamespace, machineSet), omni.SystemLabelPrefix)
+				if err != nil {
+					return err
+				}
+
+				patchesRaw := make([]string, 0, len(patches))
+
+				for _, p := range patches {
+					patchesRaw = append(patchesRaw, p.TypedSpec().Value.Data)
+				}
+
+				res.TypedSpec().Value.Patches = patchesRaw
+
+				return nil
+			}, owner, state.WithExpectedPhaseAny(),
+		)
+		if err != nil {
+			return err
+		}
+
+		// cleanup patches data from the resource to free up space
+		if err = createOrUpdate(ctx, st, item, func(*omni.ClusterMachine) error {
+			return nil
+		}, owner, state.WithExpectedPhaseAny()); err != nil {
+			return err
+		}
+
+		return reconcileConfigInputs(ctx, st, item, false)
+	})
+}
+
+// this migration does the following:
+//   - create machine config gen options resources.
+//   - reconcile machine config version to avoid triggering config apply calls on all machines.
+func machineInstallDiskPatches(ctx context.Context, st state.State, _ *zap.Logger) error {
+	items, err := safe.ReaderListAll[*omni.ClusterMachine](
+		ctx,
+		st,
+	)
+	if err != nil {
+		return err
+	}
+
+	return items.ForEachErr(func(item *omni.ClusterMachine) error {
+		machineStatus, err := safe.StateGet[*omni.MachineStatus](ctx, st, omni.NewMachineStatus(resources.DefaultNamespace, item.Metadata().ID()).Metadata())
+		if err != nil {
+			if state.IsNotFoundError(err) {
+				return nil
+			}
+
+			return err
+		}
+
+		if err = createOrUpdate(ctx, st, omni.NewMachineConfigGenOptions(resources.DefaultNamespace, item.Metadata().ID()), func(res *omni.MachineConfigGenOptions) error {
+			omnictrl.GenInstallConfig(machineStatus, res)
+
+			return nil
+		}, omnictrl.NewMachineConfigGenOptionsController().Name()); err != nil {
+			return err
+		}
+
+		return reconcileConfigInputs(ctx, st, item, true)
+	})
+}
+
+// siderolinkCounters moves data from siderolink.DeprecatedLinkCounter resource to omni.MachineStatusLink resource.
+//
+// The rest of MachineStatusLink resource will be filled by the controller.
+// siderolink.DeprecatedLinkCounter will be destroyed at the end of the migration.
+func siderolinkCounters(ctx context.Context, s state.State, logger *zap.Logger) error {
+	logger = logger.With(zap.String("migration", "siderolinkCounters"))
+
+	list, err := safe.StateListAll[*siderolink.DeprecatedLinkCounter](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	migrated := 0
+
+	for iter := list.Iterator(); iter.Next(); {
+		linkCounter := iter.Value()
+
+		if err = createOrUpdate(ctx, s, omni.NewMachineStatusLink(resources.MetricsNamespace, linkCounter.Metadata().ID()),
+			func(res *omni.MachineStatusLink) error {
+				res.TypedSpec().Value.SiderolinkCounter = linkCounter.TypedSpec().Value
+
+				return nil
+			}, omnictrl.NewMachineStatusLinkController(nil).Name()); err != nil {
+			return err
+		}
+
+		if err = s.Destroy(ctx, linkCounter.Metadata(), state.WithDestroyOwner(linkCounter.Metadata().Owner())); err != nil {
+			return err
+		}
+
+		migrated++
+	}
+
+	logger.Info("migrated siderolink counters", zap.Int("count", migrated))
+
+	return nil
+}
+
+// this migration fixes ownership of all ClusterConfigVersion resources, it was initially created by ClusterController,
+// but then it got it's own ClusterConfigVersion controller.
+func fixClusterTalosVersionOwnership(ctx context.Context, s state.State, _ *zap.Logger) error {
+	list, err := safe.StateListAll[*omni.ClusterConfigVersion](ctx, s)
+	if err != nil {
+		return err
+	}
+
+	expectedOwner := omnictrl.NewClusterConfigVersionController().ControllerName
+
+	return list.ForEachErr(func(r *omni.ClusterConfigVersion) error {
+		owner := r.Metadata().Owner()
+		if owner == expectedOwner {
+			return nil
+		}
+
+		updated := omni.NewClusterConfigVersion(resources.DefaultNamespace, r.Metadata().ID())
+		updated.TypedSpec().Value = r.TypedSpec().Value
+		updated.Metadata().SetVersion(r.Metadata().Version())
+
+		if err = updated.Metadata().SetOwner(expectedOwner); err != nil {
+			return err
+		}
+
+		return s.Update(ctx, updated, state.WithUpdateOwner(owner))
+	})
+}
diff --git a/internal/backend/runtime/omni/omni.go b/internal/backend/runtime/omni/omni.go
new file mode 100644
index 000000000..44aae3f19
--- /dev/null
+++ b/internal/backend/runtime/omni/omni.go
@@ -0,0 +1,511 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package omni implements the internal service runtime.
+package omni
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	cosiruntime "github.com/cosi-project/runtime/pkg/controller/runtime"
+	"github.com/cosi-project/runtime/pkg/controller/runtime/options"
+	cosiresource "github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/collectors"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/common"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/cosi/labels"
+	omniresources "github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	siderolinkresources "github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	virtualres "github.com/siderolabs/omni/client/pkg/omni/resources/virtual"
+	pkgruntime "github.com/siderolabs/omni/client/pkg/runtime"
+	"github.com/siderolabs/omni/internal/backend/dns"
+	"github.com/siderolabs/omni/internal/backend/resourcelogger"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime/cosi"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup/store"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/image"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/validated"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/virtual"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/virtual/pkg/producers"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+	"github.com/siderolabs/omni/internal/backend/workloadproxy"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/config"
+	newgroup "github.com/siderolabs/omni/internal/pkg/errgroup"
+	"github.com/siderolabs/omni/internal/pkg/siderolink"
+)
+
+// Name is the runtime time.
+var Name = common.Runtime_Omni.String()
+
+// Runtime implements Omni internal runtime.
+type Runtime struct {
+	controllerRuntime  *cosiruntime.Runtime
+	talosClientFactory *talos.ClientFactory
+	storeFactory       store.Factory
+
+	dnsService                   *dns.Service
+	workloadProxyServiceRegistry *workloadproxy.ServiceRegistry
+	resourceLogger               *resourcelogger.Logger
+
+	// resource state for internal consumers
+	state   state.State
+	virtual *virtual.State
+
+	logger *zap.Logger
+}
+
+// New creates a new Omni runtime.
+func New(talosClientFactory *talos.ClientFactory, dnsService *dns.Service, workloadProxyServiceRegistry *workloadproxy.ServiceRegistry,
+	resourceLogger *resourcelogger.Logger, linkCounterDeltaCh <-chan siderolink.LinkCounterDeltas, resourceState state.State,
+	virtualState *virtual.State, metricsRegistry prometheus.Registerer, logger *zap.Logger,
+) (*Runtime, error) {
+	var opts []options.Option
+
+	if !config.Config.DisableControllerRuntimeCache {
+		opts = append(opts,
+			safe.WithResourceCache[*omni.BackupData](),
+			safe.WithResourceCache[*omni.Cluster](),
+			safe.WithResourceCache[*omni.ClusterDestroyStatus](),
+			safe.WithResourceCache[*omni.ClusterEndpoint](),
+			safe.WithResourceCache[*omni.ClusterMachine](),
+			safe.WithResourceCache[*omni.ClusterMachineConfigStatus](),
+			safe.WithResourceCache[*omni.ClusterMachineIdentity](),
+			safe.WithResourceCache[*omni.ClusterMachineStatus](),
+			safe.WithResourceCache[*omni.ClusterMachineTalosVersion](),
+			safe.WithResourceCache[*omni.ClusterStatus](),
+			safe.WithResourceCache[*omni.ClusterSecrets](),
+			safe.WithResourceCache[*omni.ClusterUUID](),
+			safe.WithResourceCache[*omni.ControlPlaneStatus](),
+			safe.WithResourceCache[*omni.EtcdBackupEncryption](),
+			safe.WithResourceCache[*omni.EtcdBackupStatus](),
+			safe.WithResourceCache[*omni.ExposedService](),
+			safe.WithResourceCache[*omni.ImagePullRequest](),
+			safe.WithResourceCache[*omni.ImagePullStatus](),
+			safe.WithResourceCache[*omni.Kubeconfig](),
+			safe.WithResourceCache[*omni.KubernetesStatus](),
+			safe.WithResourceCache[*omni.KubernetesUpgradeStatus](),
+			safe.WithResourceCache[*omni.KubernetesVersion](),
+			safe.WithResourceCache[*omni.LoadBalancerConfig](),
+			safe.WithResourceCache[*omni.LoadBalancerStatus](),
+			safe.WithResourceCache[*omni.Machine](),
+			safe.WithResourceCache[*omni.MachineConfigGenOptions](),
+			safe.WithResourceCache[*omni.MachineLabels](),
+			safe.WithResourceCache[*omni.MachineSet](),
+			safe.WithResourceCache[*omni.MachineSetStatus](),
+			safe.WithResourceCache[*omni.MachineSetNode](),
+			safe.WithResourceCache[*omni.MachineStatus](),
+			safe.WithResourceCache[*omni.MachineStatusSnapshot](),
+			safe.WithResourceCache[*omni.SchematicConfiguration](),
+			safe.WithResourceCache[*omni.TalosConfig](),
+			safe.WithResourceCache[*omni.TalosExtensions](),
+			safe.WithResourceCache[*omni.TalosUpgradeStatus](),
+			safe.WithResourceCache[*omni.TalosVersion](),
+			safe.WithResourceCache[*siderolinkresources.Config](),
+			safe.WithResourceCache[*siderolinkresources.ConnectionParams](),
+			safe.WithResourceCache[*siderolinkresources.Link](),
+			options.WithWarnOnUncachedReads(false), // turn this to true to debug resource cache misses
+		)
+	}
+
+	controllerRuntime, err := cosiruntime.NewRuntime(resourceState, logger, opts...)
+	if err != nil {
+		return nil, err
+	}
+
+	storeFactory, err := store.NewStoreFactory()
+	if err != nil {
+		return nil, err
+	}
+
+	metricsRegistry.MustRegister(storeFactory)
+
+	backupController, err := omnictrl.NewEtcdBackupController(omnictrl.EtcdBackupControllerSettings{
+		ClientMaker: func(ctx context.Context, clusterName string) (omnictrl.TalosClient, error) {
+			return talosClientFactory.Get(ctx, clusterName)
+		},
+		StoreFactory: storeFactory,
+		TickInterval: config.Config.EtcdBackup.TickInterval,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	controllers := []controller.Controller{
+		omnictrl.NewCertRefreshTickController(constants.CertificateValidityTime / 10), // issue ticks at 10% of the validity, as we refresh certificates at 50% of the validity
+		omnictrl.NewClusterController(),
+		omnictrl.NewMachineSetController(),
+		&omnictrl.ClusterDestroyStatusController{},
+		&omnictrl.ClusterMachineIdentityController{},
+		&omnictrl.ClusterMachineStatusMetricsController{},
+		omnictrl.NewClusterMachineController(),
+		&omnictrl.ClusterMachineEncryptionController{},
+		&omnictrl.ClusterStatusMetricsController{},
+		&omnictrl.ClusterWorkloadProxyController{},
+		omnictrl.NewEtcdBackupOverallStatusController(),
+		backupController,
+		omnictrl.NewImagePullStatusController(&image.TalosImageClient{
+			TalosClientFactory: talosClientFactory,
+			NodeResolver:       dnsService,
+		}),
+		&omnictrl.KubernetesStatusController{},
+		&omnictrl.LoadBalancerController{},
+		&omnictrl.MachineSetNodeController{},
+		&omnictrl.MachineSetDestroyStatusController{},
+		&omnictrl.MachineSetStatusController{},
+		&omnictrl.MachineStatusController{},
+		omnictrl.NewMachineStatusLinkController(linkCounterDeltaCh),
+		&omnictrl.MachineStatusMetricsController{},
+		&omnictrl.VersionsController{},
+		omnictrl.NewClusterLoadBalancerController(
+			config.Config.LoadBalancer.MinPort,
+			config.Config.LoadBalancer.MaxPort,
+		),
+		&omnictrl.InstallationMediaController{},
+		omnictrl.NewKeyPrunerController(
+			config.Config.KeyPruner.Interval,
+		),
+		&omnictrl.OngoingTaskController{},
+	}
+
+	qcontrollers := []controller.QController{
+		omnictrl.NewBackupDataController(),
+		omnictrl.NewClusterBootstrapStatusController(storeFactory),
+		omnictrl.NewClusterConfigVersionController(),
+		omnictrl.NewClusterEndpointController(),
+		omnictrl.NewClusterMachineConfigController(config.Config.DefaultConfigGenOptions),
+		omnictrl.NewMachineConfigGenOptionsController(),
+		omnictrl.NewClusterMachineConfigStatusController(),
+		omnictrl.NewClusterMachineEncryptionKeyController(),
+		omnictrl.NewClusterMachineStatusController(),
+		omnictrl.NewClusterStatusController(),
+		omnictrl.NewClusterUUIDController(),
+		omnictrl.NewControlPlaneStatusController(),
+		omnictrl.NewEtcdBackupEncryptionController(),
+		omnictrl.NewKubeconfigController(constants.CertificateValidityTime),
+		omnictrl.NewKubernetesUpgradeManifestStatusController(),
+		omnictrl.NewKubernetesUpgradeStatusController(),
+		omnictrl.NewMachineController(),
+		omnictrl.NewMachineSetEtcdAuditController(talosClientFactory, time.Minute),
+		omnictrl.NewRedactedClusterMachineConfigController(),
+		omnictrl.NewSecretsController(storeFactory),
+		omnictrl.NewTalosConfigController(constants.CertificateValidityTime),
+		omnictrl.NewTalosExtensionsController(),
+		omnictrl.NewTalosUpgradeStatusController(),
+	}
+
+	if config.Config.Auth.SAML.Enabled {
+		controllers = append(controllers,
+			&omnictrl.SAMLAssertionController{},
+		)
+	}
+
+	for _, c := range controllers {
+		if err = controllerRuntime.RegisterController(c); err != nil {
+			return nil, err
+		}
+
+		if collector, ok := c.(prometheus.Collector); ok {
+			metricsRegistry.MustRegister(collector)
+		}
+	}
+
+	for _, c := range qcontrollers {
+		if err = controllerRuntime.RegisterQController(c); err != nil {
+			return nil, err
+		}
+
+		if collector, ok := c.(prometheus.Collector); ok {
+			metricsRegistry.MustRegister(collector)
+		}
+	}
+
+	//nolint:lll
+	expvarCollector := collectors.NewExpvarCollector(map[string]*prometheus.Desc{
+		"controller_crashes":         prometheus.NewDesc("omni_runtime_controller_crashes", "Number of controller-runtime controller crashes by controller name.", []string{"controller"}, nil),
+		"controller_wakeups":         prometheus.NewDesc("omni_runtime_controller_wakeups", "Number of controller-runtime controller wakeups by controller name.", []string{"controller"}, nil),
+		"controller_reads":           prometheus.NewDesc("omni_runtime_controller_reads", "Number of controller-runtime controller reads by controller name.", []string{"controller"}, nil),
+		"controller_writes":          prometheus.NewDesc("omni_runtime_controller_writes", "Number of controller-runtime controller writes by controller name.", []string{"controller"}, nil),
+		"reconcile_busy":             prometheus.NewDesc("omni_runtime_controller_busy_seconds", "Number of seconds controller-runtime controller is busy by controller name.", []string{"controller"}, nil),
+		"reconcile_cycles":           prometheus.NewDesc("omni_runtime_controller_reconcile_cycles", "Number of reconcile cycles by controller name.", []string{"controller"}, nil),
+		"reconcile_input_items":      prometheus.NewDesc("omni_runtime_controller_reconcile_input_items", "Number of reconciled input items by controller name.", []string{"controller"}, nil),
+		"qcontroller_crashes":        prometheus.NewDesc("omni_runtime_qcontroller_crashes", "Number of queue controller crashes by controller name.", []string{"controller"}, nil),
+		"qcontroller_requeues":       prometheus.NewDesc("omni_runtime_qcontroller_requeues", "Number of queue controller requeues by controller name.", []string{"controller"}, nil),
+		"qcontroller_processed":      prometheus.NewDesc("omni_runtime_qcontroller_processed", "Number of queue controller processed items by controller name.", []string{"controller"}, nil),
+		"qcontroller_mapped_in":      prometheus.NewDesc("omni_runtime_qcontroller_mapped_in", "Number of queue controller mapped in items by controller name.", []string{"controller"}, nil),
+		"qcontroller_mapped_out":     prometheus.NewDesc("omni_runtime_qcontroller_mapped_out", "Number of queue controller mapped out items by controller name.", []string{"controller"}, nil),
+		"qcontroller_queue_length":   prometheus.NewDesc("omni_runtime_qcontroller_queue_length", "Number of queue controller queue length by controller name.", []string{"controller"}, nil),
+		"qcontroller_map_busy":       prometheus.NewDesc("omni_runtime_qcontroller_map_busy_seconds", "Number of seconds queue controller is busy by controller name.", []string{"controller"}, nil),
+		"qcontroller_reconcile_busy": prometheus.NewDesc("omni_runtime_qcontroller_reconcile_busy_seconds", "Number of seconds queue controller reconcile is busy by controller name.", []string{"controller"}, nil),
+	})
+
+	metricsRegistry.MustRegister(expvarCollector)
+
+	validationOptions := clusterValidationOptions(resourceState)
+	validationOptions = append(validationOptions, relationLabelsValidationOptions()...)
+	validationOptions = append(validationOptions, accessPolicyValidationOptions()...)
+	validationOptions = append(validationOptions, aclValidationOptions(resourceState)...)
+	validationOptions = append(validationOptions, roleValidationOptions()...)
+	validationOptions = append(validationOptions, machineSetNodeValidationOptions(resourceState)...)
+	validationOptions = append(validationOptions, machineSetValidationOptions(resourceState, storeFactory)...)
+	validationOptions = append(validationOptions, identityValidationOptions()...)
+	validationOptions = append(validationOptions, exposedServiceValidationOptions()...)
+	validationOptions = append(validationOptions, configPatchValidationOptions(resourceState)...)
+	validationOptions = append(validationOptions, etcdManualBackupValidationOptions()...)
+	validationOptions = append(validationOptions, samlLabelRuleValidationOptions()...)
+	validationOptions = append(validationOptions, s3ConfigValidationOptions()...)
+
+	return &Runtime{
+		controllerRuntime:            controllerRuntime,
+		talosClientFactory:           talosClientFactory,
+		storeFactory:                 storeFactory,
+		dnsService:                   dnsService,
+		workloadProxyServiceRegistry: workloadProxyServiceRegistry,
+		resourceLogger:               resourceLogger,
+		state:                        state.WrapCore(validated.NewState(resourceState, validationOptions...)),
+		virtual:                      virtualState,
+		logger:                       logger,
+	}, nil
+}
+
+// Run starts underlying COSI controller runtime.
+func (r *Runtime) Run(ctx context.Context, eg newgroup.EGroup) {
+	makeWrap := func(f func(context.Context) error, msgOnError string) func() error {
+		return func() error {
+			if err := f(ctx); err != nil {
+				return fmt.Errorf("%s: %w", msgOnError, err)
+			}
+
+			return nil
+		}
+	}
+
+	if config.Config.WorkloadProxying.Enabled {
+		newgroup.GoWithContext(ctx, eg, makeWrap(r.workloadProxyServiceRegistry.Start, "workload proxy service registry failed"))
+	}
+
+	if r.resourceLogger != nil {
+		newgroup.GoWithContext(ctx, eg, makeWrap(r.resourceLogger.Start, "resource logger failed"))
+	}
+
+	newgroup.GoWithContext(ctx, eg, makeWrap(r.talosClientFactory.StartCacheManager, "talos client factory failed"))
+	newgroup.GoWithContext(ctx, eg, makeWrap(r.dnsService.Start, "dns service failed"))
+	newgroup.GoWithContext(ctx, eg, makeWrap(r.controllerRuntime.Run, "controller runtime failed"))
+
+	newgroup.GoWithContext(ctx, eg, func() error { return r.storeFactory.Start(ctx, r.state, r.logger) })
+
+	if r.virtual == nil {
+		return
+	}
+
+	newgroup.GoWithContext(ctx, eg, func() error {
+		r.virtual.RunComputed(ctx, virtualres.KubernetesUsageType, producers.NewKubernetesUsage, producers.KubernetesUsageResourceTransformer(r.state), r.logger)
+
+		return nil
+	})
+}
+
+// Watch implements runtime.Runtime.
+func (r *Runtime) Watch(ctx context.Context, events chan<- runtime.WatchResponse, setters ...runtime.QueryOption) error {
+	opts := runtime.NewQueryOptions(setters...)
+
+	var (
+		queries []cosiresource.LabelQuery
+		err     error
+	)
+
+	if len(opts.LabelSelectors) > 0 {
+		queries, err = labels.ParseSelectors(opts.LabelSelectors)
+		if err != nil {
+			return err
+		}
+	}
+
+	return cosi.Watch(
+		ctx,
+		r.state,
+		cosiresource.NewMetadata(
+			opts.Namespace,
+			opts.Resource,
+			opts.Name,
+			cosiresource.VersionUndefined,
+		),
+		events,
+		opts.TailEvents,
+		queries,
+	)
+}
+
+// Get implements runtime.Runtime.
+func (r *Runtime) Get(ctx context.Context, setters ...runtime.QueryOption) (any, error) {
+	opts := runtime.NewQueryOptions(setters...)
+
+	metadata := cosiresource.NewMetadata(opts.Namespace, opts.Resource, opts.Name, cosiresource.VersionUndefined)
+
+	res, err := r.state.Get(ctx, metadata)
+	if err != nil {
+		return nil, err
+	}
+
+	return runtime.NewResource(res)
+}
+
+// List implements runtime.Runtime.
+func (r *Runtime) List(ctx context.Context, setters ...runtime.QueryOption) (runtime.ListResult, error) {
+	opts := runtime.NewQueryOptions(setters...)
+
+	var listOptions []state.ListOption
+
+	if len(opts.LabelSelectors) > 0 {
+		queries, err := labels.ParseSelectors(opts.LabelSelectors)
+		if err != nil {
+			return runtime.ListResult{}, err
+		}
+
+		for _, query := range queries {
+			listOptions = append(listOptions, state.WithLabelQuery(cosiresource.RawLabelQuery(query)))
+		}
+	}
+
+	list, err := r.state.List(
+		ctx,
+		cosiresource.NewMetadata(opts.Namespace, opts.Resource, "", cosiresource.VersionUndefined),
+		listOptions...,
+	)
+	if err != nil {
+		return runtime.ListResult{}, err
+	}
+
+	items := make([]pkgruntime.ListItem, 0, len(list.Items))
+
+	for _, item := range list.Items {
+		res, err := runtime.NewResource(item)
+		if err != nil {
+			return runtime.ListResult{}, err
+		}
+
+		items = append(items, NewItem(res))
+	}
+
+	return runtime.ListResult{
+		Items: items,
+		Total: len(items),
+	}, nil
+}
+
+// Create implements runtime.Runtime.
+func (r *Runtime) Create(ctx context.Context, resource cosiresource.Resource, _ ...runtime.QueryOption) error {
+	return r.state.Create(ctx, resource)
+}
+
+// Update implements runtime.Runtime.
+func (r *Runtime) Update(ctx context.Context, resource cosiresource.Resource, _ ...runtime.QueryOption) error {
+	if resource.Metadata().Version().String() == cosiresource.VersionUndefined.String() {
+		current, err := r.state.Get(ctx, resource.Metadata())
+		if err != nil {
+			return err
+		}
+
+		resource.Metadata().SetVersion(current.Metadata().Version())
+	}
+
+	return r.state.Update(ctx, resource)
+}
+
+// Delete implements runtime.Runtime.
+func (r *Runtime) Delete(ctx context.Context, setters ...runtime.QueryOption) error {
+	opts := runtime.NewQueryOptions(setters...)
+
+	md := cosiresource.NewMetadata(opts.Namespace, opts.Resource, opts.Name, cosiresource.VersionUndefined)
+
+	_, err := r.state.Teardown(ctx, md)
+	if err != nil {
+		return err
+	}
+
+	if opts.TeardownOnly {
+		return nil
+	}
+
+	if _, err = r.state.WatchFor(ctx, md, state.WithFinalizerEmpty()); err != nil {
+		return err
+	}
+
+	if err = r.state.Destroy(ctx, md); err != nil && !state.IsNotFoundError(err) {
+		return err
+	}
+
+	return nil
+}
+
+// State returns runtime state.
+func (r *Runtime) State() state.State { //nolint:ireturn
+	return r.state
+}
+
+// GetCOSIRuntime returns COSI  controller runtime.
+func (r *Runtime) GetCOSIRuntime() *cosiruntime.Runtime {
+	return r.controllerRuntime
+}
+
+// AdminTalosconfig returns the raw admin talosconfig for the cluster with the given name.
+func (r *Runtime) AdminTalosconfig(ctx context.Context, clusterName string) ([]byte, error) {
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	clusterEndpoint, err := safe.StateGet[*omni.ClusterEndpoint](ctx, r.state, omni.NewClusterEndpoint(omniresources.DefaultNamespace, clusterName).Metadata())
+	if err != nil {
+		return nil, err
+	}
+
+	endpoints := clusterEndpoint.TypedSpec().Value.GetManagementAddresses()
+
+	talosConfig, err := safe.StateGet[*omni.TalosConfig](ctx, r.state, omni.NewTalosConfig(omniresources.DefaultNamespace, clusterName).Metadata())
+	if err != nil {
+		return nil, err
+	}
+
+	return omni.NewTalosClientConfig(talosConfig, endpoints...).Bytes()
+}
+
+type item struct {
+	runtime.BasicItem[*runtime.Resource]
+}
+
+func (it *item) Field(name string) (string, bool) {
+	val, ok := it.BasicItem.Field(name)
+	if ok {
+		return val, true
+	}
+
+	val, ok = runtime.ResourceField(it.BasicItem.Unwrap().Resource, name)
+	if ok {
+		return val, true
+	}
+
+	return "", false
+}
+
+func (it *item) Match(searchFor string) bool {
+	return it.BasicItem.Match(searchFor) || runtime.MatchResource(it.BasicItem.Unwrap().Resource, searchFor)
+}
+
+func (it *item) Unwrap() any {
+	return it.BasicItem.Unwrap()
+}
+
+// NewItem creates new runtime.ListItem from the resource.
+func NewItem(res *runtime.Resource) pkgruntime.ListItem {
+	return &item{BasicItem: runtime.MakeBasicItem(res.Metadata.ID, res.Metadata.Namespace, res)}
+}
diff --git a/internal/backend/runtime/omni/omni_test.go b/internal/backend/runtime/omni/omni_test.go
new file mode 100644
index 000000000..222c4232b
--- /dev/null
+++ b/internal/backend/runtime/omni/omni_test.go
@@ -0,0 +1,195 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/zap/zaptest"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/dns"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	omniruntime "github.com/siderolabs/omni/internal/backend/runtime/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+	"github.com/siderolabs/omni/internal/backend/workloadproxy"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+)
+
+// using whitelisted for external API access type.
+const testResourceType = omni.ClusterType
+
+type testResource = typed.Resource[testResourceSpec, testResourceExtension]
+
+type testResourceSpec = protobuf.ResourceSpec[specs.AuthConfigSpec, *specs.AuthConfigSpec]
+
+type testResourceExtension struct{}
+
+func (testResourceExtension) ResourceDefinition() meta.ResourceDefinitionSpec {
+	return meta.ResourceDefinitionSpec{
+		Type:             testResourceType,
+		Aliases:          []resource.Type{},
+		DefaultNamespace: "default",
+		PrintColumns:     []meta.PrintColumn{},
+	}
+}
+
+// NewtestResource creates new StrResource.
+func newTestResource(ns resource.Namespace, id resource.ID, spec *specs.AuthConfigSpec) *testResource {
+	return typed.NewResource[testResourceSpec, testResourceExtension](
+		resource.NewMetadata(ns, testResourceType, id, resource.VersionUndefined),
+		protobuf.NewResourceSpec(spec),
+	)
+}
+
+type OmniRuntimeSuite struct {
+	suite.Suite
+	runtime   *omniruntime.Runtime
+	ctx       context.Context //nolint:containedctx
+	ctxCancel context.CancelFunc
+	eg        errgroup.Group
+}
+
+func (suite *OmniRuntimeSuite) SetupTest() {
+	suite.ctx, suite.ctxCancel = context.WithTimeout(context.Background(), 3*time.Minute)
+
+	// disable auth in the context
+	suite.ctx = context.WithValue(suite.ctx, auth.EnabledAuthContextKey{}, false)
+
+	var err error
+
+	resourceState := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	logger := zaptest.NewLogger(suite.T())
+
+	clientFactory := talos.NewClientFactory(resourceState, logger)
+
+	dnsService := dns.NewService(resourceState, logger)
+
+	workloadProxyServiceRegistry, err := workloadproxy.NewServiceRegistry(resourceState, logger)
+	suite.Require().NoError(err)
+
+	suite.runtime, err = omniruntime.New(clientFactory, dnsService, workloadProxyServiceRegistry, nil, nil,
+		resourceState, nil, prometheus.NewRegistry(), logger)
+
+	suite.Require().NoError(err)
+
+	suite.startRuntime()
+}
+
+func (suite *OmniRuntimeSuite) startRuntime() {
+	suite.runtime.Run(actor.MarkContextAsInternalActor(suite.ctx), &suite.eg)
+}
+
+func (suite *OmniRuntimeSuite) TestCrud() {
+	id := "test"
+	namespace := "test"
+
+	testRes := newTestResource(namespace, id, &specs.AuthConfigSpec{
+		Auth0: &specs.AuthConfigSpec_Auth0{Enabled: true, Domain: "test"},
+	})
+
+	testRes.Metadata().Labels().Set("label1", "")
+	testRes.Metadata().Labels().Set("label2", "something")
+
+	suite.Require().NoError(suite.runtime.Create(suite.ctx, testRes))
+
+	for _, tt := range []struct {
+		labels      []string
+		expectedLen int
+	}{
+		{
+			[]string{"label1", "label2"},
+			1,
+		},
+		{
+			[]string{"!label1"},
+			0,
+		},
+		{
+			[]string{"!label3"},
+			1,
+		},
+		{
+			[]string{"label2=nope"},
+			0,
+		},
+		{
+			[]string{"label2=something"},
+			1,
+		},
+	} {
+		list, err := suite.runtime.List(suite.ctx,
+			runtime.WithResource(testResourceType),
+			runtime.WithNamespace(namespace),
+			runtime.WithLabelSelectors(tt.labels...),
+		)
+		suite.Require().NoError(err)
+		suite.Require().Len(list.Items, tt.expectedLen)
+	}
+
+	getResource := func() *runtime.Resource {
+		resp, err := suite.runtime.Get(suite.ctx, runtime.WithName(id), runtime.WithNamespace(namespace), runtime.WithResource(testResourceType))
+		suite.Require().NoError(err)
+
+		resourceResponse, ok := resp.(*runtime.Resource)
+		suite.Require().True(ok)
+
+		return resourceResponse
+	}
+
+	r := getResource()
+
+	spec, ok := r.Spec.(*specs.AuthConfigSpec)
+	suite.Require().True(ok)
+
+	suite.Require().True(spec.Auth0.Enabled)
+	suite.Require().Equal("test", spec.Auth0.Domain)
+
+	testRes = newTestResource(namespace, id, &specs.AuthConfigSpec{
+		Auth0: &specs.AuthConfigSpec_Auth0{Enabled: true, Domain: "test2"},
+	})
+
+	suite.Require().NoError(suite.runtime.Update(suite.ctx, testRes))
+
+	r = getResource()
+
+	spec, ok = r.Spec.(*specs.AuthConfigSpec)
+	suite.Require().True(ok)
+
+	suite.Require().Equal("test2", spec.Auth0.Domain)
+
+	suite.Require().NoError(suite.runtime.Delete(suite.ctx, runtime.WithName(id), runtime.WithNamespace(namespace), runtime.WithResource(testResourceType)))
+
+	_, err := suite.runtime.Get(suite.ctx, runtime.WithName(id), runtime.WithNamespace(id), runtime.WithResource(testResourceType))
+	suite.Require().Error(err)
+}
+
+func (suite *OmniRuntimeSuite) TearDownTest() {
+	suite.T().Log("tear down")
+
+	suite.ctxCancel()
+
+	suite.Require().NoError(suite.eg.Wait())
+}
+
+func TestOmniRuntimeSuite(t *testing.T) {
+	suite.Run(t, new(OmniRuntimeSuite))
+}
diff --git a/internal/backend/runtime/omni/pkg/check/check.go b/internal/backend/runtime/omni/pkg/check/check.go
new file mode 100644
index 000000000..c4501b6f9
--- /dev/null
+++ b/internal/backend/runtime/omni/pkg/check/check.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package check contains control planes healthchecks.
+package check
diff --git a/internal/backend/runtime/omni/pkg/check/connection.go b/internal/backend/runtime/omni/pkg/check/connection.go
new file mode 100644
index 000000000..4d49abc34
--- /dev/null
+++ b/internal/backend/runtime/omni/pkg/check/connection.go
@@ -0,0 +1,42 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package check
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// Connection checks that at least one node has s connected available.
+func Connection(ctx context.Context, r controller.Reader, clusterName string) error {
+	clusterMachineStatuses, err := safe.ReaderListAll[*omni.ClusterMachineStatus](
+		ctx,
+		r,
+		state.WithLabelQuery(
+			resource.LabelEqual(omni.LabelCluster, clusterName),
+			resource.LabelExists(omni.LabelControlPlaneRole),
+		),
+	)
+	if err != nil {
+		return newError(specs.ControlPlaneStatusSpec_Condition_Error, true, "Failed to get the list of machines %s", err.Error())
+	}
+
+	for iter := clusterMachineStatuses.Iterator(); iter.Next(); {
+		_, connected := iter.Value().Metadata().Labels().Get(omni.MachineStatusLabelConnected)
+		if connected {
+			return nil
+		}
+	}
+
+	return newError(specs.ControlPlaneStatusSpec_Condition_Warning, true, "No control plane nodes are connected")
+}
diff --git a/internal/backend/runtime/omni/pkg/check/etcd.go b/internal/backend/runtime/omni/pkg/check/etcd.go
new file mode 100644
index 000000000..b0ac7b200
--- /dev/null
+++ b/internal/backend/runtime/omni/pkg/check/etcd.go
@@ -0,0 +1,364 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package check
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"strings"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+	"github.com/siderolabs/talos/pkg/machinery/resources/etcd"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+)
+
+// Error is returned when the check has failed.
+type Error struct {
+	message   string
+	Status    specs.ControlPlaneStatusSpec_Condition_Status
+	Severity  specs.ControlPlaneStatusSpec_Condition_Severity
+	Interrupt bool
+}
+
+// Error implements error interface.
+func (e *Error) Error() string {
+	return e.message
+}
+
+func newError(severity specs.ControlPlaneStatusSpec_Condition_Severity, interrupt bool, msg string, params ...any) error {
+	return &Error{
+		Status:    specs.ControlPlaneStatusSpec_Condition_NotReady,
+		Severity:  severity,
+		message:   fmt.Sprintf(msg, params...),
+		Interrupt: interrupt,
+	}
+}
+
+// Etcd checks that all etcd members are healthy and are in sync,
+// etcd responds on all nodes.
+func Etcd(ctx context.Context, r controller.Reader, clusterName string) error {
+	clusterMachineStatuses, err := safe.ReaderListAll[*omni.ClusterMachineStatus](
+		ctx,
+		r,
+		state.WithLabelQuery(
+			resource.LabelEqual(omni.LabelCluster, clusterName),
+			resource.LabelExists(omni.LabelControlPlaneRole),
+		),
+	)
+	if err != nil {
+		return newError(specs.ControlPlaneStatusSpec_Condition_Error, false, "Failed to get the list of machines %s", err.Error())
+	}
+
+	var members map[uint64]string
+
+	for iter := clusterMachineStatuses.Iterator(); iter.Next(); {
+		nodeMembers, err := GetEtcdMembers(ctx, r, clusterName, iter.Value())
+		if err != nil {
+			if talos.IsClientNotReadyError(err) {
+				return newError(specs.ControlPlaneStatusSpec_Condition_Error, false, "Talos client is not ready on node %s", iter.Value().Metadata().ID())
+			}
+
+			return err
+		}
+
+		if members == nil {
+			members = nodeMembers
+
+			continue
+		}
+
+		if !maps.Equal(members, nodeMembers) {
+			return newError(
+				specs.ControlPlaneStatusSpec_Condition_Error,
+				false,
+				"Etcd members don't match on nodes %s and %s",
+				clusterMachineStatuses.Get(0).Metadata().ID(),
+				iter.Value().Metadata().ID(),
+			)
+		}
+	}
+
+	if (len(members)-1)%2 != 0 {
+		return newError(
+			specs.ControlPlaneStatusSpec_Condition_Warning,
+			false,
+			"Etcd members count doesn't match quorum, expected odd number, got %d",
+			len(members),
+		)
+	}
+
+	return nil
+}
+
+// GetEtcdMembers returns etcd members for a machine.
+func GetEtcdMembers(ctx context.Context, r controller.Reader, clusterName string, clusterMachineStatuses ...*omni.ClusterMachineStatus) (map[uint64]string, error) {
+	talosConfig, err := safe.ReaderGet[*omni.TalosConfig](ctx, r, resource.NewMetadata(resources.DefaultNamespace, omni.TalosConfigType, clusterName, resource.VersionUndefined))
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, talos.NewClientNotReadyError(err)
+		}
+
+		return nil, err
+	}
+
+	endpoints := make([]string, 0, len(clusterMachineStatuses))
+
+	var unixSocketOpts []client.OptionFunc
+
+	for _, r := range clusterMachineStatuses {
+		if r.TypedSpec().Value.ManagementAddress == "" {
+			continue
+		}
+
+		if o := talos.GetSocketOptions(r.TypedSpec().Value.ManagementAddress); o != nil {
+			unixSocketOpts = o
+
+			break
+		}
+
+		endpoints = append(endpoints, r.TypedSpec().Value.ManagementAddress)
+	}
+
+	if len(unixSocketOpts) == 0 && len(endpoints) == 0 {
+		return nil, talos.NewClientNotReadyError(errors.New("no management addresses found on cluster machine statuses"))
+	}
+
+	config := omni.NewTalosClientConfig(talosConfig, endpoints...)
+
+	c, err := client.New(ctx, append(unixSocketOpts, client.WithConfig(config))...)
+	if err != nil {
+		return nil, err
+	}
+
+	defer c.Close() //nolint:errcheck
+
+	response, err := c.EtcdMemberList(ctx, &machine.EtcdMemberListRequest{})
+	if err != nil {
+		return nil, err
+	}
+
+	members := map[uint64]string{}
+
+	for _, memberList := range response.Messages {
+		for _, member := range memberList.Members {
+			members[member.Id] = member.Hostname
+		}
+	}
+
+	return members, nil
+}
+
+// CanScaleDown verifies that the machine can be safely removed from the control planes machine set.
+func CanScaleDown(status *EtcdStatusResult, machine resource.Resource) error {
+	member, ok := status.Members[machine.Metadata().ID()]
+	if !ok {
+		return nil
+	}
+
+	totalMembers := len(status.Members)
+	healthyMembers := status.HealthyMembers
+
+	if healthyMembers < totalMembers/2+1 {
+		return fmt.Errorf("removing machine %q is not possible, etcd doesn't have quorum", machine.Metadata().ID())
+	}
+
+	totalMembers--
+
+	if member.Healthy {
+		healthyMembers--
+	}
+
+	if healthyMembers < totalMembers/2+1 {
+		return fmt.Errorf("removing machine %q will break etcd quorum", machine.Metadata().ID())
+	}
+
+	return nil
+}
+
+// EtcdStatusResult is the current etcd state: members count, healthy members count and the health of each member.
+type EtcdStatusResult struct {
+	// Members all members statuses.
+	// Also contains the members which haven't joined yet.
+	Members map[string]EtcdMemberStatus
+	// HealthyMembers is the number of healthy members.
+	HealthyMembers int
+}
+
+// EtcdMemberStatus is the current state of the etcd member.
+type EtcdMemberStatus struct {
+	// Error describes check error.
+	Error string
+	// Healthy is the response from etcd service health request.
+	Healthy bool
+}
+
+// EtcdStatus reads control plane etcd members health.
+func EtcdStatus(ctx context.Context, r controller.Reader, machineSet *omni.MachineSet) (*EtcdStatusResult, error) {
+	if _, ok := machineSet.Metadata().Labels().Get(omni.LabelControlPlaneRole); !ok {
+		return nil, errors.New("the machine set is not control planes")
+	}
+
+	clusterName, ok := machineSet.Metadata().Labels().Get(omni.LabelCluster)
+	if !ok {
+		return nil, fmt.Errorf("machine set doesn't have %s label", omni.LabelCluster)
+	}
+
+	talosConfig, err := safe.ReaderGet[*omni.TalosConfig](ctx, r, resource.NewMetadata(resources.DefaultNamespace, omni.TalosConfigType, clusterName, resource.VersionUndefined))
+	if err != nil {
+		return nil, fmt.Errorf("failed to get talos config for the cluster %q: %w", clusterName, err)
+	}
+
+	members := map[string]EtcdMemberStatus{}
+
+	var healthyMembers int
+
+	statuses, err := safe.ReaderListAll[*omni.ClusterMachineStatus](ctx, r,
+		state.WithLabelQuery(resource.LabelEqual(omni.LabelMachineSet, machineSet.Metadata().ID())),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	etcdMembers, err := GetEtcdMembers(ctx, r, clusterName, toSlice(statuses)...)
+	if err != nil {
+		return nil, err
+	}
+
+	if err = statuses.ForEachErr(func(status *omni.ClusterMachineStatus) error {
+		var (
+			member   EtcdMemberStatus
+			identity *omni.ClusterMachineIdentity
+		)
+
+		member, err = getMemberState(ctx, talosConfig, status)
+		if err != nil {
+			return err
+		}
+
+		identity, err = safe.ReaderGet[*omni.ClusterMachineIdentity](ctx, r, omni.NewClusterMachineIdentity(
+			resources.DefaultNamespace,
+			status.Metadata().ID(),
+		).Metadata())
+		if err != nil {
+			if state.IsNotFoundError(err) {
+				return nil
+			}
+
+			return err
+		}
+
+		memberID := identity.TypedSpec().Value.EtcdMemberId
+
+		if memberID == 0 {
+			return nil
+		}
+
+		if _, ok := etcdMembers[memberID]; !ok {
+			return nil
+		}
+
+		delete(etcdMembers, memberID)
+
+		members[status.Metadata().ID()] = member
+
+		if member.Healthy {
+			healthyMembers++
+		}
+
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+
+	if len(etcdMembers) > 0 {
+		extraMembers := make([]string, 0, len(etcdMembers))
+
+		for id := range etcdMembers {
+			extraMembers = append(extraMembers, etcd.FormatMemberID(id))
+		}
+
+		return nil, fmt.Errorf("couldn't map etcd members to cluster machines: %q", strings.Join(extraMembers, ", "))
+	}
+
+	return &EtcdStatusResult{
+		Members:        members,
+		HealthyMembers: healthyMembers,
+	}, nil
+}
+
+func getMemberState(ctx context.Context, talosConfig *omni.TalosConfig, clusterMachineStatus *omni.ClusterMachineStatus) (EtcdMemberStatus, error) {
+	var status EtcdMemberStatus
+
+	_, connected := clusterMachineStatus.Metadata().Labels().Get(omni.MachineStatusLabelConnected)
+
+	if !connected || clusterMachineStatus.TypedSpec().Value.ManagementAddress == "" {
+		status.Error = "the machine is unreachable"
+
+		return status, nil
+	}
+
+	opts := []client.OptionFunc{}
+
+	if o := talos.GetSocketOptions(clusterMachineStatus.TypedSpec().Value.ManagementAddress); o != nil {
+		opts = o
+	}
+
+	config := omni.NewTalosClientConfig(talosConfig, clusterMachineStatus.TypedSpec().Value.ManagementAddress)
+
+	opts = append(opts, client.WithConfig(config))
+
+	ctx, cancel := context.WithTimeout(ctx, time.Second*10)
+
+	defer cancel()
+
+	c, err := client.New(ctx, opts...)
+	if err != nil {
+		return status, err
+	}
+
+	defer c.Close() //nolint:errcheck
+
+	list, err := c.ServiceInfo(ctx, "etcd")
+	if err != nil {
+		status.Error = err.Error()
+
+		return status, nil //nolint:nilerr
+	}
+
+	for _, info := range list {
+		if info.Metadata != nil && info.Metadata.Error != "" {
+			status.Error = info.Metadata.Error
+
+			return status, nil
+		}
+
+		status.Healthy = info.Service.Health.Healthy
+	}
+
+	return status, nil
+}
+
+func toSlice[T resource.Resource](list safe.List[T]) []T {
+	res := make([]T, 0, list.Len())
+
+	list.ForEach(func(t T) {
+		res = append(res, t)
+	})
+
+	return res
+}
diff --git a/internal/backend/runtime/omni/pkg/check/etcd_test.go b/internal/backend/runtime/omni/pkg/check/etcd_test.go
new file mode 100644
index 000000000..7f22ea0f8
--- /dev/null
+++ b/internal/backend/runtime/omni/pkg/check/etcd_test.go
@@ -0,0 +1,93 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package check_test
+
+import (
+	"fmt"
+	"strconv"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/pkg/check"
+)
+
+func TestCanScaleDown(t *testing.T) {
+	for _, tt := range []struct {
+		count      int
+		healthy    int
+		index      int
+		shouldFail bool
+	}{
+		{
+			count:      1,
+			healthy:    1,
+			index:      0,
+			shouldFail: true,
+		},
+		{
+			count:   2,
+			healthy: 2,
+			index:   1,
+		},
+		{
+			count:      2,
+			healthy:    1,
+			index:      1,
+			shouldFail: true,
+		},
+		{
+			count:      3,
+			healthy:    2,
+			index:      1,
+			shouldFail: true,
+		},
+		{
+			count:   3,
+			healthy: 2,
+			index:   2,
+		},
+		{
+			count:   5,
+			healthy: 4,
+			index:   2,
+		},
+		{
+			count:   3,
+			healthy: 1,
+			index:   3,
+		},
+		{
+			count:   3,
+			healthy: 2,
+			index:   3,
+		},
+	} {
+		t.Run(fmt.Sprintf("scale down, joined %d, healthy %d, index: %d", tt.count, tt.healthy, tt.index), func(t *testing.T) {
+			members := map[string]check.EtcdMemberStatus{}
+
+			for i := 0; i < tt.count; i++ {
+				members[strconv.FormatInt(int64(i), 10)] = check.EtcdMemberStatus{
+					Healthy: i < tt.healthy,
+				}
+			}
+
+			err := check.CanScaleDown(&check.EtcdStatusResult{
+				Members:        members,
+				HealthyMembers: tt.healthy,
+			}, omni.NewClusterMachine(resources.DefaultNamespace, strconv.FormatInt(int64(tt.index), 10)))
+			if !tt.shouldFail {
+				require.NoError(t, err)
+
+				return
+			}
+
+			require.Error(t, err)
+		})
+	}
+}
diff --git a/internal/backend/runtime/omni/state.go b/internal/backend/runtime/omni/state.go
new file mode 100644
index 000000000..3be911cb5
--- /dev/null
+++ b/internal/backend/runtime/omni/state.go
@@ -0,0 +1,139 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/cosi-project/runtime/pkg/state/registry"
+	"github.com/prometheus/client_golang/prometheus"
+	"go.etcd.io/bbolt"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	resourceregistry "github.com/siderolabs/omni/client/pkg/omni/resources/registry"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
+	"github.com/siderolabs/omni/internal/backend/logging"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup/store"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/external"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/migration"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/virtual"
+	"github.com/siderolabs/omni/internal/pkg/config"
+	"github.com/siderolabs/omni/internal/version"
+)
+
+// NewState creates a production Omni state.
+func NewState(ctx context.Context, params *config.Params, logger *zap.Logger, metricsRegistry prometheus.Registerer, f func(context.Context, state.State, *virtual.State) error) error {
+	stateFunc := func(ctx context.Context, persistentStateBuilder namespaced.StateBuilder) error {
+		primaryStorageCoreState := persistentStateBuilder(resources.DefaultNamespace)
+
+		secondaryStorageCoreState, secondaryStorageBackingStore, err := newBoltPersistentState(
+			params.SecondaryStorage.Path, &bbolt.Options{
+				NoSync: true, // we do not need fsync for the secondary storage
+			}, true, logger)
+		if err != nil {
+			return fmt.Errorf("failed to create BoltDB state for secondary storage: %w", err)
+		}
+
+		defer secondaryStorageBackingStore.Close() //nolint:errcheck
+
+		virtualState := virtual.NewState(state.WrapCore(primaryStorageCoreState))
+
+		storeFactory, err := store.NewStoreFactory()
+		if err != nil {
+			return fmt.Errorf("failed to create etcd backup store: %w", err)
+		}
+
+		namespacedState := namespaced.NewState(func(ns resource.Namespace) state.CoreState {
+			switch ns {
+			case resources.VirtualNamespace:
+				return virtualState
+			case resources.MetricsNamespace:
+				return secondaryStorageCoreState
+			case meta.NamespaceName, resources.EphemeralNamespace:
+				return inmem.NewStateWithOptions(inmem.WithHistoryGap(20))(ns)
+			case resources.ExternalNamespace:
+				return &external.State{
+					CoreState:    primaryStorageCoreState,
+					StoreFactory: storeFactory,
+				}
+			default:
+				return primaryStorageCoreState
+			}
+		})
+
+		measuredState := wrapStateWithMetrics(namespacedState)
+
+		metricsRegistry.MustRegister(measuredState)
+
+		resourceState := state.WrapCore(measuredState)
+
+		namespaceRegistry := registry.NewNamespaceRegistry(resourceState)
+		resourceRegistry := registry.NewResourceRegistry(resourceState)
+
+		if err := namespaceRegistry.RegisterDefault(ctx); err != nil {
+			return err
+		}
+
+		if err := resourceRegistry.RegisterDefault(ctx); err != nil {
+			return err
+		}
+
+		// register Omni namespaces
+		for _, ns := range []struct {
+			name        string
+			description string
+		}{
+			{resources.DefaultNamespace, "Default namespace for resources"},
+			{resources.EphemeralNamespace, "Ephemeral namespace for resources"},
+			{resources.VirtualNamespace, "Namespace for virtual resources"},
+			{resources.ExternalNamespace, "Namespace for external resources"},
+			{resources.MetricsNamespace, "Secondary storage namespace for resources"},
+		} {
+			if err := namespaceRegistry.Register(ctx, ns.name, ns.description); err != nil {
+				return err
+			}
+		}
+
+		// register Omni resources
+		for _, r := range resourceregistry.Resources {
+			if err := resourceRegistry.Register(ctx, r); err != nil {
+				return err
+			}
+		}
+
+		sysVersion := system.NewSysVersion(resources.EphemeralNamespace, system.SysVersionID)
+		sysVersion.TypedSpec().Value.BackendVersion = version.Tag
+		sysVersion.TypedSpec().Value.InstanceName = config.Config.Name
+		sysVersion.TypedSpec().Value.BackendApiVersion = version.API
+
+		if err := resourceState.Create(ctx, sysVersion); err != nil {
+			return err
+		}
+
+		migrationsManager := migration.NewManager(resourceState, logger.With(logging.Component("migration")))
+		if err := migrationsManager.Run(ctx); err != nil {
+			return err
+		}
+
+		return f(ctx, resourceState, virtualState)
+	}
+
+	switch params.Storage.Kind {
+	case "boltdb":
+		return buildBoltPersistentState(ctx, params.Storage.Boltdb.Path, logger, stateFunc)
+	case "etcd":
+		return buildEtcdPersistentState(ctx, params, logger, stateFunc)
+	default:
+		return fmt.Errorf("unknown storage kind %q", params.Storage.Kind)
+	}
+}
diff --git a/internal/backend/runtime/omni/state_access.go b/internal/backend/runtime/omni/state_access.go
new file mode 100644
index 000000000..63cd0343f
--- /dev/null
+++ b/internal/backend/runtime/omni/state_access.go
@@ -0,0 +1,525 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/xslices"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	authres "github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/common"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/system"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/virtual"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/validated"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/accesspolicy"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+var (
+	// clusterIDTypeSet is the set of resource types which have the related cluster's ID as their ID.
+	clusterIDTypeSet = xslices.ToSet([]resource.Type{
+		omni.ClusterBootstrapStatusType,
+		omni.ClusterConfigVersionType,
+		omni.ClusterDestroyStatusType,
+		omni.ClusterEndpointType,
+		omni.ClusterType,
+		omni.ClusterUUIDType,
+		omni.ClusterSecretsType,
+		omni.ClusterStatusType,
+		omni.EtcdBackupStatusType,
+		omni.EtcdManualBackupType,
+	})
+
+	// clusterLabelTypeSet is the set of resource types which have the related cluster's ID as a label.
+	clusterLabelTypeSet = xslices.ToSet([]resource.Type{
+		omni.ClusterMachineConfigType,
+		omni.ClusterMachineConfigStatusType,
+		omni.ClusterMachineIdentityType,
+		omni.ClusterMachineType,
+		omni.ClusterMachineConfigPatchesType,
+		omni.ClusterMachineConfigStatusType,
+		omni.ClusterMachineTalosVersionType,
+		omni.ClusterMachineTemplateType,
+		omni.ConfigPatchType,
+		omni.ExposedServiceType,
+		omni.ImagePullRequestType,
+		omni.ImagePullStatusType,
+		omni.MachineSetType,
+		omni.MachineSetNodeType,
+		omni.EtcdBackupType,
+	})
+
+	// userManagedResourceTypeSet is the set of resource types that are managed by the user.
+	userManagedResourceTypeSet = xslices.ToSet(common.UserManagedResourceTypes)
+)
+
+// aclValidationOptions returns the validation options for the ACLs on the resources.
+func aclValidationOptions(st state.State) []validated.StateOption {
+	return []validated.StateOption{
+		validated.WithListValidations(
+			func(ctx context.Context, kind resource.Kind, opt ...state.ListOption) error {
+				var opts state.ListOptions
+
+				for _, o := range opt {
+					o(&opts)
+				}
+
+				if len(opts.LabelQueries) == 0 {
+					return checkForKindAccess(ctx, st, state.List, kind, nil)
+				}
+
+				for _, query := range opts.LabelQueries {
+					if err := checkForKindAccess(ctx, st, state.List, kind, query.Terms); err != nil {
+						return err
+					}
+				}
+
+				return nil
+			},
+		),
+		validated.WithWatchKindValidations(
+			func(ctx context.Context, kind resource.Kind, opt ...state.WatchKindOption) error {
+				var opts state.WatchKindOptions
+
+				for _, o := range opt {
+					o(&opts)
+				}
+
+				if len(opts.LabelQueries) == 0 {
+					return checkForKindAccess(ctx, st, state.Watch, kind, nil)
+				}
+
+				for _, query := range opts.LabelQueries {
+					if err := checkForKindAccess(ctx, st, state.Watch, kind, query.Terms); err != nil {
+						return err
+					}
+				}
+
+				return nil
+			},
+		),
+		validated.WithGetValidations(
+			func(ctx context.Context, ptr resource.Pointer, res resource.Resource, _ ...state.GetOption) error {
+				if res == nil {
+					// resource does not exist, decide whether to return NotFound or PermissionDenied based on the pointer
+					clusterID := clusterIDFromPointer(ptr)
+
+					return checkForRole(ctx, st, state.Access{
+						ResourceNamespace: ptr.Namespace(),
+						ResourceType:      ptr.Type(),
+						ResourceID:        ptr.ID(),
+						Verb:              state.Get,
+					}, clusterID, false)
+				}
+
+				clusterID := clusterIDFromMetadata(res.Metadata())
+
+				return checkForRole(ctx, st, state.Access{
+					ResourceNamespace: res.Metadata().Namespace(),
+					ResourceType:      res.Metadata().Type(),
+					ResourceID:        res.Metadata().ID(),
+					Verb:              state.Get,
+				}, clusterID, false)
+			},
+		),
+		validated.WithWatchValidations(
+			func(ctx context.Context, ptr resource.Pointer, _ ...state.WatchOption) error {
+				// todo: watch validation here only works for resources that have same ID as Cluster type,
+				// not for the ones that are related over a label.
+				// we should improve this by checking/filtering the labels for the cluster.
+				clusterID := clusterIDFromPointer(ptr)
+
+				return checkForRole(ctx, st, state.Access{
+					ResourceNamespace: ptr.Namespace(),
+					ResourceType:      ptr.Type(),
+					ResourceID:        ptr.ID(),
+					Verb:              state.Watch,
+				}, clusterID, false)
+			},
+		),
+		validated.WithCreateValidations(
+			func(ctx context.Context, res resource.Resource, _ ...state.CreateOption) error {
+				clusterID := clusterIDFromMetadata(res.Metadata())
+
+				return checkForRole(ctx, st, state.Access{
+					ResourceNamespace: res.Metadata().Namespace(),
+					ResourceType:      res.Metadata().Type(),
+					ResourceID:        res.Metadata().ID(),
+					Verb:              state.Create,
+				}, clusterID, false)
+			},
+		),
+		validated.WithUpdateValidations(
+			func(ctx context.Context, existingRes resource.Resource, newRes resource.Resource, _ ...state.UpdateOption) error {
+				if existingRes == nil {
+					// resource does not exist, decide whether to return NotFound or PermissionDenied based on the pointer
+					newClusterID := clusterIDFromMetadata(newRes.Metadata())
+
+					return checkForRole(ctx, st, state.Access{
+						ResourceNamespace: newRes.Metadata().Namespace(),
+						ResourceType:      newRes.Metadata().Type(),
+						ResourceID:        newRes.Metadata().ID(),
+						Verb:              state.Update,
+					}, newClusterID, false)
+				}
+
+				existingClusterID := clusterIDFromMetadata(existingRes.Metadata())
+
+				if err := checkForRole(ctx, st, state.Access{
+					ResourceNamespace: existingRes.Metadata().Namespace(),
+					ResourceType:      existingRes.Metadata().Type(),
+					ResourceID:        existingRes.Metadata().ID(),
+					Verb:              state.Update,
+				}, existingClusterID, false); err != nil {
+					return err
+				}
+
+				newClusterID := clusterIDFromMetadata(newRes.Metadata())
+
+				// if this is a cluster-related resource and the ID has not changed, we don't need to do the same check again
+				if newClusterID != "" && existingClusterID == newClusterID {
+					return nil
+				}
+
+				return checkForRole(ctx, st, state.Access{
+					ResourceNamespace: newRes.Metadata().Namespace(),
+					ResourceType:      newRes.Metadata().Type(),
+					ResourceID:        newRes.Metadata().ID(),
+					Verb:              state.Update,
+				}, newClusterID, false)
+			},
+		),
+		validated.WithDestroyValidations(
+			func(ctx context.Context, ptr resource.Pointer, res resource.Resource, _ ...state.DestroyOption) error {
+				if res == nil {
+					// resource does not exist, decide whether to return NotFound or PermissionDenied based on the pointer
+					clusterID := clusterIDFromPointer(ptr)
+
+					return checkForRole(ctx, st, state.Access{
+						ResourceNamespace: ptr.Namespace(),
+						ResourceType:      ptr.Type(),
+						ResourceID:        ptr.ID(),
+						Verb:              state.Destroy,
+					}, clusterID, false)
+				}
+
+				clusterID := clusterIDFromMetadata(res.Metadata())
+
+				return checkForRole(ctx, st, state.Access{
+					ResourceNamespace: res.Metadata().Namespace(),
+					ResourceType:      res.Metadata().Type(),
+					ResourceID:        res.Metadata().ID(),
+					Verb:              state.Destroy,
+				}, clusterID, false)
+			},
+		),
+	}
+}
+
+func checkForRole(ctx context.Context, st state.State, access state.Access, clusterID resource.ID, requireAll bool) error {
+	if actor.ContextIsInternalActor(ctx) {
+		return nil
+	}
+
+	if requireAll {
+		clusterID = "any"
+	}
+
+	if clusterID != "" {
+		clusterRole, matchesAll, err := accesspolicy.RoleForCluster(ctx, clusterID, st)
+		if err != nil {
+			return err
+		}
+
+		if clusterRole != role.None && (!requireAll || (requireAll && matchesAll)) {
+			// override the role in the context with the computed role for this cluster
+			ctx = context.WithValue(ctx, auth.RoleContextKey{}, clusterRole)
+		}
+	}
+
+	return filterAccess(ctx, access)
+}
+
+func checkForKindAccess(ctx context.Context, st state.State, verb state.Verb, kind resource.Kind, labelTerms []resource.LabelTerm) error {
+	clusterID := ""
+	requireAll := false
+
+	if isClusterRelatedType(kind.Type()) {
+		clusterID = clusterIDFromLabelTerms(labelTerms)
+
+		requireAll = clusterID == ""
+	}
+
+	return checkForRole(ctx, st, state.Access{
+		ResourceNamespace: kind.Namespace(),
+		ResourceType:      kind.Type(),
+		Verb:              verb,
+	}, clusterID, requireAll)
+}
+
+func isClusterRelatedType(typ resource.Type) bool {
+	_, ok := clusterIDTypeSet[typ]
+	if ok {
+		return true
+	}
+
+	_, ok = clusterLabelTypeSet[typ]
+
+	return ok
+}
+
+func clusterIDFromMetadata(resMD *resource.Metadata) resource.ID {
+	if _, ok := clusterIDTypeSet[resMD.Type()]; ok {
+		return resMD.ID()
+	}
+
+	if _, ok := clusterLabelTypeSet[resMD.Type()]; ok {
+		cluster, _ := resMD.Labels().Get(omni.LabelCluster)
+
+		return cluster
+	}
+
+	return ""
+}
+
+func clusterIDFromLabelTerms(labelTerms []resource.LabelTerm) resource.ID {
+	for _, term := range labelTerms {
+		if term.Key == omni.LabelCluster && term.Op == resource.LabelOpEqual {
+			return term.Value[0]
+		}
+	}
+
+	return ""
+}
+
+func clusterIDFromPointer(ptr resource.Pointer) resource.ID {
+	if _, ok := clusterIDTypeSet[ptr.Type()]; ok {
+		return ptr.ID()
+	}
+
+	return ""
+}
+
+func verbToRole(verb state.Verb) role.Role {
+	switch verb {
+	case state.Create, state.Update, state.Destroy:
+		return role.Operator
+	case state.Get, state.List, state.Watch:
+		return role.Reader
+	default:
+		panic(fmt.Sprintf("unknown verb %q", verb))
+	}
+}
+
+// filterAccess provides a filter to exclude some resources and operations from external sources.
+//
+//nolint:cyclop,gocyclo
+func filterAccess(ctx context.Context, access state.Access) error {
+	if actor.ContextIsInternalActor(ctx) {
+		return nil
+	}
+
+	var err error
+
+	// authentication and authorization checks
+	switch access.ResourceType {
+	case
+		omni.ClusterType,
+		omni.ClusterBootstrapStatusType,
+		omni.ClusterDestroyStatusType,
+		omni.ClusterEndpointType,
+		omni.ClusterMachineIdentityType,
+		omni.ClusterMachineStatusType,
+		omni.ClusterMachineTalosVersionType,
+		omni.ClusterMachineType,
+		omni.ClusterMachineConfigPatchesType,
+		omni.ClusterMachineTemplateType,
+		omni.ClusterUUIDType,
+		omni.ClusterStatusType,
+		omni.ConfigPatchType,
+		omni.ControlPlaneStatusType,
+		omni.ExposedServiceType,
+		omni.EtcdBackupType,
+		omni.EtcdBackupStatusType,
+		omni.EtcdBackupStoreStatusType,
+		omni.EtcdBackupOverallStatusType,
+		omni.EtcdManualBackupType,
+		omni.ImagePullRequestType,
+		omni.ImagePullStatusType,
+		omni.KubernetesStatusType,
+		omni.KubernetesUpgradeManifestStatusType,
+		omni.KubernetesUpgradeStatusType,
+		omni.LoadBalancerConfigType,
+		omni.LoadBalancerStatusType,
+		omni.MachineLabelsType,
+		omni.MachineSetType,
+		omni.MachineSetDestroyStatusType,
+		omni.MachineSetNodeType,
+		omni.MachineSetStatusType,
+		omni.TalosUpgradeStatusType,
+		omni.RedactedClusterMachineConfigType,
+		siderolink.LinkType,
+		siderolink.ConnectionParamsType,
+		omni.MachineType,
+		omni.MachineClassType,
+		omni.MachineStatusType,
+		omni.MachineStatusSnapshotType,
+		omni.MachineStatusLinkType,
+		omni.MachineConfigGenOptionsType,
+		omni.SchematicType,
+		omni.SchematicConfigurationType,
+		virtual.KubernetesUsageType:
+		_, err = auth.CheckGRPC(ctx, auth.WithRole(verbToRole(access.Verb)))
+	case
+		meta.NamespaceType,
+		meta.ResourceDefinitionType,
+		omni.FeaturesConfigType,
+		omni.TalosExtensionsType,
+		omni.TalosVersionType,
+		omni.KubernetesVersionType,
+		omni.InstallationMediaType,
+		omni.OngoingTaskType,
+		system.SysVersionType,
+		virtual.CurrentUserType,
+		virtual.PermissionsType,
+		virtual.ClusterPermissionsType:
+		// allow access with just valid signature
+		_, err = auth.CheckGRPC(ctx, auth.WithValidSignature(true))
+	case authres.IdentityType, authres.UserType, authres.SAMLLabelRuleType, authres.AccessPolicyType, omni.EtcdBackupS3ConfType:
+		var checkResult auth.CheckResult
+		// user management access
+		checkResult, err = auth.CheckGRPC(ctx, auth.WithRole(role.Admin))
+
+		if err == nil && (access.Verb == state.Destroy || access.Verb == state.Update) {
+			if access.ResourceType == authres.IdentityType && checkResult.Identity == access.ResourceID {
+				err = status.Errorf(codes.PermissionDenied, "destroying/updating resource %s is not allowed by the current user", access.ResourceID)
+			}
+
+			if access.ResourceType == authres.UserType && checkResult.UserID == access.ResourceID {
+				err = status.Errorf(codes.PermissionDenied, "destroying/updating resource %s is not allowed by the current user", access.ResourceID)
+			}
+		}
+	case authres.AuthConfigType:
+		// allow access even without auth
+	default:
+		err = status.Error(codes.PermissionDenied, "no access is permitted")
+	}
+
+	if err != nil {
+		return err
+	}
+
+	if config.Config.Auth.SAML.Enabled {
+		switch access.ResourceType {
+		case authres.UserType:
+			// If SAML is enabled only enable read, update and destroy on User resources.
+			if access.Verb.Readonly() || access.Verb == state.Update || access.Verb == state.Destroy {
+				return nil
+			}
+
+			return status.Error(codes.PermissionDenied, "only read and destroy access is permitted")
+		case authres.IdentityType:
+			// If SAML is enabled only enable read, update and destroy on Identity resources.
+			if access.Verb.Readonly() || access.Verb == state.Update || access.Verb == state.Destroy {
+				return nil
+			}
+
+			return status.Error(codes.PermissionDenied, "only read and destroy access is permitted")
+		}
+	}
+
+	// authorization checks by access type
+	return filterAccessByType(access)
+}
+
+// filterAccessByType provides a filter to exclude some resources and operations from external sources.
+func filterAccessByType(access state.Access) error {
+	// allow full access, these resources are managed on the client side
+	if _, ok := userManagedResourceTypeSet[access.ResourceType]; ok {
+		return nil
+	}
+
+	switch access.ResourceType {
+	case siderolink.LinkType:
+		// Allow read, update and delete access
+		// Update access is required for siderolink by rtestutils.Destroy[*siderolink.Link] call on integration tests
+		if access.Verb.Readonly() || access.Verb == state.Update || access.Verb == state.Destroy {
+			return nil
+		}
+
+		return status.Error(codes.PermissionDenied, "only read, update and delete access is permitted")
+	case
+		omni.ClusterBootstrapStatusType,
+		omni.ClusterDestroyStatusType,
+		omni.ClusterEndpointType,
+		omni.ClusterMachineIdentityType,
+		omni.ClusterMachineStatusType,
+		omni.ClusterMachineTalosVersionType,
+		omni.ClusterMachineType,
+		omni.ClusterMachineConfigPatchesType,
+		omni.ClusterMachineTemplateType,
+		omni.ClusterStatusType,
+		omni.ClusterUUIDType,
+		omni.ControlPlaneStatusType,
+		omni.ExposedServiceType,
+		omni.EtcdBackupType,
+		omni.EtcdBackupStatusType,
+		omni.EtcdBackupOverallStatusType,
+		omni.EtcdBackupStoreStatusType,
+		omni.FeaturesConfigType,
+		omni.ImagePullRequestType,
+		omni.ImagePullStatusType,
+		omni.KubernetesStatusType,
+		omni.KubernetesUpgradeManifestStatusType,
+		omni.KubernetesUpgradeStatusType,
+		omni.LoadBalancerConfigType,
+		omni.LoadBalancerStatusType,
+		omni.MachineType,
+		omni.MachineConfigGenOptionsType,
+		omni.MachineSetDestroyStatusType,
+		omni.MachineSetStatusType,
+		omni.MachineStatusType,
+		omni.MachineStatusLinkType,
+		omni.MachineStatusSnapshotType,
+		omni.KubernetesVersionType,
+		omni.TalosExtensionsType,
+		omni.TalosVersionType,
+		omni.TalosUpgradeStatusType,
+		omni.InstallationMediaType,
+		omni.OngoingTaskType,
+		omni.RedactedClusterMachineConfigType,
+		omni.SchematicType,
+		authres.AuthConfigType,
+		siderolink.ConnectionParamsType,
+		system.SysVersionType,
+		meta.NamespaceType,
+		meta.ResourceDefinitionType,
+		virtual.CurrentUserType,
+		virtual.PermissionsType,
+		virtual.KubernetesUsageType,
+		virtual.ClusterPermissionsType:
+		// allow read access only, these resources are managed by controllers only
+		if access.Verb.Readonly() {
+			return nil
+		}
+
+		return status.Error(codes.PermissionDenied, "only read access is permitted")
+	default:
+		return status.Error(codes.PermissionDenied, "access is not permitted")
+	}
+}
diff --git a/internal/backend/runtime/omni/state_boltdb.go b/internal/backend/runtime/omni/state_boltdb.go
new file mode 100644
index 000000000..5c33f42ca
--- /dev/null
+++ b/internal/backend/runtime/omni/state_boltdb.go
@@ -0,0 +1,122 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/cosi-project/runtime/pkg/state/impl/store"
+	"github.com/cosi-project/runtime/pkg/state/impl/store/bolt"
+	"go.etcd.io/bbolt"
+	"go.uber.org/zap"
+)
+
+func buildBoltPersistentState(ctx context.Context, path string, logger *zap.Logger, f func(context.Context, namespaced.StateBuilder) error) error {
+	builder, backingStore, err := newBoltStateBuilder(path, nil, false, logger)
+	if err != nil {
+		return err
+	}
+
+	defer backingStore.Close() //nolint:errcheck
+
+	return f(ctx, builder)
+}
+
+func newBoltPersistentState(path string, options *bbolt.Options, compact bool, logger *zap.Logger) (st state.CoreState, backingStore io.Closer, err error) {
+	builder, backingStore, err := newBoltStateBuilder(path, options, compact, logger)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return namespaced.NewState(builder), backingStore, nil
+}
+
+func newBoltStateBuilder(path string, options *bbolt.Options, compact bool, logger *zap.Logger) (
+	builder namespaced.StateBuilder,
+	backingStore io.Closer,
+	stateErr error,
+) {
+	boltStore, err := bolt.NewBackingStore(
+		func() (*bbolt.DB, error) {
+			if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+				return nil, fmt.Errorf("failed to create BoltDB directory: %w", err)
+			}
+
+			_, err := os.Stat(path)
+			if err != nil && !os.IsNotExist(err) {
+				return nil, fmt.Errorf("failed to stat BoltDB path: %w", err)
+			}
+
+			var (
+				runCompaction = compact && err == nil // if compaction is requested & there's an existing db file
+				oldDBPath     string
+				oldDB         *bbolt.DB
+			)
+
+			if runCompaction {
+				oldDBPath = path + ".old"
+
+				if err = os.Rename(path, oldDBPath); err != nil {
+					return nil, err
+				}
+
+				logger.Info("moved existing boltdb file", zap.String("src", path), zap.String("dst", oldDBPath))
+
+				if oldDB, err = bbolt.Open(oldDBPath, 0o600, nil); err != nil {
+					return nil, fmt.Errorf("failed to open BoltDB: %w", err)
+				}
+
+				defer oldDB.Close() //nolint:errcheck
+			}
+
+			// open the actual db file
+			db, err := bbolt.Open(path, 0o600, options)
+			if err != nil {
+				return nil, fmt.Errorf("failed to open BoltDB: %w", err)
+			}
+
+			// compaction: compact the old db file into the new one
+			if runCompaction {
+				if err = bbolt.Compact(db, oldDB, 65536); err != nil {
+					return nil, fmt.Errorf("failed to compact BoltDB: %w", err)
+				}
+
+				logger.Info("compacted BoltDB", zap.String("src", oldDBPath), zap.String("dst", path))
+
+				if err = oldDB.Close(); err != nil {
+					return nil, fmt.Errorf("failed to close old BoltDB: %w", err)
+				}
+
+				if err = os.Remove(oldDBPath); err != nil {
+					return nil, fmt.Errorf("failed to remove old BoltDB file: %w", err)
+				}
+
+				logger.Info("removed old BoltDB file after compaction", zap.String("path", oldDBPath))
+			}
+
+			return db, nil
+		},
+		store.ProtobufMarshaler{},
+	)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	return func(ns resource.Namespace) state.CoreState {
+		return inmem.NewStateWithOptions(inmem.WithBackingStore(boltStore.WithNamespace(ns)),
+			inmem.WithHistoryGap(20),
+			inmem.WithHistoryMaxCapacity(5000),
+		)(ns)
+	}, boltStore, nil
+}
diff --git a/internal/backend/runtime/omni/state_etcd.go b/internal/backend/runtime/omni/state_etcd.go
new file mode 100644
index 000000000..b4ef485e9
--- /dev/null
+++ b/internal/backend/runtime/omni/state_etcd.go
@@ -0,0 +1,286 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"net/url"
+	"os"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/cosi-project/runtime/pkg/state/impl/store"
+	"github.com/cosi-project/runtime/pkg/state/impl/store/compression"
+	"github.com/cosi-project/runtime/pkg/state/impl/store/encryption"
+	"github.com/cosi-project/state-etcd/pkg/state/impl/etcd"
+	"go.etcd.io/etcd/client/pkg/v3/transport"
+	clientv3 "go.etcd.io/etcd/client/v3"
+	"go.etcd.io/etcd/server/v3/embed"
+	"go.etcd.io/etcd/server/v3/etcdserver/api/v3client"
+	"go.uber.org/zap"
+	"google.golang.org/grpc"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/internal/backend/logging"
+	"github.com/siderolabs/omni/internal/backend/runtime/keyprovider"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+// compressionThresholdBytes is the minimum marshaled size of the data to be considered for compression.
+const compressionThresholdBytes = 2048
+
+func buildEtcdPersistentState(ctx context.Context, params *config.Params, logger *zap.Logger, f func(context.Context, namespaced.StateBuilder) error) error {
+	prefix := fmt.Sprintf("/omni/%s", url.PathEscape(params.AccountID))
+
+	return getEtcdClient(ctx, &params.Storage.Etcd, logger, func(ctx context.Context, etcdClient *clientv3.Client) error {
+		return etcdElections(ctx, etcdClient, prefix, logger, func(ctx context.Context, _ *clientv3.Client) error {
+			cipher, err := makeCipher(params.AccountID, params.Storage.Etcd, etcdClient, logger) //nolint:contextcheck
+			if err != nil {
+				return err
+			}
+
+			salt := sha256.Sum256([]byte(params.AccountID))
+
+			etcdState := etcd.NewState(
+				etcdClient,
+				encryption.NewMarshaler(
+					compression.NewMarshaler(
+						store.ProtobufMarshaler{},
+						compression.ZStd(),
+						compressionThresholdBytes,
+					),
+					cipher,
+				),
+				etcd.WithKeyPrefix(prefix),
+				etcd.WithSalt(salt[:]),
+			)
+
+			stateBuilder := func(resource.Namespace) state.CoreState {
+				// etcdState handles all namespaces in a single instance
+				return etcdState
+			}
+
+			return f(ctx, stateBuilder)
+		})
+	})
+}
+
+func makeCipher(name string, etcdParams config.EtcdParams, etcdClient etcd.Client, logger *zap.Logger) (*encryption.Cipher, error) {
+	publicKeys, err := loadPublicKeys(etcdParams)
+	if err != nil {
+		return nil, err
+	}
+
+	loader, err := NewLoader(etcdParams.PrivateKeySource, logger)
+	if err != nil {
+		return nil, err
+	}
+
+	privateKey, err := loader.PrivateKey()
+	if err != nil {
+		return nil, err
+	}
+
+	provider, err := keyprovider.New(etcdClient, hexHash(name), privateKey, publicKeys, logger)
+	if err != nil {
+		return nil, err
+	}
+
+	return encryption.NewCipher(provider), nil
+}
+
+func hexHash(name string) string {
+	result := sha256.Sum256([]byte(name))
+
+	return hex.EncodeToString(result[:])
+}
+
+func loadPublicKeys(params config.EtcdParams) ([]keyprovider.PublicKeyData, error) {
+	publicKeys := make([]keyprovider.PublicKeyData, 0, len(params.PublicKeyFiles))
+
+	for _, source := range params.PublicKeyFiles {
+		fileData, err := os.ReadFile(source)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read public key file '%s': %w", source, err)
+		}
+
+		data, err := keyprovider.MakePublicKeyData(string(fileData))
+		if err != nil {
+			return nil, fmt.Errorf("incorrect public key data '%s': %w", source, err)
+		}
+
+		publicKeys = append(publicKeys, data)
+	}
+
+	return publicKeys, nil
+}
+
+func getEtcdClient(ctx context.Context, params *config.EtcdParams, logger *zap.Logger, f func(context.Context, *clientv3.Client) error) error {
+	logger = logger.With(logging.Component("server"))
+
+	if params.Embedded {
+		return getEmbeddedEtcdClient(ctx, params, logger, f)
+	}
+
+	return getExternalEtcdClient(ctx, params, logger, f)
+}
+
+func getEmbeddedEtcdClient(ctx context.Context, params *config.EtcdParams, logger *zap.Logger, f func(context.Context, *clientv3.Client) error) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	logger = logger.WithOptions(
+		// never enable debug logs for etcd, they are too chatty
+		zap.IncreaseLevel(zap.InfoLevel),
+	).With(logging.Component("embedded_etcd"))
+
+	logger.Info("starting embedded etcd server", zap.String("data_dir", params.EmbeddedDBPath))
+
+	cfg := embed.NewConfig()
+	cfg.Dir = params.EmbeddedDBPath
+	cfg.EnableGRPCGateway = false
+	cfg.LogLevel = "info"
+	cfg.ZapLoggerBuilder = embed.NewZapLoggerBuilder(logger)
+	cfg.AuthToken = ""
+	cfg.AutoCompactionMode = "periodic"
+	cfg.AutoCompactionRetention = "5h"
+	cfg.ExperimentalCompactHashCheckEnabled = true
+	cfg.ExperimentalInitialCorruptCheck = true
+	cfg.UnsafeNoFsync = params.EmbeddedUnsafeFsync
+
+	peerURL, err := url.Parse("http://localhost:0")
+	if err != nil {
+		return fmt.Errorf("failed to parse URL: %w", err)
+	}
+
+	cfg.ListenPeerUrls = []url.URL{*peerURL}
+
+	clientURLs := make([]url.URL, 0, len(params.Endpoints))
+
+	for _, endpoint := range params.Endpoints {
+		clientURL, parseErr := url.Parse(endpoint)
+		if parseErr != nil {
+			return fmt.Errorf("failed to parse URL: %w", parseErr)
+		}
+
+		clientURLs = append(clientURLs, *clientURL)
+	}
+
+	cfg.ListenClientUrls = clientURLs
+
+	embeddedServer, err := embed.StartEtcd(cfg)
+	if err != nil {
+		return fmt.Errorf("failed to start embedded etcd: %w", err)
+	}
+
+	go func() {
+		for etcdErr := range embeddedServer.Err() {
+			if etcdErr != nil {
+				logger.Error("embedded etcd error", zap.Error(etcdErr))
+
+				cancel()
+			}
+		}
+	}()
+
+	// give etcd some time to start
+	timer := time.NewTimer(15 * time.Second)
+	defer timer.Stop()
+
+	select {
+	case <-embeddedServer.Server.ReadyNotify():
+	case <-time.After(15 * time.Second):
+		embeddedServer.Close()
+
+		return errors.New("etcd failed to start")
+	}
+
+	cli := v3client.New(embeddedServer.Server)
+
+	closer := func() error {
+		if err = cli.Close(); err != nil && !errors.Is(err, context.Canceled) {
+			return fmt.Errorf("error closing client: %w", err)
+		}
+
+		embeddedServer.Close()
+
+		select {
+		case <-embeddedServer.Server.StopNotify():
+		case <-time.After(15 * time.Second):
+			return errors.New("timeout stopping etcd server")
+		}
+
+		return nil
+	}
+
+	defer func() {
+		if err = closer(); err != nil {
+			logger.Error("error stopping embedded etcd", zap.Error(err))
+		}
+	}()
+
+	return f(ctx, cli)
+}
+
+func getExternalEtcdClient(ctx context.Context, params *config.EtcdParams, logger *zap.Logger, f func(context.Context, *clientv3.Client) error) error {
+	if len(params.Endpoints) == 0 {
+		return errors.New("no etcd endpoints provided")
+	}
+
+	logger.Info("starting etcd client",
+		zap.Strings("endpoints", params.Endpoints),
+		zap.String("cert_path", params.CertPath),
+		zap.String("key_path", params.KeyPath),
+		zap.String("ca_path", params.CAPath),
+	)
+
+	tlsInfo := transport.TLSInfo{
+		CertFile:      params.CertPath,
+		KeyFile:       params.KeyPath,
+		TrustedCAFile: params.CAPath,
+	}
+
+	tlsConfig, err := tlsInfo.ClientConfig()
+	if err != nil {
+		return fmt.Errorf("error building etcd client TLS config: %w", err)
+	}
+
+	cli, err := clientv3.New(clientv3.Config{
+		Endpoints:   params.Endpoints,
+		DialTimeout: 5 * time.Second,
+		DialOptions: []grpc.DialOption{
+			grpc.WithBlock(),
+			grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(constants.GRPCMaxMessageSize)),
+			grpc.WithSharedWriteBuffer(true),
+		},
+		TLS: tlsConfig,
+	})
+	if err != nil {
+		return err
+	}
+
+	closer := func() error {
+		if err = cli.Close(); err != nil && !errors.Is(err, context.Canceled) {
+			return fmt.Errorf("error closing client: %w", err)
+		}
+
+		return nil
+	}
+
+	defer func() {
+		if err = closer(); err != nil {
+			logger.Error("error stopping embedded etcd", zap.Error(err))
+		}
+	}()
+
+	return f(ctx, cli)
+}
diff --git a/internal/backend/runtime/omni/state_etcd_election.go b/internal/backend/runtime/omni/state_etcd_election.go
new file mode 100644
index 000000000..7a8d58edb
--- /dev/null
+++ b/internal/backend/runtime/omni/state_etcd_election.go
@@ -0,0 +1,108 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"fmt"
+	"path"
+	"time"
+
+	"github.com/google/uuid"
+	clientv3 "go.etcd.io/etcd/client/v3"
+	"go.etcd.io/etcd/client/v3/concurrency"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/internal/backend/logging"
+)
+
+// etcdElections makes sure only one instance of the application is running at a time.
+func etcdElections(ctx context.Context, client *clientv3.Client, electionKey string, logger *zap.Logger, f func(ctx context.Context, client *clientv3.Client) error) error {
+	logger = logger.With(logging.Component("elections"))
+
+	// use a new context to create a session, as `ctx` might be canceled, and the session is aborted explicitly with Close
+	sess, err := concurrency.NewSession(client, concurrency.WithContext(context.Background())) //nolint:contextcheck
+	if err != nil {
+		return fmt.Errorf("failed to create concurrency session: %w", err)
+	}
+	defer sess.Close() //nolint:errcheck
+
+	// create a random key for this campaign, so there will be no way to "resume" the elections, as there is no stable ID
+	campaignKey := uuid.NewString()
+
+	election := concurrency.NewElection(sess, path.Join(electionKey, "election"))
+
+	campaignErrCh := make(chan error)
+
+	go func() {
+		campaignErrCh <- election.Campaign(ctx, campaignKey)
+	}()
+
+	logger.Info("running the etcd election campaign")
+
+	// wait for the etcd election campaign to be complete
+campaignLoop:
+	for {
+		select {
+		case err = <-campaignErrCh:
+			if err != nil {
+				return fmt.Errorf("failed to conduct campaign: %w", err)
+			}
+
+			// won the election campaign!
+			break campaignLoop
+		case <-sess.Done():
+			logger.Info("etcd session closed")
+
+			return nil
+		case <-ctx.Done():
+			return nil
+		}
+	}
+
+	logger.Info("won the etcd election campaign")
+
+	defer func() {
+		// use a new context to resign, as `ctx` might be canceled
+		resignCtx, resignCancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer resignCancel()
+
+		resignErr := election.Resign(resignCtx)
+
+		logger.Info("resigned from the etcd election campaign", zap.Error(resignErr))
+	}()
+
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	go func() {
+		observe := election.Observe(ctx)
+
+	observeLoop:
+		for {
+			select {
+			case <-sess.Done():
+				logger.Info("etcd session closed")
+
+				break observeLoop
+			case <-ctx.Done():
+				break observeLoop
+			case resp, ok := <-observe:
+				if !ok {
+					break observeLoop
+				}
+
+				if string(resp.Kvs[0].Value) != campaignKey {
+					logger.Info("detected new leader", zap.ByteString("leader", resp.Kvs[0].Value))
+
+					break observeLoop
+				}
+			}
+		}
+	}()
+
+	return f(ctx, client)
+}
diff --git a/internal/backend/runtime/omni/state_etcd_election_test.go b/internal/backend/runtime/omni/state_etcd_election_test.go
new file mode 100644
index 000000000..bc9627db3
--- /dev/null
+++ b/internal/backend/runtime/omni/state_etcd_election_test.go
@@ -0,0 +1,116 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+	clientv3 "go.etcd.io/etcd/client/v3"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/siderolabs/omni/internal/backend/runtime/omni"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+func mockRunner(id int, started chan<- int, closed <-chan error) func(ctx context.Context, client *clientv3.Client) error {
+	return func(ctx context.Context, _ *clientv3.Client) error {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case started <- id:
+		}
+
+		select {
+		case err := <-closed:
+			return err
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+}
+
+func TestEtcdElections(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	logger := zaptest.NewLogger(t)
+
+	require.NoError(t, omni.GetEmbeddedEtcdClient(ctx, &config.EtcdParams{
+		Embedded:       true,
+		EmbeddedDBPath: t.TempDir(),
+	}, logger, func(ctx context.Context, client *clientv3.Client) error {
+		started := make(chan int)
+		closed := make(chan error)
+		errCh := make(chan error)
+		electionKey := uuid.NewString()
+
+		// run the first mock runnner, it should win the elections and keep running
+		go func() {
+			errCh <- omni.EtcdElections(ctx, client, electionKey, logger, mockRunner(1, started, closed))
+		}()
+
+		select {
+		case id := <-started:
+			require.Equal(t, 1, id)
+		case <-ctx.Done():
+			t.Fatal("first runner didn't start")
+		}
+
+		// run the second mock runner, it should not start as the elections are already won
+		go func() {
+			errCh <- omni.EtcdElections(ctx, client, electionKey, logger, mockRunner(2, started, closed))
+		}()
+
+		select {
+		case <-started:
+			t.Fatal("shouldn't start second runner")
+		case <-time.After(time.Second):
+		}
+
+		// stop the first runner, the second runner should start
+		select {
+		case closed <- nil:
+		case <-ctx.Done():
+			t.Fatal("first runner didn't stop")
+		}
+
+		select {
+		case err := <-errCh:
+			require.NoError(t, err)
+		case <-ctx.Done():
+			t.Fatal("first runner didn't stop")
+		}
+
+		select {
+		case id := <-started:
+			require.Equal(t, 2, id)
+		case <-ctx.Done():
+			t.Fatal("second runner didn't start")
+		}
+
+		// stop the second runner, it should terminate
+		select {
+		case closed <- errors.New("stopped"):
+		case <-ctx.Done():
+			t.Fatal("second runner didn't stop")
+		}
+
+		select {
+		case err := <-errCh:
+			require.Error(t, err)
+			require.EqualError(t, err, "stopped")
+		case <-ctx.Done():
+			t.Fatal("second runner didn't stop")
+		}
+
+		return nil
+	}))
+}
diff --git a/internal/backend/runtime/omni/state_etcd_test.go b/internal/backend/runtime/omni/state_etcd_test.go
new file mode 100644
index 000000000..11fc10968
--- /dev/null
+++ b/internal/backend/runtime/omni/state_etcd_test.go
@@ -0,0 +1,224 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	_ "embed"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/keystorage"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/siderolabs/gen/xtesting/check"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/keyprovider"
+	omniruntime "github.com/siderolabs/omni/internal/backend/runtime/omni"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+//go:embed testdata/pgp/new_key.private
+var oldKey string
+
+func ExampleGetIdentityString() {
+	idStr, err := keyprovider.GetIdentityString(oldKey)
+	if err != nil {
+		panic(err)
+	}
+
+	fmt.Println(idStr)
+
+	// Output:
+	// Another Key <another_key@siderolabs.com> <584aaf056e1a1278c47845008d8ce8435b748200>
+}
+
+func TestEtcdInitialization(t *testing.T) {
+	tempDir := t.TempDir()
+	etcdDir := filepath.Join(tempDir, "etcd")
+
+	t.Cleanup(func() {
+		err := os.RemoveAll(tempDir)
+		require.NoError(t, err)
+	})
+
+	type args struct {
+		privateKeySource string
+		publicKeyFiles   []string
+	}
+
+	steps := []struct { //nolint:govet
+		name        string
+		args        args
+		expectedErr check.Check
+	}{
+		{
+			name: "empty private key source",
+			args: args{
+				privateKeySource: "",
+				publicKeyFiles:   nil,
+			},
+			expectedErr: check.ErrorContains("private key source is not set"),
+		},
+		{
+			name: "private key without public keys",
+			args: args{
+				privateKeySource: "file://testdata/pgp/old_key.private",
+				publicKeyFiles:   nil,
+			},
+			expectedErr: check.NoError(),
+		},
+		{
+			name: "incorrect public key file name",
+			args: args{
+				privateKeySource: "file://testdata/pgp/old_key.private",
+				publicKeyFiles:   []string{"testdata/pgp/not_exists.pgp"},
+			},
+			expectedErr: check.ErrorContains("failed to read public key file"),
+		},
+		{
+			name: "invalid private key slot",
+			args: args{
+				privateKeySource: "file://testdata/pgp/new_key.private",
+				publicKeyFiles:   nil,
+			},
+			expectedErr: check.ErrorTagIs[keystorage.SlotNotFoundTag](),
+		},
+		{
+			name: "add new public key",
+			args: args{
+				privateKeySource: "file://testdata/pgp/old_key.private",
+				publicKeyFiles:   []string{"testdata/pgp/new_key.public"},
+			},
+			expectedErr: check.NoError(),
+		},
+		{
+			name: "new public key with old private key should be ok",
+			args: args{
+				privateKeySource: "file://testdata/pgp/old_key.private",
+				publicKeyFiles:   []string{"testdata/pgp/new_key.public"},
+			},
+			expectedErr: check.NoError(),
+		},
+		{
+			name: "use new private key",
+			args: args{
+				privateKeySource: "file://testdata/pgp/new_key.private",
+				publicKeyFiles:   nil,
+			},
+			expectedErr: check.NoError(),
+		},
+	}
+
+	for _, step := range steps {
+		res := t.Run(step.name, func(t *testing.T) {
+			err := omniruntime.BuildEtcdPersistentState(context.TODO(), &config.Params{
+				Name: "instance-name",
+				Storage: config.StorageParams{
+					Etcd: config.EtcdParams{
+						Embedded:         true,
+						EmbeddedDBPath:   etcdDir,
+						PrivateKeySource: step.args.privateKeySource,
+						PublicKeyFiles:   step.args.publicKeyFiles,
+					},
+				},
+			}, zaptest.NewLogger(t), func(context.Context, namespaced.StateBuilder) error {
+				return nil
+			})
+
+			step.expectedErr(t, err)
+		})
+
+		if !res {
+			t.FailNow()
+		}
+	}
+}
+
+func TestEncryptDecrypt(t *testing.T) {
+	tempDir := t.TempDir()
+	etcdDir := filepath.Join(tempDir, "etcd")
+
+	t.Cleanup(func() {
+		err := os.RemoveAll(tempDir)
+		require.NoError(t, err)
+	})
+
+	original := omni.NewCluster(resources.DefaultNamespace, "clusterID")
+
+	type args struct {
+		privateKeySource string
+		publicKeyFiles   []string
+	}
+
+	steps := []struct {
+		beforeGet func(t *testing.T, state state.CoreState)
+		name      string
+		args      args
+	}{
+		{
+			name: "encrypt-decrypt using 'new_key' slot",
+			args: args{
+				privateKeySource: "file://testdata/pgp/new_key.private",
+				publicKeyFiles:   []string{"testdata/pgp/old_key.public"},
+			},
+			beforeGet: func(t *testing.T, state state.CoreState) {
+				err := state.Create(context.Background(), original)
+				require.NoError(t, err)
+			},
+		},
+		{
+			name: "decrypt using 'old_key' slot",
+			args: args{
+				privateKeySource: "file://testdata/pgp/old_key.private",
+				publicKeyFiles:   nil,
+			},
+		},
+	}
+
+	for _, step := range steps {
+		res := t.Run(step.name, func(t *testing.T) {
+			err := omniruntime.BuildEtcdPersistentState(context.TODO(), &config.Params{
+				Name: "instance-name",
+				Storage: config.StorageParams{
+					Etcd: config.EtcdParams{
+						Embedded:         true,
+						EmbeddedDBPath:   etcdDir,
+						PrivateKeySource: step.args.privateKeySource,
+						PublicKeyFiles:   step.args.publicKeyFiles,
+					},
+				},
+			}, zaptest.NewLogger(t),
+				func(ctx context.Context, stateBuilder namespaced.StateBuilder) error {
+					coreState := stateBuilder(resources.DefaultNamespace)
+					if step.beforeGet != nil {
+						step.beforeGet(t, coreState)
+					}
+
+					got, err := coreState.Get(ctx, original.Metadata())
+					require.NoError(t, err)
+
+					require.True(t, resource.Equal(original, got))
+
+					return nil
+				},
+			)
+
+			require.NoError(t, err)
+		})
+
+		if !res {
+			t.FailNow()
+		}
+	}
+}
diff --git a/internal/backend/runtime/omni/state_metrics.go b/internal/backend/runtime/omni/state_metrics.go
new file mode 100644
index 000000000..3db5903c8
--- /dev/null
+++ b/internal/backend/runtime/omni/state_metrics.go
@@ -0,0 +1,99 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+// stateMetrics wraps COSI core state and produces metrics on resource access.
+type stateMetrics struct {
+	st state.CoreState
+
+	resourceOperations *prometheus.CounterVec
+}
+
+// Check interfaces.
+var (
+	_ prometheus.Collector = &stateMetrics{}
+	_ state.CoreState      = &stateMetrics{}
+)
+
+func wrapStateWithMetrics(st state.CoreState) *stateMetrics {
+	return &stateMetrics{
+		st: st,
+
+		resourceOperations: prometheus.NewCounterVec(
+			prometheus.CounterOpts{
+				Name: "omni_resource_operations_total",
+				Help: "Number of resource operations by operation and resource type.",
+			},
+			[]string{"operation", "type"},
+		),
+	}
+}
+
+// Describe implements prom.Collector interface.
+func (metrics *stateMetrics) Describe(ch chan<- *prometheus.Desc) {
+	prometheus.DescribeByCollect(metrics, ch)
+}
+
+// Collect implements prom.Collector interface.
+func (metrics *stateMetrics) Collect(ch chan<- prometheus.Metric) {
+	metrics.resourceOperations.Collect(ch)
+}
+
+func (metrics *stateMetrics) Get(ctx context.Context, r resource.Pointer, opts ...state.GetOption) (resource.Resource, error) {
+	metrics.resourceOperations.WithLabelValues("get", r.Type()).Inc()
+
+	return metrics.st.Get(ctx, r, opts...)
+}
+
+func (metrics *stateMetrics) List(ctx context.Context, r resource.Kind, opts ...state.ListOption) (resource.List, error) {
+	metrics.resourceOperations.WithLabelValues("list", r.Type()).Inc()
+
+	return metrics.st.List(ctx, r, opts...)
+}
+
+func (metrics *stateMetrics) Create(ctx context.Context, r resource.Resource, opts ...state.CreateOption) error {
+	metrics.resourceOperations.WithLabelValues("create", r.Metadata().Type()).Inc()
+
+	return metrics.st.Create(ctx, r, opts...)
+}
+
+func (metrics *stateMetrics) Update(ctx context.Context, newResource resource.Resource, opts ...state.UpdateOption) error {
+	metrics.resourceOperations.WithLabelValues("update", newResource.Metadata().Type()).Inc()
+
+	return metrics.st.Update(ctx, newResource, opts...)
+}
+
+func (metrics *stateMetrics) Destroy(ctx context.Context, r resource.Pointer, opts ...state.DestroyOption) error {
+	metrics.resourceOperations.WithLabelValues("destroy", r.Type()).Inc()
+
+	return metrics.st.Destroy(ctx, r, opts...)
+}
+
+func (metrics *stateMetrics) Watch(ctx context.Context, r resource.Pointer, ch chan<- state.Event, opts ...state.WatchOption) error {
+	metrics.resourceOperations.WithLabelValues("watch", r.Type()).Inc()
+
+	return metrics.st.Watch(ctx, r, ch, opts...)
+}
+
+func (metrics *stateMetrics) WatchKind(ctx context.Context, r resource.Kind, ch chan<- state.Event, opts ...state.WatchKindOption) error {
+	metrics.resourceOperations.WithLabelValues("watch", r.Type()).Inc()
+
+	return metrics.st.WatchKind(ctx, r, ch, opts...)
+}
+
+func (metrics *stateMetrics) WatchKindAggregated(ctx context.Context, r resource.Kind, c chan<- []state.Event, opts ...state.WatchKindOption) error {
+	metrics.resourceOperations.WithLabelValues("watch", r.Type()).Inc()
+
+	return metrics.st.WatchKindAggregated(ctx, r, c, opts...)
+}
diff --git a/internal/backend/runtime/omni/state_validation.go b/internal/backend/runtime/omni/state_validation.go
new file mode 100644
index 000000000..96041d505
--- /dev/null
+++ b/internal/backend/runtime/omni/state_validation.go
@@ -0,0 +1,699 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+	"unicode"
+
+	"github.com/blang/semver"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/hashicorp/go-multierror"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/cosi/labels"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	authres "github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup/store"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/validated"
+	"github.com/siderolabs/omni/internal/pkg/auth/accesspolicy"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+// clusterValidationOptions returns the validation options for the Talos and Kubernetes versions on the cluster resource.
+// Validation is only syntactic - they are checked whether they are valid semver strings.
