Common

AccessPermissions

Core definition for assigning administrative and viewer privileges across the platform.

Used by the engine to compute the final IAM policies (google_folder_iam_binding, etc.), aggregating individual user and group definitions to role assignments.

Property	Type	Description
administrators	DetailedAccessPermissions	Administrators. Users and groups granted administrative privileges on the asset. Exact rights are resource-dependent but typically confer full control. See DetailedAccessPermissions.
contributors	DetailedAccessPermissions	Contributors. Users and groups granted contributor privileges on the asset. Exact rights are resource-dependent but typically confer read and write access. See DetailedAccessPermissions.
viewers	DetailedAccessPermissions	Viewers. Users and groups granted viewer privileges on the asset. Exact rights are resource-dependent but typically confer read-only access. See DetailedAccessPermissions.

AgentAccessControlConfig

Aggregates all external access rules an AI agent requires.

Mirrors ApplicationAccessControlConfig but defined as a separate type to allow agent-specific access patterns to diverge independently. Agents deployed to Agent Engine (Vertex AI Reasoning Engine) may need different access semantics than containerized applications (e.g., no Redis volume mounts, no mesh-aware URLs).

Property	Type	Description
additionalRoles	list of string	Extra IAM roles for the agent service account. A list of additional IAM roles granted to the agent's service account beyond the base roles (monitoring, logging, tracing, and aiplatform.user).
pubsub	ApplicationAccessControlPubsubConfig	Pub/Sub publish and subscribe grants. The agent's permission to publish to or subscribe from specific Pub/Sub topics. See ApplicationAccessControlPubsubConfig.
buckets	list of ApplicationAccessControlBucketConfig	Cloud Storage bucket access rules. A list of bucket access rules describing which Cloud Storage buckets the agent may read from or write to. See ApplicationAccessControlBucketConfig.
database	ApplicationAccessControlDatabaseConfig	PostgreSQL database access. The agent's access to a specific PostgreSQL database instance and schema. See ApplicationAccessControlDatabaseConfig.
secrets	list of SecretsEntry	Secrets consumed by the agent. A map from Secret manifest name to the configuration describing how that secret is exposed to the agent (typically as an environment variable). See SecretSourceConfig.

SecretsEntry

Property	Type	Description
key	string
value	SecretSourceConfig

AgentConfig

Configuration for the Ops Agent deployed on the VM.

Drives the installation and configuration of the Google Cloud Ops Agent on the instance, dictating which logs and metrics are exported to Cloud Monitoring.

Property	Type	Description
logFiles	list of string	Log file glob patterns. Glob patterns identifying the log files the Ops Agent tails and ships to Cloud Logging from the VM. Applied to the agent's LogFiles configuration.
metrics	list of MetricConfig	Custom metric receivers. A list of custom metric collectors added to the Ops Agent configuration on the VM. See MetricConfig.

ApplicationAccessControlBucketConfig

Configures Google Cloud Storage interaction permissions for a workload.

Translates to roles/storage.objectViewer or roles/storage.objectUser IAM bindings assigned to the application's service account, and can map specific paths.

Property	Type	Description
name	string	Target Bucket manifest name. Required. The name of the Bucket manifest this application requires access to. The bucket must exist in every environment defined by the parent ReleaseTrack.
source	string	Source repository to sync into the bucket. Optional reference to a GithubRepository manifest whose contents seed the bucket. The CI/CD system uses this to set up a gcloud storage rsync job that mirrors the repository data into the bucket.
permission	string	Access level granted on the bucket. The permission level for this bucket: READ_ONLY grants roles/storage.objectViewer, and WRITE grants roles/storage.objectUser to the application's service account on the bucket.
mountPath	string	In-container mount path for the bucket. The absolute path at which the bucket is mounted (via Cloud Storage FUSE) inside the container. When omitted, permissions are still granted but the bucket is not mounted as a filesystem.
subPath	string	Restrict access to a bucket sub-path. A sub-path (prefix) within the bucket that access is scoped to; when omitted, access covers the whole bucket. Commonly used to mount a specific folder of the bucket into the container.
promote	bool	Promote bucket contents with the release. When true, the bucket's content is promoted through the ReleaseTrack alongside the application, typically for shipping generic application configuration data with each release.
envVar	string	Environment variable to receive the bucket name. The name of an environment variable populated with the resolved bucket name, giving the application the bucket name as plain configuration instead of a filesystem mount. Mutually exclusive with mount_path.

