Organizational Unit

OrganizationalUnit

Defines a middle-tier container within the Infrastream resource hierarchy.

Groups related Environments and Release Tracks, providing a logical structure that reflects a core business unit or product area. It serves as a primary hub for configuration inheritance, dictating cascading permissions, regional parameters, and hibernation logic across child environments.

Property	Type	Description
apiVersion	string	API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1.
kind	string	Resource kind discriminator. Identifies this document as an OrganizationalUnit so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant OrganizationalUnit.
metadata	map	Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, organization) are read by the engine to resolve this manifest's identity and its parent Organization in the dependency graph.
spec	OrganizationalUnitDefinition	Desired organizational-unit configuration. The authoritative, user-authored specification for this OU. Uses the shared OrganizationalUnitDefinition message (folder display name, permissions, regional overrides, and hibernation settings that cascade to child Environments and Release Tracks).

---

OrganizationalUnitDefinition

High-level definition of an Organizational Unit used to group environments and govern policies.

Maps to a GCP Folder hierarchy (google_folder), acting as an administrative boundary where IAM permissions and default network/hibernation policies are applied and propagated.

Property	Type	Description
displayName	string	Display name of the GCP folder. Human-friendly name for the OU's GCP Folder. When unspecified, the manifest's metadata.name is used. Proto validation constrains it to 3-30 characters of letters, digits, spaces, underscores, and dashes.
description	string	Human-readable description. Free text describing the GCP asset represented by this OU.
hibernation	HibernationConfig	Default hibernation schedule for the OU. Default schedule for automatically hibernating all resources within this Organizational Unit; can be overridden by child Environment or Project manifests. The computed schedule governs the active hours of underlying resources like google_compute_instance and google_cloud_run_service to manage cost.
permissions	AccessPermissions	Default access permissions for the OU. Default permissions for all resources within this Organizational Unit, inherited by child Environment and Project manifests. Translated into google_folder_iam_binding resources granting the specified roles to principals on the corresponding GCP Folder.
network	OrganizationalUnitNetwork	Default network settings for the OU. See OrganizationalUnitNetwork. NOT YET IMPLEMENTED (the underlying flow-log settings have no consumer).

---

AccessPermissions

Core definition for assigning administrative and viewer privileges across the platform.

Used by the engine to compute the final IAM policies (google_folder_iam_binding, etc.), aggregating individual user and group definitions to role assignments.

Property	Type	Description
administrators	DetailedAccessPermissions	Administrators. Users and groups granted administrative privileges on the asset. Exact rights are resource-dependent but typically confer full control. See DetailedAccessPermissions.
contributors	DetailedAccessPermissions	Contributors. Users and groups granted contributor privileges on the asset. Exact rights are resource-dependent but typically confer read and write access. See DetailedAccessPermissions.
viewers	DetailedAccessPermissions	Viewers. Users and groups granted viewer privileges on the asset. Exact rights are resource-dependent but typically confer read-only access. See DetailedAccessPermissions.

---

HibernationConfig

Consolidates hibernation scheduling logic.

Used by the orchestrator to aggregate windows and exclusions across OU, Environment, and Project inheritance chains into a final deployment state.

Property	Type	Description
hibernate	bool	When set to 'true', forces the resource into hibernation immediately, overriding any active 'windows' or 'exclusions'. Defaults to 'false'.
windows	list of WindowsEntry	A map of recurring time windows during which the resource will be hibernated. The key of the map provides a unique name for each window.
exclusions	list of ExclusionsEntry	A map of specific, non-recurring time windows during which hibernation will be suspended, even if a 'window' is active. Use this for planned maintenance or high-traffic periods. The key of the map provides a unique name for each exclusion.

---

OrganizationalUnitNetwork

Default network settings at the Organizational Unit (OU) level.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (its NetworkLogs payload has no consumer). Intended future behavior: provide default VPC flow-log configuration inherited by any Environment or Project within this OU.

Property	Type	Description
logs	NetworkLogs	Default VPC flow log settings for the OU. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: apply these settings to the log_config of every google_compute_subnetwork created under this unit.

---

ExclusionsEntry

Property	Type	Description
key	string
value	HibernationExclusion

---

WindowsEntry

Property	Type	Description
key	string
value	HibernationWindow

---

NetworkLogs

VPC Flow Logs export settings.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: populate the log_config block of google_compute_subnetwork, controlling flow-log aggregation interval and sampling rate for network telemetry.

Property	Type	Description
interval	string	Flow-log aggregation interval. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: set the aggregation_interval of the subnetwork log config, controlling the window over which VPC flow logs are aggregated before export. Proto validation restricts it to the allowed INTERVAL_* enum values.
sampling	double	Flow-log sampling rate. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: set the flow_sampling of the subnetwork log config, the fraction of connections captured. Proto validation constrains it to between 0.0 (no logs) and 1.0 (all logs).

---

DetailedAccessPermissions

Aggregation of specific user and group access definitions.

Refers to lists of OrganizationUser and OrganizationUserGroup manifests that will be parsed to retrieve actual Google Workspace identity emails for IAM binding construction.

Property	Type	Description
members	list of string	A list of 'OrganizationUser' manifest names to be included in this permission set.
groups	list of string	A list of 'OrganizationUserGroup' manifest names to be included in this permission set.

---

HibernationWindow

Defines a recurring period when an asset should be scaled down.

Scheduled cron strings used by the control plane's orchestration tools to dynamically stop virtual machines or scale Cloud Run instances to zero.

Property	Type	Description
start	string	A cron expression defining when the hibernation window begins.
end	string	A cron expression defining when the hibernation window ends.

---

HibernationExclusion

Defines a specific suspension of the hibernation schedule.

Prevents down-scaling operations during the specified timeframe, ensuring workloads remain active for special events or maintenance.

Property	Type	Description
start	string	The start date and time for the exclusion window in RFC3339 format. RFC3339
end	string	The end date and time for the exclusion window in RFC3339 format. RFC3339