+//
+//nolint:gocognit
+func clusterValidationOptions(st state.State) []validated.StateOption {
+	validateVersions := func(ctx context.Context, res *omni.Cluster, skipTalosVersion, skipKubernetesVersion bool) error {
+		if skipTalosVersion && skipKubernetesVersion {
+			return nil
+		}
+
+		talosVersion, err := safe.StateGet[*omni.TalosVersion](ctx, st, omni.NewTalosVersion(resources.DefaultNamespace, res.TypedSpec().Value.TalosVersion).Metadata())
+		if err != nil {
+			if state.IsNotFoundError(err) && skipTalosVersion {
+				return nil
+			}
+
+			return fmt.Errorf("invalid talos version %q: %w", res.TypedSpec().Value.TalosVersion, err)
+		}
+
+		if skipKubernetesVersion {
+			return nil
+		}
+
+		for _, compatibleKubernetesVersion := range talosVersion.TypedSpec().Value.CompatibleKubernetesVersions {
+			if compatibleKubernetesVersion == res.TypedSpec().Value.KubernetesVersion {
+				return nil
+			}
+		}
+
+		return fmt.Errorf("invalid kubernetes version %q: is not compatible with talos version %q", res.TypedSpec().Value.KubernetesVersion, res.TypedSpec().Value.TalosVersion)
+	}
+
+	encryptionSupport := semver.MustParse("1.5.0")
+
+	validateEncryption := func(res *omni.Cluster) error {
+		if !omni.GetEncryptionEnabled(res) {
+			return nil
+		}
+
+		var (
+			version semver.Version
+			err     error
+		)
+
+		if version, err = semver.ParseTolerant(res.TypedSpec().Value.TalosVersion); err != nil {
+			return err
+		}
+
+		if version.Compare(encryptionSupport) < 0 {
+			return errors.New("disk encryption is supported only for Talos version >= 1.5.0")
+		}
+
+		return nil
+	}
+
+	validateBackupInterval := func(res *omni.Cluster) error {
+		if conf := res.TypedSpec().Value.GetBackupConfiguration(); conf != nil {
+			switch conf := conf.GetInterval().AsDuration(); {
+			case conf < config.Config.EtcdBackup.MinInterval:
+				return fmt.Errorf(
+					"backup interval must be greater than %s, actual %s",
+					config.Config.EtcdBackup.MinInterval.String(),
+					conf.String(),
+				)
+			case conf > config.Config.EtcdBackup.MaxInterval:
+				return fmt.Errorf(
+					"backup interval must be less than %s, actual %s",
+					config.Config.EtcdBackup.MaxInterval.String(),
+					conf.String(),
+				)
+			}
+		}
+
+		return nil
+	}
+
+	return []validated.StateOption{
+		validated.WithCreateValidations(validated.NewCreateValidationForType(func(ctx context.Context, res *omni.Cluster, _ ...state.CreateOption) error {
+			if err := validateEncryption(res); err != nil {
+				return err
+			}
+
+			if err := validateBackupInterval(res); err != nil {
+				return err
+			}
+
+			return validateVersions(ctx, res, false, false)
+		})),
+		validated.WithUpdateValidations(validated.NewUpdateValidationForType(func(ctx context.Context, existingRes *omni.Cluster, newRes *omni.Cluster, _ ...state.UpdateOption) error {
+			if existingRes == nil {
+				// shouldn't happen - skip the validation, so that the original error (NotFound) will be returned
+				return nil
+			}
+
+			skipTalosVersion := existingRes.TypedSpec().Value.TalosVersion == newRes.TypedSpec().Value.TalosVersion
+			skipKubernetesVersion := existingRes.TypedSpec().Value.KubernetesVersion == newRes.TypedSpec().Value.KubernetesVersion
+
+			if omni.GetEncryptionEnabled(existingRes) != omni.GetEncryptionEnabled(newRes) {
+				return errors.New("updating disk encryption settings is not allowed")
+			}
+
+			if err := validateBackupInterval(newRes); err != nil {
+				return err
+			}
+
+			return validateVersions(ctx, newRes, skipTalosVersion, skipKubernetesVersion)
+		})),
+	}
+}
+
+// relationLabelsValidationOptions returns the validation options for the relation labels on the resources.
+func relationLabelsValidationOptions() []validated.StateOption {
+	validateLabelIsSet := func(res resource.Resource, key string) error {
+		val, ok := res.Metadata().Labels().Get(key)
+		if !ok {
+			return fmt.Errorf("label %q does not exist", key)
+		}
+
+		if val == "" {
+			return fmt.Errorf("label %q has empty value", key)
+		}
+
+		return nil
+	}
+
+	return []validated.StateOption{
+		validated.WithCreateValidations(
+			validated.NewCreateValidationForType(func(_ context.Context, res *omni.MachineSetNode, _ ...state.CreateOption) error {
+				return validateLabelIsSet(res, omni.LabelMachineSet)
+			}),
+			validated.NewCreateValidationForType(func(_ context.Context, res *omni.MachineSet, _ ...state.CreateOption) error {
+				return validateLabelIsSet(res, omni.LabelCluster)
+			}),
+			validated.NewCreateValidationForType(func(_ context.Context, res *omni.ExposedService, _ ...state.CreateOption) error {
+				return validateLabelIsSet(res, omni.LabelCluster)
+			}),
+		),
+		validated.WithUpdateValidations(
+			validated.NewUpdateValidationForType(func(_ context.Context, _ *omni.MachineSetNode, newRes *omni.MachineSetNode, _ ...state.UpdateOption) error {
+				return validateLabelIsSet(newRes, omni.LabelMachineSet)
+			}),
+			validated.NewUpdateValidationForType(func(_ context.Context, _ *omni.MachineSet, newRes *omni.MachineSet, _ ...state.UpdateOption) error {
+				return validateLabelIsSet(newRes, omni.LabelCluster)
+			}),
+			validated.NewUpdateValidationForType(func(_ context.Context, _ *omni.ExposedService, newRes *omni.ExposedService, _ ...state.UpdateOption) error {
+				return validateLabelIsSet(newRes, omni.LabelCluster)
+			}),
+		),
+	}
+}
+
+// accessPolicyValidationOptions returns the validation options for the access policy resource.
+func accessPolicyValidationOptions() []validated.StateOption {
+	return []validated.StateOption{
+		validated.WithCreateValidations(validated.NewCreateValidationForType(func(_ context.Context, res *authres.AccessPolicy, _ ...state.CreateOption) error {
+			return accesspolicy.Validate(res)
+		})),
+		validated.WithUpdateValidations(validated.NewUpdateValidationForType(func(_ context.Context, _ *authres.AccessPolicy, newRes *authres.AccessPolicy, _ ...state.UpdateOption) error {
+			return accesspolicy.Validate(newRes)
+		})),
+	}
+}
+
+// roleValidationOptions returns the validation options for the user and public key resources, ensuring that their roles are valid.
+func roleValidationOptions() []validated.StateOption {
+	validateRole := func(roleStr string) error {
+		_, err := role.Parse(roleStr)
+
+		return err
+	}
+
+	return []validated.StateOption{
+		validated.WithCreateValidations(validated.NewCreateValidationForType(func(_ context.Context, res *authres.User, _ ...state.CreateOption) error {
+			return validateRole(res.TypedSpec().Value.GetRole())
+		})),
+		validated.WithUpdateValidations(validated.NewUpdateValidationForType(func(_ context.Context, _ *authres.User, newRes *authres.User, _ ...state.UpdateOption) error {
+			return validateRole(newRes.TypedSpec().Value.GetRole())
+		})),
+		validated.WithCreateValidations(validated.NewCreateValidationForType(func(_ context.Context, res *authres.PublicKey, _ ...state.CreateOption) error {
+			return validateRole(res.TypedSpec().Value.GetRole())
+		})),
+		validated.WithUpdateValidations(validated.NewUpdateValidationForType(func(_ context.Context, _ *authres.PublicKey, newRes *authres.PublicKey, _ ...state.UpdateOption) error {
+			return validateRole(newRes.TypedSpec().Value.GetRole())
+		})),
+	}
+}
+
+// machineSetValidationOptions returns the validation options for the machine set resource.
+//
+//nolint:gocognit,gocyclo,cyclop
+func machineSetValidationOptions(st state.State, etcdBackupStoreFactory store.Factory) []validated.StateOption {
+	validate := func(ctx context.Context, oldRes *omni.MachineSet, res *omni.MachineSet) error {
+		// label validations
+		clusterName, ok := res.Metadata().Labels().Get(omni.LabelCluster)
+		if !ok {
+			return errors.New("cluster label is missing")
+		}
+
+		if oldRes == nil {
+			cluster, err := safe.StateGetByID[*omni.Cluster](ctx, st, clusterName)
+			if err != nil && !state.IsNotFoundError(err) {
+				return err
+			}
+
+			if cluster != nil && cluster.Metadata().Phase() == resource.PhaseTearingDown {
+				return fmt.Errorf("the cluster %q is tearing down", clusterName)
+			}
+		}
+
+		_, isControlPlane := res.Metadata().Labels().Get(omni.LabelControlPlaneRole)
+		_, isWorker := res.Metadata().Labels().Get(omni.LabelWorkerRole)
+
+		if !isControlPlane && !isWorker {
+			return fmt.Errorf("machine set must have either %q or %q label", omni.LabelControlPlaneRole, omni.LabelWorkerRole)
+		}
+
+		if isControlPlane && oldRes == nil { // creating a new control plane machine set
+			bootstrapStatus, err := safe.StateGetByID[*omni.ClusterBootstrapStatus](ctx, st, clusterName)
+			if err != nil && !state.IsNotFoundError(err) {
+				return fmt.Errorf("error getting cluster bootstrap status: %w", err)
+			}
+
+			if bootstrapStatus != nil && bootstrapStatus.TypedSpec().Value.GetBootstrapped() {
+				return errors.New("adding control plane machine set to an already bootstrapped cluster is not allowed")
+			}
+		}
+
+		if err := validateBootstrapSpec(ctx, st, etcdBackupStoreFactory, oldRes, res); err != nil {
+			return err
+		}
+
+		spec := res.TypedSpec().Value
+		if spec.MachineClass != nil {
+			if spec.MachineClass.Name == "" {
+				return errors.New("machine set class name is not set")
+			}
+
+			if spec.MachineClass.MachineCount != 0 && spec.MachineClass.AllocationType != specs.MachineSetSpec_MachineClass_Static {
+				return errors.New("machine count can be set only if static allocation type is used")
+			}
+
+			// if change machine class, verify the specified class name exists.
+			changed := oldRes == nil || oldRes.TypedSpec().Value.MachineClass != nil && oldRes.TypedSpec().Value.MachineClass.Name != spec.MachineClass.Name
+			if changed {
+				_, err := st.Get(ctx, omni.NewMachineClass(resources.DefaultNamespace, spec.MachineClass.Name).Metadata())
+				if err != nil {
+					if state.IsNotFoundError(err) {
+						return fmt.Errorf("machine class with name %q doesn't exist", spec.MachineClass.Name)
+					}
+
+					return err
+				}
+			}
+		}
+
+		if oldRes != nil {
+			// ensure that the machine class type doesn't change from manually selected machines to the machine class
+			oldSpec := oldRes.TypedSpec().Value
+
+			switch {
+			case oldSpec.MachineClass == nil && spec.MachineClass != nil:
+				return errors.New("machine set is using manual nodes management, updating to machine class mode is not allowed")
+			case oldSpec.MachineClass != nil && spec.MachineClass == nil:
+				return errors.New("machine set is using machine class based node management, updating to manual mode is not allowed")
+			}
+
+			return nil
+		}
+
+		// id validations
+		clusterPrefix := clusterName + "-"
+
+		if !strings.HasPrefix(res.Metadata().ID(), clusterPrefix) {
+			return fmt.Errorf("machine set of cluster %q ID must have %q as prefix", clusterName, clusterPrefix)
+		}
+
+		cpID := omni.ControlPlanesResourceID(clusterName)
+
+		if isControlPlane {
+			if res.Metadata().ID() == cpID {
+				return nil
+			}
+
+			return fmt.Errorf("control plane machine set must have ID %q", cpID)
+		}
+
+		if res.Metadata().ID() == cpID {
+			return fmt.Errorf("worker machine set must not have ID %q", cpID)
+		}
+
+		return nil
+	}
+
+	return []validated.StateOption{
+		validated.WithCreateValidations(validated.NewCreateValidationForType(func(ctx context.Context, res *omni.MachineSet, _ ...state.CreateOption) error {
+			return validate(ctx, nil, res)
+		})),
+		validated.WithUpdateValidations(validated.NewUpdateValidationForType(func(ctx context.Context, oldRes *omni.MachineSet, newRes *omni.MachineSet, _ ...state.UpdateOption) error {
+			return validate(ctx, oldRes, newRes)
+		})),
+	}
+}
+
+func validateBootstrapSpec(ctx context.Context, st state.State, etcdBackupStoreFactory store.Factory, oldres, res *omni.MachineSet) error {
+	bootstrapSpec := res.TypedSpec().Value.GetBootstrapSpec()
+	_, isControlPlane := res.Metadata().Labels().Get(omni.LabelControlPlaneRole)
+
+	if !isControlPlane && bootstrapSpec != nil {
+		return errors.New("bootstrap spec is not allowed for worker machine sets")
+	}
+
+	if oldres != nil { // this is an update
+		if !bootstrapSpec.EqualVT(oldres.TypedSpec().Value.GetBootstrapSpec()) {
+			return errors.New("bootstrap spec is immutable after creation")
+		}
+
+		// short-circuit if the bootstrap spec is not changed on update - it was already validated on creation
+		return nil
+	}
+
+	if bootstrapSpec == nil {
+		return nil
+	}
+
+	clusterUUIDs, err := safe.StateListAll[*omni.ClusterUUID](ctx, st, state.WithLabelQuery(resource.LabelEqual(omni.LabelClusterUUID, bootstrapSpec.GetClusterUuid())))
+	if err != nil {
+		return fmt.Errorf("error getting cluster UUIDs: %w", err)
+	}
+
+	if clusterUUIDs.Len() == 0 {
+		return fmt.Errorf("invalid cluster UUID %q", bootstrapSpec.GetClusterUuid())
+	}
+
+	if clusterUUIDs.Len() > 1 {
+		return fmt.Errorf("inconsistent state on cluster UUID %q", bootstrapSpec.GetClusterUuid())
+	}
+
+	cluster := clusterUUIDs.Get(0).Metadata().ID()
+
+	backupData, err := safe.ReaderGetByID[*omni.BackupData](ctx, st, cluster)
+	if err != nil {
+		return fmt.Errorf("error getting backup data: %w", err)
+	}
+
+	backupStore, err := etcdBackupStoreFactory.GetStore()
+	if err != nil {
+		return fmt.Errorf("error getting etcd backup store: %w", err)
+	}
+
+	data, readCloser, err := backupStore.Download(ctx, backupData.TypedSpec().Value.EncryptionKey, bootstrapSpec.ClusterUuid, bootstrapSpec.Snapshot)
+	if err != nil {
+		return fmt.Errorf("failed to get backup: %w", err)
+	}
+
+	readCloser.Close() //nolint:errcheck
+
+	if data.AESCBCEncryptionSecret != backupData.TypedSpec().Value.AesCbcEncryptionSecret {
+		return errors.New("aes cbc encryption secret mismatch")
+	}
+
+	if data.SecretboxEncryptionSecret != backupData.TypedSpec().Value.SecretboxEncryptionSecret {
+		return errors.New("secretbox encryption secret mismatch")
+	}
+
+	return nil
+}
+
+// machineSetNodeValidationOptions returns the validation options for the machine set node resource.
+//
+//nolint:gocognit
+func machineSetNodeValidationOptions(st state.State) []validated.StateOption {
+	getMachineSet := func(ctx context.Context, res *omni.MachineSetNode) (*omni.MachineSet, error) {
+		machineSetName, ok := res.Metadata().Labels().Get(omni.LabelMachineSet)
+		if !ok {
+			return nil, nil //nolint:nilnil
+		}
+
+		machineSet, err := safe.ReaderGet[*omni.MachineSet](ctx, st, omni.NewMachineSet(resources.DefaultNamespace, machineSetName).Metadata())
+		if err != nil {
+			if state.IsNotFoundError(err) {
+				return nil, nil //nolint:nilnil
+			}
+
+			return nil, err
+		}
+
+		return machineSet, nil
+	}
+
+	return []validated.StateOption{
+		validated.WithCreateValidations(validated.NewCreateValidationForType(func(ctx context.Context, res *omni.MachineSetNode, _ ...state.CreateOption) error {
+			machineSet, err := getMachineSet(ctx, res)
+			if err != nil {
+				return err
+			}
+
+			if machineSet != nil && machineSet.Metadata().Phase() == resource.PhaseTearingDown {
+				return fmt.Errorf("the machine set %q is tearing down", machineSet.Metadata().ID())
+			}
+
+			if machineSet != nil && machineSet.TypedSpec().Value.MachineClass != nil {
+				return fmt.Errorf("adding machine set node to the machine set %q is not allowed: the machine set is using machine classes", machineSet.Metadata().ID())
+			}
+
+			return validateNotControlplane(machineSet, res)
+		})),
+		validated.WithUpdateValidations(validated.NewUpdateValidationForType(func(ctx context.Context, res *omni.MachineSetNode, newRes *omni.MachineSetNode, _ ...state.UpdateOption) error {
+			// don't allow tearing down machine set nodes with locked annotation
+			if newRes.Metadata().Phase() == resource.PhaseTearingDown {
+				if _, locked := res.Metadata().Annotations().Get(omni.MachineLocked); locked {
+					return errors.New("machine set node is locked")
+				}
+			}
+
+			machineSet, err := getMachineSet(ctx, res)
+			if err != nil {
+				return err
+			}
+
+			return validateNotControlplane(machineSet, newRes)
+		})),
+		validated.WithDestroyValidations(validated.NewDestroyValidationForType(func(ctx context.Context, _ resource.Pointer, res *omni.MachineSetNode, _ ...state.DestroyOption) error {
+			machineSetName, ok := res.Metadata().Labels().Get(omni.LabelMachineSet)
+			if ok {
+				machineSet, err := safe.StateGet[*omni.MachineSet](ctx, st, omni.NewMachineSet(resources.DefaultNamespace, machineSetName).Metadata())
+				if err != nil && !state.IsNotFoundError(err) {
+					return err
+				}
+
+				// if the machine set is being torn down or doesn't exist disable machine locks
+				if machineSet == nil || machineSet.Metadata().Phase() == resource.PhaseTearingDown {
+					return nil
+				}
+			}
+
+			if _, locked := res.Metadata().Annotations().Get(omni.MachineLocked); locked {
+				return errors.New("machine set node is locked")
+			}
+
+			return nil
+		})),
+	}
+}
+
+func schematicConfigurationValidationOptions() []validated.StateOption {
+	return []validated.StateOption{
+		validated.WithCreateValidations(validated.NewCreateValidationForType(
+			func(_ context.Context, res *omni.SchematicConfiguration, _ ...state.CreateOption) error {
+				return validateSchematicConfiguration(res)
+			},
+		)),
+		validated.WithUpdateValidations(validated.NewUpdateValidationForType(
+			func(_ context.Context, _, res *omni.SchematicConfiguration, _ ...state.UpdateOption) error {
+				return validateSchematicConfiguration(res)
+			},
+		)),
+	}
+}
+
+func hasUppercaseLetters(s string) bool {
+	for _, r := range s {
+		if unicode.IsUpper(r) && unicode.IsLetter(r) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func identityValidationOptions() []validated.StateOption {
+	return []validated.StateOption{
+		validated.WithCreateValidations(validated.NewCreateValidationForType(func(_ context.Context, res *authres.Identity, _ ...state.CreateOption) error {
+			if hasUppercaseLetters(res.Metadata().ID()) {
+				return errors.New("identity id must be lowercase")
+			}
+
+			return nil
+		})),
+		validated.WithUpdateValidations(validated.NewUpdateValidationForType(func(ctx context.Context, res *authres.Identity, newRes *authres.Identity, _ ...state.UpdateOption) error {
+			if !config.Config.Auth.SAML.Enabled || actor.ContextIsInternalActor(ctx) {
+				return nil
+			}
+
+			changed := newRes.TypedSpec().Value.UserId != res.TypedSpec().Value.UserId ||
+				!newRes.Metadata().Labels().Equal(*res.Metadata().Labels()) ||
+				!newRes.Metadata().Annotations().Equal(*res.Metadata().Annotations())
+
+			if changed {
+				return errors.New("updating identity is not allowed in SAML mode")
+			}
+
+			return nil
+		})),
+	}
+}
+
+func exposedServiceValidationOptions() []validated.StateOption {
+	return []validated.StateOption{
+		validated.WithCreateValidations(validated.NewCreateValidationForType(func(_ context.Context, res *omni.ExposedService, _ ...state.CreateOption) error {
+			alias, _ := res.Metadata().Labels().Get(omni.LabelExposedServiceAlias)
+			if alias == "" {
+				return errors.New("alias must be set")
+			}
+
+			return nil
+		})),
+		validated.WithUpdateValidations(validated.NewUpdateValidationForType(func(_ context.Context, res *omni.ExposedService, newRes *omni.ExposedService, _ ...state.UpdateOption) error {
+			oldAlias, _ := res.Metadata().Labels().Get(omni.LabelExposedServiceAlias)
+			newAlias, _ := newRes.Metadata().Labels().Get(omni.LabelExposedServiceAlias)
+
+			if oldAlias != newAlias {
+				return errors.New("alias cannot be changed")
+			}
+
+			return nil
+		})),
+	}
+}
+
+func configPatchValidationOptions(st state.State) []validated.StateOption {
+	return []validated.StateOption{
+		validated.WithCreateValidations(validated.NewCreateValidationForType(func(ctx context.Context, res *omni.ConfigPatch, _ ...state.CreateOption) error {
+			if clusterName, ok := res.Metadata().Labels().Get(omni.LabelCluster); ok {
+				cluster, err := safe.StateGetByID[*omni.Cluster](ctx, st, clusterName)
+				if err != nil && !state.IsNotFoundError(err) {
+					return err
+				}
+
+				if cluster != nil && cluster.Metadata().Phase() == resource.PhaseTearingDown {
+					return fmt.Errorf("cluster %q is tearing down", clusterName)
+				}
+			}
+
+			if machineSetName, ok := res.Metadata().Labels().Get(omni.LabelMachineSet); ok {
+				machineSet, err := safe.StateGetByID[*omni.MachineSet](ctx, st, machineSetName)
+				if err != nil && !state.IsNotFoundError(err) {
+					return err
+				}
+
+				if machineSet != nil && machineSet.Metadata().Phase() == resource.PhaseTearingDown {
+					return fmt.Errorf("machine set %q is tearing down", machineSetName)
+				}
+			}
+
+			return omni.ValidateConfigPatch(res.TypedSpec().Value.GetData())
+		})),
+		validated.WithUpdateValidations(validated.NewUpdateValidationForType(func(_ context.Context, oldRes *omni.ConfigPatch, newRes *omni.ConfigPatch, _ ...state.UpdateOption) error {
+			// keep the old config patch if the data is the same for backwards-compatibility and for teardown cases
+			if oldRes.TypedSpec().Value.Data == newRes.TypedSpec().Value.Data {
+				return nil
+			}
+
+			return omni.ValidateConfigPatch(newRes.TypedSpec().Value.GetData())
+		})),
+	}
+}
+
+func validateNotControlplane(machineSet *omni.MachineSet, res *omni.MachineSetNode) error {
+	if _, locked := res.Metadata().Annotations().Get(omni.MachineLocked); !locked {
+		return nil
+	}
+
+	if machineSet == nil {
+		return nil
+	}
+
+	if _, cp := machineSet.Metadata().Labels().Get(omni.LabelControlPlaneRole); cp {
+		return errors.New("locking controlplanes is not allowed")
+	}
+
+	return nil
+}
+
+func etcdManualBackupValidationOptions() []validated.StateOption {
+	return []validated.StateOption{
+		validated.WithCreateValidations(validated.NewCreateValidationForType(func(_ context.Context, res *omni.EtcdManualBackup, _ ...state.CreateOption) error {
+			return validateManualBackup(res.TypedSpec())
+		})),
+		validated.WithUpdateValidations(validated.NewUpdateValidationForType(func(_ context.Context, oldRes *omni.EtcdManualBackup, newRes *omni.EtcdManualBackup, _ ...state.UpdateOption) error {
+			if oldRes == nil {
+				return nil
+			}
+
+			if oldRes.TypedSpec().Value.BackupAt.AsTime().Equal(newRes.TypedSpec().Value.BackupAt.AsTime()) {
+				return nil
+			}
+
+			return validateManualBackup(newRes.TypedSpec())
+		})),
+	}
+}
+
+// TODO: maybe move the role validation into roleValidationOptions and create a "matchLabelsValidationOptions" function.
+func samlLabelRuleValidationOptions() []validated.StateOption {
+	validate := func(res *authres.SAMLLabelRule) error {
+		var multiErr error
+
+		if _, err := role.Parse(res.TypedSpec().Value.GetAssignRoleOnRegistration()); err != nil {
+			multiErr = multierror.Append(multiErr, err)
+		}
+
+		if _, err := labels.ParseSelectors(res.TypedSpec().Value.GetMatchLabels()); err != nil {
+			multiErr = multierror.Append(multiErr, fmt.Errorf("invalid match labels: %w", err))
+		}
+
+		return multiErr
+	}
+
+	return []validated.StateOption{
+		validated.WithCreateValidations(validated.NewCreateValidationForType(func(_ context.Context, res *authres.SAMLLabelRule, _ ...state.CreateOption) error {
+			return validate(res)
+		})),
+		validated.WithUpdateValidations(validated.NewUpdateValidationForType(func(_ context.Context, _ *authres.SAMLLabelRule, newRes *authres.SAMLLabelRule, _ ...state.UpdateOption) error {
+			return validate(newRes)
+		})),
+	}
+}
+
+func validateManualBackup(embs *omni.EtcdManualBackupSpec) error {
+	backupAt := embs.Value.GetBackupAt().AsTime()
+
+	if time.Since(backupAt) > time.Minute {
+		return errors.New("backup time must not be more than 1 minute in the past")
+	} else if time.Until(backupAt) > time.Minute {
+		return errors.New("backup time must not be more than 1 minute in the future")
+	}
+
+	return nil
+}
+
+func s3ConfigValidationOptions() []validated.StateOption {
+	return []validated.StateOption{
+		validated.WithCreateValidations(validated.NewCreateValidationForType(func(ctx context.Context, res *omni.EtcdBackupS3Conf, _ ...state.CreateOption) error {
+			return validateS3Configuration(ctx, res)
+		})),
+		validated.WithUpdateValidations(validated.NewUpdateValidationForType(func(ctx context.Context, _ *omni.EtcdBackupS3Conf, newRes *omni.EtcdBackupS3Conf, _ ...state.UpdateOption) error {
+			return validateS3Configuration(ctx, newRes)
+		})),
+	}
+}
+
+func validateS3Configuration(ctx context.Context, s3Conf *omni.EtcdBackupS3Conf) error {
+	if store.IsEmptyS3Conf(s3Conf) {
+		return nil
+	}
+
+	_, _, err := store.S3ClientFromResource(ctx, s3Conf)
+	if err != nil {
+		return fmt.Errorf("incorrect settings for s3 client: %w", err)
+	}
+
+	return nil
+}
+
+func validateSchematicConfiguration(schematicConfiguration *omni.SchematicConfiguration) error {
+	if schematicConfiguration.TypedSpec().Value.Target == specs.SchematicConfigurationSpec_Unknown {
+		return fmt.Errorf("schematic configuration target field can not be empty")
+	}
+
+	if schematicConfiguration.TypedSpec().Value.SchematicId == "" {
+		return fmt.Errorf("schematic ID can not be empty")
+	}
+
+	return nil
+}
diff --git a/internal/backend/runtime/omni/state_validation_test.go b/internal/backend/runtime/omni/state_validation_test.go
new file mode 100644
index 000000000..9dd98ab14
--- /dev/null
+++ b/internal/backend/runtime/omni/state_validation_test.go
@@ -0,0 +1,826 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package omni_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	omnires "github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni/etcdbackup/store"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/validated"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+func TestClusterValidation(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	talos15 := "1.5.0"
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+	st := validated.NewState(innerSt, omni.ClusterVersionValidationOptions(state.WrapCore(innerSt))...)
+
+	talosVersion1 := omnires.NewTalosVersion(resources.DefaultNamespace, "1.4.0")
+	talosVersion1.TypedSpec().Value.CompatibleKubernetesVersions = []string{"1.27.0", "1.27.1"}
+
+	talosVersion2 := omnires.NewTalosVersion(resources.DefaultNamespace, talos15)
+	talosVersion2.TypedSpec().Value.CompatibleKubernetesVersions = []string{"1.28.0", "1.28.1"}
+
+	require.NoError(t, st.Create(ctx, talosVersion1))
+	require.NoError(t, st.Create(ctx, talosVersion2))
+
+	cluster := omnires.NewCluster(resources.DefaultNamespace, "test")
+
+	// create
+	err := st.Create(ctx, cluster)
+
+	require.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, "invalid talos version")
+
+	cluster.TypedSpec().Value.TalosVersion = "1.4.0"
+	cluster.TypedSpec().Value.KubernetesVersion = "1.26.0"
+
+	err = st.Create(ctx, cluster)
+	require.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, "invalid kubernetes version")
+
+	cluster.TypedSpec().Value.KubernetesVersion = "1.27.0"
+
+	require.NoError(t, st.Create(ctx, cluster))
+
+	// update
+	cluster.TypedSpec().Value.TalosVersion = talos15
+	cluster.TypedSpec().Value.KubernetesVersion = "1.27.1"
+
+	// incompatible update
+	err = st.Update(ctx, cluster)
+	require.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, "invalid kubernetes version")
+
+	cluster.TypedSpec().Value.TalosVersion = talos15
+	cluster.TypedSpec().Value.KubernetesVersion = "1.27.0"
+
+	// incompatible update, but because the kubernetes version did not change, it's allowed
+	require.NoError(t, st.Update(ctx, cluster))
+
+	cluster.TypedSpec().Value.TalosVersion = "invalid"
+
+	require.NoError(t, innerSt.Update(ctx, cluster))
+
+	// invalid Talos version, but because it did not change, it's allowed
+
+	cluster.TypedSpec().Value.KubernetesVersion = "1.28.0"
+
+	require.NoError(t, st.Update(ctx, cluster))
+
+	// try to enable encryption
+	cluster.TypedSpec().Value.Features = &specs.ClusterSpec_Features{
+		DiskEncryption: true,
+	}
+
+	err = st.Update(ctx, cluster)
+	require.True(t, validated.IsValidationError(err), "expected validation error")
+
+	cluster = omnires.NewCluster(resources.DefaultNamespace, "encryption")
+	cluster.TypedSpec().Value.TalosVersion = "1.4.7"
+	cluster.TypedSpec().Value.KubernetesVersion = "1.27.1"
+	cluster.TypedSpec().Value.Features = &specs.ClusterSpec_Features{
+		DiskEncryption: true,
+	}
+
+	err = st.Create(ctx, cluster)
+
+	require.True(t, validated.IsValidationError(err), "expected validation error")
+
+	cluster.TypedSpec().Value.TalosVersion = talos15
+	cluster.TypedSpec().Value.KubernetesVersion = "1.28.1"
+
+	require.NoError(t, st.Create(ctx, cluster))
+}
+
+func TestRelationLabelsValidation(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+	st := validated.NewState(innerSt, omni.RelationLabelsValidationOptions()...)
+
+	// MachineSet -> Cluster
+
+	machineSet := omnires.NewMachineSet(resources.DefaultNamespace, "test-machine-set")
+
+	err := st.Create(ctx, machineSet)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, fmt.Sprintf(`label "%s" does not exist`, omnires.LabelCluster))
+
+	machineSet.Metadata().Labels().Set(omnires.LabelCluster, "test-cluster")
+
+	assert.NoError(t, st.Create(ctx, machineSet))
+
+	machineSet.Metadata().Labels().Delete(omnires.LabelCluster)
+
+	err = st.Update(ctx, machineSet)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, fmt.Sprintf(`label "%s" does not exist`, omnires.LabelCluster))
+
+	machineSet.Metadata().Labels().Set(omnires.LabelCluster, "test-cluster")
+
+	// MachineSetNode -> MachineSet
+
+	machineSetNode := omnires.NewMachineSetNode(resources.DefaultNamespace, "test-machine-set", machineSet)
+
+	machineSetNode.Metadata().Labels().Delete(omnires.LabelMachineSet)
+
+	err = st.Create(ctx, machineSetNode)
+
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, fmt.Sprintf(`label "%s" does not exist`, omnires.LabelMachineSet))
+
+	machineSetNode.Metadata().Labels().Set(omnires.LabelMachineSet, "test-machine-set")
+
+	assert.NoError(t, st.Create(ctx, machineSetNode))
+
+	machineSetNode.Metadata().Labels().Delete(omnires.LabelMachineSet)
+
+	err = st.Update(ctx, machineSetNode)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, fmt.Sprintf(`label "%s" does not exist`, omnires.LabelMachineSet))
+}
+
+func TestMachineSetValidation(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	etcdBackupStoreFactory, err := store.NewStoreFactory()
+	require.NoError(t, err)
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+	st := validated.NewState(innerSt, omni.MachineSetValidationOptions(innerSt, etcdBackupStoreFactory)...)
+
+	machineSet1 := omnires.NewMachineSet(resources.DefaultNamespace, "test-cluster-wrong-suffix")
+
+	require.NoError(t, st.Create(ctx, omnires.NewCluster(resources.DefaultNamespace, "test-cluster")))
+
+	// no cluster label
+
+	err = st.Create(ctx, machineSet1)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, "cluster label is missing")
+
+	machineSet1.Metadata().Labels().Set(omnires.LabelCluster, "test-cluster")
+
+	// no role label
+
+	err = st.Create(ctx, machineSet1)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, "machine set must have either")
+
+	machineSet1.Metadata().Labels().Set(omnires.LabelControlPlaneRole, "")
+	machineSet1.Metadata().Labels().Set(omnires.LabelCluster, "wrong-cluster")
+
+	// machine set with a wrong prefix
+
+	err = st.Create(ctx, machineSet1)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, `machine set of cluster "wrong-cluster" ID must have "wrong-cluster-" as prefix`)
+
+	machineSet1.Metadata().Labels().Set(omnires.LabelCluster, "test-cluster")
+
+	// control plane machine set with wrong id
+
+	err = st.Create(ctx, machineSet1)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, "control plane machine set must have ID")
+
+	// control plane machine set with correct id on already bootstrapped cluster
+
+	status := omnires.NewClusterBootstrapStatus(resources.DefaultNamespace, "test-cluster")
+
+	status.TypedSpec().Value.Bootstrapped = true
+
+	require.NoError(t, st.Create(ctx, status))
+
+	machineSet2 := omnires.NewMachineSet(resources.DefaultNamespace, "test-cluster-control-planes")
+
+	machineSet2.Metadata().Labels().Set(omnires.LabelControlPlaneRole, "")
+	machineSet2.Metadata().Labels().Set(omnires.LabelCluster, "test-cluster")
+
+	err = st.Create(ctx, machineSet2)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, "adding control plane machine set to an already bootstrapped cluster is not allowed")
+
+	require.NoError(t, st.Destroy(ctx, status.Metadata()))
+
+	// control plane machine set with correct id
+
+	err = st.Create(ctx, machineSet2)
+	assert.NoError(t, err)
+
+	// worker machine set with id reserved for control plane
+
+	machineSet3 := omnires.NewMachineSet(resources.DefaultNamespace, "test-cluster-control-planes")
+
+	machineSet3.Metadata().Labels().Set(omnires.LabelCluster, "test-cluster")
+	machineSet3.Metadata().Labels().Set(omnires.LabelWorkerRole, "")
+
+	err = st.Create(ctx, machineSet3)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, "worker machine set must not have ID")
+
+	// no cluster exists
+
+	machineSet4 := omnires.NewMachineSet(resources.DefaultNamespace, "test-cluster-tearing-down-control-planes")
+	machineSet4.Metadata().Labels().Set(omnires.LabelCluster, "test-cluster-tearing-down")
+	machineSet4.Metadata().Labels().Set(omnires.LabelControlPlaneRole, "")
+
+	// cluster exists and is tearing down
+
+	require.NoError(t, st.Create(ctx, omnires.NewCluster(resources.DefaultNamespace, "test-cluster-tearing-down")))
+	_, err = state.WrapCore(st).Teardown(ctx, omnires.NewCluster(resources.DefaultNamespace, "test-cluster-tearing-down").Metadata())
+	require.NoError(t, err)
+
+	err = st.Create(ctx, machineSet4)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, "tearing down")
+}
+
+func TestMachineSetBootstrapSpecValidation(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	clusterID := "test-cluster"
+	aesCBCSecret := "aes-cbc-secret"
+	secretboxEncryptionSecret := "secretbox-secret"
+	clusterUUID := "70fcf307-f9be-40dc-81de-6a427adfc1d4"
+	snapshotName := "test-snapshot"
+
+	etcdBackupStoreFactory := mockEtcdBackupStoreFactory{
+		store: &mockEtcdBackupStore{
+			clusterUUID:  clusterUUID,
+			snapshotName: snapshotName,
+			backupData: etcdbackup.BackupData{
+				AESCBCEncryptionSecret:    aesCBCSecret,
+				SecretboxEncryptionSecret: secretboxEncryptionSecret,
+			},
+		},
+	}
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+	st := validated.NewState(innerSt, omni.MachineSetValidationOptions(innerSt, &etcdBackupStoreFactory)...)
+
+	cluster := omnires.NewCluster(resources.DefaultNamespace, clusterID)
+
+	require.NoError(t, st.Create(ctx, cluster))
+
+	// worker machine set with bootstrap spec - not allowed
+
+	workerMachineSet := omnires.NewMachineSet(resources.DefaultNamespace, omnires.WorkersResourceID(clusterID))
+
+	workerMachineSet.Metadata().Labels().Set(omnires.LabelCluster, clusterID)
+	workerMachineSet.Metadata().Labels().Set(omnires.LabelWorkerRole, "")
+
+	workerMachineSet.TypedSpec().Value.BootstrapSpec = &specs.MachineSetSpec_BootstrapSpec{
+		ClusterUuid: clusterUUID,
+		Snapshot:    snapshotName,
+	}
+
+	err := st.Create(ctx, workerMachineSet)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, "bootstrap spec is not allowed for worker machine sets")
+
+	// cluster UUID mismatch
+
+	clusterUUIDRes := omnires.NewClusterUUID(clusterID)
+	clusterUUIDRes.TypedSpec().Value.Uuid = clusterUUID
+
+	clusterUUIDRes.Metadata().Labels().Set(omnires.LabelClusterUUID, clusterUUID)
+
+	require.NoError(t, st.Create(ctx, clusterUUIDRes))
+
+	backupData := omnires.NewBackupData(clusterID)
+	backupData.TypedSpec().Value.AesCbcEncryptionSecret = "wrong-aes-cbc-secret"
+	backupData.TypedSpec().Value.SecretboxEncryptionSecret = "wrong-secretbox-secret"
+	backupData.TypedSpec().Value.EncryptionKey = []byte("wvd90ml3i7z9td0g2skir9mym6ax4zoz")
+
+	require.NoError(t, st.Create(ctx, backupData))
+
+	controlPlaneMachineSet := omnires.NewMachineSet(resources.DefaultNamespace, omnires.ControlPlanesResourceID(clusterID))
+
+	controlPlaneMachineSet.Metadata().Labels().Set(omnires.LabelControlPlaneRole, "")
+	controlPlaneMachineSet.Metadata().Labels().Set(omnires.LabelCluster, clusterID)
+
+	// non-existent snapshot
+
+	controlPlaneMachineSet.TypedSpec().Value.BootstrapSpec = &specs.MachineSetSpec_BootstrapSpec{
+		ClusterUuid: clusterUUID,
+		Snapshot:    "wrong-snapshot-name",
+	}
+
+	err = st.Create(ctx, controlPlaneMachineSet)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, "not found")
+
+	// aes cbc encryption secret mismatch
+
+	controlPlaneMachineSet.TypedSpec().Value.BootstrapSpec = &specs.MachineSetSpec_BootstrapSpec{
+		ClusterUuid: clusterUUID,
+		Snapshot:    snapshotName,
+	}
+
+	err = st.Create(ctx, controlPlaneMachineSet)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, "aes cbc encryption secret mismatch")
+
+	// secretbox encryption secret mismatch
+
+	backupData.TypedSpec().Value.AesCbcEncryptionSecret = aesCBCSecret
+
+	require.NoError(t, st.Update(ctx, backupData))
+
+	err = st.Create(ctx, controlPlaneMachineSet)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, "secretbox encryption secret mismatch")
+
+	// success
+
+	backupData.TypedSpec().Value.SecretboxEncryptionSecret = secretboxEncryptionSecret
+
+	require.NoError(t, st.Update(ctx, backupData))
+
+	assert.NoError(t, st.Create(ctx, controlPlaneMachineSet))
+
+	// update bootstrap spec, which is immutable
+
+	controlPlaneMachineSet.TypedSpec().Value.BootstrapSpec = &specs.MachineSetSpec_BootstrapSpec{
+		ClusterUuid: clusterUUID,
+		Snapshot:    "different",
+	}
+
+	err = st.Update(ctx, controlPlaneMachineSet)
+	assert.True(t, validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(t, err, "bootstrap spec is immutable after creation")
+}
+
+func TestMachineSetLockedAnnotation(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+	st := validated.NewState(innerSt, omni.MachineSetNodeValidationOptions(state.WrapCore(innerSt))...)
+
+	machineSet := omnires.NewMachineSet(resources.DefaultNamespace, "test-machine-set")
+	machineSetNode := omnires.NewMachineSetNode(resources.DefaultNamespace, "test-machine-set", machineSet)
+
+	machineSetNode.Metadata().Annotations().Set(omnires.MachineLocked, "")
+
+	assert := assert.New(t)
+
+	assert.NoError(st.Create(ctx, machineSetNode))
+	assert.NoError(st.Create(ctx, machineSet))
+
+	err := st.Destroy(ctx, machineSetNode.Metadata())
+	assert.Error(err)
+	assert.True(validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(err, "machine set node is locked")
+
+	s := state.WrapCore(st)
+
+	_, err = s.Teardown(ctx, machineSetNode.Metadata())
+	assert.Error(err)
+	assert.True(validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(err, "machine set node is locked")
+
+	machineSet.Metadata().Labels().Set(omnires.LabelControlPlaneRole, "")
+	assert.NoError(st.Update(ctx, machineSet))
+
+	machineSetNode = omnires.NewMachineSetNode(resources.DefaultNamespace, "test-machine-set-1", machineSet)
+	assert.NoError(st.Create(ctx, machineSetNode))
+
+	_, err = safe.StateUpdateWithConflicts(ctx, s, machineSetNode.Metadata(), func(n *omnires.MachineSetNode) error {
+		n.Metadata().Annotations().Set(omnires.MachineLocked, "")
+
+		return nil
+	})
+
+	assert.ErrorContains(err, "locking controlplanes is not allowed")
+
+	machineSetNode = omnires.NewMachineSetNode(resources.DefaultNamespace, "test-machine-set-2", machineSet)
+	machineSetNode.Metadata().Annotations().Set(omnires.MachineLocked, "")
+	assert.ErrorContains(st.Create(ctx, machineSetNode), "locking controlplanes is not allowed")
+}
+
+func TestIdentitySAML(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+	st := validated.NewState(innerSt, omni.IdentityValidationOptions()...)
+
+	user := auth.NewIdentity(resources.DefaultNamespace, "aaa")
+
+	assert := assert.New(t)
+
+	assert.NoError(st.Create(ctx, user))
+
+	config.Config = &config.Params{
+		Auth: config.AuthParams{
+			SAML: config.SAMLParams{
+				Enabled: true,
+			},
+		},
+	}
+
+	s := state.WrapCore(st)
+
+	checkError := func(err error) {
+		assert.Error(err)
+		assert.True(validated.IsValidationError(err), "expected validation error")
+		assert.ErrorContains(err, "updating identity is not allowed in SAML mode")
+	}
+
+	_, err := safe.StateUpdateWithConflicts(ctx, s, user.Metadata(), func(n *auth.Identity) error {
+		n.TypedSpec().Value.UserId = "bacd"
+
+		return nil
+	})
+
+	checkError(err)
+
+	_, err = safe.StateUpdateWithConflicts(ctx, s, user.Metadata(), func(n *auth.Identity) error {
+		n.Metadata().Labels().Set("label", "a")
+
+		return nil
+	})
+
+	checkError(err)
+
+	_, err = safe.StateUpdateWithConflicts(ctx, s, user.Metadata(), func(n *auth.Identity) error {
+		n.Metadata().Annotations().Set("key", "value")
+
+		return nil
+	})
+
+	checkError(err)
+
+	_, err = s.Teardown(ctx, user.Metadata())
+	assert.NoError(err)
+}
+
+func TestIdentityLowerCase(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+	st := validated.NewState(innerSt, omni.IdentityValidationOptions()...)
+
+	identity := auth.NewIdentity(resources.DefaultNamespace, "aaa")
+
+	assert := assert.New(t)
+
+	assert.NoError(st.Create(ctx, identity))
+
+	identity = auth.NewIdentity(resources.DefaultNamespace, "aaA")
+
+	err := st.Create(ctx, identity)
+
+	assert.Error(err)
+	assert.True(validated.IsValidationError(err), "expected validation error")
+	assert.ErrorContains(err, "identity id must be lowercase")
+}
+
+func TestExposedServiceAliasValidation(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+	st := validated.NewState(innerSt, omni.ExposedServiceValidationOptions()...)
+
+	exposedService := omnires.NewExposedService(resources.DefaultNamespace, "test-exposed-service")
+
+	err := st.Create(ctx, exposedService)
+
+	require.True(t, validated.IsValidationError(err), "expected validation error")
+	require.ErrorContains(t, err, "alias must be set")
+
+	exposedService.Metadata().Labels().Set(omnires.LabelExposedServiceAlias, "test-alias")
+
+	require.NoError(t, st.Create(ctx, exposedService))
+
+	exposedService.Metadata().Labels().Set(omnires.LabelExposedServiceAlias, "test-alias-updated")
+
+	err = st.Update(ctx, exposedService)
+
+	require.True(t, validated.IsValidationError(err), "expected validation error")
+	require.ErrorContains(t, err, "alias cannot be changed")
+
+	exposedService.Metadata().Labels().Set(omnires.LabelExposedServiceAlias, "test-alias")
+
+	exposedService.TypedSpec().Value.Port = 12345
+
+	require.NoError(t, st.Update(ctx, exposedService))
+}
+
+func TestConfigPatchValidation(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+	st := validated.NewState(innerSt, omni.ConfigPatchValidationOptions(innerSt)...)
+
+	configPatch := omnires.NewConfigPatch(resources.DefaultNamespace, "test-config-patch")
+
+	patchDataNotAllowed := strings.TrimSpace(`
+cluster:
+  clusterName: test-cluster-name
+`)
+
+	configPatch.TypedSpec().Value.Data = patchDataNotAllowed
+
+	err := st.Create(ctx, configPatch)
+	require.ErrorContains(t, err, "is not allowed in the config patch")
+
+	patchDataAllowed := strings.TrimSpace(`
+machine:
+  env:
+    bla: bla
+`)
+
+	configPatch.TypedSpec().Value.Data = patchDataAllowed
+
+	err = st.Create(ctx, configPatch)
+	require.NoError(t, err)
+
+	configPatch.TypedSpec().Value.Data = patchDataNotAllowed
+
+	err = st.Update(ctx, configPatch)
+	require.ErrorContains(t, err, "is not allowed in the config patch")
+
+	clusterID := "tearing-one"
+
+	cluster := omnires.NewCluster(resources.DefaultNamespace, clusterID)
+
+	require.NoError(t, st.Create(ctx, cluster))
+	_, err = innerSt.Teardown(ctx, cluster.Metadata())
+	require.NoError(t, err)
+
+	configPatch = omnires.NewConfigPatch(resources.DefaultNamespace, "another")
+	configPatch.Metadata().Labels().Set(omnires.LabelCluster, clusterID)
+
+	err = st.Create(ctx, configPatch)
+	require.ErrorContains(t, err, "tearing down")
+
+	msID := "machineset"
+
+	ms := omnires.NewMachineSet(resources.DefaultNamespace, msID)
+
+	require.NoError(t, st.Create(ctx, ms))
+	_, err = innerSt.Teardown(ctx, ms.Metadata())
+	require.NoError(t, err)
+
+	configPatch.Metadata().Labels().Set(omnires.LabelCluster, "some")
+	configPatch.Metadata().Labels().Set(omnires.LabelMachineSet, msID)
+
+	err = st.Create(ctx, configPatch)
+	require.ErrorContains(t, err, "tearing down")
+}
+
+func TestEtcdBackupValidation(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	st := validated.NewState(innerSt, omni.EtcdManualBackupValidationOptions()...)
+
+	backup := omnires.NewEtcdManualBackup("test-etcd-manual-backup")
+	backup.TypedSpec().Value.BackupAt = timestamppb.New(time.Now().Add(-time.Hour))
+
+	err := st.Create(ctx, backup)
+
+	require.True(t, validated.IsValidationError(err), "expected validation error")
+
+	backup.TypedSpec().Value.BackupAt = timestamppb.New(time.Now().Add(-30 * time.Second))
+
+	require.NoError(t, st.Create(ctx, backup))
+}
+
+func TestSAMLLabelRuleValidation(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+	st := validated.NewState(innerSt, omni.SAMLLabelRuleValidationOptions()...)
+
+	labelRule := auth.NewSAMLLabelRule(resources.DefaultNamespace, "test-label-rule")
+	labelRule.TypedSpec().Value.AssignRoleOnRegistration = "invalid"
+	labelRule.TypedSpec().Value.MatchLabels = []string{"--invalid--- ===== 5"}
+
+	err := st.Create(ctx, labelRule)
+	assert.ErrorContains(t, err, "unknown role")
+	assert.ErrorContains(t, err, "invalid match labels")
+
+	labelRule.TypedSpec().Value.AssignRoleOnRegistration = string(role.Operator)
+
+	err = st.Create(ctx, labelRule)
+	assert.ErrorContains(t, err, "invalid match labels")
+
+	labelRule.TypedSpec().Value.MatchLabels = []string{"a", "b"}
+
+	err = st.Create(ctx, labelRule)
+	assert.NoError(t, err)
+}
+
+func TestMachineSetClassesValidation(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	etcdBackupStoreFactory, err := store.NewStoreFactory()
+	require.NoError(t, err)
+
+	st := validated.NewState(innerSt,
+		append(
+			omni.MachineSetNodeValidationOptions(state.WrapCore(innerSt)),
+			omni.MachineSetValidationOptions(state.WrapCore(innerSt), etcdBackupStoreFactory)...,
+		)...,
+	)
+
+	require.NoError(t, st.Create(ctx, omnires.NewCluster(resources.DefaultNamespace, "test-cluster")))
+
+	machineSet := omnires.NewMachineSet(resources.DefaultNamespace, "test-cluster-control-planes")
+
+	machineSet.Metadata().Labels().Set(omnires.LabelCluster, "test-cluster")
+	machineSet.Metadata().Labels().Set(omnires.LabelControlPlaneRole, "")
+
+	machineSet.TypedSpec().Value.MachineClass = &specs.MachineSetSpec_MachineClass{}
+
+	err = st.Create(ctx, machineSet)
+
+	require.True(t, validated.IsValidationError(err), "expected validation error")
+
+	machineSet.TypedSpec().Value.MachineClass = &specs.MachineSetSpec_MachineClass{
+		Name: "none",
+	}
+
+	err = st.Create(ctx, machineSet)
+
+	require.True(t, validated.IsValidationError(err), "expected validation error")
+
+	machineClass := omnires.NewMachineClass(resources.DefaultNamespace, "test-class")
+
+	require.NoError(t, st.Create(ctx, machineClass))
+
+	machineSet.TypedSpec().Value.MachineClass = &specs.MachineSetSpec_MachineClass{
+		Name: machineClass.Metadata().ID(),
+	}
+
+	require.NoError(t, st.Create(ctx, machineSet))
+
+	machineSetNode := omnires.NewMachineSetNode(resources.DefaultNamespace, "machine", machineSet)
+
+	err = st.Create(ctx, machineSetNode)
+
+	require.True(t, validated.IsValidationError(err), "expected validation error")
+
+	machineSet.TypedSpec().Value.MachineClass.Name = "none"
+
+	err = st.Update(ctx, machineSet)
+
+	require.True(t, validated.IsValidationError(err), "expected validation error")
+
+	machineSet.TypedSpec().Value.MachineClass = nil
+
+	err = st.Update(ctx, machineSet)
+
+	require.True(t, validated.IsValidationError(err), "expected validation error")
+}
+
+func TestS3ConfigValidation(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	st := validated.NewState(innerSt, omni.S3ConfigValidationOptions()...)
+
+	res := omnires.NewEtcdBackupS3Conf()
+	res.TypedSpec().Value = &specs.EtcdBackupS3ConfSpec{}
+
+	require.NoError(t, st.Create(ctx, res))
+
+	res.TypedSpec().Value = &specs.EtcdBackupS3ConfSpec{
+		Bucket:          "",
+		Region:          "us-east-1",
+		Endpoint:        "http://localhost:27777",
+		AccessKeyId:     "access",
+		SecretAccessKey: "secret123",
+		SessionToken:    "",
+	}
+
+	require.True(t, validated.IsValidationError(st.Update(ctx, res)), "expected validation error")
+
+	res.TypedSpec().Value = &specs.EtcdBackupS3ConfSpec{
+		Bucket:          "temp-buclet",
+		Region:          "us-east-1",
+		Endpoint:        "http://localhost:27777",
+		AccessKeyId:     "",
+		SecretAccessKey: "secret123",
+		SessionToken:    "",
+	}
+
+	require.True(t, validated.IsValidationError(st.Update(ctx, res)), "expected validation error")
+
+	res.TypedSpec().Value = &specs.EtcdBackupS3ConfSpec{}
+
+	require.NoError(t, st.Update(ctx, res))
+}
+
+func TestSchematicConfigurationValidation(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	st := validated.NewState(innerSt, omni.SchematicConfigurationValidationOptions()...)
+
+	res := omnires.NewSchematicConfiguration(resources.DefaultNamespace, "test")
+
+	require.True(t, validated.IsValidationError(st.Create(ctx, res)), "expected validation error")
+
+	res.TypedSpec().Value.Target = specs.SchematicConfigurationSpec_ClusterMachine
+
+	require.True(t, validated.IsValidationError(st.Create(ctx, res)), "expected validation error")
+
+	res.TypedSpec().Value.SchematicId = "abab"
+
+	require.NoError(t, st.Create(ctx, res))
+
+	res.TypedSpec().Value.Target = specs.SchematicConfigurationSpec_Unknown
+
+	require.True(t, validated.IsValidationError(st.Update(ctx, res)), "expected validation error")
+
+	res.TypedSpec().Value.Target = specs.SchematicConfigurationSpec_MachineSet
+
+	require.NoError(t, st.Update(ctx, res))
+}
+
+type mockEtcdBackupStoreFactory struct {
+	store etcdbackup.Store
+}
+
+func (m *mockEtcdBackupStoreFactory) GetStore() (etcdbackup.Store, error) {
+	return m.store, nil
+}
+
+func (m *mockEtcdBackupStoreFactory) Start(context.Context, state.State, *zap.Logger) error {
+	return nil
+}
+
+func (m *mockEtcdBackupStoreFactory) Description() string { return "mock" }
+
+type mockEtcdBackupStore struct {
+	backupData   etcdbackup.BackupData
+	clusterUUID  string
+	snapshotName string
+}
+
+func (m *mockEtcdBackupStore) ListBackups(context.Context, string) (etcdbackup.InfoIterator, error) {
+	return nil, nil
+}
+
+func (m *mockEtcdBackupStore) Upload(context.Context, etcdbackup.Description, io.Reader) error {
+	return nil
+}
+
+func (m *mockEtcdBackupStore) Download(_ context.Context, _ []byte, clusterUUID, snapshotName string) (etcdbackup.BackupData, io.ReadCloser, error) {
+	if m.clusterUUID == clusterUUID && m.snapshotName == snapshotName {
+		return m.backupData, io.NopCloser(strings.NewReader("test")), nil
+	}
+
+	return etcdbackup.BackupData{}, nil, errors.New("not found")
+}
diff --git a/internal/backend/runtime/omni/testdata/pgp/new_key.private b/internal/backend/runtime/omni/testdata/pgp/new_key.private
new file mode 100644
index 000000000..0a578788f
--- /dev/null
+++ b/internal/backend/runtime/omni/testdata/pgp/new_key.private
@@ -0,0 +1,106 @@
+-----BEGIN PGP PRIVATE KEY BLOCK-----
+
+lQcYBGM1pZcBEADpbAWrOBHK3WDzwoxAgrzcoMEG6YSvKraBV/622SVeiwTfiz1Z
+Bij62jCTXoU0m+FpKXahbcTpcNoF8DFGkCJO6bY66a5IqccgezfZt/augByWju/6
+9PJy9qCD5V//ASH+3Xh3gMyhnVOmkddAmfoGtgm8eE+bLTGW+2jQFh0blK0np5Ad
+ycWZJtKYWYrCV7KEUiaqfUgLFyyrc+ssIlqboLHHUtfsqZAUOYcSHv9DIvyVGNE8
+TOgir243KybNOUlbqmE+ubUQHKHOSWVAAP15XpgYPnZcJFlcBacbN+uY5SZ62sxl
+yNxrZ5wQepo+x5g9l8z9HbTKG7pVwgw4lz3r9msj5WRFhm/mqb123DB5yPwMZoI1
+hFTlE03Vma/kDZY0li8CCYE+kWTcy+GKt7biK74z83OUeTDeIwfLaj7VaRSDNelB
+xrooXMCrH2g8nSsFbkQ3mXjYnSYjTPXMAXeO8BFXMf68sjHsz49ychuY8A6QG7+8
+4nbsV0761w/kUdOF7BtmKcx0usXxYfTPW1YsCYbI/I2QecYxL4fXK07JtZi+DPGv
+lQZvSSN8FUMER154ABSwA8CGYIZKHVGw8ugkGg+YCLkE/MfmyDkuFWgzvmiI5Yv3
+hqUcDVSbfyJPxORjPaOyDe/5uM8u4mjJ/p7HEbR72piCrAA/fCnB2Wyt2QARAQAB
+AA/+NH+Q29Qxvj5hnJlkKWsuFnIKT+dr6eixoPAdT9sRSkz6hNuAafoWc+roU3DG
+BVHM1fXXIlH5oGY7BuxhbMUkjjqGu4PMqLeUm1PTOSKkttUF+P+/biIyuFQLQHbx
+iv0ie/usKTZ875lek79H2hX3c5R0JqEpiFVXCqXTSj+6/rXG5v0LDwQPLtWaNl0n
+NfP66MNAQoaIUkQ9Tfd1jFjSp59x9IpHmYj+aGoS3Kq/jwY6qD7rakRCznBF2d8Y
+7D3G57ivg+fJFw1Vf/uma8l9ONOjYgqEXM9pEKcN0TOXx6y8JZP5tifBmV91bIhi
+kh2aejnexwvsGiu30ithS8YKTQ6KqtQxD+YRafu/Isrv4+d5FMjKk3Z74s5E6L/4
+2t5D/whj9fRz6Khq1ryqgy5BPM5Dxnd3cwzfeMqK3MX5DF/eIW/NlC91IrypWjUY
+EH/qIejTulYh52XMtCzBv5bo3Rw7dy8GluOI3SM4dNG3aK2ml0dOzfN5R0dQ8bze
+rmU5jMPAydaf7hDDTWctmoml6BPDZnmvWnZTrxxPj9i87Y4B4vsg7JZ+lmxRSncN
+4m4OT+wbvN0BVf7ILu4wBwuUCwBByUOh+LSmUbx5mrZGfAziwQ/YuqpQ3aW2wYjc
+1HqXyuorXP5IzMcd1cjr9PfdhDfkIcbU3jLnpGYBFnsNan0IAPPco70DCNrYFMgs
+O+XYaOGoHwxrgJ4qXMkx7dQcyelkrNGnwzdfhKvoC5j2yNPNSAlQ5NVQqW2TlOmv
+ZdfDcqb+rIsaCnOelo0oejVQ34wzfgXT4i1jGmMkiNgBosSYi0Hek/bj0mXmAj35
+Isi0UmPub2mJ2Sh3oFXGoUWyCub8igxOl9LYdeQiZSawzaRr9sjFpbtPTurc/Qkn
+NUUqKYm5lAfdyVCUF+lAWEg5Z25vuj6paqpdYndhTdzWd06wyiiYGapwBGkgE+6A
+ZQpjGNCBRS4kxvyXg3q3WPNP5yXh5WqYTcHcce0AsL1CfNIQ8lihJNULFo59dOUO
+JiC2pkUIAPUKWqUyZfTDar9EjMb+43DfvUv/OrfvZeKXjD6Vl8VORgcFlTpnJOY9
+IWDQ+izitdUB+aHvV/RammOGcUounPkJnoSDQeI9kYKv+7Dskk3M5dw2JeWoIhJa
+dV9cwPzqD2Fng9nRYFH0QcoSEyp90RUKnUUXGshaLeR/hYrhjPKaIGgp+Z4t0Igw
+nLWxTL6HAbtvB9r4aHoP/ew59bdSpm8Ed2ptDwbyphr4vr09V/MWxCPA/byW/yzj
+vSAzBbfOSEDIDOZ0c3xXyh4xjyUB+2MNzzJ0ZLdf1qUCOXlDIBtSIeD8dg7HjrFS
+onLOcoSxS4I3i4IoGemBU8KcT03h3IUH/RelCDkdsU5iTA9UJ417C0yKY5O6bwLl
+Unm4U1TFlw01MS3/ALefZBT2YpDWUVT6WzzEuPcoydidSCfeFMESlEtcSaI0pGuO
+jlfKLHMVmEGA0rU1eBi0rhMS4pPZsQ1I6qJFS1kWdqkRQ1f01zlcgL4qs9AogpGn
+JyJADefnf0z7PTXalkGmBEVziKAodCNTSM/N/sTAbwjo9JSk8O8YlQSdkG5EW5O0
+KW84W+u9aVU2YmlPOzZyOPmnioMpOQOGboyfukXUBHWh+QO85lc6f7C4se+v9K1Z
+BkbA5UOhEcj4qE4DS65OMNpm2LGrnnoaJIdq8UUZ2QxuYJ0Azb6bmcOOGLQoQW5v
+dGhlciBLZXkgPGFub3RoZXJfa2V5QHNpZGVyb2xhYnMuY29tPokCVAQTAQoAPhYh
+BFhKrwVuGhJ4xHhFAI2M6ENbdIIABQJjNaWXAhsDBQkJZgGABQsJCAcCBhUKCQgL
+AgQWAgMBAh4BAheAAAoJEI2M6ENbdIIAw0sP/0rFU3yBounB5nRThKJQUu3sL3MA
+p2Pxynkd2D0ThRb6+Y3TslmP3VSSmNcfTGswyce9jWxK0XhB2ems8Tqxi6+zwzi7
+woc0M6h2Rp3JmuRuvQHD3oWSfC1vznQhSuY+IDghW/isbzKSo0+04olhdM0npyS+
+/E8fQ/S3WMuOQDZzxa6ayJHqutxlJ421VAHitpWmqqd0O1e7ACwofLh8sIUFHYPP
+4YYdo8iAEVj+tvvBROhnyhm4gQIsOH3+WIQcwS9DVgfvR6yhxAFvkhKRqts6tWPK
+DRECChAzLl4sGrk9vW9qPegjhqPjfPq0wxgVbA8wai0eBMB/67A2c89sZh0t8Qms
+eCVnnyIC1dwo/Mf6cZh9FBIsvZuUETG3lSE4FwS+gZ8W6CBPH8c5/Z/f6iGYHpiA
+i1FDFlOqUdq6QjDdrt2JzXe2j4Sjm1HqOkAzeWGufSAK7l2JpJ/1zVkiN8kh6ZXc
+QxPDRPiVMOfiVnwEuAIUyiKF1HCvyBIhdgEm4gAgVWHRGcm3xzgUFEKunzQO0C62
+eadMlukzHjHpXYIzeAchXCpvXU4/bMu6Y1tiyM1Qxyr1eNQi4s+ex4UEusmiMVYE
+/zCBXEve+bFv4Sv6ShTfe/flpdKY1fvyFD2YIxm/4ONA8C7KqCmkZARu981FZhPx
+PXDAQNId6UjCPFdunQcYBGM1pZcBEAC5r+Jw0qLEZ1LpihzYvVxSihbA6+g7w6Hc
+8tIIaO+QqGmDpb4buaZYiK7d9H4TEMOHT/rUs/SYGivQra6CdgWykoBQBPS7TLJw
+bWBNPsKe+sSQaBrevM5xm52fpcH0ZBDXuomug4VFG6co3YPhZLNhFSwCz0RJkU1F
+Xn7C/A36D040uYD4TuKZNWn1IM/uaLpjJ50qCshV6OBv9QpCvotrtOzUxAPwAf6N
+5Tn975B9URoSrs+bPa7rNgA2pl/dw6/046RhRtrNPMGCQt2fxXh3DE8S34SUrlYt
+s/YCByZ8q8S/zlIeTl2QWMuYO3Mzd+W8xmhVJmxTQcZFlPzVLm5aFrSCCiS7gkGk
+0tqeqM9gOO/B15DlafRlKX3/sugl3Vb43i6pjTyQ2LEAiTFMu3nfMk4WCxBYTu7W
+lMek/sFy8i8Q6WigFKxOu1krmAhcueyuGgDZM+b8CVAbMeSgy6yw8glnfFGEvwrT
+JfJO8B1pdNVcBavY8eWLKVYKPZPXhVkwvQEUuXOTpZnM9tuAWkfO5QUJo4C21+wy
+oUTGXvYnJMB6Ad7w1bltHPTL/YbvtZXFzMqFeek+KBx0Jew/hZP5u/OkQ3S91NFd
+Nao6+HFiuVinpl9emrZ0TgBHIFm0qgaCSlKO3UZ0CnqgRSSv9313ND2XD1Qd3KLY
+i/ZThHCb9QARAQABAA/9GBIIQQbVCa+5LEP2lFQLtTloVK7gBmtIPruNZYCw2Wgz
+cVjZaX+p5B0nyebpNvB74D0Kb2s6gEMYPe9dyVSiTXE3R+g0j1kUYoWTL8A8e15X
+f763CPuhqVF6X9kdaOBV3Jk2QtSSwJAinaYFdADZTfLwJxcWK5E12pGyzfTdnPZB
+9Yy8frO/JQwrBZcwzR9vVe4rLemC6bwL6Ad0Qo2vxhEIiFY2inS/ukYmO9hDuzL5
+tcVKbT3UQHJaGbt8fuNgmlauFtwX/fXrwcaIMy9me8wxLemipqFo03jaIY4qu4uK
+sDB/LaWL9GvGTKAcQWY/9jYkDTGzZiGHIbr8AWiI7lUG3V3EvfmCCSqqvlnNpM5I
+P/PWx11yU3ZFHYJs+liKVOdv62ofVwLW6e3VeuiX/nlMhCvxdbayPS5PkYhaefjE
+Di8/3eVOtF635Ho6mSswRf3i15xFWSFy977PvdmmWpZvcHsJ+dBPwXCkv0Fw4cMC
+2uEqrWv/7crj2PU3wrMmBhHHEd3umM/C+sNkhFJRvKatVfqCUHUc3Mt1KtXBdavW
+b+n4C2Gs+iHmqo6wA6dtsVzFV9Gunl7VPMOutSCo3Gdw6uFAdPoK3C2y6J1HXW84
+Uowr+apvmC1pjfHXd7aVo2wuP8v8rUcRvuZ0XQvtaXY5hSVTuO1CAeYJGGb+MXsI
+AMpMsye/19dfLRqkzKawl0aDKrra51qcj1UVQ0eMF2fFYDATCxGyET2gqGrJJAKu
+Eo3o/FL0J/qpNrToQDYSh7KpcphN/bJautSuhs4JeHnQRw/BrgotMNH16nLIfx5Y
+eZopo7WXBK3UFMsT4itiAkjrlsGn5kDypyrNbyTyc7kSJ7E9/3jX+mA1TXUdh31I
+Aolefown0NyvJo/AHahG3UqgUFHpvcsuWHbEsuZ9ozkxqygpTCmpnYJS06Idv4rq
+sTsYhQIw+9fA8574lxWJb2MD9a0EYoDNOwjXtcMoS+393BYor7Xpqmys12QfM0Hw
+7wDH+HSrAFRORujbMEFaf3cIAOr6RpYIRDFmlUoiiMg/s97pNz1LHhHxo9HzbrvU
+7eJgNYhPg3tK0ne8BbYDAiIw+I2VhqseWoqqH69GUdjo8krGqc24Ua5XvBYmM1zN
+5b+bot2QSdINpL3hfAMICuoWVGX9qOmvT2C0RcdE0mdImltPTxx2nmb10d/WnHr6
+2+Xt9C81xGOIoyi951nd7B8n4HmLIdL6+RK/g2sARffW+gTpfi9NvITj1HQFgWME
+GwIdDis6+lVfhbmFmPQpHgyH5K07qRS3kcJ9Q3APXH6EP0GbMyRTQqlmPp5gh71O
+iBZCHSGoBtUkypadxIihsx8nRXsps6wRFW1c3bFrbjtW0vMH/jVv+BXXc6UssbFG
+qe2OcpVCm5gWFBMyyjGlQQAoQ1li5FnQ+yrOUckpX3IAK2z1WupX5jfymbFYuzFy
+X9W+zL944eUC8Aqd7DpNrH4D8amgV1JOg9X1xHXC9yQ6mPbo+6IQT/J9AE3YMh+/
+1s1wp0F3+oC4h021V9e53Hwpb6k/XJ9AgBCmf/V3neXa9PghkIn5elFNlIq41jfm
+2vW1zhK48ydiEocaNJdDjSHovb46WMzovd3I61ibWmnquBMSQbuJH2dKmcrS9nYy
+RlyVxHBM3ISL73zztCiaaarDGKBysq6lR8fihael5wRZ3ibOEjlM4YAtHlBfGnOW
+24bLop+OcIkCPAQYAQoAJhYhBFhKrwVuGhJ4xHhFAI2M6ENbdIIABQJjNaWXAhsM
+BQkJZgGAAAoJEI2M6ENbdIIAAQMQAMgmfXK4qSDkTarLZPbxtY9UnwPCmaYqe19E
+hqxvucFxziIpAa9tgX2Lo5XoszETF6KrhbW+Pzv9YyyYLEFZ/tT4pVQRp6UBEEGr
+3LS+CYv8SXflVEJlFKw1eCdBtUrtkUcLjkYVlNGkxA9zHp6M9m116atFPMU16EXV
+JDzQWfdTSfR/uw6a4UnuUXhqGLml+yDItI0IhaU4yfGefNgPiVPF/Cmg8paE+gdy
++BpyymxjGbV66cAbQSUUKfh8uuUQFPePIk708n936YDZFGboff0TzFFjPH7VG6mr
+UoqS+pT9L6F780Uq+K1zuZaGhDg4DmfkXkQ2r0J/iDnt48ai4gwK7i7sr1UzMVbo
+R+fMxblrx898gmntXl/ETSvf9MFe5MJARtrS0YXjDHGC0HmmrHmNIx/1V/1Gglb8
+c1pjNK1Mk1Rx08OgnFarJWFuvcYIIOpX05fo2j40k42vnjCQuTiCaBf+WZqLYDvd
+IP0vxcXgPQpc58iT7y39ja9Ar6fKy1+RlfqlDx89qzLjMi5msmhxAMHi2LGez9Cs
+8Kv5l/g8tVfUeWZBJy+f65otQwAVN/oujNNiUdhbzL4dpVzpCt74VuHRIodyjBcE
+3k9KrnIXcSUjq60OCsDCY1qZWg9NCIDrSO0opj2EUz3UoTYcYyzaUR5siAAX2hGw
+L0FT29Ky
+=3nkk
+-----END PGP PRIVATE KEY BLOCK-----
diff --git a/internal/backend/runtime/omni/testdata/pgp/new_key.public b/internal/backend/runtime/omni/testdata/pgp/new_key.public
new file mode 100644
index 000000000..dd080acff
--- /dev/null
+++ b/internal/backend/runtime/omni/testdata/pgp/new_key.public
@@ -0,0 +1,52 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGM1pZcBEADpbAWrOBHK3WDzwoxAgrzcoMEG6YSvKraBV/622SVeiwTfiz1Z
+Bij62jCTXoU0m+FpKXahbcTpcNoF8DFGkCJO6bY66a5IqccgezfZt/augByWju/6
+9PJy9qCD5V//ASH+3Xh3gMyhnVOmkddAmfoGtgm8eE+bLTGW+2jQFh0blK0np5Ad
+ycWZJtKYWYrCV7KEUiaqfUgLFyyrc+ssIlqboLHHUtfsqZAUOYcSHv9DIvyVGNE8
+TOgir243KybNOUlbqmE+ubUQHKHOSWVAAP15XpgYPnZcJFlcBacbN+uY5SZ62sxl
+yNxrZ5wQepo+x5g9l8z9HbTKG7pVwgw4lz3r9msj5WRFhm/mqb123DB5yPwMZoI1
+hFTlE03Vma/kDZY0li8CCYE+kWTcy+GKt7biK74z83OUeTDeIwfLaj7VaRSDNelB
+xrooXMCrH2g8nSsFbkQ3mXjYnSYjTPXMAXeO8BFXMf68sjHsz49ychuY8A6QG7+8
+4nbsV0761w/kUdOF7BtmKcx0usXxYfTPW1YsCYbI/I2QecYxL4fXK07JtZi+DPGv
+lQZvSSN8FUMER154ABSwA8CGYIZKHVGw8ugkGg+YCLkE/MfmyDkuFWgzvmiI5Yv3
+hqUcDVSbfyJPxORjPaOyDe/5uM8u4mjJ/p7HEbR72piCrAA/fCnB2Wyt2QARAQAB
+tChBbm90aGVyIEtleSA8YW5vdGhlcl9rZXlAc2lkZXJvbGFicy5jb20+iQJUBBMB
+CgA+FiEEWEqvBW4aEnjEeEUAjYzoQ1t0ggAFAmM1pZcCGwMFCQlmAYAFCwkIBwIG
+FQoJCAsCBBYCAwECHgECF4AACgkQjYzoQ1t0ggDDSw//SsVTfIGi6cHmdFOEolBS
+7ewvcwCnY/HKeR3YPROFFvr5jdOyWY/dVJKY1x9MazDJx72NbErReEHZ6azxOrGL
+r7PDOLvChzQzqHZGncma5G69AcPehZJ8LW/OdCFK5j4gOCFb+KxvMpKjT7TiiWF0
+zSenJL78Tx9D9LdYy45ANnPFrprIkeq63GUnjbVUAeK2laaqp3Q7V7sALCh8uHyw
+hQUdg8/hhh2jyIARWP62+8FE6GfKGbiBAiw4ff5YhBzBL0NWB+9HrKHEAW+SEpGq
+2zq1Y8oNEQIKEDMuXiwauT29b2o96COGo+N8+rTDGBVsDzBqLR4EwH/rsDZzz2xm
+HS3xCax4JWefIgLV3Cj8x/pxmH0UEiy9m5QRMbeVITgXBL6BnxboIE8fxzn9n9/q
+IZgemICLUUMWU6pR2rpCMN2u3YnNd7aPhKObUeo6QDN5Ya59IAruXYmkn/XNWSI3
+ySHpldxDE8NE+JUw5+JWfAS4AhTKIoXUcK/IEiF2ASbiACBVYdEZybfHOBQUQq6f
+NA7QLrZ5p0yW6TMeMeldgjN4ByFcKm9dTj9sy7pjW2LIzVDHKvV41CLiz57HhQS6
+yaIxVgT/MIFcS975sW/hK/pKFN979+Wl0pjV+/IUPZgjGb/g40DwLsqoKaRkBG73
+zUVmE/E9cMBA0h3pSMI8V265Ag0EYzWllwEQALmv4nDSosRnUumKHNi9XFKKFsDr
+6DvDodzy0gho75CoaYOlvhu5pliIrt30fhMQw4dP+tSz9JgaK9CtroJ2BbKSgFAE
+9LtMsnBtYE0+wp76xJBoGt68znGbnZ+lwfRkENe6ia6DhUUbpyjdg+Fks2EVLALP
+REmRTUVefsL8DfoPTjS5gPhO4pk1afUgz+5oumMnnSoKyFXo4G/1CkK+i2u07NTE
+A/AB/o3lOf3vkH1RGhKuz5s9rus2ADamX93Dr/TjpGFG2s08wYJC3Z/FeHcMTxLf
+hJSuVi2z9gIHJnyrxL/OUh5OXZBYy5g7czN35bzGaFUmbFNBxkWU/NUubloWtIIK
+JLuCQaTS2p6oz2A478HXkOVp9GUpff+y6CXdVvjeLqmNPJDYsQCJMUy7ed8yThYL
+EFhO7taUx6T+wXLyLxDpaKAUrE67WSuYCFy57K4aANkz5vwJUBsx5KDLrLDyCWd8
+UYS/CtMl8k7wHWl01VwFq9jx5YspVgo9k9eFWTC9ARS5c5Olmcz224BaR87lBQmj
+gLbX7DKhRMZe9ickwHoB3vDVuW0c9Mv9hu+1lcXMyoV56T4oHHQl7D+Fk/m786RD
+dL3U0V01qjr4cWK5WKemX16atnROAEcgWbSqBoJKUo7dRnQKeqBFJK/3fXc0PZcP
+VB3cotiL9lOEcJv1ABEBAAGJAjwEGAEKACYWIQRYSq8FbhoSeMR4RQCNjOhDW3SC
+AAUCYzWllwIbDAUJCWYBgAAKCRCNjOhDW3SCAAEDEADIJn1yuKkg5E2qy2T28bWP
+VJ8DwpmmKntfRIasb7nBcc4iKQGvbYF9i6OV6LMxExeiq4W1vj87/WMsmCxBWf7U
++KVUEaelARBBq9y0vgmL/El35VRCZRSsNXgnQbVK7ZFHC45GFZTRpMQPcx6ejPZt
+demrRTzFNehF1SQ80Fn3U0n0f7sOmuFJ7lF4ahi5pfsgyLSNCIWlOMnxnnzYD4lT
+xfwpoPKWhPoHcvgacspsYxm1eunAG0ElFCn4fLrlEBT3jyJO9PJ/d+mA2RRm6H39
+E8xRYzx+1Rupq1KKkvqU/S+he/NFKvitc7mWhoQ4OA5n5F5ENq9Cf4g57ePGouIM
+Cu4u7K9VMzFW6EfnzMW5a8fPfIJp7V5fxE0r3/TBXuTCQEba0tGF4wxxgtB5pqx5
+jSMf9Vf9RoJW/HNaYzStTJNUcdPDoJxWqyVhbr3GCCDqV9OX6No+NJONr54wkLk4
+gmgX/lmai2A73SD9L8XF4D0KXOfIk+8t/Y2vQK+nystfkZX6pQ8fPasy4zIuZrJo
+cQDB4tixns/QrPCr+Zf4PLVX1HlmQScvn+uaLUMAFTf6LozTYlHYW8y+HaVc6Qre
++Fbh0SKHcowXBN5PSq5yF3ElI6utDgrAwmNamVoPTQiA60jtKKY9hFM91KE2HGMs
+2lEebIgAF9oRsC9BU9vSsg==
+=f37X
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/internal/backend/runtime/omni/testdata/pgp/old_key.private b/internal/backend/runtime/omni/testdata/pgp/old_key.private
new file mode 100644
index 000000000..1fefbc952
--- /dev/null
+++ b/internal/backend/runtime/omni/testdata/pgp/old_key.private
@@ -0,0 +1,106 @@
+-----BEGIN PGP PRIVATE KEY BLOCK-----
+
+lQcYBGMzVUsBEAC5Ioyi/Rs06GL3zeKVgmi9F8xF6yDjec+E83FFyUdO1xiZ4fDf
+WQhUKh5c4gJi1hoGOWPkFWsEx1sTPmZsAdYIHmOSt6qPGbdt22JnfGseYdTRpMmi
+blkcbvUm3uidghDd5HiacmhaZqh+5AjN0T61QVZfryo5gb9y5wMxCVp2d8t5PG1/
+ULosQ6WfhQhCkyzF1eiuLyxfCToyYUhRRhveRsitrNnpAaNBjOvtG9ujdRz3EPsn
+q0kcwDscqqUdZIPNNe0LyUk7PDy61eTEYz6wSZVVw9l7Gng0cIs5ws89xa2Q1AFC
+9V8XE5/755R/j4V4+Iu4oqKhOF9U5Ic85LJ55wbu8mowgPsC2hK+09lqNaHzI7qf
+2pmS8Vd/6ABLCOILOFuXgvZtx7tV124GPhS72jOabkjegmFA22Gfnnrv56KrWnSv
++nk1R8FTaggC54JxsdWYckyb3bcE8J9R5T1fU+54sspEbiGQpzMALgk1AnKnlVsV
+kcXO7NvsN5xZinskRXfi9YdtwLuzZegDuq/8/dByatwKHLzn5QEQLw9HQlhQcnJB
+5GqCUl/ljncl6CmXpLZbDJSaBTeTeeDMe/a508IoMiIe0s7VBFGFZOaW5pOMWZo4
+0nVE91v2oIEBvF3IKVNlEWDCekiNnc0G4K1VMLq3Kq+OgTnjFnEZCM1M6wARAQAB
+AA/7B4h1sIFxWfXFZnqPfbCQvSD6xDLiY7R70oJqrtbseojGDNI6EDHPOkgnHssT
+eHITHQMOIs8RoQrQ6eI1c1pKcIohWGxLbwcyL4YoZY2VI5ICLDBIWWj5Ye7Mit2x
+xAxGzhXofQsACVhOrYXEgJttsce20ViPSfJoQoSj3Jrvfg03JPe7J4hhYEELEYft
+jh1ESnMpxJdRduHT5w44+Gr3N1QqAOcc9sjaRmXgM7BZKjgvCt6Qrvcz7QzlWtqW
+srDPAXVFmp/WGv2YewG5DUSnMwUgznHpp4NW4MteNDt5CJ/ChYzFgF6mP993OF4e
+l2d/nCyA2EJwhkmE7NoKUVqnkxHPuUXYgLjc1ca+rtaSScbmlwIOJKRDVD5hsZEw
+TKImUsaJ/PVOmCN8MwW5yXUx3ZvB6JlFSOjOT267B/Jk7LM3zupKuQJt8M4o6QZy
+vkMAUxZau74jsTcXB6fB2NCSmaFOlPi9rMmOgqiNpdzzaSOVuJfI7lHgS7UDS2yn
+oaWSoPUxVLEmNRTFbP1ArZ2aEUaCy/ThvQ7aFJlDbBbQbmrxz7hMp0oiWJVf2X+2
+VUEuTZAlTNYoXCSMVR3UoJfKJ99trNP7kuNiiOt5puDrhFDwNKxdjm4qRPBw6tsZ
+cBUFmnbx9S6tGNGM9BMhGZW87YMHrMmPRwGHZrBXiaV99gEIAMpFtVIXP2RTL+T6
+DgjmTz15pf1WuGBZcIg2DUs9lNRe///E0hv+IxNY1rY5g7xmJRpZfMNDCFvtEWen
+jrCJ5vJBO1Vxky4NsM3t5wbqJXYam2lib39HAXKuMTIGjXh29ShM57++FBTITXiO
+pgdO3tg2FwIi/Hc5wqYwRYpJ+gVn6rDy5mR1jD99z5ccIKAPEPWw4qQ2+ICHhICu
+Oe7aU3OTtFaS/RS7Vo+bXxENUb26bTyQMrztxHgIPnU01DamZHbhwq7uEustZ9+c
+DBMuo98XOOru15XJAaQnPd5Qi2Nz8Cqttfu7QoVBxwcWxvNU6QuYxASeGOrtYfAf
+5nfvsx0IAOpPhWEtcoRQZxf/EQ5s7YsQ8ztmVVOY6vNQC2x0EqRbJaJfI62KdQBB
+nao3Je6syKRAGQLHKcoc3dDuKT2aFPoRXFyptSLK83E2ktlIa71RPI3HcEoduqm7
+H6MPfxKXWvKF09SV5e1Bj9Dqpe8NuE81w4CkDlaVfvdoBm0HRa0c1oZ5zDNZ/Jxk
+ogPBoLWJ/WJbOo8O3ddtYILJG2mAOeIztslGu3Slsaz3Uk7WaG+5hrc783/K9yDZ
+7J5cP8hgv/Z0uVJEy34mY5s++dce3uO5OilV3QosehrV8PLt2lXOwcxNesy5QqWf
+1fDW0jb1znP+o6uQ5J0blmwekxtmOacIAIen0hx4LbhHEvWvK7AAKvct/OmVgJxB
+n1IxsaJV6c/qKEqVbf5g7cg/0I9hlsCO1B/1eqrXBD7QDjB3/3lSr3WlIOHKf4Bf
+re3v7kmXEGN1RZzyO2YdI4mLpYF3GYrQtMwo5pD6QPZudW+uRbZk5cAYIO7pb5uZ
+pbJGK5pU35UE+wkL6/oWTjn7dnBpKtamGlZ08ssl7HDPZ/A51MGnyNjYCEMC/3IE
+nmhfaeQklKI8uF6VBy0ixueTXSRbb3EO7Pj9+tF3bVRIESBfvujaH++TAJ9h89gi
+UFIwBtNJvXGj5DA2nF46y/PurMQKMr7djUA7BLBu7Usj0x9jWAv0Z5iF7LQ2RG1p
+dHJ5IE1hdHJlbmljaGV2IDxkbWl0cnkubWF0cmVuaWNoZXZAc2lkZXJvbGFicy5j
+b20+iQJUBBMBCgA+FiEEozmFFCsEH0WF59oCIBBLTR3n8ckFAmMzVUsCGwMFCQlm
+AYAFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQIBBLTR3n8cnGkxAAkdDRmP++
+K2q3s1gIGMd+ENzRplyDPxlUrQTKuopgR9xf1xRf6vdZoBT4D3sDtY7s7LBakxk9
+u15+Og7V9w8L+3i620W0KRYS1cOTjLN1BP7inaiqGCHF/KUFHlHIF08Iz6xv3X4P
+/+3oDrB/6TGqdU+DUThjA/ugUt8eVvY+VNg/8d+A4M21YOU/rjTf/PpN9FbXDbdZ
+3i3gfue9lNHJxK5CLv8sDltUFH2KF8pMgobkQ7WObwmR2hHcBaFtQAgxKV2pb1La
+jnZQAHWBEkNpJGL5R4AoApfLupcv/AASmdwLkBiwP/PzvvxhSKUMbb/LQKxK+M+3
+HLJ+lTHlNs92lU4umvpZ5W1AJQ8nLR1GKn3ufm8cD+hDzekroO1y8MTnzxKX77rA
+RjEQt//6GTuRkRrQcd6zjcAOnl3rMpEtuneWFnUWghBSuz82IM7WNGFTSVKRNthp
+NzKlu45rgBmERzn6IXA/l/r5Q4g5uM48FvJUy05znWftEjumuzG5m+1eB2Zu7xwd
+7icW1/mgL14XDvGnlnlsm6BQRR6eN5Vrx0TADFuJQPpilsouhBYuz1p02hcxMkGo
+Svjcwphc3w+yc8610eosBUbVV5KbX68wC+aSFIa4L5CS9fl68JGkREeEKA5YCCOj
+fgB8JX/mfSkeoSSZg0vGxBDajsN0G50O6BGdBxgEYzNVSwEQAKIkCwr/fw9VWLbm
+bCYckMEkF6wcXssO6ymoHwk003F1ZUsR8RQXsey7TWj6sLmS79tW8/M5RGxHdsZm
+SBxymFbdOo5c2nup0jxngV5v0IkkqWidryKOCLctK6l65qjUBhDzqLy4jRGcnf+2
+Z9XFjy+BbzY7FScT2rq4Zj3af4Zu+xfIIQ/JO9Sk9E/k9sKLNd/7BXWxDR5cPQs2
+K7WjK0ax6vND1xYLU8wm6ct+Z0dpMNA9xbxRM7uTLR7P3oonO4OVjNBHYWgpKYVE
+YF9zcevLByfgMAagGIsG3QSqdgv9LNKwv68LR7jP6JNFcdaQ1FW1e14QLECjs+xl
+RjgY/hoaCsCg7XXpbj5aJr5Me9hIbF0M1toMjujws0VGjpv1CNYuQv16efzZytQK
+GmIm30Tj5nHY7L3TwDiER9wCdvnjjX8+gIqM82mu7jElpLWFE+xg6IxJgRGcmOd1
+PPQY+5bCGVKCUHLNCJRPtYC/cXmjJUTDmLJUzdc4ysWLrdclSnaOHvv4T/VnVzq9
+EuibZ3xu+/8a/amxnjq3Ck+pzKbtdpCycqYJSfnXhaHcY8I8M1mKYg721cKy5eAV
+D+zkRm7oJz0CblB9Ds8+s3O0KLRosGSHRrBcpNfEUs/qs/NeuCx7DxSmnA/9Ohrl
+P3SrEpBodv8dNKgKry18VjjMBUMBABEBAAEAD/0TPebHl9ma1ryP/BlyjmpJWYCr
+rrQ7MdqLl4WTYJ8FNHLgbVEoWsWFPBcsMa/+Xec0JwYNY8rwdKyuT94X7iuRB3EX
+CwLssRMfkwMB05AyblTicvAhUCzNnEE1vD2aZIsRwPDR8K7hG66OdbWt42OiNiCe
+FXXlrNAE37RWe9Mtf4cx49C0oGOG0UqjHp+AJ+gtXAtiU7AkXbrq1TNru2D740po
+MzFXzuFTdXzCZw5Xpa6iz+ni9toGVSmCIhYdXBmOfJV49Delllj0lVBAk6E949rG
+Cy934dD30skw8A/RTWrf2BTvb43D63yE2bVwSsDAKSjqWU3/H85O7BfguWqSOw/b
+d9c/1PzY6DnmBjP6a6UqQ207mMmQwm+kUzOrIoPeGrwrksAperHNvNwM0uFymVkx
+87tgMI2amGXhvo2FjeYhpAmXIygMmXGmNvFKW0DqJiUzbEYM7RC+A2+1fw2eSuqN
+YOEhjA8jvRkKjIUhB5/X10GYp/vlV8Kaomhcxfk12VnwtEblwOHoeIsAREnN7wzs
+mG50sV1NdaJy4B6JwE5gJU6i9h+KcYrs49vqOIJSGJ7nDRwweMzxhEvl5PuaZJy6
+FLuslHvgRT6GWNE/eIAWavgYmj5a25Tx80i2Z+ztbtKT984eZ6VxKXa+JlOkAcXC
+0REKPz0h7pm5NvEafwgAyXMhkjNKNpB6C6HfQ1/lwo4d4+LN/C9+3D/BeTSI56aa
+vVzXK/EeF0cvwsbaTn+M9HoF/MhGKftk+TSsWXyp/Yp9se4LntyOPBHspRI/mXj7
+8kvcZCBBfLoCe8L2ytM3a7c0NZsJ8qFD3qNZgaYELyH59c7bCWhczLLbg0QSXZHl
+H2l3LPdBDcrgY1CthWOtd2kKPPNaW7B6/8Mk2eymHFVmFfVJ/6jW0Y6HJjgsF5L+
+a2zx/t2sAfB4WIBlAXIInZXWtcWHb2ArJDzHiSjhtzIRuHG5uG+48MbuYAO8zK5j
+5Y3UscHbZ6MQ0rDMKbFJawOhtuOW/dCQy2Zsj6NQAwgAzgvxjblw3NxKAcQ94M3Z
+8o1cJ80oH6xNqEceqHhlGr9QLKPIK9FLBgO3zv6NqDWrbyA2TxKMK/09EfaYKzcr
+VP8e53Xvl27lzQH3jy+4ii7ZF9GlVLtn/hw/CrNQYBOO9whEEoe95oKkBc6B1tRP
+uUVrpnTfY5qgPKn64pwflTZ1iNnSmW1GkUkHeJn3Ckts2dK5tOC3lbgRzyUMzq0r
+Ze+pxi8tLIUOxw05yngUU7Xpf6nDlhZJLxO1vQIBJolwTpRnrudQftBnZz7guQKL
+p1IWeNb8QkCjMq23kSaeyvAlpOzoIBm1ePmcavA7fLJJqLepV2C1JCDZTByNbX+b
+qwgArquLk/d1sShSfA6LqESxaJGYXAkYf2kXcJSIR3A0z7m91swL+Qrs7G/g5BfI
+8T5xtErmzK3ex4/ZYYKYCIUU/xDO/ZL+Ks7u2aPJSQGQZSPRNLk0LJK1T132FB+z
+j9WPqqu2mfr7T5YO5vMJDcd6gDEFSqZzS/8aogWwZwoIQD6DBCBCJvOodDyncgzV
+cMQytTQC+Qjea5Ji++1NHA7i9Pyj70HgqmyL6T90Lrm8BurA+/IBWgOYFf2aFrVi
+6tgxryIYjEHNrDvEBU9SVUHco3s1+7dAm86DrL5K3rLwbDbRlz5SjlJdL0+NLG1+
+wDbzwdI0AHuhxc/PZHxjRhm1DY5IiQI8BBgBCgAmFiEEozmFFCsEH0WF59oCIBBL
+TR3n8ckFAmMzVUsCGwwFCQlmAYAACgkQIBBLTR3n8cn5ghAAkXuf1KDd8I/hPxH/
+C2b6u4wjrTWaaSvzLacAjCwOf4ctHyApb7SbiQQ0cFD/0c3Vedf13O0xJJ8BdSO7
+cdF/RpVvR8hE8ebGoylnkWhKKGmB68aw7LmFYLE2pwuhx8GFuAsVz2eozrbzRqyk
+R7o/HnMSoJ41zlPLI4Go0NjETycZyzSKfNQw+5KWKbOnU7kGvCZReEuNGpyjDZ9I
+HbnB+qlRyY5QCcX+nEX6sWJyIoNyOJbu2D3XG7ylQGZL71nogTRhLMBL7VDUaR3r
+/s5l3E16jn5cn798p8o4bnFXukY9JOi3V8yL+X2Kg/ylwJYmnhhyG9c5Bu4I9g0F
+Q+Z+rbN4YoG1bt112rAA1KlekhuJwdDAn9QhKx0Nod13wcHFrjKp/Z1YH8TYxcUc
+pjeg0+BMs/K4PyO9xvnGEuITcJBoSnQRx/E+gShu3DL5ndmFsM8qyx7fJRXsTtDb
+21sArBHBNuUa5blAp1fVCm4RQ9+F1GOwnOFRJfWVrhp8ninHtnM78TnDd1wczLVv
+SNVAXjsHoZTVuuCWWXPVX0OG22fPAy90nJpxGtPNVFI5se39Srk/1Yg92vhO/G3T
+UtoMuMxSBCD7BD6ZFox/ga3fARvfreZuiNQn9t6J6d7DChqCQxo2Rtk9WWdy72W9
+hp/KSDr6GKR6H5ggj1v1tBWE95A=
+=pdI2
+-----END PGP PRIVATE KEY BLOCK-----
diff --git a/internal/backend/runtime/omni/testdata/pgp/old_key.public b/internal/backend/runtime/omni/testdata/pgp/old_key.public
new file mode 100644
index 000000000..6ccc00076
--- /dev/null
+++ b/internal/backend/runtime/omni/testdata/pgp/old_key.public
@@ -0,0 +1,52 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGMzVUsBEAC5Ioyi/Rs06GL3zeKVgmi9F8xF6yDjec+E83FFyUdO1xiZ4fDf
+WQhUKh5c4gJi1hoGOWPkFWsEx1sTPmZsAdYIHmOSt6qPGbdt22JnfGseYdTRpMmi
+blkcbvUm3uidghDd5HiacmhaZqh+5AjN0T61QVZfryo5gb9y5wMxCVp2d8t5PG1/
+ULosQ6WfhQhCkyzF1eiuLyxfCToyYUhRRhveRsitrNnpAaNBjOvtG9ujdRz3EPsn
+q0kcwDscqqUdZIPNNe0LyUk7PDy61eTEYz6wSZVVw9l7Gng0cIs5ws89xa2Q1AFC
+9V8XE5/755R/j4V4+Iu4oqKhOF9U5Ic85LJ55wbu8mowgPsC2hK+09lqNaHzI7qf
+2pmS8Vd/6ABLCOILOFuXgvZtx7tV124GPhS72jOabkjegmFA22Gfnnrv56KrWnSv
++nk1R8FTaggC54JxsdWYckyb3bcE8J9R5T1fU+54sspEbiGQpzMALgk1AnKnlVsV
+kcXO7NvsN5xZinskRXfi9YdtwLuzZegDuq/8/dByatwKHLzn5QEQLw9HQlhQcnJB
+5GqCUl/ljncl6CmXpLZbDJSaBTeTeeDMe/a508IoMiIe0s7VBFGFZOaW5pOMWZo4
+0nVE91v2oIEBvF3IKVNlEWDCekiNnc0G4K1VMLq3Kq+OgTnjFnEZCM1M6wARAQAB
+tDZEbWl0cnkgTWF0cmVuaWNoZXYgPGRtaXRyeS5tYXRyZW5pY2hldkBzaWRlcm9s
+YWJzLmNvbT6JAlQEEwEKAD4WIQSjOYUUKwQfRYXn2gIgEEtNHefxyQUCYzNVSwIb
+AwUJCWYBgAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRAgEEtNHefxycaTEACR
+0NGY/74rarezWAgYx34Q3NGmXIM/GVStBMq6imBH3F/XFF/q91mgFPgPewO1juzs
+sFqTGT27Xn46DtX3Dwv7eLrbRbQpFhLVw5OMs3UE/uKdqKoYIcX8pQUeUcgXTwjP
+rG/dfg//7egOsH/pMap1T4NROGMD+6BS3x5W9j5U2D/x34DgzbVg5T+uNN/8+k30
+VtcNt1neLeB+572U0cnErkIu/ywOW1QUfYoXykyChuRDtY5vCZHaEdwFoW1ACDEp
+XalvUtqOdlAAdYESQ2kkYvlHgCgCl8u6ly/8ABKZ3AuQGLA/8/O+/GFIpQxtv8tA
+rEr4z7ccsn6VMeU2z3aVTi6a+lnlbUAlDyctHUYqfe5+bxwP6EPN6Sug7XLwxOfP
+EpfvusBGMRC3//oZO5GRGtBx3rONwA6eXesykS26d5YWdRaCEFK7PzYgztY0YVNJ
+UpE22Gk3MqW7jmuAGYRHOfohcD+X+vlDiDm4zjwW8lTLTnOdZ+0SO6a7Mbmb7V4H
+Zm7vHB3uJxbX+aAvXhcO8aeWeWyboFBFHp43lWvHRMAMW4lA+mKWyi6EFi7PWnTa
+FzEyQahK+NzCmFzfD7JzzrXR6iwFRtVXkptfrzAL5pIUhrgvkJL1+XrwkaRER4Qo
+DlgII6N+AHwlf+Z9KR6hJJmDS8bEENqOw3QbnQ7oEbkCDQRjM1VLARAAoiQLCv9/
+D1VYtuZsJhyQwSQXrBxeyw7rKagfCTTTcXVlSxHxFBex7LtNaPqwuZLv21bz8zlE
+bEd2xmZIHHKYVt06jlzae6nSPGeBXm/QiSSpaJ2vIo4Ity0rqXrmqNQGEPOovLiN
+EZyd/7Zn1cWPL4FvNjsVJxPaurhmPdp/hm77F8ghD8k71KT0T+T2wos13/sFdbEN
+Hlw9CzYrtaMrRrHq80PXFgtTzCbpy35nR2kw0D3FvFEzu5MtHs/eiic7g5WM0Edh
+aCkphURgX3Nx68sHJ+AwBqAYiwbdBKp2C/0s0rC/rwtHuM/ok0Vx1pDUVbV7XhAs
+QKOz7GVGOBj+GhoKwKDtdeluPlomvkx72EhsXQzW2gyO6PCzRUaOm/UI1i5C/Xp5
+/NnK1AoaYibfROPmcdjsvdPAOIRH3AJ2+eONfz6Aiozzaa7uMSWktYUT7GDojEmB
+EZyY53U89Bj7lsIZUoJQcs0IlE+1gL9xeaMlRMOYslTN1zjKxYut1yVKdo4e+/hP
+9WdXOr0S6JtnfG77/xr9qbGeOrcKT6nMpu12kLJypglJ+deFodxjwjwzWYpiDvbV
+wrLl4BUP7ORGbugnPQJuUH0Ozz6zc7QotGiwZIdGsFyk18RSz+qz8164LHsPFKac
+D/06GuU/dKsSkGh2/x00qAqvLXxWOMwFQwEAEQEAAYkCPAQYAQoAJhYhBKM5hRQr
+BB9FhefaAiAQS00d5/HJBQJjM1VLAhsMBQkJZgGAAAoJECAQS00d5/HJ+YIQAJF7
+n9Sg3fCP4T8R/wtm+ruMI601mmkr8y2nAIwsDn+HLR8gKW+0m4kENHBQ/9HN1XnX
+9dztMSSfAXUju3HRf0aVb0fIRPHmxqMpZ5FoSihpgevGsOy5hWCxNqcLocfBhbgL
+Fc9nqM6280aspEe6Px5zEqCeNc5TyyOBqNDYxE8nGcs0inzUMPuSlimzp1O5Brwm
+UXhLjRqcow2fSB25wfqpUcmOUAnF/pxF+rFiciKDcjiW7tg91xu8pUBmS+9Z6IE0
+YSzAS+1Q1Gkd6/7OZdxNeo5+XJ+/fKfKOG5xV7pGPSTot1fMi/l9ioP8pcCWJp4Y
+chvXOQbuCPYNBUPmfq2zeGKBtW7dddqwANSpXpIbicHQwJ/UISsdDaHdd8HBxa4y
+qf2dWB/E2MXFHKY3oNPgTLPyuD8jvcb5xhLiE3CQaEp0EcfxPoEobtwy+Z3ZhbDP
+Ksse3yUV7E7Q29tbAKwRwTblGuW5QKdX1QpuEUPfhdRjsJzhUSX1la4afJ4px7Zz
+O/E5w3dcHMy1b0jVQF47B6GU1brglllz1V9DhttnzwMvdJyacRrTzVRSObHt/Uq5
+P9WIPdr4Tvxt01LaDLjMUgQg+wQ+mRaMf4Gt3wEb363mbojUJ/beienewwoagkMa
+NkbZPVlncu9lvYafykg6+hikeh+YII9b9bQVhPeQ
+=fQza
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/internal/backend/runtime/omni/validated/errors.go b/internal/backend/runtime/omni/validated/errors.go
new file mode 100644
index 000000000..63a5526bf
--- /dev/null
+++ b/internal/backend/runtime/omni/validated/errors.go
@@ -0,0 +1,61 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package validated
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+const errPrefix = "failed to validate: "
+
+// ErrValidation should be implemented by validation errors.