ApplicationAccessControlConfig

Aggregates all external access rules an application requires.

Computes the comprehensive list of IAM bindings, SQL grants, and secret consumptions that must be provisioned alongside the application's actual deployment.

Property	Type	Description
additionalRoles	list of string	Extra IAM roles for the service account. A list of additional IAM roles granted directly to the application's service account, beyond the roles derived from the other access-control blocks.
pubsub	ApplicationAccessControlPubsubConfig	Pub/Sub publish and subscribe grants. The application's permission to publish to or subscribe from specific Pub/Sub topics. See ApplicationAccessControlPubsubConfig.
buckets	list of ApplicationAccessControlBucketConfig	Cloud Storage bucket access rules. A list of bucket access rules describing which Cloud Storage buckets the application may read from or write to, and how they are mounted or exposed. See ApplicationAccessControlBucketConfig.
database	ApplicationAccessControlDatabaseConfig	PostgreSQL database access. The application's access to a specific PostgreSQL database instance and schema, including privileges and credential source. See ApplicationAccessControlDatabaseConfig.
secrets	list of SecretsEntry	Secrets consumed by the application. A map from Secret manifest name to the configuration describing how that secret is exposed to the application (as an environment variable or mounted file). See SecretSourceConfig.
redis	list of ApplicationAccessControlRedisConfig	Redis cache access. A list of Redis instances the application may use. Each entry injects the connection URL as an environment variable and creates a deployment dependency on the Redis DNS record. See ApplicationAccessControlRedisConfig.
jobs	list of ApplicationAccessControlJobConfig	Cloud Run Jobs the application may trigger. A list of Cloud Run Jobs (owned by other applications) that this application's service account may trigger via the RunJob API. Each entry grants roles/run.developer on the referenced job and injects its full resource name as an environment variable. See ApplicationAccessControlJobConfig.

SecretsEntry

Property	Type	Description
key	string
value	SecretSourceConfig

ApplicationAccessControlDatabaseConfig

Configures PostgreSQL interaction permissions for a workload.

Executes dynamic DDL (CREATE USER, GRANT) against the target SQL instance using an administrative proxy, setting up specific schema rights.

Property	Type	Description
name	string	Target Database manifest name. The name of the Database manifest this application requires access to. Resolves to a concrete AlloyDB/PostgreSQL instance during computation.
schema	string	Database schema to connect to. The specific database (schema) within the instance the application connects to. Feeds the computed schema and per-deployment access grants used by the Database executor to provision users, roles, and grants.
privileges	list of string	SQL privileges to grant on the schema. A list of SQL privileges granted to the application's database role on the target schema. Each entry (one of USAGE, CREATE, ALL) translates into GRANT statements executed against the PostgreSQL instance.
readOnly	bool	Connect against a read replica. When true, the application is wired for read-only access, typically to connect to a read replica rather than the primary instance.
extensions	list of string	PostgreSQL extensions to enable. A list of PostgreSQL extensions to enable in the target database for this application. Each entry runs CREATE EXTENSION IF NOT EXISTS; extensions are merged across all applications sharing a schema in the computed database schema.
secretSource	SecretSourceConfig	Credential source for the database. Required. Defines how the application obtains its database credentials, e.g. from which Secret manifest and how it is exposed (environment variable or file mount). See SecretSourceConfig.

ApplicationAccessControlJobConfig

Grants an application permission to trigger a Cloud Run Job owned by another application.