+type ErrValidation interface {
+	ValidationError()
+}
+
+// IsValidationError checks if err is validation error.
+func IsValidationError(err error) bool {
+	var i ErrValidation
+
+	if errors.As(err, &i) {
+		return true
+	}
+
+	sts, ok := status.FromError(err)
+	if !ok {
+		return false
+	}
+
+	return sts.Code() == codes.InvalidArgument && strings.HasPrefix(sts.Message(), errPrefix)
+}
+
+type eValidation struct {
+	error
+}
+
+func (e eValidation) ValidationError() {
+}
+
+func (e eValidation) GRPCStatus() *status.Status {
+	// if the wrapped error is already a status error, return it
+	if sts, ok := status.FromError(e.error); ok {
+		return sts
+	}
+
+	return status.New(codes.InvalidArgument, e.Error())
+}
+
+// ValidationError generates error compatible with validated.ErrValidation.
+func ValidationError(err error) error {
+	return eValidation{
+		fmt.Errorf("%s%w", errPrefix, err),
+	}
+}
diff --git a/internal/backend/runtime/omni/validated/options.go b/internal/backend/runtime/omni/validated/options.go
new file mode 100644
index 000000000..1c2d10488
--- /dev/null
+++ b/internal/backend/runtime/omni/validated/options.go
@@ -0,0 +1,58 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package validated
+
+// StateOption is a function that can be used to configure a state.
+type StateOption func(*State)
+
+// WithGetValidations adds validations to the state that are executed when a resource is retrieved.
+func WithGetValidations(validations ...GetValidation) StateOption {
+	return func(s *State) {
+		s.getValidations = append(s.getValidations, validations...)
+	}
+}
+
+// WithListValidations adds validations to the state that are executed when a resource is listed.
+func WithListValidations(validations ...ListValidation) StateOption {
+	return func(s *State) {
+		s.listValidations = append(s.listValidations, validations...)
+	}
+}
+
+// WithCreateValidations adds validations to the state that are executed when a resource is created.
+func WithCreateValidations(validations ...CreateValidation) StateOption {
+	return func(s *State) {
+		s.createValidations = append(s.createValidations, validations...)
+	}
+}
+
+// WithUpdateValidations adds validations to the state that are executed when a resource is updated.
+func WithUpdateValidations(validations ...UpdateValidation) StateOption {
+	return func(s *State) {
+		s.updateValidations = append(s.updateValidations, validations...)
+	}
+}
+
+// WithDestroyValidations adds validations to the state that are executed when a resource is destroyed.
+func WithDestroyValidations(validations ...DestroyValidation) StateOption {
+	return func(s *State) {
+		s.destroyValidations = append(s.destroyValidations, validations...)
+	}
+}
+
+// WithWatchValidations adds validations to the state that are executed when a resource is watched.
+func WithWatchValidations(validations ...WatchValidation) StateOption {
+	return func(s *State) {
+		s.watchValidations = append(s.watchValidations, validations...)
+	}
+}
+
+// WithWatchKindValidations adds validations to the state that are executed when a resource is watched.
+func WithWatchKindValidations(validations ...WatchKindValidation) StateOption {
+	return func(s *State) {
+		s.watchKindValidations = append(s.watchKindValidations, validations...)
+	}
+}
diff --git a/internal/backend/runtime/omni/validated/state.go b/internal/backend/runtime/omni/validated/state.go
new file mode 100644
index 000000000..e3c9762cb
--- /dev/null
+++ b/internal/backend/runtime/omni/validated/state.go
@@ -0,0 +1,208 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package validated
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/hashicorp/go-multierror"
+)
+
+// State is a state that validates resources before passing them to the underlying state.
+type State struct {
+	st state.CoreState
+
+	getValidations       []GetValidation
+	listValidations      []ListValidation
+	createValidations    []CreateValidation
+	updateValidations    []UpdateValidation
+	destroyValidations   []DestroyValidation
+	watchValidations     []WatchValidation
+	watchKindValidations []WatchKindValidation
+}
+
+// NewState creates a new validated state with the given underlying state and options.
+func NewState(st state.CoreState, opts ...StateOption) state.CoreState {
+	validatedState := &State{
+		st: st,
+	}
+
+	for _, opt := range opts {
+		opt(validatedState)
+	}
+
+	return validatedState
+}
+
+// Get gets a resource from the underlying state.
+func (v *State) Get(ctx context.Context, pointer resource.Pointer, option ...state.GetOption) (resource.Resource, error) {
+	res, err := v.st.Get(ctx, pointer, option...)
+	if err != nil && !state.IsNotFoundError(err) {
+		return nil, err
+	}
+
+	// if the existing resource was not found, instead of returning the not found error, run the validations first
+	// only if the validations pass, return the not found error
+
+	var validationErrs error
+
+	for _, validation := range v.getValidations {
+		if validationErr := validation(ctx, pointer, res, option...); validationErr != nil {
+			validationErrs = multierror.Append(validationErrs, validationErr)
+		}
+	}
+
+	if validationErrs != nil {
+		return nil, ValidationError(validationErrs)
+	}
+
+	return res, err
+}
+
+// List lists resources from the underlying state.
+func (v *State) List(ctx context.Context, kind resource.Kind, option ...state.ListOption) (resource.List, error) {
+	var validationErrs error
+
+	for _, validation := range v.listValidations {
+		if validationErr := validation(ctx, kind, option...); validationErr != nil {
+			validationErrs = multierror.Append(validationErrs, validationErr)
+		}
+	}
+
+	if validationErrs != nil {
+		return resource.List{}, ValidationError(validationErrs)
+	}
+
+	return v.st.List(ctx, kind, option...)
+}
+
+// Create creates a resource in the underlying state.
+func (v *State) Create(ctx context.Context, resource resource.Resource, option ...state.CreateOption) error {
+	var validationErrs error
+
+	for _, validation := range v.createValidations {
+		if validationErr := validation(ctx, resource, option...); validationErr != nil {
+			validationErrs = multierror.Append(validationErrs, validationErr)
+		}
+	}
+
+	if validationErrs != nil {
+		return ValidationError(validationErrs)
+	}
+
+	return v.st.Create(ctx, resource, option...)
+}
+
+// Update updates a resource in the underlying state.
+func (v *State) Update(ctx context.Context, newResource resource.Resource, opts ...state.UpdateOption) error {
+	existing, err := v.st.Get(ctx, newResource.Metadata())
+	if err != nil && !state.IsNotFoundError(err) {
+		return err
+	}
+
+	// if the existing resource was not found, instead of returning the not found error, run the validations first
+	// only if the validations pass, return the not found error
+
+	var validationErrs error
+
+	for _, validation := range v.updateValidations {
+		if validationErr := validation(ctx, existing, newResource, opts...); validationErr != nil {
+			validationErrs = multierror.Append(validationErrs, validationErr)
+		}
+	}
+
+	if validationErrs != nil {
+		return ValidationError(validationErrs)
+	}
+
+	if err != nil {
+		return err
+	}
+
+	return v.st.Update(ctx, newResource, opts...)
+}
+
+// Destroy destroys a resource in the underlying state.
+func (v *State) Destroy(ctx context.Context, pointer resource.Pointer, option ...state.DestroyOption) error {
+	existing, err := v.st.Get(ctx, pointer)
+	if err != nil && !state.IsNotFoundError(err) {
+		return err
+	}
+
+	// if the existing resource was not found, instead of returning the not found error, run the validations first
+	// only if the validations pass, return the not found error
+
+	var validationErrs error
+
+	for _, validation := range v.destroyValidations {
+		if validationErr := validation(ctx, pointer, existing, option...); validationErr != nil {
+			validationErrs = multierror.Append(validationErrs, validationErr)
+		}
+	}
+
+	if validationErrs != nil {
+		return ValidationError(validationErrs)
+	}
+
+	if err != nil {
+		return err
+	}
+
+	return v.st.Destroy(ctx, pointer, option...)
+}
+
+// Watch watches a resource in the underlying state.
+func (v *State) Watch(ctx context.Context, pointer resource.Pointer, events chan<- state.Event, option ...state.WatchOption) error {
+	var validationErrs error
+
+	for _, validation := range v.watchValidations {
+		if validationErr := validation(ctx, pointer, option...); validationErr != nil {
+			validationErrs = multierror.Append(validationErrs, validationErr)
+		}
+	}
+
+	if validationErrs != nil {
+		return ValidationError(validationErrs)
+	}
+
+	return v.st.Watch(ctx, pointer, events, option...)
+}
+
+// WatchKind watches a resource kind in the underlying state.
+func (v *State) WatchKind(ctx context.Context, kind resource.Kind, events chan<- state.Event, option ...state.WatchKindOption) error {
+	var validationErrs error
+
+	for _, validation := range v.watchKindValidations {
+		if validationErr := validation(ctx, kind, option...); validationErr != nil {
+			validationErrs = multierror.Append(validationErrs, validationErr)
+		}
+	}
+
+	if validationErrs != nil {
+		return ValidationError(validationErrs)
+	}
+
+	return v.st.WatchKind(ctx, kind, events, option...)
+}
+
+// WatchKindAggregated watches a resource kind in the underlying state.
+func (v *State) WatchKindAggregated(ctx context.Context, kind resource.Kind, c chan<- []state.Event, option ...state.WatchKindOption) error {
+	var validationErrs error
+
+	for _, validation := range v.watchKindValidations {
+		if validationErr := validation(ctx, kind, option...); validationErr != nil {
+			validationErrs = multierror.Append(validationErrs, validationErr)
+		}
+	}
+
+	if validationErrs != nil {
+		return ValidationError(validationErrs)
+	}
+
+	return v.st.WatchKindAggregated(ctx, kind, c, option...)
+}
diff --git a/internal/backend/runtime/omni/validated/state_test.go b/internal/backend/runtime/omni/validated/state_test.go
new file mode 100644
index 000000000..3c54a5556
--- /dev/null
+++ b/internal/backend/runtime/omni/validated/state_test.go
@@ -0,0 +1,207 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package validated_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/hashicorp/go-multierror"
+	"github.com/stretchr/testify/assert"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/validated"
+)
+
+func TestValidations(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	innerSt := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	testMgmtAddress := "test-mgmt-address"
+	testTalosVersion := "test-talos-version"
+
+	st := validated.NewState(innerSt,
+		validated.WithCreateValidations(
+			// generic create validator
+			func(_ context.Context, res resource.Resource, _ ...state.CreateOption) error {
+				val, _ := res.Metadata().Labels().Get("foo")
+
+				if val != "bar" {
+					return errors.New("expected label foo to be bar")
+				}
+
+				return nil
+			},
+
+			// type-specific create validator 1
+			validated.NewCreateValidationForType(func(_ context.Context, res *omni.Cluster, _ ...state.CreateOption) error {
+				if res.TypedSpec().Value.TalosVersion != testTalosVersion {
+					return fmt.Errorf("expected talos version to be %s", testTalosVersion)
+				}
+
+				return nil
+			}),
+
+			// type-specific create validator 2
+			validated.NewCreateValidationForType(func(_ context.Context, res *omni.Machine, _ ...state.CreateOption) error {
+				if res.TypedSpec().Value.ManagementAddress != testMgmtAddress {
+					return fmt.Errorf("expected management address to be %s", testMgmtAddress)
+				}
+
+				return nil
+			}),
+		),
+		validated.WithUpdateValidations(
+			// generic update validator
+			func(_ context.Context, existingRes resource.Resource, newRes resource.Resource, _ ...state.UpdateOption) error {
+				if newRes.Metadata().Labels().Len() != existingRes.Metadata().Labels().Len()+1 {
+					return errors.New("every update should add a new label")
+				}
+
+				return nil
+			},
+			// type-specific update validator 1
+			validated.NewUpdateValidationForType(func(_ context.Context, _ *omni.Cluster, newRes *omni.Cluster, option ...state.UpdateOption) error {
+				var errs error
+
+				if newRes.TypedSpec().Value.TalosVersion != "test-update" {
+					errs = multierror.Append(errs, errors.New("expected talos version to be test-update"))
+				}
+
+				var opts state.UpdateOptions
+
+				for _, opt := range option {
+					opt(&opts)
+				}
+
+				if opts.ExpectedPhase == nil || *opts.ExpectedPhase != resource.PhaseRunning {
+					errs = multierror.Append(errs, errors.New("expected ExpectedPhase to be PhaseRunning"))
+				}
+
+				return errs
+			}),
+		),
+		validated.WithDestroyValidations(
+			// generic destroy validator
+			func(_ context.Context, _ resource.Pointer, existingRes resource.Resource, _ ...state.DestroyOption) error {
+				if _, exists := existingRes.Metadata().Labels().Get("foo3"); !exists {
+					return errors.New("cannot delete a resource without label foo3")
+				}
+
+				return nil
+			},
+			// type-specific destroy validator 1
+			validated.NewDestroyValidationForType(func(_ context.Context, _ resource.Pointer, existingRes *omni.Machine, _ ...state.DestroyOption) error {
+				if existingRes.TypedSpec().Value.ManagementAddress == testMgmtAddress {
+					return fmt.Errorf("cannot delete a machine with management address %s", testMgmtAddress)
+				}
+
+				return nil
+			}),
+		),
+	)
+
+	// prepare resources
+	cluster := omni.NewCluster(resources.DefaultNamespace, "something")
+	machine := omni.NewMachine(resources.DefaultNamespace, "something")
+	machine.Metadata().Labels().Set("foo", "bar")
+
+	// try to create cluster
+	err := st.Create(ctx, cluster)
+	assert.True(t, validated.IsValidationError(err))
+	assert.ErrorContains(t, err, "expected label foo to be bar")
+	assert.ErrorContains(t, err, "expected talos version to be test")
+	assert.NotContains(t, err.Error(), "expected management address to be test")
+
+	// meet one of the creation requirements but not all and try again
+	cluster.Metadata().Labels().Set("foo", "bar")
+	err = st.Create(ctx, cluster)
+	assert.True(t, validated.IsValidationError(err))
+	assert.NotContains(t, err.Error(), "expected label foo to be bar")
+
+	// meet remaining creation requirements and try again
+	cluster.TypedSpec().Value.TalosVersion = testTalosVersion
+	assert.NoError(t, st.Create(ctx, cluster))
+
+	// try to create machine
+	err = st.Create(ctx, machine)
+	assert.True(t, validated.IsValidationError(err))
+	assert.ErrorContains(t, err, "expected management address to be test")
+
+	// meet all creation requirements and try again
+	machine.TypedSpec().Value.ManagementAddress = testMgmtAddress
+	err = st.Create(ctx, machine)
+	assert.NoError(t, err)
+
+	// try to update cluster
+	err = st.Update(ctx, cluster)
+	assert.True(t, validated.IsValidationError(err))
+	assert.ErrorContains(t, err, "every update should add a new label")
+	assert.ErrorContains(t, err, "expected talos version to be test")
+	assert.ErrorContains(t, err, "expected ExpectedPhase to be PhaseRunning")
+
+	// meet all update requirements and try again
+	cluster.Metadata().Labels().Set("foo1", "bar")
+
+	cluster.TypedSpec().Value.TalosVersion = "test-update"
+
+	assert.NoError(t, st.Update(ctx, cluster, state.WithExpectedPhase(resource.PhaseRunning)))
+
+	// try to update machine one more time
+	cluster.TypedSpec().Value.KubernetesVersion = "foobar"
+
+	err = st.Update(ctx, cluster, state.WithExpectedPhase(resource.PhaseRunning))
+	assert.True(t, validated.IsValidationError(err))
+	assert.ErrorContains(t, err, "every update should add a new label")
+
+	// meet all update requirements and try again
+	cluster.Metadata().Labels().Set("foo2", "bar")
+	assert.NoError(t, st.Update(ctx, cluster, state.WithExpectedPhase(resource.PhaseRunning)))
+
+	// try to destroy cluster
+	err = st.Destroy(ctx, cluster.Metadata())
+	assert.True(t, validated.IsValidationError(err))
+	assert.ErrorContains(t, err, "cannot delete a resource without label foo3")
+
+	// meet the delete conditions
+	cluster.Metadata().Labels().Set("foo3", "bar")
+	assert.NoError(t, st.Update(ctx, cluster, state.WithExpectedPhase(resource.PhaseRunning)))
+
+	// try to destroy cluster again
+	assert.NoError(t, st.Destroy(ctx, cluster.Metadata()))
+
+	// try to destroy machine
+	err = st.Destroy(ctx, machine.Metadata())
+	assert.True(t, validated.IsValidationError(err))
+	assert.ErrorContains(t, err, "cannot delete a machine with management address test")
+
+	// meet the delete conditions
+	machine.Metadata().Labels().Set("foo3", "bar")
+
+	machine.TypedSpec().Value.ManagementAddress = "test2"
+
+	assert.NoError(t, st.Update(ctx, machine, state.WithExpectedPhase(resource.PhaseRunning)))
+
+	// try to destroy machine again
+	assert.NoError(t, st.Destroy(ctx, machine.Metadata()))
+
+	// ensure that both resources are destroyed
+	_, err = innerSt.Get(ctx, cluster.Metadata())
+	assert.True(t, state.IsNotFoundError(err))
+
+	_, err = innerSt.Get(ctx, machine.Metadata())
+	assert.True(t, state.IsNotFoundError(err))
+}
diff --git a/internal/backend/runtime/omni/validated/validated.go b/internal/backend/runtime/omni/validated/validated.go
new file mode 100644
index 000000000..26c665e47
--- /dev/null
+++ b/internal/backend/runtime/omni/validated/validated.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package validated implements a state wrapper which validates resources before the performing the requested operation.
+package validated
diff --git a/internal/backend/runtime/omni/validated/validation.go b/internal/backend/runtime/omni/validated/validation.go
new file mode 100644
index 000000000..b7c435113
--- /dev/null
+++ b/internal/backend/runtime/omni/validated/validation.go
@@ -0,0 +1,126 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package validated
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+)
+
+// CreateValidation is a function that can be used to validate a resource before it is created.
+type CreateValidation func(ctx context.Context, res resource.Resource, option ...state.CreateOption) error
+
+// TypedCreateValidation is a function that can be used to validate a specific type of resource before it is created.
+type TypedCreateValidation[T resource.Resource] func(ctx context.Context, res T, option ...state.CreateOption) error
+
+// NewCreateValidationForType creates a CreateValidation for a specific type of resource.
+// For all other resource types, the validation will be a no-op.
+func NewCreateValidationForType[T resource.Resource](validation TypedCreateValidation[T]) CreateValidation {
+	return func(ctx context.Context, res resource.Resource, option ...state.CreateOption) error {
+		if constants.IsDebugBuild {
+			if _, ok := res.Metadata().Annotations().Get(constants.DisableValidation); ok {
+				return nil
+			}
+		}
+
+		typedRes, ok := res.(T)
+		if !ok {
+			return nil
+		}
+
+		return validation(ctx, typedRes, option...)
+	}
+}
+
+// UpdateValidation is a function that can be used to validate a resource before it is updated.
+//
+// NOTE: existingRes can be nil if the resource is not found.
+// Instead of NotFound error being returned directly, validations will still run,
+// and if they return an error, that error will be returned instead of NotFound error.
+type UpdateValidation func(ctx context.Context, existingRes resource.Resource, newRes resource.Resource, option ...state.UpdateOption) error
+
+// TypedUpdateValidation is a function that can be used to validate a specific type of resource before it is updated.
+//
+// NOTE: existingRes can be nil if the resource is not found.
+// Instead of NotFound error being returned directly, validations will still run,
+// and if they return an error, that error will be returned instead of NotFound error.
+type TypedUpdateValidation[T resource.Resource] func(ctx context.Context, existingRes, newRes T, option ...state.UpdateOption) error
+
+// NewUpdateValidationForType creates an UpdateValidation for a specific type of resource.
+// For all other resource types, the validation will be a no-op.
+func NewUpdateValidationForType[T resource.Resource](validation TypedUpdateValidation[T]) UpdateValidation {
+	return func(ctx context.Context, existingRes resource.Resource, newRes resource.Resource, option ...state.UpdateOption) error {
+		if constants.IsDebugBuild {
+			if _, ok := newRes.Metadata().Annotations().Get(constants.DisableValidation); ok {
+				return nil
+			}
+		}
+
+		existingResTyped, ok := existingRes.(T)
+		if !ok {
+			return nil
+		}
+
+		newResTyped, ok := newRes.(T)
+		if !ok {
+			return nil
+		}
+
+		return validation(ctx, existingResTyped, newResTyped, option...)
+	}
+}
+
+// DestroyValidation is a function that can be used to validate a resource before it is destroyed.
+//
+// NOTE: existingRes can be nil if the resource is not found.
+// Instead of NotFound error being returned directly, validations will still run,
+// and if they return an error, that error will be returned instead of NotFound error.
+type DestroyValidation func(ctx context.Context, ptr resource.Pointer, existingRes resource.Resource, option ...state.DestroyOption) error
+
+// TypedDestroyValidation is a function that can be used to validate a specific type of resource before it is destroyed.
+//
+// NOTE: existingRes can be nil if the resource is not found.
+// Instead of NotFound error being returned directly, validations will still run,
+// and if they return an error, that error will be returned instead of NotFound error.
+type TypedDestroyValidation[T resource.Resource] func(ctx context.Context, ptr resource.Pointer, existingRes T, option ...state.DestroyOption) error
+
+// NewDestroyValidationForType creates a DestroyValidation for a specific type of resource.
+func NewDestroyValidationForType[T resource.Resource](validation TypedDestroyValidation[T]) DestroyValidation {
+	return func(ctx context.Context, ptr resource.Pointer, res resource.Resource, option ...state.DestroyOption) error {
+		if constants.IsDebugBuild && res != nil {
+			if _, ok := res.Metadata().Annotations().Get(constants.DisableValidation); ok {
+				return nil
+			}
+		}
+
+		typedRes, ok := res.(T)
+		if !ok {
+			return nil
+		}
+
+		return validation(ctx, ptr, typedRes, option...)
+	}
+}
+
+// GetValidation is a function that can be used to validate a resource after it is retrieved.
+//
+// NOTE: res can be nil if the resource is not found.
+// Instead of NotFound error being returned directly, validations will still run,
+// and if they return an error, that error will be returned instead of NotFound error.
+type GetValidation func(ctx context.Context, ptr resource.Pointer, res resource.Resource, option ...state.GetOption) error
+
+// ListValidation is a function that can be used to validate a resource before it is listed.
+type ListValidation func(ctx context.Context, kind resource.Kind, option ...state.ListOption) error
+
+// WatchValidation is a function that can be used to validate a resource before it is watched.
+type WatchValidation func(ctx context.Context, ptr resource.Pointer, option ...state.WatchOption) error
+
+// WatchKindValidation is a function that can be used to validate a resource before it is watched.
+type WatchKindValidation func(ctx context.Context, kind resource.Kind, option ...state.WatchKindOption) error
diff --git a/internal/backend/runtime/omni/virtual/computed.go b/internal/backend/runtime/omni/virtual/computed.go
new file mode 100644
index 000000000..34c61e22d
--- /dev/null
+++ b/internal/backend/runtime/omni/virtual/computed.go
@@ -0,0 +1,138 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package virtual
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/prometheus/client_golang/prometheus"
+	"go.uber.org/zap"
+)
+
+// Computed is a virtual state implementation which provides virtual resources which are computed on the fly
+// and cached in the in inmem.State.
+type Computed struct {
+	state          state.State
+	watchScheduler *DedupScheduler
+	activeWatches  *prometheus.GaugeVec
+	resolveID      ProducerIDTransformer
+}
+
+// ProducerIDTransformer maps the incoming resource id into some other id.
+type ProducerIDTransformer func(context.Context, resource.Pointer) (resource.Pointer, error)
+
+// NoTransform passes the resource pointer without any change.
+func NoTransform(_ context.Context, ptr resource.Pointer) (resource.Pointer, error) {
+	return ptr, nil
+}
+
+// NewComputed creates new computed state.
+func NewComputed(resourceType string, factory ProducerFactory, resolveID ProducerIDTransformer, cleanupInterval time.Duration, logger *zap.Logger) *Computed {
+	state := state.WrapCore(namespaced.NewState(inmem.Build))
+	scheduler := NewDedupScheduler(resourceType, state, factory, cleanupInterval, logger)
+
+	prometheus.DefaultRegisterer.MustRegister(scheduler)
+
+	return &Computed{
+		state:          state,
+		watchScheduler: scheduler,
+		resolveID:      resolveID,
+		activeWatches: prometheus.NewGaugeVec(prometheus.GaugeOpts{
+			Name: "omni_virtual_state_watches",
+			Help: "Number of virtual state compute watches.",
+		}, []string{
+			"type",
+			"id",
+		}),
+	}
+}
+
+// Run starts underlying watch scheduler.
+func (st *Computed) Run(ctx context.Context) {
+	st.watchScheduler.Run(ctx)
+}
+
+// Get implements state.State.
+func (st *Computed) Get(ctx context.Context, ptr resource.Pointer, _ ...state.GetOption) (resource.Resource, error) {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	watchCh := make(chan state.Event)
+
+	if err := st.Watch(ctx, ptr, watchCh); err != nil {
+		return nil, err
+	}
+
+	for {
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		case ev := <-watchCh:
+			//nolint:exhaustive
+			switch ev.Type {
+			case state.Created:
+				return ev.Resource, nil
+			case state.Destroyed:
+				// ignore
+			case state.Errored:
+				return nil, fmt.Errorf("watch errored: %w", ev.Error)
+			default:
+				return nil, fmt.Errorf("unexpected event %s", ev.Type.String())
+			}
+		}
+	}
+}
+
+// Watch implements state.State.
+func (st *Computed) Watch(ctx context.Context, ptr resource.Pointer, c chan<- state.Event, opts ...state.WatchOption) error {
+	ptr, err := st.resolveID(ctx, ptr)
+	if err != nil {
+		return fmt.Errorf("failed to resolve watch id: %w", err)
+	}
+
+	activeWatches := st.activeWatches.With(prometheus.Labels{"type": ptr.Type(), "id": ptr.ID()})
+
+	if err = st.watchScheduler.Start(ctx, ptr); err != nil {
+		return fmt.Errorf("failed to start watch: %w", err)
+	}
+
+	err = st.state.Watch(ctx, ptr, c, opts...)
+	if err != nil {
+		st.watchScheduler.Stop(ptr)
+
+		return fmt.Errorf("failed to watch inmem state: %w", err)
+	}
+
+	activeWatches.Inc()
+
+	go func() {
+		<-ctx.Done()
+
+		activeWatches.Dec()
+
+		st.watchScheduler.Stop(ptr)
+	}()
+
+	return nil
+}
+
+// Describe implements prom.Collector interface.
+func (st *Computed) Describe(ch chan<- *prometheus.Desc) {
+	prometheus.DescribeByCollect(st, ch)
+}
+
+// Collect implements prom.Collector interface.
+func (st *Computed) Collect(ch chan<- prometheus.Metric) {
+	st.activeWatches.Collect(ch)
+}
+
+var _ prometheus.Collector = &DedupScheduler{}
diff --git a/internal/backend/runtime/omni/virtual/deduper.go b/internal/backend/runtime/omni/virtual/deduper.go
new file mode 100644
index 000000000..369dcf8aa
--- /dev/null
+++ b/internal/backend/runtime/omni/virtual/deduper.go
@@ -0,0 +1,214 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package virtual
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/prometheus/client_golang/prometheus"
+	"go.uber.org/zap"
+	"golang.org/x/sync/singleflight"
+
+	"github.com/siderolabs/omni/internal/backend/logging"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/virtual/pkg/producers"
+)
+
+// ProducerFactory is a function that creates a producer.
+type ProducerFactory func(ctx context.Context, state state.State, ptr resource.Pointer, logger *zap.Logger) (producers.Producer, error)
+
+type producerWrapper struct {
+	producer producers.Producer
+	resource resource.Pointer
+	inuse    int
+	stale    bool
+}
+
+// DedupScheduler handles computed watch state producers.
+// It cleans up unused producers after defined interval
+// and deduplicates producers identified by the resource IDs.
+type DedupScheduler struct {
+	producers       map[resource.ID]*producerWrapper
+	logger          *zap.Logger
+	state           state.State
+	factory         ProducerFactory
+	activeProducers *prometheus.GaugeVec
+	sf              singleflight.Group
+	resourceType    string
+	producersMu     sync.Mutex
+	cleanupInterval time.Duration
+}
+
+// NewDedupScheduler creates new dedup scheduler instance.
+func NewDedupScheduler(resourceType string, state state.State, factory ProducerFactory, cleanupInterval time.Duration, logger *zap.Logger) *DedupScheduler {
+	return &DedupScheduler{
+		state:           state,
+		factory:         factory,
+		cleanupInterval: cleanupInterval,
+		logger:          logger.With(logging.Component("compute_watch_scheduler")),
+		producers:       map[string]*producerWrapper{},
+		resourceType:    resourceType,
+
+		activeProducers: prometheus.NewGaugeVec(prometheus.GaugeOpts{
+			Name: "omni_virtual_state_producers",
+			Help: "Number of virtual state compute producers.",
+		}, []string{
+			"type",
+		}),
+	}
+}
+
+// Run starts cleanup goroutine.
+// When stopped it shuts down all running producers.
+func (d *DedupScheduler) Run(ctx context.Context) {
+	ticker := time.NewTicker(d.cleanupInterval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		}
+
+		var producersToStop []*producerWrapper
+
+		d.producersMu.Lock()
+
+		for id, pw := range d.producers {
+			if pw.stale {
+				d.logger.Debug("stopping producer",
+					zap.String("type", pw.resource.Type()),
+					zap.String("namespace", pw.resource.Namespace()),
+					zap.String("id", pw.resource.ID()),
+				)
+
+				producersToStop = append(producersToStop, pw)
+
+				pw.producer.Stop()
+
+				if err := d.state.Destroy(ctx, pw.resource); err != nil && !state.IsNotFoundError(err) {
+					d.logger.Error("failed to cleanup resources after stopping computed watch producer",
+						zap.String("resource", fmt.Sprintf("%s/%s/%s", pw.resource.Namespace(), pw.resource.Type(), pw.resource.ID())),
+					)
+				}
+
+				delete(d.producers, id)
+			} else if pw.inuse == 0 {
+				d.producers[id].stale = true
+			}
+		}
+
+		d.producersMu.Unlock()
+
+		for _, pw := range producersToStop {
+			pw.producer.Cleanup()
+		}
+	}
+}
+
+func (d *DedupScheduler) ref(ptr resource.Pointer) bool {
+	d.producersMu.Lock()
+	defer d.producersMu.Unlock()
+
+	id := resourceID(ptr)
+
+	producer, ok := d.producers[id]
+	if ok {
+		producer.inuse++
+		producer.stale = false
+
+		return true
+	}
+
+	return false
+}
+
+func (d *DedupScheduler) unref(ptr resource.Pointer) {
+	d.producersMu.Lock()
+	defer d.producersMu.Unlock()
+
+	id := resourceID(ptr)
+
+	producer, ok := d.producers[id]
+	if ok {
+		producer.inuse--
+	}
+}
+
+// Start the producer by id.
+func (d *DedupScheduler) Start(ctx context.Context, ptr resource.Pointer) error {
+	id := resourceID(ptr)
+
+	if d.ref(ptr) {
+		return nil
+	}
+
+	ch := d.sf.DoChan(id, func() (any, error) {
+		d.logger.Debug("starting producer", zap.String("type", ptr.Type()), zap.String("id", ptr.ID()))
+
+		p, err := d.factory(ctx, d.state, ptr, d.logger)
+		if err != nil {
+			return nil, err
+		}
+
+		if err = p.Start(); err != nil {
+			return nil, err
+		}
+
+		d.producersMu.Lock()
+		defer d.producersMu.Unlock()
+
+		d.producers[id] = &producerWrapper{
+			producer: p,
+			resource: ptr,
+		}
+
+		return nil, nil //nolint:nilnil
+	})
+
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case v := <-ch:
+		if v.Err != nil {
+			return v.Err
+		}
+
+		d.ref(ptr)
+
+		return nil
+	}
+}
+
+// Stop the producer by id.
+func (d *DedupScheduler) Stop(ptr resource.Pointer) {
+	d.unref(ptr)
+}
+
+// Describe implements prom.Collector interface.
+func (d *DedupScheduler) Describe(ch chan<- *prometheus.Desc) {
+	prometheus.DescribeByCollect(d, ch)
+}
+
+// Collect implements prom.Collector interface.
+func (d *DedupScheduler) Collect(ch chan<- prometheus.Metric) {
+	d.producersMu.Lock()
+	defer d.producersMu.Unlock()
+
+	d.activeProducers.With(prometheus.Labels{"type": d.resourceType}).Set(float64(len(d.producers)))
+	d.activeProducers.Collect(ch)
+}
+
+func resourceID(ptr resource.Pointer) string {
+	return fmt.Sprintf("%s/%s", ptr.Namespace(), ptr.ID())
+}
+
+var _ prometheus.Collector = &DedupScheduler{}
diff --git a/internal/backend/runtime/omni/virtual/errors.go b/internal/backend/runtime/omni/virtual/errors.go
new file mode 100644
index 000000000..8590528ac
--- /dev/null
+++ b/internal/backend/runtime/omni/virtual/errors.go
@@ -0,0 +1,47 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package virtual
+
+import (
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+type eNotFound struct {
+	error
+}
+
+func (eNotFound) NotFoundError() {}
+
+func errNotFound(r resource.Pointer) error {
+	return eNotFound{
+		fmt.Errorf("resource %s doesn't exist", r),
+	}
+}
+
+type eUnsupported struct {
+	error
+}
+
+func (e eUnsupported) GRPCStatus() *status.Status {
+	// if the wrapped error is already a status error, return it
+	if sts, ok := status.FromError(e.error); ok {
+		return sts
+	}
+
+	return status.New(codes.Unimplemented, e.Error())
+}
+
+func (eUnsupported) UnsupportedError() {}
+
+func errUnsupported(err error) error {
+	return eUnsupported{
+		err,
+	}
+}
diff --git a/internal/backend/runtime/omni/virtual/pkg/producers/kubernetes_usage.go b/internal/backend/runtime/omni/virtual/pkg/producers/kubernetes_usage.go
new file mode 100644
index 000000000..27f928e70
--- /dev/null
+++ b/internal/backend/runtime/omni/virtual/pkg/producers/kubernetes_usage.go
@@ -0,0 +1,264 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package producers
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"sync/atomic"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/informers"
+	"k8s.io/client-go/tools/cache"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/virtual"
+	"github.com/siderolabs/omni/internal/backend/logging"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime/kubernetes"
+	resourcehelper "github.com/siderolabs/omni/internal/pkg/kubernetes/resource"
+)
+
+type kubernetesUsagePointer struct {
+	resource.Pointer
+	id string
+}
+
+func (c *kubernetesUsagePointer) ID() resource.ID {
+	return c.id
+}
+
+func (c *kubernetesUsagePointer) ClusterName() string {
+	return c.Pointer.ID()
+}
+
+// KubernetesUsageResourceTransformer adds cluster uuid to the resource ID to guarantee unique watch id for each cluster generation.
+func KubernetesUsageResourceTransformer(state state.State) func(context.Context, resource.Pointer) (resource.Pointer, error) {
+	return func(ctx context.Context, ptr resource.Pointer) (resource.Pointer, error) {
+		uuid, err := safe.ReaderGetByID[*omni.ClusterUUID](ctx, state, ptr.ID())
+		if err != nil {
+			return nil, err
+		}
+
+		return &kubernetesUsagePointer{
+			Pointer: ptr,
+			id:      ptr.ID() + "/" + uuid.TypedSpec().Value.Uuid,
+		}, nil
+	}
+}
+
+// KubernetesUsage producer.
+type KubernetesUsage struct {
+	logger  *zap.Logger
+	ptr     resource.Pointer
+	state   state.State
+	factory informers.SharedInformerFactory
+	stopCh  chan struct{}
+	wg      sync.WaitGroup
+}
+
+// NewKubernetesUsage starts virtual watch on the KubernetesUsage resource.
+// The resource is computed from the multiple Kubernetes watches.
+func NewKubernetesUsage(ctx context.Context, state state.State, ptr resource.Pointer, logger *zap.Logger) (Producer, error) {
+	type kubernetesClient interface {
+		GetClient(ctx context.Context, cluster string) (*kubernetes.Client, error)
+	}
+
+	r, err := runtime.LookupInterface[kubernetesClient](kubernetes.Name)
+	if err != nil {
+		return nil, err
+	}
+
+	p, ok := ptr.(*kubernetesUsagePointer)
+	if !ok {
+		return nil, errors.New("failed to get kubernetes client: cluster name can not be resolved")
+	}
+
+	client, err := r.GetClient(ctx, p.ClusterName())
+	if err != nil {
+		return nil, err
+	}
+
+	factory := informers.NewSharedInformerFactory(client.Clientset(), 0)
+
+	return &KubernetesUsage{
+		ptr:     ptr,
+		factory: factory,
+		stopCh:  make(chan struct{}),
+		logger:  logger.With(logging.Component("compute_kubernetes_usage")),
+		state:   state,
+	}, nil
+}
+
+// Start implements Producer interface.
+func (ku *KubernetesUsage) Start() error {
+	var synced atomic.Bool
+
+	sync := func() {
+		if !synced.Load() {
+			return
+		}
+
+		var (
+			nodes []*corev1.Node
+			pods  []*corev1.Pod
+			err   error
+		)
+
+		nodes, err = ku.factory.Core().V1().Nodes().Lister().List(labels.Everything())
+		if err != nil {
+			ku.logger.Error("failed to list nodes", zap.Error(err))
+
+			return
+		}
+
+		pods, err = ku.factory.Core().V1().Pods().Lister().List(labels.Everything())
+		if err != nil {
+			ku.logger.Error("failed to list pods", zap.Error(err))
+
+			return
+		}
+
+		usage := virtual.NewKubernetesUsage(ku.ptr.Namespace(), ku.ptr.ID())
+
+		calculateUsage(pods, nodes, usage)
+
+		_, err = safe.StateUpdateWithConflicts[*virtual.KubernetesUsage](context.Background(), ku.state, usage.Metadata(), func(res *virtual.KubernetesUsage) error {
+			res.TypedSpec().Value = usage.TypedSpec().Value
+
+			return nil
+		})
+
+		if state.IsNotFoundError(err) {
+			err = ku.state.Create(context.Background(), usage)
+		}
+
+		if err != nil {
+			ku.logger.Error("failed to update usage", zap.Error(err))
+		}
+	}
+
+	if _, err := ku.factory.Core().V1().Nodes().Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    func(_ any) { sync() },
+		UpdateFunc: func(_ any, _ any) { sync() },
+		DeleteFunc: func(_ any) { sync() },
+	}); err != nil {
+		return err
+	}
+
+	if _, err := ku.factory.Core().V1().Pods().Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{
+		AddFunc:    func(_ any) { sync() },
+		UpdateFunc: func(_ any, _ any) { sync() },
+		DeleteFunc: func(_ any) { sync() },
+	}); err != nil {
+		return err
+	}
+
+	ku.factory.Start(ku.stopCh)
+
+	ku.wg.Add(2)
+
+	go func() {
+		defer ku.wg.Done()
+
+		ku.factory.WaitForCacheSync(ku.stopCh)
+
+		select {
+		case <-ku.stopCh:
+			// stopped
+			return
+		default:
+		}
+
+		synced.Store(true)
+
+		sync()
+	}()
+
+	go func() {
+		defer ku.wg.Done()
+
+		<-ku.stopCh
+
+		synced.Store(false)
+
+		ku.factory.Shutdown()
+	}()
+
+	return nil
+}
+
+// Stop implements Producer interface.
+func (ku *KubernetesUsage) Stop() {
+	close(ku.stopCh)
+}
+
+// Cleanup implements Producer interface.
+func (ku *KubernetesUsage) Cleanup() {
+	ku.wg.Wait()
+}
+
+// calculateUsage computes pod usage for the cluster.
+func calculateUsage(pods []*corev1.Pod, nodes []*corev1.Node, usage *virtual.KubernetesUsage) {
+	spec := usage.TypedSpec().Value
+
+	if spec.Cpu == nil {
+		spec.Cpu = &specs.KubernetesUsageSpec_Quantity{}
+	}
+
+	if spec.Mem == nil {
+		spec.Mem = &specs.KubernetesUsageSpec_Quantity{}
+	}
+
+	if spec.Storage == nil {
+		spec.Storage = &specs.KubernetesUsageSpec_Quantity{}
+	}
+
+	if spec.Pods == nil {
+		spec.Pods = &specs.KubernetesUsageSpec_Pod{}
+	}
+
+	spec.Pods.Count = int32(len(pods))
+
+	spec.Cpu.Limits = 0
+	spec.Mem.Limits = 0
+	spec.Storage.Limits = 0
+
+	spec.Cpu.Requests = 0
+	spec.Mem.Requests = 0
+	spec.Storage.Requests = 0
+
+	for _, pod := range pods {
+		requests, limits := resourcehelper.PodRequestsAndLimits(pod)
+
+		spec.Cpu.Limits += limits.Cpu().AsApproximateFloat64()
+		spec.Mem.Limits += limits.Memory().AsApproximateFloat64()
+		spec.Storage.Limits += limits.StorageEphemeral().AsApproximateFloat64()
+
+		spec.Cpu.Requests += requests.Cpu().AsApproximateFloat64()
+		spec.Mem.Requests += requests.Memory().AsApproximateFloat64()
+		spec.Storage.Requests += requests.StorageEphemeral().AsApproximateFloat64()
+	}
+
+	spec.Cpu.Capacity = 0
+	spec.Mem.Capacity = 0
+	spec.Storage.Capacity = 0
+	spec.Pods.Capacity = 0
+
+	for _, node := range nodes {
+		spec.Cpu.Capacity += node.Status.Capacity.Cpu().AsApproximateFloat64()
+		spec.Mem.Capacity += node.Status.Capacity.Memory().AsApproximateFloat64()
+		spec.Storage.Capacity += node.Status.Allocatable.StorageEphemeral().AsApproximateFloat64()
+		spec.Pods.Capacity += int32(node.Status.Capacity.Pods().Value())
+	}
+}
diff --git a/internal/backend/runtime/omni/virtual/pkg/producers/producers.go b/internal/backend/runtime/omni/virtual/pkg/producers/producers.go
new file mode 100644
index 000000000..44e7fde1f
--- /dev/null
+++ b/internal/backend/runtime/omni/virtual/pkg/producers/producers.go
@@ -0,0 +1,14 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package producers contains different resource kinds watch implementations.
+package producers
+
+// Producer computes virtual resource and puts it to the inmem cache.
+type Producer interface {
+	Start() error
+	Stop()
+	Cleanup()
+}
diff --git a/internal/backend/runtime/omni/virtual/state.go b/internal/backend/runtime/omni/virtual/state.go
new file mode 100644
index 000000000..dc8851f8e
--- /dev/null
+++ b/internal/backend/runtime/omni/virtual/state.go
@@ -0,0 +1,261 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package virtual provides a virtual state implementation.
+package virtual
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	authres "github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/virtual"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/accesspolicy"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+)
+
+// State is a virtual state implementation which provides virtual resources.
+// Virtual resources are not stored in the backend, but are generated on the fly.
+// They also do not behave like regular resources; for example, their content might differ, according to the caller/context.
+type State struct {
+	PrimaryState state.State
+
+	computed map[resource.Type]*Computed
+}
+
+// NewState creates new virtual state instance.
+func NewState(state state.State) *State {
+	return &State{
+		PrimaryState: state,
+		computed:     map[resource.Type]*Computed{},
+	}
+}
+
+// RunComputed starts a new computed producer on the virtual state
+// which runs until the context is canceled.
+func (v *State) RunComputed(ctx context.Context, t resource.Type, factory ProducerFactory, resolveID ProducerIDTransformer, logger *zap.Logger) {
+	st := NewComputed(t, factory, resolveID, time.Minute, logger)
+
+	v.computed[t] = st
+
+	st.Run(ctx)
+}
+
+// Get implements state.CoreState.
+func (v *State) Get(ctx context.Context, ptr resource.Pointer, opts ...state.GetOption) (resource.Resource, error) {
+	if len(opts) > 0 {
+		return nil, errUnsupported(errors.New("no get options are supported"))
+	}
+
+	if err := v.validateKind(ptr); err != nil {
+		return nil, err
+	}
+
+	computed, ok := v.computed[ptr.Type()]
+	if ok {
+		return computed.Get(ctx, ptr, opts...)
+	}
+
+	switch ptr.Type() {
+	case virtual.CurrentUserType:
+		if ptr.ID() != virtual.CurrentUserID {
+			return nil, errNotFound(ptr)
+		}
+
+		return v.currentUser(ctx)
+	case virtual.PermissionsType:
+		return v.permissions(ctx)
+	case virtual.ClusterPermissionsType:
+		return v.clusterPermissions(ctx, ptr)
+	default:
+		return nil, errUnsupported(fmt.Errorf("unsupported resource type for get %q", ptr.Type()))
+	}
+}
+
+// List implements state.CoreState.
+func (v *State) List(ctx context.Context, kind resource.Kind, opts ...state.ListOption) (resource.List, error) {
+	if len(opts) > 0 {
+		return resource.List{}, errUnsupported(errors.New("no list options are supported"))
+	}
+
+	if err := v.validateKind(kind); err != nil {
+		return resource.List{}, err
+	}
+
+	switch kind.Type() {
+	case virtual.CurrentUserType:
+		user, err := v.currentUser(ctx)
+		if err != nil {
+			return resource.List{}, err
+		}
+
+		return resource.List{Items: []resource.Resource{user}}, nil
+	case virtual.PermissionsType:
+		permissions, err := v.permissions(ctx)
+		if err != nil {
+			return resource.List{}, err
+		}
+
+		return resource.List{Items: []resource.Resource{permissions}}, nil
+	default:
+		return resource.List{}, errUnsupported(fmt.Errorf("unsupported resource type for list %q", kind.Type()))
+	}
+}
+
+// Create implements state.CoreState.
+func (v *State) Create(_ context.Context, _ resource.Resource, _ ...state.CreateOption) error {
+	return errUnsupported(errors.New("create is not supported"))
+}
+
+// Update implements state.CoreState.
+func (v *State) Update(_ context.Context, _ resource.Resource, _ ...state.UpdateOption) error {
+	return errUnsupported(errors.New("update is not supported"))
+}
+
+// Destroy implements state.CoreState.
+func (v *State) Destroy(_ context.Context, _ resource.Pointer, _ ...state.DestroyOption) error {
+	return errUnsupported(errors.New("destroy is not supported"))
+}
+
+// Watch implements state.CoreState.
+func (v *State) Watch(ctx context.Context, ptr resource.Pointer, c chan<- state.Event, opts ...state.WatchOption) error {
+	computed, ok := v.computed[ptr.Type()]
+	if ok {
+		return computed.Watch(ctx, ptr, c, opts...)
+	}
+
+	return errUnsupported(fmt.Errorf("unsupported resource type for watch %q", ptr.Type()))
+}
+
+// WatchKind implements state.CoreState.
+func (v *State) WatchKind(_ context.Context, ptr resource.Kind, _ chan<- state.Event, _ ...state.WatchKindOption) error {
+	return errUnsupported(fmt.Errorf("unsupported resource type for watch kind %q", ptr.Type()))
+}
+
+// WatchKindAggregated implements state.CoreState.
+func (v *State) WatchKindAggregated(_ context.Context, _ resource.Kind, _ chan<- []state.Event, _ ...state.WatchKindOption) error {
+	return errUnsupported(errors.New("watch kind aggregated is not supported"))
+}
+
+func (v *State) validateKind(kind resource.Kind) error {
+	if kind.Namespace() != resources.VirtualNamespace {
+		return errUnsupported(fmt.Errorf("unsupported namespace: %s", kind.Namespace()))
+	}
+
+	return nil
+}
+
+func (v *State) currentUser(ctx context.Context) (*virtual.CurrentUser, error) {
+	identity, _ := ctx.Value(auth.IdentityContextKey{}).(string) //nolint:errcheck
+
+	userRole, userRoleExists := ctx.Value(auth.RoleContextKey{}).(role.Role)
+	if !userRoleExists {
+		userRole = role.None
+	}
+
+	user := virtual.NewCurrentUser()
+
+	user.TypedSpec().Value.Identity = identity
+	user.TypedSpec().Value.Role = string(userRole)
+
+	version, err := resource.ParseVersion("1")
+	if err != nil {
+		return nil, err
+	}
+
+	user.Metadata().SetVersion(version)
+
+	return user, nil
+}
+
+func (v *State) permissions(ctx context.Context) (*virtual.Permissions, error) {
+	userRole, userRoleExists := ctx.Value(auth.RoleContextKey{}).(role.Role)
+	if !userRoleExists {
+		userRole = role.None
+	}
+
+	permissions := virtual.NewPermissions()
+
+	if userRole.Check(role.Reader) == nil {
+		permissions.TypedSpec().Value.CanReadMachineConfigPatches = true
+		permissions.TypedSpec().Value.CanReadMachineLogs = true
+		permissions.TypedSpec().Value.CanReadClusters = true
+		permissions.TypedSpec().Value.CanReadMachines = true
+	}
+
+	if userRole.Check(role.Operator) == nil {
+		permissions.TypedSpec().Value.CanRemoveMachines = true
+		permissions.TypedSpec().Value.CanCreateClusters = true
+		permissions.TypedSpec().Value.CanManageMachineConfigPatches = true
+	}
+
+	if userRole.Check(role.Admin) == nil {
+		permissions.TypedSpec().Value.CanManageUsers = userRole.Check(role.Admin) == nil
+		permissions.TypedSpec().Value.CanManageBackupStore = userRole.Check(role.Admin) == nil
+	}
+
+	if !permissions.TypedSpec().Value.CanCreateClusters {
+		_, err := safe.StateGet[*authres.AccessPolicy](ctx, v.PrimaryState, authres.NewAccessPolicy().Metadata())
+		if err == nil {
+			// if there is an access policy, we assume user can create clusters - we do the actual check on creation time by id, selectors, etc.
+			permissions.TypedSpec().Value.CanCreateClusters = true
+		} else if !state.IsNotFoundError(err) {
+			return nil, err
+		}
+	}
+
+	version, err := resource.ParseVersion("1")
+	if err != nil {
+		return nil, err
+	}
+
+	permissions.Metadata().SetVersion(version)
+
+	return permissions, nil
+}
+
+func (v *State) clusterPermissions(ctx context.Context, ptr resource.Pointer) (*virtual.ClusterPermissions, error) {
+	userRole, _, err := accesspolicy.RoleForCluster(ctx, ptr.ID(), v.PrimaryState)
+	if err != nil {
+		return nil, err
+	}
+
+	clusterPermissions := virtual.NewClusterPermissions(ptr.ID())
+
+	if userRole.Check(role.Reader) == nil {
+		clusterPermissions.TypedSpec().Value.CanRebootMachines = true
+		clusterPermissions.TypedSpec().Value.CanDownloadKubeconfig = true
+		clusterPermissions.TypedSpec().Value.CanDownloadTalosconfig = true
+		clusterPermissions.TypedSpec().Value.CanReadConfigPatches = true
+	}
+
+	if userRole.Check(role.Operator) == nil {
+		clusterPermissions.TypedSpec().Value.CanAddMachines = true
+		clusterPermissions.TypedSpec().Value.CanRemoveMachines = true
+		clusterPermissions.TypedSpec().Value.CanUpdateKubernetes = true
+		clusterPermissions.TypedSpec().Value.CanUpdateTalos = true
+		clusterPermissions.TypedSpec().Value.CanManageConfigPatches = true
+		clusterPermissions.TypedSpec().Value.CanSyncKubernetesManifests = true
+		clusterPermissions.TypedSpec().Value.CanManageClusterFeatures = true
+	}
+
+	version, err := resource.ParseVersion("1")
+	if err != nil {
+		return nil, err
+	}
+
+	clusterPermissions.Metadata().SetVersion(version)
+
+	return clusterPermissions, nil
+}
diff --git a/internal/backend/runtime/omni/virtual/state_test.go b/internal/backend/runtime/omni/virtual/state_test.go
new file mode 100644
index 000000000..31f390df1
--- /dev/null
+++ b/internal/backend/runtime/omni/virtual/state_test.go
@@ -0,0 +1,243 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package virtual_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/siderolabs/gen/channel"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest"
+	"golang.org/x/sync/errgroup"
+
+	virtualres "github.com/siderolabs/omni/client/pkg/omni/resources/virtual"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/virtual"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni/virtual/pkg/producers"
+)
+
+type mockProducer struct {
+	startCh chan struct{}
+	stopCh  chan struct{}
+	updates chan resource.Resource
+	state   state.State
+}
+
+func (p *mockProducer) Start() error {
+	p.startCh <- struct{}{}
+
+	go func() {
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+
+		for {
+			select {
+			case <-p.stopCh:
+				return
+			case res := <-p.updates:
+				cur, err := p.state.Get(ctx, res.Metadata())
+				if err != nil {
+					if !state.IsNotFoundError(err) {
+						return
+					}
+
+					if err = p.state.Create(ctx, res); err != nil {
+						return
+					}
+				}
+
+				*res.Metadata() = *cur.Metadata()
+
+				if err = p.state.Update(ctx, res); err != nil {
+					return
+				}
+			}
+		}
+	}()
+
+	return nil
+}
+
+func (p *mockProducer) Stop() {
+	close(p.stopCh)
+}
+
+func (p *mockProducer) Cleanup() {}
+
+func TestComputed(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+
+	mp := mockProducer{
+		startCh: make(chan struct{}, 1),
+		stopCh:  make(chan struct{}, 1),
+		updates: make(chan resource.Resource),
+	}
+
+	calls := 0
+
+	newProducer := func(ctx context.Context, state state.State, _ resource.Pointer, _ *zap.Logger) (producers.Producer, error) {
+		calls++
+
+		if calls > 1 {
+			return nil, errors.New("failed to create producer")
+		}
+
+		cu := virtualres.NewCurrentUser()
+		cu.TypedSpec().Value.Identity = "a@a.com"
+
+		if err := state.Create(ctx, cu); err != nil {
+			return nil, err
+		}
+
+		mp.state = state
+
+		return &mp, nil
+	}
+
+	st := virtual.NewComputed(virtualres.CurrentUserType, newProducer, virtual.NoTransform, time.Second, zaptest.NewLogger(t))
+
+	var eg errgroup.Group
+
+	eg.Go(func() error {
+		st.Run(ctx)
+
+		return nil
+	})
+
+	eg.Go(func() error {
+		select {
+		case <-time.After(time.Second):
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+
+		cu := virtualres.NewCurrentUser()
+		cu.TypedSpec().Value.Identity = "a@b.com"
+
+		if !channel.SendWithContext(ctx, mp.updates, resource.Resource(cu)) {
+			return ctx.Err()
+		}
+
+		return nil
+	})
+
+	require := require.New(t)
+
+	_, err := st.Get(ctx, virtualres.NewCurrentUser().Metadata())
+	require.NoError(err)
+
+	events := make(chan state.Event)
+
+	err = st.Watch(ctx, virtualres.NewCurrentUser().Metadata(), events)
+	require.NoError(err)
+
+	updated := 0
+	created := 0
+
+	for {
+		select {
+		case <-ctx.Done():
+			require.FailNow("timed out waiting for create and update events")
+		case event := <-events:
+			//nolint:exhaustive
+			switch event.Type {
+			case state.Created:
+				created++
+			case state.Updated:
+				updated++
+			default:
+				require.FailNowf("unexpected event %s", event.Type.String())
+			}
+		}
+
+		if created == 1 && updated == 1 {
+			break
+		}
+	}
+
+	cancel()
+
+	require.NoError(eg.Wait())
+}
+
+func TestDeduper(t *testing.T) {
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+
+	mp := mockProducer{
+		startCh: make(chan struct{}, 1),
+		stopCh:  make(chan struct{}, 1),
+	}
+
+	calls := 0
+
+	newProducer := func(ctx context.Context, state state.State, _ resource.Pointer, _ *zap.Logger) (producers.Producer, error) {
+		calls++
+
+		if calls > 1 {
+			return nil, errors.New("failed to create producer")
+		}
+
+		cu := virtualres.NewCurrentUser()
+		cu.TypedSpec().Value.Identity = "a@a.com"
+
+		if err := state.Create(ctx, cu); err != nil {
+			return nil, err
+		}
+
+		return &mp, nil
+	}
+
+	dedup := virtual.NewDedupScheduler(virtualres.CurrentUserType, st, newProducer, time.Millisecond*500, zaptest.NewLogger(t))
+
+	var eg errgroup.Group
+
+	eg.Go(func() error {
+		dedup.Run(ctx)
+
+		return nil
+	})
+
+	md := virtualres.NewCurrentUser().Metadata()
+
+	require := require.New(t)
+
+	require.NoError(dedup.Start(ctx, md))
+	require.NoError(dedup.Start(ctx, md))
+
+	_, err := st.Get(ctx, md)
+
+	require.NoError(err)
+
+	select {
+	case <-mp.startCh:
+	case <-time.After(time.Second):
+		require.FailNow("the producer is not started after 1 second")
+	}
+
+	dedup.Stop(md)
+	dedup.Stop(md)
+
+	select {
+	case <-mp.stopCh:
+	case <-ctx.Done():
+		require.FailNow("the producer is not stopped")
+	}
+
+	cancel()
+
+	require.NoError(eg.Wait())
+}
diff --git a/internal/backend/runtime/options.go b/internal/backend/runtime/options.go
new file mode 100644
index 000000000..bddaacf06
--- /dev/null
+++ b/internal/backend/runtime/options.go
@@ -0,0 +1,146 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package runtime
+
+import "strings"
+
+// QueryOptions List and Get query options.
+type QueryOptions struct {
+	Namespace      string
+	Name           string
+	Context        string
+	Resource       string
+	FieldSelector  string
+	CurrentVersion string
+	SortField      string
+	SearchFor      []string
+	Nodes          []string
+	LabelSelectors []string
+	SortDescending bool
+	TeardownOnly   bool
+	TailEvents     int
+	Offset         int
+	Limit          int
+}
+
+// NewQueryOptions creates new QueryOptions.
+func NewQueryOptions(setters ...QueryOption) *QueryOptions {
+	o := &QueryOptions{}
+
+	for _, s := range setters {
+		s(o)
+	}
+
+	return o
+}
+
+// QueryOption defines variable input option for List and Get methods in the Runtime implementations.
+type QueryOption func(*QueryOptions)
+
+// WithNamespace enables filtering by namespace.
+func WithNamespace(namespace string) QueryOption {
+	return func(o *QueryOptions) {
+		o.Namespace = namespace
+	}
+}
+
+// WithName enables filtering by resource name.
+func WithName(name string) QueryOption {
+	return func(o *QueryOptions) {
+		o.Name = name
+	}
+}
+
+// WithLabelSelectors enables filtering by label.
+func WithLabelSelectors(selectors ...string) QueryOption {
+	return func(o *QueryOptions) {
+		var labelSelectors []string
+
+		for _, s := range selectors {
+			labelSelectors = append(labelSelectors, strings.Split(s, ";")...)
+		}
+
+		o.LabelSelectors = labelSelectors
+	}
+}
+
+// WithFieldSelector enables filtering by field.
+func WithFieldSelector(selector string) QueryOption {
+	return func(o *QueryOptions) {
+		o.FieldSelector = selector
+	}
+}
+
+// WithContext routes the request to a specific context.
+func WithContext(name string) QueryOption {
+	return func(o *QueryOptions) {
+		o.Context = name
+	}
+}
+
+// WithResource explicitly specifies the resource type to get from the runtime.
+func WithResource(resource string) QueryOption {
+	return func(o *QueryOptions) {
+		o.Resource = resource
+	}
+}
+
+// WithNodes explicitly defines nodes list to use for the request (Talos only).
+func WithNodes(nodes ...string) QueryOption {
+	return func(o *QueryOptions) {
+		o.Nodes = nodes
+	}
+}
+
+// WithCurrentVersion pass current version to the update call to avoid conflicts (only for update, Omni only).
+func WithCurrentVersion(version string) QueryOption {
+	return func(o *QueryOptions) {
+		o.CurrentVersion = version
+	}
+}
+
+// WithTailEvents requests resource backlog instead of the latest resource state.
+func WithTailEvents(count int) QueryOption {
+	return func(o *QueryOptions) {
+		o.TailEvents = count
+	}
+}
+
+// WithLimit limits the number of returned items.
+func WithLimit(limit int) QueryOption {
+	return func(o *QueryOptions) {
+		o.Limit = limit
+	}
+}
+
+// WithOffset skips the number of returned items.
+func WithOffset(offset int) QueryOption {
+	return func(o *QueryOptions) {
+		o.Offset = offset
+	}
+}
+
+// WithSort enables sorting by field.
+func WithSort(field string, descending bool) QueryOption {
+	return func(o *QueryOptions) {
+		o.SortField = field
+		o.SortDescending = descending
+	}
+}
+
+// WithSearchFor enables field search.
+func WithSearchFor(searchFor []string) QueryOption {
+	return func(o *QueryOptions) {
+		o.SearchFor = searchFor
+	}
+}
+
+// WithTeardownOnly makes delete run teardown only (COSI only).
+func WithTeardownOnly() QueryOption {
+	return func(o *QueryOptions) {
+		o.TeardownOnly = true
+	}
+}
diff --git a/internal/backend/runtime/proxy_runtime.go b/internal/backend/runtime/proxy_runtime.go
new file mode 100644
index 000000000..0ed5c3837
--- /dev/null
+++ b/internal/backend/runtime/proxy_runtime.go
@@ -0,0 +1,347 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package runtime
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/siderolabs/gen/channel"
+	"github.com/siderolabs/gen/pair"
+	"github.com/siderolabs/gen/pair/ordered"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/siderolabs/omni/client/api/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/runtime"
+)
+
+type proxyRuntime struct{ Runtime }
+
+func (p *proxyRuntime) Watch(ctx context.Context, responses chan<- WatchResponse, option ...QueryOption) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	var group errgroup.Group
+
+	opts := NewQueryOptions(option...)
+	cmp := MakeWatchResponseComparator(opts.SortField, opts.SortDescending)
+	ch := make(chan WatchResponse)
+	produce := watchResponseProducer(responses, opts, cmp)
+
+	group.Go(func() error {
+		defer cancel()
+
+		slc, err := takeSorted(ctx, ch, cmp)
+		if err != nil {
+			return err
+		}
+
+		for _, ev := range slc {
+			if ok, err := produce(ctx, ev); !ok {
+				return err
+			}
+		}
+
+		for {
+			select {
+			case <-ctx.Done():
+				return nil
+			case ev := <-ch:
+				if ok, err := produce(ctx, ev); !ok {
+					return err
+				}
+			}
+		}
+	})
+
+	group.Go(func() error {
+		defer cancel()
+
+		return p.Runtime.Watch(ctx, ch, option...)
+	})
+
+	return group.Wait()
+}
+
+func watchResponseProducer(
+	responses chan<- WatchResponse,
+	opts *QueryOptions,
+	cmp WatchResponseComparator,
+) func(ctx context.Context, wr WatchResponse) (bool, error) {
+	offsetLimiter := MakeStreamOffsetLimiter(opts.Offset, opts.Limit, safeCmp(cmp, cmpNamespaceID[WatchResponse]))
+	total := int32(0)
+
+	return func(ctx context.Context, wr WatchResponse) (bool, error) {
+		if !match(wr, opts.SearchFor) {
+			return true, nil
+		}
+
+		wr.Unwrap().Total = changeTotal(wr, &total)
+
+		if wr.Namespace() != "" && wr.ID() != "" {
+			if !offsetLimiter.Check(wr) {
+				return true, nil
+			}
+		}
+
+		err := fill(wr, opts.SortField, opts.SortDescending)
+		if err != nil {
+			return false, err
+		}
+
+		if !channel.SendWithContext(ctx, responses, wr) {
+			return false, nil
+		}
+
+		return true, nil
+	}
+}
+
+func match(ev runtime.Matcher, searchFor []string) bool {
+	return len(searchFor) == 0 ||
+		slices.IndexFunc(searchFor, func(searchFor string) bool { return ev.Match(searchFor) }) != -1
+}
+
+func fill(r WatchResponse, field string, desc bool) error {
+	if r.Namespace() == "" || r.ID() == "" {
+		return nil
+	}
+
+	fieldData, err := getField(r, field)
+	if err != nil {
+		return err
+	}
+
+	// Mutating things is not a good idea, but we have to do it here.
+	// In futre - make WatchResponse an internal type, and convert it to grpc in outer layer.
+	u := r.Unwrap()
+	u.SortFieldData = fieldData
+	u.SortDescending = desc
+
+	return nil
+}
+
+func changeTotal(ev WatchResponse, total *int32) int32 {
+	switch EventType(ev) { //nolint:exhaustive
+	case resources.EventType_CREATED:
+		*total++
+	case resources.EventType_DESTROYED:
+		*total--
+	}
+
+	return *total
+}
+
+func takeSorted(ctx context.Context, ch chan WatchResponse, cmp WatchResponseComparator) ([]WatchResponse, error) {
+	slc, ok := takeUntil(ctx, ch, func(ev WatchResponse) bool { return EventType(ev) == resources.EventType_BOOTSTRAPPED })
+	if !ok {
+		if ctx.Err() != nil {
+			return nil, ctx.Err()
+		}
+
+		return nil, errors.New("failed to take data until BOOTSTRAPPED event")
+	}
+
+	err := SortResponses(slc, cmp)
+	if err != nil {
+		return nil, err
+	}
+
+	return slc, nil
+}
+
+func (p *proxyRuntime) List(ctx context.Context, option ...QueryOption) (ListResult, error) {
+	res, err := p.Runtime.List(ctx, option...)
+	if err != nil {
+		return ListResult{}, err
+	}
+
+	opts := NewQueryOptions(option...)
+	cmp := MakeFieldComparator(opts.SortField, opts.SortDescending, getField, cmpNamespaceID[fielder])
+
+	res = res.Filter(func(m runtime.ListItem) bool { return match(m, opts.SearchFor) })
+
+	err = res.SortInPlace(func(a, b runtime.ListItem) (int, error) { return cmp(a, b) })
+	if err != nil {
+		return ListResult{}, err
+	}
+
+	res = res.Slice(opts.Offset, opts.Limit)
+
+	return res, nil
+}
+
+// Unwrap returns the underlying runtime.
+func (p *proxyRuntime) Unwrap() Runtime {
+	return p.Runtime
+}
+
+func takeUntil[T any](ctx context.Context, ch <-chan T, f func(v T) bool) ([]T, bool) {
+	var res []T
+
+	for {
+		select {
+		case <-ctx.Done():
+			return res, false
+		case v, ok := <-ch:
+			if !ok {
+				return res, false
+			}
+
+			res = append(res, v)
+
+			if f(v) {
+				return res, true
+			}
+		}
+	}
+}
+
+// SortResponses sorts the slice of WatchResponse in a safe way.
+func SortResponses(slc []WatchResponse, cmp WatchResponseComparator) error {
+	return unsafeSort(slc, cmp)
+}
+
+// WatchResponseComparator is a comparator for WatchResponse.
+type WatchResponseComparator func(a, b WatchResponse) (int, error)
+
+// MakeWatchResponseComparator returns a comparator for WatchResponse.
+func MakeWatchResponseComparator(field string, descending bool) WatchResponseComparator {
+	if field == "" {
+		field = "id"
+	}
+
+	cmp := MakeFieldComparator(field, descending, getField, cmpNamespaceID[fielder])
+
+	return func(a, b WatchResponse) (int, error) {
+		// BOOTSTRAPPED event should always be the last.
+		switch pair.MakePair(EventType(a) == resources.EventType_BOOTSTRAPPED, EventType(b) == resources.EventType_BOOTSTRAPPED) {
+		case pair.MakePair(true, false):
+			return +1, nil
+		case pair.MakePair(false, true):
+			return -1, nil
+		case pair.MakePair(true, true):
+			return 0, nil
+		}
+
+		return cmp(a, b)
+	}
+}
+
+type customError struct{ error }
+
+func unsafeSort[T any](slc []T, cmp func(a, b T) (int, error)) (err error) {
+	if len(slc) == 0 {
+		return nil
+	}
+
+	if len(slc) == 1 {
+		// Compare it with itself to check if it's possible to compare.
+		_, err = cmp(slc[0], slc[0])
+		if err != nil {
+			return err
+		}
+	}
+
+	defer func() {
+		if r := recover(); r != nil {
+			if pnc, ok := r.(*customError); ok {
+				err = pnc
+
+				return
+			}
+
+			panic(err)
+		}
+	}()
+
+	slices.SortFunc(slc, func(a, b T) int {
+		res, err := cmp(a, b)
+		if err != nil {
+			panic(&customError{err})
+		}
+
+		return res
+	})
+
+	return nil
+}
+
+type fielder interface {
+	idNamespace
+	Field(string) (string, bool)
+}
+
+func getField(wr fielder, field string) (string, error) {
+	res, ok := wr.Field(field)
+	if !ok {
+		return "", fmt.Errorf("failed to sort: field %q for element %q not found", field, wr.ID())
+	}
+
+	return res, nil
+}
+
+func safeCmp[T any](unsafeCmp func(a, b T) (int, error), cmp func(a, b T) int) func(a, b T) int {
+	return func(a, b T) (result int) {
+		res, err := unsafeCmp(a, b)
+		if err != nil {
+			return cmp(a, b)
+		}
+
+		return res
+	}
+}
+
+type idNamespace interface {
+	ID() string
+	Namespace() string
+}
+
+func cmpNamespaceID[T idNamespace](a, b T) int {
+	left := ordered.MakePair(a.Namespace(), a.ID())
+	right := ordered.MakePair(b.Namespace(), b.ID())
+
+	return left.Compare(right)
+}
+
+// MakeFieldComparator returns a comparator for the given field.
+func MakeFieldComparator[T any](
+	field string,
+	descending bool,
+	fieldExtractor func(T, string) (string, error),
+	defaultCmp func(T, T) int,
+) func(T, T) (int, error) {
+	cmp := func(a, b T) (int, error) {
+		if field == "" {
+			return defaultCmp(a, b), nil
+		}
+
+		left, err := fieldExtractor(a, field)
+		if err != nil {
+			return 0, err
+		}
+
+		right, err := fieldExtractor(b, field)
+		if err != nil {
+			return 0, err
+		}
+
+		if res := strings.Compare(left, right); res != 0 {
+			if descending {
+				return -res, nil
+			}
+
+			return res, nil
+		}
+
+		return defaultCmp(a, b), nil
+	}
+
+	return cmp
+}
diff --git a/internal/backend/runtime/proxy_runtime_test.go b/internal/backend/runtime/proxy_runtime_test.go
new file mode 100644
index 000000000..e4657e397
--- /dev/null
+++ b/internal/backend/runtime/proxy_runtime_test.go
@@ -0,0 +1,500 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package runtime_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/siderolabs/gen/ensure"
+	"github.com/siderolabs/go-pointer"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/api/omni/resources"
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	pkgruntime "github.com/siderolabs/omni/client/pkg/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime/cosi"
+	omni2 "github.com/siderolabs/omni/internal/backend/runtime/omni"
+)
+
+type runtimeMock struct {
+	runtime.Runtime
+	watch func(ctx context.Context, responses chan<- runtime.WatchResponse, option ...runtime.QueryOption) error
+	list  func(ctx context.Context, opts ...runtime.QueryOption) (runtime.ListResult, error)
+}
+
+func (r *runtimeMock) Watch(ctx context.Context, responses chan<- runtime.WatchResponse, opts ...runtime.QueryOption) error {
+	if r.watch == nil {
+		return r.Runtime.Watch(ctx, responses, opts...)
+	}
+
+	return r.watch(ctx, responses, opts...)
+}
+
+func (r *runtimeMock) List(ctx context.Context, opts ...runtime.QueryOption) (runtime.ListResult, error) {
+	if r.list == nil {
+		return r.Runtime.List(ctx, opts...)
+	}
+
+	return r.list(ctx, opts...)
+}
+
+func TestProxyRuntime_Watch(t *testing.T) {
+	t.Parallel()
+
+	type args struct {
+		msgs         []runtime.WatchResponse
+		expectedMsgs []runtime.WatchResponse
+		skip         int
+		limit        int
+	}
+
+	tests := []struct {
+		name string
+		args args
+	}{
+		{
+			name: "limit 0, skip 0, with duplicates",
+			args: args{
+				limit:        0,
+				skip:         0,
+				msgs:         duplicate(produce(0, 3, makeResponse)),
+				expectedMsgs: safeSort(duplicate(produce(0, 3, makeResponse)), "", false),
+			},
+		},
+		{
+			name: "limit 3, skip 0",
+			args: args{
+				limit:        3,
+				skip:         0,
+				msgs:         produce(0, 10, makeResponse),
+				expectedMsgs: produce(0, 3, makeResponse),
+			},
+		},
+		{
+			name: "limit 0, skip 3",
+			args: args{
+				limit:        0,
+				skip:         3,
+				msgs:         produce(0, 10, makeResponse),
+				expectedMsgs: produce(3, 7, makeResponse),
+			},
+		},
+		{
+			name: "limit 3, skip 3",
+			args: args{
+				limit:        3,
+				skip:         3,
+				msgs:         produce(0, 10, makeResponse),
+				expectedMsgs: produce(3, 3, makeResponse),
+			},
+		},
+		{
+			name: "limit 6, skip 3, with duplicates",
+			args: args{
+				limit:        6,
+				skip:         3,
+				msgs:         duplicate(produce(0, 10, makeResponse)),
+				expectedMsgs: safeSort(duplicate(produce(3, 6, makeResponse)), "", false),
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			testWatch(
+				t,
+				tt.args.msgs,
+				tt.args.expectedMsgs,
+				false,
+				runtime.WithLimit(tt.args.limit),
+				runtime.WithOffset(tt.args.skip),
+			)
+		})
+	}
+}
+
+func makeResponse(i int) runtime.WatchResponse {
+	return pointer.To(runtime.NewBasicResponse(
+		fmt.Sprintf("id-%d", i),
+		fmt.Sprintf("msg-%d", i),
+		&resources.WatchResponse{Event: &resources.Event{}},
+	))
+}
+
+func duplicate[T any](v []T) []T { return append(v, v...) }
+
+func produce[T any](start, count int, fn func(i int) T) []T {
+	msgs := make([]T, 0, count)
+
+	for i := 0; i < count; i++ {
+		msgs = append(msgs, fn(i+start))
+	}
+
+	return msgs
+}
+
+func testWatch(t *testing.T, msgs, expectedMsgs []runtime.WatchResponse, compareTotal bool, opts ...runtime.QueryOption) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	mock := runtimeMock{
+		watch: func(ctx context.Context, responses chan<- runtime.WatchResponse, _ ...runtime.QueryOption) error {
+			for _, msg := range msgs {
+				responses <- msg
+			}
+
+			<-ctx.Done()
+
+			return nil
+		},
+	}
+
+	msgs = appendBootstrapped(msgs)
+	expectedMsgs = appendBootstrapped(expectedMsgs)
+
+	proxy := &runtime.ProxyRuntime{Runtime: &mock}
+	ch := make(chan runtime.WatchResponse)
+	errCh := make(chan error)
+
+	go func() {
+		err := proxy.Watch(ctx, ch, opts...)
+		if err != nil {
+			t.Log("error from proxy.Watch:", err)
+		}
+
+		errCh <- err
+	}()
+
+	chResult, err := takeCount(ctx, ch, len(expectedMsgs))
+	assert.NoError(t, err)
+
+	cancel()
+
+	if !compareSlices(chResult, expectedMsgs, func(a, b runtime.WatchResponse) bool {
+		result := true
+
+		if compareTotal {
+			result = a.Unwrap().GetTotal() == b.Unwrap().GetTotal()
+		}
+
+		return result &&
+			a.ID() == b.ID() &&
+			a.Namespace() == b.Namespace() &&
+			runtime.EventType(a) == runtime.EventType(b)
+	}) {
+		t.Helper()
+		t.Log("got:", chResult)
+		t.Log("expected:", expectedMsgs)
+		t.FailNow()
+	}
+
+	require.NoError(t, <-errCh)
+}
+
+func appendBootstrapped(msgs []runtime.WatchResponse) []runtime.WatchResponse {
+	if !slices.ContainsFunc(msgs, func(response runtime.WatchResponse) bool {
+		return runtime.EventType(response) == resources.EventType_BOOTSTRAPPED
+	}) {
+		msgs = append(msgs, pointer.To(runtime.NewBasicResponse(
+			"",
+			"",
+			&resources.WatchResponse{Event: &resources.Event{EventType: resources.EventType_BOOTSTRAPPED}},
+		)))
+	}
+
+	return msgs
+}
+
+func takeCount[T any](ctx context.Context, ch <-chan T, count int) ([]T, error) {
+	msgs := make([]T, 0, count)
+
+	for i := 0; i < count; i++ {
+		select {
+		case got, ok := <-ch:
+			if !ok {
+				return nil, errors.New("channel closed early")
+			}
+
+			msgs = append(msgs, got)
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+	}
+
+	return msgs, nil
+}
+
+func TestProxyRuntime_WatchContextCancel(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	mock := runtimeMock{
+		watch: func(ctx context.Context, ch chan<- runtime.WatchResponse, _ ...runtime.QueryOption) error {
+			select {
+			case ch <- makeResponse(0):
+			case <-ctx.Done():
+			}
+
+			<-ctx.Done()
+
+			return ctx.Err()
+		},
+	}
+
+	proxy := &runtime.ProxyRuntime{Runtime: &mock}
+	ch := make(chan runtime.WatchResponse)
+
+	errCh := make(chan error, 1)
+
+	go func() {
+		errCh <- proxy.Watch(ctx, ch)
+	}()
+
+	cancel()
+
+	require.Equal(t, context.Canceled, <-errCh)
+}
+
+func compareSlices[T comparable](a, b []T, cmp func(T, T) bool) bool {
+	if len(a) != len(b) {
+		return false
+	}
+
+	for i := range a {
+		if !cmp(a[i], b[i]) {
+			return false
+		}
+	}
+
+	return true
+}
+
+func safeSort(msgs []runtime.WatchResponse, field string, desc bool) []runtime.WatchResponse {
+	err := runtime.SortResponses(msgs, runtime.MakeWatchResponseComparator(field, desc))
+	if err != nil {
+		panic(err)
+	}
+
+	return msgs
+}
+
+func TestProxyRuntime_WatchWithWithSort(t *testing.T) {
+	t.Parallel()
+
+	produced := produce(0, 10, makeResponse)
+	expected := reverse(produced)
+
+	testWatch(t, produced, expected, false, runtime.WithSort("", true))
+}
+
+func reverse[T any](slc []T) []T {
+	for i := len(slc)/2 - 1; i >= 0; i-- {
+		opp := len(slc) - 1 - i
+		slc[i], slc[opp] = slc[opp], slc[i]
+	}
+
+	return slc
+}
+
+func TestProxyRuntime_WatchWithSearchFor(t *testing.T) {
+	t.Parallel()
+
+	produced := produce(1, 10, makeResponse)
+	expected := []runtime.WatchResponse{produced[0], produced[9], produced[4]}
+
+	testWatch(t, produced, expected, false, runtime.WithSearchFor([]string{"this-should-not-match", "id-1", "id-5"}))
+}
+
+func TestProxyRuntime_List(t *testing.T) {
+	t.Parallel()
+
+	machines := toListResult([]*omni.MachineStatus{
+		newMachine(1, &specs.MachineStatusSpec{Cluster: "cluster5"}),
+		newMachine(2, &specs.MachineStatusSpec{Cluster: "cluster3"}),
+		newMachine(3, &specs.MachineStatusSpec{Cluster: "cluster2"}),
+		newMachine(4, &specs.MachineStatusSpec{Cluster: "cluster4"}),
+		newMachine(5, &specs.MachineStatusSpec{Cluster: "cluster1"}),
+		newMachine(6, &specs.MachineStatusSpec{Cluster: "cluster1"}),
+	})
+
+	expected := runtime.ListResult{
+		Items: []pkgruntime.ListItem{
+			machines.Items[4],
+			machines.Items[5],
+			machines.Items[2],
+			machines.Items[1],
+		},
+		Total: 5,
+	}
+
+	testList(
+		t,
+		machines,
+		expected,
+		nil,
+		runtime.WithSort("cluster", false),
+		runtime.WithSearchFor([]string{"cluster1", "cluster2", "cluster3", "cluster4"}),
+		runtime.WithLimit(4),
+	)
+}
+
+func toListResult(machines []*omni.MachineStatus) runtime.ListResult {
+	items := make([]pkgruntime.ListItem, 0, len(machines))
+
+	for _, machine := range machines {
+		items = append(items, omni2.NewItem(ensure.Value(runtime.NewResource(machine))))
+	}
+
+	return runtime.ListResult{
+		Items: items,
+		Total: len(items),
+	}
+}
+
+func newMachine(i int, val *specs.MachineStatusSpec) *omni.MachineStatus {
+	machine := omni.NewMachineStatus("default", fmt.Sprintf("id%d", i))
+
+	machine.Metadata().SetVersion(ensure.Value(resource.ParseVersion("1")))
+
+	machine.TypedSpec().Value = val
+
+	return machine
+}
+
+func testList(t *testing.T, original, expected runtime.ListResult, expectedErr error, opts ...runtime.QueryOption) {
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	mock := runtimeMock{
+		list: func(context.Context, ...runtime.QueryOption) (runtime.ListResult, error) {
+			return original, nil
+		},
+	}
+
+	proxy := &runtime.ProxyRuntime{Runtime: &mock}
+
+	res, err := proxy.List(ctx, opts...)
+	if err != nil || expectedErr != nil {
+		require.NotNil(t, expectedErr)
+		require.EqualError(t, err, expectedErr.Error())
+
+		return
+	}
+
+	require.Equal(t, expected.Total, res.Total)
+
+	if !compareSlices(res.Items, expected.Items, func(a, b pkgruntime.ListItem) bool {
+		require.Equal(t, a.ID(), b.ID())
+		require.Equal(t, a.Namespace(), b.Namespace())
+		require.Equal(t, a.Unwrap(), b.Unwrap())
+
+		return true
+	}) {
+		t.Helper()
+		t.Log("got:", res.Items)
+		t.Log("expected:", expected.Items)
+		t.FailNow()
+	}
+}
+
+func TestProxyRuntime_ListError(t *testing.T) {
+	t.Parallel()
+
+	machines := toListResult([]*omni.MachineStatus{newMachine(1, &specs.MachineStatusSpec{Cluster: "cluster1"})})
+
+	testList(
+		t,
+		machines,
+		runtime.ListResult{},
+		errors.New("failed to sort: field \"such-field-do-not-exist\" for element \"id1\" not found"),
+		runtime.WithSort("such-field-do-not-exist", false),
+	)
+}
+
+func TestProxyRuntime_WatchBootstrappedFirst(t *testing.T) {
+	t.Parallel()
+
+	msgs := []runtime.WatchResponse{
+		cosi.NewResponse("", "", &resources.WatchResponse{
+			Event: &resources.Event{
+				EventType: resources.EventType_BOOTSTRAPPED,
+			},
+		}, nil),
+		watchResponse(1, "cluster3", "cluster", 0),
+		watchResponse(2, "cluster2", "cluster", 0),
+		watchResponse(3, "cluster1", "cluster", 0),
+		watchResponse(4, "cluster3", "cluster", 0),
+		watchResponse(5, "cluster3", "cluster", 0),
+		watchResponse(6, "cluster3", "cluster", 0),
+		watchResponseDestroy(3, "cluster1", "cluster", 0),
+	}
+
+	expected := []runtime.WatchResponse{
+		cosi.NewResponse("", "", &resources.WatchResponse{
+			Event: &resources.Event{
+				EventType: resources.EventType_BOOTSTRAPPED,
+			},
+		}, nil),
+		watchResponse(3, "cluster1", "cluster", 2),
+		watchResponse(4, "cluster3", "cluster", 3),
+		watchResponseDestroy(3, "cluster1", "cluster", 4),
+	}
+
+	testWatch(
+		t,
+		msgs,
+		expected,
+		true,
+		runtime.WithSort("cluster", false),
+		runtime.WithOffset(1),
+		runtime.WithLimit(2),
+		runtime.WithSearchFor([]string{"cluster1", "cluster3"}),
+	)
+}
+
+//nolint:unparam
+func watchResponse(id int, cluster, sortByField string, count int) runtime.WatchResponse {
+	return cosi.NewResponse(
+		fmt.Sprintf("id%d", id),
+		"default",
+		&resources.WatchResponse{
+			Event: &resources.Event{
+				EventType: resources.EventType_CREATED,
+			},
+			Total:         int32(count),
+			SortFieldData: sortByField,
+		},
+		newMachine(id, &specs.MachineStatusSpec{Cluster: cluster}),
+	)
+}
+
+func watchResponseDestroy(id int, cluster, field string, count int) runtime.WatchResponse {
+	return cosi.NewResponse(
+		fmt.Sprintf("id%d", id),
+		"default",
+		&resources.WatchResponse{
+			Event: &resources.Event{
+				EventType: resources.EventType_DESTROYED,
+			},
+			Total:         int32(count),
+			SortFieldData: field,
+		},
+		newMachine(id, &specs.MachineStatusSpec{Cluster: cluster}),
+	)
+}
diff --git a/internal/backend/runtime/resource.go b/internal/backend/runtime/resource.go
new file mode 100644
index 000000000..852ffa9f9
--- /dev/null
+++ b/internal/backend/runtime/resource.go
@@ -0,0 +1,151 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package runtime
+
+import (
+	"encoding/json"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/siderolabs/talos/pkg/machinery/api/common"
+	"google.golang.org/protobuf/proto"
+	"gopkg.in/yaml.v3"
+)
+
+type protobufWrapper interface {
+	GetValue() proto.Message
+}
+
+// Version implements a special uint64 type which can be unmarshalled from COSI version that can be string if it's undefined.
+type Version uint64
+
+// UnmarshalYAML implements yaml.Unmarshaler.
+func (v *Version) UnmarshalYAML(value *yaml.Node) error {
+	if value.Value == resource.VersionUndefined.String() {
+		return nil
+	}
+
+	val, err := strconv.ParseUint(value.Value, 10, 64)
+	if err != nil {
+		return err
+	}
+
+	*v = Version(val)
+
+	return nil
+}
+
+// Metadata wraps COSI or Talos metadata into a json serializable object.
+type Metadata struct {
+	Created     time.Time           `json:"created" yaml:"created"`
+	Updated     time.Time           `json:"updated" yaml:"updated"`
+	Namespace   resource.Namespace  `json:"namespace" yaml:"namespace"`
+	Type        resource.Type       `json:"type" yaml:"type"`
+	ID          resource.ID         `json:"id" yaml:"id"`
+	Owner       resource.Owner      `json:"owner" yaml:"owner"`
+	Phase       string              `json:"phase" yaml:"phase"`
+	Node        string              `json:"node,omitempty" yaml:"node"`
+	Labels      map[string]string   `json:"labels,omitempty" yaml:"labels,omitempty"`
+	Annotations map[string]string   `json:"annotations,omitempty" yaml:"annotations,omitempty"`
+	Finalizers  resource.Finalizers `json:"finalizers,omitempty" yaml:"finalizers,omitempty"`
+	Version     Version             `json:"version" yaml:"version,omitempty"`
+}
+
+// Resource wraps Talos and COSI resource response to be encoded as JSON.
+type Resource struct {
+	Spec     any               `yaml:"spec" json:"spec"`
+	Resource resource.Resource `yaml:"-" json:"-"`
+	ID       string            `yaml:"-" json:"-"`
+	Metadata Metadata          `yaml:"metadata" json:"metadata"`
+}
+
+// ResourceOptions describes additional resource wrapper options.
+type ResourceOptions struct {
+	metadata *common.Metadata
+}
+
+// ResourceOption is a single resource creation option.
+type ResourceOption func(*ResourceOptions)
+
+// WithMetadata creates resource with Talos metadata.
+func WithMetadata(value *common.Metadata) ResourceOption {
+	return func(o *ResourceOptions) {
+		o.metadata = value
+	}
+}
+
+// NewResource creates new resource.
+func NewResource(r resource.Resource, options ...ResourceOption) (*Resource, error) {
+	opts := &ResourceOptions{}
+	for _, o := range options {
+		o(opts)
+	}
+
+	s, err := resource.MarshalYAML(r)
+	if err != nil {
+		return nil, err
+	}
+
+	data, err := yaml.Marshal(s)
+	if err != nil {
+		return nil, err
+	}
+
+	parts := make([]string, 0, 3)
+	if opts.metadata != nil {
+		parts = append(parts, opts.metadata.Hostname)
+	}
+
+	parts = append(parts, r.Metadata().Namespace(), r.Metadata().ID())
+
+	res := &Resource{
+		ID: strings.Join(parts, "/"),
+	}
+	if err = yaml.Unmarshal(data, &res); err != nil {
+		return nil, err
+	}
+
+	if opts.metadata != nil {
+		res.Metadata.Node = opts.metadata.Hostname
+	}
+
+	if wrapped, ok := r.Spec().(protobufWrapper); ok {
+		res.Spec = wrapped.GetValue()
+	}
+
+	res.Resource = r
+
+	return res, nil
+}
+
+// protoMessage wraps proto.Message to leverage protojson encoder.
+type protoMessage struct {
+	Message proto.Message
+}
+
+func (r protoMessage) MarshalJSON() ([]byte, error) {
+	data, err := MarshalJSON(r.Message)
+
+	return []byte(data), err
+}
+
+// MarshalJSON overrides default marshal behavior replacing spec
+// with the wrapped struct, that uses protojson encoder.
+func (r *Resource) MarshalJSON() ([]byte, error) {
+	m, ok := r.Spec.(proto.Message)
+	if !ok {
+		return json.Marshal(*r)
+	}
+
+	return json.Marshal(Resource{
+		Spec:     protoMessage{Message: m},
+		Metadata: r.Metadata,
+		Resource: r.Resource,
+		ID:       r.ID,
+	})
+}
diff --git a/internal/backend/runtime/runtime.go b/internal/backend/runtime/runtime.go
new file mode 100644
index 000000000..b093e5d36
--- /dev/null
+++ b/internal/backend/runtime/runtime.go
@@ -0,0 +1,306 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package runtime implements connectors to various runtimes.
+package runtime
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+	"strings"
+	"sync"
+	"time"
+
+	cosiresource "github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/typed"
+	"github.com/siderolabs/gen/xslices"
+	"k8s.io/client-go/rest"
+
+	"github.com/siderolabs/omni/client/api/common"
+	"github.com/siderolabs/omni/client/api/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/runtime"
+)
+
+// Runtime is an abstraction for the data access.
+type Runtime interface {
+	Watch(context.Context, chan<- WatchResponse, ...QueryOption) error
+	Get(context.Context, ...QueryOption) (any, error)
+	List(context.Context, ...QueryOption) (ListResult, error)
+	Create(context.Context, cosiresource.Resource, ...QueryOption) error
+	Update(context.Context, cosiresource.Resource, ...QueryOption) error
+	Delete(context.Context, ...QueryOption) error
+}
+
+// WatchResponse is a wrapper for the resources.WatchResponse.
+type WatchResponse interface {
+	ID() string
+	Namespace() string
+	Field(name string) (string, bool)
+	Match(searchFor string) bool
+	Unwrap() *resources.WatchResponse
+}
+
+// EventType returns event type for the response.
+func EventType(resp WatchResponse) resources.EventType { return resp.Unwrap().Event.EventType }
+
+// ListResult is a wrapper for the list result.
+type ListResult struct {
+	Items []runtime.ListItem
+	Total int
+}
+
+// ListComparator is a comparator for the list items.
+type ListComparator func(a, b runtime.ListItem) (int, error)
+
+// SortInPlace sorts the list result.
+func (l *ListResult) SortInPlace(cmp ListComparator) error { return unsafeSort(l.Items, cmp) }
+
+// Slice returns a slice of the list result.
+func (l *ListResult) Slice(offset, count int) ListResult {
+	if offset >= len(l.Items) {
+		return ListResult{
+			Total: l.Total,
+		}
+	}
+
+	items := l.Items[offset:]
+
+	if count > 0 && count < len(items) {
+		items = items[:count]
+	}
+
+	return ListResult{
+		Items: items,
+		Total: l.Total,
+	}
+}
+
+// Filter filters Items using the provided predicate.
+func (l *ListResult) Filter(match func(m runtime.ListItem) bool) ListResult {
+	result := xslices.Filter(l.Items, match)
+
+	return ListResult{
+		Items: result,
+		Total: len(result),
+	}
+}
+
+// KubeconfigSource is implemented by runtimes that allow getting kubeconfigs.
+type KubeconfigSource interface {
+	GetKubeconfig(context.Context, *common.Context) (*rest.Config, error)
+}
+
+var (
+	runtimeMu sync.RWMutex
+	runtimes  = map[string]Runtime{}
+)
+
+// Install a runtime singleton for a type.
+func Install(name string, runtime Runtime) {
+	runtimeMu.Lock()
+	defer runtimeMu.Unlock()
+
+	runtimes[name] = &proxyRuntime{runtime}
+}
+
+// Get returns runtime for a type.
+func Get(name string) (Runtime, error) { //nolint:ireturn
+	runtimeMu.RLock()
+	defer runtimeMu.RUnlock()
+
+	if runtime, ok := runtimes[name]; ok {
+		return runtime, nil
+	}
+
+	return nil, fmt.Errorf("failed to find the runtime %v", name)
+}
+
+// LookupInterface looks for a specific implementation in runtimes.
+func LookupInterface[T any](name string) (T, error) {
+	var zero T
+
+	typ := reflect.TypeFor[T]()
+	if typ.Kind() != reflect.Interface {
+		return zero, errors.New("can only be used with interface types")
+	}
+
+	if typ.NumMethod() != 1 {
+		return zero, errors.New("can only be used with interfaces with a single method")
+	}
+
+	runtimeMu.RLock()
+	defer runtimeMu.RUnlock()
+
+	if runtime, ok := runtimes[name]; ok {
+		res, ok := unwrap(runtime).(T)
+		if !ok {
+			return zero, fmt.Errorf("runtime with id %s is not %s", name, typeName(typ))
+		}
+
+		return res, nil
+	}
+
+	return zero, fmt.Errorf("failed to find the runtime %v", name)
+}
+
+func typeName(typ reflect.Type) string {
+	if name := typ.Name(); name != "" {
+		return name
+	}
+
+	return typ.String()
+}
+
+func unwrap(runtime Runtime) Runtime {
+	for {
+		wrapped, ok := runtime.(interface{ Unwrap() Runtime })
+		if !ok {
+			return runtime
+		}
+
+		runtime = wrapped.Unwrap()
+	}
+}
+
+// NewBasicResponse creates a new basic response.
+func NewBasicResponse(id string, namespace string, resp *resources.WatchResponse) BasicResponse {
+	mustNotNil(resp, "nil response")
+	mustNotNil(resp.Event, "nil response event")
+
+	return BasicResponse{
+		BasicItem: BasicItem[*resources.WatchResponse]{
+			id: id,
+			ns: namespace,
+			v:  resp,
+		},
+	}
+}
+
+// BasicResponse is a basic implementation of the WatchResponse.
+type BasicResponse struct {
+	BasicItem[*resources.WatchResponse]
+}
+
+// Field implements WatchResponse. name can be "id", "namespace" or "event_type".
+// If name is empty, it returns ID. If name is unknown, it returns false.
+func (b *BasicResponse) Field(name string) (string, bool) {
+	field, ok := b.BasicItem.Field(name)
+	if ok {
+		return field, true
+	}
+
+	if name == "event_type" {
+		return string(EventType(b)), true
+	}
+
+	return "", false
+}
+
+// Match looks for a specific string in item data.
+func (b *BasicResponse) Match(searchFor string) bool {
+	return EventType(b) == resources.EventType_BOOTSTRAPPED || b.BasicItem.Match(searchFor)
+}
+
+// String implements fmt.Stringer.
+func (b *BasicResponse) String() string {
+	return fmt.Sprintf("{id=%q, namespace=%q, event_type=%q, total=%d}", b.BasicItem.id, b.BasicItem.ns, EventType(b), b.Unwrap().GetTotal())
+}
+
+// MakeBasicItem creates a new basic item.
+func MakeBasicItem[T any](id string, ns string, v T) BasicItem[T] {
+	return BasicItem[T]{id: id, ns: ns, v: v}
+}
+
+// BasicItem is a basic building block for the WatchResponse and ListItem.
+type BasicItem[T any] struct {
+	v  T
+	id string
+	ns string
+}
+
+// ID implements WatchResponse.
+func (bi BasicItem[T]) ID() string { return bi.id }
+
+// Namespace implements WatchResponse.
+func (bi BasicItem[T]) Namespace() string { return bi.ns }
+
+// Unwrap implements WatchResponse.
+func (bi BasicItem[T]) Unwrap() T { return bi.v }
+
+// Field implements WatchResponse. name can be "id", "namespace" or "event_type".
+// If name is empty, it returns ID. If name is unknown, it returns false.
+func (bi BasicItem[T]) Field(name string) (string, bool) {
+	switch name {
+	case "id", "":
+		return bi.id, true
+	case "namespace":
+		return bi.ns, true
+	default:
+		return "", false
+	}
+}
+
+// Match looks for a specific string in item data.
+func (bi BasicItem[T]) Match(searchFor string) bool {
+	return strings.Contains(bi.ID(), searchFor) ||
+		strings.Contains(bi.Namespace(), searchFor)
+}
+
+// String implements fmt.Stringer.
+func (bi BasicItem[T]) String() string {
+	return fmt.Sprintf("{id=%q, namespace=%q}", bi.id, bi.ns)
+}
+
+func mustNotNil[T any](v *T, msg string) {
+	if v == nil {
+		panic(msg)
+	}
+}
+
+// ResourceField returns a metadata field value.
+func ResourceField(res cosiresource.Resource, name string) (string, bool) {
+	if res == nil {
+		return "", false
+	}
+
+	switch name {
+	case "created":
+		return timeToString(res.Metadata().Created()), true
+	case "updated":
+		return timeToString(res.Metadata().Updated()), true
+	}
+
+	fielder, ok := typed.LookupExtension[runtime.Fielder](res)
+	if !ok {
+		return "", false
+	}
+
+	return fielder.Field(name)
+}
+
+func timeToString(t time.Time) string {
+	return t.UTC().Format("2006-01-02 15:04:05.000000000")
+}
+
+// MatchResource returns true if searchFor is in any field of metadata.
+func MatchResource(res cosiresource.Resource, searchFor string) bool {
+	if res == nil {
+		return false
+	}
+
+	if strings.Contains(timeToString(res.Metadata().Created()), searchFor) ||
+		strings.Contains(timeToString(res.Metadata().Updated()), searchFor) {
+		return true
+	}
+
+	matcher, ok := typed.LookupExtension[runtime.Matcher](res)
+	if !ok {
+		return false
+	}
+
+	return matcher.Match(searchFor)
+}
diff --git a/internal/backend/runtime/runtime_test.go b/internal/backend/runtime/runtime_test.go
new file mode 100644
index 000000000..8cf1ae81d
--- /dev/null
+++ b/internal/backend/runtime/runtime_test.go
@@ -0,0 +1,45 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package runtime_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime/kubernetes"
+)
+
+func TestInstall_LookupInterface(t *testing.T) {
+	k8s, err := kubernetes.New(nil)
+	require.NoError(t, err)
+
+	runtime.Install(kubernetes.Name, k8s)
+
+	type incorrectIface interface {
+		GetClient(ctx context.Context, cluster string) (kubernetes.Client, error)
+	}
+
+	_, err = runtime.LookupInterface[incorrectIface](kubernetes.Name)
+	require.EqualError(t, err, fmt.Sprintf("runtime with id %s is not incorrectIface", kubernetes.Name))
+
+	type incorrectUnnamedIface = interface {
+		GetClient(ctx context.Context, cluster string) (kubernetes.Client, error)
+	}
+
+	_, err = runtime.LookupInterface[incorrectUnnamedIface](kubernetes.Name)
+	require.EqualError(t, err, fmt.Sprintf("runtime with id %s is not interface { GetClient(context.Context, string) (kubernetes.Client, error) }", kubernetes.Name))
+
+	type correctIface = interface {
+		GetClient(ctx context.Context, cluster string) (*kubernetes.Client, error)
+	}
+
+	_, err = runtime.LookupInterface[correctIface](kubernetes.Name)
+	require.NoError(t, err)
+}
diff --git a/internal/backend/runtime/talos/clients.go b/internal/backend/runtime/talos/clients.go
new file mode 100644
index 000000000..ad5b234d3
--- /dev/null
+++ b/internal/backend/runtime/talos/clients.go
@@ -0,0 +1,354 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package talos
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"runtime"
+	"strings"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/hashicorp/golang-lru/v2/expirable"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+	clientconfig "github.com/siderolabs/talos/pkg/machinery/client/config"
+	"go.uber.org/zap"
+	"golang.org/x/sync/singleflight"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// ClientNotReadyError is returned when building the client fails because cluster endpoints list is empty
+// or Talos config resource doesn't exist.
+type ClientNotReadyError struct {
+	wrappedError error
+}
+
+// NewClientNotReadyError creates a new ClientNotReadyError wrapping the given error.
+func NewClientNotReadyError(wrapped error) ClientNotReadyError {
+	return ClientNotReadyError{wrappedError: wrapped}
+}
+
+func (e ClientNotReadyError) Error() string {
+	return fmt.Sprintf("talos API client is not available: %s", e.wrappedError)
+}
+
+func (e ClientNotReadyError) Unwrap() error {
+	return e.wrappedError
+}
+
+// IsClientNotReadyError checks if the error is ClientNotReadyError.
+func IsClientNotReadyError(e error) bool {
+	var w ClientNotReadyError
+
+	return errors.As(e, &w)
+}
+
+// NewClient creates a new Talos client.
+func NewClient(c *client.Client, clusterName string) *Client {
+	return &Client{Client: c, clusterName: clusterName}
+}
+
+// Client wraps Talos client.
+type Client struct {
+	*client.Client
+
+	clusterName string
+}
+
+// Close closes the Talos client.
+//
+// Deprecated: Clients are cached, so this is no-op and must not be called.
+func (c *Client) Close() error {
+	return nil
+}
+
+// Connected provides informational flag about cluster being reachable which is computed from the resources.
+func (c *Client) Connected(ctx context.Context, r controller.Reader) (bool, error) {
+	if c == nil {
+		return false, errors.New("client is nil")
+	}
+
+	if len(c.GetEndpoints()) == 0 {
+		return false, nil
+	}
+
+	if c.clusterName == "" {
+		return false, errors.New("cluster name is empty")
+	}
+
+	clusterStatus, err := safe.ReaderGet[*omni.ClusterStatus](ctx, r,
+		omni.NewClusterStatus(resources.DefaultNamespace, c.clusterName).Metadata(),
+	)
+	if err != nil {
+		return false, fmt.Errorf("failed to get cluster status for cluster %q: %w", c.GetClusterName(), err)
+	}
+
+	return clusterStatus.TypedSpec().Value.GetAvailable(), nil
+}
+
+// GetSocketOptions adds unix socket parameters to the client configuration
+// if the address has unix:// schema.
+func GetSocketOptions(address string) []client.OptionFunc {
+	// we are not going to use unix sockets for management,
+	// but it's handy to have it when running unit tests
+	if strings.HasPrefix(address, "unix://") {
+		_, address, _ = strings.Cut(address, "//")
+
+		return []client.OptionFunc{
+			client.WithUnixSocket(address),
+			client.WithGRPCDialOptions(grpc.WithTransportCredentials(insecure.NewCredentials())),
+		}
+	}
+
+	return nil
+}
+
+const (
+	talosClientLRUSize = 32
+	talosClientTTL     = time.Hour
+)
+
+// ClientFactory creates client based on the resource state.
+type ClientFactory struct {
+	omniState state.State
+	logger    *zap.Logger
+
+	cache *expirable.LRU[string, *Client]
+	sf    singleflight.Group
+
+	metricCacheSize, metricActiveClients prometheus.Gauge
+	metricCacheHits, metricCacheMisses   prometheus.Counter
+}
+
+// NewClientFactory initializes a ClientFactory with a built-in cache.
+// For the factory to do proper cache invalidation, the method StartCacheManager must be called.
+func NewClientFactory(omniState state.State, logger *zap.Logger) *ClientFactory {
+	return &ClientFactory{
+		omniState: omniState,
+		logger:    logger,
+		cache:     expirable.NewLRU[string, *Client](talosClientLRUSize, nil, talosClientTTL),
+
+		metricCacheSize: prometheus.NewGauge(prometheus.GaugeOpts{
+			Name: "omni_talos_clientfactory_cache_size",
+			Help: "Number of Talos clients in the cache of Talos client factory.",
+		}),
+		metricActiveClients: prometheus.NewGauge(prometheus.GaugeOpts{
+			Name: "omni_talos_clientfactory_active_clients",
+			Help: "Number of active Talos clients created by Talos client factory.",
+		}),
+		metricCacheHits: prometheus.NewCounter(prometheus.CounterOpts{
+			Name: "omni_talos_clientfactory_cache_hits_total",
+			Help: "Number of Talos client factory cache hits.",
+		}),
+		metricCacheMisses: prometheus.NewCounter(prometheus.CounterOpts{
+			Name: "omni_talos_clientfactory_cache_misses_total",
+			Help: "Number of Talos client factory cache misses.",
+		}),
+	}
+}
+
+// connectionOptions returns client configuration generated from the TalosConfig resource.
+func (factory *ClientFactory) connectionOptions(ctx context.Context, id string, endpoints []string) ([]client.OptionFunc, error) {
+	if len(endpoints) > 0 {
+		opts := GetSocketOptions(endpoints[0])
+
+		if opts != nil {
+			return opts, nil
+		}
+	}
+
+	res, err := safe.StateGet[*omni.TalosConfig](ctx, factory.omniState, resource.NewMetadata(resources.DefaultNamespace, omni.TalosConfigType, id, resource.VersionUndefined))
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, NewClientNotReadyError(err)
+		}
+
+		return nil, err
+	}
+
+	spec := res.TypedSpec().Value
+
+	config := &clientconfig.Config{
+		Context: id,
+		Contexts: map[string]*clientconfig.Context{
+			id: {
+				Endpoints: endpoints,
+				CA:        spec.Ca,
+				Crt:       spec.Crt,
+				Key:       spec.Key,
+			},
+		},
+	}
+
+	return []client.OptionFunc{
+		client.WithConfig(config),
+		client.WithGRPCDialOptions(
+			grpc.WithDefaultCallOptions(
+				grpc.MaxCallRecvMsgSize(constants.GRPCMaxMessageSize),
+			),
+			grpc.WithSharedWriteBuffer(true),
+		),
+	}, nil
+}
+
+// Get constructs a client from resource configuration.
+// Returned client is cached and must not be closed by the consumer.
+func (factory *ClientFactory) Get(ctx context.Context, clusterName string) (*Client, error) {
+	if cli, ok := factory.cache.Get(clusterName); ok {
+		factory.logger.Debug("cache hit, returning cached Talos client", zap.String("cluster", clusterName))
+
+		factory.metricCacheHits.Inc()
+
+		return cli, nil
+	}
+
+	ch := factory.sf.DoChan(clusterName, func() (any, error) {
+		factory.logger.Debug("cache miss, creating new Talos client", zap.String("cluster", clusterName))
+
+		factory.metricCacheMisses.Inc()
+
+		cli, err := factory.build(ctx, clusterName)
+		if err != nil {
+			return nil, err
+		}
+
+		factory.metricActiveClients.Inc()
+
+		runtime.SetFinalizer(cli, func(c *Client) {
+			factory.logger.Debug("finalizing Talos client", zap.String("cluster", c.clusterName))
+
+			factory.metricActiveClients.Dec()
+
+			c.Client.Close() //nolint:errcheck
+		})
+
+		factory.cache.Add(clusterName, cli)
+
+		return cli, nil
+	})
+
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case res := <-ch:
+		if res.Err != nil {
+			return nil, res.Err
+		}
+
+		cli := res.Val.(*Client) //nolint:forcetypeassert,errcheck
+
+		return cli, nil
+	}
+}
+
+// release releases the Talos cluster client from the client cache.
+// The client will only be closed when it is garbage collected.
+func (factory *ClientFactory) release(clusterName string) {
+	factory.logger.Debug("deleting Talos client from cache", zap.String("cluster", clusterName), zap.Stack("stack"))
+
+	factory.cache.Remove(clusterName)
+}
+
+func (factory *ClientFactory) build(ctx context.Context, clusterName string) (*Client, error) {
+	clusterEndpoint, err := safe.StateGet[*omni.ClusterEndpoint](ctx, factory.omniState,
+		omni.NewClusterEndpoint(resources.DefaultNamespace, clusterName).Metadata(),
+	)
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return nil, NewClientNotReadyError(err)
+		}
+
+		return nil, err
+	}
+
+	endpoints := clusterEndpoint.TypedSpec().Value.ManagementAddresses
+	if len(endpoints) == 0 {
+		return nil, NewClientNotReadyError(errors.New("no management addresses on cluster endpoint"))
+	}
+
+	options, err := factory.connectionOptions(ctx, clusterName, endpoints)
+	if err != nil {
+		return nil, err
+	}
+
+	c, err := client.New(ctx, options...)
+	if err != nil {
+		return nil, err
+	}
+
+	return NewClient(c, clusterName), nil
+}
+
+// StartCacheManager starts watching the relevant resources to do the client cache invalidation.
+func (factory *ClientFactory) StartCacheManager(ctx context.Context) error {
+	eventCh := make(chan state.Event)
+	clusterEndpointMd := omni.NewClusterEndpoint(resources.DefaultNamespace, "").Metadata()
+	talosconfigMd := omni.NewTalosConfig(resources.DefaultNamespace, "").Metadata()
+
+	err := factory.omniState.WatchKind(ctx, clusterEndpointMd, eventCh)
+	if err != nil {
+		return fmt.Errorf("failed to watch ClusterEndpoints: %w", err)
+	}
+
+	err = factory.omniState.WatchKind(ctx, talosconfigMd, eventCh)
+	if err != nil {
+		return fmt.Errorf("failed to watch TalosConfigs: %w", err)
+	}
+
+	factory.logger.Debug("started Talos client cache manager")
+
+	for {
+		select {
+		case <-ctx.Done():
+			if errors.Is(ctx.Err(), context.Canceled) {
+				factory.logger.Debug("stopping Talos client cache manager")
+
+				return nil
+			}
+
+			return fmt.Errorf("talos client cache manager context error: %w", ctx.Err())
+		case ev := <-eventCh:
+			if ev.Error != nil {
+				return fmt.Errorf("talos client cache manager received an error event: %w", ev.Error)
+			}
+
+			if ev.Resource == nil {
+				continue
+			}
+
+			factory.release(ev.Resource.Metadata().ID())
+		}
+	}
+}
+
+// Describe implements prom.Collector interface.
+func (factory *ClientFactory) Describe(ch chan<- *prometheus.Desc) {
+	prometheus.DescribeByCollect(factory, ch)
+}
+
+// Collect implements prom.Collector interface.
+func (factory *ClientFactory) Collect(ch chan<- prometheus.Metric) {
+	factory.metricActiveClients.Collect(ch)
+
+	factory.metricCacheSize.Set(float64(factory.cache.Len()))
+	factory.metricCacheSize.Collect(ch)
+
+	factory.metricCacheHits.Collect(ch)
+	factory.metricCacheMisses.Collect(ch)
+}
+
+var _ prometheus.Collector = &ClientFactory{}
diff --git a/internal/backend/runtime/talos/clients_test.go b/internal/backend/runtime/talos/clients_test.go
new file mode 100644
index 000000000..cb7d7f486
--- /dev/null
+++ b/internal/backend/runtime/talos/clients_test.go
@@ -0,0 +1,122 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package talos_test
+
+import (
+	"context"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/controller/runtime"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/siderolabs/talos/pkg/machinery/config/bundle"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/logging"
+	omnictrl "github.com/siderolabs/omni/internal/backend/runtime/omni/controllers/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+)
+
+type ClientsSuite struct { //nolint:govet
+	suite.Suite
+
+	state state.State
+
+	runtime *runtime.Runtime
+	wg      sync.WaitGroup
+
+	ctx       context.Context //nolint:containedctx
+	ctxCancel context.CancelFunc
+}
+
+func (suite *ClientsSuite) SetupTest() {
+	suite.ctx, suite.ctxCancel = context.WithTimeout(context.Background(), 3*time.Minute)
+	suite.state = state.WrapCore(namespaced.NewState(inmem.Build))
+
+	var err error
+
+	suite.Assert().NoError(err)
+
+	logger := zaptest.NewLogger(suite.T()).With(logging.Component("clients"))
+
+	suite.runtime, err = runtime.NewRuntime(suite.state, logger)
+	suite.Require().NoError(err)
+
+	suite.wg.Add(1)
+
+	go func() {
+		defer suite.wg.Done()
+
+		suite.Assert().NoError(suite.runtime.Run(suite.ctx))
+	}()
+}
+
+func (suite *ClientsSuite) TestGetClient() {
+	clusterName := "omni"
+
+	logger := zaptest.NewLogger(suite.T())
+
+	clientFactory := talos.NewClientFactory(suite.state, logger)
+
+	suite.Require().NoError(suite.runtime.RegisterQController(omnictrl.NewTalosConfigController(constants.CertificateValidityTime)))
+
+	_, err := clientFactory.Get(suite.ctx, clusterName)
+	suite.Require().True(talos.IsClientNotReadyError(err))
+
+	configBundle, err := bundle.NewBundle(bundle.WithInputOptions(
+		&bundle.InputOptions{
+			ClusterName: clusterName,
+			Endpoint:    "https://127.0.0.1:6443",
+		}))
+	suite.Require().NoError(err)
+
+	talosconfig := omni.NewTalosConfig(resources.DefaultNamespace, clusterName)
+	spec := talosconfig.TypedSpec().Value
+
+	context := configBundle.TalosCfg.Contexts[configBundle.TalosCfg.Context]
+
+	spec.Ca = context.CA
+	spec.Crt = context.Crt
+	spec.Key = context.Key
+
+	clusterStatus := omni.NewClusterStatus(resources.DefaultNamespace, clusterName)
+	clusterStatus.TypedSpec().Value.Available = true
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, clusterStatus), state.WithCreateOwner((&omnictrl.ClusterStatusController{}).Name()))
+
+	suite.Require().NoError(suite.state.Create(suite.ctx, talosconfig))
+
+	clusterEndpoint := omni.NewClusterEndpoint(resources.DefaultNamespace, clusterName)
+	clusterEndpoint.TypedSpec().Value.ManagementAddresses = []string{"localhost"}
+	suite.Require().NoError(suite.state.Create(suite.ctx, clusterEndpoint))
+
+	c1, err := clientFactory.Get(suite.ctx, clusterName)
+	suite.Require().NoError(err)
+
+	c2, err := clientFactory.Get(suite.ctx, clusterName)
+	suite.Require().NoError(err)
+
+	suite.Assert().Same(c1, c2)
+}
+
+func (suite *ClientsSuite) TearDownTest() {
+	suite.T().Log("tear down")
+
+	suite.ctxCancel()
+
+	suite.wg.Wait()
+}
+
+func TestClients(t *testing.T) {
+	suite.Run(t, &ClientsSuite{})
+}
diff --git a/internal/backend/runtime/talos/talos.go b/internal/backend/runtime/talos/talos.go
new file mode 100644
index 000000000..5aa992774
--- /dev/null
+++ b/internal/backend/runtime/talos/talos.go
@@ -0,0 +1,266 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package talos implements the connector that can pull data from the Talos controller runtime.
+package talos
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	cosiresource "github.com/cosi-project/runtime/pkg/resource"
+	taloscommon "github.com/siderolabs/talos/pkg/machinery/api/common"
+	"github.com/siderolabs/talos/pkg/machinery/client"
+	clientconfig "github.com/siderolabs/talos/pkg/machinery/client/config"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/common"
+	"github.com/siderolabs/omni/client/pkg/cosi/labels"
+	pkgruntime "github.com/siderolabs/omni/client/pkg/runtime"
+	"github.com/siderolabs/omni/internal/backend/logging"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime/cosi"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+// Name talos runtime string id.
+var Name = common.Runtime_Talos.String()
+
+// Runtime implements runtime.Runtime for Talos resources.
+type Runtime struct {
+	clientFactory *ClientFactory
+	logger        *zap.Logger
+}
+
+// New creates a new Talos runtime.
+func New(clientFactory *ClientFactory, logger *zap.Logger) *Runtime {
+	return &Runtime{
+		clientFactory: clientFactory,
+		logger:        logger.With(logging.Component("talos_runtime")),
+	}
+}
+
+// Watch implements runtime.Runtime.
+func (r *Runtime) Watch(ctx context.Context, events chan<- runtime.WatchResponse, setters ...runtime.QueryOption) error {
+	opts := runtime.NewQueryOptions(setters...)
+
+	switch len(opts.Nodes) {
+	case 0:
+		// nothing
+	case 1:
+		ctx = client.WithNode(ctx, opts.Nodes[0])
+	default:
+		return errors.New("multiple nodes are not supported for Watch")
+	}
+
+	c, err := r.GetClient(ctx, opts.Context)
+	if err != nil {
+		return err
+	}
+
+	var queries []cosiresource.LabelQuery
+
+	if len(opts.LabelSelectors) > 0 {
+		queries, err = labels.ParseSelectors(opts.LabelSelectors)
+		if err != nil {
+			return err
+		}
+	}
+
+	return cosi.WatchLegacy(
+		ctx,
+		c.COSI,
+		cosiresource.NewMetadata(
+			opts.Namespace,
+			opts.Resource,
+			opts.Name,
+			cosiresource.VersionUndefined,
+		),
+		events,
+		opts.TailEvents,
+		queries,
+	)
+}
+
+// Get implements runtime.Runtime.
+func (r *Runtime) Get(ctx context.Context, setters ...runtime.QueryOption) (any, error) {
+	opts := runtime.NewQueryOptions(setters...)
+
+	var responseMetadata *taloscommon.Metadata
+
+	switch len(opts.Nodes) {
+	case 0:
+		// nothing
+	case 1:
+		ctx = client.WithNode(ctx, opts.Nodes[0])
+		responseMetadata = &taloscommon.Metadata{
+			Hostname: opts.Nodes[0],
+		}
+	default:
+		return nil, errors.New("multiple nodes are not supported for Get")
+	}
+
+	c, err := r.GetClient(ctx, opts.Context)
+	if err != nil {
+		return nil, err
+	}
+
+	res, err := c.COSI.Get(ctx, cosiresource.NewMetadata(opts.Namespace, opts.Resource, opts.Name, cosiresource.VersionUndefined))
+	if err != nil {
+		return nil, err
+	}
+
+	return runtime.NewResource(res, runtime.WithMetadata(responseMetadata))
+}
+
+// List implements runtime.Runtime.
+func (r *Runtime) List(ctx context.Context, setters ...runtime.QueryOption) (runtime.ListResult, error) {
+	opts := runtime.NewQueryOptions(setters...)
+
+	if len(opts.Nodes) == 0 {
+		opts.Nodes = []string{""}
+	}
+
+	c, err := r.GetClient(ctx, opts.Context)
+	if err != nil {
+		return runtime.ListResult{}, err
+	}
+
+	var res []pkgruntime.ListItem
+
+	for _, node := range opts.Nodes {
+		var responseMetadata *taloscommon.Metadata
+
+		nodeCtx := ctx
+
+		if node != "" {
+			nodeCtx = client.WithNode(ctx, node)
+			responseMetadata = &taloscommon.Metadata{
+				Hostname: node,
+			}
+		}
+
+		items, err := c.COSI.List(nodeCtx, cosiresource.NewMetadata(opts.Namespace, opts.Resource, "", cosiresource.VersionUndefined))
+		if err != nil {
+			return runtime.ListResult{}, err
+		}
+
+		for _, item := range items.Items {
+			resource, err := runtime.NewResource(item, runtime.WithMetadata(responseMetadata))
+			if err != nil {
+				return runtime.ListResult{}, err
+			}
+
+			res = append(res, newItem(resource))
+		}
+	}
+
+	return runtime.ListResult{
+		Items: res,
+		Total: len(res),
+	}, nil
+}
+
+// Create implements runtime.Runtime.
+func (r *Runtime) Create(context.Context, cosiresource.Resource, ...runtime.QueryOption) error {
+	return errors.New("not implemented")
+}
+
+// Update implements runtime.Runtime.
+func (r *Runtime) Update(context.Context, cosiresource.Resource, ...runtime.QueryOption) error {
+	return errors.New("not implemented")
+}
+
+// Delete implements runtime.Runtime.
+func (r *Runtime) Delete(context.Context, ...runtime.QueryOption) error {
+	return errors.New("not implemented")
+}
+
+// GetTalosconfigRaw returns raw talosconfig for the cluster (or for whole instance if the cluster is not specified).
+func (r *Runtime) GetTalosconfigRaw(context *common.Context, identity string) ([]byte, error) {
+	auth := clientconfig.Auth{}
+
+	auth.SideroV1 = &clientconfig.SideroV1{
+		Identity: identity,
+	}
+
+	contextName := config.Config.Name
+	apiURL := config.Config.APIURL
+
+	cluster := ""
+
+	if context != nil {
+		cluster = context.Name
+	}
+
+	if cluster != "" {
+		contextName = contextName + "-" + cluster
+	}
+
+	talosconfig := clientconfig.Config{
+		Context: contextName,
+		Contexts: map[string]*clientconfig.Context{
+			contextName: {
+				Endpoints: []string{
+					apiURL,
+				},
+				Auth:    auth,
+				Cluster: cluster,
+			},
+		},
+	}
+
+	return talosconfig.Bytes()
+}
+
+// GetClient returns talos client for the cluster name.
+func (r *Runtime) GetClient(ctx context.Context, clusterName string) (*Client, error) {
+	c, err := r.clientFactory.Get(ctx, clusterName)
+	if err != nil {
+		return nil, err
+	}
+
+	connected, err := c.Connected(ctx, r.clientFactory.omniState)
+	if err != nil {
+		return nil, err
+	}
+
+	if !connected {
+		return nil, fmt.Errorf("the cluster %s is not reachable", clusterName)
+	}
+
+	return c, nil
+}
+
+type item struct {
+	runtime.BasicItem[*runtime.Resource]
+}
+
+func (it *item) Field(name string) (string, bool) {
+	val, ok := it.BasicItem.Field(name)
+	if ok {
+		return val, true
+	}
+
+	val, ok = runtime.ResourceField(it.BasicItem.Unwrap().Resource, name)
+	if ok {
+		return val, true
+	}
+
+	return "", false
+}
+
+func (it *item) Match(searchFor string) bool {
+	return it.BasicItem.Match(searchFor) || runtime.MatchResource(it.BasicItem.Unwrap().Resource, searchFor)
+}
+
+func (it *item) Unwrap() any {
+	return it.BasicItem.Unwrap()
+}
+
+func newItem(res *runtime.Resource) pkgruntime.ListItem {
+	return &item{BasicItem: runtime.MakeBasicItem(res.Metadata.ID, res.Metadata.Namespace, res)}
+}
diff --git a/internal/backend/runtime/utils.go b/internal/backend/runtime/utils.go
new file mode 100644
index 000000000..188c06917
--- /dev/null
+++ b/internal/backend/runtime/utils.go
@@ -0,0 +1,174 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package runtime
+
+import (
+	"slices"
+)
+
+// SliceSet is a set of items.
+type SliceSet[T any] struct {
+	cmp   func(a, b T) int
+	slice []T
+}
+
+// NewSliceSet creates new SliceSet.
+func NewSliceSet[T any](cmp func(a, b T) int) SliceSet[T] {
+	return SliceSet[T]{
+		cmp: cmp,
+	}
+}
+
+// Add adds item to the set.
+func (s *SliceSet[T]) Add(item T) {
+	if s.slice == nil {
+		s.slice = []T{item}
+
+		return
+	}
+
+	i, found := slices.BinarySearchFunc(s.slice, item, s.cmp)
+	if found {
+		return
+	}
+
+	s.slice = slices.Insert(s.slice, i, item)
+}
+
+// Len returns number of items in the set.
+func (s *SliceSet[T]) Len() int {
+	return len(s.slice)
+}
+
+// ForEach iterates over all items in the set.
+func (s *SliceSet[T]) ForEach(fn func(item T)) {
+	for _, item := range s.slice {
+		fn(item)
+	}
+}
+
+// Contains returns true if item is in the set.
+func (s *SliceSet[T]) Contains(item T) bool {
+	if len(s.slice) == 0 {
+		return false
+	}
+
+	_, found := slices.BinarySearchFunc(s.slice, item, s.cmp)
+
+	return found
+}
+
+// Reset removes all items from the set.
+func (s *SliceSet[T]) Reset() {
+	s.slice = nil
+}
+
+// Min returns minimum value in the set.
+func (s *SliceSet[T]) Min() (T, bool) {
+	if len(s.slice) == 0 {
+		var zero T
+
+		return zero, false
+	}
+
+	return s.slice[0], true
+}
+
+// Max returns maximum value in the set.
+func (s *SliceSet[T]) Max() (T, bool) {
+	if len(s.slice) == 0 {
+		var zero T
+
+		return zero, false
+	}
+
+	return s.slice[len(s.slice)-1], true
+}
+
+// StreamOffsetLimiter limits number of items returned by stream.
+type StreamOffsetLimiter[T any] struct {
+	cmp       func(a, b T) int
+	min       *T
+	max       *T
+	offsetSet SliceSet[T]
+	limitSet  SliceSet[T]
+
+	offset int
+	limit  int
+}
+
+// MakeStreamOffsetLimiter creates new StreamOffsetLimiter. To create a correct range it expects
+// that all values come sorted for elements it didn't see before.
+func MakeStreamOffsetLimiter[T any](offset int, limit int, cmp func(a, b T) int) *StreamOffsetLimiter[T] {
+	return &StreamOffsetLimiter[T]{
+		cmp:       cmp,
+		offsetSet: NewSliceSet(cmp),
+		limitSet:  NewSliceSet(cmp),
+		offset:    offset,
+		limit:     limit,
+	}
+}
+
+// Check checks that value is in the range of limit and offset.
+func (l *StreamOffsetLimiter[T]) Check(val T) bool {
+	// limit and offset are not set, so we return everything.
+	if l.limit == 0 && l.offset == 0 {
+		return true
+	}
+
+	// We have a range, so we can check if value is in the range.
+	if l.min != nil {
+		if l.max != nil {
+			return l.cmp(val, *l.min) >= 0 && l.cmp(val, *l.max) <= 0
+		}
+
+		// We have empty limit, so we return everything above offset.
+		return l.cmp(val, *l.min) > 0
+	}
+
+	// We haven't skipped offset yet, so we need to skip it.
+	if l.offsetSet.Len() < l.offset {
+		l.offsetSet.Add(val)
+
+		return false
+	}
+
+	// We have skipped offset, check if item is in it.
+	if l.offsetSet.Contains(val) {
+		return false
+	}
+
+	// We have empty limit, so we return everything above offset.
+	if l.limit == 0 {
+		if l.min == nil {
+			min, _ := l.offsetSet.Max()
+			l.min = &min
+			l.offsetSet.Reset()
+		}
+
+		return l.cmp(val, *l.min) > 0
+	}
+
+	// We haven't reached limit yet, so we need to add it to the limit set.
+	if l.limitSet.Len() < l.limit {
+		l.limitSet.Add(val)
+
+		return true
+	}
+
+	// Creating range using min and max from limit set.
+	min, _ := l.limitSet.Min()
+	max, _ := l.limitSet.Max()
+
+	l.min = &min
+	l.max = &max
+
+	// We no longer need limit set and offset set, since we have the range now.
+	l.limitSet.Reset()
+	l.offsetSet.Reset()
+
+	return l.cmp(val, *l.min) >= 0 && l.cmp(val, *l.max) <= 0
+}
diff --git a/internal/backend/runtime/utils_test.go b/internal/backend/runtime/utils_test.go
new file mode 100644
index 000000000..56507a1eb
--- /dev/null
+++ b/internal/backend/runtime/utils_test.go
@@ -0,0 +1,128 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package runtime_test
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/siderolabs/gen/pair"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/internal/backend/runtime"
+)
+
+func TestSliceSet(t *testing.T) {
+	set := runtime.NewSliceSet(strings.Compare)
+
+	set.Add("")
+	set.Add("")
+	set.Add("b")
+	set.Add("a")
+	require.Equal(t, []string{"", "a", "b"}, toSlice(set))
+	require.EqualValues(t, 3, set.Len())
+
+	set.Add("a")
+	require.Equal(t, []string{"", "a", "b"}, toSlice(set))
+
+	set.Add("c")
+	require.Equal(t, []string{"", "a", "b", "c"}, toSlice(set))
+
+	set.Add("1")
+	require.Equal(t, []string{"", "1", "a", "b", "c"}, toSlice(set))
+
+	require.True(t, set.Contains("a"))
+	require.False(t, set.Contains("d"))
+
+	require.Equal(t, pair.MakePair("", true), pair.MakePair(set.Min()))
+	require.Equal(t, pair.MakePair("c", true), pair.MakePair(set.Max()))
+
+	set.Reset()
+	require.Zero(t, toSlice(set))
+	require.False(t, set.Contains("a"))
+
+	require.Equal(t, pair.MakePair("", false), pair.MakePair(set.Min()))
+	require.Equal(t, pair.MakePair("", false), pair.MakePair(set.Max()))
+}
+
+func toSlice(set runtime.SliceSet[string]) []string {
+	var slice []string
+
+	set.ForEach(func(item string) {
+		slice = append(slice, item)
+	})
+
+	return slice
+}
+
+func TestStreamOffsetLimiter(t *testing.T) {
+	tests := []struct {
+		name     string
+		args     []string
+		expected []string
+		offset   int
+		limit    int
+	}{
+		{
+			name:     "offset 0, limit 0",
+			offset:   0,
+			limit:    0,
+			args:     []string{"a", "c", "d", "e", "f", "g"},
+			expected: []string{"a", "c", "d", "e", "f", "g"},
+		},
+		{
+			name:     "offset 0, limit 2",
+			offset:   0,
+			limit:    2,
+			args:     []string{"a", "c", "d", "e", "f", "g"},
+			expected: []string{"a", "c"},
+		},
+		{
+			name:     "offset 3, limit 0",
+			offset:   3,
+			limit:    0,
+			args:     []string{"a", "b", "b", "a1", "c", "b", "d", "e", "f", "b", "a1"},
+			expected: []string{"c", "d", "e", "f"},
+		},
+		{
+			name:     "offset 1, limit 1",
+			offset:   1,
+			limit:    1,
+			args:     []string{"a", "c", "d", "e", "c", "f", "g"},
+			expected: []string{"c", "c"},
+		},
+		{
+			name:     "offset 3, limit 3, duplicated",
+			offset:   3,
+			limit:    3,
+			args:     []string{"a", "a", "b", "b", "a", "c", "c", "d", "d", "e", "d", "e", "d", "f", "f", "g", "g", "f", "d"},
+			expected: []string{"d", "d", "e", "d", "e", "d", "f", "f", "f", "d"},
+		},
+		{
+			name:     "offset 3, limit 2",
+			offset:   3,
+			limit:    3,
+			args:     []string{"a", "c", "d", "e", "e", "f", "e", "g", "h", "e", "i", "e1", "e2", "e"},
+			expected: []string{"e", "e", "f", "e", "g", "e", "e1", "e2", "e"},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			offsetLimiter := runtime.MakeStreamOffsetLimiter(test.offset, test.limit, strings.Compare)
+
+			var accum []string
+
+			for _, arg := range test.args {
+				if offsetLimiter.Check(arg) {
+					accum = append(accum, arg)
+				}
+			}
+
+			require.Equal(t, test.expected, accum)
+		})
+	}
+}
diff --git a/internal/backend/runtime/watch.go b/internal/backend/runtime/watch.go
new file mode 100644
index 000000000..0ab527cd8
--- /dev/null
+++ b/internal/backend/runtime/watch.go
@@ -0,0 +1,86 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package runtime
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/siderolabs/omni/client/api/omni/resources"
+)
+
+// NewWatchResponseFromCOSIEvent creates new WatchResponse from COSI state.Event.
+func NewWatchResponseFromCOSIEvent(response state.Event) (*resources.WatchResponse, error) {
+	var (
+		old, res any
+		err      error
+	)
+
+	res, err = NewResource(response.Resource)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create resource %w", err)
+	}
+
+	if response.Old != nil {
+		old, err = NewResource(response.Old)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create resource %w", err)
+		}
+	}
+
+	return NewWatchResponse(resources.EventType(response.Type+1), res, old)
+}
+
+// NewWatchResponse creates watch response from resources and event type.
+func NewWatchResponse(eventType resources.EventType, res, old any) (*resources.WatchResponse, error) {
+	var (
+		resEncoded string
+		oldEncoded string
+		err        error
+	)
+
+	if old != nil {
+		oldEncoded, err = MarshalJSON(old)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	resEncoded, err = MarshalJSON(res)
+	if err != nil {
+		return nil, err
+	}
+
+	return &resources.WatchResponse{
+		Event: &resources.Event{
+			EventType: eventType,
+			Resource:  resEncoded,
+			Old:       oldEncoded,
+		},
+	}, nil
+}
+
+// MarshalJSON encodes resource as JSON using jsonpb marshaler for proto.Messages or a standard marshaler.
+func MarshalJSON(res any) (string, error) {
+	if m, ok := res.(proto.Message); ok {
+		opts := protojson.MarshalOptions{
+			UseProtoNames:  true,
+			UseEnumNumbers: true,
+		}
+
+		data, err := opts.Marshal(m)
+
+		return string(data), err
+	}
+
+	data, err := json.Marshal(res)
+
+	return string(data), err
+}
diff --git a/internal/backend/saml/encoder.go b/internal/backend/saml/encoder.go
new file mode 100644
index 000000000..d70f526d8
--- /dev/null
+++ b/internal/backend/saml/encoder.go
@@ -0,0 +1,42 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package saml
+
+import (
+	"encoding/base64"
+
+	"github.com/crewjam/saml/samlsp"
+	"gopkg.in/yaml.v3"
+)
+
+// Encoder serializes tracked request cookies as base64 encoded YAML.
+type Encoder struct{}
+
+// Encode returns an encoded string representing the TrackedRequest.
+func (*Encoder) Encode(in samlsp.TrackedRequest) (string, error) {
+	res, err := yaml.Marshal(in)
+	if err != nil {
+		return "", err
+	}
+
+	return base64.StdEncoding.EncodeToString(res), nil
+}
+
+// Decode returns a Tracked request from an encoded string.
+func (*Encoder) Decode(in string) (*samlsp.TrackedRequest, error) {
+	var req samlsp.TrackedRequest
+
+	rawYAML, err := base64.StdEncoding.DecodeString(in)
+	if err != nil {
+		return nil, err
+	}
+
+	if err = yaml.Unmarshal(rawYAML, &req); err != nil {
+		return nil, err
+	}
+
+	return &req, nil
+}
diff --git a/internal/backend/saml/saml.go b/internal/backend/saml/saml.go
new file mode 100644
index 000000000..1805769fb
--- /dev/null
+++ b/internal/backend/saml/saml.go
@@ -0,0 +1,128 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package saml contains SAML setup handlers.
+package saml
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/url"
+	"os"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/crewjam/saml"
+	"github.com/crewjam/saml/samlsp"
+	"github.com/prometheus/client_golang/prometheus"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/internal/backend/logging"
+	"github.com/siderolabs/omni/internal/backend/monitoring"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+// NewHandler creates new SAML handler.
+func NewHandler(state state.State, cfg *specs.AuthConfigSpec_SAML, logger *zap.Logger) (*samlsp.Middleware, error) {
+	idpMetadata, err := readMetadata(cfg)
+	if err != nil {
+		return nil, err
+	}
+
+	rootURL, err := url.Parse(config.Config.APIURL)
+	if err != nil {
+		return nil, err
+	}
+
+	opts := samlsp.Options{
+		URL:            *rootURL,
+		IDPMetadata:    idpMetadata,
+		LogoutBindings: []string{saml.HTTPPostBinding},
+	}
+
+	serviceProvider := samlsp.DefaultServiceProvider(opts)
+	requestTracker := samlsp.DefaultRequestTracker(opts, &serviceProvider)
+	requestTracker.Codec = &Encoder{}
+
+	m := &samlsp.Middleware{
+		ServiceProvider: serviceProvider,
+		ResponseBinding: saml.HTTPPostBinding,
+		OnError:         createErrorHandler(logger),
+		Session: &SessionProvider{
+			state:   state,
+			tracker: requestTracker,
+			logger:  logger.With(logging.Component("saml_session")),
+		},
+		RequestTracker: requestTracker,
+	}
+
+	return m, nil
+}
+
+// RegisterHandlers adds login and logout handlers.
+func RegisterHandlers(saml *samlsp.Middleware, mux *http.ServeMux, logger *zap.Logger) {
+	logger = logger.With(zap.String("handler", "saml"))
+	login := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		saml.HandleStartAuthFlow(w, r)
+	})
+
+	md := http.HandlerFunc(saml.ServeMetadata)
+	promLabel := prometheus.Labels{"handler": "saml"}
+
+	mux.Handle("/saml/", monitoring.NewHandler(
+		logging.NewHandler(saml, logger),
+		promLabel,
+	))
+
+	mux.Handle("/saml/metadata", monitoring.NewHandler(
+		logging.NewHandler(md, logger),
+		promLabel,
+	))
+
+	mux.Handle("/login", monitoring.NewHandler(
+		logging.NewHandler(login, logger),
+		promLabel,
+	))
+}
+
+func readMetadata(cfg *specs.AuthConfigSpec_SAML) (*saml.EntityDescriptor, error) {
+	if cfg.Url != "" {
+		idpMetadataURL, err := url.Parse(cfg.Url)
+		if err != nil {
+			return nil, err
+		}
+
+		return samlsp.FetchMetadata(context.Background(), http.DefaultClient,
+			*idpMetadataURL)
+	}
+
+	data, err := os.ReadFile(cfg.Metadata)
+	if err != nil {
+		return nil, err
+	}
+
+	return samlsp.ParseMetadata(data)
+}
+
+func createErrorHandler(logger *zap.Logger) func(http.ResponseWriter, *http.Request, error) {
+	logger = logger.With(logging.Component("saml"))
+
+	return func(w http.ResponseWriter, r *http.Request, err error) {
+		var invalidSAML *saml.InvalidResponseError
+
+		if errors.As(err, &invalidSAML) {
+			logger.Warn("received invalid saml response",
+				zap.String("response", invalidSAML.Response),
+				zap.Time("now", invalidSAML.Now),
+				zap.Error(invalidSAML.PrivateErr),
+			)
+		} else {
+			logger.Error("saml error", zap.Error(err))
+		}
+
+		http.Redirect(w, r, "/forbidden", http.StatusSeeOther)
+	}
+}
diff --git a/internal/backend/saml/session.go b/internal/backend/saml/session.go
new file mode 100644
index 000000000..e11f1137d
--- /dev/null
+++ b/internal/backend/saml/session.go
@@ -0,0 +1,407 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package saml contains SAML setup handlers.
+package saml
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/kvutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/crewjam/saml"
+	"github.com/crewjam/saml/samlsp"
+	"github.com/google/uuid"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/cosi/labels"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/auth/user"
+)
+
+// UserInfo describes user identity and fullname.
+type UserInfo struct {
+	// Identity ...
+	Identity string
+	// Fullname ...
+	Fullname string
+}
+
+// SessionProvider is an implementation of SessionProvider that stores
+// session tokens in the COSI state.
+type SessionProvider struct {
+	state   state.State
+	tracker samlsp.RequestTracker
+	logger  *zap.Logger
+}
+
+// CreateSession is called when we have received a valid SAML assertion and
+// should create a new session and do redirect.
+func (sp *SessionProvider) CreateSession(w http.ResponseWriter, r *http.Request, assertion *saml.Assertion) error {
+	hashInput := ""
+
+	if assertion.Subject == nil {
+		return errors.New("no subject in the assertion")
+	}
+
+	for _, subjectConfirmation := range assertion.Subject.SubjectConfirmations {
+		hashInput += subjectConfirmation.SubjectConfirmationData.InResponseTo
+	}
+
+	var logFields []zap.Field
+
+	if sub := assertion.Subject; sub != nil {
+		if nameID := sub.NameID; nameID != nil {
+			logFields = append(logFields, zap.String("subject_id", nameID.Value))
+		}
+	}
+
+	for _, attributeStatement := range assertion.AttributeStatements {
+		for _, attr := range attributeStatement.Attributes {
+			name := attr.FriendlyName
+			if name == "" {
+				name = attr.Name
+			}
+
+			var value string
+
+			if len(attr.Values) > 0 {
+				value = attr.Values[0].Value
+			}
+
+			logFields = append(logFields, zap.String(name, value))
+		}
+	}
+
+	sp.logger.Info("new SAML assertion", logFields...)
+
+	var session string
+
+	if hashInput == "" {
+		session = uuid.New().String()
+	} else {
+		h := sha256.New()
+
+		h.Write([]byte(hashInput))
+
+		session = hex.EncodeToString(h.Sum(nil))
+	}
+
+	query := r.URL.Query()
+
+	if trackedRequestIndex := r.Form.Get("RelayState"); trackedRequestIndex != "" {
+		trackedRequest, err := sp.tracker.GetTrackedRequest(r, trackedRequestIndex)
+		if err != nil {
+			return err
+		}
+
+		redirectURI, err := url.Parse(trackedRequest.URI)
+		if err != nil {
+			return err
+		}
+
+		query = redirectURI.Query()
+	}
+
+	query.Set("session", session)
+
+	user, err := LocateUserInfo(assertion)
+	if err != nil {
+		return err
+	}
+
+	query.Set("identity", user.Identity)
+	query.Set("fullname", user.Fullname)
+
+	if user.Identity == "" {
+		return errors.New("couldn't find user identity in the SAML assertion")
+	}
+
+	samlAssertion := auth.NewSAMLAssertion(resources.DefaultNamespace, session)
+
+	samlAssertion.TypedSpec().Value.Data, err = json.Marshal(assertion)
+	if err != nil {
+		return err
+	}
+
+	samlAssertion.TypedSpec().Value.Email = user.Identity
+
+	ctx := actor.MarkContextAsInternalActor(r.Context())
+
+	if err = sp.state.Create(ctx, samlAssertion); err != nil {
+		return err
+	}
+
+	samlLabels, err := sp.readLabelsFromAssertion(ctx, assertion)
+	if err != nil {
+		return err
+	}
+
+	if err = sp.ensureUser(ctx, user.Identity, samlLabels); err != nil {
+		return err
+	}
+
+	http.Redirect(w, r, fmt.Sprintf("/omni/authenticate?%s", query.Encode()), http.StatusSeeOther)
+
+	return nil
+}
+
+// DeleteSession shouldn't be used by SAML provider configured for Omni.
+// Session cleanup is done on the first usage or by a timeout.
+func (sp *SessionProvider) DeleteSession(http.ResponseWriter, *http.Request) error {
+	return errors.New("not implemented")
+}
+
+// GetSession shouldn't be used by SAML provider configured for Omni.
+func (sp *SessionProvider) GetSession(*http.Request) (samlsp.Session, error) {
+	return nil, errors.New("not implemented")
+}
+
+func (sp *SessionProvider) readLabelsFromAssertion(ctx context.Context, assertion *saml.Assertion) (map[string]string, error) {
+	knownFields := map[string]string{
+		// Microsoft
+		"http://schemas.microsoft.com/ws/2008/06/identity/claims/role": "role",
+		// Google
+		"Role": "role",
+		// Samltest
+		"role": "role",
+	}
+
+	config, err := safe.ReaderGet[*auth.Config](ctx, sp.state, auth.NewAuthConfig().Metadata())
+	if err != nil {
+		return nil, err
+	}
+
+	customFields := config.TypedSpec().Value.Saml.LabelRules
+
+	get := func(attr saml.Attribute, from map[string]string) (string, string) {
+		dest, ok := from[attr.FriendlyName]
+		if !ok {
+			dest, ok = from[attr.Name]
+
+			if !ok {
+				return "", ""
+			}
+		}
+
+		return dest, attr.Values[0].Value
+	}
+
+	samlLabels := make(map[string]string)
+
+	for _, attributeStatement := range assertion.AttributeStatements {
+		for _, attr := range attributeStatement.Attributes {
+			if len(attr.Values) == 0 {
+				continue
+			}
+
+			key, value := get(attr, customFields)
+			if key == "" {
+				key, value = get(attr, knownFields)
+			}
+
+			if key == "" {
+				continue
+			}
+
+			samlLabels[fmt.Sprintf("%s%s/%s", auth.SAMLLabelPrefix, key, value)] = ""
+		}
+	}
+
+	return samlLabels, nil
+}
+
+func (sp *SessionProvider) ensureUser(ctx context.Context, email string, samlLabels map[string]string) error {
+	users, err := sp.state.List(ctx, auth.NewUser(resources.DefaultNamespace, "").Metadata())
+	if err != nil {
+		return err
+	}
+
+	r := role.Admin
+	if len(users.Items) > 0 {
+		r, err = sp.getRoleInSAMLLabelRules(ctx, samlLabels)
+		if err != nil {
+			return err
+		}
+	}
+
+	if err = user.Ensure(ctx, sp.state, email, r); err != nil {
+		return err
+	}
+
+	if err = sp.updateIdentityLabels(ctx, email, samlLabels); err != nil {
+		return err
+	}
+
+	return err
+}
+
+func (sp *SessionProvider) updateIdentityLabels(ctx context.Context, identity string, samlLabels map[string]string) error {
+	identityPtr := auth.NewIdentity(resources.DefaultNamespace, identity).Metadata()
+
+	_, err := safe.StateUpdateWithConflicts[*auth.Identity](ctx, sp.state, identityPtr, func(r *auth.Identity) error {
+		var toDelete []string
+
+		for _, label := range r.Metadata().Labels().Keys() {
+			if !strings.HasPrefix(label, auth.SAMLLabelPrefix) {
+				continue
+			}
+
+			if _, ok := samlLabels[label]; !ok {
+				toDelete = append(toDelete, label)
+			}
+		}
+
+		r.Metadata().Labels().Do(func(temp kvutils.TempKV) {
+			for k, v := range samlLabels {
+				temp.Set(k, v)
+			}
+
+			for _, k := range toDelete {
+				temp.Delete(k)
+			}
+		})
+
+		return nil
+	})
+
+	return err
+}
+
+// getRoleInSAMLLabelRules returns the highest role found in the SAML label rules.
+//
+// If there is no rule matching the labels, role.None is returned.
+func (sp *SessionProvider) getRoleInSAMLLabelRules(ctx context.Context, samlLabels map[string]string) (role.Role, error) {
+	labelRuleList, err := safe.ReaderListAll[*auth.SAMLLabelRule](ctx, sp.state)
+	if err != nil {
+		return "", err
+	}
+
+	labelRules := make([]*auth.SAMLLabelRule, 0)
+
+	for iter := labelRuleList.Iterator(); iter.Next(); {
+		labelRule := iter.Value()
+
+		labelRules = append(labelRules, labelRule)
+	}
+
+	return RoleInSAMLLabelRules(labelRules, samlLabels, sp.logger), nil
+}
+
+// RoleInSAMLLabelRules returns the role on the SAMLLabelRules with the highest access level that matches the labels.
+func RoleInSAMLLabelRules(samlLabelRules []*auth.SAMLLabelRule, samlLabels map[string]string, logger *zap.Logger) role.Role {
+	samlRole := role.None
+
+	resLabels := resource.Labels{}
+
+	for key, value := range samlLabels {
+		resLabels.Set(key, value)
+	}
+
+	for _, labelRule := range samlLabelRules {
+		selectors, selectorsErr := labels.ParseSelectors(labelRule.TypedSpec().Value.GetMatchLabels())
+		if selectorsErr != nil {
+			logger.Warn("skip invalid match labels on identity label rule", zap.Error(selectorsErr))
+
+			continue
+		}
+
+		if selectors.Matches(resLabels) {
+			parsedRole, parseErr := role.Parse(labelRule.TypedSpec().Value.GetAssignRoleOnRegistration())
+			if parseErr != nil {
+				logger.Warn("skip invalid role on identity label rule", zap.Error(parseErr))
+
+				continue
+			}
+
+			maxRole, maxErr := role.Max(parsedRole, samlRole)
+			if maxErr != nil {
+				logger.Warn("skip invalid role on identity label rule", zap.Error(maxErr))
+
+				continue
+			}
+
+			samlRole = maxRole
+		}
+	}
+
+	return samlRole
+}
+
+// LocateUserInfo searches for user email and fullname in the ACS response.
+func LocateUserInfo(assertion *saml.Assertion) (UserInfo, error) {
+	var (
+		user      UserInfo
+		givenName string
+		surname   string
+	)
+
+	copyFields := map[string]*string{
+		// samltest.sp SAML.
+		"urn:oasis:names:tc:SAML:attribute:subject-id": &user.Identity,
+		"displayName": &user.Fullname,
+		// Microsoft SAML.
+		"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": &user.Identity,
+		"http://schemas.microsoft.com/identity/claims/displayname":   &user.Fullname,
+		// keycloak X500 mapping
+		"email":     &user.Identity,
+		"givenName": &givenName,
+		"surname":   &surname,
+	}
+
+	// Google SAML keeps that info in Subject.
+	if strings.Contains(assertion.Issuer.Value, "google.com") {
+		if sub := assertion.Subject; sub != nil {
+			if nameID := sub.NameID; nameID != nil {
+				user.Identity = nameID.Value
+				user.Fullname = nameID.Value
+			}
+		}
+	}
+
+	for _, attributeStatement := range assertion.AttributeStatements {
+		for _, attr := range attributeStatement.Attributes {
+			param, ok := copyFields[attr.FriendlyName]
+			if !ok {
+				param, ok = copyFields[attr.Name]
+
+				if !ok {
+					continue
+				}
+			}
+
+			if len(attr.Values) == 0 {
+				continue
+			}
+
+			*param = attr.Values[0].Value
+		}
+	}
+
+	if givenName != "" && surname != "" {
+		user.Fullname = givenName + " " + surname
+	}
+
+	if user.Identity == "" {
+		return UserInfo{}, errors.New("unsupported SAML IDP: cannot find user identity in the assertion")
+	}
+
+	user.Identity = strings.ToLower(user.Identity)
+
+	return user, nil
+}
diff --git a/internal/backend/saml/session_test.go b/internal/backend/saml/session_test.go
new file mode 100644
index 000000000..67faeb651
--- /dev/null
+++ b/internal/backend/saml/session_test.go
@@ -0,0 +1,149 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package saml_test
+
+import (
+	"net/url"
+	"os"
+	"testing"
+	"time"
+
+	csaml "github.com/crewjam/saml"
+	"github.com/crewjam/saml/samlsp"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/internal/backend/saml"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+)
+
+func TestUserInfo(t *testing.T) {
+	var fakeTime string
+
+	csaml.TimeNow = func() time.Time {
+		now, err := time.Parse(time.RFC3339, fakeTime)
+		require.NoError(t, err)
+
+		return now
+	}
+
+	// Assertion parse is sensitive to time, signature expects XML to have exactly the same bytes as it was sent by IDP.
+	// So we fake time here and add all possible request ids.
+	for _, tt := range []struct {
+		file       string
+		rootURL    string
+		time       string
+		shouldFail bool
+	}{
+		{
+			file:    "google",
+			rootURL: "https://77.108.97.212:8099/",
+			time:    "2023-06-01T16:20:13.346Z",
+		},
+		{
+			file:    "microsoft",
+			rootURL: "https://localhost:8099/",
+			time:    "2023-06-01T16:14:13.346Z",
+		},
+		{
+			file:    "samlsp",
+			rootURL: "https://localhost:8099/",
+			time:    "2023-06-01T16:14:13.346Z",
+		},
+	} {
+		t.Run(tt.file, func(t *testing.T) {
+			fakeTime = tt.time
+
+			rootURL, err := url.Parse(tt.rootURL)
+			require.NoError(t, err)
+
+			d, err := os.ReadFile("testdata/" + tt.file + "_metadata.xml")
+			require.NoError(t, err)
+
+			idpMetadata, err := samlsp.ParseMetadata(d)
+			require.NoError(t, err)
+
+			opts := samlsp.Options{
+				URL:         *rootURL,
+				IDPMetadata: idpMetadata,
+			}
+
+			sp := samlsp.DefaultServiceProvider(opts)
+
+			d, err = os.ReadFile("testdata/" + tt.file + "_acs.xml")
+			require.NoError(t, err)
+
+			assertion, err := sp.ParseXMLResponse(d, []string{
+				"id-2837ca5976dd42731472c4d4da0c953603232b9f",
+				"id-3809fc8de18772f24b29629342ea4b91d6a5cadc",
+				"id-ebe26e0275903436e5a2c334d90f3e953985fd75",
+			})
+			require.NoError(t, err)
+
+			user, err := saml.LocateUserInfo(assertion)
+
+			if tt.shouldFail {
+				require.Error(t, err)
+
+				return
+			}
+
+			require.NoError(t, err)
+			require.NotEmpty(t, user.Identity)
+			require.NotEmpty(t, user.Fullname)
+		})
+	}
+}
+
+func TestRoleInSAMLLabelRules(t *testing.T) {
+	logger := zaptest.NewLogger(t)
+
+	operatorRoleToDeveloper := auth.NewSAMLLabelRule(resources.DefaultNamespace, "assign-operator-to-developer")
+
+	operatorRoleToDeveloper.TypedSpec().Value.MatchLabels = []string{"saml.omni.sidero.dev/role/developer"}
+	operatorRoleToDeveloper.TypedSpec().Value.AssignRoleOnRegistration = string(role.Operator)
+
+	readerRoleToDeveloper := auth.NewSAMLLabelRule(resources.DefaultNamespace, "assign-reader-to-developer")
+
+	readerRoleToDeveloper.TypedSpec().Value.MatchLabels = []string{"saml.omni.sidero.dev/role/developer"}
+	readerRoleToDeveloper.TypedSpec().Value.AssignRoleOnRegistration = string(role.Reader)
+
+	adminRoleToManager := auth.NewSAMLLabelRule(resources.DefaultNamespace, "assign-admin-to-manager")
+
+	adminRoleToManager.TypedSpec().Value.MatchLabels = []string{"saml.omni.sidero.dev/role/manager"}
+	adminRoleToManager.TypedSpec().Value.AssignRoleOnRegistration = string(role.Admin)
+
+	invalidRoleToFoobar := auth.NewSAMLLabelRule(resources.DefaultNamespace, "assign-invalid-role-to-foobar")
+
+	invalidRoleToFoobar.TypedSpec().Value.MatchLabels = []string{"saml.omni.sidero.dev/role/foobar"}
+	invalidRoleToFoobar.TypedSpec().Value.AssignRoleOnRegistration = "invalid-role"
+
+	// match the role in the rules with the highest access level
+
+	matchedRole := saml.RoleInSAMLLabelRules(
+		[]*auth.SAMLLabelRule{operatorRoleToDeveloper, readerRoleToDeveloper, adminRoleToManager, invalidRoleToFoobar},
+		map[string]string{
+			"saml.omni.sidero.dev/role/developer": "",
+		}, logger)
+
+	require.Equal(t, matchedRole, role.Operator)
+
+	matchedRole = saml.RoleInSAMLLabelRules([]*auth.SAMLLabelRule{operatorRoleToDeveloper, invalidRoleToFoobar, adminRoleToManager}, map[string]string{
+		"saml.omni.sidero.dev/role/manager": "",
+	}, logger)
+
+	require.Equal(t, matchedRole, role.Admin)
+
+	// if the role in the rule is invalid, log it and return None
+
+	matchedRole = saml.RoleInSAMLLabelRules([]*auth.SAMLLabelRule{invalidRoleToFoobar}, map[string]string{
+		"saml.omni.sidero.dev/role/foobar": "",
+	}, logger)
+
+	require.Equal(t, matchedRole, role.None)
+}
diff --git a/internal/backend/saml/testdata/google_acs.xml b/internal/backend/saml/testdata/google_acs.xml
new file mode 100644
index 000000000..c639dcd97
--- /dev/null
+++ b/internal/backend/saml/testdata/google_acs.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://77.108.97.212:8099/saml/acs" ID="_7d6008efda32cfc2c29b526c3e64357b" InResponseTo="id-ebe26e0275903436e5a2c334d90f3e953985fd75" IssueInstant="2023-06-01T16:28:13.346Z" Version="2.0"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://accounts.google.com/o/saml2?idpid=C03vb0qyk</saml2:Issuer><saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2p:Status><saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_499de9dd3241dc2301cee067d690af9f" IssueInstant="2023-06-01T16:28:13.346Z" Version="2.0"><saml2:Issuer>https://accounts.google.com/o/saml2?idpid=C03vb0qyk</saml2:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><ds:Reference URI="#_499de9dd3241dc2301cee067d690af9f"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>KPgq+CzNHhhCXUzwn50n0ZdxtBZ2YM3br0zK9s2wTn4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>t90sERNJ36bIGj/1wC71T3UnWhgLz5t00Ud7BUgMxT/q4Llsj3fWFlB0khbjcApp4jagxTSJY8gu
+9csRBY5Kx6nLrsB94XObHE8SHWkvnQAQeZ8onyvej+8mV+GrxtTgigpLgfYs8ijVuGeGrkKA78CZ
+kx1BftNeTgTauLy0e4hMmF/IwKX7pze7lR7D3CRTxz1Tt/1s6brXHQ0tQ22/c/w8DzAp8tXoJV5Y
+FmZstC63ApzPu3hslXp+LIbSnAtT+v6lCLbpEwuz4fEp3lXqyyOF24wZo8uKsRrwukx/ZG+TorMQ
+zKd2tPh8zY7tWDc6xorrPcais3VDjSalbLcdCQ==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509SubjectName>ST=California,C=US,OU=Google For Work,CN=Google,L=Mountain View,O=Google Inc.</ds:X509SubjectName><ds:X509Certificate>MIIDdDCCAlygAwIBAgIGAYHJZxF+MA0GCSqGSIb3DQEBCwUAMHsxFDASBgNVBAoTC0dvb2dsZSBJ
+bmMuMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MQ8wDQYDVQQDEwZHb29nbGUxGDAWBgNVBAsTD0dv
+b2dsZSBGb3IgV29yazELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWEwHhcNMjIwNzA0
+MTMyOTQzWhcNMjcwNzAzMTMyOTQzWjB7MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEWMBQGA1UEBxMN
+TW91bnRhaW4gVmlldzEPMA0GA1UEAxMGR29vZ2xlMRgwFgYDVQQLEw9Hb29nbGUgRm9yIFdvcmsx
+CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAy6YHJ7cNCd3nRv2IiiDQ14BTRAWFzEztvRDc9ZMuGnlO3TAr9iB88xSyvBDSFC4t
+qk7OW4DMzRqkBd6ixPqoscOz0k0Avhbcu+RdQEShKaOu7k+OGvi3O54u1LjZUNMEaQrYFC27cFzn
+KK5njh6xqpzhzzLDi2lblmZPwvJk9PcIIoBrvsgci7qNS1FIVATDWmBvyQ6LMuE3E9DpoGtDrOG6
+HHHFGUPwg6s3QPtMLF3a/6ZR3XR00MT39SwhJqdhMogH5ncMQ8Hgcp7H5+tFyPC75H4+pNAkrlKs
+r52nYquUu7FUPnhkbljroTpSgmpdos3UM1cfRBM2YvvJC8BHEQIDAQABMA0GCSqGSIb3DQEBCwUA
+A4IBAQBFTKWIwHJhwhfFrXXYujzi0ivbR3yJmluhL25XM7VlEc9my8dRHfzehWXfILgnAx//OKlY
+7jZlOTAWCX3nXaLQz6tIGO02yGWu2sG8wqcVcfTrFxWDXsriiefV8PpJRjGwmm+gfM5GnPl09KyA
+e24/e3vd2hk5VOz+FU9x8Bm+i6U8+mKnMdjym37LQzRWrZyBdhvSheJfq6w0eoO7wXjqJIzYwT12
+wvKK79SZ1JPkpFZykw+B8KjtOPv+Cy4OYrfuGR31AU3NcegIE2wCI7am/ue6LqPU/sDGAEa+S5uL
+VZXp03YBtQBLauNIY7DBKLTfmkIT/MbMtRwZGj76wZ1P</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2:Subject><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">artem.chernyshev@siderolabs.com</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData InResponseTo="id-ebe26e0275903436e5a2c334d90f3e953985fd75" NotOnOrAfter="2023-06-01T16:33:13.346Z" Recipient="https://77.108.97.212:8099/saml/acs"/></saml2:SubjectConfirmation></saml2:Subject><saml2:Conditions NotBefore="2023-06-01T16:23:13.346Z" NotOnOrAfter="2023-06-01T16:33:13.346Z"><saml2:AudienceRestriction><saml2:Audience>https://77.108.97.212:8099/saml/metadata</saml2:Audience></saml2:AudienceRestriction></saml2:Conditions><saml2:AttributeStatement><saml2:Attribute Name="Role"><saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:anyType">Developers</saml2:AttributeValue></saml2:Attribute></saml2:AttributeStatement><saml2:AuthnStatement AuthnInstant="2023-05-24T08:12:57.000Z" SessionIndex="_499de9dd3241dc2301cee067d690af9f"><saml2:AuthnContext><saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml2:AuthnContextClassRef></saml2:AuthnContext></saml2:AuthnStatement></saml2:Assertion></saml2p:Response>
\ No newline at end of file
diff --git a/internal/backend/saml/testdata/google_metadata.xml b/internal/backend/saml/testdata/google_metadata.xml
new file mode 100644
index 000000000..dc155be61
--- /dev/null
+++ b/internal/backend/saml/testdata/google_metadata.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://accounts.google.com/o/saml2?idpid=C03vb0qyk" validUntil="2027-07-03T13:29:43.000Z">
+  <md:IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <md:KeyDescriptor use="signing">
+      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+        <ds:X509Data>
+          <ds:X509Certificate>MIIDdDCCAlygAwIBAgIGAYHJZxF+MA0GCSqGSIb3DQEBCwUAMHsxFDASBgNVBAoTC0dvb2dsZSBJbmMuMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MQ8wDQYDVQQDEwZHb29nbGUxGDAWBgNVBAsTD0dvb2dsZSBGb3IgV29yazELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWEwHhcNMjIwNzA0MTMyOTQzWhcNMjcwNzAzMTMyOTQzWjB7MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEPMA0GA1UEAxMGR29vZ2xlMRgwFgYDVQQLEw9Hb29nbGUgRm9yIFdvcmsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy6YHJ7cNCd3nRv2IiiDQ14BTRAWFzEztvRDc9ZMuGnlO3TAr9iB88xSyvBDSFC4tqk7OW4DMzRqkBd6ixPqoscOz0k0Avhbcu+RdQEShKaOu7k+OGvi3O54u1LjZUNMEaQrYFC27cFznKK5njh6xqpzhzzLDi2lblmZPwvJk9PcIIoBrvsgci7qNS1FIVATDWmBvyQ6LMuE3E9DpoGtDrOG6HHHFGUPwg6s3QPtMLF3a/6ZR3XR00MT39SwhJqdhMogH5ncMQ8Hgcp7H5+tFyPC75H4+pNAkrlKsr52nYquUu7FUPnhkbljroTpSgmpdos3UM1cfRBM2YvvJC8BHEQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBFTKWIwHJhwhfFrXXYujzi0ivbR3yJmluhL25XM7VlEc9my8dRHfzehWXfILgnAx//OKlY7jZlOTAWCX3nXaLQz6tIGO02yGWu2sG8wqcVcfTrFxWDXsriiefV8PpJRjGwmm+gfM5GnPl09KyAe24/e3vd2hk5VOz+FU9x8Bm+i6U8+mKnMdjym37LQzRWrZyBdhvSheJfq6w0eoO7wXjqJIzYwT12wvKK79SZ1JPkpFZykw+B8KjtOPv+Cy4OYrfuGR31AU3NcegIE2wCI7am/ue6LqPU/sDGAEa+S5uLVZXp03YBtQBLauNIY7DBKLTfmkIT/MbMtRwZGj76wZ1P</ds:X509Certificate>
+        </ds:X509Data>
+      </ds:KeyInfo>
+    </md:KeyDescriptor>
+    <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
+    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://accounts.google.com/o/saml2/idp?idpid=C03vb0qyk"/>
+    <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://accounts.google.com/o/saml2/idp?idpid=C03vb0qyk"/>
+  </md:IDPSSODescriptor>
+</md:EntityDescriptor>
\ No newline at end of file
diff --git a/internal/backend/saml/testdata/microsoft_acs.xml b/internal/backend/saml/testdata/microsoft_acs.xml
new file mode 100644
index 000000000..2e826e50e
--- /dev/null
+++ b/internal/backend/saml/testdata/microsoft_acs.xml
@@ -0,0 +1 @@
+<samlp:Response ID="_639eb7b8-d6a7-4095-a47a-4be0cb902491" Version="2.0" IssueInstant="2023-06-01T16:14:52.149Z" Destination="https://localhost:8099/saml/acs" InResponseTo="id-2837ca5976dd42731472c4d4da0c953603232b9f" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://sts.windows.net/57fb1072-f4b5-4e0d-b18f-f3147e598295/</Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><Assertion ID="_b6b3116e-7364-4cd8-a586-890d34aa5501" IssueInstant="2023-06-01T16:14:52.143Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion"><Issuer>https://sts.windows.net/57fb1072-f4b5-4e0d-b18f-f3147e598295/</Issuer><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><Reference URI="#_b6b3116e-7364-4cd8-a586-890d34aa5501"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>82luhWsVycWXDS/QMjn1dlLK5Lk5A4YgTRk7epx1ebU=</DigestValue></Reference></SignedInfo><SignatureValue>NOE8HZ6vjzle+vRDP5E1cSx6i+s4c4ov4PHHTSaFN3anDkYcBBIU0xenQm+fNsQ4fXvKco7NukPkyEvYOX4U45NipiJsREDdiYy4sfIjPPHPzB/y1jXF46Gh0uhY+/iTVjbYC7Oyp+/1uRJMQnttyp+ijlYzemX7kHVySGaf31pribL9K4lrrZocVEKBzI3h9Cpor7gCn2E4UCu3W+xjoPv2MZW6vCRsRMqmzOa5RjcgXTRCzYT1SD0YIrhxhrEK3DQ3qcHgEXfp9m7B6GqeKyWxbFK/zdDG4ka9ltymg2WAl9p5w0F3Cvnc/PIvdBiEBHl+HFffVsBDS7BNMWFysA==</SignatureValue><KeyInfo><X509Data><X509Certificate>MIIC8DCCAdigAwIBAgIQQ/Uc/Ut2xa5HreoGsGikyTANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylNaWNyb3NvZnQgQXp1cmUgRmVkZXJhdGVkIFNTTyBDZXJ0aWZpY2F0ZTAeFw0yMzA2MDExNTQ1MjJaFw0yNjA2MDExNTQ1MjFaMDQxMjAwBgNVBAMTKU1pY3Jvc29mdCBBenVyZSBGZWRlcmF0ZWQgU1NPIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzkkM9EfrHBJtJnKhewbmybCVPBR/PJlRRW70ITUVhCR45udbW6UIYeeSlHCsCv2qL3Z/G7yYTXXvIitOOmBnXeQWxmFRMWusOInU4ISgTHXW4oOATE4BibekQEw83JZ8WpJ5BGO2qUmrKabbMG8Ibgj/d82wT6ga8IAzuKaJ48s0T4IOoXQ74Ck3ZmvFa5pAUOi6ES0o+9ReQ0HjH4bW1iTdcSK7/JAuRyEVeRGF2/clAfJ369GGiSCSb418U6GVCPlQaVlxU0v59SZQ9S7EocpT5fJ9AOhr/MnZzQFg2wYZosGvov0R9piEhcmJDOhDalgdL2uHfD1lLK5h+rwOcQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBKk5k9DWWbJMExXvkZ50w3Bb8s+6TyQzbuzUCuW+swHOWc2+QTZltnwiskQ9kjWbRa/YGXgxGu/Vh616YIPIjCcSpMWeMuYRsXFWY6VxoeRxfIB7baGHtjvIVK2006zcXFIK2KfXifQ00QAOmRYEBo92R0To+HVG+edaeOt4Fo2AzVB7L6qdztSX5x/xzqmf84OicyPem2UqZKziWfGAsndpjSb15+qnIBO5upxM75e+GRH1egcE62wiWObo4Fc6rTp8dKxFhmZJNx44wNlEeJWhN6Nf1bnu9Mm3P1t9IbxbyMpN76l888+n6Q0m8jnKfWtn4r24l2yJbVy3fNCGFh</X509Certificate></X509Data></KeyInfo></Signature><Subject><NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">iNyqFe9q4ShlYcaBqE5n1m6BJuUzTsfVCPU8nE8ajmg=</NameID><SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><SubjectConfirmationData InResponseTo="id-2837ca5976dd42731472c4d4da0c953603232b9f" NotOnOrAfter="2023-06-01T17:14:52.049Z" Recipient="https://localhost:8099/saml/acs"/></SubjectConfirmation></Subject><Conditions NotBefore="2023-06-01T16:09:52.049Z" NotOnOrAfter="2023-06-01T17:14:52.049Z"><AudienceRestriction><Audience>https://localhost:8099/saml/metadata</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name="http://schemas.microsoft.com/identity/claims/tenantid"><AttributeValue>57fb1072-f4b5-4e0d-b18f-f3147e598295</AttributeValue></Attribute><Attribute Name="http://schemas.microsoft.com/identity/claims/objectidentifier"><AttributeValue>9d775093-da73-4793-aa83-83ec82c8f479</AttributeValue></Attribute><Attribute Name="http://schemas.microsoft.com/identity/claims/displayname"><AttributeValue>Artem Chernyshev</AttributeValue></Attribute><Attribute Name="http://schemas.microsoft.com/identity/claims/identityprovider"><AttributeValue>https://sts.windows.net/57fb1072-f4b5-4e0d-b18f-f3147e598295/</AttributeValue></Attribute><Attribute Name="http://schemas.microsoft.com/claims/authnmethodsreferences"><AttributeValue>http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</AttributeValue><AttributeValue>http://schemas.microsoft.com/claims/multipleauthn</AttributeValue></Attribute><Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"><AttributeValue>artem.chernyshev@siderolabs.com</AttributeValue></Attribute></AttributeStatement><AuthnStatement AuthnInstant="2023-06-01T13:00:28.260Z" SessionIndex="_b6b3116e-7364-4cd8-a586-890d34aa5501"><AuthnContext><AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef></AuthnContext></AuthnStatement></Assertion></samlp:Response>
\ No newline at end of file
diff --git a/internal/backend/saml/testdata/microsoft_metadata.xml b/internal/backend/saml/testdata/microsoft_metadata.xml
new file mode 100644
index 000000000..af4199225
--- /dev/null
+++ b/internal/backend/saml/testdata/microsoft_metadata.xml
@@ -0,0 +1,194 @@
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+  ID="_b049a2cd-c229-4161-944a-dc716d62e9cc"
+  entityID="https://sts.windows.net/57fb1072-f4b5-4e0d-b18f-f3147e598295/">
+  <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
+    <SignedInfo>
+      <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+      <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
+      <Reference URI="#_b049a2cd-c229-4161-944a-dc716d62e9cc">
+        <Transforms>
+          <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
+          <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
+        </Transforms>
+        <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
+        <DigestValue>ohsvnkge4+VhjsV7ccC5/JyiOILTBWJdYwHF5BScMAk=</DigestValue>
+      </Reference>
+    </SignedInfo>
+    <SignatureValue>
+      eA0wGAURb/D2xKM8jV+vjB/eOYSEglZl/mISrXo5t2u4CmtsURpWMtZpfT2t3g6dbKgV2Z1fYJe6d2YI86Ou4eFaYwUwfWQSCaZUI9MIrvDwtAnjFpntUJ4tQ7ILarKWxqjKag7VAn9ygLm2NVVsAp16EAcgfTdN7V0Gz1zeRKe5MVQaP4WmsT49gffOQL3o2VxzFw2YeGt4XkxKpNTL53KpVXHPGDv8XqAe5nH07jQlB5m6ra8SUIF7zHTJ0yJ7r+EDYscQG7paenkQEEP+aHOD3CMKoaZw21TEgtPvhdGDfYORTXqGF/MSaHs2piEW2Dr75b/9bfmNxwpfucmB5Q==</SignatureValue>
+    <KeyInfo>
+      <X509Data>
+        <X509Certificate>
+          MIIC8DCCAdigAwIBAgIQQ/Uc/Ut2xa5HreoGsGikyTANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylNaWNyb3NvZnQgQXp1cmUgRmVkZXJhdGVkIFNTTyBDZXJ0aWZpY2F0ZTAeFw0yMzA2MDExNTQ1MjJaFw0yNjA2MDExNTQ1MjFaMDQxMjAwBgNVBAMTKU1pY3Jvc29mdCBBenVyZSBGZWRlcmF0ZWQgU1NPIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzkkM9EfrHBJtJnKhewbmybCVPBR/PJlRRW70ITUVhCR45udbW6UIYeeSlHCsCv2qL3Z/G7yYTXXvIitOOmBnXeQWxmFRMWusOInU4ISgTHXW4oOATE4BibekQEw83JZ8WpJ5BGO2qUmrKabbMG8Ibgj/d82wT6ga8IAzuKaJ48s0T4IOoXQ74Ck3ZmvFa5pAUOi6ES0o+9ReQ0HjH4bW1iTdcSK7/JAuRyEVeRGF2/clAfJ369GGiSCSb418U6GVCPlQaVlxU0v59SZQ9S7EocpT5fJ9AOhr/MnZzQFg2wYZosGvov0R9piEhcmJDOhDalgdL2uHfD1lLK5h+rwOcQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBKk5k9DWWbJMExXvkZ50w3Bb8s+6TyQzbuzUCuW+swHOWc2+QTZltnwiskQ9kjWbRa/YGXgxGu/Vh616YIPIjCcSpMWeMuYRsXFWY6VxoeRxfIB7baGHtjvIVK2006zcXFIK2KfXifQ00QAOmRYEBo92R0To+HVG+edaeOt4Fo2AzVB7L6qdztSX5x/xzqmf84OicyPem2UqZKziWfGAsndpjSb15+qnIBO5upxM75e+GRH1egcE62wiWObo4Fc6rTp8dKxFhmZJNx44wNlEeJWhN6Nf1bnu9Mm3P1t9IbxbyMpN76l888+n6Q0m8jnKfWtn4r24l2yJbVy3fNCGFh</X509Certificate>
+      </X509Data>
+    </KeyInfo>
+  </Signature>
+  <RoleDescriptor xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xmlns:fed="http://docs.oasis-open.org/wsfed/federation/200706"
+    xsi:type="fed:SecurityTokenServiceType"
+    protocolSupportEnumeration="http://docs.oasis-open.org/wsfed/federation/200706">
+    <KeyDescriptor use="signing">
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data>
+          <X509Certificate>
+            MIIC8DCCAdigAwIBAgIQQ/Uc/Ut2xa5HreoGsGikyTANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylNaWNyb3NvZnQgQXp1cmUgRmVkZXJhdGVkIFNTTyBDZXJ0aWZpY2F0ZTAeFw0yMzA2MDExNTQ1MjJaFw0yNjA2MDExNTQ1MjFaMDQxMjAwBgNVBAMTKU1pY3Jvc29mdCBBenVyZSBGZWRlcmF0ZWQgU1NPIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzkkM9EfrHBJtJnKhewbmybCVPBR/PJlRRW70ITUVhCR45udbW6UIYeeSlHCsCv2qL3Z/G7yYTXXvIitOOmBnXeQWxmFRMWusOInU4ISgTHXW4oOATE4BibekQEw83JZ8WpJ5BGO2qUmrKabbMG8Ibgj/d82wT6ga8IAzuKaJ48s0T4IOoXQ74Ck3ZmvFa5pAUOi6ES0o+9ReQ0HjH4bW1iTdcSK7/JAuRyEVeRGF2/clAfJ369GGiSCSb418U6GVCPlQaVlxU0v59SZQ9S7EocpT5fJ9AOhr/MnZzQFg2wYZosGvov0R9piEhcmJDOhDalgdL2uHfD1lLK5h+rwOcQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBKk5k9DWWbJMExXvkZ50w3Bb8s+6TyQzbuzUCuW+swHOWc2+QTZltnwiskQ9kjWbRa/YGXgxGu/Vh616YIPIjCcSpMWeMuYRsXFWY6VxoeRxfIB7baGHtjvIVK2006zcXFIK2KfXifQ00QAOmRYEBo92R0To+HVG+edaeOt4Fo2AzVB7L6qdztSX5x/xzqmf84OicyPem2UqZKziWfGAsndpjSb15+qnIBO5upxM75e+GRH1egcE62wiWObo4Fc6rTp8dKxFhmZJNx44wNlEeJWhN6Nf1bnu9Mm3P1t9IbxbyMpN76l888+n6Q0m8jnKfWtn4r24l2yJbVy3fNCGFh</X509Certificate>
+        </X509Data>
+      </KeyInfo>
+    </KeyDescriptor>
+    <fed:ClaimTypesOffered>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">
+        <auth:DisplayName>Name</auth:DisplayName>
+        <auth:Description>The mutable display name of the user.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier">
+        <auth:DisplayName>Subject</auth:DisplayName>
+        <auth:Description>An immutable, globally unique, non-reusable identifier of the user that is
+          unique to the application for which a token is issued.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname">
+        <auth:DisplayName>Given Name</auth:DisplayName>
+        <auth:Description>First name of the user.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname">
+        <auth:DisplayName>Surname</auth:DisplayName>
+        <auth:Description>Last name of the user.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.microsoft.com/identity/claims/displayname">
+        <auth:DisplayName>Display Name</auth:DisplayName>
+        <auth:Description>Display name of the user.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.microsoft.com/identity/claims/nickname">
+        <auth:DisplayName>Nick Name</auth:DisplayName>
+        <auth:Description>Nick name of the user.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationinstant">
+        <auth:DisplayName>Authentication Instant</auth:DisplayName>
+        <auth:Description>The time (UTC) when the user is authenticated to Windows Azure Active
+          Directory.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod">
+        <auth:DisplayName>Authentication Method</auth:DisplayName>
+        <auth:Description>The method that Windows Azure Active Directory uses to authenticate users.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.microsoft.com/identity/claims/objectidentifier">
+        <auth:DisplayName>ObjectIdentifier</auth:DisplayName>
+        <auth:Description>Primary identifier for the user in the directory. Immutable, globally
+          unique, non-reusable.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.microsoft.com/identity/claims/tenantid">
+        <auth:DisplayName>TenantId</auth:DisplayName>
+        <auth:Description>Identifier for the user's tenant.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.microsoft.com/identity/claims/identityprovider">
+        <auth:DisplayName>IdentityProvider</auth:DisplayName>
+        <auth:Description>Identity provider for the user.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
+        <auth:DisplayName>Email</auth:DisplayName>
+        <auth:Description>Email address of the user.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/groups">
+        <auth:DisplayName>Groups</auth:DisplayName>
+        <auth:Description>Groups of the user.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.microsoft.com/identity/claims/accesstoken">
+        <auth:DisplayName>External Access Token</auth:DisplayName>
+        <auth:Description>Access token issued by external identity provider.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/expiration">
+        <auth:DisplayName>External Access Token Expiration</auth:DisplayName>
+        <auth:Description>UTC expiration time of access token issued by external identity provider.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.microsoft.com/identity/claims/openid2_id">
+        <auth:DisplayName>External OpenID 2.0 Identifier</auth:DisplayName>
+        <auth:Description>OpenID 2.0 identifier issued by external identity provider.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.microsoft.com/claims/groups.link">
+        <auth:DisplayName>GroupsOverageClaim</auth:DisplayName>
+        <auth:Description>Issued when number of user's group claims exceeds return limit.</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/role">
+        <auth:DisplayName>Role Claim</auth:DisplayName>
+        <auth:Description>Roles that the user or Service Principal is attached to</auth:Description>
+      </auth:ClaimType>
+      <auth:ClaimType xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706"
+        Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/wids">
+        <auth:DisplayName>RoleTemplate Id Claim</auth:DisplayName>
+        <auth:Description>Role template id of the Built-in Directory Roles that the user is a member
+          of</auth:Description>
+      </auth:ClaimType>
+    </fed:ClaimTypesOffered>
+    <fed:SecurityTokenServiceEndpoint>
+      <wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing">
+        <wsa:Address>https://login.microsoftonline.com/57fb1072-f4b5-4e0d-b18f-f3147e598295/wsfed</wsa:Address>
+      </wsa:EndpointReference>
+    </fed:SecurityTokenServiceEndpoint>
+    <fed:PassiveRequestorEndpoint>
+      <wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing">
+        <wsa:Address>https://login.microsoftonline.com/57fb1072-f4b5-4e0d-b18f-f3147e598295/wsfed</wsa:Address>
+      </wsa:EndpointReference>
+    </fed:PassiveRequestorEndpoint>
+  </RoleDescriptor>
+  <RoleDescriptor xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xmlns:fed="http://docs.oasis-open.org/wsfed/federation/200706"
+    xsi:type="fed:ApplicationServiceType"
+    protocolSupportEnumeration="http://docs.oasis-open.org/wsfed/federation/200706">
+    <KeyDescriptor use="signing">
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data>
+          <X509Certificate>
+            MIIC8DCCAdigAwIBAgIQQ/Uc/Ut2xa5HreoGsGikyTANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylNaWNyb3NvZnQgQXp1cmUgRmVkZXJhdGVkIFNTTyBDZXJ0aWZpY2F0ZTAeFw0yMzA2MDExNTQ1MjJaFw0yNjA2MDExNTQ1MjFaMDQxMjAwBgNVBAMTKU1pY3Jvc29mdCBBenVyZSBGZWRlcmF0ZWQgU1NPIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzkkM9EfrHBJtJnKhewbmybCVPBR/PJlRRW70ITUVhCR45udbW6UIYeeSlHCsCv2qL3Z/G7yYTXXvIitOOmBnXeQWxmFRMWusOInU4ISgTHXW4oOATE4BibekQEw83JZ8WpJ5BGO2qUmrKabbMG8Ibgj/d82wT6ga8IAzuKaJ48s0T4IOoXQ74Ck3ZmvFa5pAUOi6ES0o+9ReQ0HjH4bW1iTdcSK7/JAuRyEVeRGF2/clAfJ369GGiSCSb418U6GVCPlQaVlxU0v59SZQ9S7EocpT5fJ9AOhr/MnZzQFg2wYZosGvov0R9piEhcmJDOhDalgdL2uHfD1lLK5h+rwOcQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBKk5k9DWWbJMExXvkZ50w3Bb8s+6TyQzbuzUCuW+swHOWc2+QTZltnwiskQ9kjWbRa/YGXgxGu/Vh616YIPIjCcSpMWeMuYRsXFWY6VxoeRxfIB7baGHtjvIVK2006zcXFIK2KfXifQ00QAOmRYEBo92R0To+HVG+edaeOt4Fo2AzVB7L6qdztSX5x/xzqmf84OicyPem2UqZKziWfGAsndpjSb15+qnIBO5upxM75e+GRH1egcE62wiWObo4Fc6rTp8dKxFhmZJNx44wNlEeJWhN6Nf1bnu9Mm3P1t9IbxbyMpN76l888+n6Q0m8jnKfWtn4r24l2yJbVy3fNCGFh</X509Certificate>
+        </X509Data>
+      </KeyInfo>
+    </KeyDescriptor>
+    <fed:TargetScopes>
+      <wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing">
+        <wsa:Address>https://sts.windows.net/57fb1072-f4b5-4e0d-b18f-f3147e598295/</wsa:Address>
+      </wsa:EndpointReference>
+    </fed:TargetScopes>
+    <fed:ApplicationServiceEndpoint>
+      <wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing">
+        <wsa:Address>https://login.microsoftonline.com/57fb1072-f4b5-4e0d-b18f-f3147e598295/wsfed</wsa:Address>
+      </wsa:EndpointReference>
+    </fed:ApplicationServiceEndpoint>
+    <fed:PassiveRequestorEndpoint>
+      <wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing">
+        <wsa:Address>https://login.microsoftonline.com/57fb1072-f4b5-4e0d-b18f-f3147e598295/wsfed</wsa:Address>
+      </wsa:EndpointReference>
+    </fed:PassiveRequestorEndpoint>
+  </RoleDescriptor>
+  <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <KeyDescriptor use="signing">
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data>
+          <X509Certificate>
+            MIIC8DCCAdigAwIBAgIQQ/Uc/Ut2xa5HreoGsGikyTANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylNaWNyb3NvZnQgQXp1cmUgRmVkZXJhdGVkIFNTTyBDZXJ0aWZpY2F0ZTAeFw0yMzA2MDExNTQ1MjJaFw0yNjA2MDExNTQ1MjFaMDQxMjAwBgNVBAMTKU1pY3Jvc29mdCBBenVyZSBGZWRlcmF0ZWQgU1NPIENlcnRpZmljYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzkkM9EfrHBJtJnKhewbmybCVPBR/PJlRRW70ITUVhCR45udbW6UIYeeSlHCsCv2qL3Z/G7yYTXXvIitOOmBnXeQWxmFRMWusOInU4ISgTHXW4oOATE4BibekQEw83JZ8WpJ5BGO2qUmrKabbMG8Ibgj/d82wT6ga8IAzuKaJ48s0T4IOoXQ74Ck3ZmvFa5pAUOi6ES0o+9ReQ0HjH4bW1iTdcSK7/JAuRyEVeRGF2/clAfJ369GGiSCSb418U6GVCPlQaVlxU0v59SZQ9S7EocpT5fJ9AOhr/MnZzQFg2wYZosGvov0R9piEhcmJDOhDalgdL2uHfD1lLK5h+rwOcQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBKk5k9DWWbJMExXvkZ50w3Bb8s+6TyQzbuzUCuW+swHOWc2+QTZltnwiskQ9kjWbRa/YGXgxGu/Vh616YIPIjCcSpMWeMuYRsXFWY6VxoeRxfIB7baGHtjvIVK2006zcXFIK2KfXifQ00QAOmRYEBo92R0To+HVG+edaeOt4Fo2AzVB7L6qdztSX5x/xzqmf84OicyPem2UqZKziWfGAsndpjSb15+qnIBO5upxM75e+GRH1egcE62wiWObo4Fc6rTp8dKxFhmZJNx44wNlEeJWhN6Nf1bnu9Mm3P1t9IbxbyMpN76l888+n6Q0m8jnKfWtn4r24l2yJbVy3fNCGFh</X509Certificate>
+        </X509Data>
+      </KeyInfo>
+    </KeyDescriptor>
+    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+      Location="https://login.microsoftonline.com/57fb1072-f4b5-4e0d-b18f-f3147e598295/saml2" />
+    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+      Location="https://login.microsoftonline.com/57fb1072-f4b5-4e0d-b18f-f3147e598295/saml2" />
+    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+      Location="https://login.microsoftonline.com/57fb1072-f4b5-4e0d-b18f-f3147e598295/saml2" />
+  </IDPSSODescriptor>
+</EntityDescriptor>
\ No newline at end of file
diff --git a/internal/backend/saml/testdata/samlsp_acs.xml b/internal/backend/saml/testdata/samlsp_acs.xml
new file mode 100644
index 000000000..222189c00
--- /dev/null
+++ b/internal/backend/saml/testdata/samlsp_acs.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<saml2p:Response Destination="https://localhost:8099/saml/acs" ID="_90fd4bf26b1c62eb95e2747a5faf4b0e" InResponseTo="id-3809fc8de18772f24b29629342ea4b91d6a5cadc" IssueInstant="2023-06-01T16:16:35.174Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://samltest.id/saml/idp</saml2:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><ds:Reference URI="#_90fd4bf26b1c62eb95e2747a5faf4b0e"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces PrefixList="xsd" xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>OsMZOxAUGpVGZQ83vAEJpfjZNkz3J6MeKsq/DksR8aI=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>kPi/7xIT4BaTPmohdqDesXzZzGtm2VQELSCTDU3iJ+vK9k3+44ZARil2Oyn+CMM5bumtfkuwiNRH537QlKNoKcbZoetndOfLSIrIiRWXxunkALHIdVRPe5GnZbSZUNaRGPtWiLPDGpOE5iUd17bVcgkVUHhdTQFmhunUSiKK1ujzfu3kunaj/9QY2W6LL61KQU2qwklQT9pRZRDoyaveUPTqC2H+haZ55ICSubiS4RHgDg2+MzBYKolvcZUX4KlViH7xm1ES3S+3dwb3FURENiT4Mq0S+9x8yxdVovCggQG4nLkI1V9fnBiqz/kNebtErRQ3Lhroy1K0IZJhB694sw==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDEjCCAfqgAwIBAgIVAMECQ1tjghafm5OxWDh9hwZfxthWMA0GCSqGSIb3DQEBCwUAMBYxFDAS
+BgNVBAMMC3NhbWx0ZXN0LmlkMB4XDTE4MDgyNDIxMTQwOVoXDTM4MDgyNDIxMTQwOVowFjEUMBIG
+A1UEAwwLc2FtbHRlc3QuaWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0Z4QX1NFK
+s71ufbQwoQoW7qkNAJRIANGA4iM0ThYghul3pC+FwrGv37aTxWXfA1UG9njKbbDreiDAZKngCgyj
+xj0uJ4lArgkr4AOEjj5zXA81uGHARfUBctvQcsZpBIxDOvUUImAl+3NqLgMGF2fktxMG7kX3GEVN
+c1klbN3dfYsaw5dUrw25DheL9np7G/+28GwHPvLb4aptOiONbCaVvh9UMHEA9F7c0zfF/cL5fOpd
+Va54wTI0u12CsFKt78h6lEGG5jUs/qX9clZncJM7EFkN3imPPy+0HC8nspXiH/MZW8o2cqWRkrw3
+MzBZW3Ojk5nQj40V6NUbjb7kfejzAgMBAAGjVzBVMB0GA1UdDgQWBBQT6Y9J3Tw/hOGc8PNV7JEE
+4k2ZNTA0BgNVHREELTArggtzYW1sdGVzdC5pZIYcaHR0cHM6Ly9zYW1sdGVzdC5pZC9zYW1sL2lk
+cDANBgkqhkiG9w0BAQsFAAOCAQEASk3guKfTkVhEaIVvxEPNR2w3vWt3fwmwJCccW98XXLWgNbu3
+YaMb2RSn7Th4p3h+mfyk2don6au7Uyzc1Jd39RNv80TG5iQoxfCgphy1FYmmdaSfO8wvDtHTTNiL
+ArAxOYtzfYbzb5QrNNH/gQEN8RJaEf/g/1GTw9x/103dSMK0RXtl+fRs2nblD1JJKSQ3AdhxK/we
+P3aUPtLxVVJ9wMOQOfcy02l+hHMb6uAjsPOpOVKqi3M8XmcUZOpx4swtgGdeoSpeRyrtMvRwdcci
+NBp9UZome44qZAYH1iqrpmmjsfI9pJItsgWu3kXPjhSfj1AJGR1l9JGvJrHki1iHTA==</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2p:Status><saml2:Assertion ID="_6c5e4f22f6c9aeff683aa883edb5a797" IssueInstant="2023-06-01T16:16:35.174Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:Issuer>https://samltest.id/saml/idp</saml2:Issuer><saml2:Subject><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://samltest.id/saml/idp" SPNameQualifier="https://localhost:8099/saml/metadata" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">AAdzZWNyZXQxJoJWR6zCOEQ79VhkNjR/n5/n4EwIQh6NPN0b4rO+Sl2rZp1egNO6ICZfB0qLAZe1OlFkuIh76lzEnEr8Ef1T9QY3CrD4+QGxaPhwACrN4UMaTWbsDOUVrMLlhDSLFnNujU4WRli0FA==</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData Address="77.108.97.212" InResponseTo="id-3809fc8de18772f24b29629342ea4b91d6a5cadc" NotOnOrAfter="2023-06-01T16:21:35.187Z" Recipient="https://localhost:8099/saml/acs"/></saml2:SubjectConfirmation></saml2:Subject><saml2:Conditions NotBefore="2023-06-01T16:16:35.174Z" NotOnOrAfter="2023-06-01T16:21:35.174Z"><saml2:AudienceRestriction><saml2:Audience>https://localhost:8099/saml/metadata</saml2:Audience></saml2:AudienceRestriction></saml2:Conditions><saml2:AuthnStatement AuthnInstant="2023-06-01T16:16:35.132Z" SessionIndex="_789a3b73bd47eaf7a89021fed94e0abc"><saml2:SubjectLocality Address="77.108.97.212"/><saml2:AuthnContext><saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></saml2:AuthnContext></saml2:AuthnStatement><saml2:AttributeStatement><saml2:Attribute FriendlyName="eduPersonEntitlement" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>urn:mace:dir:entitlement:common-lib-terms</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="uid" Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>rick</saml2:AttributeValue></saml2:Attribute><saml2:Attribute Name="urn:oasis:names:tc:SAML:attribute:subject-id" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">rsanchez@samltest.id</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="telephoneNumber" Name="urn:oid:2.5.4.20" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>+1-555-555-5515</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="role" Name="https://samltest.id/attributes/role" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">manager@Samltest.id</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="mail" Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>rsanchez@samltest.id</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="sn" Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>Sanchez</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="displayName" Name="urn:oid:2.16.840.1.113730.3.1.241" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>Rick Sanchez</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>Rick</saml2:AttributeValue></saml2:Attribute></saml2:AttributeStatement></saml2:Assertion></saml2p:Response>
\ No newline at end of file
diff --git a/internal/backend/saml/testdata/samlsp_metadata.xml b/internal/backend/saml/testdata/samlsp_metadata.xml
new file mode 100644
index 000000000..69a406b3a
--- /dev/null
+++ b/internal/backend/saml/testdata/samlsp_metadata.xml
@@ -0,0 +1,68 @@
+<!-- The entity describing the SAMLtest IdP, named by the entityID below --> 
+
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" ID="SAMLtestIdP" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xml="http://www.w3.org/XML/1998/namespace" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" validUntil="2100-01-01T00:00:42Z" entityID="https://samltest.id/saml/idp">
+
+    <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0">
+
+        <Extensions>
+<!-- An enumeration of the domains this IdP is able to assert scoped attributes, which are
+typically those with a @ delimiter, like mail.  Most IdP's serve only a single domain.  It's crucial
+for the SP to check received attribute values match permitted domains to prevent a recognized IdP from 
+sending attribute values for which a different recognized IdP is authoritative. -->
+            <shibmd:Scope regexp="false">samltest.id</shibmd:Scope>
+
+<!-- Display information about this IdP that can be used by SP's and discovery
+services to identify the IdP meaningfully for end users --> 
+            <mdui:UIInfo>
+                <mdui:DisplayName xml:lang="en">SAMLtest IdP</mdui:DisplayName>
+                <mdui:Description xml:lang="en">A free and basic IdP for testing SAML deployments</mdui:Description>
+                <mdui:Logo height="90" width="225">https://samltest.id/saml/logo.png</mdui:Logo>
+            </mdui:UIInfo>
+        </Extensions>
+
+        <KeyDescriptor use="signing">
+            <ds:KeyInfo>
+                    <ds:X509Data>
+                        <ds:X509Certificate>MIIDETCCAfmgAwIBAgIUZRpDhkNKl5eWtJqk0Bu1BgTTargwDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLc2FtbHRlc3QuaWQwHhcNMTgwODI0MjExNDEwWhcNMzgwODI0MjExNDEwWjAWMRQwEgYDVQQDDAtzYW1sdGVzdC5pZDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJrh9/PcDsiv3UeL8Iv9rf4WfLPxuOm9W6aCntEA8l6c1LQ1Zyrz+Xa/40ZgP29ENf3oKKbPCzDcc6zooHMji2fBmgXp6Li3fQUzu7yd+nIC2teejijVtrNLjn1WUTwmqjLtuzrKC/ePoZyIRjpoUxyEMJopAd4dJmAcCq/Kk2eYX9GYRlqvIjLFoGNgy2R4dWwAKwljyh6pdnPUgyO/WjRDrqUBRFrLQJorR2kDc4seZUbmpZZfp4MjmWMDgyGM1ZnR0XvNLtYeWAyt0KkSvFoOMjZUeVK/4xR74F8e8ToPqLmZEg9ZUx+4z2KjVK00LpdRkH9Uxhh03RQ0FabHW6UCAwEAAaNXMFUwHQYDVR0OBBYEFJDbe6uSmYQScxpVJhmt7PsCG4IeMDQGA1UdEQQtMCuCC3NhbWx0ZXN0LmlkhhxodHRwczovL3NhbWx0ZXN0LmlkL3NhbWwvaWRwMA0GCSqGSIb3DQEBCwUAA4IBAQBNcF3zkw/g51q26uxgyuy4gQwnSr01Mhvix3Dj/Gak4tc4XwvxUdLQq+jCcxr2Pie96klWhY/v/JiHDU2FJo9/VWxmc/YOk83whvNd7mWaNMUsX3xGv6AlZtCOL3JhCpHjiN+kBcMgS5jrtGgV1Lz3/1zpGxykdvS0B4sPnFOcaCwHe2B9SOCWbDANJXpTjz1DmJO4ImyWPJpN1xsYKtm67Pefxmn0ax0uE2uuzq25h0xbTkqIQgJzyoE/DPkBFK1vDkMfAW11dQ0BXatEnW7Gtkc0lh2/PIbHWj4AzxYMyBf5Gy6HSVOftwjCvoQR2qr2xJBixsg+MIORKtmKHLfU</ds:X509Certificate>
+                    </ds:X509Data>
+            </ds:KeyInfo>
+
+        </KeyDescriptor>
+        <KeyDescriptor use="signing">
+            <ds:KeyInfo>
+                    <ds:X509Data>
+                        <ds:X509Certificate>MIIDEjCCAfqgAwIBAgIVAMECQ1tjghafm5OxWDh9hwZfxthWMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNVBAMMC3NhbWx0ZXN0LmlkMB4XDTE4MDgyNDIxMTQwOVoXDTM4MDgyNDIxMTQwOVowFjEUMBIGA1UEAwwLc2FtbHRlc3QuaWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC0Z4QX1NFKs71ufbQwoQoW7qkNAJRIANGA4iM0ThYghul3pC+FwrGv37aTxWXfA1UG9njKbbDreiDAZKngCgyjxj0uJ4lArgkr4AOEjj5zXA81uGHARfUBctvQcsZpBIxDOvUUImAl+3NqLgMGF2fktxMG7kX3GEVNc1klbN3dfYsaw5dUrw25DheL9np7G/+28GwHPvLb4aptOiONbCaVvh9UMHEA9F7c0zfF/cL5fOpdVa54wTI0u12CsFKt78h6lEGG5jUs/qX9clZncJM7EFkN3imPPy+0HC8nspXiH/MZW8o2cqWRkrw3MzBZW3Ojk5nQj40V6NUbjb7kfejzAgMBAAGjVzBVMB0GA1UdDgQWBBQT6Y9J3Tw/hOGc8PNV7JEE4k2ZNTA0BgNVHREELTArggtzYW1sdGVzdC5pZIYcaHR0cHM6Ly9zYW1sdGVzdC5pZC9zYW1sL2lkcDANBgkqhkiG9w0BAQsFAAOCAQEASk3guKfTkVhEaIVvxEPNR2w3vWt3fwmwJCccW98XXLWgNbu3YaMb2RSn7Th4p3h+mfyk2don6au7Uyzc1Jd39RNv80TG5iQoxfCgphy1FYmmdaSfO8wvDtHTTNiLArAxOYtzfYbzb5QrNNH/gQEN8RJaEf/g/1GTw9x/103dSMK0RXtl+fRs2nblD1JJKSQ3AdhxK/weP3aUPtLxVVJ9wMOQOfcy02l+hHMb6uAjsPOpOVKqi3M8XmcUZOpx4swtgGdeoSpeRyrtMvRwdcciNBp9UZome44qZAYH1iqrpmmjsfI9pJItsgWu3kXPjhSfj1AJGR1l9JGvJrHki1iHTA==</ds:X509Certificate>
+                    </ds:X509Data>
+            </ds:KeyInfo>
+
+        </KeyDescriptor>
+        <KeyDescriptor use="encryption">
+            <ds:KeyInfo>
+                    <ds:X509Data>
+                        <ds:X509Certificate>MIIDEjCCAfqgAwIBAgIVAPVbodo8Su7/BaHXUHykx0Pi5CFaMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNVBAMMC3NhbWx0ZXN0LmlkMB4XDTE4MDgyNDIxMTQwOVoXDTM4MDgyNDIxMTQwOVowFjEUMBIGA1UEAwwLc2FtbHRlc3QuaWQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCQb+1a7uDdTTBBFfwOUun3IQ9nEuKM98SmJDWaMwM877elswKUTIBVh5gB2RIXAPZt7J/KGqypmgw9UNXFnoslpeZbA9fcAqqu28Z4sSb2YSajV1ZgEYPUKvXwQEmLWN6aDhkn8HnEZNrmeXihTFdyr7wjsLj0JpQ+VUlc4/J+hNuU7rGYZ1rKY8AA34qDVd4DiJ+DXW2PESfOu8lJSOteEaNtbmnvH8KlwkDs1NvPTsI0W/m4SK0UdXo6LLaV8saIpJfnkVC/FwpBolBrRC/Em64UlBsRZm2T89cauzDee2yPUvbBd5kLErw+sC7i4xXa2rGmsQLYcBPhsRwnmBmlAgMBAAGjVzBVMB0GA1UdDgQWBBRZ3exEu6rCwRe5C7f5QrPcAKRPUjA0BgNVHREELTArggtzYW1sdGVzdC5pZIYcaHR0cHM6Ly9zYW1sdGVzdC5pZC9zYW1sL2lkcDANBgkqhkiG9w0BAQsFAAOCAQEABZDFRNtcbvIRmblnZItoWCFhVUlq81ceSQddLYs8DqK340//hWNAbYdjWcP85HhIZnrw6NGCO4bUipxZXhiqTA/A9d1BUll0vYB8qckYDEdPDduYCOYemKkDdmnHMQWs9Y6zWiYuNKEJ9mf3+1N8knN/PK0TYVjVjXAf2CnOETDbLtlj6Nqb8La3sQkYmU+aUdopbjd5JFFwbZRaj6KiHXHtnIRgu8sUXNPrgipUgZUOVhP0C0N5OfE4JW8ZBrKgQC/6vJ2rSa9TlzI6JAa5Ww7gMXMP9M+cJUNQklcq+SBnTK8G+uBHgPKRzBDsMIEzRtQZm4GIoHJae4zmnCekkQ==</ds:X509Certificate>
+                    </ds:X509Data>
+            </ds:KeyInfo>
+
+        </KeyDescriptor>
+
+<!-- An endpoint for artifact resolution.  Please see Wikipedia for more details about SAML
+     artifacts and when you may find them useful. -->
+
+        <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://samltest.id/idp/profile/SAML2/SOAP/ArtifactResolution" index="1" />
+
+<!-- A set of endpoints where the IdP can receive logout messages. These must match the public
+facing addresses if this IdP is hosted behind a reverse proxy.  --> 
+        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://samltest.id/idp/profile/SAML2/Redirect/SLO"/>
+        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://samltest.id/idp/profile/SAML2/POST/SLO"/>
+        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://samltest.id/idp/profile/SAML2/POST-SimpleSign/SLO"/>
+
+<!-- A set of endpoints the SP can send AuthnRequests to in order to trigger user authentication. -->
+        <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://samltest.id/idp/profile/Shibboleth/SSO"/>
+        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://samltest.id/idp/profile/SAML2/POST/SSO"/>
+        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://samltest.id/idp/profile/SAML2/POST-SimpleSign/SSO"/>
+        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://samltest.id/idp/profile/SAML2/Redirect/SSO"/>
+        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://samltest.id/idp/profile/SAML2/SOAP/ECP"/>
+
+    </IDPSSODescriptor>
+
+</EntityDescriptor>
\ No newline at end of file
diff --git a/internal/backend/server.go b/internal/backend/server.go
new file mode 100644
index 000000000..7bf76ffb6
--- /dev/null
+++ b/internal/backend/server.go
@@ -0,0 +1,1104 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package backend contains all internal backend code.