Resolves the target job via the owning Application's name and job name, then grants roles/run.developer to the calling application's service account on that job. The job's full Cloud Run resource name is injected as an env var (derived from the job name).

Property	Type	Description
application	string	Owning application. Required. The Application manifest name that owns the target Cloud Run Job. Used together with job to resolve the concrete job resource to grant access on.
job	string	Target job name. Required. The job's name within the owning application, matching an ApplicationJobReference.name on that application.
envVar	string	Environment variable for the job resource name. The name of an environment variable injected into the caller with the job's full Cloud Run resource name. When empty, no variable is injected and the caller must derive the job name by convention.

ApplicationAccessControlPubsubConfig

Configures Pub/Sub interaction permissions for a workload.

Translates to roles/pubsub.publisher and roles/pubsub.subscriber IAM bindings assigned to the application's underlying service account.

Property	Type	Description
publishTo	list of string	Topics the workload may publish to. A list of PubSub manifest names this workload is allowed to publish messages to. Each entry grants roles/pubsub.publisher to the workload's service account on the corresponding topic.
subscribeTo	list of string	Topics the workload may subscribe to. A list of PubSub manifest names this workload is allowed to create subscriptions for and pull messages from. Each entry grants roles/pubsub.subscriber to the workload's service account on the corresponding topic.

ApplicationAccessControlRedisConfig

Configures Redis cache access for a workload.

Injects the Redis connection URL as an environment variable and establishes a graph dependency on the Redis manifest's DNS record to ensure the stable FQDN is resolvable before the application deploys.

All Memorystore Redis instances are provisioned with SERVER_AUTHENTICATION transit encryption (TLS). The CA certificate is extracted from the instance state and mounted as a volume in the container so the application can configure its TLS trust pool.

Property	Type	Description
name	string	Target Redis manifest name. Required. The name of the Redis manifest this application requires access to. Establishes a graph dependency on that instance's DNS record so its FQDN is resolvable before the application deploys.
envVar	string	Environment variable for the connection URL. Required. The name of the environment variable populated with the Redis connection URL of the form redis[s]://memory-<redis-name>.<internal-domain>:<port>. Meshed strategies (SIDECAR/PROXYLESS) use redis:// on port 6380; direct access (DISABLED) uses rediss:// on port 6379.
caCertPath	string	In-container path for the server CA certificate. Required. The absolute file path at which the Memorystore server's CA certificate (extracted from instance state) is mounted. The application must load this PEM file into its TLS trust pool to validate the server's identity.

ApplicationDefinition

User-authored application specification.

The spec body for the Application manifest: it selects the source build, the target compute platform and mesh strategy, the destination project, resource permissions, and associated lifecycle jobs. Consumed by the application, deployment-config, and job-config computers. (ExternalApplication uses the separate ExternalApplicationDefinition message, since its image is built outside the workspace.)