+package backend
+
+import (
+	"compress/gzip"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/pprof"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	pgpcrypto "github.com/ProtonMail/gopenpgp/v2/crypto"
+	"github.com/cosi-project/runtime/api/v1alpha1"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/meta"
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	protobufserver "github.com/cosi-project/runtime/pkg/state/protobuf/server"
+	"github.com/crewjam/saml/samlsp"
+	grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
+	grpc_zap "github.com/grpc-ecosystem/go-grpc-middleware/logging/zap"
+	grpc_recovery "github.com/grpc-ecosystem/go-grpc-middleware/recovery"
+	grpc_ctxtags "github.com/grpc-ecosystem/go-grpc-middleware/tags"
+	grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"github.com/siderolabs/gen/value"
+	"github.com/siderolabs/go-api-signature/pkg/pgp"
+	talosconstants "github.com/siderolabs/talos/pkg/machinery/constants"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/h2c"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	resapi "github.com/siderolabs/omni/client/api/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	authres "github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	omnires "github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/debug"
+	"github.com/siderolabs/omni/internal/backend/dns"
+	"github.com/siderolabs/omni/internal/backend/factory"
+	grpcomni "github.com/siderolabs/omni/internal/backend/grpc"
+	"github.com/siderolabs/omni/internal/backend/grpc/router"
+	"github.com/siderolabs/omni/internal/backend/health"
+	"github.com/siderolabs/omni/internal/backend/k8sproxy"
+	"github.com/siderolabs/omni/internal/backend/logging"
+	"github.com/siderolabs/omni/internal/backend/monitoring"
+	"github.com/siderolabs/omni/internal/backend/oidc"
+	"github.com/siderolabs/omni/internal/backend/runtime"
+	"github.com/siderolabs/omni/internal/backend/runtime/kubernetes"
+	"github.com/siderolabs/omni/internal/backend/runtime/omni"
+	"github.com/siderolabs/omni/internal/backend/runtime/talos"
+	"github.com/siderolabs/omni/internal/backend/saml"
+	"github.com/siderolabs/omni/internal/backend/workloadproxy"
+	"github.com/siderolabs/omni/internal/frontend"
+	"github.com/siderolabs/omni/internal/memconn"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/auth/auth0"
+	"github.com/siderolabs/omni/internal/pkg/auth/handler"
+	"github.com/siderolabs/omni/internal/pkg/auth/interceptor"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/cache"
+	"github.com/siderolabs/omni/internal/pkg/compress"
+	"github.com/siderolabs/omni/internal/pkg/config"
+	"github.com/siderolabs/omni/internal/pkg/errgroup"
+	"github.com/siderolabs/omni/internal/pkg/grpcutil"
+	"github.com/siderolabs/omni/internal/pkg/kms"
+	"github.com/siderolabs/omni/internal/pkg/siderolink"
+)
+
+// Server is main backend entrypoint that starts REST API, WebSocket and Serves static contents.
+type Server struct {
+	omniRuntime                  *omni.Runtime
+	logger                       *zap.Logger
+	logHandler                   *siderolink.LogHandler
+	authConfig                   *authres.Config
+	dnsService                   *dns.Service
+	workloadProxyServiceRegistry *workloadproxy.ServiceRegistry
+
+	linkCounterDeltaCh chan<- siderolink.LinkCounterDeltas
+
+	proxyServer         Proxy
+	bindAddress         string
+	metricsBindAddress  string
+	pprofBindAddress    string
+	k8sProxyBindAddress string
+	keyFile             string
+	certFile            string
+}
+
+// NewServer creates new HTTP server.
+func NewServer(
+	bindAddress, metricsBindAddress, k8sProxyBindAddress, pprofBindAddress string,
+	dnsService *dns.Service,
+	workloadProxyServiceRegistry *workloadproxy.ServiceRegistry,
+	linkCounterDeltaCh chan<- siderolink.LinkCounterDeltas,
+	omniRuntime *omni.Runtime,
+	talosRuntime *talos.Runtime,
+	logHandler *siderolink.LogHandler,
+	authConfig *authres.Config,
+	keyFile, certFile string,
+	proxyServer Proxy,
+	logger *zap.Logger,
+) (*Server, error) {
+	s := &Server{
+		omniRuntime:                  omniRuntime,
+		logger:                       logger.With(logging.Component("server")),
+		logHandler:                   logHandler,
+		authConfig:                   authConfig,
+		dnsService:                   dnsService,
+		workloadProxyServiceRegistry: workloadProxyServiceRegistry,
+		linkCounterDeltaCh:           linkCounterDeltaCh,
+		proxyServer:                  proxyServer,
+		bindAddress:                  bindAddress,
+		metricsBindAddress:           metricsBindAddress,
+		k8sProxyBindAddress:          k8sProxyBindAddress,
+		pprofBindAddress:             pprofBindAddress,
+		keyFile:                      keyFile,
+		certFile:                     certFile,
+	}
+
+	k8sruntime, err := kubernetes.New(omniRuntime.State())
+	if err != nil {
+		return nil, err
+	}
+
+	prometheus.MustRegister(k8sruntime)
+
+	runtime.Install(kubernetes.Name, k8sruntime)
+	runtime.Install(talos.Name, talosRuntime)
+	runtime.Install(omni.Name, s.omniRuntime)
+
+	return s, nil
+}
+
+// RegisterRuntime adds a runtime.
+func (s *Server) RegisterRuntime(name string, r runtime.Runtime) {
+	runtime.Install(name, r)
+}
+
+// Run runs HTTP server.
+func (s *Server) Run(ctx context.Context) error {
+	eg, ctx := errgroup.WithContext(ctx)
+
+	s.omniRuntime.Run(ctx, eg)
+
+	runtimeState := s.omniRuntime.State()
+	oidcStorage := oidc.NewStorage(runtimeState, s.logger)
+
+	oidcProvider, err := oidc.NewProvider(ctx, oidcStorage)
+	if err != nil {
+		return err
+	}
+
+	imageFactoryHandler := handler.NewAuthConfig(
+		handler.NewSignature(
+			&factory.Handler{
+				State:  runtimeState,
+				Logger: s.logger.With(logging.Component("factory_proxy")),
+			},
+			s.authenticatorFunc(),
+			s.logger,
+		),
+		authres.Enabled(s.authConfig),
+		s.logger,
+	)
+
+	var samlHandler *samlsp.Middleware
+
+	if s.authConfig.TypedSpec().Value.Saml.Enabled {
+		samlHandler, err = saml.NewHandler(s.omniRuntime.State(), s.authConfig.TypedSpec().Value.Saml, s.logger) //nolint:contextcheck
+		if err != nil {
+			return err
+		}
+	}
+
+	mux, err := makeMux(imageFactoryHandler, oidcProvider.HttpHandler(), samlHandler, s.omniRuntime, s.logger)
+	if err != nil {
+		return fmt.Errorf("failed to create mux: %w", err)
+	}
+
+	serverOptions, err := s.buildServerOptions() //nolint:contextcheck
+	if err != nil {
+		return err
+	}
+
+	serviceServers, err := grpcomni.MakeServiceServers(runtimeState, s.logHandler, oidcProvider, oidcStorage, s.logger)
+	if err != nil {
+		return err
+	}
+
+	gatewayTransport := &memconn.Transport{Address: "gateway-conn"}
+
+	grpcServer, err := grpcomni.New(ctx, mux, serviceServers, gatewayTransport, s.logger, serverOptions...)
+	if err != nil {
+		return err
+	}
+
+	grpcTransport := &memconn.Transport{Address: "grpc-conn"}
+
+	rtr, err := router.NewRouter(
+		grpcTransport,
+		runtimeState,
+		s.dnsService,
+		authres.Enabled(s.authConfig),
+		interceptor.NewSignature(s.authenticatorFunc(), s.logger).Unary(),
+	)
+	if err != nil {
+		return err
+	}
+
+	prometheus.MustRegister(rtr)
+
+	eg.Go(func() error { return rtr.ClusterWatcher(ctx, runtimeState) })
+
+	grpcProxyServer := router.NewServer(rtr,
+		router.Interceptors(s.logger),
+		grpc.MaxRecvMsgSize(constants.GRPCMaxMessageSize),
+	)
+	crtData := certData{certFile: s.certFile, keyFile: s.keyFile}
+
+	workloadProxyHandler, err := s.workloadProxyHandler(mux)
+	if err != nil {
+		return fmt.Errorf("failed to create workload proxy handler: %w", err)
+	}
+
+	unifiedHandler := unifyHandler(workloadProxyHandler, grpcProxyServer, crtData)
+
+	fns := []func() error{
+		func() error { return runGRPCServer(ctx, grpcProxyServer, gatewayTransport, s.logger) },
+		func() error { return runAPIServer(ctx, unifiedHandler, s.bindAddress, crtData, s.logger) },
+		func() error { return runGRPCServer(ctx, grpcServer, grpcTransport, s.logger) },
+		func() error { return runMetricsServer(ctx, s.metricsBindAddress, s.logger) },
+		func() error {
+			return runK8sProxyServer(ctx, s.k8sProxyBindAddress, oidcStorage, crtData, runtimeState, s.logger)
+		},
+		func() error { return s.proxyServer.Run(ctx, unifiedHandler, s.logger) },
+		func() error { return s.logHandler.Start(ctx) },
+		func() error { return s.runMachineAPI(ctx) },
+	}
+
+	if s.pprofBindAddress != "" {
+		fns = append(fns, func() error { return runPprofServer(ctx, s.pprofBindAddress, s.logger) })
+	}
+
+	for _, fn := range fns {
+		eg.Go(fn)
+	}
+
+	if err = runLocalResourceServer(ctx, runtimeState, serverOptions, eg, s.logger); err != nil {
+		return fmt.Errorf("failed to run local resource server: %w", err)
+	}
+
+	return eg.Wait()
+}
+
+// buildServerOptions builds the gRPC server options.
+//
+// Recovery is installed as the first middleware in the chain to handle panics (via defer and recover()) in all subsequent middlewares.
+//
+// Logging is installed as the first middleware (even before recovery middleware) in the chain
+// so that request in the form it was received and status sent on the wire is logged (error/success).
+// It also tracks the whole duration of the request, including other middleware overhead.
+func (s *Server) buildServerOptions() ([]grpc.ServerOption, error) {
+	recoveryOpt := grpc_recovery.WithRecoveryHandler(recoveryHandler(s.logger))
+	messageProducer := grpcutil.LogLevelOverridingMessageProducer(grpc_zap.DefaultMessageProducer)
+	logLevelOverrideUnaryInterceptor, logLevelOverrideStreamInterceptor := grpcutil.LogLevelInterceptors()
+
+	grpc_prometheus.EnableHandlingTimeHistogram(grpc_prometheus.WithHistogramBuckets([]float64{0.001, 0.01, 0.1, 1, 10, 30, 60, 120, 300, 600}))
+
+	unaryInterceptors := []grpc.UnaryServerInterceptor{
+		grpc_ctxtags.UnaryServerInterceptor(),
+		logLevelOverrideUnaryInterceptor,
+		grpc_zap.UnaryServerInterceptor(s.logger, grpc_zap.WithMessageProducer(messageProducer)),
+		grpcutil.SetUserAgent(),
+		grpcutil.SetRealPeerAddress(),
+		grpcutil.InterceptBodyToTags(
+			grpcutil.NewHook(
+				grpcutil.NewRewriter(resourceServerCreate),
+				grpcutil.NewRewriter(resourceServerUpdate),
+				grpcutil.NewRewriter(cosiResourceServerCreate),
+				grpcutil.NewRewriter(cosiResourceServerUpdate),
+			),
+			1024,
+		),
+		grpc_prometheus.UnaryServerInterceptor,
+		grpc_recovery.UnaryServerInterceptor(recoveryOpt),
+	}
+
+	streamInterceptors := []grpc.StreamServerInterceptor{
+		grpc_ctxtags.StreamServerInterceptor(),
+		logLevelOverrideStreamInterceptor,
+		grpc_zap.StreamServerInterceptor(s.logger, grpc_zap.WithMessageProducer(messageProducer)),
+		grpcutil.StreamSetUserAgent(),
+		grpcutil.StreamSetRealPeerAddress(),
+		grpcutil.StreamIntercept(
+			grpcutil.StreamHooks{
+				RecvMsg: grpcutil.StreamInterceptRequestBodyToTags(
+					grpcutil.NewHook(
+						grpcutil.NewRewriter(resourceServerCreate),
+						grpcutil.NewRewriter(resourceServerUpdate),
+						grpcutil.NewRewriter(cosiResourceServerCreate),
+						grpcutil.NewRewriter(cosiResourceServerUpdate),
+					),
+					1024,
+				),
+			},
+		),
+		grpc_prometheus.StreamServerInterceptor,
+		grpc_recovery.StreamServerInterceptor(recoveryOpt),
+	}
+
+	unaryAuthInterceptors, streamAuthInterceptors, err := s.getAuthInterceptors()
+	if err != nil {
+		return nil, err
+	}
+
+	unaryInterceptors = append(unaryInterceptors, unaryAuthInterceptors...)
+	streamInterceptors = append(streamInterceptors, streamAuthInterceptors...)
+
+	return []grpc.ServerOption{
+		grpc.MaxRecvMsgSize(constants.GRPCMaxMessageSize),
+		grpc.ChainUnaryInterceptor(unaryInterceptors...),
+		grpc.ChainStreamInterceptor(streamInterceptors...),
+		grpc.SharedWriteBuffer(true),
+	}, nil
+}
+
+func (s *Server) getAuthInterceptors() ([]grpc.UnaryServerInterceptor, []grpc.StreamServerInterceptor, error) {
+	authEnabled := authres.Enabled(s.authConfig)
+
+	authConfigInterceptor := interceptor.NewAuthConfig(authEnabled, s.logger)
+
+	unaryInterceptors := []grpc.UnaryServerInterceptor{
+		authConfigInterceptor.Unary(),
+	}
+
+	streamInterceptors := []grpc.StreamServerInterceptor{
+		authConfigInterceptor.Stream(),
+	}
+
+	if !authEnabled {
+		return unaryInterceptors, streamInterceptors, nil
+	}
+
+	// auth is enabled, add signature and jwt interceptors
+	signatureInterceptor := interceptor.NewSignature(s.authenticatorFunc(), s.logger)
+
+	unaryInterceptors = append(unaryInterceptors, signatureInterceptor.Unary())
+	streamInterceptors = append(streamInterceptors, signatureInterceptor.Stream())
+
+	switch {
+	case s.authConfig.TypedSpec().Value.Auth0.Enabled:
+		verifier, err := auth0.NewIDTokenVerifier(s.authConfig.TypedSpec().Value.GetAuth0().Domain)
+		if err != nil {
+			return nil, nil, err
+		}
+
+		jwtInterceptor := interceptor.NewJWT(verifier, s.logger)
+
+		unaryInterceptors = append(unaryInterceptors, jwtInterceptor.Unary())
+		streamInterceptors = append(streamInterceptors, jwtInterceptor.Stream())
+	case s.authConfig.TypedSpec().Value.Saml.Enabled:
+		samlInterceptor := interceptor.NewSAML(s.omniRuntime.State(), s.logger)
+
+		unaryInterceptors = append(unaryInterceptors, samlInterceptor.Unary())
+		streamInterceptors = append(streamInterceptors, samlInterceptor.Stream())
+	}
+
+	return unaryInterceptors, streamInterceptors, nil
+}
+
+func (s *Server) authenticatorFunc() auth.AuthenticatorFunc {
+	return func(ctx context.Context, fingerprint string) (*auth.Authenticator, error) {
+		ctx = actor.MarkContextAsInternalActor(ctx)
+
+		ptr := authres.NewPublicKey(resources.DefaultNamespace, fingerprint).Metadata()
+
+		pubKey, err := safe.StateGet[*authres.PublicKey](ctx, s.omniRuntime.State(), ptr)
+		if err != nil {
+			return nil, err
+		}
+
+		if pubKey.TypedSpec().Value.Expiration.AsTime().Before(time.Now()) {
+			return nil, errors.New("public key expired")
+		}
+
+		if !pubKey.TypedSpec().Value.Confirmed {
+			return nil, errors.New("public key not confirmed")
+		}
+
+		userID, labelExists := pubKey.Metadata().Labels().Get(authres.LabelPublicKeyUserID)
+		if !labelExists {
+			return nil, errors.New("public key has no user ID label")
+		}
+
+		key, err := pgpcrypto.NewKeyFromArmored(string(pubKey.TypedSpec().Value.GetPublicKey()))
+		if err != nil {
+			return nil, err
+		}
+
+		verifier, err := pgp.NewKey(key)
+		if err != nil {
+			return nil, err
+		}
+
+		user, err := safe.StateGet[*authres.User](ctx, s.omniRuntime.State(), resource.NewMetadata(resources.DefaultNamespace, authres.UserType, userID, resource.VersionUndefined))
+		if err != nil {
+			return nil, err
+		}
+
+		finalRole, err := role.Min(role.Role(user.TypedSpec().Value.GetRole()), role.Role(pubKey.TypedSpec().Value.GetRole()))
+		if err != nil {
+			return nil, err
+		}
+
+		if config.Config.Auth.Suspended {
+			finalRole = role.Reader
+		}
+
+		return &auth.Authenticator{
+			UserID:   userID,
+			Identity: pubKey.TypedSpec().Value.GetIdentity().GetEmail(),
+			Role:     finalRole,
+			Verifier: verifier,
+		}, nil
+	}
+}
+
+func (s *Server) runMachineAPI(ctx context.Context) error {
+	wgAddress := config.Config.SiderolinkWireguardBindAddress
+
+	params := siderolink.Params{
+		WireguardEndpoint:  wgAddress,
+		AdvertisedEndpoint: config.Config.SiderolinkWireguardAdvertisedAddress,
+		APIEndpoint:        config.Config.MachineAPIBindAddress,
+		Cert:               config.Config.MachineAPICertFile,
+		Key:                config.Config.MachineAPIKeyFile,
+		EventSinkPort:      strconv.Itoa(config.Config.EventSinkPort),
+	}
+
+	slink, err := siderolink.NewManager(
+		ctx,
+		s.omniRuntime.State(),
+		siderolink.DefaultWireguardHandler,
+		params,
+		s.logger.With(logging.Component("siderolink")).WithOptions(
+			zap.AddStacktrace(zapcore.ErrorLevel), // prevent warn level from printing stack traces
+		),
+		s.logHandler,
+		s.linkCounterDeltaCh,
+	)
+	if err != nil {
+		return err
+	}
+
+	kms := kms.NewManager(
+		s.omniRuntime.State(),
+		s.logger.With(logging.Component("kms")).WithOptions(
+			zap.AddStacktrace(zapcore.ErrorLevel), // prevent warn level from printing stack traces
+		),
+	)
+
+	prometheus.MustRegister(slink)
+
+	// start API listener
+	lis, err := params.NewListener()
+	if err != nil {
+		return fmt.Errorf("error listening for Siderolink gRPC API: %w", err)
+	}
+
+	eg, groupCtx := errgroup.WithContext(ctx)
+
+	server := grpc.NewServer(
+		grpc.SharedWriteBuffer(true),
+	)
+
+	slink.Register(server)
+	kms.Register(server)
+
+	eg.Go(func() error {
+		return slink.Run(groupCtx,
+			"",
+			strconv.Itoa(config.Config.EventSinkPort),
+			strconv.Itoa(talosconstants.TrustdPort),
+			strconv.Itoa(config.Config.LogServerPort),
+		)
+	})
+
+	grpcutil.RunServer(groupCtx, server, lis, eg)
+
+	return eg.Wait()
+}
+
+func (s *Server) workloadProxyHandler(next http.Handler) (http.Handler, error) {
+	roleProvider, err := workloadproxy.NewAccessPolicyRoleProvider(s.omniRuntime.State())
+	if err != nil {
+		return nil, fmt.Errorf("failed to create access policy role provider: %w", err)
+	}
+
+	pgpSignatureValidator, err := workloadproxy.NewPGPAccessValidator(s.omniRuntime.State(), roleProvider,
+		s.logger.With(logging.Component("pgp_access_validator")))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create pgp signature validator: %w", err)
+	}
+
+	mainURL, err := url.Parse(config.Config.APIURL)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse API URL: %w", err)
+	}
+
+	return workloadproxy.NewHTTPHandler(
+		next,
+		s.workloadProxyServiceRegistry,
+		pgpSignatureValidator,
+		mainURL,
+		s.logger.With(logging.Component("workload_proxy_handler")),
+	)
+}
+
+func recoveryHandler(logger *zap.Logger) grpc_recovery.RecoveryHandlerFunc {
+	return func(p any) error {
+		if logger != nil {
+			logger.Error("grpc panic", zap.Any("panic", p), zap.Stack("stack"))
+		}
+
+		return status.Errorf(codes.Internal, "%v", p)
+	}
+}
+
+func cosiResourceServerCreate(req *v1alpha1.CreateRequest) (*v1alpha1.CreateRequest, bool) {
+	if isSensitiveResource(req.Resource) {
+		req.Resource.Spec = nil
+
+		return req, true
+	}
+
+	return nil, false
+}
+
+func cosiResourceServerUpdate(req *v1alpha1.UpdateRequest) (*v1alpha1.UpdateRequest, bool) {
+	if isSensitiveResource(req.NewResource) {
+		req.NewResource.Spec = nil
+
+		return req, true
+	}
+
+	return nil, false
+}
+
+func resourceServerCreate(resCopy *resapi.CreateRequest) (*resapi.CreateRequest, bool) {
+	if isSensitiveSpec(resCopy.Resource) {
+		resCopy.Resource.Spec = ""
+
+		return resCopy, true
+	}
+
+	return nil, false
+}
+
+func resourceServerUpdate(resCopy *resapi.UpdateRequest) (*resapi.UpdateRequest, bool) {
+	if isSensitiveSpec(resCopy.Resource) {
+		resCopy.Resource.Spec = ""
+
+		return resCopy, true
+	}
+
+	return nil, false
+}
+
+func isSensitiveResource(res *v1alpha1.Resource) bool {
+	protoR, err := protobuf.Unmarshal(res)
+	if err != nil {
+		return false
+	}
+
+	properResource, err := protobuf.UnmarshalResource(protoR)
+	if err != nil {
+		return false
+	}
+
+	resDef, ok := properResource.(meta.ResourceDefinitionProvider)
+	if !ok || resDef.ResourceDefinition().Sensitivity == meta.Sensitive {
+		// If we have !ok we do not know if this resource have Sensitive field, so we will mask it anyway.
+		return true
+	}
+
+	return false
+}
+
+func isSensitiveSpec(resource *resapi.Resource) bool {
+	res, err := grpcomni.CreateResource(resource)
+	if err != nil {
+		return false
+	}
+
+	resDef, ok := res.(meta.ResourceDefinitionProvider)
+	if !ok || resDef.ResourceDefinition().Sensitivity == meta.Sensitive {
+		// If we have !ok we do not know if this resource have Sensitive field, so we will mask it anyway.
+		return true
+	}
+
+	return false
+}
+
+func makeMux(imageHandler, oidcHandler http.Handler, samlHandler *samlsp.Middleware, omniRuntime *omni.Runtime, logger *zap.Logger) (*http.ServeMux, error) {
+	mux := http.NewServeMux()
+
+	muxHandle := func(route string, handler http.Handler, value string) {
+		mux.Handle(route, monitoring.NewHandler(
+			logging.NewHandler(handler, logger.With(zap.String("handler", value))),
+			prometheus.Labels{"handler": value},
+		))
+	}
+
+	muxHandle(
+		"/",
+		compress.Handler(
+			frontend.NewStaticHandler(7200),
+			gzip.BestCompression,
+		),
+		"static",
+	)
+
+	if samlHandler != nil {
+		saml.RegisterHandlers(samlHandler, mux, logger)
+	}
+
+	muxHandle("/image/", imageHandler, "image")
+
+	omnictlHndlr, err := getOmnictlDownloads("./omnictl/")
+	if err != nil {
+		return nil, err
+	}
+
+	talosctlHandler, err := makeTalosctlHandler(omniRuntime.State(), logger)
+	if err != nil {
+		return nil, err
+	}
+
+	muxHandle("/omnictl/", http.StripPrefix("/omnictl/", omnictlHndlr), "files")
+	muxHandle("/talosctl/downloads", talosctlHandler, "talosctl-downloads")
+	// actually enabled only in debug build
+	muxHandle("/debug/", debug.NewHandler(omniRuntime.GetCOSIRuntime(), omniRuntime.State()), "debug")
+
+	// OIDC Provider
+	mux.Handle("/oidc/",
+		http.StripPrefix("/oidc",
+			monitoring.NewHandler(
+				logging.NewHandler(
+					oidcHandler,
+					logger.With(zap.String("handler", "debug")),
+				),
+				prometheus.Labels{"handler": "debug"},
+			),
+		),
+	)
+
+	// Health checks
+	muxHandle("/healthz", health.NewHandler(omniRuntime.State(), logger), "health")
+
+	return mux, nil
+}
+
+func getOmnictlDownloads(dir string) (http.Handler, error) {
+	readDir, err := os.ReadDir(dir)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read directory %q: %w", dir, err)
+	}
+
+	for _, entry := range readDir {
+		name := entry.Name()
+
+		if !entry.Type().IsRegular() {
+			return nil, fmt.Errorf("entry %q is not a regular file in %q", name, dir)
+		}
+	}
+
+	return http.FileServer(http.Dir(dir)), nil
+}
+
+func runMetricsServer(ctx context.Context, bindAddress string, logger *zap.Logger) error {
+	var metricsMux http.ServeMux
+
+	metricsMux.Handle("/metrics", promhttp.Handler())
+
+	metricsServer := &http.Server{
+		Addr:    bindAddress,
+		Handler: &metricsMux,
+	}
+
+	logger = logger.With(zap.String("server", bindAddress), zap.String("server_type", "metrics"))
+
+	return runServer(ctx, &server{
+		server: metricsServer,
+	}, logger)
+}
+
+type oidcStore interface {
+	GetPublicKeyByID(keyID string) (any, error)
+}
+
+func runK8sProxyServer(ctx context.Context, bindAddress string, oidcStorage oidcStore, data certData,
+	runtimeState state.State, logger *zap.Logger,
+) error {
+	keyFunc := func(_ context.Context, keyID string) (any, error) {
+		return oidcStorage.GetPublicKeyByID(keyID)
+	}
+
+	clusterUUIDResolver := func(ctx context.Context, clusterID string) (resource.ID, error) {
+		ctx = actor.MarkContextAsInternalActor(ctx)
+
+		uuid, resolveErr := safe.StateGetByID[*omnires.ClusterUUID](ctx, runtimeState, clusterID)
+		if resolveErr != nil {
+			return "", fmt.Errorf("failed to resolve cluster ID to UUID: %w", resolveErr)
+		}
+
+		return uuid.TypedSpec().Value.Uuid, nil
+	}
+
+	k8sProxyHandler, err := k8sproxy.NewHandler(keyFunc, clusterUUIDResolver, logger)
+	if err != nil {
+		return err
+	}
+
+	prometheus.MustRegister(k8sProxyHandler)
+
+	k8sProxy := monitoring.NewHandler(
+		logging.NewHandler(
+			k8sProxyHandler,
+			logger.With(zap.String("handler", "k8s_proxy")),
+		),
+		prometheus.Labels{"handler": "k8s-proxy"},
+	)
+
+	k8sProxyServer := &http.Server{
+		Addr:    bindAddress,
+		Handler: k8sProxy,
+	}
+
+	logger = logger.With(zap.String("server", bindAddress), zap.String("server_type", "k8s_proxy"))
+
+	return runServer(ctx, &server{
+		server:   k8sProxyServer,
+		certData: data,
+	}, logger)
+}
+
+func runAPIServer(ctx context.Context, handler http.Handler, bindAddress string, data certData, logger *zap.Logger) error {
+	srv := &http.Server{
+		Addr:    bindAddress,
+		Handler: handler,
+	}
+
+	logger = logger.With(zap.String("server", bindAddress), zap.String("server_type", "api"))
+
+	return runServer(ctx, &server{
+		server:   srv,
+		certData: data,
+	}, logger)
+}
+
+// setRealIPRequest extracts ip from the request and sets it to the X-Real-IP header if there is neither X-Real-IP nore
+// X-Forwarded-For.
+func setRealIPRequest(req *http.Request) *http.Request {
+	if req.Header.Get("X-Real-IP") != "" || req.Header.Get("X-Forwarded-For") != "" {
+		return req
+	}
+
+	actualIP, _, err := net.SplitHostPort(req.RemoteAddr)
+	if err != nil {
+		return req
+	}
+
+	newReq := req.Clone(req.Context())
+
+	newReq.Header.Set("X-Real-IP", actualIP)
+
+	return newReq
+}
+
+type server struct {
+	server *http.Server
+	certData
+}
+
+type certData struct {
+	certFile string
+	keyFile  string
+}
+
+func (s *server) ListenAndServe() error {
+	if s.certFile != "" || s.keyFile != "" {
+		return s.server.ListenAndServeTLS(s.certFile, s.keyFile)
+	}
+
+	return s.server.ListenAndServe()
+}
+
+func (s *server) Shutdown(ctx context.Context) error {
+	err := s.server.Shutdown(ctx)
+	if errors.Is(ctx.Err(), err) {
+		closeErr := s.server.Close()
+		if closeErr != nil {
+			return fmt.Errorf("failed to close server: %w", closeErr)
+		}
+	}
+
+	return err
+}
+
+func runServer(ctx context.Context, srv *server, logger *zap.Logger) error {
+	logger.Info("server starting")
+	defer logger.Info("server stopped")
+
+	errCh := make(chan error, 1)
+
+	go func() { errCh <- srv.ListenAndServe() }()
+
+	select {
+	case err := <-errCh:
+		if err != nil && !errors.Is(err, http.ErrServerClosed) {
+			return fmt.Errorf("failed to serve: %w", err)
+		}
+
+		return nil
+	case <-ctx.Done():
+		logger.Info("server stopping")
+	}
+
+	shutdownCtx, shutdownCtxCancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer shutdownCtxCancel()
+
+	//nolint:contextcheck
+	err := srv.Shutdown(shutdownCtx)
+	if err != nil {
+		logger.Error("failed to gracefully stop server", zap.Error(err))
+	}
+
+	return err
+}
+
+func runLocalResourceServer(ctx context.Context, st state.CoreState, serverOptions []grpc.ServerOption, eg *errgroup.Group, logger *zap.Logger) error {
+	listener, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", config.Config.LocalResourceServerPort))
+	if err != nil {
+		return fmt.Errorf("failed to listen: %w", err)
+	}
+
+	unaryInterceptor := grpc.UnaryServerInterceptor(func(ctx context.Context, req interface{}, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (resp interface{}, err error) {
+		return handler(actor.MarkContextAsInternalActor(ctx), req)
+	})
+
+	streamInterceptor := grpc.StreamServerInterceptor(func(srv interface{}, ss grpc.ServerStream, _ *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		return handler(srv, &grpc_middleware.WrappedServerStream{
+			ServerStream:   ss,
+			WrappedContext: actor.MarkContextAsInternalActor(ss.Context()),
+		})
+	})
+
+	serverOptions = append([]grpc.ServerOption{
+		grpc.ChainUnaryInterceptor(unaryInterceptor),
+		grpc.ChainStreamInterceptor(streamInterceptor),
+		grpc.SharedWriteBuffer(true),
+	}, serverOptions...)
+
+	grpcServer := grpc.NewServer(serverOptions...)
+
+	readOnlyState := state.WrapCore(state.Filter(st, func(_ context.Context, access state.Access) error {
+		if !access.Verb.Readonly() {
+			return status.Error(codes.PermissionDenied, "only read-only access is permitted")
+		}
+
+		return nil
+	}))
+
+	v1alpha1.RegisterStateServer(grpcServer, protobufserver.NewState(readOnlyState))
+
+	logger.Info("starting local resource server")
+
+	grpcutil.RunServer(ctx, grpcServer, listener, eg)
+
+	return nil
+}
+
+func runGRPCServer(ctx context.Context, server *grpc.Server, transport *memconn.Transport, logger *zap.Logger) error {
+	grpcListener, err := transport.Listener()
+	if err != nil {
+		return fmt.Errorf("failed to create listener: %w", err)
+	}
+
+	logger.Info("internal API server starting", zap.String("address", grpcListener.Addr().String()))
+	defer logger.Info("internal API server stopped")
+
+	errCh := make(chan error, 1)
+
+	go func() { errCh <- server.Serve(grpcListener) }()
+
+	select {
+	case err := <-errCh:
+		if err != nil && !errors.Is(err, grpc.ErrServerStopped) {
+			return fmt.Errorf("failed to serve: %w", err)
+		}
+
+		return nil
+	case <-ctx.Done():
+		logger.Info("grpc server stopping")
+	}
+
+	// Since we use a memconn transport and ServeHTTP, we can't use the graceful shutdown
+	server.Stop()
+
+	return nil
+}
+
+func unifyHandler(handler http.Handler, grpcServer *grpc.Server, data certData) http.Handler {
+	h := http.Handler(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		if req.ProtoMajor == 2 && strings.HasPrefix(
+			req.Header.Get("Content-Type"), "application/grpc") {
+			// grpcProxyServer provides top-level gRPC proxy handler.
+			grpcServer.ServeHTTP(w, setRealIPRequest(req))
+
+			return
+		}
+
+		// handler contains "regular" HTTP handlers
+		handler.ServeHTTP(w, req)
+	}))
+
+	if value.IsZero(data) {
+		// If we don't have TLS data, wrap the handler in http2.Server
+		h = h2c.NewHandler(h, &http2.Server{})
+	}
+
+	return h
+}
+
+func runPprofServer(ctx context.Context, bindAddress string, l *zap.Logger) error {
+	mux := &http.ServeMux{}
+
+	mux.HandleFunc("/debug/pprof/", pprof.Index)
+	mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
+	mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
+	mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
+	mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
+
+	srv := &http.Server{
+		Addr:    bindAddress,
+		Handler: mux,
+	}
+
+	l = l.With(zap.String("server", bindAddress), zap.String("server_type", "pprof"))
+
+	return runServer(ctx, &server{server: srv}, l)
+}
+
+//nolint:unparam
+func makeTalosctlHandler(state state.State, logger *zap.Logger) (http.Handler, error) {
+	// The list of versions does not update very often, so we can cache it.
+	cacher := cache.Value[releaseData]{Duration: time.Hour}
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		type result struct {
+			ReleaseData *releaseData `json:"release_data,omitempty"`
+			Status      string       `json:"status"`
+		}
+
+		writeResult := func(a any, code int) {
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(code)
+
+			if err := json.NewEncoder(w).Encode(a); err != nil {
+				logger.Error("failed to encode result", zap.Error(err))
+			}
+		}
+
+		ctx := actor.MarkContextAsInternalActor(r.Context())
+
+		data, err := cacher.GetOrUpdate(func() (releaseData, error) { return getReleaseData(ctx, state) })
+		if err != nil {
+			logger.Error("failed to get latest talosctl release", zap.Error(err))
+			writeResult(result{Status: "failed to get latest talosctl release"}, http.StatusInternalServerError)
+
+			return
+		}
+
+		writeResult(result{
+			ReleaseData: &data,
+			Status:      "ok",
+		}, http.StatusOK)
+	}), nil
+}
+
+func getReleaseData(ctx context.Context, state state.State) (releaseData, error) {
+	all, err := safe.StateListAll[*omnires.TalosVersion](ctx, state)
+	if err != nil {
+		return releaseData{}, fmt.Errorf("failed to list all talos versions: %w", err)
+	}
+
+	if all.Len() == 0 {
+		return releaseData{}, errors.New("no talos versions found")
+	}
+
+	versionNames := make([]string, 0, all.Len())
+
+	for it := all.Iterator(); it.Next(); {
+		version := it.Value().TypedSpec().Value.Version
+		if !strings.HasPrefix(version, "v") {
+			version = "v" + version
+		}
+
+		versionNames = append(versionNames, version)
+	}
+
+	releases, err := getGithubReleases(versionNames...)
+	if err != nil {
+		return releaseData{}, err
+	}
+
+	return releases, nil
+}
+
+func getGithubReleases(tags ...string) (releaseData, error) {
+	if len(tags) == 0 {
+		return releaseData{}, errors.New("no tags provided")
+	}
+
+	versions := make(map[string][]talosctlAsset, len(tags))
+
+	for _, tag := range tags {
+		assets := make([]talosctlAsset, 0, len(assetsData))
+
+		for _, asset := range assetsData {
+			assets = append(assets, talosctlAsset{
+				Name: asset.name,
+				URL:  fmt.Sprintf("https://github.com/siderolabs/talos/releases/download/%s/%s", tag, asset.urlPart),
+			})
+		}
+
+		versions[tag] = assets
+	}
+
+	return releaseData{
+		AvailableVersions: versions,
+		DefaultVersion:    tags[len(tags)-1],
+	}, nil
+}
+
+type releaseData struct {
+	AvailableVersions map[string][]talosctlAsset `json:"available_versions"`
+	DefaultVersion    string                     `json:"default_version,omitempty"`
+}
+
+type talosctlAsset struct {
+	Name string `json:"name"`
+	URL  string `json:"url"`
+}
+
+var assetsData = []struct {
+	name    string
+	urlPart string
+}{
+	{
+		"Apple",
+		"talosctl-darwin-amd64",
+	},
+	{
+		"Apple Silicon",
+		"talosctl-darwin-arm64",
+	},
+	{
+		"Linux",
+		"talosctl-linux-amd64",
+	},
+	{
+		"Linux ARM",
+		"talosctl-linux-armv7",
+	},
+	{
+		"Linux ARM64",
+		"talosctl-linux-arm64",
+	},
+	{
+		"Windows",
+		"talosctl-windows-amd64.exe",
+	},
+}
diff --git a/internal/backend/workloadproxy/accessvalidator.go b/internal/backend/workloadproxy/accessvalidator.go
new file mode 100644
index 000000000..71d39a735
--- /dev/null
+++ b/internal/backend/workloadproxy/accessvalidator.go
@@ -0,0 +1,133 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package workloadproxy
+
+import (
+	"context"
+	"encoding/base64"
+	"errors"
+
+	pgpcrypto "github.com/ProtonMail/gopenpgp/v2/crypto"
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/go-api-signature/pkg/pgp"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	authres "github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/accesspolicy"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+)
+
+// RoleProvider provides the current actor's role for a cluster.
+type RoleProvider interface {
+	RoleForCluster(ctx context.Context, id resource.ID) (role.Role, error)
+}
+
+// AccessPolicyRoleProvider provides the role for a cluster by looking into the context and evaluating access policies.
+type AccessPolicyRoleProvider struct {
+	state state.State
+}
+
+// NewAccessPolicyRoleProvider creates a new RoleProvider that uses the access policy in the state.
+func NewAccessPolicyRoleProvider(state state.State) (*AccessPolicyRoleProvider, error) {
+	if state == nil {
+		return nil, errors.New("state is nil")
+	}
+
+	return &AccessPolicyRoleProvider{state: state}, nil
+}
+
+// RoleForCluster returns the role of the current user for the given cluster.
+func (a *AccessPolicyRoleProvider) RoleForCluster(ctx context.Context, clusterID resource.ID) (role.Role, error) {
+	accessRole, _, err := accesspolicy.RoleForCluster(ctx, clusterID, a.state)
+
+	return accessRole, err
+}
+
+// PGPAccessValidator validates a signature using PGP keys and roles/ACLs.
+type PGPAccessValidator struct {
+	logger       *zap.Logger
+	state        state.State
+	roleProvider RoleProvider
+}
+
+// NewPGPAccessValidator creates a new PGP signature validator.
+func NewPGPAccessValidator(state state.State, roleProvider RoleProvider, logger *zap.Logger) (*PGPAccessValidator, error) {
+	if state == nil {
+		return nil, errors.New("state is nil")
+	}
+
+	if roleProvider == nil {
+		return nil, errors.New("role provider is nil")
+	}
+
+	if logger == nil {
+		logger = zap.NewNop()
+	}
+
+	return &PGPAccessValidator{
+		logger:       logger,
+		state:        state,
+		roleProvider: roleProvider,
+	}, nil
+}
+
+// ValidateAccess validates the access to an exposed service in the given cluster ID,
+// using the PGP public keys in the Omni database.
+func (p *PGPAccessValidator) ValidateAccess(ctx context.Context, publicKeyID, publicKeyIDSignatureBase64 string, clusterID resource.ID) error {
+	singatureBytes, err := base64.StdEncoding.DecodeString(publicKeyIDSignatureBase64)
+	if err != nil {
+		return err
+	}
+
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	publicKey, err := safe.StateGet[*authres.PublicKey](ctx, p.state, authres.NewPublicKey(resources.DefaultNamespace, publicKeyID).Metadata())
+	if err != nil {
+		return err
+	}
+
+	key, err := pgpcrypto.NewKeyFromArmored(string(publicKey.TypedSpec().Value.GetPublicKey()))
+	if err != nil {
+		return err
+	}
+
+	pgpKey, err := pgp.NewKey(key)
+	if err != nil {
+		return err
+	}
+
+	if err = pgpKey.Validate(); err != nil {
+		return err
+	}
+
+	if err = pgpKey.Verify([]byte(publicKeyID), singatureBytes); err != nil {
+		return err
+	}
+
+	publicKeyRoleStr := publicKey.TypedSpec().Value.GetRole()
+	if publicKeyRoleStr != "" {
+		publicKeyRole, parseErr := role.Parse(publicKeyRoleStr)
+		if parseErr != nil {
+			return parseErr
+		}
+
+		ctx = context.WithValue(ctx, auth.RoleContextKey{}, publicKeyRole)
+	}
+
+	ctx = context.WithValue(ctx, auth.IdentityContextKey{}, publicKey.TypedSpec().Value.GetIdentity().GetEmail())
+
+	accessRole, err := p.roleProvider.RoleForCluster(ctx, clusterID)
+	if err != nil {
+		return err
+	}
+
+	return accessRole.Check(role.Reader)
+}
diff --git a/internal/backend/workloadproxy/accessvalidator_test.go b/internal/backend/workloadproxy/accessvalidator_test.go
new file mode 100644
index 000000000..326526723
--- /dev/null
+++ b/internal/backend/workloadproxy/accessvalidator_test.go
@@ -0,0 +1,83 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package workloadproxy_test
+
+import (
+	"context"
+	"encoding/base64"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/siderolabs/go-api-signature/pkg/pgp"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/internal/backend/workloadproxy"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+)
+
+type mockRoleProvider struct {
+	role role.Role
+
+	clusterIDs []resource.ID
+}
+
+func (m *mockRoleProvider) RoleForCluster(_ context.Context, id resource.ID) (role.Role, error) {
+	m.clusterIDs = append(m.clusterIDs, id)
+
+	return m.role, nil
+}
+
+func TestAccessValidator(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	t.Cleanup(cancel)
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	roleProvider := &mockRoleProvider{
+		role: role.Reader,
+	}
+
+	accessValidator, err := workloadproxy.NewPGPAccessValidator(st, roleProvider, zaptest.NewLogger(t))
+	require.NoError(t, err)
+
+	key, err := pgp.GenerateKey("test", "", "test@example.com", 8*time.Hour)
+	require.NoError(t, err)
+
+	publicKey := auth.NewPublicKey(resources.DefaultNamespace, "test-public-key-id")
+
+	armored, err := key.ArmorPublic()
+	require.NoError(t, err)
+
+	publicKey.TypedSpec().Value.PublicKey = []byte(armored)
+
+	require.NoError(t, st.Create(ctx, publicKey))
+
+	err = accessValidator.ValidateAccess(ctx, publicKey.Metadata().ID(), base64.StdEncoding.EncodeToString([]byte("invalid-test-signature")), "test-cluster")
+	require.Error(t, err)
+
+	signature, err := key.Sign([]byte(publicKey.Metadata().ID()))
+	require.NoError(t, err)
+
+	err = accessValidator.ValidateAccess(ctx, publicKey.Metadata().ID(), base64.StdEncoding.EncodeToString(signature), "test-cluster")
+	require.NoError(t, err)
+
+	require.Len(t, roleProvider.clusterIDs, 1)
+	require.Equal(t, "test-cluster", roleProvider.clusterIDs[0])
+
+	// access should be denied if the role is less than Reader
+
+	roleProvider.role = role.None
+
+	err = accessValidator.ValidateAccess(ctx, publicKey.Metadata().ID(), base64.StdEncoding.EncodeToString(signature), "test-cluster")
+	require.Error(t, err)
+}
diff --git a/internal/backend/workloadproxy/handler.go b/internal/backend/workloadproxy/handler.go
new file mode 100644
index 000000000..e5742c093
--- /dev/null
+++ b/internal/backend/workloadproxy/handler.go
@@ -0,0 +1,220 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package workloadproxy
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+// ProxyProvider is a provider of HTTP proxies for the exposed services.
+type ProxyProvider interface {
+	GetProxy(alias string) (http.Handler, resource.ID, error)
+}
+
+// AccessValidator validates workload proxy requests against the given cluster by the given public key ID and its signed & base64'd form.
+type AccessValidator interface {
+	ValidateAccess(ctx context.Context, publicKeyID, publicKeyIDSignatureBase64 string, clusterID resource.ID) error
+}
+
+// HTTPHandler is an HTTP handler that will proxy matching requests to the workload proxy.
+//
+// It will pass through the requests that don't match.
+type HTTPHandler struct {
+	next            http.Handler
+	logger          *zap.Logger
+	proxyProvider   ProxyProvider
+	accessValidator AccessValidator
+	mainURL         *url.URL
+	mainDomain      string
+}
+
+// NewHTTPHandler creates a new HTTP handler that will proxy requests to the workload proxy.
+func NewHTTPHandler(next http.Handler, proxyProvider ProxyProvider, accessValidator AccessValidator, mainURL *url.URL, logger *zap.Logger) (*HTTPHandler, error) {
+	if logger == nil {
+		logger = zap.NewNop()
+	}
+
+	if proxyProvider == nil {
+		return nil, errors.New("proxy provider is nil")
+	}
+
+	if accessValidator == nil {
+		return nil, errors.New("access validator is nil")
+	}
+
+	if mainURL == nil {
+		return nil, errors.New("main URL is nil")
+	}
+
+	return &HTTPHandler{
+		next:            next,
+		proxyProvider:   proxyProvider,
+		accessValidator: accessValidator,
+		mainURL:         mainURL,
+		mainDomain:      getMainDomain(mainURL),
+		logger:          logger,
+	}, nil
+}
+
+// ServeHTTP implements http.Handler.
+func (h *HTTPHandler) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
+	if !h.isWorkloadProxyRequest(request) {
+		h.next.ServeHTTP(writer, request)
+
+		return
+	}
+
+	alias := h.parseServiceAliasFromHost(request)
+	if alias == "" {
+		http.NotFound(writer, request)
+
+		return
+	}
+
+	proxy, clusterID, err := h.proxyProvider.GetProxy(alias)
+	if err != nil {
+		h.logger.Warn("failed to get proxy", zap.Error(err), zap.String("alias", alias))
+
+		http.Error(writer, "failed to get proxy", http.StatusInternalServerError)
+
+		return
+	}
+
+	if proxy == nil {
+		h.logger.Debug("proxy is nil", zap.String("alias", alias))
+
+		http.NotFound(writer, request)
+
+		return
+	}
+
+	h.checkCookies(writer, request, proxy, clusterID)
+}
+
+func (h *HTTPHandler) isWorkloadProxyRequest(request *http.Request) bool {
+	host, _, _ := net.SplitHostPort(request.Host) //nolint:errcheck
+
+	if host == "" {
+		host = request.Host
+	}
+
+	return strings.HasPrefix(host, HostPrefix+"-") && strings.HasSuffix(host, "-"+h.mainDomain)
+}
+
+func (h *HTTPHandler) checkCookies(writer http.ResponseWriter, request *http.Request, proxy http.Handler, clusterID resource.ID) {
+	publicKeyID, publicKeyIDSignatureBase64 := h.getSignatureCookies(request)
+	if publicKeyID == "" || publicKeyIDSignatureBase64 == "" {
+		h.redirectToLogin(writer, request)
+
+		return
+	}
+
+	if err := h.accessValidator.ValidateAccess(request.Context(), publicKeyID, publicKeyIDSignatureBase64, clusterID); err != nil {
+		h.logger.Warn("failed to validate access", zap.Error(err))
+
+		forbiddenURL := h.mainURL.JoinPath("/forbidden").String()
+
+		http.Redirect(writer, request, forbiddenURL, http.StatusSeeOther)
+
+		return
+	}
+
+	proxy.ServeHTTP(writer, request)
+}
+
+// parseServiceAliasFromHost parses the service alias from the request host.
+//
+// The host will have the pattern: p-<alias>-<instance-name>.<main domain>.
+func (h *HTTPHandler) parseServiceAliasFromHost(request *http.Request) (alias string) {
+	hostParts := strings.SplitN(request.Host, ".", 2)
+	if len(hostParts) == 0 {
+		h.logger.Debug("empty proxy service host", zap.String("host", request.Host))
+
+		return ""
+	}
+
+	proxyServiceHostPrefixParts := strings.SplitN(hostParts[0], "-", 3)
+	if len(proxyServiceHostPrefixParts) < 3 {
+		h.logger.Debug("invalid proxy service host prefix: wrong number of parts", zap.String("host", request.Host), zap.Strings("parts", proxyServiceHostPrefixParts))
+
+		return ""
+	}
+
+	if proxyServiceHostPrefixParts[0] != HostPrefix {
+		h.logger.Debug("invalid proxy service host prefix: doesn't start with the prefix", zap.String("host", request.Host), zap.Strings("parts", proxyServiceHostPrefixParts))
+
+		return ""
+	}
+
+	return proxyServiceHostPrefixParts[1]
+}
+
+func (h *HTTPHandler) getSignatureCookies(request *http.Request) (publicKeyID string, publicKeyIDSignatureBase64 string) {
+	for _, cookie := range request.Cookies() {
+		switch cookie.Name {
+		case PublicKeyIDCookie:
+			publicKeyID = cookie.Value
+		case PublicKeyIDSignatureBase64Cookie:
+			publicKeyIDSignatureBase64 = cookie.Value
+		}
+
+		if publicKeyID != "" && publicKeyIDSignatureBase64 != "" {
+			break
+		}
+	}
+
+	return publicKeyID, publicKeyIDSignatureBase64
+}
+
+func (h *HTTPHandler) redirectToLogin(writer http.ResponseWriter, request *http.Request) {
+	loginURL, err := url.Parse(config.Config.APIURL)
+	if err != nil {
+		h.logger.Warn("failed to redirect to login", zap.Error(err))
+
+		http.Error(writer, "failed to redirect to login", http.StatusInternalServerError)
+
+		return
+	}
+
+	reqURL := *request.URL
+	reqURL.Scheme = "https"
+	reqURL.Host = request.Host
+
+	if reqURL.Port() == "" && loginURL.Port() != "" {
+		reqURL.Host = fmt.Sprintf("%s:%s", request.Host, loginURL.Port())
+	}
+
+	loginURL.Path = "/omni/authenticate"
+	q := loginURL.Query()
+	q.Set(auth.RedirectQueryParam, reqURL.String())
+	q.Set(auth.FlowQueryParam, auth.ProxyAuthFlow)
+
+	loginURL.RawQuery = q.Encode()
+
+	http.Redirect(writer, request, loginURL.String(), http.StatusSeeOther)
+}
+
+func getMainDomain(url *url.URL) string {
+	host, _, _ := net.SplitHostPort(url.Host) //nolint:errcheck
+
+	if host != "" {
+		return host
+	}
+
+	return url.Host
+}
diff --git a/internal/backend/workloadproxy/handler_test.go b/internal/backend/workloadproxy/handler_test.go
new file mode 100644
index 000000000..56ea35bd4
--- /dev/null
+++ b/internal/backend/workloadproxy/handler_test.go
@@ -0,0 +1,161 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package workloadproxy_test
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/siderolabs/omni/internal/backend/workloadproxy"
+)
+
+type mockProxyProvider struct {
+	aliases []string
+}
+
+func (m *mockProxyProvider) GetProxy(alias string) (http.Handler, resource.ID, error) {
+	m.aliases = append(m.aliases, alias)
+
+	return http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+		// return 200 with info on the request
+		writer.WriteHeader(http.StatusOK)
+
+		writer.Write([]byte("alias: " + alias)) //nolint:errcheck
+	}), "test-cluster", nil
+}
+
+type mockAccessValidator struct {
+	publicKeyIDs                []string
+	publicKeyIDSignatureBase64s []string
+	clusterIDs                  []resource.ID
+}
+
+func (m *mockAccessValidator) ValidateAccess(_ context.Context, publicKeyID, publicKeyIDSignatureBase64 string, clusterID resource.ID) error {
+	m.publicKeyIDs = append(m.publicKeyIDs, publicKeyID)
+	m.publicKeyIDSignatureBase64s = append(m.publicKeyIDSignatureBase64s, publicKeyIDSignatureBase64)
+	m.clusterIDs = append(m.clusterIDs, clusterID)
+
+	return nil
+}
+
+type mockHandler struct {
+	requests []*http.Request
+}
+
+func (m *mockHandler) ServeHTTP(_ http.ResponseWriter, request *http.Request) {
+	m.requests = append(m.requests, request)
+}
+
+func TestHandler(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	t.Cleanup(cancel)
+
+	mainURL, err := url.Parse("https://instanceid.example.com")
+	require.NoError(t, err)
+
+	t.Run("not a subdomain request", func(t *testing.T) {
+		t.Parallel()
+
+		next := &mockHandler{}
+		proxyProvider := &mockProxyProvider{}
+		accessValidator := &mockAccessValidator{}
+		logger := zaptest.NewLogger(t)
+
+		handler, err := workloadproxy.NewHTTPHandler(next, proxyProvider, accessValidator, mainURL, logger)
+		require.NoError(t, err)
+
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://instanceid.example.com/example", nil)
+		require.NoError(t, err)
+
+		rr := httptest.NewRecorder()
+
+		handler.ServeHTTP(rr, req)
+
+		require.Equal(t, http.StatusOK, rr.Code)
+		require.Len(t, next.requests, 1)
+	})
+
+	t.Run("subdomain request without cookies", func(t *testing.T) {
+		t.Parallel()
+
+		next := &mockHandler{}
+		proxyProvider := &mockProxyProvider{}
+		accessValidator := &mockAccessValidator{}
+		logger := zaptest.NewLogger(t)
+
+		handler, err := workloadproxy.NewHTTPHandler(next, proxyProvider, accessValidator, mainURL, logger)
+		require.NoError(t, err)
+
+		rr := httptest.NewRecorder()
+
+		testServiceAlias := "testsvc"
+
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("https://%s-%s-instanceid.example.com/example", workloadproxy.HostPrefix, testServiceAlias), nil)
+		require.NoError(t, err)
+
+		handler.ServeHTTP(rr, req)
+
+		require.Equal(t, []string{testServiceAlias}, proxyProvider.aliases)
+
+		require.Equal(t, http.StatusSeeOther, rr.Code)
+
+		redirectedURL, err := url.Parse(rr.Header().Get("Location"))
+		require.NoError(t, err)
+
+		redirectedURL.Port()
+
+		redirectBackURL := redirectedURL.Query().Get("redirect")
+
+		require.Equal(t, fmt.Sprintf("https://%s-%s-instanceid.example.com:%s/example", workloadproxy.HostPrefix, testServiceAlias, redirectedURL.Port()), redirectBackURL)
+	})
+
+	t.Run("subdomain request with cookies", func(t *testing.T) {
+		t.Parallel()
+
+		next := &mockHandler{}
+		proxyProvider := &mockProxyProvider{}
+		accessValidator := &mockAccessValidator{}
+		logger := zaptest.NewLogger(t)
+
+		handler, err := workloadproxy.NewHTTPHandler(next, proxyProvider, accessValidator, mainURL, logger)
+		require.NoError(t, err)
+
+		rr := httptest.NewRecorder()
+
+		testServiceAlias := "testsvc2"
+
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, fmt.Sprintf("https://%s-%s-instanceid.example.com/example", workloadproxy.HostPrefix, testServiceAlias), nil)
+		require.NoError(t, err)
+
+		testPublicKeyID := "test-public-key-id"
+		testPublicKeyIDSignatureBase64 := base64.StdEncoding.EncodeToString([]byte("test-signed-public-key-id"))
+
+		req.AddCookie(&http.Cookie{Name: workloadproxy.PublicKeyIDCookie, Value: testPublicKeyID})
+		req.AddCookie(&http.Cookie{Name: workloadproxy.PublicKeyIDSignatureBase64Cookie, Value: testPublicKeyIDSignatureBase64})
+
+		handler.ServeHTTP(rr, req)
+
+		require.Equal(t, []string{testServiceAlias}, proxyProvider.aliases)
+
+		require.Equal(t, http.StatusOK, rr.Code)
+
+		require.Equal(t, []string{testPublicKeyID}, accessValidator.publicKeyIDs)
+		require.Equal(t, []string{testPublicKeyIDSignatureBase64}, accessValidator.publicKeyIDSignatureBase64s)
+		require.Equal(t, []resource.ID{"test-cluster"}, accessValidator.clusterIDs)
+	})
+}
diff --git a/internal/backend/workloadproxy/serviceregistry.go b/internal/backend/workloadproxy/serviceregistry.go
new file mode 100644
index 000000000..88bcf503d
--- /dev/null
+++ b/internal/backend/workloadproxy/serviceregistry.go
@@ -0,0 +1,262 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package workloadproxy
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math/rand"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strconv"
+	"sync"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+type serviceEntry struct {
+	clusterID resource.ID
+	port      uint32
+}
+
+type clusterEntry struct {
+	healthyTargetAddressSet map[string]struct{}
+	enabled                 bool
+}
+
+// ServiceRegistry a registry to store Services that are exposed by the workload proxy.
+type ServiceRegistry struct {
+	state state.State
+
+	logger *zap.Logger
+
+	clusterIDToEntry    map[resource.ID]*clusterEntry
+	aliasToServiceEntry map[string]*serviceEntry
+
+	lock sync.Mutex
+}
+
+// NewServiceRegistry creates a new service registry. It needs to be started before use.
+func NewServiceRegistry(state state.State, logger *zap.Logger) (*ServiceRegistry, error) {
+	if state == nil {
+		return nil, errors.New("state is nil")
+	}
+
+	if logger == nil {
+		logger = zap.NewNop()
+	}
+
+	return &ServiceRegistry{
+		state:               state,
+		clusterIDToEntry:    make(map[resource.ID]*clusterEntry),
+		aliasToServiceEntry: make(map[string]*serviceEntry),
+		logger:              logger,
+	}, nil
+}
+
+// Start starts the service registry.
+func (s *ServiceRegistry) Start(ctx context.Context) error {
+	if s.state == nil {
+		return errors.New("state is nil")
+	}
+
+	ch := make(chan state.Event)
+
+	if err := s.state.WatchKind(ctx, omni.NewCluster(resources.DefaultNamespace, "").Metadata(), ch, state.WithBootstrapContents(true)); err != nil {
+		return fmt.Errorf("failed to watch clusters: %w", err)
+	}
+
+	if err := s.state.WatchKind(ctx, omni.NewClusterMachineStatus(resources.DefaultNamespace, "").Metadata(), ch, state.WithBootstrapContents(true)); err != nil {
+		return fmt.Errorf("failed to watch cluster machine statuses: %w", err)
+	}
+
+	if err := s.state.WatchKind(ctx, omni.NewExposedService(resources.DefaultNamespace, "").Metadata(), ch, state.WithBootstrapContents(true)); err != nil {
+		return fmt.Errorf("failed to watch exposed services: %w", err)
+	}
+
+	for {
+		select {
+		case <-ctx.Done():
+			if errors.Is(ctx.Err(), context.Canceled) {
+				s.logger.Debug("stopping service registry")
+
+				return nil
+			}
+
+			return fmt.Errorf("service registry context error: %w", ctx.Err())
+		case ev := <-ch:
+			if err := s.handleEvent(ev); err != nil {
+				return fmt.Errorf("failed to handle resource: %w", err)
+			}
+		}
+	}
+}
+
+func (s *ServiceRegistry) handleEvent(ev state.Event) error {
+	deleted := false
+
+	switch ev.Type {
+	case state.Bootstrapped:
+		return nil
+	case state.Created, state.Updated:
+		deleted = false
+	case state.Destroyed:
+		deleted = true
+	case state.Errored:
+		return fmt.Errorf("service registry received an error event: %w", ev.Error)
+	}
+
+	switch r := ev.Resource.(type) {
+	case *omni.Cluster:
+		s.handleCluster(r, deleted)
+	case *omni.ClusterMachineStatus:
+		s.handleClusterMachineStatus(r, deleted)
+	case *omni.ExposedService:
+		s.handleExposedService(r, deleted)
+	default:
+		s.logger.Warn(
+			"service registry received an event with an unexpected resource type",
+			zap.String("event_type", ev.Type.String()),
+			zap.String("type", fmt.Sprintf("%T", r)),
+		)
+	}
+
+	return nil
+}
+
+func (s *ServiceRegistry) handleClusterMachineStatus(res *omni.ClusterMachineStatus, deleted bool) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	clusterID, ok := res.Metadata().Labels().Get(omni.LabelCluster)
+	if !ok {
+		return
+	}
+
+	managementAddress := res.TypedSpec().Value.GetManagementAddress()
+	if managementAddress == "" {
+		return
+	}
+
+	cluster := s.getOrCreateClusterEntryNoLock(clusterID)
+
+	if deleted || !res.TypedSpec().Value.GetReady() {
+		delete(cluster.healthyTargetAddressSet, managementAddress)
+
+		return
+	}
+
+	cluster.healthyTargetAddressSet[managementAddress] = struct{}{}
+}
+
+func (s *ServiceRegistry) handleCluster(res *omni.Cluster, deleted bool) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	clusterID := res.Metadata().ID()
+
+	if deleted {
+		delete(s.clusterIDToEntry, clusterID)
+
+		return
+	}
+
+	cluster := s.getOrCreateClusterEntryNoLock(clusterID)
+
+	cluster.enabled = res.TypedSpec().Value.GetFeatures().GetEnableWorkloadProxy()
+}
+
+func (s *ServiceRegistry) handleExposedService(res *omni.ExposedService, deleted bool) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	clusterID, ok := res.Metadata().Labels().Get(omni.LabelCluster)
+	if !ok {
+		s.logger.Warn("exposed service is missing cluster label", zap.String("id", res.Metadata().ID()))
+
+		return
+	}
+
+	alias, ok := res.Metadata().Labels().Get(omni.LabelExposedServiceAlias)
+	if !ok {
+		s.logger.Warn("exposed service is missing alias label", zap.String("id", res.Metadata().ID()))
+
+		return
+	}
+
+	if deleted {
+		delete(s.aliasToServiceEntry, alias)
+
+		return
+	}
+
+	s.aliasToServiceEntry[alias] = &serviceEntry{
+		clusterID: clusterID,
+		port:      res.TypedSpec().Value.GetPort(),
+	}
+}
+
+func (s *ServiceRegistry) getOrCreateClusterEntryNoLock(clusterID resource.ID) *clusterEntry {
+	cluster, ok := s.clusterIDToEntry[clusterID]
+	if !ok {
+		cluster = &clusterEntry{
+			healthyTargetAddressSet: make(map[string]struct{}),
+		}
+
+		s.clusterIDToEntry[clusterID] = cluster
+	}
+
+	return cluster
+}
+
+// GetProxy returns a proxy for the given cluster and the alias of the service.
+func (s *ServiceRegistry) GetProxy(alias string) (http.Handler, resource.ID, error) {
+	s.lock.Lock()
+	defer s.lock.Unlock()
+
+	service, ok := s.aliasToServiceEntry[alias]
+	if !ok {
+		return nil, "", nil
+	}
+
+	cluster, ok := s.clusterIDToEntry[service.clusterID]
+	if !ok || !cluster.enabled {
+		return nil, "", nil
+	}
+
+	if len(cluster.healthyTargetAddressSet) == 0 {
+		return nil, "", errors.New("no healthy target addresses")
+	}
+
+	getRandomHealthyTargetAddress := func() string {
+		i := rand.Intn(len(cluster.healthyTargetAddressSet))
+
+		for key := range cluster.healthyTargetAddressSet {
+			if i == 0 {
+				return key
+			}
+
+			i--
+		}
+
+		return "" // unreachable
+	}
+
+	targetURL := &url.URL{
+		Scheme: "http",
+		Host:   net.JoinHostPort(getRandomHealthyTargetAddress(), strconv.Itoa(int(service.port))),
+	}
+
+	return httputil.NewSingleHostReverseProxy(targetURL), service.clusterID, nil
+}
diff --git a/internal/backend/workloadproxy/serviceregistry_test.go b/internal/backend/workloadproxy/serviceregistry_test.go
new file mode 100644
index 000000000..9164e870f
--- /dev/null
+++ b/internal/backend/workloadproxy/serviceregistry_test.go
@@ -0,0 +1,178 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package workloadproxy_test
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap/zaptest"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/backend/workloadproxy"
+)
+
+func TestServiceRegistry(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	t.Cleanup(cancel)
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	serviceRegistry, serviceRegistryErr := workloadproxy.NewServiceRegistry(st, zaptest.NewLogger(t))
+	require.NoError(t, serviceRegistryErr)
+
+	eg, ctx := errgroup.WithContext(ctx)
+
+	eg.Go(func() error {
+		return serviceRegistry.Start(ctx)
+	})
+
+	t.Cleanup(func() {
+		cancel()
+		require.NoError(t, eg.Wait())
+	})
+
+	t.Run("get non-existing service handler", func(t *testing.T) {
+		t.Parallel()
+
+		proxy, clusterID, err := serviceRegistry.GetProxy("service1")
+		require.NoError(t, err)
+
+		require.Nil(t, proxy)
+		require.Zero(t, clusterID)
+	})
+
+	t.Run("service exists but feature is disabled on cluster", func(t *testing.T) {
+		t.Parallel()
+
+		cluster := omni.NewCluster(resources.DefaultNamespace, "cluster1")
+
+		require.NoError(t, st.Create(ctx, cluster))
+
+		exposedService := omni.NewExposedService(resources.DefaultNamespace, "cluster1/service1")
+		exposedService.Metadata().Labels().Set(omni.LabelCluster, "cluster1")
+		exposedService.Metadata().Labels().Set(omni.LabelExposedServiceAlias, "service1")
+
+		require.NoError(t, st.Create(ctx, exposedService))
+
+		clusterMachineStatus := omni.NewClusterMachineStatus(resources.DefaultNamespace, "clustermachine-1")
+		clusterMachineStatus.Metadata().Labels().Set(omni.LabelCluster, "cluster1")
+
+		clusterMachineStatus.TypedSpec().Value.ManagementAddress = "127.0.0.42"
+		clusterMachineStatus.TypedSpec().Value.Ready = true
+
+		require.NoError(t, st.Create(ctx, clusterMachineStatus))
+
+		sleepWithContext(ctx, 2*time.Second)
+
+		proxy, clusterID, err := serviceRegistry.GetProxy("service1")
+		require.NoError(t, err)
+		require.Nil(t, proxy)
+		require.Zero(t, clusterID)
+	})
+
+	t.Run("service exists and feature is enabled on cluster", func(t *testing.T) {
+		t.Parallel()
+
+		cluster := omni.NewCluster(resources.DefaultNamespace, "cluster2")
+		cluster.TypedSpec().Value.Features = &specs.ClusterSpec_Features{
+			EnableWorkloadProxy: true,
+		}
+
+		require.NoError(t, st.Create(ctx, cluster))
+
+		exposedService := omni.NewExposedService(resources.DefaultNamespace, "cluster2/service2")
+		exposedService.Metadata().Labels().Set(omni.LabelCluster, "cluster2")
+		exposedService.Metadata().Labels().Set(omni.LabelExposedServiceAlias, "service2")
+
+		require.NoError(t, st.Create(ctx, exposedService))
+
+		clusterMachineStatus := omni.NewClusterMachineStatus(resources.DefaultNamespace, "clustermachine-2")
+		clusterMachineStatus.Metadata().Labels().Set(omni.LabelCluster, "cluster2")
+
+		clusterMachineStatus.TypedSpec().Value.ManagementAddress = "127.0.0.43"
+		clusterMachineStatus.TypedSpec().Value.Ready = true
+
+		require.NoError(t, st.Create(ctx, clusterMachineStatus))
+
+		require.NoError(t, retry.Constant(3*time.Second, retry.WithUnits(50*time.Millisecond)).Retry(func() error {
+			proxy, clusterID, err := serviceRegistry.GetProxy("service2")
+			if err != nil {
+				return retry.ExpectedError(err)
+			}
+
+			if proxy == nil {
+				return retry.ExpectedError(errors.New("proxy is nil"))
+			}
+
+			if clusterID != "cluster2" {
+				return retry.ExpectedError(fmt.Errorf("wrong cluster id: %s", clusterID))
+			}
+
+			return nil
+		}))
+
+		// kill the single healthy upstream
+		clusterMachineStatus.TypedSpec().Value.Ready = false
+
+		require.NoError(t, st.Update(ctx, clusterMachineStatus))
+
+		require.NoError(t, retry.Constant(3*time.Second, retry.WithUnits(50*time.Millisecond)).Retry(func() error {
+			_, _, proxyErr := serviceRegistry.GetProxy("service2")
+			if proxyErr == nil {
+				return retry.ExpectedError(errors.New("proxy error is nil"))
+			}
+
+			return nil
+		}))
+
+		// remove exposed service
+		require.NoError(t, st.Destroy(ctx, exposedService.Metadata()))
+
+		require.NoError(t, retry.Constant(3*time.Second, retry.WithUnits(50*time.Millisecond)).Retry(func() error {
+			proxy, clusterID, proxyErr := serviceRegistry.GetProxy("service2")
+			if proxyErr != nil {
+				return retry.ExpectedError(errors.New("proxy error is nil"))
+			}
+
+			if proxy != nil {
+				return retry.ExpectedError(errors.New("proxy is not nil"))
+			}
+
+			if clusterID != "" {
+				return retry.ExpectedError(errors.New("clusterID is not empty"))
+			}
+
+			return nil
+		}))
+	})
+}
+
+func sleepWithContext(ctx context.Context, d time.Duration) {
+	timer := time.NewTimer(d)
+	defer timer.Stop()
+
+	select {
+	case <-ctx.Done():
+		if !timer.Stop() {
+			<-timer.C
+		}
+	case <-timer.C:
+	}
+}
diff --git a/internal/backend/workloadproxy/workloadproxy.go b/internal/backend/workloadproxy/workloadproxy.go
new file mode 100644
index 000000000..640b64af3
--- /dev/null
+++ b/internal/backend/workloadproxy/workloadproxy.go
@@ -0,0 +1,24 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package workloadproxy provides functions for proxying traffic to workload clusters.
+package workloadproxy
+
+const (
+	// HostPrefix is the prefix used to distinguish subdomain requests which should be proxied to the workload clusters.
+	//
+	// tsgen:workloadProxyHostPrefix
+	HostPrefix = "p"
+
+	// PublicKeyIDCookie is the name of the cookie used for workload proxy request authentication that contains the public key ID.
+	//
+	// tsgen:workloadProxyPublicKeyIdCookie
+	PublicKeyIDCookie = "publicKeyId"
+
+	// PublicKeyIDSignatureBase64Cookie is the name of the cookie used for workload proxy request authentication that contains the signed & base64'd public key ID.
+	//
+	// tsgen:workloadProxyPublicKeyIdSignatureBase64Cookie
+	PublicKeyIDSignatureBase64Cookie = "publicKeyIdSignatureBase64"
+)
diff --git a/internal/e2e-tests/.kresignore b/internal/e2e-tests/.kresignore
new file mode 100644
index 000000000..e69de29bb
diff --git a/internal/e2e-tests/Dockerfile b/internal/e2e-tests/Dockerfile
new file mode 100644
index 000000000..31dbbfca9
--- /dev/null
+++ b/internal/e2e-tests/Dockerfile
@@ -0,0 +1,12 @@
+FROM ghcr.io/siderolabs/playwright-go:6151770
+
+COPY go.* /tmp/test/
+WORKDIR /tmp/test
+
+RUN go mod download
+
+COPY *.go /tmp/test/
+
+RUN go test -c -o test main_test.go
+
+CMD ["/tmp/test/test", "-test.v"]
diff --git a/internal/e2e-tests/go.mod b/internal/e2e-tests/go.mod
new file mode 100644
index 000000000..a9aec8f48
--- /dev/null
+++ b/internal/e2e-tests/go.mod
@@ -0,0 +1,33 @@
+module github.com/siderolabs/omni-e2e-tests
+
+go 1.22.0
+
+require (
+	github.com/buger/jsonparser v1.1.1
+	github.com/google/uuid v1.5.0
+	github.com/playwright-community/playwright-go v0.4101.1
+	github.com/stretchr/testify v1.8.4
+	github.com/wI2L/jsondiff v0.5.0
+	golang.org/x/sync v0.5.0
+	mvdan.cc/xurls/v2 v2.5.0
+)
+
+require (
+	github.com/deckarep/golang-set/v2 v2.6.0 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.1 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/tidwall/gjson v1.17.0 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc // indirect
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/go-stack/stack v1.8.1 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/siderolabs/go-retry v0.3.2
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
diff --git a/internal/e2e-tests/go.sum b/internal/e2e-tests/go.sum
new file mode 100644
index 000000000..b39d5845c
--- /dev/null
+++ b/internal/e2e-tests/go.sum
@@ -0,0 +1,66 @@
+github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
+github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/deckarep/golang-set/v2 v2.6.0 h1:XfcQbWM1LlMB8BsJ8N9vW5ehnnPVIw0je80NsVHagjM=
+github.com/deckarep/golang-set/v2 v2.6.0/go.mod h1:VAky9rY/yGXJOLEDv3OMci+7wtDpOF4IN+y82NBOac4=
+github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
+github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
+github.com/go-stack/stack v1.8.1 h1:ntEHSVwIt7PNXNpgPmVfMrNhLtgjlmnZha2kOpuRiDw=
+github.com/go-stack/stack v1.8.1/go.mod h1:dcoOX6HbPZSZptuspn9bctJ+N/CnF5gGygcUP3XYfe4=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/uuid v1.5.0 h1:1p67kYwdtXjb0gL0BPiP1Av9wiZPo5A8z2cWkTZ+eyU=
+github.com/google/uuid v1.5.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc=
+github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg=
+github.com/playwright-community/playwright-go v0.4101.1 h1:MrValJr0Cx0GLnfrF7/bzL6odtr3WNj5f2YYO+bntHs=
+github.com/playwright-community/playwright-go v0.4101.1/go.mod h1:IVr5cwkhRObh/7jvs97rzi9L5luk0c/+iPz5TmXRTtg=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
+github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/siderolabs/go-retry v0.3.2 h1:FzWslFm4y8RY1wU0gIskm0oZHOpsSibZqlR8N8/k4Eo=
+github.com/siderolabs/go-retry v0.3.2/go.mod h1:Ac8HIh0nAYDQm04FGZHNofVAXteyd4xR9oujTRrtvK0=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/tidwall/gjson v1.14.2/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/gjson v1.17.0 h1:/Jocvlh98kcTfpN2+JzGQWQcqrPQwDrVEMApx/M5ZwM=
+github.com/tidwall/gjson v1.17.0/go.mod h1:/wbyibRr2FHMks5tjHJ5F8dMZh3AcwJEMf5vlfC0lxk=
+github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
+github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
+github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/pretty v1.2.1 h1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=
+github.com/tidwall/pretty v1.2.1/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
+github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
+github.com/wI2L/jsondiff v0.5.0 h1:RRMTi/mH+R2aXcPe1VYyvGINJqQfC3R+KSEakuU1Ikw=
+github.com/wI2L/jsondiff v0.5.0/go.mod h1:qqG6hnK0Lsrz2BpIVCxWiK9ItsBCpIZQiv0izJjOZ9s=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc h1:ao2WRsKSzW6KuUY9IWPwWahcHCgR0s52IfwutMfEbdM=
+golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
+golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+mvdan.cc/xurls/v2 v2.5.0 h1:lyBNOm8Wo71UknhUs4QTFUNNMyxy2JEIaKKo0RWOh+8=
+mvdan.cc/xurls/v2 v2.5.0/go.mod h1:yQgaGQ1rFtJUzkmKiHYSSfuQxqfYmd//X6PxvholpeE=
diff --git a/internal/e2e-tests/main_test.go b/internal/e2e-tests/main_test.go
new file mode 100644
index 000000000..e28961507
--- /dev/null
+++ b/internal/e2e-tests/main_test.go
@@ -0,0 +1,565 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package main
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/url"
+	"os"
+	"os/exec"
+	"path"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/buger/jsonparser"
+	"github.com/google/uuid"
+	"github.com/playwright-community/playwright-go"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"github.com/wI2L/jsondiff"
+	"golang.org/x/sync/errgroup"
+	"mvdan.cc/xurls/v2"
+)
+
+const (
+	omnictlPath    = "/usr/local/bin/omnictl"
+	omniconfigPath = "/tmp/omniconfig"
+)
+
+var True = true
+
+type E2ESuite struct {
+	suite.Suite
+
+	pw       *playwright.Playwright
+	chromium playwright.Browser
+
+	baseURL  string
+	videoDir string
+	username string
+	password string
+}
+
+func (s *E2ESuite) SetupTest() {
+	var err error
+
+	s.pw, err = playwright.Run()
+	s.Require().NoError(err, "could not start playwright")
+
+	s.chromium, err = s.pw.Chromium.Launch()
+	s.Require().NoError(err, "could not launch browser Chromium")
+
+	s.baseURL = os.Getenv("BASE_URL")
+	s.Require().NotEmpty(s.baseURL, "BASE_URL is not set")
+	s.T().Logf("BASE_URL is set to: %s", s.baseURL)
+
+	s.videoDir = os.Getenv("VIDEO_DIR")
+	if s.videoDir == "" {
+		s.T().Logf("VIDEO_DIR env is not set, videos will not be saved")
+	} else {
+		s.T().Logf("videos will be saved to VIDEO_DIR: %s", s.videoDir)
+	}
+
+	s.username = os.Getenv("AUTH_USERNAME")
+	s.Require().NotEmpty(s.username, "username is not set")
+
+	s.password = os.Getenv("AUTH_PASSWORD")
+	s.Require().NotEmpty(s.password, "password is not set")
+}
+
+func (s *E2ESuite) withPage(url string, f func(page playwright.Page)) {
+	var recordVideo *playwright.RecordVideo
+
+	if s.videoDir != "" {
+		recordVideo = &playwright.RecordVideo{
+			Dir: s.videoDir,
+			Size: &playwright.Size{
+				Width:  1280,
+				Height: 720,
+			},
+		}
+	}
+
+	browserCtx, err := s.chromium.NewContext(playwright.BrowserNewContextOptions{
+		AcceptDownloads:   &True,
+		IgnoreHttpsErrors: &True,
+		RecordVideo:       recordVideo,
+	})
+	s.Require().NoError(err)
+
+	defer func() { s.Require().NoError(browserCtx.Close()) }()
+
+	page, err := browserCtx.NewPage()
+	s.Require().NoError(err)
+
+	page.On("request", func(request playwright.Request) {
+		s.T().Logf(">> %s %s", request.Method(), request.URL())
+	})
+	page.On("response", func(response playwright.Response) {
+		s.T().Logf("<< %v %s", response.Status(), response.URL())
+	})
+	page.On("console", func(msg playwright.ConsoleMessage) {
+		s.T().Logf("-- %s", msg)
+	})
+
+	_, err = page.Goto(url)
+	s.Require().NoError(err)
+
+	element := page.Locator("input#username").First()
+
+	s.Require().NoError(element.Click())
+	s.Require().NoError(element.Type(s.username))
+
+	element = page.Locator("input#password").First()
+
+	s.Require().NoError(element.Click())
+	s.Require().NoError(element.Type(s.password))
+
+	s.click(page, `button[type="submit"]:has-text("Continue"):visible`)
+
+	logIn, err := page.WaitForSelector("button.t-button.highlighted")
+	s.Require().NoError(err)
+
+	s.Require().NoError(logIn.Click())
+
+	f(page)
+}
+
+func (s *E2ESuite) runOmnictlCommand(ctx context.Context, args string, stderrHandler func(line string)) (string, string, error) {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	cmd := exec.CommandContext(ctx, omnictlPath,
+		append([]string{"--omniconfig", omniconfigPath, "--insecure-skip-tls-verify"}, strings.Fields(args)...)...,
+	)
+
+	stdout := strings.Builder{}
+	stderr := strings.Builder{}
+
+	reader, writer := io.Pipe()
+
+	cmd.Stdout = &stdout
+	cmd.Stderr = writer
+
+	if err := cmd.Start(); err != nil {
+		return "", "", fmt.Errorf("failed to start command: %w", err)
+	}
+
+	eg := errgroup.Group{}
+	lineCh := make(chan string)
+
+	eg.Go(func() error {
+		scanner := bufio.NewScanner(io.TeeReader(reader, &stderr))
+		for scanner.Scan() {
+			select {
+			case <-ctx.Done():
+				return nil
+			case lineCh <- scanner.Text():
+			}
+		}
+
+		return scanner.Err()
+	})
+
+	eg.Go(func() error {
+		defer cancel()
+
+		return errors.Join(cmd.Wait(), writer.Close())
+	})
+
+	for {
+		select {
+		case <-ctx.Done():
+			return stdout.String(), stderr.String(), eg.Wait()
+		case line := <-lineCh:
+			if stderrHandler != nil {
+				stderrHandler(line)
+			}
+		}
+	}
+}
+
+func (s *E2ESuite) prepareOmnictl(ctx context.Context) {
+	s.T().Logf("preparing omnictl")
+
+	// download omnictl and omniconfig
+	s.withPage(s.baseURL, func(page playwright.Page) {
+		downloadOmnictlButton := page.Locator(`span:has-text("Download omnictl"):visible`)
+
+		s.Require().NoError(downloadOmnictlButton.Click())
+
+		downloadButton := page.GetByText("Download", playwright.PageGetByTextOptions{
+			Exact: playwright.Bool(true),
+		})
+
+		download, err := page.ExpectDownload(func() error {
+			return downloadButton.Click()
+		})
+		s.Require().NoError(err, "failed to download omnictl")
+
+		s.Require().NoError(download.SaveAs(omnictlPath), "failed to save omnictl")
+
+		s.Require().NoError(os.Chmod(omnictlPath, 0o755), "failed to chmod omnictl")
+
+		version, _, err := s.runOmnictlCommand(ctx, "--version", nil)
+		s.Require().NoError(err, "failed to get omnictl version")
+
+		s.T().Logf("omnictl version: %s", version)
+
+		omniconfigDownload := page.Locator(`span:has-text("Download omniconfig"):visible`)
+
+		download, err = page.ExpectDownload(func() error {
+			return omniconfigDownload.Click()
+		})
+		s.Require().NoError(err, "failed to download omniconfig")
+
+		s.Require().NoError(download.SaveAs(omniconfigPath), "failed to save omniconfig")
+	})
+
+	// go through the CLI auth flow
+	rxStrict := xurls.Strict()
+	loggedIn := false
+	backendVersion, _, err := s.runOmnictlCommand(ctx, "get sysversion -ojsonpath={.spec.backendversion}", func(line string) {
+		if loggedIn {
+			return
+		}
+
+		authURL := rxStrict.FindString(line)
+		if authURL == "" {
+			return
+		}
+
+		s.T().Logf("Captured CLI Auth URL from stderr: %s", authURL)
+
+		// We do not need to do anything in the callback function, withPage goes through the auth flow
+		// for the auth URL by clicking the "Grant Access" button.
+		s.withPage(authURL, func(page playwright.Page) {})
+	})
+	s.Require().NoError(err, "failed to prepare omnictl")
+
+	s.T().Logf("backend version: %s", backendVersion)
+}
+
+func (s *E2ESuite) TestTitle() {
+	expected := "Omni - default"
+
+	s.withPage(s.baseURL, func(page playwright.Page) {
+		err := retry.Constant(time.Second*5, retry.WithUnits(time.Millisecond*100)).Retry(func() error {
+			title, err := page.Title()
+			s.Require().NoError(err)
+
+			if title != expected {
+				return retry.ExpectedErrorf("expected title to be %q, got %q", expected, title)
+			}
+
+			return nil
+		})
+
+		s.Assert().NoError(err)
+	})
+}
+
+func (s *E2ESuite) TestClickViewAll() {
+	s.withPage(s.baseURL, func(page playwright.Page) {
+		viewAllButton, err := page.WaitForSelector("text=View All")
+		s.Require().NoError(err, "could not get entries")
+
+		s.Require().NoError(viewAllButton.Click(), "error clicking button")
+
+		expectedURL, err := url.JoinPath(s.baseURL, "/omni/clusters")
+		s.Require().NoError(err)
+
+		s.Assert().Equal(expectedURL, page.MainFrame().URL())
+	})
+}
+
+//nolint:gocognit
+func (s *E2ESuite) TestCreateCluster() {
+	s.assertClusterCreation()
+	s.assertTemplateExportAndSync()
+}
+
+func (s *E2ESuite) assertClusterCreation() {
+	s.withPage(s.baseURL, func(page playwright.Page) {
+		navigateToClusters := func() {
+			_, err := page.WaitForSelector(`p:has-text("Clusters")`)
+
+			s.Require().NoError(err)
+
+			clustersURL, err := url.JoinPath(s.baseURL, "/omni/clusters")
+			s.Require().NoError(err)
+
+			s.navigate(page, `p:has-text("Clusters")`, clustersURL)
+		}
+
+		navigateToClusters()
+
+		// create cluster
+		clusterCreateURL, err := url.JoinPath(s.baseURL, "/omni/cluster/create")
+		s.Require().NoError(err)
+
+		s.navigate(page, `button[type="button"]:has-text("Create Cluster")`, clusterCreateURL)
+
+		s.click(page, `div.machine-set-label#CP >> nth=0`)
+
+		s.click(page, `div.machine-set-label#W0 >> nth=1`)
+
+		s.click(page, "button#CP")
+
+		editor := page.Locator(`div.monaco-editor`).First()
+
+		s.Require().NoError(editor.Click())
+
+		selectAllKeyCombination := "Control+a"
+		if runtime.GOOS == "darwin" {
+			selectAllKeyCombination = "Meta+a"
+		}
+
+		s.Require().NoError(editor.Press(selectAllKeyCombination))
+		s.Require().NoError(editor.Press("Delete"))
+		s.Require().NoError(editor.Type(`machine:
+ network:
+   hostname: deadbeef`))
+
+		s.click(page, `button:has-text("Save")`)
+
+		s.click(page, `button:has-text("Create Cluster")`)
+
+		_, err = page.WaitForSelector(`h3[class="title"]:has-text("talos-default")`)
+		s.Require().NoError(err)
+
+		navigateToClusters()
+
+		_, err = page.WaitForSelector("div.clusters-box")
+		s.Require().NoError(err)
+
+		clusterURL, err := url.JoinPath(s.baseURL, "/cluster/talos-default")
+		s.Require().NoError(err)
+
+		clusterOverviewURL, err := url.JoinPath(clusterURL, "/overview")
+		s.Require().NoError(err)
+
+		s.navigate(page, `div.clusters-grid a`, clusterOverviewURL)
+
+		scaleURL, err := url.JoinPath(clusterURL, "/scale")
+		s.Require().NoError(err)
+
+		s.navigate(page, `button[type="button"]:has-text("Cluster Scaling")`, scaleURL)
+
+		s.click(page, `div.machine-set-label#W0 >> nth=0`)
+
+		s.click(page, `button:has-text("Update")`)
+
+		// Wait for the scaling to navigate successfully to the cluster overview page to avoid a race condition where
+		// the test navigates to the Clusters page too early, then the scaling succeeds and goes to the Cluster Overview page
+		_, err = page.WaitForSelector(`text=Updated Cluster Configuration`)
+		s.Require().NoError(err)
+
+		openPage := func() {
+			navigateToClusters()
+
+			_, err := page.WaitForSelector("svg.collapse-button", playwright.PageWaitForSelectorOptions{
+				Timeout: nil,
+			})
+			s.Require().NoError(err)
+
+			s.click(page, `svg.collapse-button`)
+		}
+
+		openPage()
+
+		s.Assert().NoError(retry.Constant(15*time.Minute, retry.WithUnits(5*time.Second)).Retry(func() error {
+			element := page.Locator(`div.clusters-grid`)
+
+			count, err := element.Count()
+			if err != nil {
+				openPage()
+
+				return retry.ExpectedErrorf("failed to get clusters-grid element %s", err)
+			}
+
+			if count < 1 {
+				return retry.ExpectedErrorf("the cluster is not created yet")
+			}
+
+			runningMachineSet := page.Locator(`div[class="cluster-phase-name"]:has-text("Running")`)
+			runningMachineSetCount, err := runningMachineSet.Count()
+			if err != nil {
+				openPage()
+
+				return retry.ExpectedErrorf("failed to get running machine sets count %s", err)
+			}
+
+			runningMachines := page.Locator(`div[class="cluster-stage-name"]:has-text("Running")`)
+			runningMachinesCount, err := runningMachines.Count()
+			if err != nil {
+				openPage()
+
+				return retry.ExpectedErrorf("failed to get running machines count %s", err)
+			}
+
+			machineCount := page.Locator("#machine-count")
+			runningAndTotal, err := machineCount.TextContent()
+			if err != nil {
+				openPage()
+
+				return retry.ExpectedErrorf("failed to get machines total %s", err)
+			}
+
+			_, machinesTotal, found := strings.Cut(runningAndTotal, "/")
+			if !found {
+				return fmt.Errorf("failed to parse machines count")
+			}
+
+			hostname := page.Locator(`text=deadbeef`)
+			hostnameCount, err := hostname.Count()
+			if err != nil {
+				return retry.ExpectedErrorf("failed to get hostname %s", err)
+			}
+
+			s.T().Logf("machine sets running: %d/2, machines running: %d/%s, hostname set: %t", runningMachineSetCount, runningMachinesCount, machinesTotal, hostnameCount > 0)
+			if hostnameCount == 0 {
+				return retry.ExpectedErrorf("no machines with hostname deadbeef found, patch may not be applied")
+			}
+
+			if machinesTotal != "3" {
+				return retry.ExpectedErrorf("total machines expected to be 3, got %s", machinesTotal)
+			}
+
+			if runningMachineSetCount == 2 && runningMachinesCount == 3 {
+				return nil
+			}
+
+			return retry.ExpectedError(fmt.Errorf("cluster is not healthy"))
+		}))
+	})
+}
+
+func (s *E2ESuite) assertTemplateExportAndSync() {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	s.T().Cleanup(cancel)
+
+	s.prepareOmnictl(ctx)
+
+	templatePath := path.Join(s.T().TempDir(), "cluster.yaml")
+
+	// export a template
+
+	exportStdout, exportStderr, err := s.runOmnictlCommand(ctx, "cluster template export -c talos-default -o "+templatePath+" -f", nil)
+	s.Require().NoError(err, "failed to export cluster template. stdout: %s, stderr: %s", exportStdout, exportStderr)
+
+	// collect resources before syncing the template back to the cluster
+
+	clusterBefore, _, err := s.runOmnictlCommand(ctx, "get cluster talos-default -ojson", nil)
+	s.Require().NoError(err, "failed to get cluster before export. stdout: %s", clusterBefore)
+
+	configPatchesBefore, _, err := s.runOmnictlCommand(ctx, "get configpatch -l omni.sidero.dev/cluster=talos-default -ojson", nil)
+	s.Require().NoError(err, "failed to get config patches before export. stdout: %s", configPatchesBefore)
+
+	// sync the template back to the cluster
+
+	syncStdout, syncStderr, err := s.runOmnictlCommand(ctx, "cluster template sync -f "+templatePath, nil)
+	s.Require().NoError(err, "failed to sync cluster. stdout: %s, stderr: %s", syncStdout, syncStderr)
+
+	// assert that only the cluster and a single config patch are updated
+
+	syncOutputLines := strings.Split(strings.TrimSpace(syncStdout), "\n")
+	if s.Assert().Len(syncOutputLines, 2, "sync output is not equal to expected") {
+		s.Assert().Equal("* updating Clusters.omni.sidero.dev(talos-default)", syncOutputLines[0], "sync output line 0 is not equal to expected")
+
+		// Assert the line to follow the format:
+		// * updating ConfigPatches.omni.sidero.dev(400-cm-f7f5fb9c-2aa3-42b7-b414-f2998ee153e9)
+		prefix := "* updating ConfigPatches.omni.sidero.dev(400-cm-"
+		suffix := ")"
+		hasPrefix := s.Assert().True(strings.HasPrefix(syncOutputLines[1], prefix), "sync output line 1 (%q) does not start with the expected prefix %q", syncOutputLines[1], prefix)
+		hasSuffix := s.Assert().True(strings.HasSuffix(syncOutputLines[1], suffix), "sync output line 1 (%q) does not end with the expected suffix %q", syncOutputLines[1], suffix)
+
+		if hasPrefix && hasSuffix {
+			machineID := strings.TrimPrefix(syncOutputLines[1], prefix)
+			machineID = strings.TrimSuffix(machineID, suffix)
+
+			_, err = uuid.Parse(machineID)
+			s.Assert().NoError(err, "machine id in sync output line 1 (%q) is not a valid UUID", syncOutputLines[1])
+		}
+	}
+
+	// assert the resource manifests are semantically equal before and after export
+
+	clusterAfter, _, err := s.runOmnictlCommand(ctx, "get cluster talos-default -ojson", nil)
+	s.Require().NoError(err, "failed to get cluster after export. stdout: %s", clusterAfter)
+
+	configPatchesAfter, _, err := s.runOmnictlCommand(ctx, "get configpatch -l omni.sidero.dev/cluster=talos-default -ojson", nil)
+	s.Require().NoError(err, "failed to get config patches after export. stdout: %s", configPatchesAfter)
+
+	diff, err := jsondiff.CompareJSON([]byte(clusterBefore), []byte(clusterAfter), jsondiff.Ignores("/metadata/updated", "/metadata/version", "/metadata/annotations"))
+	s.Require().NoError(err, "failed to compare cluster before and after export. diff: %s", diff)
+
+	assert.Empty(s.T(), diff.String(), "cluster before and after export are not equal")
+
+	diff, err = jsondiff.CompareJSON([]byte(configPatchesBefore), []byte(configPatchesAfter), jsondiff.Ignores("/metadata/updated", "/metadata/version", "/metadata/annotations", "/spec/data"))
+	s.Require().NoError(err, "failed to compare config patches before and after export. diff: %s", diff)
+
+	assert.Empty(s.T(), diff.String(), "config patches before and after export are not equal")
+
+	patchDataBefore, err := jsonparser.GetString([]byte(configPatchesBefore), "spec", "data")
+	s.Require().NoError(err, "failed to get spec.data from config patches before export")
+
+	patchDataAfter, err := jsonparser.GetString([]byte(configPatchesAfter), "spec", "data")
+	s.Require().NoError(err, "failed to get spec.data from config patches after export")
+
+	s.YAMLEq(patchDataBefore, patchDataAfter, "spec.data from config patches before and after export are not equal")
+}
+
+func (s *E2ESuite) TestOpenMachine() {
+	clustersURL, err := url.JoinPath(s.baseURL, "/omni/clusters")
+	s.Require().NoError(err)
+
+	s.withPage(clustersURL, func(page playwright.Page) {
+		node := page.Locator("#talos-default-control-planes > div:last-child")
+
+		s.Require().NoError(node.WaitFor())
+		s.Require().NoError(node.Click())
+
+		s.Require().NoError(page.Locator("#etcd").WaitFor())
+
+		_, err = page.Goto(clustersURL)
+		s.Require().NoError(err)
+
+		node = page.Locator("#talos-default-workers > div:last-child")
+
+		s.Require().NoError(node.WaitFor())
+		s.Require().NoError(node.Click())
+
+		s.Require().NoError(page.Locator("#machined").WaitFor())
+
+		element := page.Locator("text=etcd")
+		count, err := element.Count()
+		s.Require().NoError(err)
+
+		s.Require().Equal(0, count)
+	})
+}
+
+func (s *E2ESuite) click(page playwright.Page, locator string) {
+	s.Require().NoErrorf(page.Locator(locator).First().Click(), "error clicking to the first element matching locator: %q", locator)
+}
+
+func (s *E2ESuite) navigate(page playwright.Page, locator, expectedURL string) {
+	s.click(page, locator)
+
+	s.Require().NoError(page.WaitForURL(expectedURL), "failed to wait for URL %q after clicking on the first element with locator %q (current URL: %q)", expectedURL, locator, page.URL())
+}
+
+func TestE2ESuite(t *testing.T) {
+	suite.Run(t, &E2ESuite{})
+}
diff --git a/internal/frontend/dist/index.html b/internal/frontend/dist/index.html
new file mode 100644
index 000000000..90531a4b3
--- /dev/null
+++ b/internal/frontend/dist/index.html
@@ -0,0 +1,2 @@
+<html>
+</html>
diff --git a/internal/frontend/frontend.go b/internal/frontend/frontend.go
new file mode 100644
index 000000000..79060b51a
--- /dev/null
+++ b/internal/frontend/frontend.go
@@ -0,0 +1,17 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+//
+// Generated on 2024-02-28T11:43:22Z by kres latest.
+
+package frontend
+
+import "embed"
+
+// Dist is an embedded JS frontend release folder.
+//
+//go:embed dist
+var Dist embed.FS
diff --git a/internal/frontend/handler.go b/internal/frontend/handler.go
new file mode 100644
index 000000000..58c6fdab6
--- /dev/null
+++ b/internal/frontend/handler.go
@@ -0,0 +1,129 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package frontend contains embedded web files and static handler implementation.
+package frontend
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"net/http"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+const index = "/index.html"
+
+// StaticHandler serves embedded frontend files.
+type StaticHandler struct {
+	modTime   time.Time
+	maxAgeSec int
+}
+
+// NewStaticHandler creates new static handler.
+func NewStaticHandler(maxAgeSec int) *StaticHandler {
+	return &StaticHandler{
+		modTime:   time.Now(),
+		maxAgeSec: maxAgeSec,
+	}
+}
+
+// ServeHTTP implements http.Handler.
+func (handler *StaticHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	const options = http.MethodOptions + ", " + http.MethodGet + ", " + http.MethodHead
+
+	switch r.Method {
+	case http.MethodGet, http.MethodHead:
+		if !strings.HasPrefix(r.URL.Path, "/") {
+			r.URL.Path = "/" + r.URL.Path
+		}
+
+		handler.serveFile(w, r, r.URL.Path)
+
+	case http.MethodOptions:
+		w.Header().Set("Allow", options)
+
+	default:
+		w.Header().Set("Allow", options)
+		http.Error(w, "read-only", http.StatusMethodNotAllowed)
+	}
+}
+
+type fileInfo struct {
+	io.ReadSeekCloser
+	fs.FileInfo
+}
+
+func (handler *StaticHandler) openFile(name string) (*fileInfo, error) {
+	f, err := Dist.Open(path.Clean(filepath.Join("dist", name)))
+	if err != nil {
+		return nil, err
+	}
+
+	d, err := f.Stat()
+	if err != nil {
+		return nil, err
+	}
+
+	if !d.Mode().IsRegular() {
+		f.Close() //nolint:errcheck
+
+		return nil, os.ErrNotExist
+	}
+
+	file, ok := f.(io.ReadSeekCloser)
+	if !ok {
+		return nil, fmt.Errorf("file %s is not io.ReadSeekCloser", d.Name())
+	}
+
+	return &fileInfo{
+		FileInfo:       d,
+		ReadSeekCloser: file,
+	}, nil
+}
+
+func (handler *StaticHandler) serveFile(w http.ResponseWriter, r *http.Request, name string) {
+	for _, path := range []string{name, index} {
+		file, err := handler.openFile(path)
+		if err != nil {
+			if os.IsNotExist(err) {
+				continue
+			}
+
+			writeHTTPError(w, err)
+
+			return
+		}
+
+		if path != index {
+			w.Header().Set("Vary", "Accept-Encoding, User-Agent")
+			w.Header().Set("Cache-Control", fmt.Sprintf("public, max-age=%d, immutable", handler.maxAgeSec))
+		}
+
+		defer file.Close() //nolint:errcheck
+
+		http.ServeContent(w, r, file.Name(), handler.modTime, file)
+
+		return
+	}
+
+	writeHTTPError(w, os.ErrNotExist)
+}
+
+func writeHTTPError(w http.ResponseWriter, err error) {
+	switch {
+	case errors.Is(err, fs.ErrNotExist):
+		http.Error(w, "404 Page Not Found", http.StatusNotFound)
+	case errors.Is(err, fs.ErrPermission):
+		http.Error(w, "403 Forbidden", http.StatusForbidden)
+	default:
+		http.Error(w, "500 Internal Server Error", http.StatusInternalServerError)
+	}
+}
diff --git a/internal/internal/generate.go b/internal/internal/generate.go
new file mode 100644
index 000000000..93bfc9bbb
--- /dev/null
+++ b/internal/internal/generate.go
@@ -0,0 +1,9 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package internal contains the command that generates the TS code.
+package internal
+
+//go:generate go run -tags=tools github.com/siderolabs/omni/internal/internal/tools/tsgen -out ../../frontend/src/api/resources.ts ../../,../../client/
diff --git a/internal/internal/tools/tsgen/ast.go b/internal/internal/tools/tsgen/ast.go
new file mode 100644
index 000000000..c5087e825
--- /dev/null
+++ b/internal/internal/tools/tsgen/ast.go
@@ -0,0 +1,172 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//go:build tools
+
+package main
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"go/types"
+	"regexp"
+
+	"golang.org/x/tools/go/packages"
+)
+
+type file struct {
+	f   *ast.File
+	pkg *packages.Package
+}
+
+// ParseRecursive parses the source code recursively and returns the AST slice.
+func ParseRecursive(dir, tags string) ([]file, error) {
+	cfg := &packages.Config{
+		Mode: packages.NeedName | packages.NeedTypes | packages.NeedTypesInfo | packages.NeedSyntax,
+		// TODO: Need to think about constants in test files. Maybe write type_string_test.go
+		// in a separate pass? For later.
+		Tests:      false,
+		BuildFlags: []string{fmt.Sprintf("-tags=%s", tags)},
+		Dir:        dir,
+	}
+
+	pkgs, err := packages.Load(cfg, "./...")
+	if err != nil {
+		return nil, err
+	}
+
+	if len(pkgs) == 0 {
+		return nil, fmt.Errorf("error: no packages found")
+	}
+
+	if len(pkgs[0].Errors) > 0 {
+		return nil, fmt.Errorf("error loading packages: %s", pkgs[0].Errors)
+	}
+
+	var result []file
+
+	for _, pkg := range pkgs {
+		for _, f := range pkg.Syntax {
+			result = append(result, file{f, pkg})
+		}
+	}
+
+	return result, nil
+}
+
+// FindTSGenConstants returns the list of constants that have tsgen directive.
+func FindTSGenConstants(f file) ([]ConstantWithDirective, error) {
+	constants := FindConstants(f)
+
+	var result []ConstantWithDirective
+	for _, constant := range constants {
+		for _, comment := range constant.Doc {
+			if directive, ok := extractTsGenDirective(comment); ok {
+				if directive == "" {
+					return nil, fmt.Errorf("empty directive in %s", constant.Name)
+				}
+				result = append(result, ConstantWithDirective{
+					Constant:  constant,
+					Directive: directive,
+				})
+			}
+		}
+	}
+
+	return result, nil
+}
+
+// tsGenMatcher is a regexp matcher for tsgen directive.
+var tsGenMatcher = regexp.MustCompile(`tsgen:(\w*)`)
+
+// extractTsGenDirective extracts the tsgen directive from the comment.
+func extractTsGenDirective(comment string) (string, bool) {
+	matches := tsGenMatcher.FindStringSubmatch(comment)
+	switch {
+	case len(matches) == 0:
+		return "", false
+	case len(matches) == 2:
+		return matches[1], true
+	default:
+		return "", true
+	}
+}
+
+// Constant represents a constant with a doc, name and a value.
+type Constant struct {
+	Doc   []string
+	Name  string
+	Value string
+}
+
+// ConstantWithDirective represents a Constant with a directive.
+type ConstantWithDirective struct {
+	Constant
+	Directive string
+}
+
+// FindConstants returns a list of constants in the given file.
+func FindConstants(file file) []Constant {
+	var result []Constant
+	ast.Inspect(file.f, func(n ast.Node) bool {
+		if decl, ok := n.(*ast.GenDecl); ok {
+			if decl.Tok == token.CONST {
+				if decl.Lparen == token.NoPos {
+					name := decl.Specs[0].(*ast.ValueSpec).Names[0]
+					obj := file.pkg.TypesInfo.Defs[name].(*types.Const)
+					value := obj.Val().String()
+
+					result = append(result, Constant{
+						Doc:   commentToStrings(decl.Doc),
+						Name:  name.Name,
+						Value: value,
+					})
+
+					return false
+				}
+
+				for _, spec := range decl.Specs {
+					// multiple constants declared inside parentheses
+					if valueSpec, ok := spec.(*ast.ValueSpec); ok {
+						if len(valueSpec.Values) == 0 {
+							// constant declared without a value, skip it
+							continue
+						}
+
+						name := valueSpec.Names[0]
+						obj := file.pkg.TypesInfo.Defs[name].(*types.Const)
+						value := obj.Val().String()
+
+						result = append(result, Constant{
+							Doc:   commentToStrings(valueSpec.Doc),
+							Name:  name.Name,
+							Value: value,
+						})
+					}
+				}
+			}
+
+			return false
+		}
+		return true
+	})
+
+	return result
+}
+
+// commentToStrings converts a list of comments to a list of strings.
+func commentToStrings(doc *ast.CommentGroup) []string {
+	if doc == nil {
+		return nil
+	}
+
+	var result []string
+	for _, c := range doc.List {
+		result = append(result, c.Text)
+	}
+
+	return result
+}
diff --git a/internal/internal/tools/tsgen/main.go b/internal/internal/tools/tsgen/main.go
new file mode 100644
index 000000000..8bd702eee
--- /dev/null
+++ b/internal/internal/tools/tsgen/main.go
@@ -0,0 +1,144 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//go:build tools
+
+package main
+
+import (
+	_ "embed"
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"text/template"
+)
+
+func main() {
+	out, dirsToParse, tags, err := getParams()
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+
+	err = run(dirsToParse, tags, out)
+	if err != nil {
+		fmt.Println(err)
+		os.Exit(1)
+	}
+}
+
+func run(dirsToParse []string, tags string, out string) error {
+	var result []ConstantWithDirective
+
+	for _, dirToParse := range dirsToParse {
+		fmt.Println("Parsing directory:", dirToParse)
+
+		files, err := ParseRecursive(dirToParse, tags)
+		if err != nil {
+			return fmt.Errorf("failed to parse directory: %w", err)
+		}
+
+		fmt.Printf("Parsed %d files\n", len(files))
+
+		for _, file := range files {
+			filtered, err := FindTSGenConstants(file)
+			if err != nil {
+				return err
+			}
+			result = append(result, filtered...)
+		}
+
+		fmt.Printf("Found %d constants with \"tsgen:\" directive\nSaving to %s\n", len(result), out)
+	}
+
+	return SaveConstantsToFile(out, result)
+}
+
+func createFoldersForFile(out string) error {
+	dir := filepath.Dir(out)
+	return os.MkdirAll(dir, os.ModePerm)
+}
+
+// getParams parses the command line parameters and returns the output file, the directory to parse and an error
+func getParams() (out string, dirsToParse []string, tags string, _ error) {
+	flag.Usage = func() {
+		fmt.Fprintf(os.Stderr, "Usage: %s -out <output file> <input dir>\n", os.Args[0])
+	}
+	flag.StringVar(&out, "out", "", "output file")
+	flag.StringVar(&tags, "tags", "", "build tags")
+	flag.Parse()
+
+	if out == "" {
+		return "", nil, "", fmt.Errorf("-out is required")
+	}
+
+	dirs := flag.Arg(0)
+	if dirs == "" {
+		return "", nil, "", fmt.Errorf("input dirs is required")
+	}
+
+	dirsToParse = strings.Split(dirs, ",")
+
+	out, err := filepath.Abs(out)
+	if err != nil {
+		return "", nil, "", err
+	}
+
+	return out, dirsToParse, tags, err
+}
+
+// fillTemplate fills the provided Template with the given data.
+func fillTemplate(t *template.Template, data any) (string, error) {
+	var buf strings.Builder
+	err := t.Execute(&buf, data)
+	if err != nil {
+		return "", err
+	}
+
+	return buf.String(), nil
+}
+
+// MakeTemplate creates a new named template from the given string. It panics on error.
+func MakeTemplate(name, s string) *template.Template {
+	return template.Must(template.New(name).Parse(s))
+}
+
+// Tpl is template for generate TS file which consumes slices of ConstantWithDirective.
+//
+//go:embed ts.template
+var Tpl string
+
+// SaveConstantsToFile saves the given constants to the given file.
+func SaveConstantsToFile(file string, data any) error {
+	t := MakeTemplate("ts_gen", Tpl)
+	s, err := fillTemplate(t, data)
+	if err != nil {
+		return err
+	}
+
+	return WriteFile(file, s)
+}
+
+// WriteFile writes the given string to the given file.
+func WriteFile(file string, s string) error {
+	if err := createFoldersForFile(file); err != nil {
+		return err
+	}
+
+	f, err := os.Create(file)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	_, err = f.WriteString(s)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
diff --git a/internal/internal/tools/tsgen/main_test.go b/internal/internal/tools/tsgen/main_test.go
new file mode 100644
index 000000000..ef0407e7c
--- /dev/null
+++ b/internal/internal/tools/tsgen/main_test.go
@@ -0,0 +1,54 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+//go:build tools
+
+package main
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func Test_extractTsGenDirective(t *testing.T) {
+	directive, ok := extractTsGenDirective("//tsgen:expected")
+	require.True(t, ok)
+	require.Equal(t, "expected", directive)
+	directive, ok = extractTsGenDirective("//tsgen:")
+	require.True(t, ok)
+	require.Equal(t, "", directive)
+	directive, ok = extractTsGenDirective("//tsgena:")
+	require.False(t, ok)
+	require.Equal(t, "", directive)
+}
+
+func Test_run(t *testing.T) {
+	t.Run("should return error if input file is not found", func(t *testing.T) {
+		err := run([]string{"./testdata/not-found-dir"}, "tools", "testdata/out")
+		require.Error(t, err)
+	})
+
+	t.Run("should properly parse pkg and give output", func(t *testing.T) {
+		err := run([]string{"./testdata/good/pkg/."}, "tools", "testdata/good/out/resources.ts")
+		require.NoError(t, err)
+		t.Cleanup(func() {
+			err := os.RemoveAll("testdata/good/out")
+			require.NoError(t, err)
+		})
+
+		actual, err := os.ReadFile("testdata/good/out/resources.ts")
+		require.NoError(t, err)
+		expected, err := os.ReadFile("testdata/good/expected/resources.ts")
+		require.NoError(t, err)
+		require.Equal(t, string(expected), string(actual))
+	})
+
+	t.Run("should fail on incorrect input", func(t *testing.T) {
+		err := run([]string{"./testdata/bad/pkg"}, "tools", "testdata/bad/resources.ts")
+		require.EqualError(t, err, "empty directive in MyConst")
+	})
+}
diff --git a/internal/internal/tools/tsgen/testdata/bad/pkg/1.go b/internal/internal/tools/tsgen/testdata/bad/pkg/1.go
new file mode 100644
index 000000000..c0aa2770f
--- /dev/null
+++ b/internal/internal/tools/tsgen/testdata/bad/pkg/1.go
@@ -0,0 +1,8 @@
+package pkg
+
+const (
+	// MyConst is a constant.
+	//
+	// tsgen:
+	MyConst = "const"
+)
diff --git a/internal/internal/tools/tsgen/testdata/good/expected/resources.ts b/internal/internal/tools/tsgen/testdata/good/expected/resources.ts
new file mode 100644
index 000000000..659ebf101
--- /dev/null
+++ b/internal/internal/tools/tsgen/testdata/good/expected/resources.ts
@@ -0,0 +1,41 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+
+export const Const2 = "const2";
+export const ConstNotSolo = "constSolo";
+export const ConstComputed = "constComputed";
+export const NamespaceType = "Namespaces.meta.cosi.dev";
+export const ResourceDefinitionType = "ResourceDefinitions.meta.cosi.dev";
+export const MetaNamespace = "meta";
+
+export const kubernetes = {
+  service: "services.v1",
+  pod: "pods.v1",
+  node: "nodes.v1",
+  cluster: `clusters`,
+  machine: `machines`,
+  sideroServers: "servers",
+  crd: "customresourcedefinitions.v1.apiextensions.k8s.io",
+};
+
+export const talos = {
+  // resources
+  service: "Services.v1alpha1.talos.dev",
+  cpu: "CPUStats.perf.talos.dev",
+  mem: "MemoryStats.perf.talos.dev",
+  nodename: "Nodenames.kubernetes.talos.dev",
+  member: "Members.cluster.talos.dev",
+
+  // well known resource IDs
+  defaultNodeNameID: "nodename",
+
+  // namespaces
+  perfNamespace: "perf",
+  clusterNamespace: "cluster",
+  runtimeNamespace: "runtime",
+  k8sNamespace: "k8s",
+};
diff --git a/internal/internal/tools/tsgen/testdata/good/pkg/1.go b/internal/internal/tools/tsgen/testdata/good/pkg/1.go
new file mode 100644
index 000000000..e8f8f501d
--- /dev/null
+++ b/internal/internal/tools/tsgen/testdata/good/pkg/1.go
@@ -0,0 +1,12 @@
+package main
+
+const (
+	// Const1 is a const.
+	Const1 = "const1"
+	// Const2 is a const.
+	//
+	// tsgen:Const2
+	Const2 = "const2"
+	// Const3 is a const.
+	Const3 = "const3"
+)
diff --git a/internal/internal/tools/tsgen/testdata/good/pkg/2.go b/internal/internal/tools/tsgen/testdata/good/pkg/2.go
new file mode 100644
index 000000000..e951ccf8f
--- /dev/null
+++ b/internal/internal/tools/tsgen/testdata/good/pkg/2.go
@@ -0,0 +1,13 @@
+package main
+
+// ConstSolo is a const.
+//
+// tsgen:ConstNotSolo
+const ConstSolo = "constSolo"
+
+const (
+	// ConstComputed is an expression.
+	//
+	// tsgen:ConstComputed
+	ConstComputed = "const" + "Computed"
+)
diff --git a/internal/internal/tools/tsgen/ts.template b/internal/internal/tools/tsgen/ts.template
new file mode 100644
index 000000000..a5fe0f26c
--- /dev/null
+++ b/internal/internal/tools/tsgen/ts.template
@@ -0,0 +1,44 @@
+// This Runtime Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+// THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+
+{{range . -}}
+export const {{.Directive}} = {{.Value}};
+{{end -}}
+
+
+export const NamespaceType = "Namespaces.meta.cosi.dev";
+export const ResourceDefinitionType = "ResourceDefinitions.meta.cosi.dev";
+export const MetaNamespace = "meta";
+
+export const kubernetes = {
+  service: "services.v1",
+  pod: "pods.v1",
+  node: "nodes.v1",
+  cluster: `clusters`,
+  machine: `machines`,
+  sideroServers: "servers",
+  crd: "customresourcedefinitions.v1.apiextensions.k8s.io",
+};
+
+export const talos = {
+  // resources
+  service: "Services.v1alpha1.talos.dev",
+  cpu: "CPUStats.perf.talos.dev",
+  mem: "MemoryStats.perf.talos.dev",
+  nodename: "Nodenames.kubernetes.talos.dev",
+  member: "Members.cluster.talos.dev",
+  nodeaddress: "NodeAddresses.net.talos.dev",
+
+  // well known resource IDs
+  defaultNodeNameID: "nodename",
+
+  // namespaces
+  perfNamespace: "perf",
+  clusterNamespace: "cluster",
+  runtimeNamespace: "runtime",
+  k8sNamespace: "k8s",
+  networkNamespace: "network",
+};
diff --git a/internal/memconn/memconn.go b/internal/memconn/memconn.go
new file mode 100644
index 000000000..9c7084cbc
--- /dev/null
+++ b/internal/memconn/memconn.go
@@ -0,0 +1,37 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package memconn provides a memory-based net.Conn implementation.
+package memconn
+
+import (
+	"errors"
+	"net"
+
+	"github.com/akutz/memconn"
+)
+
+// Transport is transport for in-memory connection.
+type Transport struct {
+	Address string
+}
+
+// Listener creates new listener.
+func (l *Transport) Listener() (net.Listener, error) {
+	if l.Address == "" {
+		return nil, errors.New("address is not set")
+	}
+
+	return memconn.Listen("memu", l.Address)
+}
+
+// Dial creates a new connection.
+func (l *Transport) Dial() (net.Conn, error) {
+	if l.Address == "" {
+		return nil, errors.New("address is not set")
+	}
+
+	return memconn.Dial("memu", l.Address)
+}
diff --git a/internal/pkg/auth/accesspolicy/accesspolicy.go b/internal/pkg/auth/accesspolicy/accesspolicy.go
new file mode 100644
index 000000000..bac32c16b
--- /dev/null
+++ b/internal/pkg/auth/accesspolicy/accesspolicy.go
@@ -0,0 +1,355 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package accesspolicy provides functionality to check and validate access policies.
+package accesspolicy
+
+import (
+	"errors"
+	"fmt"
+	"path/filepath"
+	"slices"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/hashicorp/go-multierror"
+
+	"github.com/siderolabs/omni/client/pkg/cosi/labels"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+)
+
+// GroupPrefix is the special prefix used in the AccessPolicy rules to denote a group of users or clusters.
+const GroupPrefix = "group/"
+
+// CheckResult is the result of an access policy check.
+type CheckResult struct {
+	Role                        role.Role
+	KubernetesImpersonateGroups []string
+	MatchesAllClusters          bool
+}
+
+// Validate validates the given access policy by running all its tests.
+//
+//nolint:gocognit,gocyclo,cyclop
+func Validate(accessPolicy *auth.AccessPolicy) error {
+	var validationErrs error
+
+	// check metadata
+	if accessPolicy.Metadata().ID() != auth.AccessPolicyID {
+		validationErrs = multierror.Append(validationErrs, fmt.Errorf(
+			"access policy ID mismatch: expected %q, got %q",
+			auth.AccessPolicyID,
+			accessPolicy.Metadata().ID(),
+		))
+	}
+
+	if accessPolicy.Metadata().Namespace() != resources.DefaultNamespace {
+		validationErrs = multierror.Append(validationErrs, fmt.Errorf(
+			"access policy namespace mismatch: expected %q, got %q",
+			resources.DefaultNamespace,
+			accessPolicy.Metadata().Namespace(),
+		))
+	}
+
+	accessPolicySpec := accessPolicy.TypedSpec().Value
+
+	// check user groups
+	for name, userGroup := range accessPolicySpec.UserGroups {
+		for _, user := range userGroup.GetUsers() {
+			numSetFields := 0
+
+			if user.GetName() != "" {
+				numSetFields++
+			}
+
+			if user.GetMatch() != "" {
+				numSetFields++
+
+				// check the validity of the match pattern
+				if _, err := filepath.Match(user.GetMatch(), ""); err != nil {
+					validationErrs = multierror.Append(validationErrs, err)
+				}
+			}
+
+			if len(user.GetLabelSelectors()) != 0 {
+				numSetFields++
+			}
+
+			if numSetFields == 0 {
+				validationErrs = multierror.Append(validationErrs, fmt.Errorf(
+					"access policy user group %q contains an empty user",
+					name,
+				))
+			} else if numSetFields > 1 {
+				validationErrs = multierror.Append(validationErrs, fmt.Errorf(
+					"access policy user group %q contains a user with mutually exclusive fields set",
+					name,
+				))
+			}
+		}
+	}
+
+	// check cluster groups
+	for name, clusterGroup := range accessPolicySpec.ClusterGroups {
+		for _, cluster := range clusterGroup.GetClusters() {
+			numSetFields := 0
+
+			if cluster.GetName() != "" {
+				numSetFields++
+			}
+
+			if cluster.GetMatch() != "" {
+				numSetFields++
+
+				// check the validity of the match pattern
+				if _, err := filepath.Match(cluster.GetMatch(), ""); err != nil {
+					validationErrs = multierror.Append(validationErrs, err)
+				}
+			}
+
+			if numSetFields == 0 {
+				validationErrs = multierror.Append(validationErrs, fmt.Errorf(
+					"access policy cluster group %q contains an empty cluster",
+					name,
+				))
+			} else if numSetFields > 1 {
+				validationErrs = multierror.Append(validationErrs, fmt.Errorf(
+					"access policy cluster group %q contains a cluster with mutually exclusive fields set",
+					name,
+				))
+			}
+		}
+	}
+
+	// check rules
+	for _, rule := range accessPolicySpec.GetRules() {
+		if rule.Role != "" {
+			if _, err := role.Parse(rule.Role); err != nil {
+				validationErrs = multierror.Append(validationErrs, err)
+			}
+		}
+	}
+
+	// check tests
+	for _, test := range accessPolicySpec.GetTests() {
+		testName := test.GetName()
+		clusterName := test.GetCluster().GetName()
+		userName := test.GetUser().GetName()
+
+		// check test fields
+		if testName == "" {
+			validationErrs = multierror.Append(validationErrs, errors.New("invalid test: name is empty"))
+		}
+
+		if clusterName == "" {
+			validationErrs = multierror.Append(validationErrs, fmt.Errorf("invalid test %q: cluster name is empty", clusterName))
+		}
+
+		if userName == "" {
+			validationErrs = multierror.Append(validationErrs, fmt.Errorf("invalid test %q: user name is empty", userName))
+		}
+
+		// evaluate the test
+		clusterMD := omni.NewCluster(resources.DefaultNamespace, clusterName).Metadata()
+		identityMD := auth.NewIdentity(resources.DefaultNamespace, userName).Metadata()
+
+		for key, value := range test.GetUser().GetLabels() {
+			identityMD.Labels().Set(key, value)
+		}
+
+		checkResult, err := Check(accessPolicy, clusterMD, identityMD)
+		if err != nil {
+			validationErrs = multierror.Append(validationErrs, err)
+
+			continue
+		}
+
+		expectedRole := test.GetExpected().GetRole()
+		expectedImpersonateGroups := append([]string(nil), test.GetExpected().GetKubernetes().GetImpersonate().GetGroups()...)
+
+		slices.Sort(expectedImpersonateGroups)
+		slices.Sort(checkResult.KubernetesImpersonateGroups)
+
+		if !slices.Equal(expectedImpersonateGroups, checkResult.KubernetesImpersonateGroups) {
+			validationErrs = multierror.Append(validationErrs, fmt.Errorf(
+				"access policy test %q failed: kubernetes impersonate groups mismatch: expected %q, got %q",
+				test.GetName(),
+				expectedImpersonateGroups,
+				checkResult.KubernetesImpersonateGroups,
+			))
+		}
+
+		if expectedRole != "" && string(checkResult.Role) != expectedRole {
+			validationErrs = multierror.Append(validationErrs, fmt.Errorf(
+				"access policy test %q failed: role mismatch: expected %q, got %q",
+				test.GetName(),
+				expectedRole,
+				checkResult.Role,
+			))
+		}
+	}
+
+	return validationErrs
+}
+
+// Check checks the given user against the given cluster, and returns the result of the check, containing
+// which role is assumed and which groups will be impersonated when the Kubernetes cluster is accessed.
+//
+//nolint:gocognit,gocyclo,cyclop
+func Check(accessPolicy *auth.AccessPolicy, clusterMD, identityMD *resource.Metadata) (CheckResult, error) {
+	if identityMD == nil {
+		return CheckResult{}, errors.New("no user metadata")
+	}
+
+	if clusterMD == nil {
+		return CheckResult{}, errors.New("no cluster metadata")
+	}
+
+	accessPolicySpec := accessPolicy.TypedSpec().Value
+	maxRole := role.None
+
+	if len(accessPolicySpec.GetRules()) == 0 {
+		return CheckResult{
+			Role: maxRole,
+		}, nil
+	}
+
+	impersonateGroups := make([]string, 0, len(accessPolicySpec.GetRules()))
+
+	match := func(md *resource.Metadata, exactMatchValue, matchPattern string, selectors []string) (bool, error) {
+		if exactMatchValue != "" && md.ID() == exactMatchValue {
+			return true, nil
+		}
+
+		if matchPattern != "" {
+			matches, err := filepath.Match(matchPattern, md.ID())
+			if err != nil {
+				return false, fmt.Errorf("invalid match pattern %q for %s", matchPattern, md)
+			}
+
+			if matches {
+				return true, nil
+			}
+		}
+
+		if len(selectors) != 0 && md.Labels() != nil {
+			query, err := labels.ParseSelectors([]string{strings.Join(selectors, ",")})
+			if err != nil {
+				return false, err
+			}
+
+			if query.Matches(*md.Labels()) {
+				return true, nil
+			}
+		}
+
+		return false, nil
+	}
+
+	matchesAllClusters := false
+
+	for _, rule := range accessPolicySpec.GetRules() {
+		userMatches := false
+
+		for _, ruleUser := range rule.GetUsers() {
+			if ruleUser == identityMD.ID() {
+				userMatches = true
+
+				break
+			}
+
+			if strings.HasPrefix(ruleUser, GroupPrefix) {
+				groupName := ruleUser[len(GroupPrefix):]
+
+				group, groupOk := accessPolicySpec.GetUserGroups()[groupName]
+				if !groupOk {
+					continue
+				}
+
+				for _, groupUser := range group.GetUsers() {
+					matches, err := match(identityMD, groupUser.GetName(), groupUser.GetMatch(), groupUser.GetLabelSelectors())
+					if err != nil {
+						return CheckResult{}, err
+					}
+
+					if matches {
+						userMatches = true
+
+						break
+					}
+				}
+			}
+		}
+
+		if !userMatches {
+			continue
+		}
+
+		clusterMatches := false
+
+		for _, ruleCluster := range rule.GetClusters() {
+			if ruleCluster == clusterMD.ID() {
+				clusterMatches = true
+
+				break
+			}
+
+			if strings.HasPrefix(ruleCluster, GroupPrefix) {
+				groupName := ruleCluster[len(GroupPrefix):]
+
+				group, groupOk := accessPolicySpec.GetClusterGroups()[groupName]
+				if !groupOk {
+					continue
+				}
+
+				for _, groupCluster := range group.GetClusters() {
+					if groupCluster.GetMatch() == "*" {
+						clusterMatches = true
+						matchesAllClusters = true
+
+						break
+					}
+
+					matches, err := match(clusterMD, groupCluster.GetName(), groupCluster.GetMatch(), nil)
+					if err != nil {
+						return CheckResult{}, err
+					}
+
+					if matches {
+						clusterMatches = true
+
+						break
+					}
+				}
+			}
+		}
+
+		if !clusterMatches {
+			continue
+		}
+
+		if rule.Role != "" {
+			parsedRole, err := role.Parse(rule.Role)
+			if err != nil {
+				return CheckResult{}, err
+			}
+
+			if parsedRole.Check(maxRole) == nil {
+				maxRole = parsedRole
+			}
+		}
+
+		impersonateGroups = append(impersonateGroups, rule.GetKubernetes().GetImpersonate().GetGroups()...)
+	}
+
+	return CheckResult{
+		MatchesAllClusters:          matchesAllClusters,
+		Role:                        maxRole,
+		KubernetesImpersonateGroups: impersonateGroups,
+	}, nil
+}
diff --git a/internal/pkg/auth/accesspolicy/accesspolicy_test.go b/internal/pkg/auth/accesspolicy/accesspolicy_test.go
new file mode 100644
index 000000000..0b206a10b
--- /dev/null
+++ b/internal/pkg/auth/accesspolicy/accesspolicy_test.go
@@ -0,0 +1,181 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package accesspolicy_test
+
+import (
+	"bytes"
+	_ "embed"
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/resource/protobuf"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/auth/accesspolicy"
+)
+
+//go:embed testdata/acl-valid.yaml
+var aclValidRaw []byte
+
+//go:embed testdata/acl-valid-match-selector.yaml
+var aclValidMatchSelectorRaw []byte
+
+//go:embed testdata/acl-invalid-metadata.yaml
+var aclInvalidMetadataRaw []byte
+
+func TestCheck(t *testing.T) {
+	accessPolicy := getAccessPolicy(t, aclValidRaw)
+
+	checkResult, err := accesspolicy.Check(accessPolicy,
+		omni.NewCluster(resources.DefaultNamespace, "cluster-group-1-cluster-1").Metadata(),
+		auth.NewIdentity(resources.DefaultNamespace, "user-group-1-user-1").Metadata())
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"k8s-group-1", "k8s-group-2"}, checkResult.KubernetesImpersonateGroups)
+
+	checkResult, err = accesspolicy.Check(accessPolicy,
+		omni.NewCluster(resources.DefaultNamespace, "cluster-group-1-cluster-1").Metadata(),
+		auth.NewIdentity(resources.DefaultNamespace, "user-group-1-user-2").Metadata())
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"k8s-group-1", "k8s-group-2"}, checkResult.KubernetesImpersonateGroups)
+
+	checkResult, err = accesspolicy.Check(accessPolicy,
+		omni.NewCluster(resources.DefaultNamespace, "cluster-group-1-cluster-1").Metadata(),
+		auth.NewIdentity(resources.DefaultNamespace, "standalone-user-1").Metadata())
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"k8s-group-1", "k8s-group-2"}, checkResult.KubernetesImpersonateGroups)
+
+	checkResult, err = accesspolicy.Check(accessPolicy,
+		omni.NewCluster(resources.DefaultNamespace, "standalone-cluster-1").Metadata(),
+		auth.NewIdentity(resources.DefaultNamespace, "standalone-user-1").Metadata())
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"k8s-group-1", "k8s-group-2"}, checkResult.KubernetesImpersonateGroups)
+
+	checkResult, err = accesspolicy.Check(accessPolicy,
+		omni.NewCluster(resources.DefaultNamespace, "cluster-group-1-cluster-1").Metadata(),
+		auth.NewIdentity(resources.DefaultNamespace, "user-group-2-user-1").Metadata())
+	require.NoError(t, err)
+	assert.Empty(t, checkResult.KubernetesImpersonateGroups)
+
+	checkResult, err = accesspolicy.Check(accessPolicy,
+		omni.NewCluster(resources.DefaultNamespace, "cluster-group-2-cluster-1").Metadata(),
+		auth.NewIdentity(resources.DefaultNamespace, "user-group-2-user-1").Metadata())
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"k8s-group-3", "k8s-group-4"}, checkResult.KubernetesImpersonateGroups)
+
+	checkResult, err = accesspolicy.Check(accessPolicy,
+		omni.NewCluster(resources.DefaultNamespace, "cluster-group-2-cluster-1").Metadata(),
+		auth.NewIdentity(resources.DefaultNamespace, "user-group-2-user-2").Metadata())
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"k8s-group-3", "k8s-group-4"}, checkResult.KubernetesImpersonateGroups)
+
+	checkResult, err = accesspolicy.Check(accessPolicy,
+		omni.NewCluster(resources.DefaultNamespace, "cluster-group-2-cluster-1").Metadata(),
+		auth.NewIdentity(resources.DefaultNamespace, "user-group-2-user-3").Metadata())
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"k8s-group-3", "k8s-group-4"}, checkResult.KubernetesImpersonateGroups)
+
+	checkResult, err = accesspolicy.Check(accessPolicy,
+		omni.NewCluster(resources.DefaultNamespace, "cluster-group-2-cluster-1").Metadata(),
+		auth.NewIdentity(resources.DefaultNamespace, "standalone-user-2").Metadata())
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"k8s-group-3", "k8s-group-4"}, checkResult.KubernetesImpersonateGroups)
+
+	checkResult, err = accesspolicy.Check(accessPolicy,
+		omni.NewCluster(resources.DefaultNamespace, "standalone-cluster-2").Metadata(),
+		auth.NewIdentity(resources.DefaultNamespace, "standalone-user-2").Metadata())
+	require.NoError(t, err)
+	assert.ElementsMatch(t, []string{"k8s-group-3", "k8s-group-4"}, checkResult.KubernetesImpersonateGroups)
+
+	checkResult, err = accesspolicy.Check(accessPolicy,
+		omni.NewCluster(resources.DefaultNamespace, "cluster-group-2-cluster-1").Metadata(),
+		auth.NewIdentity(resources.DefaultNamespace, "user-group-1-user-1").Metadata())
+	require.NoError(t, err)
+	assert.Empty(t, checkResult.KubernetesImpersonateGroups)
+}
+
+func TestValidateFailingTests(t *testing.T) {
+	accessPolicy := getAccessPolicy(t, aclValidRaw)
+
+	err := accesspolicy.Validate(accessPolicy)
+	assert.NoError(t, err)
+
+	accessPolicy.TypedSpec().Value.Tests[0].Expected.Kubernetes.Impersonate.Groups = []string{"k8s-group-1", "k8s-group-2", "k8s-group-3"}
+	accessPolicy.TypedSpec().Value.Tests[1].Expected.Kubernetes.Impersonate.Groups = []string{"k8s-group-3", "k8s-group-4", "k8s-group-5"}
+
+	err = accesspolicy.Validate(accessPolicy)
+	assert.ErrorContains(t, err, "2 errors occurred")
+	assert.ErrorContains(t, err, `access policy test "test-1" failed`)
+	assert.ErrorContains(t, err, `access policy test "test-2" failed`)
+}
+
+func TestValidateInvalidMetadata(t *testing.T) {
+	accessPolicy := getAccessPolicy(t, aclInvalidMetadataRaw)
+
+	err := accesspolicy.Validate(accessPolicy)
+	assert.ErrorContains(t, err, "2 errors occurred")
+	assert.ErrorContains(t, err, `access policy ID mismatch`)
+	assert.ErrorContains(t, err, `access policy namespace mismatch`)
+}
+
+func TestValidateInvalidGroups(t *testing.T) {
+	accessPolicy := getAccessPolicy(t, aclValidRaw)
+
+	err := accesspolicy.Validate(accessPolicy)
+	assert.NoError(t, err)
+
+	accessPolicy.TypedSpec().Value.UserGroups["user-group-1"].Users[0].Name = ""
+
+	err = accesspolicy.Validate(accessPolicy)
+	assert.ErrorContains(t, err, `"user-group-1" contains an empty user`)
+
+	// revert to valid state
+	accessPolicy = getAccessPolicy(t, aclValidRaw)
+
+	accessPolicy.TypedSpec().Value.UserGroups["user-group-1"].Users[0].Match = "some-matcher"
+	accessPolicy.TypedSpec().Value.UserGroups["user-group-2"].Users[0].LabelSelectors = []string{"some-selector"}
+
+	accessPolicy.TypedSpec().Value.ClusterGroups["cluster-group-1"].Clusters[0].Match = "some-matcher"
+
+	err = accesspolicy.Validate(accessPolicy)
+	assert.ErrorContains(t, err, "3 errors occurred")
+	assert.ErrorContains(t, err, `"user-group-1" contains a user with mutually exclusive fields set`)
+	assert.ErrorContains(t, err, `"user-group-2" contains a user with mutually exclusive fields set`)
+	assert.ErrorContains(t, err, `"cluster-group-1" contains a cluster with mutually exclusive fields set`)
+}
+
+func TestValidateWithMatchAndSelector(t *testing.T) {
+	accessPolicy := getAccessPolicy(t, aclValidMatchSelectorRaw)
+
+	err := accesspolicy.Validate(accessPolicy)
+	assert.NoError(t, err)
+}
+
+func TestInvalidRole(t *testing.T) {
+	accessPolicy := getAccessPolicy(t, aclValidRaw)
+
+	accessPolicy.TypedSpec().Value.Rules[1].Role = "non-existent"
+
+	err := accesspolicy.Validate(accessPolicy)
+	assert.ErrorContains(t, err, "unknown role")
+}
+
+func getAccessPolicy(t *testing.T, raw []byte) *auth.AccessPolicy {
+	dec := yaml.NewDecoder(bytes.NewReader(raw))
+
+	var res protobuf.YAMLResource
+
+	err := dec.Decode(&res)
+	require.NoError(t, err)
+
+	policy, ok := res.Resource().(*auth.AccessPolicy)
+	require.True(t, ok, "resource is not an AccessPolicy")
+
+	return policy
+}
diff --git a/internal/pkg/auth/accesspolicy/cluster.go b/internal/pkg/auth/accesspolicy/cluster.go
new file mode 100644
index 000000000..4ef8b1b4e
--- /dev/null
+++ b/internal/pkg/auth/accesspolicy/cluster.go
@@ -0,0 +1,68 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package accesspolicy
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	authres "github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+)
+
+// RoleForCluster returns the role of the current user for the given cluster, and whether the role matches all clusters.
+func RoleForCluster(ctx context.Context, id resource.ID, st state.State) (role.Role, bool, error) {
+	userRole, userRoleExists := ctx.Value(auth.RoleContextKey{}).(role.Role)
+	if !userRoleExists {
+		userRole = role.None
+	}
+
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	accessPolicy, err := safe.StateGet[*authres.AccessPolicy](ctx, st, authres.NewAccessPolicy().Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return userRole, false, nil
+		}
+
+		return role.None, false, err
+	}
+
+	identityStr, identityExists := ctx.Value(auth.IdentityContextKey{}).(string)
+	if !identityExists {
+		return userRole, false, nil
+	}
+
+	identity, err := safe.StateGet[*authres.Identity](ctx, st, authres.NewIdentity(resources.DefaultNamespace, identityStr).Metadata())
+	if err != nil {
+		if state.IsNotFoundError(err) {
+			return userRole, false, nil
+		}
+
+		return role.None, false, err
+	}
+
+	clusterMD := omni.NewCluster(resources.DefaultNamespace, id).Metadata()
+
+	checkResult, err := Check(accessPolicy, clusterMD, identity.Metadata())
+	if err != nil {
+		return role.None, false, err
+	}
+
+	maxRole, err := role.Max(userRole, checkResult.Role)
+	if err != nil {
+		return role.None, false, err
+	}
+
+	return maxRole, checkResult.MatchesAllClusters, nil
+}
diff --git a/internal/pkg/auth/accesspolicy/testdata/acl-invalid-metadata.yaml b/internal/pkg/auth/accesspolicy/testdata/acl-invalid-metadata.yaml
new file mode 100644
index 000000000..305c095cf
--- /dev/null
+++ b/internal/pkg/auth/accesspolicy/testdata/acl-invalid-metadata.yaml
@@ -0,0 +1,9 @@
+metadata:
+  namespace: invalid-ns
+  type: AccessPolicies.omni.sidero.dev
+  id: invalid-id
+spec:
+  usergroups: {}
+  clustergroups: {}
+  rules: []
+  tests: []
diff --git a/internal/pkg/auth/accesspolicy/testdata/acl-valid-match-selector.yaml b/internal/pkg/auth/accesspolicy/testdata/acl-valid-match-selector.yaml
new file mode 100644
index 000000000..af912b8c8
--- /dev/null
+++ b/internal/pkg/auth/accesspolicy/testdata/acl-valid-match-selector.yaml
@@ -0,0 +1,73 @@
+metadata:
+  namespace: default
+  type: AccessPolicies.omni.sidero.dev
+  id: access-policy
+spec:
+  usergroups:
+    user-group-1:
+      users:
+        - match: user-to-match-* # fnmatch syntax
+    user-group-2:
+      users:
+        - labelselectors:
+            - key-1=value-1 # key-1 must have value-1
+            - key-2 # key-2 must exist
+            - "!key-3" # key-3 must not exist
+  clustergroups:
+    cluster-group-1:
+      clusters:
+        - match: cluster-?-match # fnmatch syntax
+  rules:
+    - users:
+        - group/user-group-1
+      clusters:
+        - group/cluster-group-1
+      kubernetes:
+        impersonate:
+          groups:
+            - k8s-group-1
+    - users:
+        - group/user-group-2
+      clusters:
+        - cluster-x
+      kubernetes:
+        impersonate:
+          groups:
+            - k8s-group-1
+  tests:
+    - name: test-1
+      user:
+        name: user-to-match-1 # member of user-group-1
+      cluster:
+        name: cluster-b-match # member of cluster-group-1
+      expected:
+        kubernetes:
+          impersonate:
+            groups:
+              - k8s-group-1
+    - name: test-2
+      user:
+        name: doesnt-matter # member of user-group-2
+        labels:
+            key-1: value-1
+            key-2: value-2
+      cluster:
+        name: cluster-x
+      expected:
+        kubernetes:
+          impersonate:
+            groups:
+              - k8s-group-1
+    - name: test-2
+      user:
+        name: doesnt-matter # not a member of any groups because of the label "key-3"
+        labels:
+          key-1: value-1
+          key-2: value-2
+          key-3: something
+      cluster:
+        name: cluster-x
+      expected:
+        kubernetes:
+          impersonate:
+            groups: []
diff --git a/internal/pkg/auth/accesspolicy/testdata/acl-valid.yaml b/internal/pkg/auth/accesspolicy/testdata/acl-valid.yaml
new file mode 100644
index 000000000..1205c1f51
--- /dev/null
+++ b/internal/pkg/auth/accesspolicy/testdata/acl-valid.yaml
@@ -0,0 +1,82 @@
+metadata:
+  namespace: default
+  type: AccessPolicies.omni.sidero.dev
+  id: access-policy
+spec:
+  usergroups:
+    user-group-1:
+      users:
+        - name: user-group-1-user-1
+        - name: user-group-1-user-2
+    user-group-2:
+      users:
+        - name: user-group-2-user-1
+        - name: user-group-2-user-2
+        - name: user-group-2-user-3
+  clustergroups:
+    cluster-group-1:
+      clusters:
+        - name: cluster-group-1-cluster-1
+        - name: cluster-group-1-cluster-2
+    cluster-group-2:
+      clusters:
+        - name: cluster-group-2-cluster-1
+        - name: cluster-group-2-cluster-2
+        - name: cluster-group-2-cluster-3
+  rules:
+    - users:
+        - group/user-group-1
+        - standalone-user-1
+      clusters:
+        - group/cluster-group-1
+        - standalone-cluster-1
+      kubernetes:
+        impersonate:
+          groups:
+            - k8s-group-1
+            - k8s-group-2
+    - users:
+        - group/user-group-2
+        - standalone-user-2
+      clusters:
+        - group/cluster-group-2
+        - standalone-cluster-2
+      role: Operator
+      kubernetes:
+        impersonate:
+          groups:
+            - k8s-group-3
+            - k8s-group-4
+  tests:
+    - name: test-1
+      user:
+        name: user-group-1-user-1
+      cluster:
+        name: cluster-group-1-cluster-1
+      expected:
+        kubernetes:
+          impersonate:
+            groups:
+              - k8s-group-1
+              - k8s-group-2
+    - name: test-2
+      user:
+        name: standalone-user-2
+      cluster:
+        name: standalone-cluster-2
+      expected:
+        role: Operator
+        kubernetes:
+          impersonate:
+            groups:
+              - k8s-group-3
+              - k8s-group-4
+    - name: test-3
+      user:
+        name: user-group-1-user-1
+      cluster:
+        name: cluster-group-2-cluster-2
+      expected:
+        kubernetes:
+          impersonate:
+            groups: []
diff --git a/internal/pkg/auth/actor/actor.go b/internal/pkg/auth/actor/actor.go
new file mode 100644
index 000000000..75c777fb9
--- /dev/null
+++ b/internal/pkg/auth/actor/actor.go
@@ -0,0 +1,22 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package actor implements the context marking for internal/external actors.
+package actor
+
+import "context"
+
+// internalActorContextKey is the key for internal actor context.
+type internalActorContextKey struct{}
+
+// MarkContextAsInternalActor returns a new derived context from the given context, marked as an internal actor.
+func MarkContextAsInternalActor(ctx context.Context) context.Context {
+	return context.WithValue(ctx, internalActorContextKey{}, struct{}{})
+}
+
+// ContextIsInternalActor returns true if the given context is marked as an internal actor.
+func ContextIsInternalActor(ctx context.Context) bool {
+	return ctx.Value(internalActorContextKey{}) != nil
+}
diff --git a/internal/pkg/auth/auth.go b/internal/pkg/auth/auth.go
new file mode 100644
index 000000000..604b6ccf0
--- /dev/null
+++ b/internal/pkg/auth/auth.go
@@ -0,0 +1,34 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package auth contains authentication related logic.
+package auth
+
+import "time"
+
+const (
+	// ServiceAccountMaxAllowedLifetime is the maximum allowed lifetime for a service account.
+	ServiceAccountMaxAllowedLifetime = 365 * 24 * time.Hour
+
+	// RedirectQueryParam is the name of the query parameter used to specify URL or route to redirect after authentication flow is complete.
+	//
+	// tsgen:RedirectQueryParam
+	RedirectQueryParam = "redirect"
+
+	// FlowQueryParam is the name of the query parameter used to specify the authentication flow.
+	//
+	// tsgen:AuthFlowQueryParam
+	FlowQueryParam = "flow"
+
+	// CLIAuthFlow is the name of the authentication flow used for CLI authentication.
+	//
+	// tsgen:CLIAuthFlow
+	CLIAuthFlow = "cli"
+
+	// ProxyAuthFlow is the name of the authentication flow used for proxy authentication.
+	//
+	// tsgen:WorkloadProxyAuthFlow
+	ProxyAuthFlow = "workload-proxy"
+)
diff --git a/internal/pkg/auth/auth0/auth0.go b/internal/pkg/auth/auth0/auth0.go
new file mode 100644
index 000000000..1edef12b5
--- /dev/null
+++ b/internal/pkg/auth/auth0/auth0.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package auth0 related operations such as ID token/JWT verification.
+package auth0
diff --git a/internal/pkg/auth/auth0/token.go b/internal/pkg/auth/auth0/token.go
new file mode 100644
index 000000000..95c9b408b
--- /dev/null
+++ b/internal/pkg/auth/auth0/token.go
@@ -0,0 +1,108 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package auth0
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/mail"
+	"net/url"
+	"time"
+
+	"github.com/auth0/go-jwt-middleware/v2/jwks"
+	"github.com/auth0/go-jwt-middleware/v2/validator"
+	"github.com/siderolabs/go-api-signature/pkg/jwt"
+
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+const (
+	tokenValidationCacheDuration    = 5 * time.Minute
+	tokenValidationAllowedClockSkew = 5 * time.Minute
+)
+
+// IDTokenVerifier is an Auth0 ID token verifier.
+type IDTokenVerifier struct {
+	validator *validator.Validator
+}
+
+// NewIDTokenVerifier creates a new ID token verifier.
+func NewIDTokenVerifier(domain string) (*IDTokenVerifier, error) {
+	issuerURL, err := url.Parse("https://" + domain + "/")
+	if err != nil {
+		return nil, err
+	}
+
+	provider := jwks.NewCachingProvider(issuerURL, tokenValidationCacheDuration)
+
+	idTokenValidator, err := validator.New(
+		provider.KeyFunc,
+		validator.RS256,
+		issuerURL.String(),
+		[]string{config.Config.Auth.Auth0.ClientID},
+		validator.WithAllowedClockSkew(tokenValidationAllowedClockSkew),
+		validator.WithCustomClaims(func() validator.CustomClaims {
+			return &CustomIDClaims{}
+		}),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDTokenVerifier{
+		validator: idTokenValidator,
+	}, nil
+}
+
+// Verify verifies the given Auth0 ID token with the configured Auth0 domain (JWKs).
+func (v *IDTokenVerifier) Verify(ctx context.Context, token string) (*jwt.Claims, error) {
+	claims, err := v.validator.ValidateToken(ctx, token)
+	if err != nil {
+		return nil, err
+	}
+
+	validatedClaims, ok := claims.(*validator.ValidatedClaims)
+	if !ok {
+		return nil, errors.New("unexpected claims type")
+	}
+
+	customClaims, ok := validatedClaims.CustomClaims.(*CustomIDClaims)
+	if !ok {
+		return nil, errors.New("unexpected custom claims type")
+	}
+
+	return &jwt.Claims{
+		VerifiedEmail: customClaims.Email,
+	}, nil
+}
+
+// IDClaims represents the claims of an ID token.
+type IDClaims struct {
+	validator.RegisteredClaims
+	CustomIDClaims
+}
+
+// CustomIDClaims is the custom claims we expect to be present in ID tokens.
+type CustomIDClaims struct {
+	// Email is the email address of the user.
+	Email         string `json:"email"`
+	EmailVerified bool   `json:"email_verified"`
+}
+
+// Validate validates the claims on the CustomIDClaims.
+func (a *CustomIDClaims) Validate(_ context.Context) error {
+	_, err := mail.ParseAddress(a.Email)
+	if err != nil {
+		return fmt.Errorf("email claim is not valid: %w: %s", err, a.Email)
+	}
+
+	if !a.EmailVerified {
+		return errors.New("email is not verified")
+	}
+
+	return nil
+}
diff --git a/internal/pkg/auth/authenticator.go b/internal/pkg/auth/authenticator.go
new file mode 100644
index 000000000..e39a7836a
--- /dev/null
+++ b/internal/pkg/auth/authenticator.go
@@ -0,0 +1,25 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package auth
+
+import (
+	"context"
+
+	"github.com/siderolabs/go-api-signature/pkg/message"
+
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+)
+
+// Authenticator represents an authenticator.
+type Authenticator struct {
+	Verifier message.SignatureVerifier
+	Identity string
+	UserID   string
+	Role     role.Role
+}
+
+// AuthenticatorFunc represents a function that returns an authenticator for the given public key fingerprint.
+type AuthenticatorFunc func(ctx context.Context, fingerprint string) (*Authenticator, error)
diff --git a/internal/pkg/auth/check.go b/internal/pkg/auth/check.go
new file mode 100644
index 000000000..54197093c
--- /dev/null
+++ b/internal/pkg/auth/check.go
@@ -0,0 +1,167 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package auth
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+)
+
+var (
+	// ErrUnauthenticated is returned when the context does not contain the required authentication information.
+	ErrUnauthenticated = errors.New("unauthenticated")
+
+	// ErrUnauthorized is returned when the context does not contain the required authorization information.
+	ErrUnauthorized = errors.New("unauthorized")
+)
+
+// CheckOptions are the options for the checks.
+type CheckOptions struct {
+	Role           role.Role
+	VerifiedEmail  bool
+	ValidSignature bool
+}
+
+// DefaultCheckOptions returns the default check options.
+func DefaultCheckOptions() CheckOptions {
+	return CheckOptions{
+		Role: role.None,
+	}
+}
+
+// CheckResult is the result of a successful check.
+type CheckResult struct {
+	VerifiedEmail     string
+	Identity          string
+	UserID            string
+	Labels            map[string]string
+	Role              role.Role
+	HasValidSignature bool
+	AuthEnabled       bool
+}
+
+// CheckOption is a functional option for Check.
+type CheckOption func(*CheckOptions)
+
+// WithRole checks the context to have the given role.
+//
+// If the required role is other than role.None, WithValidSignature is ignored and the signature is always checked.
+func WithRole(role role.Role) CheckOption {
+	return func(opts *CheckOptions) {
+		opts.Role = role
+	}
+}
+
+// WithValidSignature checks if the context has a valid signature.
+//
+// If the required role set via WithRole is other than role.None, this setting is ignored and the signature is always checked.
+func WithValidSignature(validSignature bool) CheckOption {
+	return func(opts *CheckOptions) {
+		opts.ValidSignature = validSignature
+	}
+}
+
+// WithVerifiedEmail checks if there is a verified email in the context.
+func WithVerifiedEmail() CheckOption {
+	return func(opts *CheckOptions) {
+		opts.VerifiedEmail = true
+	}
+}
+
+// Check checks the given context for the given authentication and authorization conditions.
+//
+// The returned error can be checked against ErrUnauthenticated and ErrUnauthorized.
+func Check(ctx context.Context, opt ...CheckOption) (CheckResult, error) {
+	authEnabled, ok := ctx.Value(EnabledAuthContextKey{}).(bool)
+	if !ok {
+		return CheckResult{}, fmt.Errorf("%w: auth configuration not found in context", ErrUnauthenticated)
+	}
+
+	if !authEnabled {
+		return CheckResult{
+			AuthEnabled: false,
+		}, nil
+	}
+
+	result := CheckResult{
+		AuthEnabled: authEnabled,
+	}
+
+	opts := DefaultCheckOptions()
+
+	for _, o := range opt {
+		o(&opts)
+	}
+
+	// If the required role is other than role.None, we always check the signature.
+	if opts.Role != role.None {
+		opts.ValidSignature = true
+	}
+
+	if opts.VerifiedEmail {
+		email, ok := ctx.Value(VerifiedEmailContextKey{}).(string)
+		if !ok {
+			return CheckResult{}, fmt.Errorf("%w: missing verified email", ErrUnauthenticated)
+		}
+
+		result.VerifiedEmail = email
+	}
+
+	ctxRole, ctxRoleExists := ctx.Value(RoleContextKey{}).(role.Role)
+	if !ctxRoleExists {
+		ctxRole = role.None
+	}
+
+	result.Role = ctxRole
+
+	// RoleContextKey{} is set on the context only when there is a valid signature, so we can rely on this.
+	result.HasValidSignature = ctxRoleExists
+
+	if opts.ValidSignature && !result.HasValidSignature {
+		return CheckResult{}, fmt.Errorf("%w: missing valid signature", ErrUnauthenticated)
+	}
+
+	if opts.Role != role.None {
+		err := ctxRole.Check(opts.Role)
+		if err != nil {
+			return CheckResult{}, fmt.Errorf("%w: %v", ErrUnauthorized, err) //nolint:errorlint
+		}
+	}
+
+	if identity, ok := ctx.Value(IdentityContextKey{}).(string); ok {
+		result.Identity = identity
+	}
+
+	if userID, ok := ctx.Value(UserIDContextKey{}).(string); ok {
+		result.UserID = userID
+	}
+
+	return result, nil
+}
+
+// CheckGRPC wraps Check function returning gRPC error codes.
+func CheckGRPC(ctx context.Context, opt ...CheckOption) (CheckResult, error) {
+	result, err := Check(ctx, opt...)
+	if err != nil {
+		if errors.Is(err, ErrUnauthenticated) {
+			return CheckResult{}, status.Errorf(codes.Unauthenticated, "%s", err)
+		}
+
+		if errors.Is(err, ErrUnauthorized) {
+			return CheckResult{}, status.Errorf(codes.PermissionDenied, "%s", err)
+		}
+
+		return CheckResult{}, err
+	}
+
+	return result, nil
+}
diff --git a/internal/pkg/auth/check_test.go b/internal/pkg/auth/check_test.go
new file mode 100644
index 000000000..4ab4d0471
--- /dev/null
+++ b/internal/pkg/auth/check_test.go
@@ -0,0 +1,205 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package auth_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+)
+
+func TestCheck(t *testing.T) {
+	for _, tt := range []struct { //nolint:govet
+		name    string
+		ctx     context.Context //nolint:containedctx
+		opts    []auth.CheckOption
+		want    auth.CheckResult
+		errorIs error
+	}{
+		{
+			name:    "empty context",
+			ctx:     context.Background(),
+			errorIs: auth.ErrUnauthenticated,
+		},
+		{
+			name: "auth disabled",
+			ctx: context.WithValue(
+				context.Background(),
+				auth.EnabledAuthContextKey{},
+				false,
+			),
+		},
+		{
+			name: "not authenticated, no requirements",
+			ctx: context.WithValue(
+				context.Background(),
+				auth.EnabledAuthContextKey{},
+				true,
+			),
+			want: auth.CheckResult{
+				AuthEnabled: true,
+				Role:        role.None,
+			},
+		},
+		{
+			name: "not authenticated, verified email",
+			ctx: context.WithValue(
+				context.Background(),
+				auth.EnabledAuthContextKey{},
+				true,
+			),
+			opts:    []auth.CheckOption{auth.WithVerifiedEmail()},
+			errorIs: auth.ErrUnauthenticated,
+		},
+		{
+			name: "not authenticated, none role",
+			ctx: context.WithValue(
+				context.Background(),
+				auth.EnabledAuthContextKey{},
+				true,
+			),
+			opts:    []auth.CheckOption{auth.WithValidSignature(true)},
+			errorIs: auth.ErrUnauthenticated,
+		},
+		{
+			name: "not authenticated, operator role",
+			ctx: context.WithValue(
+				context.Background(),
+				auth.EnabledAuthContextKey{},
+				true,
+			),
+			opts:    []auth.CheckOption{auth.WithRole(role.Operator)},
+			errorIs: auth.ErrUnauthenticated,
+		},
+		{
+			name: "verified email",
+			ctx: context.WithValue(
+				context.WithValue(
+					context.Background(),
+					auth.EnabledAuthContextKey{},
+					true,
+				),
+				auth.VerifiedEmailContextKey{},
+				"user@example.com",
+			),
+			opts: []auth.CheckOption{auth.WithVerifiedEmail()},
+			want: auth.CheckResult{
+				AuthEnabled:   true,
+				VerifiedEmail: "user@example.com",
+				Role:          role.None,
+			},
+		},
+		{
+			name: "role okay",
+			ctx: context.WithValue(
+				context.WithValue(
+					context.Background(),
+					auth.EnabledAuthContextKey{},
+					true,
+				),
+				auth.RoleContextKey{},
+				role.Operator,
+			),
+			opts: []auth.CheckOption{auth.WithRole(role.Operator)},
+			want: auth.CheckResult{
+				AuthEnabled:       true,
+				HasValidSignature: true,
+				Role:              role.Operator,
+			},
+		},
+		{
+			name: "role mismatch",
+			ctx: context.WithValue(
+				context.WithValue(
+					context.Background(),
+					auth.EnabledAuthContextKey{},
+					true,
+				),
+				auth.RoleContextKey{},
+				role.Operator,
+			),
+			opts:    []auth.CheckOption{auth.WithRole(role.Admin)},
+			errorIs: auth.ErrUnauthorized,
+		},
+		{
+			name: "role and verified email",
+			ctx: context.WithValue(
+				context.WithValue(
+					context.WithValue(
+						context.WithValue(
+							context.Background(),
+							auth.EnabledAuthContextKey{},
+							true,
+						),
+						auth.RoleContextKey{},
+						role.Operator,
+					),
+					auth.VerifiedEmailContextKey{},
+					"user@example.com",
+				),
+				auth.IdentityContextKey{},
+				"user2@example.com",
+			),
+			opts: []auth.CheckOption{auth.WithRole(role.Operator), auth.WithVerifiedEmail()},
+			want: auth.CheckResult{
+				AuthEnabled:       true,
+				HasValidSignature: true,
+				Role:              role.Operator,
+				Identity:          "user2@example.com",
+				VerifiedEmail:     "user@example.com",
+			},
+		},
+		{
+			name: "valid signature",
+			ctx: context.WithValue(
+				context.WithValue(
+					context.Background(),
+					auth.EnabledAuthContextKey{},
+					true,
+				),
+				auth.RoleContextKey{},
+				role.None,
+			),
+			opts: []auth.CheckOption{},
+			want: auth.CheckResult{
+				AuthEnabled:       true,
+				HasValidSignature: true,
+				Role:              role.None,
+			},
+		},
+		{
+			name: "missing signature",
+			ctx: context.WithValue(
+				context.WithValue(
+					context.Background(),
+					auth.EnabledAuthContextKey{},
+					true,
+				),
+				auth.VerifiedEmailContextKey{},
+				"me@example.com",
+			),
+			opts:    []auth.CheckOption{auth.WithValidSignature(true)},
+			errorIs: auth.ErrUnauthenticated,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			result, err := auth.Check(tt.ctx, tt.opts...)
+
+			if tt.errorIs != nil {
+				assert.ErrorIs(t, err, tt.errorIs)
+
+				return
+			}
+
+			assert.NoError(t, err)
+			assert.Equal(t, tt.want, result)
+		})
+	}
+}
diff --git a/internal/pkg/auth/config.go b/internal/pkg/auth/config.go
new file mode 100644
index 000000000..fc2961fd1
--- /dev/null
+++ b/internal/pkg/auth/config.go
@@ -0,0 +1,133 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package auth
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+// EnsureAuthConfigResource creates/configures the auth config resource.
+func EnsureAuthConfigResource(ctx context.Context, st state.State, logger *zap.Logger, authParams config.AuthParams) (*auth.Config, error) {
+	err := validateParams(authParams)
+	if err != nil {
+		return nil, err
+	}
+
+	confPtr := auth.NewAuthConfig().Metadata()
+
+	setConfig := func(res *auth.Config) {
+		if res.TypedSpec().Value.Auth0 == nil {
+			res.TypedSpec().Value.Auth0 = &specs.AuthConfigSpec_Auth0{}
+		}
+
+		if res.TypedSpec().Value.Saml == nil {
+			res.TypedSpec().Value.Saml = &specs.AuthConfigSpec_SAML{}
+		}
+
+		if res.TypedSpec().Value.Webauthn == nil {
+			res.TypedSpec().Value.Webauthn = &specs.AuthConfigSpec_Webauthn{}
+		}
+
+		res.TypedSpec().Value.Auth0.Enabled = authParams.Auth0.Enabled
+		res.TypedSpec().Value.Auth0.Domain = authParams.Auth0.Domain
+		res.TypedSpec().Value.Auth0.ClientId = authParams.Auth0.ClientID
+		res.TypedSpec().Value.Saml.Enabled = authParams.SAML.Enabled
+		res.TypedSpec().Value.Saml.Url = authParams.SAML.URL
+		res.TypedSpec().Value.Saml.Metadata = authParams.SAML.Metadata
+		res.TypedSpec().Value.Saml.LabelRules = authParams.SAML.LabelRules
+
+		if res.TypedSpec().Value.Webauthn.Enabled && !authParams.WebAuthn.Enabled {
+			logger.Warn("webauthn is disabled in Config, but enabled in the cluster, refusing to disable it",
+				zap.String("resource", confPtr.ID()),
+			)
+		} else {
+			res.TypedSpec().Value.Webauthn.Enabled = authParams.WebAuthn.Enabled
+			res.TypedSpec().Value.Webauthn.Required = authParams.WebAuthn.Required
+		}
+
+		res.TypedSpec().Value.Suspended = authParams.Suspended
+	}
+
+	_, err = safe.StateGet[*auth.Config](ctx, st, confPtr)
+	if state.IsNotFoundError(err) {
+		authConfig := auth.NewAuthConfig()
+		setConfig(authConfig)
+
+		err = st.Create(ctx, authConfig)
+		if err != nil {
+			return nil, fmt.Errorf("failed to create Config resource: %w", err)
+		}
+
+		logger.Info("created Config resource",
+			zap.String("resource", confPtr.ID()),
+			zap.Any("auth0", authParams.Auth0),
+			zap.Any("webauthn", authParams.WebAuthn),
+			zap.Any("saml", authParams.SAML),
+		)
+
+		return authConfig, nil
+	}
+
+	if err != nil {
+		return nil, fmt.Errorf("failed to get Config resource: %w", err)
+	}
+
+	authConfig, err := safe.StateUpdateWithConflicts(ctx, st, confPtr, func(res *auth.Config) error {
+		setConfig(res)
+
+		logger.Info("updated Config resource",
+			zap.String("resource", confPtr.ID()),
+			zap.Any("auth0", authParams.Auth0),
+			zap.Any("webauthn", authParams.WebAuthn),
+			zap.Any("saml", authParams.SAML),
+		)
+
+		return nil
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to update Config resource: %w", err)
+	}
+
+	return authConfig, nil
+}
+
+func validateParams(authParams config.AuthParams) error {
+	if !authParams.SAML.Enabled && !authParams.Auth0.Enabled && !authParams.WebAuthn.Enabled {
+		return errors.New("no authentication is enabled")
+	}
+
+	if authParams.SAML.Enabled && authParams.Auth0.Enabled {
+		return errors.New("both auth0 and SAML auth are enabled, only one can be enabled at the same time")
+	}
+
+	if authParams.SAML.Enabled && authParams.SAML.URL == "" && authParams.SAML.Metadata == "" {
+		return errors.New("SAML is enabled but neither URL nor metadata is set")
+	}
+
+	if !authParams.Auth0.Enabled {
+		return nil
+	}
+
+	if authParams.Auth0.Domain == "" {
+		return errors.New("auth0 is enabled but its domain is not set")
+	}
+
+	if authParams.Auth0.ClientID == "" {
+		return errors.New("auth0 is enabled but its client id is not set")
+	}
+
+	return nil
+}
diff --git a/internal/pkg/auth/config_test.go b/internal/pkg/auth/config_test.go
new file mode 100644
index 000000000..909aaeb79
--- /dev/null
+++ b/internal/pkg/auth/config_test.go
@@ -0,0 +1,194 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package auth_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap/zaptest"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/internal/backend/logging"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+func TestEnsureAuthConfigResource(t *testing.T) {
+	t.Parallel()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	logger := zaptest.NewLogger(t).With(logging.Component("auth"))
+
+	for _, tt := range []struct { //nolint:govet
+		name              string
+		initialConfig     config.AuthParams
+		updatedConfig     *config.AuthParams
+		expected          *specs.AuthConfigSpec
+		expectInitError   bool
+		expectUpdateError bool
+	}{
+		{
+			name:            "empty",
+			expectInitError: true,
+		},
+		{
+			name: "enable auth0",
+			initialConfig: config.AuthParams{
+				Auth0: config.Auth0Params{
+					Enabled:  true,
+					ClientID: "client-id",
+					Domain:   "domain",
+				},
+			},
+			expected: &specs.AuthConfigSpec{
+				Auth0: &specs.AuthConfigSpec_Auth0{
+					Enabled:  true,
+					ClientId: "client-id",
+					Domain:   "domain",
+				},
+				Webauthn: &specs.AuthConfigSpec_Webauthn{},
+				Saml:     &specs.AuthConfigSpec_SAML{},
+			},
+		},
+		{
+			name: "enable webauthn",
+			initialConfig: config.AuthParams{
+				WebAuthn: config.WebAuthnParams{
+					Enabled: true,
+				},
+			},
+			expected: &specs.AuthConfigSpec{
+				Webauthn: &specs.AuthConfigSpec_Webauthn{
+					Enabled: true,
+				},
+				Auth0: &specs.AuthConfigSpec_Auth0{},
+				Saml:  &specs.AuthConfigSpec_SAML{},
+			},
+		},
+		{
+			name: "make webauthn not required",
+			initialConfig: config.AuthParams{
+				WebAuthn: config.WebAuthnParams{
+					Enabled:  true,
+					Required: true,
+				},
+			},
+			updatedConfig: &config.AuthParams{
+				WebAuthn: config.WebAuthnParams{
+					Enabled:  true,
+					Required: false,
+				},
+			},
+			expected: &specs.AuthConfigSpec{
+				Webauthn: &specs.AuthConfigSpec_Webauthn{
+					Enabled: true,
+				},
+				Auth0: &specs.AuthConfigSpec_Auth0{},
+				Saml:  &specs.AuthConfigSpec_SAML{},
+			},
+		},
+		{
+			name: "fail to disable webauthn",
+			initialConfig: config.AuthParams{
+				WebAuthn: config.WebAuthnParams{
+					Enabled:  true,
+					Required: true,
+				},
+			},
+			updatedConfig: &config.AuthParams{
+				WebAuthn: config.WebAuthnParams{
+					Enabled: false,
+				},
+			},
+			expectUpdateError: true,
+		},
+		{
+			name: "fail to disable auth0",
+			initialConfig: config.AuthParams{
+				Auth0: config.Auth0Params{
+					Enabled:  true,
+					ClientID: "client-id",
+					Domain:   "domain",
+				},
+			},
+			updatedConfig:     &config.AuthParams{},
+			expectUpdateError: true,
+		},
+		{
+			name: "switch from auth0 to SAML",
+			initialConfig: config.AuthParams{
+				Auth0: config.Auth0Params{
+					Enabled:  true,
+					ClientID: "client-id",
+					Domain:   "domain",
+				},
+			},
+			updatedConfig: &config.AuthParams{
+				SAML: config.SAMLParams{
+					Enabled: true,
+					URL:     "http://samltest.sp/idp",
+				},
+			},
+			expected: &specs.AuthConfigSpec{
+				Auth0:    &specs.AuthConfigSpec_Auth0{},
+				Webauthn: &specs.AuthConfigSpec_Webauthn{},
+				Saml: &specs.AuthConfigSpec_SAML{
+					Enabled: true,
+					Url:     "http://samltest.sp/idp",
+				},
+			},
+		},
+		{
+			name: "fail to disable SAML",
+			initialConfig: config.AuthParams{
+				SAML: config.SAMLParams{
+					Enabled: true,
+					URL:     "http://samltest.sp/idp",
+				},
+			},
+			updatedConfig:     &config.AuthParams{},
+			expectUpdateError: true,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+			authConfig, err := auth.EnsureAuthConfigResource(ctx, st, logger, tt.initialConfig)
+			if tt.expectInitError {
+				require.Error(t, err)
+
+				return
+			}
+
+			require.NoError(t, err)
+
+			if tt.updatedConfig != nil {
+				authConfig, err = auth.EnsureAuthConfigResource(ctx, st, logger, *tt.updatedConfig)
+
+				if tt.expectUpdateError {
+					require.Error(t, err)
+
+					return
+				}
+
+				require.NoError(t, err)
+			}
+
+			assert.True(t, proto.Equal(authConfig.TypedSpec().Value, tt.expected), "expected %v, got %v", tt.expected, authConfig.TypedSpec().Value)
+		})
+	}
+}
diff --git a/internal/pkg/auth/constants.go b/internal/pkg/auth/constants.go
new file mode 100644
index 000000000..de537aa1f
--- /dev/null
+++ b/internal/pkg/auth/constants.go
@@ -0,0 +1,35 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package auth
+
+import "github.com/siderolabs/go-api-signature/pkg/message"
+
+// These constants here are declared only for tsgen.
+//
+//nolint:deadcode,unused,varcheck
+const (
+	// tsgen:SignatureHeaderKey
+	signatureHeaderKey = message.SignatureHeaderKey
+
+	// tsgen:TimestampHeaderKey
+	timestampHeaderKey = message.TimestampHeaderKey
+
+	// tsgen:PayloadHeaderKey
+	payloadHeaderKey = message.PayloadHeaderKey
+
+	// AuthorizationHeader metadata key.
+	// tsgen:authHeader
+	authorizationHeaderKey = message.AuthorizationHeaderKey
+
+	// tsgen:authBearerHeaderPrefix
+	bearerPrefix = message.BearerPrefix
+
+	// tsgen:SignatureVersionV1
+	SignatureVersionV1 message.SignatureVersion = message.SignatureVersionV1
+
+	// tsgen:samlSessionHeader
+	SamlSessionHeaderKey = "saml-session"
+)
diff --git a/internal/pkg/auth/context.go b/internal/pkg/auth/context.go
new file mode 100644
index 000000000..42eb34854
--- /dev/null
+++ b/internal/pkg/auth/context.go
@@ -0,0 +1,24 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package auth
+
+// EnabledAuthContextKey is the context key for enabled authentication. Value has the type bool.
+type EnabledAuthContextKey struct{}
+
+// GRPCMessageContextKey is the context key for the GRPC message. It is only set if authentication is enabled.
+type GRPCMessageContextKey struct{}
+
+// VerifiedEmailContextKey is the context key for the verified email address. Value has the type string.
+type VerifiedEmailContextKey struct{}
+
+// UserIDContextKey is the context key for the user ID. Value has the type string.
+type UserIDContextKey struct{}
+
+// RoleContextKey is the context key for the role. Value has the type role.Role.
+type RoleContextKey struct{}
+
+// IdentityContextKey is the context key for the user identity. Value has the type string.
+type IdentityContextKey struct{}
diff --git a/internal/pkg/auth/handler/auth_config.go b/internal/pkg/auth/handler/auth_config.go
new file mode 100644
index 000000000..0969ef44d
--- /dev/null
+++ b/internal/pkg/auth/handler/auth_config.go
@@ -0,0 +1,38 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package handler
+
+import (
+	"context"
+	"net/http"
+
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/internal/pkg/auth"
+)
+
+// AuthConfig represents the configuration for the auth config interceptor.
+type AuthConfig struct {
+	next    http.Handler
+	logger  *zap.Logger
+	enabled bool
+}
+
+// NewAuthConfig returns a new auth config interceptor.
+func NewAuthConfig(handler http.Handler, enabled bool, logger *zap.Logger) *AuthConfig {
+	return &AuthConfig{
+		next:    handler,
+		enabled: enabled,
+		logger:  logger,
+	}
+}
+
+func (c *AuthConfig) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
+	ctx := context.WithValue(request.Context(), auth.EnabledAuthContextKey{}, c.enabled)
+	request = request.WithContext(ctx)
+
+	c.next.ServeHTTP(writer, request)
+}
diff --git a/internal/pkg/auth/handler/handler.go b/internal/pkg/auth/handler/handler.go
new file mode 100644
index 000000000..01d3c39bc
--- /dev/null
+++ b/internal/pkg/auth/handler/handler.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package handler contains HTTP server interceptors related to authentication and authorization.
+package handler
diff --git a/internal/pkg/auth/handler/handler_test.go b/internal/pkg/auth/handler/handler_test.go
new file mode 100644
index 000000000..6a308d84a
--- /dev/null
+++ b/internal/pkg/auth/handler/handler_test.go
@@ -0,0 +1,163 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package handler_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/siderolabs/go-api-signature/pkg/message"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/handler"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+)
+
+func testHandler(t *testing.T, authEnabled bool) {
+	ctxCh := make(chan context.Context, 1)
+
+	coreHandler := http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
+		ctxCh <- r.Context()
+	})
+
+	logger := zaptest.NewLogger(t)
+
+	authenticatorFunc := func(context.Context, string) (*auth.Authenticator, error) {
+		return &auth.Authenticator{
+			Verifier: mockSignerVerifier{},
+			Identity: "user@example.com",
+			UserID:   "user-id",
+			Role:     role.Operator,
+		}, nil
+	}
+
+	wrapWithAuth := func(h http.Handler) http.Handler {
+		return handler.NewAuthConfig(handler.NewSignature(h, authenticatorFunc, logger), authEnabled, logger)
+	}
+
+	ts := httptest.NewServer(wrapWithAuth(coreHandler))
+	defer ts.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+
+	type testCase struct { //nolint:govet
+		name string
+		uri  string
+
+		signRequest     bool
+		appendSignature []byte
+		verifyContext   bool
+
+		expectedCode int
+	}
+
+	var testCases []testCase
+
+	if authEnabled {
+		testCases = []testCase{
+			{
+				name:         "no signature",
+				expectedCode: http.StatusOK,
+				uri:          "/ok",
+			},
+			{
+				name:         "correct signature",
+				expectedCode: http.StatusOK,
+
+				signRequest:   true,
+				verifyContext: true,
+
+				uri: "/ok",
+			},
+			{
+				name:         "broken signature",
+				expectedCode: http.StatusUnauthorized,
+
+				signRequest:     true,
+				appendSignature: []byte("broken"),
+
+				uri: "/fail",
+			},
+		}
+	} else {
+		testCases = []testCase{
+			{
+				name:         "no signature",
+				expectedCode: http.StatusOK,
+				uri:          "/",
+			},
+		}
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			req, err := http.NewRequestWithContext(ctx, http.MethodGet, ts.URL+tc.uri, nil)
+			require.NoError(t, err)
+
+			if tc.signRequest {
+				var msg *message.HTTP
+
+				msg, err = message.NewHTTP(req)
+				require.NoError(t, err)
+
+				require.NoError(t, msg.Sign("foo@example.com", mockSignerVerifier{tc.appendSignature}))
+			}
+
+			resp, err := http.DefaultClient.Do(req) //nolint:bodyclose
+			require.NoError(t, err)
+
+			require.Equal(t, tc.expectedCode, resp.StatusCode)
+
+			if tc.expectedCode != http.StatusOK {
+				return
+			}
+
+			var reqCtx context.Context
+
+			select {
+			case reqCtx = <-ctxCh:
+			case <-time.After(time.Second):
+				t.Fatal("timeout")
+			}
+
+			ctxAuthEnabled, ok := reqCtx.Value(auth.EnabledAuthContextKey{}).(bool)
+			require.True(t, ok)
+			assert.Equal(t, authEnabled, ctxAuthEnabled)
+
+			if !tc.verifyContext {
+				return
+			}
+
+			ctxUserID, ok := reqCtx.Value(auth.UserIDContextKey{}).(string)
+			require.True(t, ok)
+			assert.Equal(t, "user-id", ctxUserID)
+
+			ctxRole, ok := reqCtx.Value(auth.RoleContextKey{}).(role.Role)
+			require.True(t, ok)
+			assert.Equal(t, role.Operator, ctxRole)
+
+			ctxIdentity, ok := reqCtx.Value(auth.IdentityContextKey{}).(string)
+			require.True(t, ok)
+			assert.Equal(t, "user@example.com", ctxIdentity)
+		})
+	}
+}
+
+func TestHandler(t *testing.T) {
+	t.Run("AuthEnabled", func(t *testing.T) {
+		testHandler(t, true)
+	})
+	t.Run("AuthDisabled", func(t *testing.T) {
+		testHandler(t, false)
+	})
+}
diff --git a/internal/pkg/auth/handler/mock_test.go b/internal/pkg/auth/handler/mock_test.go
new file mode 100644
index 000000000..a3e286459
--- /dev/null
+++ b/internal/pkg/auth/handler/mock_test.go
@@ -0,0 +1,37 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package handler_test
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+)
+
+type mockSignerVerifier struct {
+	appendSignature []byte
+}
+
+func (mock mockSignerVerifier) Fingerprint() string {
+	return "mock-fingerprint"
+}
+
+func (mock mockSignerVerifier) Sign(data []byte) ([]byte, error) {
+	hash := sha256.Sum256(data)
+
+	return []byte(hex.EncodeToString(append(hash[:], mock.appendSignature...))), nil
+}
+
+func (mock mockSignerVerifier) Verify(data, signature []byte) error {
+	expected, _ := mock.Sign(data) //nolint:errcheck
+
+	if !bytes.Equal(signature, expected) {
+		return errors.New("invalid signature")
+	}
+
+	return nil
+}
diff --git a/internal/pkg/auth/handler/signature.go b/internal/pkg/auth/handler/signature.go
new file mode 100644
index 000000000..2850a5abe
--- /dev/null
+++ b/internal/pkg/auth/handler/signature.go
@@ -0,0 +1,110 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package handler
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	grpc_ctxtags "github.com/grpc-ecosystem/go-grpc-middleware/tags"
+	"github.com/siderolabs/go-api-signature/pkg/message"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/internal/pkg/auth"
+)
+
+var errInvalidSignature = errors.New("invalid signature")
+
+// Signature represents a signature handler.
+type Signature struct {
+	authenticatorFunc auth.AuthenticatorFunc
+	next              http.Handler
+	logger            *zap.Logger
+}
+
+// NewSignature returns a new signature handler.
+func NewSignature(handler http.Handler, authenticatorFunc auth.AuthenticatorFunc, logger *zap.Logger) *Signature {
+	return &Signature{
+		next:              handler,
+		authenticatorFunc: authenticatorFunc,
+		logger:            logger,
+	}
+}
+
+// ServeHTTP implements the http.Handler interface.
+func (s *Signature) ServeHTTP(writer http.ResponseWriter, request *http.Request) {
+	req, err := s.intercept(request)
+	if errors.Is(err, errInvalidSignature) {
+		writer.WriteHeader(http.StatusUnauthorized)
+
+		return
+	}
+
+	if err != nil {
+		s.logger.Error("failed to intercept request", zap.Error(err))
+
+		writer.WriteHeader(http.StatusInternalServerError)
+
+		return
+	}
+
+	s.next.ServeHTTP(writer, req)
+}
+
+func (s *Signature) intercept(request *http.Request) (*http.Request, error) {
+	msg, err := message.NewHTTP(request)
+	if err != nil {
+		return nil, err
+	}
+
+	signature, err := msg.Signature()
+	if errors.Is(err, message.ErrNotFound) { // missing signature, pass it through
+		return request, nil
+	}
+
+	if err != nil {
+		s.logger.Warn("failed to get signature", zap.Error(err))
+
+		return nil, errInvalidSignature
+	}
+
+	ctx := request.Context()
+
+	// set the initial identity based on the signature header, it can't be trusted yet, but it gives
+	// a better context if the auth fails
+	grpc_ctxtags.Extract(ctx).
+		Set("authenticator.identity", signature.Identity)
+
+	authenticator, err := s.authenticatorFunc(request.Context(), signature.KeyFingerprint)
+	if err != nil {
+		if errors.Is(err, context.Canceled) && ctx.Err() != nil {
+			return nil, context.Canceled
+		}
+
+		s.logger.Warn("failed to get authenticator", zap.Error(err))
+
+		return nil, errInvalidSignature
+	}
+
+	err = msg.VerifySignature(authenticator.Verifier)
+	if err != nil {
+		s.logger.Info("failed to verify message", zap.Error(err))
+
+		return nil, errInvalidSignature
+	}
+
+	grpc_ctxtags.Extract(ctx).
+		Set("authenticator.user_id", authenticator.UserID).
+		Set("authenticator.identity", authenticator.Identity).
+		Set("authenticator.role", string(authenticator.Role))
+
+	ctx = context.WithValue(ctx, auth.IdentityContextKey{}, authenticator.Identity)
+	ctx = context.WithValue(ctx, auth.UserIDContextKey{}, authenticator.UserID)
+	ctx = context.WithValue(ctx, auth.RoleContextKey{}, authenticator.Role)
+
+	return request.WithContext(ctx), nil
+}
diff --git a/internal/pkg/auth/interceptor/auth_config.go b/internal/pkg/auth/interceptor/auth_config.go
new file mode 100644
index 000000000..6ef62bb20
--- /dev/null
+++ b/internal/pkg/auth/interceptor/auth_config.go
@@ -0,0 +1,70 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package interceptor
+
+import (
+	"context"
+
+	grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
+	"github.com/siderolabs/go-api-signature/pkg/message"
+	"go.uber.org/zap"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+
+	"github.com/siderolabs/omni/internal/pkg/auth"
+)
+
+// AuthConfig represents the configuration for the auth config interceptor.
+type AuthConfig struct {
+	logger  *zap.Logger
+	enabled bool
+}
+
+// NewAuthConfig returns a new auth config interceptor.
+func NewAuthConfig(enabled bool, logger *zap.Logger) *AuthConfig {
+	return &AuthConfig{
+		enabled: enabled,
+		logger:  logger,
+	}
+}
+
+// Unary returns a new unary GRPC interceptor.
+func (c *AuthConfig) Unary() grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+		ctx = c.intercept(ctx, info.FullMethod)
+
+		return handler(ctx, req)
+	}
+}
+
+// Stream returns a new streaming GRPC interceptor.
+func (c *AuthConfig) Stream() grpc.StreamServerInterceptor {
+	return func(srv any, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		ctx := c.intercept(ss.Context(), info.FullMethod)
+
+		return handler(srv, &grpc_middleware.WrappedServerStream{
+			ServerStream:   ss,
+			WrappedContext: ctx,
+		})
+	}
+}
+
+func (c *AuthConfig) intercept(ctx context.Context, method string) context.Context {
+	ctx = context.WithValue(ctx, auth.EnabledAuthContextKey{}, c.enabled)
+
+	if !c.enabled {
+		return ctx
+	}
+
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		md = metadata.New(nil)
+	}
+
+	msg := message.NewGRPC(md, method)
+
+	return context.WithValue(ctx, auth.GRPCMessageContextKey{}, msg)
+}
diff --git a/internal/pkg/auth/interceptor/interceptor.go b/internal/pkg/auth/interceptor/interceptor.go
new file mode 100644
index 000000000..523874960
--- /dev/null
+++ b/internal/pkg/auth/interceptor/interceptor.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package interceptor contains gRPC server interceptors related to authentication and authorization.
+package interceptor
diff --git a/internal/pkg/auth/interceptor/jwt.go b/internal/pkg/auth/interceptor/jwt.go
new file mode 100644
index 000000000..0b5504e94
--- /dev/null
+++ b/internal/pkg/auth/interceptor/jwt.go
@@ -0,0 +1,86 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package interceptor
+
+import (
+	"context"
+	"errors"
+
+	grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
+	"github.com/siderolabs/go-api-signature/pkg/jwt"
+	"github.com/siderolabs/go-api-signature/pkg/message"
+	"go.uber.org/zap"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/internal/pkg/auth"
+)
+
+var errGRPCInvalidJWT = status.Error(codes.Unauthenticated, "invalid jwt")
+
+// JWT is a GRPC interceptor that verifies JWT tokens.
+type JWT struct {
+	jwtVerifier jwt.Verifier
+	logger      *zap.Logger
+}
+
+// NewJWT returns a new JWT interceptor.
+func NewJWT(jwtVerifier jwt.Verifier, logger *zap.Logger) *JWT {
+	return &JWT{
+		jwtVerifier: jwtVerifier,
+		logger:      logger,
+	}
+}
+
+// Unary returns a new unary JWT interceptor.
+func (i *JWT) Unary() grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req any, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+		ctx, err := i.intercept(ctx)
+		if err != nil {
+			return nil, err
+		}
+
+		return handler(ctx, req)
+	}
+}
+
+// Stream returns a new stream JWT interceptor.
+func (i *JWT) Stream() grpc.StreamServerInterceptor {
+	return func(srv any, ss grpc.ServerStream, _ *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		ctx, err := i.intercept(ss.Context())
+		if err != nil {
+			return err
+		}
+
+		return handler(srv, &grpc_middleware.WrappedServerStream{
+			ServerStream:   ss,
+			WrappedContext: ctx,
+		})
+	}
+}
+
+func (i *JWT) intercept(ctx context.Context) (context.Context, error) {
+	msg, ok := ctx.Value(auth.GRPCMessageContextKey{}).(*message.GRPC)
+	if !ok {
+		return nil, status.Error(codes.Internal, "missing or invalid message in context")
+	}
+
+	claims, err := msg.VerifyJWT(ctx, i.jwtVerifier)
+	if errors.Is(err, message.ErrNotFound) { // missing jwt, pass it through
+		return ctx, nil
+	}
+
+	if err != nil {
+		i.logger.Info("invalid jwt", zap.Error(err))
+
+		return nil, errGRPCInvalidJWT
+	}
+
+	ctx = context.WithValue(ctx, auth.VerifiedEmailContextKey{}, claims.VerifiedEmail)
+
+	return ctx, nil
+}
diff --git a/internal/pkg/auth/interceptor/saml.go b/internal/pkg/auth/interceptor/saml.go
new file mode 100644
index 000000000..485cc89b7
--- /dev/null
+++ b/internal/pkg/auth/interceptor/saml.go
@@ -0,0 +1,130 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package interceptor
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/crewjam/saml"
+	grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
+	"github.com/siderolabs/go-api-signature/pkg/message"
+	"go.uber.org/zap"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	authres "github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+)
+
+var errGRPCInvalidSAML = status.Error(codes.Unauthenticated, "invalid session")
+
+// SAML is a GRPC interceptor that verifies SAML session.
+type SAML struct {
+	state  state.State
+	logger *zap.Logger
+}
+
+// NewSAML returns a new SAML interceptor.
+func NewSAML(state state.State, logger *zap.Logger) *SAML {
+	return &SAML{
+		state:  state,
+		logger: logger,
+	}
+}
+
+// Unary returns a new unary SAML interceptor.
+func (i *SAML) Unary() grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req any, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+		ctx, err := i.intercept(ctx)
+		if err != nil {
+			return nil, err
+		}
+
+		return handler(ctx, req)
+	}
+}
+
+// Stream returns a new stream SAML interceptor.
+func (i *SAML) Stream() grpc.StreamServerInterceptor {
+	return func(srv any, ss grpc.ServerStream, _ *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		ctx, err := i.intercept(ss.Context())
+		if err != nil {
+			return err
+		}
+
+		return handler(srv, &grpc_middleware.WrappedServerStream{
+			ServerStream:   ss,
+			WrappedContext: ctx,
+		})
+	}
+}
+
+func (i *SAML) intercept(ctx context.Context) (context.Context, error) {
+	msg, ok := ctx.Value(auth.GRPCMessageContextKey{}).(*message.GRPC)
+	if !ok {
+		return nil, status.Error(codes.Internal, "missing or invalid message in context")
+	}
+
+	values := msg.Metadata.Get(auth.SamlSessionHeaderKey)
+	if len(values) == 0 {
+		return ctx, nil
+	}
+
+	session, err := i.getSession(ctx, values[0])
+	if err != nil {
+		return nil, errGRPCInvalidSAML
+	}
+
+	ctx = context.WithValue(ctx, auth.VerifiedEmailContextKey{}, session.TypedSpec().Value.Email)
+
+	return ctx, nil
+}
+
+func (i *SAML) getSession(ctx context.Context, sessionID string) (*authres.SAMLAssertion, error) {
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	acs, err := safe.StateGet[*authres.SAMLAssertion](ctx, i.state, authres.NewSAMLAssertion(resources.DefaultNamespace, sessionID).Metadata())
+	if err != nil {
+		i.logger.Info("invalid session", zap.Error(err))
+
+		return nil, errGRPCInvalidSAML
+	}
+
+	var assertion saml.Assertion
+
+	err = json.Unmarshal(acs.TypedSpec().Value.Data, &assertion)
+	if err != nil {
+		return nil, err
+	}
+
+	if acs.TypedSpec().Value.Used {
+		i.logger.Info("invalid session", zap.Error(errors.New("session was already used")))
+
+		return nil, errGRPCInvalidSAML
+	}
+
+	if assertion.IssueInstant.Add(saml.MaxIssueDelay).Before(time.Now().UTC()) {
+		i.logger.Info("invalid session", zap.Error(errors.New("SAML assertion expired")))
+
+		return nil, errGRPCInvalidSAML
+	}
+
+	_, err = safe.StateUpdateWithConflicts(ctx, i.state, acs.Metadata(), func(r *authres.SAMLAssertion) error {
+		r.TypedSpec().Value.Used = true
+
+		return nil
+	})
+
+	return acs, err
+}
diff --git a/internal/pkg/auth/interceptor/signature.go b/internal/pkg/auth/interceptor/signature.go
new file mode 100644
index 000000000..2872d4727
--- /dev/null
+++ b/internal/pkg/auth/interceptor/signature.go
@@ -0,0 +1,120 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package interceptor
+
+import (
+	"context"
+	"errors"
+
+	grpc_middleware "github.com/grpc-ecosystem/go-grpc-middleware"
+	grpc_ctxtags "github.com/grpc-ecosystem/go-grpc-middleware/tags"
+	"github.com/siderolabs/go-api-signature/pkg/message"
+	"go.uber.org/zap"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/internal/pkg/auth"
+)
+
+var errGRPCInvalidSignature = status.Error(codes.Unauthenticated, "invalid signature")
+
+// Signature represents a signature interceptor.
+type Signature struct {
+	authenticatorFunc auth.AuthenticatorFunc
+	logger            *zap.Logger
+}
+
+// NewSignature returns a new signature interceptor.
+func NewSignature(authenticatorFunc auth.AuthenticatorFunc, logger *zap.Logger) *Signature {
+	return &Signature{
+		authenticatorFunc: authenticatorFunc,
+		logger:            logger,
+	}
+}
+
+// Unary returns a new unary signature interceptor.
+func (i *Signature) Unary() grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req any, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+		ctx, err := i.intercept(ctx)
+		if err != nil {
+			return nil, err
+		}
+
+		return handler(ctx, req)
+	}
+}
+
+// Stream returns a new stream signature interceptor.
+func (i *Signature) Stream() grpc.StreamServerInterceptor {
+	return func(srv any, ss grpc.ServerStream, _ *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		ctx, err := i.intercept(ss.Context())
+		if err != nil {
+			return err
+		}
+
+		return handler(srv, &grpc_middleware.WrappedServerStream{
+			ServerStream:   ss,
+			WrappedContext: ctx,
+		})
+	}
+}
+
+func (i *Signature) intercept(ctx context.Context) (context.Context, error) {
+	msg, ok := ctx.Value(auth.GRPCMessageContextKey{}).(*message.GRPC)
+	if !ok {
+		return nil, status.Error(codes.Internal, "missing or invalid message in context")
+	}
+
+	signature, err := msg.Signature()
+	if errors.Is(err, message.ErrNotFound) { // missing signature, pass it through
+		grpc_ctxtags.Extract(ctx).
+			Set("authenticator.user_id", "").
+			Set("authenticator.identity", "")
+
+		return ctx, nil
+	}
+
+	if err != nil {
+		i.logger.Warn("failed to get signature", zap.Error(err))
+
+		return nil, errGRPCInvalidSignature
+	}
+
+	// set the initial identity based on the signature header, it can't be trusted yet, but it gives
+	// a better context if the auth fails
+	grpc_ctxtags.Extract(ctx).
+		Set("authenticator.identity", signature.Identity)
+
+	authenticator, err := i.authenticatorFunc(ctx, signature.KeyFingerprint)
+	if err != nil {
+		if errors.Is(err, context.Canceled) && ctx.Err() != nil {
+			return nil, status.Error(codes.Canceled, "context canceled while doing authentication")
+		}
+
+		i.logger.Warn("failed to get authenticator", zap.Error(err))
+
+		return nil, errGRPCInvalidSignature
+	}
+
+	err = msg.VerifySignature(authenticator.Verifier)
+	if err != nil {
+		i.logger.Info("failed to verify message", zap.Error(err))
+
+		return nil, errGRPCInvalidSignature
+	}
+
+	grpc_ctxtags.Extract(ctx).
+		Set("authenticator.user_id", authenticator.UserID).
+		Set("authenticator.identity", authenticator.Identity).