Property	Type	Description
description	string	Human-readable role of the application. Free text describing what this application does; used as documentation and as context for AI assistants reasoning about the manifest.
target	string	Target compute platform. Selects the runtime the application is deployed to (KUBERNETES, CLOUD_RUN, or COMPUTE). Copied to computed state and used by the deployment-config computer to pick the underlying module (e.g. google_cloud_run_v2_service for CLOUD_RUN).
meshStrategy	string	Service mesh integration strategy. Controls how the application joins the service mesh: SIDECAR deploys a proxy sidecar and creates mesh HTTP/gRPC routes against a SIDECAR_PROXY backend, PROXYLESS uses in-process gRPC service discovery with no sidecar, and DISABLED keeps the application out of the mesh. Copied to computed state and read by the routing executors.
project	string	Destination Project manifest. Required. Name of the Project manifest the application is deployed into; must be present in every environment of the parent ReleaseTrack. Determines the GCP project where all of the application's resources (service, IAM bindings, etc.) are provisioned.
accessControl	ApplicationAccessControlConfig	Resource permissions granted to the application. Declares the access the application's service account is granted to platform resources such as Buckets, Databases, Pub/Sub topics, and Secrets. Copied to computed state and expanded by executors into the corresponding IAM bindings. See ApplicationAccessControlConfig.
bundleOnly	bool	Skip staged rollout and store builds directly. When true, the application is not promoted through pre-release tracks; its successful build versions are recorded directly as deployments and become available for inclusion in release-track bundles. Read by the application computer.
jobs	list of ApplicationJobReference	Associated lifecycle jobs. References to jobs run around this application's lifecycle (BEFORE deploy, AFTER deploy, SCHEDULED via cron, or ON_DEMAND). Each reference must have a matching JobConfig manifest in every environment. Read by the job-config computer and validators. See ApplicationJobReference.
buildDefinition	string	Source build definition. Required. Name of the BuildDefinition manifest that produces this application's single container image. Creates a dependency on that build so the deployment-config computer can resolve the destination registry and image name from the build's containerize block. Because a BuildDefinition produces exactly one image, no separate container selector is needed.
cluster	string	Destination Kubernetes cluster. Required when target is KUBERNETES. metadata.name of a Kubernetes manifest inside the destination project. A Project may own several clusters, so there is nothing to infer — the cluster must be named. Validated to exist in the named project, in every environment of the parent ReleaseTrack, exactly as project is. Ignored for CLOUD_RUN and COMPUTE targets. Copied to computed state and used by the deployment-config executor to resolve the cluster the workload is deployed onto.

ApplicationJobReference

Declares a job that is part of an Application's lifecycle.

References a job by name and type. The environment-specific configuration (container, schedule, resources) is provided by a corresponding JobConfig manifest.

Property	Type	Description
name	string	Job name. Required. A unique name for this job within the application (e.g. migrate, cleanup). Links to the corresponding JobConfig manifest that supplies the environment-specific container, schedule, and resources.
type	string	Job execution type. Determines when and how the job runs: BEFORE runs before the main service deploy and blocks until complete (e.g. DB migrations); AFTER runs after the deploy and blocks until complete (e.g. seed data); SCHEDULED is triggered by a Cloud Scheduler cron expression; ON_DEMAND is provisioned but not scheduled, triggered manually or via API.

ApprovalPolicy

Recursive rule describing who must approve a deployment stage.

A single node in an approval tree: either a leaf naming one stakeholder, or a composite (any-of, all-of, or quorum) over nested policies. The engine validates every referenced stakeholder against the organization when processing a ReleaseTrack.

Property	Type	Description
stakeholder	Stakeholder	Single required approver. A leaf policy satisfied when the named stakeholder (a user or group) approves. See Stakeholder.
anyOf	ApprovalSet	Any-of (OR) composite. Satisfied when at least one of the nested policies is satisfied. See ApprovalSet.
allOf	ApprovalSet	All-of (AND) composite. Satisfied only when every nested policy is satisfied. See ApprovalSet.
quorum	ApprovalSet	Quorum composite. Satisfied when at least min_approvals of the nested policies are satisfied. See ApprovalSet.

ApprovalSet

A collection of nested approval policies combined by a composite operator.

Holds the child policies for an any-of, all-of, or quorum node of an ApprovalPolicy tree. For quorum nodes, min_approvals sets how many children must be satisfied.

Property	Type	Description
policies	list of ApprovalPolicy	Nested policies. The child approval policies combined by the parent operator (any-of, all-of, or quorum). See ApprovalPolicy.
minApprovals	int32	Quorum threshold. For quorum composites, the minimum number of nested policies that must be satisfied. Ignored by any-of and all-of operators.

ArtifactRegistryAccessPermissions

Defines access levels specifically for Artifact Registry repositories.

Maps readers and writers to roles/artifactregistry.reader and roles/artifactregistry.writer respectively on the targeted google_artifact_registry_repository.