+		Set("authenticator.role", string(authenticator.Role))
+
+	ctx = context.WithValue(ctx, auth.UserIDContextKey{}, authenticator.UserID)
+	ctx = context.WithValue(ctx, auth.IdentityContextKey{}, authenticator.Identity)
+	ctx = context.WithValue(ctx, auth.RoleContextKey{}, authenticator.Role)
+
+	return ctx, nil
+}
diff --git a/internal/pkg/auth/interceptor/signature_test.go b/internal/pkg/auth/interceptor/signature_test.go
new file mode 100644
index 000000000..6783492d5
--- /dev/null
+++ b/internal/pkg/auth/interceptor/signature_test.go
@@ -0,0 +1,175 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package interceptor_test
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/siderolabs/go-api-signature/pkg/message"
+	"github.com/siderolabs/go-api-signature/pkg/pgp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/zap/zaptest"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/interop/grpc_testing"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/internal/pkg/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/interceptor"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+	"github.com/siderolabs/omni/internal/pkg/test"
+)
+
+type testServer struct {
+	grpc_testing.UnimplementedTestServiceServer
+	t *testing.T
+}
+
+func (s testServer) UnaryCall(_ context.Context, _ *grpc_testing.SimpleRequest) (*grpc_testing.SimpleResponse, error) {
+	return &grpc_testing.SimpleResponse{}, nil
+}
+
+type SignatureTestSuite struct {
+	testServiceClient grpc_testing.TestServiceClient
+
+	clientConn *grpc.ClientConn
+
+	key *pgp.Key
+
+	test.GRPCSuite
+}
+
+func (suite *SignatureTestSuite) SetupSuite() {
+	var err error
+
+	suite.key, err = pgp.GenerateKey("", "", "test@example.org", time.Minute)
+	suite.Require().NoError(err)
+
+	authenticatorFunc := func(context.Context, string) (*auth.Authenticator, error) {
+		return &auth.Authenticator{
+			Verifier: suite.key,
+			Identity: "user@example.com",
+			UserID:   "user-id",
+			Role:     role.Operator,
+		}, nil
+	}
+
+	logger := zaptest.NewLogger(suite.T())
+
+	authConfigInterceptor := interceptor.NewAuthConfig(true, logger)
+
+	signatureInterceptor := interceptor.NewSignature(authenticatorFunc, logger)
+
+	suite.InitServer(
+		grpc.ChainUnaryInterceptor(
+			authConfigInterceptor.Unary(),
+			signatureInterceptor.Unary(),
+		),
+		grpc.ChainStreamInterceptor(
+			authConfigInterceptor.Stream(),
+			signatureInterceptor.Stream(),
+		),
+	)
+
+	grpc_testing.RegisterTestServiceServer(suite.Server, testServer{
+		t: suite.T(),
+	})
+
+	suite.StartServer()
+
+	dialOptions := []grpc.DialOption{
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	}
+
+	suite.clientConn, err = grpc.Dial(suite.Target, dialOptions...)
+	suite.Require().NoError(err)
+
+	suite.testServiceClient = grpc_testing.NewTestServiceClient(suite.clientConn)
+}
+
+func (suite *SignatureTestSuite) TearDownSuite() {
+	suite.clientConn.Close() //nolint:errcheck
+	suite.StopServer()
+}
+
+func (suite *SignatureTestSuite) TestMissingSignaturePassthrough() {
+	_, err := suite.testServiceClient.UnaryCall(context.Background(), &grpc_testing.SimpleRequest{})
+
+	suite.Assert().NoError(err)
+}
+
+func (suite *SignatureTestSuite) TestInvalidSignatureVersion() {
+	ctx := metadata.NewOutgoingContext(context.Background(), metadata.Pairs(
+		message.SignatureHeaderKey, "invalid",
+	))
+
+	_, err := suite.testServiceClient.UnaryCall(ctx, &grpc_testing.SimpleRequest{})
+
+	suite.Assert().Error(err)
+	suite.Assert().Equal(codes.Unauthenticated, status.Code(err), "error code should be codes.Unauthenticated")
+	suite.Assert().ErrorContains(err, "invalid signature")
+}
+
+func (suite *SignatureTestSuite) TestMissingTimestamp() {
+	payload := base64.StdEncoding.EncodeToString([]byte("payload"))
+
+	ctx := metadata.NewOutgoingContext(context.Background(), metadata.Pairs(
+		message.SignatureHeaderKey, fmt.Sprintf("%s test@example.org signer-1 %s", message.SignatureVersionV1, payload),
+	))
+
+	_, err := suite.testServiceClient.UnaryCall(ctx, &grpc_testing.SimpleRequest{})
+
+	suite.Assert().Error(err)
+	suite.Assert().Equal(codes.Unauthenticated, status.Code(err), "error code should be codes.Unauthenticated")
+	suite.Assert().ErrorContains(err, "invalid signature")
+}
+
+func (suite *SignatureTestSuite) TestValidSignature() {
+	epochTimestamp := strconv.FormatInt(time.Now().Unix(), 10)
+
+	payload := message.GRPCPayload{
+		Headers: map[string][]string{
+			message.TimestampHeaderKey: {epochTimestamp},
+		},
+		Method: "/grpc.testing.TestService/UnaryCall",
+	}
+
+	payloadJSON, err := json.Marshal(payload)
+	suite.Require().NoError(err)
+
+	signature, err := suite.key.Sign(payloadJSON)
+	suite.Require().NoError(err)
+
+	signatureBase64 := base64.StdEncoding.EncodeToString(signature)
+
+	ctx := metadata.NewOutgoingContext(context.Background(), metadata.Pairs(
+		message.SignatureHeaderKey, fmt.Sprintf(
+			"%s test@example.org %s %s",
+			message.SignatureVersionV1,
+			suite.key.Fingerprint(),
+			signatureBase64,
+		),
+		message.TimestampHeaderKey, epochTimestamp,
+		message.PayloadHeaderKey, string(payloadJSON),
+	))
+
+	_, err = suite.testServiceClient.UnaryCall(ctx, &grpc_testing.SimpleRequest{})
+
+	assert.NoError(suite.T(), err)
+}
+
+func TestSignatureTestSuite(t *testing.T) {
+	suite.Run(t, new(SignatureTestSuite))
+}
diff --git a/internal/pkg/auth/role/role.go b/internal/pkg/auth/role/role.go
new file mode 100644
index 000000000..8efbc48fb
--- /dev/null
+++ b/internal/pkg/auth/role/role.go
@@ -0,0 +1,139 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package role contains the role definitions and checks.
+package role
+
+import (
+	"fmt"
+)
+
+// Role represents a user role.
+type Role string
+
+const (
+	// None is a role that has no capability.
+	//
+	// tsgen:RoleNone
+	None Role = "None"
+
+	// Reader is a role that has read-only capability.
+	//
+	// tsgen:RoleReader
+	Reader Role = "Reader"
+
+	// Operator is a role that has read/write capability.
+	//
+	// tsgen:RoleOperator
+	Operator Role = "Operator"
+
+	// Admin is a role that has read/write and user/service account management capability.
+	//
+	// tsgen:RoleAdmin
+	Admin Role = "Admin"
+)
+
+var roles = []Role{None, Reader, Operator, Admin}
+
+var indexes map[Role]int
+
+func init() {
+	indexes = make(map[Role]int, len(roles))
+
+	for i, role := range roles {
+		indexes[role] = i
+	}
+}
+
+// Parse parses the role string.
+func Parse(role string) (Role, error) {
+	parsed, ok := indexes[Role(role)]
+	if !ok {
+		return "", fmt.Errorf("unknown role to parse: %q", role)
+	}
+
+	return roles[parsed], nil
+}
+
+// Check verifies if the actor role satisfies the required role.
+func (r Role) Check(role Role) error {
+	thisIndex, ok := indexes[r]
+	if !ok {
+		return fmt.Errorf("unknown role to run check on: %q", r)
+	}
+
+	otherIndex, ok := indexes[role]
+	if !ok {
+		return fmt.Errorf("unknown other role: %q", role)
+	}
+
+	if thisIndex < otherIndex {
+		return fmt.Errorf("access denied: insufficient role: %q", r)
+	}
+
+	return nil
+}
+
+// Previous returns the previous role - i.e., the role with fewer capabilities.
+func (r Role) Previous() (Role, error) {
+	index, ok := indexes[r]
+	if !ok {
+		return "", fmt.Errorf("unknown current role in 'previous' check: %q", r)
+	}
+
+	if index == 0 {
+		return "", fmt.Errorf("no 'previous' role for %q", r)
+	}
+
+	return roles[index-1], nil
+}
+
+// Min returns the least capable role from the given roles.
+func Min(first Role, role ...Role) (Role, error) {
+	result := first
+
+	resultIndex, ok := indexes[first]
+	if !ok {
+		return "", fmt.Errorf("unknown first role in min check: %q", first)
+	}
+
+	for i, currentRole := range role {
+		currentIndex, currentIndexOk := indexes[currentRole]
+		if !currentIndexOk {
+			return "", fmt.Errorf("unknown role in min check at index %d: %q", i, currentRole)
+		}
+
+		if currentIndex < resultIndex {
+			result = currentRole
+			resultIndex = currentIndex
+		}
+	}
+
+	return result, nil
+}
+
+// Max returns the most capable role from the given roles.
+func Max(first Role, role ...Role) (Role, error) {
+	result := first
+
+	resultIndex, ok := indexes[first]
+	if !ok {
+		return "", fmt.Errorf("unknown first role in max check: %q", first)
+	}
+
+	for i, currentRole := range role {
+		currentIndex, currentIndexOk := indexes[currentRole]
+		if !currentIndexOk {
+			return "", fmt.Errorf("unknown role in max check at index %d: %q", i, currentRole)
+		}
+
+		if currentIndex > resultIndex {
+			result = currentRole
+			resultIndex = currentIndex
+		}
+	}
+
+	return result, nil
+}
diff --git a/internal/pkg/auth/scope/action.go b/internal/pkg/auth/scope/action.go
new file mode 100644
index 000000000..b73a0df51
--- /dev/null
+++ b/internal/pkg/auth/scope/action.go
@@ -0,0 +1,18 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package scope
+
+// Action represents an action in the scope.
+type Action string
+
+// Action constants.
+const (
+	ActionRead    Action = "read"
+	ActionCreate  Action = "create"
+	ActionModify  Action = "modify"
+	ActionDestroy Action = "destroy"
+	ActionAny     Action = "*"
+)
diff --git a/internal/pkg/auth/scope/object.go b/internal/pkg/auth/scope/object.go
new file mode 100644
index 000000000..a7a1dd202
--- /dev/null
+++ b/internal/pkg/auth/scope/object.go
@@ -0,0 +1,21 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package scope
+
+// Object represents Scope target.
+type Object string
+
+// Object constants.
+const (
+	// Cluster and everything below it.
+	ObjectCluster = "cluster"
+	// Machines.
+	ObjectMachine = "machine"
+	// Users.
+	ObjectUser = "user"
+	// Service accounts.
+	ObjectServiceAccount = "service-account"
+)
diff --git a/internal/pkg/auth/scope/perspective.go b/internal/pkg/auth/scope/perspective.go
new file mode 100644
index 000000000..a865be26b
--- /dev/null
+++ b/internal/pkg/auth/scope/perspective.go
@@ -0,0 +1,17 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package scope
+
+// Perspective is the sub-action of the scope.
+type Perspective string
+
+// Perspective constants.
+const (
+	PerspectiveNone                     = ""
+	PerspectiveKubernetesAccess         = "kubernetes-api-access"
+	PerspectiveKubeconfigServiceAccount = "kubeconfig-service-account"
+	PerspectiveKubernetesUpgrade        = "kubernetes-upgrade"
+)
diff --git a/internal/pkg/auth/scope/scope.go b/internal/pkg/auth/scope/scope.go
new file mode 100644
index 000000000..01fa35670
--- /dev/null
+++ b/internal/pkg/auth/scope/scope.go
@@ -0,0 +1,98 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package scope contains the scope definitions and checks.
+package scope
+
+import (
+	"fmt"
+	"strings"
+)
+
+// Scope represents an authorization scope.
+type Scope struct {
+	// Object the access is granted to, e.g. `cluster`, or `machine`.
+	Object Object
+	// Action the access is granted for, e.g. `create`, or `delete`.
+	Action Action
+	// Perspective is the additional sub-action for specific object.
+	Perspective Perspective
+}
+
+// New creates a new scope.
+func New(object Object, action Action, perspective Perspective) Scope {
+	return Scope{
+		Object:      object,
+		Action:      action,
+		Perspective: perspective,
+	}
+}
+
+// Parse parses a scope from string.
+func Parse(scope string) (Scope, error) {
+	obj, actionAndPerspective, ok := strings.Cut(scope, ":")
+	if !ok {
+		return Scope{}, fmt.Errorf("invalid scope %q", scope)
+	}
+
+	action, perspective, ok := strings.Cut(actionAndPerspective, ".")
+	if !ok {
+		return New(Object(obj), Action(action), PerspectiveNone), nil
+	}
+
+	return New(Object(obj), Action(action), Perspective(perspective)), nil
+}
+
+// Matches verifies if the required scope matches the actor scope.
+func (s Scope) Matches(actorScope Scope) bool {
+	return s.Object == actorScope.Object &&
+		((s.Action == actorScope.Action && s.Perspective == actorScope.Perspective) || actorScope.Action == ActionAny)
+}
+
+// String converts Scope to string.
+func (s Scope) String() string {
+	action := string(s.Action)
+
+	if s.Perspective != PerspectiveNone {
+		action = action + "." + string(s.Perspective)
+	}
+
+	return string(s.Object) + ":" + action
+}
+
+// Set of standard scopes.
+var (
+	ClusterAny            = New(ObjectCluster, ActionAny, PerspectiveNone)
+	UserAny               = New(ObjectUser, ActionAny, PerspectiveNone)
+	MachineAny            = New(ObjectMachine, ActionAny, PerspectiveNone)
+	ServiceAccountAny     = New(ObjectServiceAccount, ActionAny, PerspectiveNone)
+	ClusterRead           = New(ObjectCluster, ActionRead, PerspectiveNone)
+	ClusterModify         = New(ObjectCluster, ActionModify, PerspectiveNone)
+	UserRead              = New(ObjectUser, ActionRead, PerspectiveNone)
+	MachineRead           = New(ObjectMachine, ActionRead, PerspectiveNone)
+	ServiceAccountRead    = New(ObjectServiceAccount, ActionRead, PerspectiveNone)
+	ServiceAccountCreate  = New(ObjectServiceAccount, ActionCreate, PerspectiveNone)
+	ServiceAccountDestroy = New(ObjectServiceAccount, ActionDestroy, PerspectiveNone)
+)
+
+// UserDefaultScopes is the set of scopes granted to users by default.
+//
+// This might change as we introduce more user roles.
+var UserDefaultScopes = []Scope{
+	ClusterAny,
+	MachineAny,
+	UserAny,
+	ServiceAccountAny,
+}
+
+// SuspendedScopes is the set of scopes granted to users when the Omni account is suspended.
+//
+// This might change as we introduce more user roles.
+var SuspendedScopes = []Scope{
+	ClusterRead,
+	MachineRead,
+	UserRead,
+	ServiceAccountRead,
+}
diff --git a/internal/pkg/auth/scope/scope_test.go b/internal/pkg/auth/scope/scope_test.go
new file mode 100644
index 000000000..87b405dad
--- /dev/null
+++ b/internal/pkg/auth/scope/scope_test.go
@@ -0,0 +1,76 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package scope_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/internal/pkg/auth/scope"
+)
+
+func TestParse(t *testing.T) {
+	for _, sc := range []scope.Scope{
+		scope.ClusterAny,
+		scope.MachineAny,
+		scope.UserAny,
+		scope.New(scope.ObjectUser, scope.ActionCreate, "test-perspective"),
+	} {
+		s := sc.String()
+
+		parsedScope, err := scope.Parse(s)
+		require.NoError(t, err)
+
+		assert.Equal(t, sc, parsedScope)
+	}
+
+	for _, sc := range []string{
+		"cluster:read",
+		"cluster:*",
+		"cluster:read.kubeconfig",
+	} {
+		parsedScope, err := scope.Parse(sc)
+		require.NoError(t, err)
+
+		s := parsedScope.String()
+
+		assert.Equal(t, sc, s)
+	}
+}
+
+func TestMatches(t *testing.T) {
+	// same scope matches
+	assert.True(t, scope.ClusterAny.Matches(scope.ClusterAny))
+
+	// "any" action matches any action
+	assert.True(t, scope.New(scope.ObjectCluster, scope.ActionCreate, scope.PerspectiveNone).Matches(scope.ClusterAny))
+
+	// "any" action matches any action + perspective
+	assert.True(t, scope.New(scope.ObjectCluster, scope.ActionCreate, "test-perspective").Matches(scope.ClusterAny))
+
+	// the opposite is not true: specific action does not match "any" action
+	assert.False(t, scope.ClusterAny.Matches(scope.New(scope.ObjectCluster, scope.ActionCreate, scope.PerspectiveNone)))
+
+	// different objects don't match
+	assert.False(t, scope.ClusterAny.Matches(scope.UserAny))
+
+	// different objects with specific action don't match
+	assert.False(t, scope.New(scope.ObjectUser, scope.ActionCreate, scope.PerspectiveNone).
+		Matches(scope.New(scope.ObjectCluster, scope.ActionCreate, scope.PerspectiveNone)),
+	)
+
+	// different actions don't match
+	assert.False(t, scope.New(scope.ObjectUser, scope.ActionCreate, scope.PerspectiveNone).
+		Matches(scope.New(scope.ObjectUser, scope.ActionDestroy, scope.PerspectiveNone)),
+	)
+
+	// different perspectives don't match
+	assert.False(t, scope.New(scope.ObjectUser, scope.ActionCreate, scope.PerspectiveNone).
+		Matches(scope.New(scope.ObjectUser, scope.ActionCreate, "test-perspective")),
+	)
+}
diff --git a/internal/pkg/auth/scope/set.go b/internal/pkg/auth/scope/set.go
new file mode 100644
index 000000000..9f203e31b
--- /dev/null
+++ b/internal/pkg/auth/scope/set.go
@@ -0,0 +1,94 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package scope
+
+import (
+	"fmt"
+	"slices"
+
+	"github.com/siderolabs/gen/maps"
+	"github.com/siderolabs/gen/xslices"
+)
+
+// Scopes represents a set of scopes.
+type Scopes struct {
+	scopeList []Scope
+}
+
+// NewScopes creates a new Scopes instance.
+func NewScopes(scopes ...Scope) Scopes {
+	return Scopes{
+		scopeList: slices.Clone(scopes),
+	}
+}
+
+// ParseScopes parses scopes from a list of strings.
+func ParseScopes(scopes []string) (Scopes, error) {
+	scopeList := make([]Scope, 0, len(scopes))
+
+	for _, stringScope := range scopes {
+		sc, err := Parse(stringScope)
+		if err != nil {
+			return Scopes{}, err
+		}
+
+		scopeList = append(scopeList, sc)
+	}
+
+	return NewScopes(scopeList...), nil
+}
+
+// Check checks if the given scopes are contained in the scope set.
+func (s Scopes) Check(requiredScopes ...Scope) error {
+	for _, scope := range requiredScopes {
+		matched := false
+
+		for _, actorScope := range s.scopeList {
+			if scope.Matches(actorScope) {
+				matched = true
+
+				break
+			}
+		}
+
+		if !matched {
+			return fmt.Errorf("missing required scope: %s", scope)
+		}
+	}
+
+	return nil
+}
+
+// Intersect returns the intersection of the scope with the provided other scope.
+func (s Scopes) Intersect(other Scopes) Scopes {
+	intersectionSet := map[Scope]struct{}{}
+
+	for _, scope1 := range s.scopeList {
+		for _, scope2 := range other.scopeList {
+			if scope1.Matches(scope2) {
+				intersectionSet[scope1] = struct{}{}
+			}
+
+			if scope2.Matches(scope1) {
+				intersectionSet[scope2] = struct{}{}
+			}
+		}
+	}
+
+	return NewScopes(maps.Keys(intersectionSet)...)
+}
+
+// Strings marshals the scopes to a list of strings.
+func (s Scopes) Strings() []string {
+	return xslices.Map(s.scopeList, func(scope Scope) string {
+		return scope.String()
+	})
+}
+
+// List returns the list of scopes.
+func (s Scopes) List() []Scope {
+	return slices.Clone(s.scopeList)
+}
diff --git a/internal/pkg/auth/scope/set_test.go b/internal/pkg/auth/scope/set_test.go
new file mode 100644
index 000000000..593e3b133
--- /dev/null
+++ b/internal/pkg/auth/scope/set_test.go
@@ -0,0 +1,141 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package scope_test
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/internal/pkg/auth/scope"
+)
+
+func TestScopeCheck(t *testing.T) {
+	for _, tt := range []struct { //nolint:govet
+		name           string
+		actorScopes    []scope.Scope
+		requiredScopes []scope.Scope
+		expectedError  string
+	}{
+		{
+			name: "empty",
+		},
+		{
+			name: "actor okay",
+			actorScopes: []scope.Scope{
+				scope.ClusterAny,
+				scope.UserAny,
+				scope.MachineAny,
+			},
+			requiredScopes: []scope.Scope{
+				scope.New(scope.ObjectCluster, scope.ActionRead, scope.PerspectiveNone),
+				scope.New(scope.ObjectUser, scope.ActionDestroy, scope.PerspectiveNone),
+			},
+		},
+		{
+			name: "missing scope",
+			actorScopes: []scope.Scope{
+				scope.UserAny,
+				scope.MachineAny,
+			},
+			requiredScopes: []scope.Scope{
+				scope.New(scope.ObjectCluster, scope.ActionRead, scope.PerspectiveNone),
+				scope.New(scope.ObjectUser, scope.ActionDestroy, scope.PerspectiveNone),
+			},
+			expectedError: "missing required scope: cluster:read",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			actorScopes := scope.NewScopes(tt.actorScopes...)
+
+			err := actorScopes.Check(tt.requiredScopes...)
+			if tt.expectedError != "" {
+				require.Error(t, err)
+				assert.EqualError(t, err, tt.expectedError)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestParseScopes(t *testing.T) {
+	scopes := scope.NewScopes(scope.ClusterAny, scope.MachineAny)
+
+	assert.Equal(t, []string{"cluster:*", "machine:*"}, scopes.Strings())
+
+	parsedScopes, err := scope.ParseScopes(scopes.Strings())
+	require.NoError(t, err)
+	assert.Equal(t, scopes, parsedScopes)
+}
+
+func TestIntersection(t *testing.T) {
+	scopeUserRead := scope.New(scope.ObjectUser, scope.ActionRead, scope.PerspectiveNone)
+	scopeClusterRead := scope.New(scope.ObjectCluster, scope.ActionRead, scope.PerspectiveNone)
+	scopeClusterCreate := scope.New(scope.ObjectCluster, scope.ActionCreate, scope.PerspectiveNone)
+	scopeClusterUpgrade := scope.New(scope.ObjectCluster, scope.ActionModify, scope.PerspectiveKubernetesUpgrade)
+	scopeMachineDestroy := scope.New(scope.ObjectMachine, scope.ActionDestroy, scope.PerspectiveNone)
+
+	testCases := []struct {
+		name     string
+		scopes1  scope.Scopes
+		scopes2  scope.Scopes
+		expected scope.Scopes
+	}{
+		{
+			name:     "with-any",
+			scopes1:  scope.NewScopes(scope.ClusterAny, scope.MachineAny),
+			scopes2:  scope.NewScopes(scope.ClusterAny, scope.MachineAny, scope.UserAny),
+			expected: scope.NewScopes(scope.ClusterAny, scope.MachineAny),
+		},
+		{
+			name:     "with-empty",
+			scopes1:  scope.NewScopes(scopeUserRead, scope.MachineAny),
+			scopes2:  scope.NewScopes(),
+			expected: scope.NewScopes(),
+		},
+		{
+			name:     "mixed-1",
+			scopes1:  scope.NewScopes(scopeClusterCreate, scope.MachineAny),
+			scopes2:  scope.NewScopes(scope.ClusterAny, scope.MachineAny),
+			expected: scope.NewScopes(scopeClusterCreate, scope.MachineAny),
+		},
+		{
+			name:     "mixed-2",
+			scopes1:  scope.NewScopes(scope.UserDefaultScopes...),
+			scopes2:  scope.NewScopes(scopeClusterRead),
+			expected: scope.NewScopes(scopeClusterRead),
+		},
+		{
+			name:     "mixed-inverted",
+			scopes2:  scope.NewScopes(scope.ClusterAny, scope.MachineAny),
+			scopes1:  scope.NewScopes(scopeClusterCreate, scope.MachineAny),
+			expected: scope.NewScopes(scopeClusterCreate, scope.MachineAny),
+		},
+		{
+			name:     "complex",
+			scopes1:  scope.NewScopes(scopeUserRead, scopeMachineDestroy, scopeClusterUpgrade),
+			scopes2:  scope.NewScopes(scope.ClusterAny, scope.MachineAny),
+			expected: scope.NewScopes(scopeMachineDestroy, scopeClusterUpgrade),
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			intersection := tc.scopes1.Intersect(tc.scopes2)
+
+			expectedStrs := tc.expected.Strings()
+			actualStrs := intersection.Strings()
+
+			slices.Sort(expectedStrs)
+			slices.Sort(actualStrs)
+
+			assert.Equal(t, expectedStrs, actualStrs)
+		})
+	}
+}
diff --git a/internal/pkg/auth/user/user.go b/internal/pkg/auth/user/user.go
new file mode 100644
index 000000000..fec04411f
--- /dev/null
+++ b/internal/pkg/auth/user/user.go
@@ -0,0 +1,81 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package user contains the auth.User and auth.Identity related operations.
+package user
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/google/uuid"
+	"github.com/hashicorp/go-multierror"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/role"
+)
+
+// EnsureInitialResources creates the auth.User and auth.Identity resources if they are not present.
+func EnsureInitialResources(ctx context.Context, st state.State, logger *zap.Logger, initialUsers []string) error {
+	items, err := st.List(ctx, auth.NewUser(resources.DefaultNamespace, "").Metadata())
+	if err != nil {
+		return err
+	}
+
+	if len(items.Items) > 0 {
+		logger.Info("some users already exist, skipping initial users")
+
+		return nil
+	}
+
+	var multiErr error
+
+	for _, email := range initialUsers {
+		if err := Ensure(ctx, st, email, role.Admin); err != nil {
+			multiErr = multierror.Append(multiErr, err)
+		}
+	}
+
+	return multiErr
+}
+
+// Ensure creates the auth.User and auth.Identity resources with the given role if they are not already present.
+func Ensure(ctx context.Context, st state.State, email string, role role.Role) error {
+	email = strings.ToLower(email)
+
+	identity, err := safe.StateGet[*auth.Identity](ctx, st, auth.NewIdentity(resources.DefaultNamespace, email).Metadata())
+	if err != nil {
+		if !state.IsNotFoundError(err) {
+			return err
+		}
+
+		newUserID := uuid.New().String()
+
+		identity = auth.NewIdentity(resources.DefaultNamespace, email)
+		identity.TypedSpec().Value.UserId = newUserID
+		identity.Metadata().Labels().Set(auth.LabelIdentityUserID, newUserID)
+
+		err = st.Create(ctx, identity)
+		if err != nil {
+			return fmt.Errorf("failed to create Identity resource %s: %w", identity.Metadata().ID(), err)
+		}
+	}
+
+	user := auth.NewUser(resources.DefaultNamespace, identity.TypedSpec().Value.UserId)
+
+	user.TypedSpec().Value.Role = string(role)
+
+	err = st.Create(ctx, user)
+	if err != nil && !state.IsConflictError(err) {
+		return err
+	}
+
+	return nil
+}
diff --git a/internal/pkg/auth/user/user_test.go b/internal/pkg/auth/user/user_test.go
new file mode 100644
index 000000000..b419615ec
--- /dev/null
+++ b/internal/pkg/auth/user/user_test.go
@@ -0,0 +1,79 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package user_test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/auth"
+	"github.com/siderolabs/omni/internal/pkg/auth/user"
+)
+
+func assertUsers(ctx context.Context, t *testing.T, st state.State, expectedUsers []string) {
+	var userIDs []string
+
+	rtestutils.AssertResources(ctx, t, st, expectedUsers, func(identity *auth.Identity, assert *assert.Assertions) {
+		userIDs = append(userIDs, identity.TypedSpec().Value.UserId)
+
+		label, ok := identity.Metadata().Labels().Get(auth.LabelIdentityUserID)
+
+		assert.True(ok)
+		assert.Equal(identity.TypedSpec().Value.UserId, label)
+	})
+
+	assert.Len(t, userIDs, len(expectedUsers))
+
+	rtestutils.AssertResources(ctx, t, st, userIDs, func(*auth.User, *assert.Assertions) {})
+}
+
+func TestInitialUsers(t *testing.T) {
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+	logger := zaptest.NewLogger(t)
+	ctx := context.Background()
+
+	const (
+		john    = "john@example.com"
+		richard = "richard@example.com"
+		timothy = "timothy@example.com"
+	)
+
+	require.NoError(t, user.EnsureInitialResources(ctx, st, logger,
+		[]string{
+			john,
+			richard,
+		},
+	))
+
+	assertUsers(ctx, t, st, []string{john, richard})
+
+	require.NoError(t, user.EnsureInitialResources(ctx, st, logger,
+		[]string{
+			richard,
+			john,
+		},
+	))
+
+	assertUsers(ctx, t, st, []string{john, richard})
+
+	require.NoError(t, user.EnsureInitialResources(ctx, st, logger,
+		[]string{
+			richard,
+			timothy,
+		},
+	))
+
+	// new user doesn't get created, as the state is already initialized
+	assertUsers(ctx, t, st, []string{john, richard})
+}
diff --git a/internal/pkg/cache/cache.go b/internal/pkg/cache/cache.go
new file mode 100644
index 000000000..d2004bd4e
--- /dev/null
+++ b/internal/pkg/cache/cache.go
@@ -0,0 +1,45 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package cache implements a simple in-memory cache for a single value.
+package cache
+
+import (
+	"sync"
+	"time"
+)
+
+// Value is a cache for a single value.
+//
+//nolint:govet
+type Value[T any] struct {
+	// Duration is the duration for which the cached value is valid.
+	Duration time.Duration
+
+	mx         sync.Mutex
+	lastResult T
+	lastTime   time.Time
+}
+
+// GetOrUpdate returns the cached result if it is still valid, otherwise it calls the given function and caches the result.
+func (c *Value[T]) GetOrUpdate(fn func() (T, error)) (T, error) {
+	c.mx.Lock()
+	defer c.mx.Unlock()
+
+	if time.Since(c.lastTime) > c.Duration {
+		var err error
+
+		c.lastResult, err = fn()
+		if err != nil {
+			var zero T
+
+			return zero, err
+		}
+
+		c.lastTime = time.Now()
+	}
+
+	return c.lastResult, nil
+}
diff --git a/internal/pkg/cache/cache_test.go b/internal/pkg/cache/cache_test.go
new file mode 100644
index 000000000..25506dad9
--- /dev/null
+++ b/internal/pkg/cache/cache_test.go
@@ -0,0 +1,42 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package cache_test
+
+import (
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/internal/pkg/cache"
+)
+
+func TestResultCacher_GetOrUpdate(t *testing.T) {
+	cacher := cache.Value[int]{Duration: time.Second}
+
+	result, err := cacher.GetOrUpdate(func() (int, error) { return 42, errors.New("test") })
+
+	require.EqualError(t, err, "test")
+	require.Zero(t, result)
+
+	result, err = cacher.GetOrUpdate(func() (int, error) { return 42, nil })
+
+	require.NoError(t, err)
+	require.Equal(t, 42, result)
+
+	result, err = cacher.GetOrUpdate(func() (int, error) { return 43, nil })
+
+	require.NoError(t, err)
+	require.Equal(t, 42, result)
+
+	time.Sleep(time.Second)
+
+	result, err = cacher.GetOrUpdate(func() (int, error) { return 43, nil })
+
+	require.NoError(t, err)
+	require.Equal(t, 43, result)
+}
diff --git a/internal/pkg/certs/certs.go b/internal/pkg/certs/certs.go
new file mode 100644
index 000000000..df4c4b3a8
--- /dev/null
+++ b/internal/pkg/certs/certs.go
@@ -0,0 +1,76 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package certs provides utilities for managing/generating certificates.
+package certs
+
+import (
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"time"
+
+	talosx509 "github.com/siderolabs/crypto/x509"
+	talossecrets "github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
+	"github.com/siderolabs/talos/pkg/machinery/role"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+// IsBase64EncodedCertificateStale checks if the given base64 encoded certificate is stale.
+//
+// Certificate is considered stale if it's 50% into its validity period.
+// As a special case, empty string is considered not stale.
+func IsBase64EncodedCertificateStale(certBase64 string, expectedValidity time.Duration) (bool, error) {
+	if certBase64 == "" {
+		return false, nil
+	}
+
+	certPEM, err := base64.StdEncoding.DecodeString(certBase64)
+	if err != nil {
+		return false, fmt.Errorf("error decoding certificate: %w", err)
+	}
+
+	return IsPEMEncodedCertificateStale(certPEM, expectedValidity)
+}
+
+// IsPEMEncodedCertificateStale checks if the given PEM-encoded certificate is stale.
+//
+// Certificate is considered stale if it's 50% into its validity period.
+// As a special case, empty string is considered not stale.
+func IsPEMEncodedCertificateStale(certPEM []byte, expectedValidity time.Duration) (bool, error) {
+	if len(certPEM) == 0 {
+		return false, nil
+	}
+
+	block, _ := pem.Decode(certPEM)
+	if block == nil {
+		return false, errors.New("error decoding PEM block")
+	}
+
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return false, fmt.Errorf("error parsing certificate: %w", err)
+	}
+
+	return time.Now().After(cert.NotAfter.Add(-expectedValidity / 2)), nil
+}
+
+// TalosAPIClientCertificateFromSecrets generates a Talos API client certificate from the given secrets.
+func TalosAPIClientCertificateFromSecrets(secrets *omni.ClusterSecrets, certificateValidity time.Duration, roles role.Set) (*talosx509.PEMEncodedCertificateAndKey, []byte, error) {
+	secretBundle, err := omni.ToSecretsBundle(secrets)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	clientCert, err := talossecrets.NewAdminCertificateAndKey(time.Now(), secretBundle.Certs.OS, roles, certificateValidity)
+	if err != nil {
+		return nil, nil, fmt.Errorf("error generating Talos API certificate: %w", err)
+	}
+
+	return clientCert, secretBundle.Certs.OS.Crt, nil
+}
diff --git a/internal/pkg/certs/certs_test.go b/internal/pkg/certs/certs_test.go
new file mode 100644
index 000000000..4720a543f
--- /dev/null
+++ b/internal/pkg/certs/certs_test.go
@@ -0,0 +1,47 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package certs_test
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/siderolabs/talos/pkg/machinery/config"
+	"github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
+	"github.com/siderolabs/talos/pkg/machinery/role"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/certs"
+)
+
+func TestIsTalosCertificateStale(t *testing.T) {
+	bundle, err := secrets.NewBundle(secrets.NewFixedClock(time.Now()), config.TalosVersionCurrent)
+	require.NoError(t, err)
+
+	data, err := json.Marshal(bundle)
+	require.NoError(t, err)
+
+	secrets := omni.NewClusterSecrets("", "")
+	secrets.TypedSpec().Value.Data = data
+
+	cert, _, err := certs.TalosAPIClientCertificateFromSecrets(secrets, constants.CertificateValidityTime, role.All)
+	require.NoError(t, err)
+
+	// cert should be fresh with default validity time
+	stale, err := certs.IsPEMEncodedCertificateStale(cert.Crt, constants.CertificateValidityTime)
+	require.NoError(t, err)
+
+	require.False(t, stale)
+
+	// cert should be stale with double validity time
+	stale, err = certs.IsPEMEncodedCertificateStale(cert.Crt, 2*constants.CertificateValidityTime)
+	require.NoError(t, err)
+
+	require.True(t, stale)
+}
diff --git a/internal/pkg/certs/kubernetes.go b/internal/pkg/certs/kubernetes.go
new file mode 100644
index 000000000..c105a5baa
--- /dev/null
+++ b/internal/pkg/certs/kubernetes.go
@@ -0,0 +1,128 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package certs
+
+import (
+	stdlibx509 "crypto/x509"
+	"encoding/base64"
+	"fmt"
+	"time"
+
+	"github.com/siderolabs/crypto/x509"
+	talosconstants "github.com/siderolabs/talos/pkg/machinery/constants"
+	"gopkg.in/yaml.v3"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+)
+
+type kubeconfigTemplate struct { //nolint:govet
+	APIVersion     string              `yaml:"apiVersion"`
+	Kind           string              `yaml:"kind"`
+	Clusters       []kubeconfigCluster `yaml:"clusters"`
+	Users          []kubeconfigUser    `yaml:"users"`
+	Contexts       []kubeconfigContext `yaml:"contexts"`
+	CurrentContext string              `yaml:"current-context"`
+}
+
+type kubeconfigCluster struct {
+	Name    string                   `yaml:"name"`
+	Cluster kubeconfigClusterCluster `yaml:"cluster"`
+}
+
+type kubeconfigClusterCluster struct {
+	Server                   string `yaml:"server"`
+	CertificateAuthorityData string `yaml:"certificate-authority-data"`
+}
+
+type kubeconfigUser struct {
+	Name string             `yaml:"name"`
+	User kubeconfigUserUser `yaml:"user"`
+}
+
+type kubeconfigUserUser struct {
+	ClientCertificateData string `yaml:"client-certificate-data"`
+	ClientKeyData         string `yaml:"client-key-data"`
+}
+
+type kubeconfigContext struct {
+	Name    string                   `yaml:"name"`
+	Context kubeconfigContextContext `yaml:"context"`
+}
+
+type kubeconfigContextContext struct {
+	Cluster   string `yaml:"cluster"`
+	Namespace string `yaml:"namespace"`
+	User      string `yaml:"user"`
+}
+
+const allowedTimeSkew = 10 * time.Second
+
+// GenerateKubeconfig a kubeconfig for the cluster from the given input resources.
+func GenerateKubeconfig(secrets *omni.ClusterSecrets, lbConfig *omni.LoadBalancerConfig, certificateValidity time.Duration) ([]byte, error) {
+	secretBundle, err := omni.ToSecretsBundle(secrets)
+	if err != nil {
+		return nil, err
+	}
+
+	k8sCA, err := x509.NewCertificateAuthorityFromCertificateAndKey(secretBundle.Certs.K8s)
+	if err != nil {
+		return nil, fmt.Errorf("error getting Kubernetes CA: %w", err)
+	}
+
+	clientCert, err := x509.NewKeyPair(k8sCA,
+		x509.CommonName(constants.KubernetesAdminCertCommonName),
+		x509.Organization(talosconstants.KubernetesAdminCertOrganization),
+		x509.NotBefore(time.Now().Add(-allowedTimeSkew)),
+		x509.NotAfter(time.Now().Add(certificateValidity)),
+		x509.KeyUsage(stdlibx509.KeyUsageDigitalSignature|stdlibx509.KeyUsageKeyEncipherment),
+		x509.ExtKeyUsage([]stdlibx509.ExtKeyUsage{
+			stdlibx509.ExtKeyUsageClientAuth,
+		}),
+	)
+	if err != nil {
+		return nil, fmt.Errorf("error generating Kubernetes client certificate: %w", err)
+	}
+
+	clientCertPEM := x509.NewCertificateAndKeyFromKeyPair(clientCert)
+	contextName := fmt.Sprintf("%s@%s", "admin", secrets.Metadata().ID())
+
+	kubeconfig := kubeconfigTemplate{
+		APIVersion: "v1",
+		Kind:       "Config",
+		Clusters: []kubeconfigCluster{
+			{
+				Name: secrets.Metadata().ID(),
+				Cluster: kubeconfigClusterCluster{
+					Server:                   lbConfig.TypedSpec().Value.SiderolinkEndpoint,
+					CertificateAuthorityData: base64.StdEncoding.EncodeToString(secretBundle.Certs.K8s.Crt),
+				},
+			},
+		},
+		Users: []kubeconfigUser{
+			{
+				Name: contextName,
+				User: kubeconfigUserUser{
+					ClientCertificateData: base64.StdEncoding.EncodeToString(clientCertPEM.Crt),
+					ClientKeyData:         base64.StdEncoding.EncodeToString(clientCertPEM.Key),
+				},
+			},
+		},
+		Contexts: []kubeconfigContext{
+			{
+				Name: contextName,
+				Context: kubeconfigContextContext{
+					Cluster:   secrets.Metadata().ID(),
+					Namespace: "default",
+					User:      contextName,
+				},
+			},
+		},
+		CurrentContext: contextName,
+	}
+
+	return yaml.Marshal(kubeconfig)
+}
diff --git a/internal/pkg/certs/kubernetes_test.go b/internal/pkg/certs/kubernetes_test.go
new file mode 100644
index 000000000..a0a5809d8
--- /dev/null
+++ b/internal/pkg/certs/kubernetes_test.go
@@ -0,0 +1,53 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package certs_test
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/siderolabs/talos/pkg/machinery/config"
+	"github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
+	"github.com/stretchr/testify/require"
+	"k8s.io/client-go/tools/clientcmd"
+
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/certs"
+)
+
+func TestIsKubernetesCertificateStale(t *testing.T) {
+	bundle, err := secrets.NewBundle(secrets.NewFixedClock(time.Now()), config.TalosVersionCurrent)
+	require.NoError(t, err)
+
+	data, err := json.Marshal(bundle)
+	require.NoError(t, err)
+
+	secrets := omni.NewClusterSecrets("", "my-first-cluster")
+	secrets.TypedSpec().Value.Data = data
+
+	lbConfig := omni.NewLoadBalancerConfig("", "")
+	lbConfig.TypedSpec().Value.SiderolinkEndpoint = "https://[2001:db8::1]:6443"
+
+	kubeconfig, err := certs.GenerateKubeconfig(secrets, lbConfig, constants.CertificateValidityTime)
+	require.NoError(t, err)
+
+	cfg, err := clientcmd.RESTConfigFromKubeConfig(kubeconfig)
+	require.NoError(t, err)
+
+	// cert should be fresh with default validity time
+	stale, err := certs.IsPEMEncodedCertificateStale(cfg.CertData, constants.CertificateValidityTime)
+	require.NoError(t, err)
+
+	require.False(t, stale)
+
+	// cert should be stale with double validity time
+	stale, err = certs.IsPEMEncodedCertificateStale(cfg.CertData, 2*constants.CertificateValidityTime)
+	require.NoError(t, err)
+
+	require.True(t, stale)
+}
diff --git a/internal/pkg/compress/compress.go b/internal/pkg/compress/compress.go
new file mode 100644
index 000000000..f07f04d97
--- /dev/null
+++ b/internal/pkg/compress/compress.go
@@ -0,0 +1,112 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package compress defines HTTP compression handlers.
+package compress
+
+import (
+	"compress/flate"
+	"compress/gzip"
+	"io"
+	"net/http"
+	"strings"
+)
+
+const (
+	acceptEncoding = "Accept-Encoding"
+	gzipEncoding   = "gzip"
+	flateEncoding  = "deflate"
+)
+
+type writerFlusherCloser interface {
+	io.WriteCloser
+	Flush() error
+}
+
+// Handler is an adapted version of the middleware from gorilla/handlers.
+func Handler(next http.Handler, level int) http.Handler {
+	if level < gzip.DefaultCompression || level > gzip.BestCompression {
+		panic("invalid compression level")
+	}
+
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !strings.Contains(w.Header().Get("Vary"), acceptEncoding) {
+			w.Header().Add("Vary", acceptEncoding)
+		}
+
+		if r.Header.Get("Upgrade") != "" {
+			next.ServeHTTP(w, r)
+
+			return
+		}
+
+		encoding := encoding(r)
+		if encoding == "" {
+			next.ServeHTTP(w, r)
+
+			return
+		}
+
+		var encWriter writerFlusherCloser
+
+		if encoding == gzipEncoding {
+			encWriter, _ = gzip.NewWriterLevel(w, level) //nolint:errcheck
+		} else if encoding == flateEncoding {
+			encWriter, _ = flate.NewWriter(w, level) //nolint:errcheck
+		}
+
+		defer encWriter.Close() //nolint:errcheck
+
+		w.Header().Set("Content-Encoding", encoding)
+		r.Header.Del(acceptEncoding)
+
+		next.ServeHTTP(&compressResponseWriter{w: w, c: encWriter}, r)
+	})
+}
+
+func encoding(r *http.Request) string {
+	for _, encPart := range strings.Split(r.Header.Get(acceptEncoding), ",") {
+		encPart = strings.TrimSpace(encPart)
+
+		if encPart == gzipEncoding || encPart == flateEncoding {
+			return encPart
+		}
+	}
+
+	return ""
+}
+
+type compressResponseWriter struct {
+	w http.ResponseWriter
+	c writerFlusherCloser
+}
+
+func (cw *compressResponseWriter) Header() http.Header { return cw.w.Header() }
+
+func (cw *compressResponseWriter) WriteHeader(c int) {
+	cw.w.Header().Del("Content-Length")
+	cw.w.WriteHeader(c)
+}
+
+func (cw *compressResponseWriter) Write(b []byte) (int, error) {
+	h := cw.w.Header()
+
+	h.Del("Content-Length")
+
+	if h.Get("Content-Type") == "" {
+		h.Set("Content-Type", http.DetectContentType(b))
+	}
+
+	return cw.c.Write(b)
+}
+
+func (cw *compressResponseWriter) Flush() {
+	cw.c.Flush() //nolint:errcheck
+
+	// Flush HTTP response.
+	if f, ok := cw.w.(http.Flusher); ok {
+		f.Flush()
+	}
+}
diff --git a/internal/pkg/config/auth.go b/internal/pkg/config/auth.go
new file mode 100644
index 000000000..a554f9d10
--- /dev/null
+++ b/internal/pkg/config/auth.go
@@ -0,0 +1,63 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package config
+
+import "encoding/json"
+
+// AuthParams configures authentication.
+//
+//nolint:govet
+type AuthParams struct {
+	Auth0    Auth0Params    `yaml:"auth0"`
+	WebAuthn WebAuthnParams `yaml:"webauthn"`
+	SAML     SAMLParams     `yaml:"saml"`
+
+	Suspended bool `yaml:"suspended"`
+}
+
+// Auth0Params holds configuration parameters for Auth0.
+type Auth0Params struct {
+	Domain   string `yaml:"domain"`
+	ClientID string `yaml:"clientID"`
+	Enabled  bool   `yaml:"enabled"`
+}
+
+// WebAuthnParams holds configuration parameters for WebAuthn.
+type WebAuthnParams struct {
+	Enabled  bool `yaml:"enabled"`
+	Required bool `yaml:"required"`
+}
+
+// SAMLParams holds configuration parameters for SAML auth.
+type SAMLParams struct {
+	LabelRules SAMLLabelRules `yaml:"labelRules"`
+	URL        string         `yaml:"url"`
+	Metadata   string         `yaml:"metadata"`
+	Enabled    bool           `yaml:"enabled"`
+}
+
+// SAMLLabelRules defines mapping of SAML assertion attributes to Omni identity labels.
+type SAMLLabelRules map[string]string
+
+// String implements pflag.Value.
+func (s SAMLLabelRules) String() string {
+	b, err := json.Marshal(s)
+	if err != nil {
+		panic(err)
+	}
+
+	return string(b)
+}
+
+// Set implements pflag.Value.
+func (s *SAMLLabelRules) Set(value string) error {
+	return json.Unmarshal([]byte(value), &s)
+}
+
+// Type implements pflag.Value.
+func (SAMLLabelRules) Type() string {
+	return "JSON encoded key/value map"
+}
diff --git a/internal/pkg/config/config.go b/internal/pkg/config/config.go
new file mode 100644
index 000000000..72cb6f1be
--- /dev/null
+++ b/internal/pkg/config/config.go
@@ -0,0 +1,344 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package config contains the application config loading functions.
+package config
+
+import (
+	"errors"
+	"fmt"
+	"net"
+	"net/url"
+	"time"
+
+	"github.com/siderolabs/talos/pkg/machinery/config/generate"
+	"go.uber.org/zap/zapcore"
+
+	consts "github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/common"
+)
+
+const (
+	wireguardDefaultPort = "50180"
+)
+
+// Params defines application configs.
+//
+//nolint:govet
+type Params struct {
+	// AccountID is the stable identifier of the instance.
+	//
+	// Omni will use that to build paths to etcd storage, etc.
+	AccountID string `yaml:"account_id"`
+	// Name is the user-facing name of the instance.
+	//
+	// Omni will use to present some information to the user.
+	// Name can be changed at any time.
+	Name string `yaml:"name"`
+
+	APIURL                string `yaml:"apiURL"`
+	MachineAPIBindAddress string `yaml:"apiBindAddress"`
+	MachineAPICertFile    string `yaml:"apiCertFile"`
+	MachineAPIKeyFile     string `yaml:"apiKeyFile"`
+
+	KubernetesProxyURL                   string `yaml:"kubernetesProxyURL"`
+	SiderolinkEnabled                    bool   `yaml:"siderolinkEnabled"`
+	SiderolinkWireguardBindAddress       string `yaml:"siderolinkWireguardBindAddress"`
+	SiderolinkWireguardAdvertisedAddress string `yaml:"siderolinkWireguardAdvertisedAddress"`
+	SiderolinkDisableLastEndpoint        bool   `yaml:"siderolinkDisableLastEndpoint"`
+
+	EventSinkPort    int                `yaml:"eventSinkPort"`
+	SideroLinkAPIURL string             `yaml:"siderolinkAPIURL"`
+	LoadBalancer     LoadBalancerParams `yaml:"loadbalancer"`
+	LogServerPort    int                `yaml:"logServerPort"`
+
+	LogStorage LogStorageParams `yaml:"logStorage"`
+
+	Auth AuthParams `yaml:"auth"`
+
+	InitialUsers []string `yaml:"initialUsers"`
+
+	TalosRegistry string `yaml:"talosRegistry"`
+
+	KubernetesRegistry string `yaml:"kubernetesRegistry"`
+
+	ImageFactoryBaseURL    string `yaml:"imageFactoryAddress"`
+	ImageFactoryPXEBaseURL string `yaml:"imageFactoryProxyAddress"`
+
+	Storage StorageParams `yaml:"storage"`
+
+	SecondaryStorage BoltDBParams `yaml:"secondaryStorage"`
+
+	DefaultConfigGenOptions []generate.Option `yaml:"-" json:"-"`
+
+	KeyPruner KeyPrunerParams `yaml:"keyPruner"`
+
+	EnableTalosPreReleaseVersions bool `yaml:"enableTalosPreReleaseVersions"`
+
+	WorkloadProxying WorkloadProxyingParams `yaml:"workloadProxying"`
+
+	LocalResourceServerPort int `yaml:"localResourceServerPort"`
+
+	EtcdBackup EtcdBackupParams `yaml:"etcdBackup"`
+
+	DisableControllerRuntimeCache bool `yaml:"disableControllerRuntimeCache"`
+
+	LogResourceUpdatesTypes    []string
+	LogResourceUpdatesLogLevel string
+}
+
+// EtcdBackupParams defines etcd backup configs.
+type EtcdBackupParams struct {
+	LocalPath    string        `yaml:"localPath"`
+	S3Enabled    bool          `yaml:"s3Enabled"`
+	TickInterval time.Duration `yaml:"tickInterval"`
+	MinInterval  time.Duration `yaml:"minInterval"`
+	MaxInterval  time.Duration `yaml:"maxInterval"`
+}
+
+// GetStorageType returns the storage type.
+func (ebp EtcdBackupParams) GetStorageType() (EtcdBackupStorage, error) {
+	if ebp.LocalPath != "" && ebp.S3Enabled {
+		return "", errors.New("both localPath and s3 are set")
+	}
+
+	switch {
+	case ebp.LocalPath == "" && !ebp.S3Enabled:
+		return EtcdBackupTypeS3, nil
+	case ebp.LocalPath != "":
+		return EtcdBackupTypeFS, nil
+	case ebp.S3Enabled:
+		return EtcdBackupTypeS3, nil
+	default:
+		return "", errors.New("unknown backup storage type")
+	}
+}
+
+// WorkloadProxyingParams defines workload proxying configs.
+type WorkloadProxyingParams struct {
+	Enabled bool `yaml:"enabled"`
+}
+
+// LoadBalancerParams defines load balancer configs.
+type LoadBalancerParams struct {
+	MinPort int `yaml:"minPort"`
+	MaxPort int `yaml:"maxPort"`
+
+	DialTimeout     time.Duration `yaml:"dialTimeout"`
+	KeepAlivePeriod time.Duration `yaml:"keepAlivePeriod"`
+	TCPUserTimeout  time.Duration `yaml:"tcpUserTimeout"`
+
+	HealthCheckInterval time.Duration `yaml:"healthCheckInterval"`
+	HealthCheckTimeout  time.Duration `yaml:"healthCheckTimeout"`
+}
+
+// StorageParams defines storage configs.
+type StorageParams struct {
+	// Kind can be either 'boltdb' or 'etcd'.
+	Kind   string       `yaml:"kind"`
+	Boltdb BoltDBParams `yaml:"boltdb"`
+	Etcd   EtcdParams   `yaml:"etcd"`
+}
+
+// BoltDBParams defines boltdb storage configs.
+type BoltDBParams struct {
+	Path string `yaml:"path"`
+}
+
+// EtcdParams defines etcd storage configs.
+type EtcdParams struct { ///nolint:govet
+	// External etcd: list of endpoints, as host:port pairs.
+	Endpoints []string `yaml:"endpoints"`
+	CAPath    string   `yaml:"caPath"`
+	CertPath  string   `yaml:"certPath"`
+	KeyPath   string   `yaml:"keyPath"`
+
+	// Use embedded etcd server (no clustering).
+	Embedded            bool   `yaml:"embedded"`
+	EmbeddedDBPath      string `yaml:"embeddedDBPath"`
+	EmbeddedUnsafeFsync bool   `yaml:"embeddedUnsafeFsync"`
+
+	PrivateKeySource string   `yaml:"privateKeySource"`
+	PublicKeyFiles   []string `yaml:"publicKeysFiles"`
+}
+
+// KeyPrunerParams defines key pruner configs.
+type KeyPrunerParams struct {
+	Interval time.Duration `yaml:"interval"`
+}
+
+// LogStorageParams defines log storage configuration.
+type LogStorageParams struct {
+	Path        string        `yaml:"directory"`
+	FlushPeriod time.Duration `yaml:"flushPeriod"`
+	Enabled     bool          `yaml:"enabled"`
+}
+
+var (
+	localIP = getLocalIPOrEmpty()
+
+	// Config holds the application config and provides the default values for it.
+	Config = &Params{
+		AccountID:                            "edd2822a-7834-4fe0-8172-cc5581f13a8d",
+		Name:                                 "default",
+		APIURL:                               fmt.Sprintf("http://%s", net.JoinHostPort("localhost", "8080")),
+		KubernetesProxyURL:                   fmt.Sprintf("https://%s", net.JoinHostPort("localhost", "8095")),
+		SiderolinkEnabled:                    true,
+		SiderolinkWireguardBindAddress:       net.JoinHostPort("0.0.0.0", wireguardDefaultPort),
+		SiderolinkWireguardAdvertisedAddress: net.JoinHostPort(localIP, wireguardDefaultPort),
+		MachineAPIBindAddress:                net.JoinHostPort(localIP, "8090"),
+		EventSinkPort:                        8090,
+		SideroLinkAPIURL:                     fmt.Sprintf("grpc://%s", net.JoinHostPort(localIP, "8090")),
+		LoadBalancer: LoadBalancerParams{
+			MinPort: 10000,
+			MaxPort: 35000,
+
+			DialTimeout:     15 * time.Second,
+			KeepAlivePeriod: 30 * time.Second,
+			TCPUserTimeout:  30 * time.Second,
+
+			HealthCheckInterval: 20 * time.Second,
+			HealthCheckTimeout:  15 * time.Second,
+		},
+		KeyPruner: KeyPrunerParams{
+			Interval: 10 * time.Minute,
+		},
+		LogServerPort: 8092,
+		LogStorage: LogStorageParams{
+			Enabled:     true,
+			Path:        "_out/logs",
+			FlushPeriod: 10 * time.Minute,
+		},
+		TalosRegistry:       consts.TalosRegistry,
+		KubernetesRegistry:  consts.KubernetesRegistry,
+		ImageFactoryBaseURL: consts.ImageFactoryBaseURL,
+		Storage: StorageParams{
+			Kind: "etcd",
+			Boltdb: BoltDBParams{
+				Path: "_out/omni.db",
+			},
+			Etcd: EtcdParams{
+				Endpoints: []string{"http://localhost:2379"},
+				CAPath:    "etcd/ca.crt",
+				CertPath:  "etcd/client.crt",
+				KeyPath:   "etcd/client.key",
+
+				Embedded:       true,
+				EmbeddedDBPath: "_out/etcd/",
+			},
+		},
+
+		SecondaryStorage: BoltDBParams{
+			Path: "_out/secondary-storage/bolt.db",
+		},
+
+		WorkloadProxying: WorkloadProxyingParams{
+			Enabled: true,
+		},
+
+		LocalResourceServerPort: 8081,
+
+		EtcdBackup: EtcdBackupParams{
+			TickInterval: time.Minute,
+			MinInterval:  time.Hour,
+			MaxInterval:  24 * time.Hour,
+		},
+
+		LogResourceUpdatesLogLevel: zapcore.InfoLevel.String(),
+		LogResourceUpdatesTypes:    common.UserManagedResourceTypes,
+	}
+)
+
+// GetImageFactoryPXEBaseURL reads image factory PXE address from the args.
+func (p *Params) GetImageFactoryPXEBaseURL() (*url.URL, error) {
+	if p.ImageFactoryPXEBaseURL != "" {
+		return url.Parse(p.ImageFactoryPXEBaseURL)
+	}
+
+	url, err := url.Parse(p.ImageFactoryBaseURL)
+	if err != nil {
+		return nil, fmt.Errorf("invalid URL specified for the image factory: %w", err)
+	}
+
+	url.Host = fmt.Sprintf("pxe.%s", url.Host)
+
+	return url, nil
+}
+
+// GetAdvertisedAPIHost returns the advertised host (IP or domain) of the API without the port.
+func (p *Params) GetAdvertisedAPIHost() (string, error) {
+	apiURL, err := url.Parse(p.SideroLinkAPIURL)
+	if err != nil {
+		return "", err
+	}
+
+	apiHost, _, err := net.SplitHostPort(apiURL.Host)
+	if err != nil {
+		apiHost = apiURL.Host
+	}
+
+	return apiHost, nil
+}
+
+// GetOIDCIssuerEndpoint returns the OIDC issuer endpoint.
+func (p *Params) GetOIDCIssuerEndpoint() (string, error) {
+	u, err := url.Parse(p.APIURL)
+	if err != nil {
+		return "", err
+	}
+
+	u.Path, err = url.JoinPath(u.Path, "/oidc")
+	if err != nil {
+		return "", err
+	}
+
+	return u.String(), nil
+}
+
+func getLocalIPOrEmpty() string {
+	ip, _ := getLocalIP() //nolint:errcheck
+
+	return ip
+}
+
+// getLocalIP returns the non-loopback local IP of the host, preferring IPv4 over IPv6.
+func getLocalIP() (string, error) {
+	addresses, err := net.InterfaceAddrs()
+	if err != nil {
+		return "", err
+	}
+
+	var firstIPV6 string
+
+	for _, address := range addresses {
+		if ipnet, ok := address.(*net.IPNet); ok && !ipnet.IP.IsLoopback() {
+			if ipnet.IP.To4() != nil {
+				return ipnet.IP.String(), nil
+			}
+
+			if firstIPV6 == "" {
+				firstIPV6 = ipnet.IP.String()
+			}
+		}
+	}
+
+	if firstIPV6 != "" {
+		return firstIPV6, nil
+	}
+
+	return "", errors.New("could not determine local IP address")
+}
+
+// EtcdBackupStorage defines etcd backup storage type.
+type EtcdBackupStorage string
+
+const (
+	// EtcdBackupTypeNone is the no backup storage type.
+	EtcdBackupTypeNone EtcdBackupStorage = "none"
+	// EtcdBackupTypeS3 is the S3 backup storage type.
+	EtcdBackupTypeS3 EtcdBackupStorage = "s3"
+	// EtcdBackupTypeFS is the filesystem backup storage type.
+	EtcdBackupTypeFS EtcdBackupStorage = "local"
+)
diff --git a/internal/pkg/constants/talos.go b/internal/pkg/constants/talos.go
new file mode 100644
index 000000000..a08217540
--- /dev/null
+++ b/internal/pkg/constants/talos.go
@@ -0,0 +1,22 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package constants keeps all constants which are used project wide.
+package constants
+
+// TODO: we should consider defining that in Talos machinery package.
+const (
+	// APIDService Talos APID service ID.
+	APIDService = "apid"
+)
+
+const (
+	// TaskResetSystemDiskSpec the disk was reset by using a reset spec
+	// In Omni we only reset and STATE and EPHEMERAL partitions.
+	TaskResetSystemDiskSpec = "resetSystemDiskSpec"
+)
+
+// KubePrismPort is the port for the API server load balancer (KubePrism) in Talos.
+const KubePrismPort = 7445
diff --git a/internal/pkg/constants/versions.go b/internal/pkg/constants/versions.go
new file mode 100644
index 000000000..7085ca0d2
--- /dev/null
+++ b/internal/pkg/constants/versions.go
@@ -0,0 +1,29 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package constants
+
+// AnotherTalosVersion is used in the integration tests for Talos upgrade.
+const AnotherTalosVersion = "1.6.3"
+
+// MinTalosVersion allowed to be used when creating the cluster.
+const MinTalosVersion = "1.3.0"
+
+// DefaultKubernetesVersion is pre-selected in the UI and used in the integration tests.
+//
+// tsgen:DefaultKubernetesVersion
+const DefaultKubernetesVersion = "1.29.1"
+
+// AnotherKubernetesVersion is used in the integration tests for Kubernetes upgrade.
+const AnotherKubernetesVersion = "1.28.5"
+
+// MinKubernetesVersion allowed to be used when creating the cluster.
+const MinKubernetesVersion = "1.24.0"
+
+// DenylistedTalosVersions is a list of versions which should never show up in the version picker.
+var DenylistedTalosVersions = map[string]struct{}{
+	"1.4.2": {}, // issue with the number of open files limit
+	"1.4.3": {}, // issue with the number of open files limit
+}
diff --git a/internal/pkg/errgroup/errgroup.go b/internal/pkg/errgroup/errgroup.go
new file mode 100644
index 000000000..5c74f1aa1
--- /dev/null
+++ b/internal/pkg/errgroup/errgroup.go
@@ -0,0 +1,81 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package errgroup is a small wrapper around Go's x/sync/errgroup.Group.
+package errgroup
+
+import (
+	"context"
+	"fmt"
+	"runtime/debug"
+
+	"golang.org/x/sync/errgroup"
+)
+
+// EGroup defines common interface for Group and x/sync/errgroup.Group.
+type EGroup interface {
+	Go(func() error)
+	Wait() error
+}
+
+// Group is wrapper around Go's x/sync/errgroup.Group. It's not a drop-in replacement for it, because
+// it requires initialization with WithContext.
+type Group struct {
+	group *errgroup.Group
+	ctx   context.Context //nolint:containedctx
+}
+
+// WithContext returns a new Group and an associated Context derived from ctx.
+//
+// The derived Context is canceled the first time a function passed to Go
+// returns or the first time Wait returns, whichever occurs
+// first.
+func WithContext(ctx context.Context) (*Group, context.Context) {
+	withContext, newCtx := errgroup.WithContext(ctx)
+
+	return &Group{group: withContext, ctx: newCtx}, newCtx
+}
+
+// Wait blocks until all function calls from the Go method have returned, then
+// returns the first non-nil error (if any) from them.
+func (g *Group) Wait() error {
+	return g.group.Wait()
+}
+
+// Go is small wrapper around errgroup.Group.Go. When f returns nil error, and group ctx was not canceled
+// it instead returns ReturnError thus canceling the group.
+func (g *Group) Go(f func() error) {
+	GoWithContext(g.ctx, g.group, f)
+}
+
+// ReturnError contains a stack trace of the function which called Group.Go.
+type ReturnError struct{ stack string }
+
+func (e *ReturnError) Error() string {
+	return fmt.Sprintf("sentinel error: function returned with nil error: %s", e.stack)
+}
+
+// GoWithContext is a small wrapper around errgroup.Group.Go. When f returns nil error, and ctx was not canceled
+// it instead returns ReturnError.
+//
+// It may be needed in situations where you use errgroup.Group without initializing it with WithContext.
+func GoWithContext(ctx context.Context, eg EGroup, f func() error) {
+	stack := debug.Stack()
+
+	eg.Go(func() error {
+		err := f()
+		if err != nil {
+			return err
+		}
+
+		if ctx.Err() == nil {
+			// If the context is not canceled, that means the function didn't return because it was
+			// canceled. So instead of nil we return a ReturnError.
+			return &ReturnError{stack: string(stack)}
+		}
+
+		return nil
+	})
+}
diff --git a/internal/pkg/errgroup/errgroup_test.go b/internal/pkg/errgroup/errgroup_test.go
new file mode 100644
index 000000000..ea6a53564
--- /dev/null
+++ b/internal/pkg/errgroup/errgroup_test.go
@@ -0,0 +1,62 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package errgroup_test
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/internal/pkg/errgroup"
+)
+
+func TestGroup(t *testing.T) {
+	t.Run("should not return an error if it was canceled", func(t *testing.T) {
+		ctx, cancel := context.WithCancel(context.Background())
+		eg, innerCtx := errgroup.WithContext(ctx)
+		eg.Go(func() error {
+			// We can't wait on parent `Done` here because `context` package closes `Done` channel before
+			// it cancels the children contexts.
+			<-innerCtx.Done()
+
+			// Or we could wait for parent `Err` method to unblock to achieve the same of effect.
+			// _ = ctx.Err()
+
+			return nil
+		})
+		cancel()
+
+		err := eg.Wait()
+
+		require.NoError(t, err)
+	})
+
+	t.Run("should return an error if it was canceled", func(t *testing.T) {
+		eg, _ := errgroup.WithContext(context.Background())
+		eg.Go(func() error { return nil })
+		err := eg.Wait()
+		require.Contains(t, err.Error(), "sentinel error: function returned with nil error")
+		require.Contains(t, err.Error(), "errgroup.(*Group).Go")
+		require.Contains(t, err.Error(), "internal/pkg/errgroup/errgroup.go:50", "unexpected stack trace - did the line numbers change in the source file? error:\n%s", err.Error())
+	})
+
+	t.Run("should return an error if it got an error", func(t *testing.T) {
+		eg, _ := errgroup.WithContext(context.Background())
+		eg.Go(func() error { return errors.New("error") })
+		err := eg.Wait()
+		require.Contains(t, err.Error(), "error")
+	})
+
+	t.Run("should not hit ReturnError path on second Go call", func(t *testing.T) {
+		eg, _ := errgroup.WithContext(context.Background())
+		eg.Go(func() error { return errors.New("error") })
+		err := eg.Wait()
+		eg.Go(func() error { return nil })
+		require.Contains(t, err.Error(), "error")
+	})
+}
diff --git a/internal/pkg/features/features.go b/internal/pkg/features/features.go
new file mode 100644
index 000000000..7d7841e0c
--- /dev/null
+++ b/internal/pkg/features/features.go
@@ -0,0 +1,66 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package features contains the feature flags related functionality.
+package features
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"go.uber.org/zap"
+	"google.golang.org/protobuf/types/known/durationpb"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+// UpdateResources creates or updates the features omni.FeaturesConfig resource with the current feature flags.
+func UpdateResources(ctx context.Context, st state.State, logger *zap.Logger) error {
+	updateFeaturesConfig := func(res *omni.FeaturesConfig) error {
+		res.TypedSpec().Value.EnableWorkloadProxying = config.Config.WorkloadProxying.Enabled
+		res.TypedSpec().Value.EtcdBackupSettings = &specs.EtcdBackupSettings{
+			TickInterval: durationpb.New(config.Config.EtcdBackup.TickInterval),
+			MinInterval:  durationpb.New(config.Config.EtcdBackup.MinInterval),
+			MaxInterval:  durationpb.New(config.Config.EtcdBackup.MaxInterval),
+		}
+
+		return nil
+	}
+
+	featuresConfig := omni.NewFeaturesConfig(resources.DefaultNamespace, omni.FeaturesConfigID)
+
+	_, err := st.Get(ctx, featuresConfig.Metadata())
+	if err != nil {
+		if !state.IsNotFoundError(err) {
+			return fmt.Errorf("failed to get features config: %w", err)
+		}
+
+		if err = updateFeaturesConfig(featuresConfig); err != nil {
+			return fmt.Errorf("failed to update features config: %w", err)
+		}
+
+		err = st.Create(ctx, featuresConfig)
+		if err != nil {
+			return fmt.Errorf("failed to create features config: %w", err)
+		}
+
+		logger.Info("created features config resource", zap.Bool("enable_workload_proxying", config.Config.WorkloadProxying.Enabled))
+
+		return nil
+	}
+
+	if _, err = safe.StateUpdateWithConflicts(ctx, st, featuresConfig.Metadata(), updateFeaturesConfig); err != nil {
+		return fmt.Errorf("failed to update features config: %w", err)
+	}
+
+	logger.Info("updated features config resource", zap.Bool("enable_workload_proxying", config.Config.WorkloadProxying.Enabled))
+
+	return nil
+}
diff --git a/internal/pkg/grpcutil/grpcutil.go b/internal/pkg/grpcutil/grpcutil.go
new file mode 100644
index 000000000..339e915dd
--- /dev/null
+++ b/internal/pkg/grpcutil/grpcutil.go
@@ -0,0 +1,46 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package grpcutil provides utilities for gRPC.
+package grpcutil
+
+import (
+	"errors"
+	"fmt"
+
+	"google.golang.org/grpc"
+)
+
+// FullMethodName returns full method name for the given gRPC method from the given gRPC service.
+func FullMethodName(serviceDesc *grpc.ServiceDesc, methodName string) (string, error) {
+	if methodName == "" {
+		return "", errors.New("method name is empty")
+	}
+
+	for _, method := range serviceDesc.Methods {
+		if method.MethodName == methodName {
+			return "/" + serviceDesc.ServiceName + "/" + method.MethodName, nil
+		}
+	}
+
+	for _, method := range serviceDesc.Streams {
+		if method.StreamName == methodName {
+			return "/" + serviceDesc.ServiceName + "/" + method.StreamName, nil
+		}
+	}
+
+	return "", fmt.Errorf("method %q not found in service %q", methodName, serviceDesc.ServiceName)
+}
+
+// MustFullMethodName is a helper function to get full method name for the given gRPC method from the given gRPC service.
+// It panics if method is not found.
+func MustFullMethodName(serviceDesc *grpc.ServiceDesc, methodName string) string {
+	fullMethodName, err := FullMethodName(serviceDesc, methodName)
+	if err != nil {
+		panic(err)
+	}
+
+	return fullMethodName
+}
diff --git a/internal/pkg/grpcutil/grpcutil_test.go b/internal/pkg/grpcutil/grpcutil_test.go
new file mode 100644
index 000000000..1b4591ddb
--- /dev/null
+++ b/internal/pkg/grpcutil/grpcutil_test.go
@@ -0,0 +1,73 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+package grpcutil_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/interop/grpc_testing"
+
+	"github.com/siderolabs/omni/internal/pkg/grpcutil"
+)
+
+func TestGetFullMethodName(t *testing.T) {
+	type args struct {
+		methodName string
+	}
+
+	tests := []struct {
+		want func(*testing.T, string, error)
+		name string
+		args args
+	}{
+		{
+			name: "proper method name",
+			args: args{
+				methodName: "EmptyCall",
+			},
+			want: func(t *testing.T, actual string, err error) {
+				require.NoError(t, err)
+				require.Equal(t, "/grpc.testing.TestService/EmptyCall", actual)
+			},
+		},
+		{
+			name: "incorrect method name",
+			args: args{
+				methodName: "Empty2Call",
+			},
+			want: equalError(`method "Empty2Call" not found in service "grpc.testing.TestService"`),
+		},
+		{
+			name: "empty method name",
+			args: args{
+				methodName: "",
+			},
+			want: equalError("method name is empty"),
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := grpcutil.FullMethodName(&grpc_testing.TestService_ServiceDesc, tt.args.methodName)
+			tt.want(t, got, err)
+		})
+	}
+
+	require.Panics(t, func() {
+		grpcutil.MustFullMethodName(&grpc_testing.TestService_ServiceDesc, "Empty2Call")
+	})
+
+	require.NotPanics(t, func() {
+		grpcutil.MustFullMethodName(&grpc_testing.TestService_ServiceDesc, "EmptyCall")
+	})
+}
+
+func equalError(eq string) func(*testing.T, string, error) {
+	return func(t *testing.T, _ string, err error) {
+		require.Error(t, err)
+		require.EqualError(t, err, eq)
+	}
+}
diff --git a/internal/pkg/grpcutil/logger.go b/internal/pkg/grpcutil/logger.go
new file mode 100644
index 000000000..3f9aad82b
--- /dev/null
+++ b/internal/pkg/grpcutil/logger.go
@@ -0,0 +1,247 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package grpcutil
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+
+	"github.com/cosi-project/runtime/api/v1alpha1"
+	grpc_zap "github.com/grpc-ecosystem/go-grpc-middleware/logging/zap"
+	grpc_ctxtags "github.com/grpc-ecosystem/go-grpc-middleware/tags"
+	"go.uber.org/zap/zapcore"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/siderolabs/omni/client/api/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/constants"
+)
+
+const (
+	// LogLevelOverrideMetadataKey is a metadata key that can be used to override the log level.
+	//
+	// Should only be used in debug mode.
+	LogLevelOverrideMetadataKey = "log-level-override"
+)
+
+// Hook is a function that can be used to modify the request or response before it is logged.
+type Hook func(req proto.Message) proto.Message
+
+// NewHook returns a hook that will rewrite the request or response using the provided rewriter.
+func NewHook(hooks ...Rewriter) Hook {
+	return func(req proto.Message) proto.Message {
+		for _, hook := range hooks {
+			res, ok := hook(req)
+			if ok {
+				return res
+			}
+		}
+
+		return req
+	}
+}
+
+// Rewriter is a function that can be used to modify the request or response before it is logged.
+type Rewriter func(req proto.Message) (proto.Message, bool)
+
+// NewRewriter returns a rewriter that will rewrite the copy of request or response using the provided rewriter.
+func NewRewriter[T proto.Message](f func(T) (T, bool)) Rewriter {
+	return func(req proto.Message) (proto.Message, bool) {
+		typedReq, ok := req.(T)
+		if !ok {
+			return req, false
+		}
+
+		return f(proto.Clone(typedReq).(T)) //nolint:forcetypeassert
+	}
+}
+
+type jsonpbObjectMarshaler struct {
+	pb        proto.Message
+	bodyLimit int
+}
+
+func (j *jsonpbObjectMarshaler) MarshalLogObject(e zapcore.ObjectEncoder) error {
+	// ZAP jsonEncoder deals with AddReflect by using json.MarshalObject. The same thing applies for consoleEncoder.
+	return e.AddReflected("msg", j)
+}
+
+func (j *jsonpbObjectMarshaler) MarshalJSON() ([]byte, error) {
+	res, err := marshaller.Marshal(j.pb)
+	if err != nil {
+		return nil, fmt.Errorf("json serializer failed: %w", err)
+	}
+
+	if j.bodyLimit > 0 && len(res) > j.bodyLimit {
+		res = res[:j.bodyLimit]
+	}
+
+	return res, nil
+}
+
+var marshaller = protojson.MarshalOptions{}
+
+// SetRealPeerAddress returns a new unary server interceptor that adds the real peer address for "peer.address" tag.
+func SetRealPeerAddress() grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req any, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+		setRealIPAddress(ctx)
+
+		return handler(ctx, req)
+	}
+}
+
+// SetUserAgent returns a new unary server interceptor that adds user agent to the list of ctxtags.
+func SetUserAgent() grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req any, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+		setUserAgent(ctx)
+
+		return handler(ctx, req)
+	}
+}
+
+// InterceptBodyToTags returns a new unary server interceptor that adds request and response body to the list ctxtags.
+func InterceptBodyToTags(hook Hook, bodyLimit int) grpc.UnaryServerInterceptor {
+	return func(ctx context.Context, req any, _ *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+		if r, ok := req.(proto.Message); ok {
+			grpc_ctxtags.Extract(ctx).Set("grpc.request.content", &jsonpbObjectMarshaler{pb: hook(r), bodyLimit: bodyLimit})
+		}
+
+		resp, err := handler(ctx, req)
+		if r, ok := resp.(proto.Message); ok {
+			grpc_ctxtags.Extract(ctx).Set("grpc.response.content", &jsonpbObjectMarshaler{pb: hook(r), bodyLimit: bodyLimit})
+		}
+
+		return resp, err
+	}
+}
+
+func setRealIPAddress(ctx context.Context) {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if ok {
+		for _, hdr := range []string{"x-forwarded-for", "x-real-ip"} {
+			peer := md.Get(hdr)
+			if len(peer) == 0 {
+				continue
+			}
+
+			addr, err := netip.ParseAddr(peer[0])
+			if err != nil {
+				continue
+			}
+
+			grpc_ctxtags.Extract(ctx).Set("peer.address", addr.String())
+
+			break
+		}
+	}
+}
+
+func setUserAgent(ctx context.Context) {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if ok {
+		for _, hdr := range []string{"grpcgateway-user-agent", "user-agent"} {
+			if ua := md.Get(hdr); len(ua) > 0 {
+				grpc_ctxtags.Extract(ctx).Set("user_agent", ua[0])
+
+				break
+			}
+		}
+	}
+}
+
+// SetShouldLog marks the context to log the request.
+func SetShouldLog(ctx context.Context, system string) {
+	grpc_ctxtags.Extract(ctx).Set("request_log_initiator", system)
+}
+
+// AddLogPair adds a key-value pair to the context.
+func AddLogPair(ctx context.Context, key string, val any) {
+	grpc_ctxtags.Extract(ctx).Set(key, val)
+}
+
+// ShouldLog returns true if the request should be logged.
+func ShouldLog(ctx context.Context) bool {
+	return grpc_ctxtags.Extract(ctx).Has("request_log_initiator")
+}
+
+const successLogLevelTag = "grpc.success_log_level"
+
+// LogLevelOverridingMessageProducer returns a new message producer
+// that overrides the log level based on the incoming context.
+func LogLevelOverridingMessageProducer(wrapped grpc_zap.MessageProducer) grpc_zap.MessageProducer {
+	return func(ctx context.Context, msg string, level zapcore.Level, code codes.Code, err error, duration zapcore.Field) {
+		if code == codes.OK {
+			tags := grpc_ctxtags.Extract(ctx).Values()
+			if logLevel, ok := tags[successLogLevelTag].(zapcore.Level); ok {
+				delete(tags, successLogLevelTag)
+
+				level = logLevel
+			}
+		}
+
+		if !constants.IsDebugBuild {
+			wrapped(ctx, msg, level, code, err, duration)
+
+			return
+		}
+
+		// this is a debug build, so we additionally check the log level override header
+
+		shouldLog := true
+
+		md, ok := metadata.FromIncomingContext(ctx)
+		if ok {
+			logLevels := md.Get(LogLevelOverrideMetadataKey)
+			if len(logLevels) > 0 {
+				parsedLevel, parseErr := zapcore.ParseLevel(logLevels[0])
+				if parseErr == nil {
+					shouldLog = level >= parsedLevel
+				}
+			}
+		}
+
+		if shouldLog {
+			wrapped(ctx, msg, level, code, err, duration)
+		}
+	}
+}
+
+// LogLevelInterceptors returns a pair of unary and stream server interceptors that control the log level based on the GRPC method.
+//
+// Currently, the log levels of the read operations on the COSI ResourceService are overridden to the debug level.
+func LogLevelInterceptors() (grpc.UnaryServerInterceptor, grpc.StreamServerInterceptor) {
+	isReadMethod := func(method string) bool {
+		switch method {
+		case resources.ResourceService_Get_FullMethodName, resources.ResourceService_List_FullMethodName, resources.ResourceService_Watch_FullMethodName,
+			v1alpha1.State_Get_FullMethodName, v1alpha1.State_List_FullMethodName, v1alpha1.State_Watch_FullMethodName:
+			return true
+		default:
+			return false
+		}
+	}
+
+	unary := func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+		if isReadMethod(info.FullMethod) {
+			grpc_ctxtags.Extract(ctx).Set(successLogLevelTag, zapcore.DebugLevel)
+		}
+
+		return handler(ctx, req)
+	}
+
+	stream := func(srv any, stream grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		if isReadMethod(info.FullMethod) {
+			grpc_ctxtags.Extract(stream.Context()).Set(successLogLevelTag, zapcore.DebugLevel)
+		}
+
+		return handler(srv, stream)
+	}
+
+	return unary, stream
+}
diff --git a/internal/pkg/grpcutil/logger_test.go b/internal/pkg/grpcutil/logger_test.go
new file mode 100644
index 000000000..d5b4eb673
--- /dev/null
+++ b/internal/pkg/grpcutil/logger_test.go
@@ -0,0 +1,168 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package grpcutil_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"testing"
+	"time"
+
+	grpc_zap "github.com/grpc-ecosystem/go-grpc-middleware/logging/zap"
+	grpc_ctxtags "github.com/grpc-ecosystem/go-grpc-middleware/tags"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/interop/grpc_testing"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/internal/pkg/grpcutil"
+)
+
+func TestPayloadUnaryServerInterceptor(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		panic(err)
+	}
+
+	defer runNoErr(listener.Close, "failed to close listener")
+
+	var dst bytes.Buffer
+	logger := newLogger(&dst)
+
+	server := grpc.NewServer(grpc.ChainUnaryInterceptor(
+		grpc_ctxtags.UnaryServerInterceptor(),
+		grpc_zap.UnaryServerInterceptor(logger,
+			grpc_zap.WithTimestampFormat(""),
+			grpc_zap.WithDurationField(func(_ time.Duration) zap.Field {
+				return zap.Float64("grpc.duration", 1)
+			}),
+		),
+		grpcutil.SetUserAgent(),
+		grpcutil.SetRealPeerAddress(),
+		grpcutil.InterceptBodyToTags(grpcutil.NewHook(
+			grpcutil.NewRewriter(func(req *grpc_testing.SimpleRequest) (*grpc_testing.SimpleRequest, bool) {
+				req.Payload.Body = nil
+
+				return req, true
+			}),
+			grpcutil.NewRewriter(func(res *grpc_testing.SimpleResponse) (*grpc_testing.SimpleResponse, bool) {
+				res.Username = "REDACTED"
+
+				return res, true
+			}),
+		), 1024),
+	))
+
+	grpc_testing.RegisterTestServiceServer(server, &testService{})
+
+	errCh := make(chan error, 1)
+
+	go func() {
+		errCh <- server.Serve(listener)
+	}()
+
+	dial, err := grpc.Dial(listener.Addr().String(),
+		grpc.WithTransportCredentials(insecure.NewCredentials()),
+		grpc.WithBlock(),
+	)
+	if err != nil {
+		panic(err)
+	}
+
+	defer runNoErr(dial.Close, "failed to close dial")
+
+	client := grpc_testing.NewTestServiceClient(dial)
+	ctx := metadata.NewOutgoingContext(context.Background(), metadata.Pairs("grpcgateway-user-agent", "test", "x-forwarded-for", "10.10.10.10"))
+
+	res, err := client.UnaryCall(ctx, &grpc_testing.SimpleRequest{
+		Payload: &grpc_testing.Payload{
+			Body: []byte("Hello World"),
+		},
+		FillUsername:   true,
+		FillOauthScope: true,
+	})
+	if err != nil {
+		panic(err)
+	}
+
+	if res.Username != "MyUserName" {
+		panic("username should be MyUserName")
+	}
+
+	server.Stop()
+
+	if err := <-errCh; err != nil {
+		panic(err)
+	}
+
+	var actualOutput map[string]any
+
+	require.NoError(t, json.Unmarshal(dst.Bytes(), &actualOutput))
+	require.Equal(t, expectedOutput, actualOutput)
+}
+
+func newLogger(dst io.Writer) *zap.Logger {
+	encoderCfg := zapcore.EncoderConfig{
+		MessageKey:     "msg",
+		LevelKey:       "level",
+		NameKey:        "logger",
+		EncodeLevel:    zapcore.LowercaseLevelEncoder,
+		EncodeTime:     zapcore.ISO8601TimeEncoder,
+		EncodeDuration: zapcore.StringDurationEncoder,
+	}
+
+	core := zapcore.NewCore(zapcore.NewJSONEncoder(encoderCfg), zapcore.AddSync(dst), zap.DebugLevel)
+
+	return zap.New(core)
+}
+
+func runNoErr(c func() error, s string) {
+	if err := c(); err != nil {
+		if errors.Is(err, net.ErrClosed) {
+			return
+		}
+
+		panic(fmt.Errorf("%s: %w", s, err))
+	}
+}
+
+type testService struct {
+	grpc_testing.UnimplementedTestServiceServer
+}
+
+func (t *testService) UnaryCall(_ context.Context, req *grpc_testing.SimpleRequest) (*grpc_testing.SimpleResponse, error) {
+	if req.Payload.Body == nil || string(req.Payload.Body) != "Hello World" {
+		return nil, status.Errorf(codes.InvalidArgument, "payload body is incorrect")
+	}
+
+	return &grpc_testing.SimpleResponse{
+		Payload:    nil,
+		Username:   "MyUserName",
+		OauthScope: "Scope",
+	}, nil
+}
+
+//nolint:lll
+var expectedOutput = func() map[string]any {
+	const line = `{"level":"info","msg":"finished unary call with code OK","grpc.start_time":"","system":"grpc","span.kind":"server","grpc.service":"grpc.testing.TestService","grpc.method":"UnaryCall","grpc.request.content":{"msg":{"payload":{},"fillUsername":true,"fillOauthScope":true}},"grpc.response.content":{"msg":{"username":"REDACTED","oauthScope":"Scope"}},"peer.address":"10.10.10.10","user_agent":"test","grpc.code":"OK","grpc.duration":1}`
+
+	dst := map[string]any{}
+	if err := json.Unmarshal([]byte(line), &dst); err != nil {
+		panic(err)
+	}
+
+	return dst
+}()
diff --git a/internal/pkg/grpcutil/server.go b/internal/pkg/grpcutil/server.go
new file mode 100644
index 000000000..8a2d8d768
--- /dev/null
+++ b/internal/pkg/grpcutil/server.go
@@ -0,0 +1,57 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package grpcutil provides utilities for gRPC.
+package grpcutil
+
+import (
+	"context"
+	"errors"
+	"net"
+	"time"
+
+	"google.golang.org/grpc"
+
+	"github.com/siderolabs/omni/internal/pkg/errgroup"
+)
+
+// RunServer starts gRPC server on top of the provided listener, stops it when the context is done.
+func RunServer(ctx context.Context, server *grpc.Server, lis net.Listener, eg *errgroup.Group) {
+	eg.Go(func() error {
+		err := server.Serve(lis)
+		if !errors.Is(err, grpc.ErrServerStopped) {
+			return err
+		}
+
+		return nil
+	})
+
+	eg.Go(func() error {
+		serverGracefulStop(server, ctx)
+
+		return nil
+	})
+}
+
+func serverGracefulStop(server *grpc.Server, ctx context.Context) { //nolint:revive
+	<-ctx.Done()
+
+	stopped := make(chan struct{})
+
+	shutdownCtx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+
+	go func() {
+		server.GracefulStop()
+		close(stopped)
+	}()
+
+	select {
+	case <-shutdownCtx.Done():
+		server.Stop()
+	case <-stopped:
+		server.Stop()
+	}
+}
diff --git a/internal/pkg/grpcutil/stream_interceptors.go b/internal/pkg/grpcutil/stream_interceptors.go
new file mode 100644
index 000000000..824fd2103
--- /dev/null
+++ b/internal/pkg/grpcutil/stream_interceptors.go
@@ -0,0 +1,89 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package grpcutil
+
+import (
+	"context"
+
+	grpc_ctxtags "github.com/grpc-ecosystem/go-grpc-middleware/tags"
+	"google.golang.org/grpc"
+	"google.golang.org/protobuf/proto"
+)
+
+// StreamSetRealPeerAddress returns a new stream server interceptor that adds the real peer address for "peer.address" tag.
+func StreamSetRealPeerAddress() grpc.StreamServerInterceptor {
+	return func(srv any, ss grpc.ServerStream, _ *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		setRealIPAddress(ss.Context())
+
+		return handler(srv, ss)
+	}
+}
+
+// StreamSetUserAgent returns a new stream server interceptor that adds user agent to the list of ctxtags.
+func StreamSetUserAgent() grpc.StreamServerInterceptor {
+	return func(srv any, ss grpc.ServerStream, _ *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		setUserAgent(ss.Context())
+
+		return handler(srv, ss)
+	}
+}
+
+// StreamIntercept returns a new stream server interceptor that calls the given hook functions.
+func StreamIntercept(hooks StreamHooks) grpc.StreamServerInterceptor {
+	return func(srv any, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
+		return handler(srv, &serverStreamHook{
+			ServerStream: ss,
+			info:         info,
+			hooks:        hooks,
+		})
+	}
+}
+
+// RecvMsgHandler is a function that handles received message.
+type RecvMsgHandler func(msg any) error
+
+// RecvMsgHook is a hook function for RecvMsgHandler.
+type RecvMsgHook func(ctx context.Context, msg any, info *grpc.StreamServerInfo, handler RecvMsgHandler) error
+
+// StreamHooks is a set of hooks that are called when a stream is intercepted.
+type StreamHooks struct {
+	RecvMsg RecvMsgHook
+}
+
+type serverStreamHook struct {
+	grpc.ServerStream
+	info  *grpc.StreamServerInfo
+	hooks StreamHooks
+}
+
+func (s *serverStreamHook) RecvMsg(msg any) error {
+	if s.hooks.RecvMsg != nil {
+		return s.hooks.RecvMsg(s.Context(), msg, s.info, s.ServerStream.RecvMsg)
+	}
+
+	return s.ServerStream.RecvMsg(msg)
+}
+
+// StreamInterceptRequestBodyToTags returns a new stream server interceptor that adds request body to the list of ctxtags.
+// It uses the given hook function to override proto message.
+func StreamInterceptRequestBodyToTags(hook Hook, bodyLimit int) RecvMsgHook {
+	return func(ctx context.Context, msg any, info *grpc.StreamServerInfo, handler RecvMsgHandler) error {
+		if info.IsClientStream {
+			return handler(msg)
+		}
+
+		result := handler(msg)
+
+		if actualMsg, ok := msg.(proto.Message); ok {
+			grpc_ctxtags.Extract(ctx).Set("grpc.request.content", &jsonpbObjectMarshaler{
+				pb:        hook(actualMsg),
+				bodyLimit: bodyLimit,
+			})
+		}
+
+		return result
+	}
+}
diff --git a/internal/pkg/image/image.go b/internal/pkg/image/image.go
new file mode 100644
index 000000000..16eb66f80
--- /dev/null
+++ b/internal/pkg/image/image.go
@@ -0,0 +1,27 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package image contains the container image helpers.
+package image
+
+import (
+	"fmt"
+
+	"github.com/containers/image/docker/reference"
+)
+
+// GetTag returns image tag if it's available.
+func GetTag(imageRef string) (string, error) {
+	ref, err := reference.Parse(imageRef)
+	if err != nil {
+		return "", err
+	}
+
+	if tagged, ok := ref.(reference.Tagged); ok {
+		return tagged.Tag(), nil
+	}
+
+	return "", fmt.Errorf("image reference %q doesn't have a tag", imageRef)
+}
diff --git a/internal/pkg/image/image_test.go b/internal/pkg/image/image_test.go
new file mode 100644
index 000000000..959abe9aa
--- /dev/null
+++ b/internal/pkg/image/image_test.go
@@ -0,0 +1,65 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package image_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/internal/pkg/image"
+)
+
+func TestGetTag(t *testing.T) {
+	t.Parallel()
+
+	for _, test := range []struct {
+		name    string
+		input   string
+		want    string
+		wantErr string
+	}{
+		{
+			name:  "valid image",
+			input: "docker.io/autonomy/installer:latest",
+			want:  "latest",
+		},
+		{
+			name:  "image with version",
+			input: "registry.k8s.io/kube-apiserver:v1.26.1",
+			want:  "v1.26.1",
+		},
+		{
+			name:    "image with digest",
+			input:   "registry.k8s.io/kube-apiserver@sha256:99e1ed9fbc8a8d36a70f148f25130c02e0e366875249906be0bcb2c2d9df0c26",
+			wantErr: `image reference "registry.k8s.io/kube-apiserver@sha256:99e1ed9fbc8a8d36a70f148f25130c02e0e366875249906be0bcb2c2d9df0c26" doesn't have a tag`,
+		},
+		{
+			name:    "iamge without tag",
+			input:   "docker.io/autonomy/installer",
+			wantErr: `image reference "docker.io/autonomy/installer" doesn't have a tag`,
+		},
+		{
+			name:    "invalid image",
+			input:   "docker.io/autonomy/installer:latest:latest",
+			wantErr: "invalid reference format",
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+
+			got, err := image.GetTag(test.input)
+			if test.wantErr != "" {
+				assert.EqualError(t, err, test.wantErr)
+			} else {
+				require.NoError(t, err)
+
+				assert.Equal(t, test.want, got)
+			}
+		})
+	}
+}
diff --git a/internal/pkg/kms/kms.go b/internal/pkg/kms/kms.go
new file mode 100644
index 000000000..65a760ecc
--- /dev/null
+++ b/internal/pkg/kms/kms.go
@@ -0,0 +1,54 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package kms implements Omni KMS server for disk encryption keys.
+package kms
+
+import (
+	"context"
+
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/kms-client/api/kms"
+	"github.com/siderolabs/kms-client/pkg/server"
+	"go.uber.org/zap"
+	"google.golang.org/grpc"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+)
+
+// Manager handles disk encryption keys seal/unseal operations using COSI state and existing machines.
+type Manager struct {
+	state  state.State
+	logger *zap.Logger
+}
+
+// NewManager creates new KMS key manager.
+func NewManager(state state.State, logger *zap.Logger) *Manager {
+	return &Manager{
+		state:  state,
+		logger: logger,
+	}
+}
+
+// Register manager to handle gRPC requests for seal and unseal.
+func (m *Manager) Register(srv *grpc.Server) {
+	grpcServer := server.NewServer(func(ctx context.Context, nodeUUID string) ([]byte, error) {
+		ctx = actor.MarkContextAsInternalActor(ctx)
+
+		res, err := safe.StateGet[*omni.ClusterMachineEncryptionKey](ctx, m.state, omni.NewClusterMachineEncryptionKey(resources.DefaultNamespace, nodeUUID).Metadata())
+		if err != nil {
+			m.logger.Error("failed to get encryption key for node", zap.String("machine", nodeUUID), zap.Error(err))
+
+			return nil, err
+		}
+
+		return res.TypedSpec().Value.Data, nil
+	})
+
+	kms.RegisterKMSServiceServer(srv, grpcServer)
+}
diff --git a/internal/pkg/kubernetes/resource/kubernetes.go b/internal/pkg/kubernetes/resource/kubernetes.go
new file mode 100644
index 000000000..162cf401d
--- /dev/null
+++ b/internal/pkg/kubernetes/resource/kubernetes.go
@@ -0,0 +1,87 @@
+/*
+Copyright 2018 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package resource is copied from kubectl, used to collect resource usage for pods.
+package resource
+
+import (
+	corev1 "k8s.io/api/core/v1"
+)
+
+// PodRequestsAndLimits returns a dictionary of all defined resources summed up for all
+// containers of the pod. If pod overhead is non-nil, the pod overhead is added to the
+// total container resource requests and to the total container limits which have a
+// non-zero quantity.
+func PodRequestsAndLimits(pod *corev1.Pod) (reqs, limits corev1.ResourceList) {
+	reqs, limits = corev1.ResourceList{}, corev1.ResourceList{}
+	for _, container := range pod.Spec.Containers {
+		addResourceList(reqs, container.Resources.Requests)
+		addResourceList(limits, container.Resources.Limits)
+	}
+
+	// init containers define the minimum of any resource
+	for _, container := range pod.Spec.InitContainers {
+		maxResourceList(reqs, container.Resources.Requests)
+		maxResourceList(limits, container.Resources.Limits)
+	}
+
+	// Add overhead for running a pod to the sum of requests and to non-zero limits:
+	if pod.Spec.Overhead != nil {
+		addResourceList(reqs, pod.Spec.Overhead)
+
+		for name, quantity := range pod.Spec.Overhead {
+			if value, ok := limits[name]; ok && !value.IsZero() {
+				value.Add(quantity)
+
+				limits[name] = value
+			}
+		}
+	}
+
+	return
+}
+
+// addResourceList adds the resources in newList to list.
+func addResourceList(list, added corev1.ResourceList) {
+	for name, quantity := range added {
+		value, ok := list[name]
+		if !ok {
+			list[name] = quantity.DeepCopy()
+
+			continue
+		}
+
+		value.Add(quantity)
+		list[name] = value
+	}
+}
+
+// maxResourceList sets list to the greater of list/newList for every resource
+// either list.
+func maxResourceList(list, added corev1.ResourceList) {
+	for name, quantity := range added {
+		value, ok := list[name]
+		if !ok {
+			list[name] = quantity.DeepCopy()
+
+			continue
+		}
+
+		if quantity.Cmp(value) > 0 {
+			list[name] = quantity.DeepCopy()
+		}
+	}
+}
diff --git a/internal/pkg/logreceiver/logreceiver.go b/internal/pkg/logreceiver/logreceiver.go
new file mode 100644
index 000000000..49f4bb867
--- /dev/null
+++ b/internal/pkg/logreceiver/logreceiver.go
@@ -0,0 +1,161 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package logreceiver provides a TCP server that receives logs from Talos.
+package logreceiver
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/netip"
+	"sync"
+
+	"github.com/siderolabs/gen/containers"
+	"go.uber.org/zap"
+)
+
+// Server implements TCP server to receive JSON logs. It is similar to the one in Talos, except it doesn't try to parse
+// the JSON and instead writes rawdata and uses newline as a separator.
+//
+//nolint:govet
+type Server struct {
+	listener net.Listener
+	handler  *ConnHandler
+	logger   *zap.Logger
+
+	closeOnce sync.Once
+	// wg is used to wait for all connections to be closed.
+	wg sync.WaitGroup
+
+	m containers.ConcurrentMap[string, net.Conn]
+}
+
+// Handler handles a message or an error.
+type Handler interface {
+	HandleMessage(srcAddress netip.Addr, rawData []byte)
+	HandleError(srcAddress netip.Addr, err error)
+}
+
+// NewServer initializes new Server.
+func NewServer(listener net.Listener, handler *ConnHandler, logger *zap.Logger) *Server {
+	return &Server{
+		listener: listener,
+		handler:  handler,
+		logger:   logger,
+	}
+}
+
+// Serve runs the TCP server loop.
+func (srv *Server) Serve() error {
+	for {
+		conn, err := srv.listener.Accept()
+		if err != nil {
+			if errors.Is(err, net.ErrClosed) {
+				return nil
+			}
+
+			return fmt.Errorf("error accepting connection: %w", err)
+		}
+
+		srcAddr, ok := conn.RemoteAddr().(*net.TCPAddr)
+		if !ok {
+			srv.logger.Error("error getting remote IP address")
+
+			continue
+		}
+
+		remoteAddr, _ := netip.AddrFromSlice(srcAddr.IP)
+		remoteAddress := conn.RemoteAddr().String()
+
+		srv.wg.Add(1)
+		srv.m.Set(remoteAddress, conn)
+
+		go func() {
+			defer srv.wg.Done()
+			srv.handler.HandleConn(remoteAddr, conn)
+			srv.m.Remove(remoteAddress)
+		}()
+	}
+}
+
+// Stop serving.
+func (srv *Server) Stop() {
+	srv.closeOnce.Do(func() {
+		srv.listener.Close() //nolint:errcheck
+
+		srv.m.ForEach(func(_ string, conn net.Conn) {
+			remotrAddr := conn.RemoteAddr().String()
+			srv.logger.Info("closing connection", zap.String("remote_addr", remotrAddr))
+
+			err := conn.Close()
+			if err != nil {
+				srv.logger.Warn("error closing connection", zap.String("remote_addr", remotrAddr), zap.Error(err))
+			}
+		})
+
+		srv.logger.Info("waiting for goroutines to finish")
+		// Wait for all connections goroutines to finish.
+		srv.wg.Wait()
+		srv.m.Clear()
+		srv.logger.Info("stopped logging server")
+	})
+}
+
+// ConnHandler is called for each received connection.
+type ConnHandler struct {
+	msgHandler Handler
+	logger     *zap.Logger
+}
+
+// NewConnHandler initializes new ConnHandler.
+func NewConnHandler(msgHandler Handler, logger *zap.Logger) *ConnHandler {
+	return &ConnHandler{
+		msgHandler: msgHandler,
+		logger:     logger,
+	}
+}
+
+// HandleConn handles a connection.
+func (ch *ConnHandler) HandleConn(addr netip.Addr, conn io.ReadCloser) {
+	defer conn.Close() //nolint:errcheck
+
+	bufReader := bufio.NewReader(conn)
+
+	for {
+		slice, err := bufReader.ReadSlice('\n')
+		if err != nil {
+			if !errors.Is(err, net.ErrClosed) && !errors.Is(err, io.EOF) && !isTimeout(err) {
+				ch.logger.Error("error decoding message", zap.Error(err))
+				ch.msgHandler.HandleError(addr, err)
+			}
+
+			return
+		}
+
+		ch.msgHandler.HandleMessage(addr, slice[:len(slice)-1])
+	}
+}
+
+func isTimeout(err error) bool {
+	var neterr net.Error
+	if errors.As(err, &neterr) {
+		return neterr != nil && neterr.Timeout()
+	}
+
+	return false
+}
+
+// MakeServer creates a listener on the given address and returns a struct which can be used to start and stop the server.
+func MakeServer(address string, handler Handler, logger *zap.Logger) (*Server, error) {
+	listener, err := net.Listen("tcp", address)
+	if err != nil {
+		return nil, fmt.Errorf("log server: error listening on %s: %w", address, err)
+	}
+
+	return NewServer(listener, NewConnHandler(handler, logger), logger), nil
+}
diff --git a/internal/pkg/logreceiver/logreceiver_test.go b/internal/pkg/logreceiver/logreceiver_test.go
new file mode 100644
index 000000000..de8fe6b12
--- /dev/null
+++ b/internal/pkg/logreceiver/logreceiver_test.go
@@ -0,0 +1,50 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package logreceiver_test
+
+import (
+	"bytes"
+	"io"
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest"
+
+	"github.com/siderolabs/omni/internal/pkg/logreceiver"
+)
+
+//nolint:govet
+type testLogHandler struct {
+	t      *testing.T
+	b      bytes.Buffer
+	logger *zap.Logger
+}
+
+var addr = netip.MustParseAddr("1.2.3.4")
+
+func (t *testLogHandler) HandleMessage(srcAddress netip.Addr, rawData []byte) {
+	assert.Equal(t.t, addr, srcAddress)
+	t.b.Write(rawData)
+}
+
+func (t *testLogHandler) HandleError(srcAddress netip.Addr, err error) {
+	assert.Equal(t.t, addr, srcAddress)
+	t.t.Fatal(err)
+}
+
+func TestConnHandler(t *testing.T) {
+	logger := zaptest.NewLogger(t)
+	handler := &testLogHandler{
+		t:      t,
+		logger: logger,
+	}
+	ch := logreceiver.NewConnHandler(handler, logger)
+
+	ch.HandleConn(addr, io.NopCloser(bytes.NewBufferString("{ hello: \"1\" }\n{ hello: \"2\" }\n")))
+	assert.Equal(t, "{ hello: \"1\" }{ hello: \"2\" }", handler.b.String())
+}
diff --git a/internal/pkg/registry/registry.go b/internal/pkg/registry/registry.go
new file mode 100644
index 000000000..d4c1aa485
--- /dev/null
+++ b/internal/pkg/registry/registry.go
@@ -0,0 +1,29 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package registry provides container registry scanning utils.
+package registry
+
+import (
+	"context"
+
+	"github.com/google/go-containerregistry/pkg/name"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
+)
+
+// UpgradeCandidates fetches release tags from the Github.
+func UpgradeCandidates(ctx context.Context, source string) ([]string, error) {
+	repo, err := name.NewRepository(source)
+	if err != nil {
+		return nil, err
+	}
+
+	tags, err := remote.List(repo, remote.WithContext(ctx))
+	if err != nil {
+		return nil, err
+	}
+
+	return tags, nil
+}
diff --git a/internal/pkg/resetable/closer.go b/internal/pkg/resetable/closer.go
new file mode 100644
index 000000000..ad3b13834
--- /dev/null
+++ b/internal/pkg/resetable/closer.go
@@ -0,0 +1,37 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package resetable provides a Closer helper type for defer statements.
+package resetable
+
+// NewCloser returns a new Closer.
+func NewCloser(closer func()) Closer {
+	return Closer{
+		closer: closer,
+	}
+}
+
+// NewCloserErr returns a new Closer. It is similar to NewCloser but accepts functions that return error.
+func NewCloserErr(closer func() error) Closer {
+	return NewCloser(func() { closer() }) //nolint:errcheck
+}
+
+// Closer is a wrapper around a closer function that can be reset.
+// It is useful for conditional closing in defer statements.
+type Closer struct {
+	closer func()
+}
+
+// Close calls the wrapped closer function if it is not nil.
+func (s *Closer) Close() {
+	if s.closer != nil {
+		s.closer()
+	}
+}
+
+// Reset resets the wrapped closer function.
+func (s *Closer) Reset() {
+	s.closer = nil
+}
diff --git a/internal/pkg/resetable/closer_test.go b/internal/pkg/resetable/closer_test.go
new file mode 100644
index 000000000..8c2d1196f
--- /dev/null
+++ b/internal/pkg/resetable/closer_test.go
@@ -0,0 +1,36 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package resetable_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/siderolabs/omni/internal/pkg/resetable"
+)
+
+func testResetableCloser(reset bool) (closerCalled bool) {
+	closer := func() error {
+		closerCalled = true
+
+		return nil
+	}
+
+	rc := resetable.NewCloserErr(closer)
+	defer rc.Close()
+
+	if reset {
+		rc.Reset()
+	}
+
+	return false
+}
+
+func TestResetableCloser(t *testing.T) {
+	require.False(t, testResetableCloser(true))
+	require.True(t, testResetableCloser(false))
+}
diff --git a/internal/pkg/siderolink/adapter.go b/internal/pkg/siderolink/adapter.go
new file mode 100644
index 000000000..e8f293a03
--- /dev/null
+++ b/internal/pkg/siderolink/adapter.go
@@ -0,0 +1,139 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package siderolink implements siderolink manager.
+package siderolink
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/siderolink/pkg/events"
+	machineapi "github.com/siderolabs/talos/pkg/machinery/api/machine"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+)
+
+// NewEventsAdapter creates new Events.
+func NewEventsAdapter(state state.State, logger *zap.Logger) *Adapter {
+	return &Adapter{
+		state:  state,
+		logger: logger,
+	}
+}
+
+// Adapter maintains machine status state based on the incoming events.
+type Adapter struct {
+	logger *zap.Logger
+	state  state.State
+}
+
+// HandleEvent is called on each event coming from the Talos nodes.
+func (e *Adapter) HandleEvent(ctx context.Context, event events.Event) error {
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	ipPort, err := netip.ParseAddrPort(event.Node)
+	if err != nil {
+		return err
+	}
+
+	ip := ipPort.Addr().String()
+
+	machines, err := safe.StateListAll[*omni.Machine](
+		ctx,
+		e.state,
+		state.WithLabelQuery(resource.LabelEqual(omni.MachineAddressLabel, ip)),
+	)
+	if err != nil {
+		return err
+	}
+
+	if machines.Len() == 0 {
+		return fmt.Errorf("no machines found for address %s", ip)
+	}
+
+	switch event := event.Payload.(type) {
+	case *machineapi.MachineStatusEvent:
+		return e.handleMachineStatusEvent(ctx, event, machines.Get(0))
+	default: // nothing, we ignore other events
+	}
+
+	return nil
+}
+
+// CleanupMachineStatuses cleans up machine status snapshot when machine is destroyed.
+func (e *Adapter) CleanupMachineStatuses(ctx context.Context, logger *zap.Logger) error {
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	watchCh := make(chan state.Event)
+
+	if err := e.state.WatchKind(ctx,
+		resource.NewMetadata(resources.DefaultNamespace, omni.MachineType, "", resource.VersionUndefined),
+		watchCh,
+	); err != nil {
+		return fmt.Errorf("error watching machines: %w", err)
+	}
+
+	for {
+		var event state.Event
+
+		select {
+		case <-ctx.Done():
+			return nil
+		case event = <-watchCh:
+		}
+
+		if event.Type != state.Destroyed {
+			continue
+		}
+
+		id := event.Resource.Metadata().ID()
+
+		if err := e.state.Destroy(ctx, resource.NewMetadata(resources.DefaultNamespace, omni.MachineStatusSnapshotType, id, resource.VersionUndefined)); err != nil {
+			if !state.IsNotFoundError(err) {
+				logger.Error("error destroying machine status snapshot", zap.Error(err))
+			}
+		}
+	}
+}
+
+func (e *Adapter) handleMachineStatusEvent(ctx context.Context, event *machineapi.MachineStatusEvent, machine *omni.Machine) error {
+	e.logger.Info("got machine status event",
+		zap.String("machine", machine.Metadata().ID()),
+		zap.String("stage", event.Stage.String()),
+		zap.Any("status", event.Status),
+	)
+
+	snapshot := omni.NewMachineStatusSnapshot(resources.DefaultNamespace, machine.Metadata().ID())
+
+	if _, err := safe.StateUpdateWithConflicts(
+		ctx,
+		e.state,
+		snapshot.Metadata(),
+		func(status *omni.MachineStatusSnapshot) error {
+			status.TypedSpec().Value.MachineStatus = event
+
+			return nil
+		},
+	); err != nil {
+		if !state.IsNotFoundError(err) {
+			return err
+		}
+
+		snapshot.TypedSpec().Value.MachineStatus = event
+
+		return e.state.Create(ctx, snapshot)
+	}
+
+	return nil
+}
diff --git a/internal/pkg/siderolink/export_test.go b/internal/pkg/siderolink/export_test.go
new file mode 100644
index 000000000..5bbb51098
--- /dev/null
+++ b/internal/pkg/siderolink/export_test.go
@@ -0,0 +1,8 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package siderolink
+
+var GenerateJoinToken = generateJoinToken
diff --git a/internal/pkg/siderolink/loghandler.go b/internal/pkg/siderolink/loghandler.go
new file mode 100644
index 000000000..f7c41ec0f
--- /dev/null
+++ b/internal/pkg/siderolink/loghandler.go
@@ -0,0 +1,289 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package siderolink
+
+import (
+	"bufio"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/netip"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/siderolabs/gen/optional"
+	"github.com/siderolabs/go-tail"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/config"
+)
+
+// NewLogHandler returns a new LogHandler.
+func NewLogHandler(machineMap *MachineMap, omniState state.State, storageConfig *config.LogStorageParams, logger *zap.Logger) *LogHandler {
+	storage := optional.None[*LogStorage]()
+
+	if storageConfig.Enabled {
+		storage = optional.Some(NewLogStorage(storageConfig.Path))
+	}
+
+	cache := NewMachineCache(storage, logger)
+	handler := LogHandler{
+		StorageFlushPeriod: storageConfig.FlushPeriod,
+		Map:                machineMap,
+		OmniState:          omniState,
+		Cache:              cache,
+		logger:             logger,
+	}
+
+	return &handler
+}
+
+// LogHandler stores a map of machines to their circular log buffers.
+type LogHandler struct {
+	OmniState          state.State
+	Map                *MachineMap
+	logger             *zap.Logger
+	Cache              *MachineCache
+	StorageFlushPeriod time.Duration
+}
+
+// Start starts the LogHandler.
+func (h *LogHandler) Start(ctx context.Context) error {
+	h.logger.Info("starting log handler")
+
+	eventCh := make(chan state.Event)
+
+	if err := h.OmniState.WatchKind(
+		ctx,
+		omni.NewMachine(resources.DefaultNamespace, "").Metadata(),
+		eventCh,
+		state.WithBootstrapContents(true),
+	); err != nil {
+		return err
+	}
+
+	var tickerCh <-chan time.Time
+
+	var storagePath string
+
+	storage, storageEnabled := h.Cache.Storage.Get()
+	if storageEnabled {
+		ticker := time.NewTicker(h.StorageFlushPeriod)
+		tickerCh = ticker.C
+
+		defer ticker.Stop()
+
+		storagePath = storage.Path
+	}
+
+	for {
+		select {
+		case <-ctx.Done():
+			if storageEnabled {
+				h.logger.Info("save all log buffers before shutdown", zap.String("storage_path", storagePath))
+
+				err := h.Cache.SaveAll()
+				if err != nil {
+					h.logger.Error("failed to save all log buffers", zap.Error(err))
+
+					return ctx.Err()
+				}
+			}
+
+			if errors.Is(ctx.Err(), context.Canceled) {
+				return nil
+			}
+
+			return ctx.Err()
+		case <-tickerCh:
+			h.logger.Info(
+				"save all log buffers",
+				zap.String("storage_path", storagePath),
+				zap.Duration("period", h.StorageFlushPeriod),
+			)
+
+			err := h.Cache.SaveAll()
+			if err != nil {
+				h.logger.Error("failed to save all log buffers", zap.Error(err))
+			}
+		case event := <-eventCh:
+			switch event.Type {
+			case state.Created, state.Updated, state.Bootstrapped:
+				// ignore
+			case state.Errored:
+				return fmt.Errorf("error watching machines: %w", event.Error)
+			case state.Destroyed:
+				machineID := MachineID(event.Resource.Metadata().ID())
+
+				h.Map.RemoveByMachineID(machineID)
+
+				err := h.Cache.Remove(machineID)
+				if err != nil {
+					h.logger.Error("failed to remove machine buffer", zap.String("machine_id", string(machineID)), zap.Error(err))
+				}
+			}
+		}
+	}
+}
+
+// HandleMessage handles a log message.
+func (h *LogHandler) HandleMessage(srcAddress netip.Addr, rawData []byte) {
+	currentIP := srcAddress.String()
+	if currentIP == "" {
+		h.logger.Error("empty IP address")
+
+		return
+	}
+
+	logger := h.logger.With(zap.String("machine_ip", currentIP))
+	rawData = trimNewlines(rawData)
+
+	if len(rawData) == 0 {
+		logger.Warn("empty log message")
+
+		return
+	}
+
+	err := h.writeMessage(currentIP, rawData)
+	if err != nil {
+		logger.Error("failed to write message to buffer", zap.Error(err))
+
+		return
+	}
+}
+
+func (h *LogHandler) writeMessage(ip string, data []byte) error {
+	id, err := h.Map.GetMachineID(ip)
+	if err != nil {
+		return fmt.Errorf("failed to get machine ID for ip address '%s': %w", ip, err)
+	}
+
+	err = h.Cache.WriteMessage(id, data)
+	if err != nil {
+		return fmt.Errorf("failed to write message to buffer for machine '%s': %w", id, err)
+	}
+
+	return nil
+}
+
+// HandleError handles an error from the server.
+func (h *LogHandler) HandleError(srcAddress netip.Addr, hErr error) {
+	currentIP := srcAddress.String()
+	if currentIP == "" {
+		h.logger.Error("empty IP address")
+
+		return
+	}
+
+	logger := h.logger.With(zap.String("machine_ip", currentIP))
+
+	id, err := h.Map.GetMachineID(currentIP)
+	if err != nil {
+		h.logger.Error("failed to get machine ID for ip address", zap.String("ip", currentIP), zap.Error(err))
+
+		return
+	}
+
+	logger = logger.With(zap.String("machine_id", string(id)))
+
+	logger.Error("error from the log server", zap.Error(hErr))
+}
+
+// GetReader returns a line reader for the given machine ID.
+func (h *LogHandler) GetReader(machineID MachineID, follow bool, tailLines optional.Optional[int32]) (*LineReader, error) {
+	buf, err := h.Cache.GetBuffer(machineID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get buffer for machine '%s': %w", machineID, err)
+	}
+
+	var r interface {
+		io.ReadCloser
+		io.Seeker
+	}
+
+	if follow {
+		r = buf.GetStreamingReader()
+	} else {
+		r = buf.GetReader()
+	}
+
+	if tailLines.IsPresent() {
+		// since we are surrounding each message with \n we should increase lines by two times.
+		lines := int(tailLines.ValueOrZero()) * 2
+
+		err := tail.SeekLines(r, lines)
+		if err != nil {
+			return nil, fmt.Errorf("failed to seek %d lines: %w", lines, err)
+		}
+	}
+
+	return &LineReader{reader: r}, nil
+}
+
+// LineReader is a reader which reads lines surrounded by \n from the underlying reader.
+type LineReader struct {
+	buf    *bufio.Reader
+	reader io.ReadCloser
+}
+
+// Close closes the LineReader underlying reader.
+func (r *LineReader) Close() error {
+	return r.reader.Close()
+}
+
+// ReadLine reads a line from the underlying reader.
+func (r *LineReader) ReadLine() ([]byte, error) {
+	if r.buf == nil {
+		r.buf = bufio.NewReader(r.reader)
+	}
+
+	for {
+		emptyLine, err := r.buf.ReadBytes('\n')
+		if err != nil {
+			if err == io.EOF {
+				return nil, io.EOF
+			}
+
+			return nil, fmt.Errorf("failed to read line: %w", err)
+		}
+
+		if len(emptyLine) != 1 {
+			// missed the start of the line, skipping to the next entry
+			continue
+		}
+
+		logLine, err := r.buf.ReadBytes('\n')
+		if err != nil {
+			if err == io.EOF {
+				return nil, io.EOF
+			}
+
+			return nil, fmt.Errorf("failed to read line: %w", err)
+		}
+
+		return trimNewlines(logLine), nil
+	}
+}
+
+// trimNewlines trims a newline from the start and from end of a byte slice.
+func trimNewlines(data []byte) []byte {
+	if len(data) == 0 {
+		return data
+	}
+
+	if data[0] == '\n' {
+		data = data[1:]
+	}
+
+	if len(data) > 0 && data[len(data)-1] == '\n' {
+		data = data[:len(data)-1]
+	}
+
+	return data
+}
diff --git a/internal/pkg/siderolink/loghandler_test.go b/internal/pkg/siderolink/loghandler_test.go
new file mode 100644
index 000000000..2a100fbdd
--- /dev/null
+++ b/internal/pkg/siderolink/loghandler_test.go
@@ -0,0 +1,315 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package siderolink_test
+
+import (
+	"context"
+	"errors"
+	"net/netip"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/siderolabs/gen/optional"
+	"github.com/siderolabs/gen/xtesting/must"
+	"github.com/siderolabs/go-retry/retry"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap/zaptest"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/config"
+	"github.com/siderolabs/omni/internal/pkg/siderolink"
+)
+
+func TestLogHandler_HandleMessage(t *testing.T) {
+	t.Run("empty log message", func(t *testing.T) {
+		machineMap := siderolink.NewMachineMap(&siderolink.MapStorage{})
+
+		st := state.WrapCore(namespaced.NewState(inmem.Build))
+		storageConfig := config.LogStorageParams{
+			Enabled: false,
+		}
+
+		handler := siderolink.NewLogHandler(machineMap, st, &storageConfig, zaptest.NewLogger(t))
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(""))
+	})
+
+	t.Run("non-empty log message", func(t *testing.T) {
+		cache := siderolink.NewMachineMap(&siderolink.MapStorage{
+			IPToMachine: map[string]siderolink.MachineID{
+				"1.2.3.4": "machine1",
+			},
+		})
+
+		st := state.WrapCore(namespaced.NewState(inmem.Build))
+		storageConfig := config.LogStorageParams{
+			Enabled: false,
+		}
+
+		handler := siderolink.NewLogHandler(cache, st, &storageConfig, zaptest.NewLogger(t))
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(`{"hello": "world"}`))
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(`{"hello": "world2"}`))
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(`{"hello": "world3"}`))
+		reader, err := handler.GetReader("machine1", false, optional.None[int32]())
+		require.NoError(t, err)
+		line, err := reader.ReadLine()
+		require.NoError(t, err)
+		require.Equal(t, `{"hello": "world"}`, string(line))
+		line, err = reader.ReadLine()
+		require.NoError(t, err)
+		require.Equal(t, `{"hello": "world2"}`, string(line))
+		line, err = reader.ReadLine()
+		require.NoError(t, err)
+		require.Equal(t, `{"hello": "world3"}`, string(line))
+	})
+
+	t.Run("non-empty log message with invalid data in the beginning", func(t *testing.T) {
+		cache := siderolink.NewMachineMap(&siderolink.MapStorage{
+			IPToMachine: map[string]siderolink.MachineID{
+				"1.2.3.4": "machine1",
+			},
+		})
+
+		st := state.WrapCore(namespaced.NewState(inmem.Build))
+		storageConfig := config.LogStorageParams{
+			Enabled: false,
+		}
+
+		handler := siderolink.NewLogHandler(cache, st, &storageConfig, zaptest.NewLogger(t))
+		writeBytes(t, handler, "1.2.3.4", []byte(`{"hello": "first"}`))
+
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(`{"hello": "world"}`))
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(`{"hello": "world2"}`))
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(`{"hello": "world3"}`))
+		reader, err := handler.GetReader("machine1", false, optional.None[int32]())
+		require.NoError(t, err)
+		line, err := reader.ReadLine()
+		require.NoError(t, err)
+		require.Equal(t, `{"hello": "world2"}`, string(line))
+		line, err = reader.ReadLine()
+		require.NoError(t, err)
+		require.Equal(t, `{"hello": "world3"}`, string(line))
+	})
+
+	t.Run("non-empty log message with invalid message in the beginning", func(t *testing.T) {
+		cache := siderolink.NewMachineMap(&siderolink.MapStorage{
+			IPToMachine: map[string]siderolink.MachineID{
+				"1.2.3.4": "machine1",
+			},
+		})
+
+		st := state.WrapCore(namespaced.NewState(inmem.Build))
+		storageConfig := config.LogStorageParams{
+			Enabled: false,
+		}
+
+		handler := siderolink.NewLogHandler(cache, st, &storageConfig, zaptest.NewLogger(t))
+		writeBytes(t, handler, "1.2.3.4", []byte(`{"hello": "first"}`+"\n"))
+
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(`{"hello": "world"}`))
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(`{"hello": "world2"}`))
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(`{"hello": "world3"}`))
+		reader, err := handler.GetReader("machine1", false, optional.None[int32]())
+		require.NoError(t, err)
+		line, err := reader.ReadLine()
+		require.NoError(t, err)
+		require.Equal(t, `{"hello": "world"}`, string(line))
+		line, err = reader.ReadLine()
+		require.NoError(t, err)
+		require.Equal(t, `{"hello": "world2"}`, string(line))
+		line, err = reader.ReadLine()
+		require.NoError(t, err)
+		require.Equal(t, `{"hello": "world3"}`, string(line))
+	})
+
+	t.Run("non-empty log messages with tail 2", func(t *testing.T) {
+		cache := siderolink.NewMachineMap(&siderolink.MapStorage{
+			IPToMachine: map[string]siderolink.MachineID{
+				"1.2.3.4": "machine1",
+			},
+		})
+
+		st := state.WrapCore(namespaced.NewState(inmem.Build))
+		storageConfig := config.LogStorageParams{
+			Enabled: false,
+		}
+
+		handler := siderolink.NewLogHandler(cache, st, &storageConfig, zaptest.NewLogger(t))
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(`{"hello": "world"}`))
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(`{"hello": "world2"}`))
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(`{"hello": "world3"}`))
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(`{"hello": "world4"}`))
+		handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte(`{"hello": "world5"}`))
+
+		reader, err := handler.GetReader("machine1", false, optional.Some[int32](2))
+		require.NoError(t, err)
+		line, err := reader.ReadLine()
+		require.NoError(t, err)
+		require.Equal(t, `{"hello": "world4"}`, string(line))
+		line, err = reader.ReadLine()
+		require.NoError(t, err)
+		require.Equal(t, `{"hello": "world5"}`, string(line))
+	})
+}
+
+// TestLogHandlerStorage tests that log handler can store logs on the filesystem when log storage is enabled.
+func TestLogHandlerStorage(t *testing.T) {
+	ctx, ctxCancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer ctxCancel()
+
+	machineMap := siderolink.NewMachineMap(&siderolink.MapStorage{
+		IPToMachine: map[string]siderolink.MachineID{
+			"1.2.3.4": "machine-1",
+			"2.3.4.5": "machine-2",
+		},
+	})
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	require.NoError(t, st.Create(ctx, omni.NewMachine(resources.DefaultNamespace, "machine-1")))
+	require.NoError(t, st.Create(ctx, omni.NewMachine(resources.DefaultNamespace, "machine-2")))
+
+	tempDir := t.TempDir()
+
+	logHandler := siderolink.NewLogHandler(machineMap, st, &config.LogStorageParams{
+		Enabled:     true,
+		Path:        tempDir,
+		FlushPeriod: 2 * time.Second,
+	}, zaptest.NewLogger(t))
+
+	var eg errgroup.Group
+
+	eg.Go(func() error { return logHandler.Start(ctx) })
+
+	logHandler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte("aaaa"))
+	logHandler.HandleMessage(netip.MustParseAddr("2.3.4.5"), []byte("AAAA"))
+
+	// wait for a log flush to happen
+	time.Sleep(2100 * time.Millisecond)
+
+	assertLogExists(t, tempDir, "machine-1", "aaaa")
+	assertLogExists(t, tempDir, "machine-2", "AAAA")
+
+	// destroy machine-2
+	require.NoError(t, st.Destroy(ctx, omni.NewMachine(resources.DefaultNamespace, "machine-2").Metadata()))
+
+	// ensure that log and hash files for machine-2 are removed
+	require.NoError(t, retry.Constant(10*time.Second).Retry(func() error {
+		logFileExists, err := fileExists(filepath.Join(tempDir, "machine-2.log"))
+		require.NoError(t, err)
+
+		if logFileExists {
+			return retry.ExpectedError(errors.New("log file for machine-2 is still present"))
+		}
+
+		logHashExists, err := fileExists(filepath.Join(tempDir, "machine-2.log.sha256sum"))
+		require.NoError(t, err)
+
+		if logHashExists {
+			return retry.ExpectedError(errors.New("log hash for machine-2 is still present"))
+		}
+
+		return nil
+	}), "log and hash files for machine-2 should be removed")
+
+	// send another log and immediately cancel the context
+	logHandler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte("bbbb"))
+
+	ctxCancel()
+
+	require.NoError(t, eg.Wait())
+
+	// ensure that the last log entry is flushed to disk on shutdown
+	assertLogExists(t, tempDir, "machine-1", "bbbb")
+}
+
+// TestLogHandlerStorageDisabled ensures that log handler works as expected without log storage.
+func TestLogHandlerStorageDisabled(t *testing.T) {
+	ctx, ctxCancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer ctxCancel()
+
+	machineMap := siderolink.NewMachineMap(&siderolink.MapStorage{
+		IPToMachine: map[string]siderolink.MachineID{
+			"1.2.3.4": "machine-1",
+			"2.3.4.5": "machine-2",
+		},
+	})
+
+	st := state.WrapCore(namespaced.NewState(inmem.Build))
+
+	require.NoError(t, st.Create(ctx, omni.NewMachine(resources.DefaultNamespace, "machine-1")))
+	require.NoError(t, st.Create(ctx, omni.NewMachine(resources.DefaultNamespace, "machine-2")))
+
+	tempDir := t.TempDir()
+	storageConfig := config.LogStorageParams{
+		Enabled:     false,
+		Path:        tempDir,
+		FlushPeriod: 100 * time.Millisecond,
+	}
+
+	handler := siderolink.NewLogHandler(machineMap, st, &storageConfig, zaptest.NewLogger(t))
+
+	var eg errgroup.Group
+
+	eg.Go(func() error { return handler.Start(ctx) })
+
+	time.Sleep(300 * time.Millisecond)
+
+	handler.HandleMessage(netip.MustParseAddr("1.2.3.4"), []byte("aaaa"))
+	handler.HandleMessage(netip.MustParseAddr("2.3.4.5"), []byte("AAAA"))
+
+	ctxCancel()
+
+	require.NoError(t, eg.Wait())
+
+	assert.NoFileExists(t, filepath.Join(tempDir, "machine-1.log"))
+	assert.NoFileExists(t, filepath.Join(tempDir, "machine-1.log.sha256sum"))
+
+	assert.NoFileExists(t, filepath.Join(tempDir, "machine-2.log"))
+	assert.NoFileExists(t, filepath.Join(tempDir, "machine-2.log.sha256sum"))
+}
+
+func assertLogExists(t *testing.T, dir, machineID, log string) {
+	fileBytes, err := os.ReadFile(filepath.Join(dir, machineID+".log"))
+	if err != nil {
+		// Print additional directory contents to help with debugging.
+		stat := must.Value(os.Stat(dir))(t)
+		require.True(t, stat.IsDir(), "expected %q to be a directory", dir)
+
+		readDir := must.Value(os.ReadDir(dir))(t)
+		t.Log("directory contents:")
+
+		for _, entry := range readDir {
+			t.Logf("%s", entry.Name())
+		}
+
+		t.Fatal(err)
+	}
+
+	assert.Contains(t, string(fileBytes), log)
+}
+
+func writeBytes(t *testing.T, handler *siderolink.LogHandler, ip string, bytes []byte) {
+	id := must.Value(handler.Map.GetMachineID(ip))(t)
+	writeTo := must.Value(handler.Cache.GetWriter(id))(t)
+	must.Value(writeTo.Write(bytes))(t)
+}
+
+func fileExists(path string) (bool, error) {
+	_, err := os.Stat(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return false, nil
+	}
+
+	return err == nil, err
+}
diff --git a/internal/pkg/siderolink/logstorage.go b/internal/pkg/siderolink/logstorage.go
new file mode 100644
index 000000000..ce6492877
--- /dev/null
+++ b/internal/pkg/siderolink/logstorage.go
@@ -0,0 +1,142 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package siderolink
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+)
+
+// LogStorage stores logs for machines on file system.
+type LogStorage struct {
+	Path string
+}
+
+// NewLogStorage creates a new LogStorage.
+func NewLogStorage(path string) *LogStorage {
+	return &LogStorage{
+		Path: path,
+	}
+}
+
+// Exists returns true if the log file exists for the given machine ID.
+func (l *LogStorage) Exists(id MachineID) (bool, error) {
+	_, err := os.Stat(l.logPath(id))
+	if err == nil {
+		return true, nil
+	}
+
+	if errors.Is(err, os.ErrNotExist) {
+		return false, nil
+	}
+
+	return false, err
+}
+
+// Load loads logs of the machine with the given id, if exists, into the given writer.
+func (l *LogStorage) Load(id MachineID, writer io.Writer) error {
+	filePath := l.logPath(id)
+
+	bufferData, err := os.ReadFile(filePath)
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil
+		}
+
+		return err
+	}
+
+	hashHexExpectedBytes, err := os.ReadFile(l.logSHA256Path(id))
+	if err != nil {
+		removeErr := l.Remove(id)
+		if removeErr != nil {
+			return fmt.Errorf("failed to delete invalid log buffer file: %w", removeErr)
+		}
+
+		return fmt.Errorf("failed to read log buffer hash file: %w", err)
+	}
+
+	hashHexExpected := string(hashHexExpectedBytes)
+
+	// verify the hash
+	hashActual := sha256.Sum256(bufferData)
+	hashHexActual := hex.EncodeToString(hashActual[:])
+
+	if hashHexExpected != hashHexActual {
+		removeErr := l.Remove(id)
+		if removeErr != nil {
+			return fmt.Errorf("failed to delete invalid log buffer file: %w", removeErr)
+		}
+
+		return fmt.Errorf("invalid log buffer hash in file: expected %s, got %s", hashHexExpected, hashHexActual)
+	}
+
+	_, err = io.Copy(writer, bytes.NewReader(bufferData))
+
+	return err
+}
+
+// Remove removes the log file, if exists, for the given machine ID.
+func (l *LogStorage) Remove(id MachineID) error {
+	if err := l.removeFileIfExists(l.logPath(id)); err != nil {
+		return err
+	}
+
+	return l.removeFileIfExists(l.logSHA256Path(id))
+}
+
+// Save saves the given reader into the log file for the given machine ID.
+func (l *LogStorage) Save(machineID MachineID, reader io.Reader) error {
+	err := os.MkdirAll(l.Path, 0o755)
+	if err != nil {
+		return fmt.Errorf("failed to create log storage directory: %w", err)
+	}
+
+	logFilePath := l.logPath(machineID)
+
+	file, err := os.OpenFile(logFilePath, os.O_TRUNC|os.O_CREATE|os.O_WRONLY, 0o644)
+	if err != nil {
+		return fmt.Errorf("failed to open log file for machine '%s': %w", machineID, err)
+	}
+
+	defer file.Close() //nolint:errcheck
+
+	hash := sha256.New()
+
+	teeReader := io.TeeReader(reader, hash)
+
+	_, err = io.Copy(file, teeReader)
+	if err != nil {
+		return fmt.Errorf("failed to copy buffer to file for machine '%s': %w", machineID, err)
+	}
+
+	hashHex := hex.EncodeToString(hash.Sum(nil))
+
+	return os.WriteFile(l.logSHA256Path(machineID), []byte(hashHex), 0o644)
+}
+
+func (l *LogStorage) logPath(machineID MachineID) string {
+	return filepath.Join(l.Path, fmt.Sprintf("%s.log", machineID))
+}
+
+func (l *LogStorage) logSHA256Path(machineID MachineID) string {
+	return l.logPath(machineID) + ".sha256sum"
+}
+
+func (l *LogStorage) removeFileIfExists(path string) error {
+	err := os.Remove(path)
+	if err == nil || errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+
+	return err
+}
diff --git a/internal/pkg/siderolink/logstorage_test.go b/internal/pkg/siderolink/logstorage_test.go
new file mode 100644
index 000000000..c896b5755
--- /dev/null
+++ b/internal/pkg/siderolink/logstorage_test.go
@@ -0,0 +1,98 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package siderolink_test
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+
+	"github.com/siderolabs/omni/internal/pkg/siderolink"
+)
+
+type LogStorageSuite struct {
+	suite.Suite
+}
+
+// TestSave tests that log storage saves logs on file system with their hash.
+func (l *LogStorageSuite) TestSave() {
+	tempDir := l.T().TempDir()
+	logStorage := siderolink.NewLogStorage(tempDir)
+
+	l.Require().NoError(logStorage.Save("test-machine", strings.NewReader("aaaa")), "failed to save log")
+
+	fileBytes, err := os.ReadFile(filepath.Join(tempDir, "test-machine.log"))
+	l.Require().NoError(err, "failed to read log file")
+
+	l.Require().Equal("aaaa", string(fileBytes), "log file contents are not equal")
+
+	fileHashBytes, err := os.ReadFile(filepath.Join(tempDir, "test-machine.log.sha256sum"))
+	l.Require().NoError(err, "failed to read log file sha256sum")
+
+	expectedHash := sha256Hex([]byte("aaaa"))
+
+	assert.Equal(l.T(), expectedHash, string(fileHashBytes), "log file hash is not equal")
+}
+
+// TestLoad tests that log storage loads logs from file system.
+func (l *LogStorageSuite) TestLoad() {
+	tempDir := l.T().TempDir()
+	logStorage := siderolink.NewLogStorage(tempDir)
+
+	l.Require().NoError(logStorage.Save("test-machine", strings.NewReader("aaaa")), "failed to save log")
+
+	var buffer strings.Builder
+
+	l.Require().NoError(logStorage.Load("test-machine", &buffer))
+
+	l.Assert().Equal("aaaa", buffer.String(), "log file contents are not equal")
+}
+
+func (l *LogStorageSuite) TestLoadInvalid() {
+	tempDir := l.T().TempDir()
+	logStorage := siderolink.NewLogStorage(tempDir)
+
+	l.Require().NoError(logStorage.Save("test-machine", strings.NewReader("aaaa")), "failed to save log")
+
+	// corrupt the log file hash
+	l.Require().NoError(os.WriteFile(filepath.Join(tempDir, "test-machine.log.sha256sum"), []byte("invalid-hash"), 0o644))
+
+	var buffer strings.Builder
+
+	l.Require().Error(logStorage.Load("test-machine", &buffer))
+
+	l.Assert().NoFileExists(filepath.Join(tempDir, "test-machine.log"), "log file was not removed")
+	l.Assert().NoFileExists(filepath.Join(tempDir, "test-machine.log.sha256sum"), "log file was not removed")
+}
+
+// TestRemove tests that log storage cal properly remove logs from file system.
+func (l *LogStorageSuite) TestRemove() {
+	tempDir := l.T().TempDir()
+	logStorage := siderolink.NewLogStorage(tempDir)
+
+	l.Require().NoError(logStorage.Save("test-machine", strings.NewReader("aaaa")), "failed to save log")
+
+	l.Require().NoError(logStorage.Remove("test-machine"))
+
+	l.Require().NoFileExists(filepath.Join(tempDir, "test-machine.log"), "log file was not removed")
+	l.Require().NoFileExists(filepath.Join(tempDir, "test-machine.log.sha256sum"), "log file was not removed")
+}
+
+func sha256Hex(data []byte) string {
+	sum256Sum := sha256.Sum256(data)
+
+	return hex.EncodeToString(sum256Sum[:])
+}
+
+func TestLogStorageSuite(t *testing.T) {
+	suite.Run(t, new(LogStorageSuite))
+}
diff --git a/internal/pkg/siderolink/machines.go b/internal/pkg/siderolink/machines.go
new file mode 100644
index 000000000..4cb0021ea
--- /dev/null
+++ b/internal/pkg/siderolink/machines.go
@@ -0,0 +1,313 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package siderolink
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"sync"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/hashicorp/go-multierror"
+	"github.com/siderolabs/gen/containers"
+	"github.com/siderolabs/gen/optional"
+	"github.com/siderolabs/go-circular"
+	"go.uber.org/zap"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+)
+
+// MachineCache stores a map of machines to their circular log buffers. It also allows to access the buffers
+// using the machine IP.
+type MachineCache struct {
+	machineBuffers containers.LazyMap[MachineID, *circular.Buffer]
+	logger         *zap.Logger
+	Storage        optional.Optional[*LogStorage]
+	mx             sync.Mutex
+	inited         bool
+}
+
+// NewMachineCache returns a new MachineCache.
+func NewMachineCache(storage optional.Optional[*LogStorage], logger *zap.Logger) *MachineCache {
+	return &MachineCache{
+		Storage: storage,
+		logger:  logger,
+	}
+}
+
+// WriteMessage writes the message surrounded with '\n' to the circular buffer for the given machine ID.
+func (m *MachineCache) WriteMessage(id MachineID, rawData []byte) error {
+	buffer, err := m.GetWriter(id)
+	if err != nil {
+		return err
+	}
+
+	_, err = buffer.Write([]byte("\n"))
+	if err != nil {
+		return err
+	}
+
+	_, err = buffer.Write(rawData)
+	if err != nil {
+		return err
+	}
+
+	_, err = buffer.Write([]byte("\n"))
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// GetBuffer returns the circular buffer for the given machine ID.
+func (m *MachineCache) GetBuffer(id MachineID) (*circular.Buffer, error) {
+	m.mx.Lock()
+	defer m.mx.Unlock()
+	m.init()
+
+	val, ok := m.machineBuffers.Get(id)
+	if ok {
+		return val, nil
+	}
+
+	storage, storageOk := m.Storage.Get()
+	if !storageOk {
+		return nil, &BufferNotFoundError{id: id}
+	}
+
+	// if storage is enabled and the log file exists, initialize the buffer from the file
+	exists, err := storage.Exists(id)
+	if err != nil {
+		return nil, err
+	}
+
+	if !exists {
+		return nil, &BufferNotFoundError{id: id}
+	}
+
+	return m.machineBuffers.GetOrCreate(id)
+}
+
+// GetWriter returns the circular buffer for the given machine ID. Creates buffer if it doesn't exist.
+func (m *MachineCache) GetWriter(id MachineID) (io.Writer, error) {
+	m.mx.Lock()
+	defer m.mx.Unlock()
+	m.init()
+
+	val, err := m.machineBuffers.GetOrCreate(id)
+	if err != nil {
+		return nil, err
+	}
+
+	return val, nil
+}
+
+// Remove removes the circular buffer for the given machine ID.
+// If storage is enabled, it also removes the logs from the storage i.e. the file system.
+func (m *MachineCache) Remove(id MachineID) error {
+	m.mx.Lock()
+	defer m.mx.Unlock()
+
+	m.logger.Info("remove logs for machine", zap.String("machine_id", string(id)))
+
+	if !m.inited {
+		return nil
+	}
+
+	m.machineBuffers.Remove(id)
+
+	storage, storageEnabled := m.Storage.Get()
+	if storageEnabled {
+		return storage.Remove(id)
+	}
+
+	return nil
+}
+
+// SaveAll saves all the logs to the storage, i.e., the file system.
+func (m *MachineCache) SaveAll() error {
+	storage, storageEnabled := m.Storage.Get()
+
+	if !storageEnabled {
+		return errors.New("storage is not enabled")
+	}
+
+	var multiErr error
+
+	for id, reader := range m.getMachineBufferReaders() {
+		m.logger.Debug("save logs for machine", zap.String("machine_id", string(id)))
+
+		err := storage.Save(id, reader)
+		if err != nil {
+			multiErr = multierror.Append(multiErr, err)
+		}
+	}
+
+	return multiErr
+}
+
+// getMachineBufferReaders takes a snapshot (copy) of the machine ID to buffer map in a thread-safe manner.
+func (m *MachineCache) getMachineBufferReaders() map[MachineID]io.Reader {
+	m.mx.Lock()
+	defer m.mx.Unlock()
+
+	bufferReaderMap := map[MachineID]io.Reader{}
+
+	m.machineBuffers.ForEach(func(id MachineID, buffer *circular.Buffer) {
+		bufferReaderMap[id] = buffer.GetReader()
+	})
+
+	return bufferReaderMap
+}
+
+func (m *MachineCache) init() {
+	if m.inited {
+		return
+	}
+
+	m.inited = true
+	m.machineBuffers = containers.LazyMap[MachineID, *circular.Buffer]{
+		Creator: func(id MachineID) (*circular.Buffer, error) {
+			buffer, err := circular.NewBuffer(
+				circular.WithInitialCapacity(InitialCapacity),
+				circular.WithMaxCapacity(MaxCapacity),
+				circular.WithSafetyGap(SafetyGap))
+			if err != nil {
+				return nil, fmt.Errorf("failed to create circular buffer for machine '%s': %w", id, err)
+			}
+
+			storage, storageEnabled := m.Storage.Get()
+
+			if storageEnabled {
+				m.logger.Info("load logs for machine", zap.String("machine_id", string(id)))
+
+				if err = storage.Load(id, buffer); err != nil {
+					m.logger.Error("failed to load logs for machine", zap.String("machine_id", string(id)), zap.Error(err))
+				}
+			}
+
+			return buffer, nil
+		},
+	}
+}
+
+// These constants should some day move to config.
+const (
+	// Some logs are tiny, no need to reserve too much memory.
+	InitialCapacity = 16384
+	// Cap each log at 1M.
+	MaxCapacity = 1048576
+	// Safety gap to avoid buffer overruns.
+	SafetyGap = 2048
+)
+
+// NewMachineMap returns a new MachineMap.
+func NewMachineMap(storage MachineStorage) *MachineMap {
+	return &MachineMap{
+		lazyMap: containers.LazyBiMap[string, MachineID]{
+			Creator: func(ip string) (MachineID, error) {
+				return storage.GetMachine(ip)
+			},
+		},
+	}
+}
+
+// MachineMap is a map of IP to machineID.
+type MachineMap struct {
+	lazyMap containers.LazyBiMap[string, MachineID]
+	mx      sync.Mutex
+}
+
+// MachineID is a machine ID type.
+type MachineID string
+
+// GetMachineID returns the machine ID for the given IP.
+func (m *MachineMap) GetMachineID(ip string) (MachineID, error) {
+	m.mx.Lock()
+	defer m.mx.Unlock()
+
+	return m.lazyMap.GetOrCreate(ip)
+}
+
+// RemoveByMachineID removes the given machine from the map.
+func (m *MachineMap) RemoveByMachineID(id MachineID) {
+	m.mx.Lock()
+	defer m.mx.Unlock()
+
+	m.lazyMap.RemoveInverse(id)
+}
+
+// MachineStorage returns machineID for the given IP.
+type MachineStorage interface {
+	GetMachine(machineIP string) (MachineID, error)
+}
+
+// MapStorage is a concrete implementation of MachineStorage that uses the map.
+type MapStorage struct {
+	IPToMachine map[string]MachineID
+}
+
+// GetMachine returns the machine with the given IP.
+func (s *MapStorage) GetMachine(ip string) (MachineID, error) {
+	if machine, ok := s.IPToMachine[ip]; ok {
+		return machine, nil
+	}
+
+	panic("no machine found")
+}
+
+// NewStateStorage returns a new StateStorage.
+func NewStateStorage(state state.State) *StateStorage {
+	return &StateStorage{state: state}
+}
+
+// StateStorage is a concrete implementation of MachineStorage that uses the state.
+type StateStorage struct {
+	state state.State
+}
+
+// GetMachine returns the machineID from state using the IP address.
+func (s *StateStorage) GetMachine(machineIP string) (MachineID, error) {
+	ctx := actor.MarkContextAsInternalActor(context.Background())
+
+	machines, err := safe.StateListAll[*omni.Machine](
+		ctx,
+		s.state,
+		state.WithLabelQuery(resource.LabelEqual(omni.MachineAddressLabel, machineIP)),
+	)
+	if err != nil {
+		return "", err
+	}
+
+	if machines.Len() == 0 {
+		return "", fmt.Errorf("no machine found for address %s", machineIP)
+	}
+
+	return MachineID(machines.Get(0).Metadata().ID()), nil
+}
+
+// BufferNotFoundError is returned when the machine buffer is not found.
+type BufferNotFoundError struct {
+	id MachineID
+}
+
+// Error returns the error message.
+func (e *BufferNotFoundError) Error() string {
+	return fmt.Sprintf("no buffer found for machine '%s'", e.id)
+}
+
+// IsBufferNotFoundError returns true if the error is of type BufferNotFoundError.
+func IsBufferNotFoundError(err error) bool {
+	var target *BufferNotFoundError
+
+	return errors.As(err, &target)
+}
diff --git a/internal/pkg/siderolink/manager.go b/internal/pkg/siderolink/manager.go
new file mode 100644
index 000000000..39d5aa9bb
--- /dev/null
+++ b/internal/pkg/siderolink/manager.go
@@ -0,0 +1,718 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package siderolink
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/netip"
+	"os"
+	"strconv"
+	"syscall"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/jxskiss/base62"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/siderolabs/gen/channel"
+	"github.com/siderolabs/go-retry/retry"
+	eventsapi "github.com/siderolabs/siderolink/api/events"
+	pb "github.com/siderolabs/siderolink/api/siderolink"
+	"github.com/siderolabs/siderolink/pkg/events"
+	"github.com/siderolabs/siderolink/pkg/wireguard"
+	machineapi "github.com/siderolabs/talos/pkg/machinery/api/machine"
+	talosconstants "github.com/siderolabs/talos/pkg/machinery/constants"
+	"github.com/siderolabs/talos/pkg/machinery/proto"
+	"go.uber.org/zap"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/constants"
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+	"github.com/siderolabs/omni/internal/pkg/config"
+	"github.com/siderolabs/omni/internal/pkg/errgroup"
+	"github.com/siderolabs/omni/internal/pkg/grpcutil"
+	"github.com/siderolabs/omni/internal/pkg/logreceiver"
+	"github.com/siderolabs/omni/internal/pkg/siderolink/trustd"
+)
+
+// LinkCounterDeltas represents a map of link counters deltas.
+type LinkCounterDeltas = map[resource.ID]LinkCounterDelta
+
+// LinkCounterDelta represents a delta of link counters, namely bytes sent and received.
+type LinkCounterDelta struct {
+	LastAlive     time.Time
+	BytesSent     int64
+	BytesReceived int64
+}
+
+// NewManager creates new Manager.
+func NewManager(
+	ctx context.Context,
+	state state.State,
+	wgHandler WireguardHandler,
+	params Params,
+	logger *zap.Logger,
+	handler *LogHandler,
+	deltaCh chan<- LinkCounterDeltas,
+) (*Manager, error) {
+	manager := &Manager{
+		state:      state,
+		wgHandler:  wgHandler,
+		logger:     logger,
+		logHandler: handler,
+		deltaCh:    deltaCh,
+
+		metricBytesReceived: prometheus.NewCounter(prometheus.CounterOpts{
+			Name: "omni_siderolink_received_bytes_total",
+			Help: "Number of bytes received from the SideroLink interface.",
+		}),
+		metricBytesSent: prometheus.NewCounter(prometheus.CounterOpts{
+			Name: "omni_siderolink_sent_bytes_total",
+			Help: "Number of bytes sent to the SideroLink interface.",
+		}),
+		metricLastHandshake: prometheus.NewHistogram(prometheus.HistogramOpts{
+			Name: "omni_siderolink_last_handshake_seconds",
+			Help: "Time since the last handshake with the SideroLink interface.",
+			Buckets: []float64{
+				2 * 60,  // "normal" reconnect
+				4 * 60,  // late, but within the bounds of "connected"
+				8 * 60,  // considered disconnected now
+				16 * 60, // super late
+				32 * 60, // super duper late
+				64 * 60, // more than hour... wth?
+			},
+		}),
+	}
+
+	nodePrefix := wireguard.NetworkPrefix("")
+	manager.serverAddr = netip.PrefixFrom(nodePrefix.Addr().Next(), nodePrefix.Bits())
+
+	cfg, err := manager.getOrCreateConfig(ctx, manager.serverAddr, nodePrefix, params)
+	if err != nil {
+		return nil, err
+	}
+
+	if err = manager.updateConnectionParams(ctx, cfg, params.EventSinkPort); err != nil {
+		return nil, err
+	}
+
+	manager.config = cfg
+
+	return manager, nil
+}
+
+// Manager sets up Siderolink server, manages it's state.
+type Manager struct {
+	pb.UnimplementedProvisionServiceServer
+	config     *siderolink.Config
+	logger     *zap.Logger
+	state      state.State
+	wgHandler  WireguardHandler
+	logHandler *LogHandler
+
+	metricBytesReceived prometheus.Counter
+	metricBytesSent     prometheus.Counter
+	metricLastHandshake prometheus.Histogram
+	deltaCh             chan<- LinkCounterDeltas
+	serverAddr          netip.Prefix
+}
+
+// JoinTokenLen number of random bytes to be encoded in the join token.
+// The real length of the token will depend on the base62 encoding,
+// whose lengths happpens to be non-deterministic.
+const JoinTokenLen = 32
+
+const siderolinkDevJoinTokenEnvVar = "SIDEROLINK_DEV_JOIN_TOKEN"
+
+// getJoinToken returns the join token from the env or generates a new one.
+func getJoinToken(logger *zap.Logger) (string, error) {
+	joinToken := os.Getenv(siderolinkDevJoinTokenEnvVar)
+	if joinToken == "" {
+		return generateJoinToken()
+	}
+
+	if !constants.IsDebugBuild {
+		logger.Sugar().Warnf("environment variable %s is set, but this is not a debug build, ignoring", siderolinkDevJoinTokenEnvVar)
+
+		return generateJoinToken()
+	}
+
+	logger.Sugar().Warnf("using a static join token from environment variable %s. THIS IS NOT RECOMMENDED FOR PRODUCTION USE.", siderolinkDevJoinTokenEnvVar)
+
+	return joinToken, nil
+}
+
+// generateJoinToken generates a base62 encoded token.
+func generateJoinToken() (string, error) {
+	b := make([]byte, JoinTokenLen)
+	if _, err := rand.Read(b); err != nil {
+		return "", fmt.Errorf("failed to read random bytes: %w", err)
+	}
+
+	token := base62.EncodeToString(b)
+
+	return token, nil
+}
+
+// Params are the parameters for the Manager.
+type Params struct {
+	WireguardEndpoint  string
+	AdvertisedEndpoint string
+	APIEndpoint        string
+	Cert               string
+	Key                string
+	EventSinkPort      string
+}
+
+// NewListener creates a new listener.
+func (p *Params) NewListener() (net.Listener, error) {
+	if p.APIEndpoint == "" {
+		return nil, errors.New("no siderolink API endpoint specified")
+	}
+
+	switch {
+	case p.Cert == "" && p.Key == "":
+		// no key, no cert - use plain TCP
+		return net.Listen("tcp", p.APIEndpoint)
+	case p.Cert == "":
+		return nil, errors.New("siderolink cert is required")
+	case p.Key == "":
+		return nil, errors.New("siderolink key is required")
+	}
+
+	cert, err := tls.LoadX509KeyPair(p.Cert, p.Key)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load siderolink cert/key: %w", err)
+	}
+
+	return tls.Listen("tcp", p.APIEndpoint, &tls.Config{
+		Certificates: []tls.Certificate{cert},
+	})
+}
+
+func createListener(ctx context.Context, host, port string) (net.Listener, error) {
+	endpoint := net.JoinHostPort(host, port)
+
+	var (
+		listener net.Listener
+		err      error
+	)
+
+	if err = retry.Constant(20*time.Second, retry.WithUnits(100*time.Millisecond)).RetryWithContext(
+		ctx, func(context.Context) error {
+			listener, err = net.Listen("tcp", endpoint)
+			if errors.Is(err, syscall.EADDRNOTAVAIL) {
+				return retry.ExpectedError(err)
+			}
+
+			return err
+		}); err != nil {
+		return nil, fmt.Errorf("error listening for endpoint %s: %w", endpoint, err)
+	}
+
+	return listener, nil
+}
+
+// Register implements controller.Manager interface.
+func (manager *Manager) Register(
+	server *grpc.Server,
+) {
+	pb.RegisterProvisionServiceServer(server, manager)
+}
+
+// Run implements controller.Manager interface.
+//
+// If eventSinkHost is empty, event sink API will only listen on the siderolink interface.
+func (manager *Manager) Run(
+	ctx context.Context,
+	listenHost string,
+	eventSinkPort string,
+	trustdPort string,
+	logServerPort string,
+) error {
+	eg, groupCtx := errgroup.WithContext(ctx)
+
+	if err := manager.startWireguard(groupCtx, eg, manager.serverAddr); err != nil {
+		return err
+	}
+
+	eg.Go(func() error { return manager.pollWireguardPeers(groupCtx) })
+
+	if listenHost == "" {
+		listenHost = manager.serverAddr.Addr().String()
+	}
+
+	eventSinkListener, err := createListener(ctx, listenHost, eventSinkPort)
+	if err != nil {
+		return err
+	}
+
+	trustdListener, err := createListener(ctx, listenHost, trustdPort)
+	if err != nil {
+		return err
+	}
+
+	manager.startEventsGRPC(groupCtx, eg, eventSinkListener)
+	manager.startTrustdGRPC(groupCtx, eg, trustdListener, manager.serverAddr)
+
+	if logServerPort != "" {
+		// Check that the log server port is set, and we are actually running the server
+		err := manager.startLogServer(groupCtx, eg, manager.serverAddr, logServerPort)
+		if err != nil {
+			return err
+		}
+	}
+
+	return eg.Wait()
+}
+
+func (manager *Manager) getOrCreateConfig(ctx context.Context, serverAddr netip.Prefix, nodePrefix netip.Prefix, params Params) (*siderolink.Config, error) {
+	// get the existing configuration, or create a new one if it doesn't exist
+	cfg, err := safe.StateGet[*siderolink.Config](ctx, manager.state, resource.NewMetadata(siderolink.Namespace, siderolink.ConfigType, siderolink.ConfigID, resource.VersionUndefined))
+	if err != nil {
+		if !state.IsNotFoundError(err) {
+			return nil, err
+		}
+
+		newConfig := siderolink.NewConfig(siderolink.Namespace)
+		cfg = newConfig
+
+		spec := newConfig.TypedSpec().Value
+
+		var privateKey wgtypes.Key
+
+		privateKey, err = wgtypes.GeneratePrivateKey()
+		if err != nil {
+			return nil, fmt.Errorf("error generating key: %w", err)
+		}
+
+		spec.WireguardEndpoint = params.WireguardEndpoint
+		spec.AdvertisedEndpoint = params.AdvertisedEndpoint
+		spec.PrivateKey = privateKey.String()
+		spec.PublicKey = privateKey.PublicKey().String()
+		spec.ServerAddress = serverAddr.Addr().String()
+		spec.Subnet = nodePrefix.String()
+
+		var joinToken string
+
+		joinToken, err = getJoinToken(manager.logger)
+		if err != nil {
+			return nil, fmt.Errorf("error getting join token: %w", err)
+		}
+
+		spec.JoinToken = joinToken
+
+		if err = manager.state.Create(ctx, cfg); err != nil {
+			return nil, err
+		}
+	}
+
+	// start siderolink
+	if cfg, err = safe.StateUpdateWithConflicts(ctx, manager.state, cfg.Metadata(), func(cfg *siderolink.Config) error {
+		spec := cfg.TypedSpec().Value
+		spec.WireguardEndpoint = params.WireguardEndpoint
+		spec.AdvertisedEndpoint = params.AdvertisedEndpoint
+
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+
+	return cfg, nil
+}
+
+func (manager *Manager) wgConfig() *specs.SiderolinkConfigSpec {
+	return manager.config.TypedSpec().Value
+}
+
+func (manager *Manager) startWireguard(ctx context.Context, eg *errgroup.Group, serverAddr netip.Prefix) error {
+	key, err := wgtypes.ParseKey(manager.wgConfig().PrivateKey)
+	if err != nil {
+		return fmt.Errorf("invalid private key: %w", err)
+	}
+
+	if err = manager.wgHandler.SetupDevice(serverAddr, key, manager.wgConfig().WireguardEndpoint, manager.logger); err != nil {
+		return err
+	}
+
+	eg.Go(func() error {
+		defer func() {
+			err := manager.wgHandler.Shutdown()
+			if err != nil {
+				manager.logger.Error("error shutting down wireguard handler", zap.Error(err))
+			}
+		}()
+
+		return manager.wgHandler.Run(ctx, manager.logger)
+	})
+
+	return nil
+}
+
+func (manager *Manager) startEventsGRPC(ctx context.Context, eg *errgroup.Group, listener net.Listener) {
+	server := grpc.NewServer(
+		grpc.SharedWriteBuffer(true),
+	)
+	adapter := NewEventsAdapter(manager.state, manager.logger)
+	sink := events.NewSink(adapter, []proto.Message{
+		&machineapi.MachineStatusEvent{},
+	})
+	eventsapi.RegisterEventSinkServiceServer(server, sink)
+
+	eg.Go(func() error {
+		err := adapter.CleanupMachineStatuses(
+			ctx,
+			manager.logger.With(
+				zap.String("component", "events_machine_status_cleanup"),
+			),
+		)
+		if err != nil {
+			err = fmt.Errorf("machine status cleanup failed: %w", err)
+		}
+
+		return err
+	})
+
+	grpcutil.RunServer(ctx, server, listener, eg)
+}
+
+func (manager *Manager) startTrustdGRPC(ctx context.Context, eg *errgroup.Group, listener net.Listener, serverAddr netip.Prefix) {
+	server := trustd.NewServer(manager.logger, manager.state, serverAddr.Addr().AsSlice()) //nolint:contextcheck
+
+	grpcutil.RunServer(ctx, server, listener, eg)
+}
+
+func (manager *Manager) startLogServer(ctx context.Context, eg *errgroup.Group, serverAddr netip.Prefix, logServerPort string) error {
+	logServerBindAddr := net.JoinHostPort(serverAddr.Addr().String(), logServerPort)
+
+	logServer, err := logreceiver.MakeServer(logServerBindAddr, manager.logHandler, manager.logger)
+	if err != nil {
+		return err
+	}
+
+	manager.logger.Info("started log server", zap.String("bind_address", logServerBindAddr))
+
+	eg.Go(logServer.Serve)
+	eg.Go(func() error {
+		<-ctx.Done()
+		logServer.Stop()
+
+		return nil
+	})
+
+	return nil
+}
+
+//nolint:gocognit,gocyclo,cyclop
+func (manager *Manager) pollWireguardPeers(ctx context.Context) error {
+	links, err := safe.StateListAll[*siderolink.Link](ctx, manager.state)
+	if err != nil {
+		return err
+	}
+
+	for iter := links.Iterator(); iter.Next(); {
+		spec := iter.Value().TypedSpec().Value
+
+		if err = manager.wgHandler.PeerEvent(ctx, spec, false); err != nil {
+			return err
+		}
+	}
+
+	ticker := time.NewTicker(time.Second * 30)
+
+	defer ticker.Stop()
+
+	previous := map[string]struct {
+		receiveBytes  int64
+		transmitBytes int64
+	}{}
+
+	var (
+		updateCounter       int
+		checkPeerConnection bool
+	)
+
+	// Poll wireguard peers
+	for {
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-ticker.C:
+			peers, err := manager.wgHandler.Peers()
+			if err != nil {
+				return err
+			}
+
+			// waiting for some grace period after the manager just started
+			// check runs every 30 seconds, 60 seconds will pass after the second tick
+			// after 2 iterations we enable peer connectivity check
+			if updateCounter < 2 {
+				updateCounter++
+			} else {
+				checkPeerConnection = true
+			}
+
+			peersByKey := map[string]wgtypes.Peer{}
+
+			for _, peer := range peers {
+				peersByKey[peer.PublicKey.String()] = peer
+			}
+
+			links, err := safe.StateListAll[*siderolink.Link](ctx, manager.state)
+			if err != nil {
+				return err
+			}
+
+			counterDeltas := make(LinkCounterDeltas, links.Len())
+
+			for iter := links.Iterator(); iter.Next(); {
+				link := iter.Value()
+				spec := link.TypedSpec().Value
+
+				peer, ok := peersByKey[spec.NodePublicKey]
+				if !ok {
+					continue
+				}
+
+				deltaReceived := peer.ReceiveBytes - previous[spec.NodePublicKey].receiveBytes
+				if deltaReceived > 0 {
+					manager.metricBytesReceived.Add(float64(deltaReceived))
+				}
+
+				deltaSent := peer.TransmitBytes - previous[spec.NodePublicKey].transmitBytes
+				if deltaSent > 0 {
+					manager.metricBytesSent.Add(float64(deltaSent))
+				}
+
+				counterDeltas[link.Metadata().ID()] = LinkCounterDelta{
+					BytesSent:     deltaSent,
+					BytesReceived: deltaReceived,
+					LastAlive:     peer.LastHandshakeTime,
+				}
+
+				previous[spec.NodePublicKey] = struct {
+					receiveBytes  int64
+					transmitBytes int64
+				}{
+					receiveBytes:  peer.ReceiveBytes,
+					transmitBytes: peer.TransmitBytes,
+				}
+
+				sinceLastHandshake := time.Since(peer.LastHandshakeTime)
+
+				manager.metricLastHandshake.Observe(sinceLastHandshake.Seconds())
+
+				if _, err = safe.StateUpdateWithConflicts(ctx, manager.state, link.Metadata(), func(res *siderolink.Link) error {
+					spec = res.TypedSpec().Value
+					if checkPeerConnection || !peer.LastHandshakeTime.IsZero() {
+						spec.Connected = sinceLastHandshake < wireguard.PeerDownInterval
+					}
+
+					if !config.Config.SiderolinkDisableLastEndpoint {
+						spec.LastEndpoint = ""
+
+						return nil
+					}
+
+					if peer.Endpoint != nil {
+						spec.LastEndpoint = peer.Endpoint.String()
+					}
+
+					return nil
+				}); err != nil && !state.IsNotFoundError(err) && !state.IsPhaseConflictError(err) {
+					return fmt.Errorf("failed to update link %w", err)
+				}
+			}
+
+			if manager.deltaCh != nil {
+				channel.SendWithContext(ctx, manager.deltaCh, counterDeltas)
+			}
+		}
+	}
+}
+
+func (manager *Manager) updateConnectionParams(ctx context.Context, siderolinkConfig *siderolink.Config, eventSinkPort string) error {
+	connectionParams := siderolink.NewConnectionParams(
+		resources.DefaultNamespace,
+		siderolinkConfig.Metadata().ID(),
+	)
+
+	var err error
+
+	if err = manager.state.Create(ctx, connectionParams); err != nil && !state.IsConflictError(err) {
+		return err
+	}
+
+	if _, err = safe.StateUpdateWithConflicts(ctx, manager.state, connectionParams.Metadata(), func(res *siderolink.ConnectionParams) error {
+		spec := res.TypedSpec().Value
+
+		spec.ApiEndpoint = config.Config.SideroLinkAPIURL
+		spec.JoinToken = siderolinkConfig.TypedSpec().Value.JoinToken
+		spec.WireguardEndpoint = siderolinkConfig.TypedSpec().Value.AdvertisedEndpoint
+
+		spec.Args = fmt.Sprintf("%s=%s?jointoken=%s %s=%s %s=tcp://%s",
+			talosconstants.KernelParamSideroLink,
+			spec.ApiEndpoint,
+			siderolinkConfig.TypedSpec().Value.JoinToken,
+			talosconstants.KernelParamEventsSink,
+			net.JoinHostPort(
+				siderolinkConfig.TypedSpec().Value.ServerAddress,
+				eventSinkPort,
+			),
+			talosconstants.KernelParamLoggingKernel,
+			net.JoinHostPort(
+				siderolinkConfig.TypedSpec().Value.ServerAddress,
+				strconv.Itoa(config.Config.LogServerPort),
+			),
+		)
+
+		manager.logger.Info(fmt.Sprintf("add this kernel argument to a Talos instance you would like to connect: %s", spec.Args))
+
+		return nil
+	}); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+type isDirty bool
+
+// getLink will return either the existing Link for the requesting node or a new Link.
+func (manager *Manager) getLink(ctx context.Context, req *pb.ProvisionRequest, id string) (*siderolink.Link, isDirty, error) {
+	res, err := safe.StateGet[*siderolink.Link](ctx, manager.state, resource.NewMetadata(siderolink.Namespace, siderolink.LinkType, id, resource.VersionUndefined))
+	if state.IsNotFoundError(err) {
+		if manager.wgConfig().JoinToken == "" {
+			return nil, false, status.Error(codes.PermissionDenied, "cannot accept new nodes if no join token is set")
+		}
+
+		if req.JoinToken == nil || *req.JoinToken != manager.wgConfig().JoinToken {
+			return nil, false, status.Error(codes.PermissionDenied, "invalid join token")
+		}
+
+		var spec *specs.SiderolinkSpec
+
+		spec, err = manager.generateLinkSpec(req)
+		if err != nil {
+			return nil, false, err
+		}
+
+		spec.Connected = true
+
+		link := siderolink.NewLink(siderolink.Namespace, id, spec)
+
+		if err = manager.state.Create(ctx, link); err != nil {
+			return nil, false, err
+		}
+
+		return link, true, nil
+	}
+
+	return res, false, err
+}
+
+// Provision the SideroLink.
+func (manager *Manager) Provision(ctx context.Context, req *pb.ProvisionRequest) (*pb.ProvisionResponse, error) {
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	link, dirty, err := manager.getLink(ctx, req, req.NodeUuid)
+	if err != nil {
+		return nil, err
+	}
+
+	spec := link.TypedSpec().Value
+	if spec.NodePublicKey != req.NodePublicKey {
+		if _, err = safe.StateUpdateWithConflicts(ctx, manager.state, link.Metadata(), func(r *siderolink.Link) error {
+			s := r.TypedSpec().Value
+
+			if err = manager.wgHandler.PeerEvent(ctx, s, true); err != nil {
+				return err
+			}
+
+			s.NodePublicKey = req.NodePublicKey
+
+			spec = s
+
+			return nil
+		}); err != nil {
+			return nil, err
+		}
+
+		dirty = true
+	}
+
+	if dirty {
+		if err = manager.wgHandler.PeerEvent(ctx, spec, false); err != nil {
+			return nil, err
+		}
+	}
+
+	endpoint := manager.wgConfig().WireguardEndpoint
+	if manager.wgConfig().AdvertisedEndpoint != "" {
+		endpoint = manager.wgConfig().AdvertisedEndpoint
+	}
+
+	return &pb.ProvisionResponse{
+		ServerEndpoint:    []string{endpoint},
+		ServerPublicKey:   manager.wgConfig().PublicKey,
+		ServerAddress:     manager.wgConfig().ServerAddress,
+		NodeAddressPrefix: spec.NodeSubnet,
+	}, nil
+}
+
+func (manager *Manager) generateLinkSpec(req *pb.ProvisionRequest) (*specs.SiderolinkSpec, error) {
+	nodePrefix := netip.MustParsePrefix(manager.wgConfig().Subnet)
+
+	// generated random address for the node
+	raw := nodePrefix.Addr().As16()
+	salt := make([]byte, 8)
+
+	_, err := io.ReadFull(rand.Reader, salt)
+	if err != nil {
+		return nil, err
+	}
+
+	copy(raw[8:], salt)
+
+	nodeAddress := netip.PrefixFrom(netip.AddrFrom16(raw), nodePrefix.Bits())
+
+	pubKey, err := wgtypes.ParseKey(req.NodePublicKey)
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, fmt.Sprintf("error parsing Wireguard key: %s", err))
+	}
+
+	return &specs.SiderolinkSpec{
+		NodeSubnet:    nodeAddress.String(),
+		NodePublicKey: pubKey.String(),
+	}, nil
+}
+
+// Describe implements prom.Collector interface.
+func (manager *Manager) Describe(ch chan<- *prometheus.Desc) {
+	prometheus.DescribeByCollect(manager, ch)
+}
+
+// Collect implements prom.Collector interface.
+func (manager *Manager) Collect(ch chan<- prometheus.Metric) {
+	ch <- manager.metricBytesReceived
+	ch <- manager.metricBytesSent
+	ch <- manager.metricLastHandshake
+}
+
+var _ prometheus.Collector = &Manager{}
diff --git a/internal/pkg/siderolink/siderolink.go b/internal/pkg/siderolink/siderolink.go
new file mode 100644
index 000000000..a04348419
--- /dev/null
+++ b/internal/pkg/siderolink/siderolink.go
@@ -0,0 +1,7 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package siderolink implements siderolink manager.
+package siderolink
diff --git a/internal/pkg/siderolink/siderolink_test.go b/internal/pkg/siderolink/siderolink_test.go
new file mode 100644
index 000000000..fbc6366f4
--- /dev/null
+++ b/internal/pkg/siderolink/siderolink_test.go
@@ -0,0 +1,274 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package siderolink_test
+
+import (
+	"context"
+	"errors"
+	"net/netip"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/resource/rtestutils"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	"github.com/cosi-project/runtime/pkg/state/impl/inmem"
+	"github.com/cosi-project/runtime/pkg/state/impl/namespaced"
+	"github.com/siderolabs/go-retry/retry"
+	pb "github.com/siderolabs/siderolink/api/siderolink"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/suite"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zaptest"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/protobuf/proto"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/siderolink"
+	"github.com/siderolabs/omni/internal/pkg/config"
+	"github.com/siderolabs/omni/internal/pkg/errgroup"
+	"github.com/siderolabs/omni/internal/pkg/grpcutil"
+	sideromanager "github.com/siderolabs/omni/internal/pkg/siderolink"
+)
+
+type fakeWireguardHandler struct {
+	logger   *zap.Logger
+	loggerMu sync.Mutex
+}
+
+func (h *fakeWireguardHandler) SetupDevice(netip.Prefix, wgtypes.Key, string, *zap.Logger) error {
+	return nil
+}
+
+func (h *fakeWireguardHandler) Run(ctx context.Context, logger *zap.Logger) error {
+	unlock := safeLock(&h.loggerMu)
+	defer unlock()
+
+	h.logger = logger
+
+	unlock()
+	<-ctx.Done()
+
+	return nil
+}
+
+func (h *fakeWireguardHandler) Shutdown() error {
+	return nil
+}
+
+func (h *fakeWireguardHandler) PeerEvent(_ context.Context, spec *specs.SiderolinkSpec, deleted bool) error {
+	h.loggerMu.Lock()
+	defer h.loggerMu.Unlock()
+
+	msg := "updated peer"
+	if deleted {
+		msg = "removed peer"
+	}
+
+	h.logger.Info(msg, zap.String("public_key", spec.NodePublicKey), zap.String("address", spec.NodeSubnet))
+
+	return nil
+}
+
+func (h *fakeWireguardHandler) Peers() ([]wgtypes.Peer, error) {
+	return []wgtypes.Peer{}, nil
+}
+
+type SiderolinkSuite struct {
+	suite.Suite
+
+	ctx       context.Context //nolint:containedctx
+	ctxCancel context.CancelFunc
+
+	state   state.State
+	manager *sideromanager.Manager
+	address string
+
+	wg sync.WaitGroup
+}
+
+func (suite *SiderolinkSuite) SetupTest() {
+	suite.ctx, suite.ctxCancel = context.WithTimeout(context.Background(), 3*time.Minute)
+
+	suite.state = state.WrapCore(namespaced.NewState(inmem.Build))
+
+	params := sideromanager.Params{
+		WireguardEndpoint:  "127.0.0.1:0",
+		AdvertisedEndpoint: config.Config.SiderolinkWireguardAdvertisedAddress,
+		APIEndpoint:        "127.0.0.1:0",
+	}
+
+	var err error
+
+	suite.manager, err = sideromanager.NewManager(suite.ctx, suite.state, &fakeWireguardHandler{}, params, zaptest.NewLogger(suite.T()), nil, nil)
+	suite.Require().NoError(err)
+
+	suite.startManager(params)
+}
+
+func (suite *SiderolinkSuite) startManager(params sideromanager.Params) {
+	suite.wg.Add(1)
+
+	lis, err := params.NewListener()
+	suite.Require().NoError(err)
+
+	suite.address = lis.Addr().String()
+
+	go func() {
+		defer suite.wg.Done()
+
+		eg, groupCtx := errgroup.WithContext(suite.ctx)
+
+		server := grpc.NewServer()
+
+		suite.manager.Register(
+			server,
+		)
+
+		eg.Go(func() error {
+			return suite.manager.Run(
+				groupCtx,
+				"127.0.0.1",
+				"0",
+				"0",
+				"",
+			)
+		})
+
+		grpcutil.RunServer(groupCtx, server, lis, eg)
+
+		suite.Require().NoError(eg.Wait())
+	}()
+}
+
+func (suite *SiderolinkSuite) TestNodes() {
+	var spec *specs.ConnectionParamsSpec
+
+	ctx, cancel := context.WithTimeout(suite.ctx, time.Second*2)
+	defer cancel()
+
+	rtestutils.AssertResources[*siderolink.Config](ctx, suite.T(), suite.state, []string{
+		siderolink.ConfigID,
+	}, func(r *siderolink.Config, assertion *assert.Assertions) {
+		assertion.NotEmpty(r.TypedSpec().Value.JoinToken)
+		assertion.NotEmpty(r.TypedSpec().Value.PrivateKey)
+		assertion.NotEmpty(r.TypedSpec().Value.PublicKey)
+	})
+
+	rtestutils.AssertResources[*siderolink.ConnectionParams](ctx, suite.T(), suite.state, []string{
+		siderolink.ConfigID,
+	}, func(r *siderolink.ConnectionParams, assertion *assert.Assertions) {
+		assertion.NotEmpty(r.TypedSpec().Value.Args)
+		assertion.NotEmpty(r.TypedSpec().Value.ApiEndpoint)
+		assertion.NotEmpty(r.TypedSpec().Value.JoinToken)
+		assertion.NotEmpty(r.TypedSpec().Value.WireguardEndpoint)
+
+		spec = r.TypedSpec().Value
+	})
+
+	conn, err := grpc.DialContext(suite.ctx, suite.address, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	suite.Require().NoError(err)
+
+	client := pb.NewProvisionServiceClient(conn)
+
+	privateKey, err := wgtypes.GeneratePrivateKey()
+	suite.Require().NoError(err)
+
+	resp, err := client.Provision(suite.ctx, &pb.ProvisionRequest{
+		NodeUuid:      "testnode",
+		NodePublicKey: privateKey.PublicKey().String(),
+		JoinToken:     &spec.JoinToken,
+	})
+
+	suite.Require().NoError(err)
+
+	suite.Assert().NoError(
+		retry.Constant(time.Second * 2).Retry(func() error {
+			list, err := suite.state.List(suite.ctx, resource.NewMetadata(siderolink.Namespace, siderolink.LinkType, "", resource.VersionUndefined)) //nolint:govet
+			if err != nil {
+				return err
+			}
+
+			if len(list.Items) == 0 {
+				return retry.ExpectedErrorf("no links established yet")
+			}
+
+			for _, item := range list.Items {
+				if item.Metadata().ID() == "" {
+					return errors.New("empty id in the resource list")
+				}
+			}
+
+			return nil
+		}),
+	)
+
+	reprovision, err := client.Provision(suite.ctx, &pb.ProvisionRequest{
+		NodeUuid:      "testnode",
+		NodePublicKey: privateKey.PublicKey().String(),
+		JoinToken:     &spec.JoinToken,
+	})
+
+	suite.Assert().NoError(err)
+	suite.Require().True(proto.Equal(resp, reprovision))
+
+	privateKey, err = wgtypes.GeneratePrivateKey()
+	suite.Assert().NoError(err)
+
+	reprovision, err = client.Provision(suite.ctx, &pb.ProvisionRequest{
+		NodeUuid:      "testnode",
+		NodePublicKey: privateKey.PublicKey().String(),
+		JoinToken:     &spec.JoinToken,
+	})
+
+	suite.Assert().NoError(err)
+	suite.Require().True(proto.Equal(resp, reprovision))
+
+	resource, err := safe.StateGet[*siderolink.Link](suite.ctx, suite.state, resource.NewMetadata(siderolink.Namespace, siderolink.LinkType, "testnode", resource.VersionUndefined))
+	suite.Assert().NoError(err)
+	suite.Require().Equal(privateKey.PublicKey().String(), resource.TypedSpec().Value.NodePublicKey)
+}
+
+func (suite *SiderolinkSuite) TestGenerateJoinToken() {
+	token, err := sideromanager.GenerateJoinToken()
+
+	suite.Assert().NoError(err)
+
+	tokenLen := len(token)
+	suite.Assert().Less(tokenLen, 52)
+	suite.Assert().Greater(tokenLen, 42)
+}
+
+func (suite *SiderolinkSuite) TearDownTest() {
+	suite.T().Log("tear down")
+
+	suite.ctxCancel()
+
+	suite.wg.Wait()
+}
+
+func TestSiderolinkSuite(t *testing.T) {
+	suite.Run(t, new(SiderolinkSuite))
+}
+
+func safeLock(mx sync.Locker) func() {
+	mx.Lock()
+
+	var locked atomic.Bool
+
+	locked.Store(true)
+
+	return func() {
+		if locked.Swap(false) {
+			mx.Unlock()
+		}
+	}
+}
diff --git a/internal/pkg/siderolink/trustd/server.go b/internal/pkg/siderolink/trustd/server.go
new file mode 100644
index 000000000..7d1063c7a
--- /dev/null
+++ b/internal/pkg/siderolink/trustd/server.go
@@ -0,0 +1,148 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package trustd
+
+import (
+	"context"
+	stdx509 "crypto/x509"
+	"encoding/pem"
+	"net"
+
+	"github.com/cosi-project/runtime/pkg/resource"
+	"github.com/cosi-project/runtime/pkg/safe"
+	"github.com/cosi-project/runtime/pkg/state"
+	grpc_ctxtags "github.com/grpc-ecosystem/go-grpc-middleware/tags"
+	"github.com/siderolabs/crypto/x509"
+	securityapi "github.com/siderolabs/talos/pkg/machinery/api/security"
+	"github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
+	"go.uber.org/zap"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+	"google.golang.org/grpc/status"
+
+	"github.com/siderolabs/omni/client/pkg/omni/resources"
+	"github.com/siderolabs/omni/client/pkg/omni/resources/omni"
+	"github.com/siderolabs/omni/internal/pkg/auth/actor"
+)
+
+type handler struct {
+	securityapi.UnimplementedSecurityServiceServer
+
+	state  state.State
+	logger *zap.Logger
+}
+
+func getSecretsBundle(ctx context.Context, st state.State, peerAddress string) (*secrets.Bundle, error) {
+	ctx = actor.MarkContextAsInternalActor(ctx)
+
+	machines, err := safe.StateListAll[*omni.Machine](
+		ctx,
+		st,
+		state.WithLabelQuery(resource.LabelEqual(omni.MachineAddressLabel, peerAddress)),
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.PermissionDenied, "failed to list machines: %s", err)
+	}
+
+	if machines.Len() != 1 {
+		return nil, status.Errorf(codes.PermissionDenied, "failed to find machine with address %s", peerAddress)
+	}
+
+	machine := machines.Get(0)
+
+	clusterMachine, err := safe.StateGet[*omni.ClusterMachine](ctx, st, resource.NewMetadata(resources.DefaultNamespace, omni.ClusterMachineType, machine.Metadata().ID(), resource.VersionUndefined))
+	if err != nil {
+		return nil, status.Errorf(codes.PermissionDenied, "failed to get cluster machine: %s", err)
+	}
+
+	clusterID, ok := clusterMachine.Metadata().Labels().Get(omni.LabelCluster)
+	if !ok {
+		return nil, status.Errorf(codes.PermissionDenied, "failed to get cluster ID from cluster machine %s", machine.Metadata().ID())
+	}
+
+	grpc_ctxtags.Extract(ctx).Set("cluster", clusterID)
+
+	clusterSecrets, err := safe.StateGet[*omni.ClusterSecrets](ctx, st, resource.NewMetadata(resources.DefaultNamespace, omni.ClusterSecretsType, clusterID, resource.VersionUndefined))
+	if err != nil {
+		return nil, status.Errorf(codes.PermissionDenied, "failed to get cluster secrets: %s", err)
+	}
+
+	return omni.ToSecretsBundle(clusterSecrets)
+}
+
+// Certificate implements the securityapi.SecurityServer interface.
+//
+// This API is called by Talos worker nodes to request a server certificate for apid running on the node.
+// Control plane nodes generate certificates (client and server) directly from machine config PKI.
+func (h *handler) Certificate(ctx context.Context, in *securityapi.CertificateRequest) (resp *securityapi.CertificateResponse, err error) {
+	remotePeer, ok := peer.FromContext(ctx)
+	if !ok {
+		return nil, status.Error(codes.PermissionDenied, "peer not found")
+	}
+
+	tcpAddr, ok := remotePeer.Addr.(*net.TCPAddr)
+	if !ok {
+		return nil, status.Error(codes.PermissionDenied, "peer address is not TCP")
+	}
+
+	secretsBundle, err := getSecretsBundle(ctx, h.state, tcpAddr.IP.String())
+	if err != nil {
+		return nil, err
+	}
+
+	// validate the token
+	md, _ := metadata.FromIncomingContext(ctx)
+	if token := md.Get("token"); len(token) != 1 || token[0] != secretsBundle.TrustdInfo.Token {
+		return nil, status.Error(codes.PermissionDenied, "invalid token")
+	}
+
+	// decode and validate CSR
+	csrPemBlock, _ := pem.Decode(in.Csr)
+	if csrPemBlock == nil {
+		return nil, status.Errorf(codes.InvalidArgument, "failed to decode CSR")
+	}
+
+	request, err := stdx509.ParseCertificateRequest(csrPemBlock.Bytes)
+	if err != nil {
+		return nil, status.Errorf(codes.InvalidArgument, "failed to parse CSR: %s", err)
+	}
+
+	h.logger.Info("received CSR signing request",
+		zap.Stringer("remote_addr", remotePeer.Addr),
+		zap.Stringer("subject", request.Subject),
+		zap.Strings("dns_names", request.DNSNames),
+		zap.Stringers("ip_adresses", request.IPAddresses),
+	)
+
+	// allow only server auth certificates
+	x509Opts := []x509.Option{
+		x509.KeyUsage(stdx509.KeyUsageDigitalSignature),
+		x509.ExtKeyUsage([]stdx509.ExtKeyUsage{stdx509.ExtKeyUsageServerAuth}),
+	}
+
+	// don't allow any certificates which can be used for client authentication
+	if len(request.Subject.Organization) > 0 {
+		return nil, status.Error(codes.PermissionDenied, "organization field is not allowed in CSR")
+	}
+
+	signed, err := x509.NewCertificateFromCSRBytes(
+		secretsBundle.Certs.OS.Crt,
+		secretsBundle.Certs.OS.Key,
+		in.Csr,
+		x509Opts...,
+	)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "failed to sign CSR: %s", err)
+	}
+
+	resp = &securityapi.CertificateResponse{
+		Ca:  secretsBundle.Certs.OS.Crt,
+		Crt: signed.X509CertificatePEM,
+	}
+
+	return resp, nil
+}
diff --git a/internal/pkg/siderolink/trustd/trustd.go b/internal/pkg/siderolink/trustd/trustd.go
new file mode 100644
index 000000000..43398eb30
--- /dev/null
+++ b/internal/pkg/siderolink/trustd/trustd.go
@@ -0,0 +1,121 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package trustd provides "extra" virtual trustd for Talos workers.
+//
+// This trustd allows worker nodes to start apid even if the cluster control plane is down.
+package trustd
+
+import (
+	"crypto/tls"
+	stdlibx509 "crypto/x509"
+	"errors"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/cosi-project/runtime/pkg/state"
+	grpc_zap "github.com/grpc-ecosystem/go-grpc-middleware/logging/zap"
+	grpc_recovery "github.com/grpc-ecosystem/go-grpc-middleware/recovery"
+	grpc_ctxtags "github.com/grpc-ecosystem/go-grpc-middleware/tags"
+	grpc_prometheus "github.com/grpc-ecosystem/go-grpc-prometheus"
+	"github.com/siderolabs/crypto/x509"
+	securityapi "github.com/siderolabs/talos/pkg/machinery/api/security"
+	"go.uber.org/zap"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/status"
+)
+
+func recoveryHandler(logger *zap.Logger) grpc_recovery.RecoveryHandlerFunc {
+	return func(p any) error {
+		if logger != nil {
+			logger.Error("grpc panic", zap.Any("panic", p), zap.Stack("stack"))
+		}
+
+		return status.Errorf(codes.Internal, "internal error")
+	}
+}
+
+// getCertificate provides dynamic server certificate for trustd based on the calling cluster member.
+func getCertificate(st state.State, serverAddr net.IP) func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
+	return func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
+		tcpAddr, ok := info.Conn.RemoteAddr().(*net.TCPAddr)
+		if !ok {
+			return nil, errors.New("failed to get remote address")
+		}
+
+		secretsBundle, err := getSecretsBundle(info.Context(), st, tcpAddr.IP.String())
+		if err != nil {
+			return nil, err
+		}
+
+		// issue a short-lived cert for trustd for this connection
+		ca, err := x509.NewCertificateAuthorityFromCertificateAndKey(secretsBundle.Certs.OS)
+		if err != nil {
+			return nil, fmt.Errorf("failed to parse CA certificate: %w", err)
+		}
+
+		serverCert, err := x509.NewKeyPair(ca,
+			x509.IPAddresses([]net.IP{serverAddr}),
+			x509.CommonName("omni"),
+			x509.NotAfter(time.Now().Add(5*time.Minute)),
+			x509.KeyUsage(stdlibx509.KeyUsageDigitalSignature|stdlibx509.KeyUsageKeyEncipherment),
+			x509.ExtKeyUsage([]stdlibx509.ExtKeyUsage{
+				stdlibx509.ExtKeyUsageServerAuth,
+			}),
+		)
+		if err != nil {
+			return nil, fmt.Errorf("failed to generate API server cert: %w", err)
+		}
+
+		return serverCert.Certificate, nil
+	}
+}
+
+// NewServer initializes grpc server for trustd.
+func NewServer(logger *zap.Logger, st state.State, serverAddr net.IP) *grpc.Server {
+	recoveryOpt := grpc_recovery.WithRecoveryHandler(recoveryHandler(logger))
+
+	grpc_prometheus.EnableHandlingTimeHistogram(grpc_prometheus.WithHistogramBuckets([]float64{0.001, 0.01, 0.1, 1, 10, 30, 60, 120, 300, 600}))
+
+	unaryInterceptors := []grpc.UnaryServerInterceptor{
+		grpc_ctxtags.UnaryServerInterceptor(),
+		grpc_zap.UnaryServerInterceptor(logger),
+		grpc_prometheus.UnaryServerInterceptor,
+		grpc_recovery.UnaryServerInterceptor(recoveryOpt),
+	}
+
+	streamInterceptors := []grpc.StreamServerInterceptor{
+		grpc_ctxtags.StreamServerInterceptor(),
+		grpc_zap.StreamServerInterceptor(logger),
+		grpc_prometheus.StreamServerInterceptor,
+		grpc_recovery.StreamServerInterceptor(recoveryOpt),
+	}
+
+	tlsConfig := &tls.Config{
+		MinVersion:     tls.VersionTLS13,
+		GetCertificate: getCertificate(st, serverAddr),
+		ClientAuth:     tls.NoClientCert,
+	}
+
+	options := []grpc.ServerOption{
+		grpc.ChainUnaryInterceptor(unaryInterceptors...),
+		grpc.ChainStreamInterceptor(streamInterceptors...),
+		grpc.Creds(
+			credentials.NewTLS(tlsConfig),
+		),
+		grpc.SharedWriteBuffer(true),
+	}
+
+	server := grpc.NewServer(options...)
+	securityapi.RegisterSecurityServiceServer(server, &handler{
+		logger: logger,
+		state:  st,
+	})
+
+	return server
+}
diff --git a/internal/pkg/siderolink/wireguard.go b/internal/pkg/siderolink/wireguard.go
new file mode 100644
index 000000000..bbf6005d0
--- /dev/null
+++ b/internal/pkg/siderolink/wireguard.go
@@ -0,0 +1,102 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package siderolink
+
+import (
+	"context"
+	"fmt"
+	"net/netip"
+
+	"github.com/siderolabs/go-pointer"
+	"github.com/siderolabs/siderolink/pkg/wireguard"
+	"go.uber.org/zap"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/siderolabs/omni/client/api/omni/specs"
+)
+
+// WireguardHandler abstraction around peer handler and wgDevice.
+type WireguardHandler interface {
+	SetupDevice(netip.Prefix, wgtypes.Key, string, *zap.Logger) error
+	Shutdown() error
+	Run(context.Context, *zap.Logger) error
+	PeerEvent(context.Context, *specs.SiderolinkSpec, bool) error
+	Peers() ([]wgtypes.Peer, error)
+}
+
+// PhysicalWireguardHandler implements WireguardHandler interface.
+type PhysicalWireguardHandler struct {
+	wgDevice *wireguard.Device
+	events   chan wireguard.PeerEvent
+}
+
+// DefaultWireguardHandler is a default wireguard handler to be used with the siderolink manager.
+var DefaultWireguardHandler = &PhysicalWireguardHandler{events: make(chan wireguard.PeerEvent)}
+
+// PeerEvent implements WireguardHandler.
+func (handler *PhysicalWireguardHandler) PeerEvent(ctx context.Context, spec *specs.SiderolinkSpec, deleted bool) error {
+	address, err := netip.ParsePrefix(spec.NodeSubnet)
+	if err != nil {
+		return err
+	}
+
+	pubKey, err := wgtypes.ParseKey(spec.NodePublicKey)
+	if err != nil {
+		return err
+	}
+
+	select {
+	case <-ctx.Done():
+	case handler.events <- wireguard.PeerEvent{
+		PubKey:                      pubKey,
+		Address:                     address.Addr(),
+		Remove:                      deleted,
+		Endpoint:                    spec.LastEndpoint,
+		PersistentKeepAliveInterval: pointer.To(wireguard.RecommendedPersistentKeepAliveInterval),
+	}:
+	}
+
+	return nil
+}
+
+// EventCh implements the wireguard.PeerSource interface.
+func (handler *PhysicalWireguardHandler) EventCh() <-chan wireguard.PeerEvent {
+	return handler.events
+}
+
+// SetupDevice implements WireguardHandler.
+func (handler *PhysicalWireguardHandler) SetupDevice(serverAddr netip.Prefix, key wgtypes.Key, endpoint string, logger *zap.Logger) error {
+	wireguardEndpoint, err := netip.ParseAddrPort(endpoint)
+	if err != nil {
+		return fmt.Errorf("invalid Wireguard endpoint: %w", err)
+	}
+
+	handler.wgDevice, err = wireguard.NewDevice(serverAddr, key, wireguardEndpoint.Port(), false, logger)
+	if err != nil {
+		return fmt.Errorf("error initializing wgDevice: %w", err)
+	}
+
+	return nil
+}
+
+// Shutdown implements WireguardHandler.
+func (handler *PhysicalWireguardHandler) Shutdown() error {
+	return handler.wgDevice.Close()
+}
+
+// Run implements WireguardHandler.
+func (handler *PhysicalWireguardHandler) Run(ctx context.Context, logger *zap.Logger) error {
+	return handler.wgDevice.Run(ctx, logger, handler)
+}
+
+// Peers implements WireguardHandler.
+func (handler *PhysicalWireguardHandler) Peers() ([]wgtypes.Peer, error) {
+	if handler.wgDevice == nil {
+		return []wgtypes.Peer{}, nil
+	}
+
+	return handler.wgDevice.Peers()
+}
diff --git a/internal/pkg/test/grpc.go b/internal/pkg/test/grpc.go
new file mode 100644
index 000000000..17aca1123
--- /dev/null
+++ b/internal/pkg/test/grpc.go
@@ -0,0 +1,55 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package test contains the test helpers.
+package test
+
+import (
+	"fmt"
+	"net"
+
+	"github.com/stretchr/testify/suite"
+	"google.golang.org/grpc"
+)
+
+// GRPCSuite is a test suite that provides a gRPC server and client.
+type GRPCSuite struct {
+	suite.Suite
+
+	listener net.Listener
+	Server   *grpc.Server
+
+	Target string
+}
+
+// InitServer initializes the test gRPC server.
+//
+// Options must b provided at this step, and servers must be registered before calling StartServer.
+func (suite *GRPCSuite) InitServer(opts ...grpc.ServerOption) {
+	var err error
+
+	suite.listener, err = net.Listen("tcp", "localhost:0")
+	suite.Require().NoError(err)
+
+	suite.Server = grpc.NewServer(opts...)
+
+	addr, ok := suite.listener.Addr().(*net.TCPAddr)
+	suite.Require().True(ok)
+
+	suite.Target = fmt.Sprintf("localhost:%d", addr.Port)
+}
+
+// StartServer starts the test gRPC server.
+//
+// This method must be called after registering all the servers.
+func (suite *GRPCSuite) StartServer() {
+	go suite.Server.Serve(suite.listener) //nolint:errcheck
+}
+
+// StopServer stops the test gRPC server.
+func (suite *GRPCSuite) StopServer() {
+	suite.Server.Stop()
+	suite.listener.Close() //nolint:errcheck
+}
diff --git a/internal/pkg/xmocks/xmocks.go b/internal/pkg/xmocks/xmocks.go
new file mode 100644
index 000000000..992d17a81
--- /dev/null
+++ b/internal/pkg/xmocks/xmocks.go
@@ -0,0 +1,57 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// Package xmocks provides some helpers for testify mocks.
+package xmocks
+
+import (
+	"reflect"
+	"runtime"
+	"strings"
+
+	"github.com/stretchr/testify/mock"
+)
+
+// Name returns the name of the given method.
+func Name(method any) string {
+	val := reflect.ValueOf(method)
+
+	if val.Kind() != reflect.Func {
+		panic("not a function")
+	}
+
+	name := runtime.FuncForPC(val.Pointer()).Name()
+
+	name = name[strings.LastIndex(name, ".")+1:]
+
+	return strings.TrimSuffix(name, "-fm")
+}
+
+// GetAs casts the given [mock.Arguments.Get] to the given type.
+func GetAs[T any](m mock.Arguments, i int) T {
+	res := m.Get(i)
+	if res != nil {
+		return res.(T) //nolint:forcetypeassert
+	}
+
+	switch typ := reflect.TypeOf((*T)(nil)).Elem(); typ.Kind() { //nolint:exhaustive
+	case reflect.Map, reflect.Slice, reflect.Chan, reflect.Func, reflect.Ptr, reflect.Interface, reflect.UnsafePointer:
+		var z T
+
+		return z
+	default:
+		panic("non nil value expected for type " + typ.String())
+	}
+}
+
+// Cast2 casts the given [mock.Arguments.Get] to the given types. Helper function for multiple return values.
+func Cast2[T, T1 any](m mock.Arguments) (T, T1) {
+	return GetAs[T](m, 0), GetAs[T1](m, 1)
+}
+
+// Cast3 casts the given [mock.Arguments.Get] to the given types. Helper function for multiple return values.
+func Cast3[T, T1, T2 any](m mock.Arguments) (T, T1, T2) {
+	return GetAs[T](m, 0), GetAs[T1](m, 1), GetAs[T2](m, 2)
+}
diff --git a/internal/version/api.go b/internal/version/api.go
new file mode 100644
index 000000000..1ea225669
--- /dev/null
+++ b/internal/version/api.go
@@ -0,0 +1,11 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+package version
+
+// API represents the current API version of the backend, and is checked by the clients for compatibility.
+//
+// When the backend API changes in a breaking way, this needs to be bumped.
+const API uint32 = 1
diff --git a/internal/version/data/sha b/internal/version/data/sha
new file mode 100644
index 000000000..66dc9051d
--- /dev/null
+++ b/internal/version/data/sha
@@ -0,0 +1 @@
+undefined
\ No newline at end of file
diff --git a/internal/version/data/tag b/internal/version/data/tag
new file mode 100644
index 000000000..8c20c5272
--- /dev/null
+++ b/internal/version/data/tag
@@ -0,0 +1 @@
+v0.20.0
\ No newline at end of file
diff --git a/internal/version/version.go b/internal/version/version.go
new file mode 100644
index 000000000..f40a75d3b
--- /dev/null
+++ b/internal/version/version.go
@@ -0,0 +1,42 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+//
+// Generated on 2024-02-23T01:26:28Z by kres 38f172c.
+
+// Package version contains variables such as project name, tag and sha. It's a proper alternative to using
+// -ldflags '-X ...'.
+package version
+
+import (
+	_ "embed"
+	"runtime/debug"
+	"strings"
+)
+
+var (
+	// Tag declares project git tag.
+	//go:embed data/tag
+	Tag string
+	// SHA declares project git SHA.
+	//go:embed data/sha
+	SHA string
+	// Name declares project name.
+	Name = func() string {
+		info, ok := debug.ReadBuildInfo()
+		if !ok {
+			panic("cannot read build info, something is very wrong")
+		}
+
+		// Check if siderolabs project
+		if strings.HasPrefix(info.Path, "github.com/siderolabs/") {
+			return info.Path[strings.LastIndex(info.Path, "/")+1:]
+		}
+
+		// We could return a proper full path here, but it could be seen as a privacy violation.
+		return "community-project"
+	}()
+)
diff --git a/vetur.config.js b/vetur.config.js
new file mode 100644
index 000000000..bc985afc3
--- /dev/null
+++ b/vetur.config.js
@@ -0,0 +1,44 @@
+// Copyright (c) 2024 Sidero Labs, Inc.
+//
+// Use of this software is governed by the Business Source License
+// included in the LICENSE file.
+
+// vetur.config.js
+/** @type {import('vls').VeturConfig} */
+module.exports = {
+  // **optional** default: `{}`
+  // override vscode settings
+  // Notice: It only affects the settings used by Vetur.
+  settings: {
+    "vetur.useWorkspaceDependencies": true,
+    "vetur.experimental.templateInterpolationService": true
+  },
+  // **optional** default: `[{ root: './' }]`
+  // support monorepos
+  projects: [
+    './frontend/', // Shorthand for specifying only the project root location
+    {
+      // **required**
+      // Where is your project?
+      // It is relative to `vetur.config.js`.
+      root: './frontend/',
+      // **optional** default: `'package.json'`
+      // Where is `package.json` in the project?
+      // We use it to determine the version of vue.
+      // It is relative to root property.
+      package: './package.json',
+      // **optional**
+      // Where is TypeScript config file in the project?
+      // It is relative to root property.
+      tsconfig: './tsconfig.json',
+      // **optional** default: `[]`
+      // Register globally Vue component glob.
+      // If you set it, you can get completion by that components.
+      // It is relative to root property.
+      // Notice: It won't actually do it. You need to use `require.context` or `Vue.component`
+      globalComponents: [
+        './src/components/**/*.vue'
+      ]
+    }
+  ]
+}