Property	Type	Description
readers	DetailedAccessPermissions	A list of users and groups who are granted read-only access to the repository. Corresponds to the 'roles/artifactregistry.reader' IAM role.
writers	DetailedAccessPermissions	A list of users and groups who are granted read and write access to the repository. Corresponds to the 'roles/artifactregistry.writer' IAM role.

BucketImageConverterConfig

Automatic image conversion settings for a bucket.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads these fields). Intended future behavior: instruct the bucket's image-processing pipeline how to re-encode and resize uploaded images.

Property	Type	Description
format	string	Target output format. Image format uploaded objects are re-encoded to (WEBP, PNG, or JPEG). Constrained by buf.validate.
maxWidth	int64	Maximum output width in pixels. Upper bound on the converted image width; larger images are scaled down. Must be at least 100 (buf.validate).
maxHeight	int64	Maximum output height in pixels. Upper bound on the converted image height; larger images are scaled down. Must be at least 100 (buf.validate).

BucketNotificationConfig

Links storage buckets to Pub/Sub notification pipelines.

Generates the google_storage_notification resource to push event records upon object changes.

Property	Type	Description
topic	string	Destination Pub/Sub topic. Name of the PubSub manifest that receives object-change notifications for this bucket. Validated by the bucket validator to reference an existing topic, and collected into the bucket's computed notification list.
events	list of string	Object events that trigger a notification. List of storage event types (OBJECT_FINALIZE for new objects, OBJECT_METADATA_UPDATE for metadata changes) that fire a notification. Constrained to those two values by buf.validate; intended to become the event_types of the underlying google_storage_notification.

BucketRouteConfig

Configures authorization rules specifically for bucket backends.

Affects the associated URL map routing and attached authz extensions when a Load Balancer path serves static assets directly from GCS.

Property	Type	Description
name	string	Backing bucket name. Name of the GCS bucket whose static assets are served directly by this Load Balancer path.
authentication	list of RouteRuleAuthenticationConfig	Rule Authentication Configuration. Defines the authentication configuration for this rule. If not specified, the rule will be unauthenticated.
authorization	list of ComputedAuthorizationAccessRuleCheck	Rule Authorization Configuration. Defines the authorization configuration for this rule. If not specified, the rule will be open to all users.

CodeOwnerConfig

Configuration for GitHub code ownership and repository rules.

Used during repository templating to enforce CODEOWNERS files and branch protection rules, ensuring that specific teams review changes to critical paths.

Property	Type	Description
githubOwner	string	Owning GitHub organization for the CODEOWNERS entries. The GitHub Organization (Owner) that hosts the target repository. When unset, it defaults to the organization's configured GitHub organization and is used to qualify team references (e.g. @<owner>/infrastream-<group>) written into the generated CODEOWNERS rules.
repository	string	Target repository for the CODEOWNERS file. Name of the repository whose CODEOWNERS rules are being computed. When unset, it defaults to the organization's <org>-infrastream-organization-manifests manifest repository.
rules	list of string	Computed CODEOWNERS rule lines. Fully rendered CODEOWNERS entries, one per protected file path, each pairing the path with the resolved owning teams and individual GitHub usernames derived from the administrator access permissions. Populated by the engine during computation.

ComputedAccessPermissions

Represents the computed access configurations for a resource.

Houses the flattened permission structure derived from an AccessPermissions block, ready for IAM provisioning.

Property	Type	Description
administrators	ComputedDetailedAccessPermissions	Resolved administrators. The final, resolved users and groups with administrative privileges on the asset. See ComputedDetailedAccessPermissions.
contributors	ComputedDetailedAccessPermissions	Resolved contributors. The final, resolved users and groups with contributor privileges on the asset. See ComputedDetailedAccessPermissions.
viewers	ComputedDetailedAccessPermissions	Resolved viewers. The final, resolved users and groups with viewer privileges on the asset. See ComputedDetailedAccessPermissions.

ComputedAccessibleRegistry

Represents a computed Artifact Registry resource accessible by deployments.

Tracks the registry location and name needed to perform container image path resolution.

Property	Type	Description
name	string	Registry name. The name of the Artifact Registry repository accessible to the deployment.
location	string	Registry location. The GCP region or multi-region where the registry is hosted, used to build the image path.
trustedRepositories	list of string	Trusted external repositories. The names of trusted repository children for external registries, used by the Binary Authorization policy to generate granular per-repository allowlist patterns instead of blanket registry-wide wildcards. Empty for internal Artifact Registry repositories, which rely on attestation instead.

ComputedApplication

Represents a fully computed application deployment configuration.

Collates mesh strategy, pre-flight migration requirements, and the container image layout required by the execution engine to provision the underlying Cloud Run service or K8s Deployment.

Property	Type	Description
name	string	Application name. The resolved name of the application this computed record describes.
meshStrategy	string	Service mesh strategy. The mesh strategy applied to the application (e.g. SIDECAR, PROXYLESS, DISABLED, EXCLUDED), which governs how traffic is routed and how service URLs are formed.
container	ComputedContainerDefinition	Container definition. The fully resolved container image definition for the application, used by the executor to provision the underlying Cloud Run service or Kubernetes Deployment. See ComputedContainerDefinition.

ComputedArtifactRegistry

Represents a computed Artifact Registry resource.

JIT-resolved state of an ArtifactRegistry manifest containing the definitive configuration utilized during the implementation phase.

Property	Type	Description
name	string	This value is a direct reflection of 'metadata.name' from this 'ArtifactRegistry' manifest.
type	string	This value is a direct reflection of 'spec.type' from this 'ArtifactRegistry' manifest.
publishUrl	string	This URL is composed based on the 'spec.type' from this 'ArtifactRegistry' manifest.
region	string	This value is taken from 'spec.region' from this 'ArtifactRegistry' manifest.
permissions	ArtifactRegistryAccessPermissions	This block is a direct reflection of the 'spec.permissions' block from this 'ArtifactRegistry' manifest, with user and group names resolved to their full Google Cloud Identity identifiers.

ComputedAuthorizationAccess

The full map of hostnames to authorization paths.

Acts as the primary in-memory index for the authz extensions running alongside the load balancers.

Property	Type	Description
rules	list of RulesEntry	This is a map where the key is a hostname and the value is the set of authorization rules for that host, aggregated from all relevant child 'HttpRoute' and 'GrpcRoute' manifests.

RulesEntry

Property	Type	Description
key	string
value	ComputedAuthorizationAccessRules

ComputedAuthorizationAccessRule

Single computed authorization rule.

Part of the compiled configuration supplied to authz extension services to resolve user scopes dynamically.

Property	Type	Description
identitySource	string	This value is a direct reflection of 'spec.authorization.identitySource' from a child 'HttpRoute' or 'GrpcRoute' manifest.
matches	list of HttpRouteRuleMatch	This list is a direct reflection of the 'spec.matches' block from a child 'HttpRoute' or 'GrpcRoute' manifest.
checks	list of ComputedAuthorizationAccessRuleCheck	This list is a direct reflection of the 'spec.authorization.checks' block from a child 'HttpRoute' or 'GrpcRoute' manifest.

ComputedAuthorizationAccessRuleCheck

Represents a computed access check for a route rule.

Maps an expected identity tuple (namespace, relation, object) that the AuthZ extension must validate during the request flow.

Property	Type	Description
namespace	string	This value is a direct reflection of 'spec.authorization.namespace' from a child 'HttpRoute' or 'GrpcRoute' manifest.
relation	string	This value is a direct reflection of 'spec.authorization.relation' from a child 'HttpRoute' or 'GrpcRoute' manifest.
object	string	This value is a direct reflection of 'spec.authorization.object' from a child 'HttpRoute' or 'GrpcRoute' manifest.

ComputedAuthorizationAccessRules

Aggregation of authz rules for a specific host.

Pre-calculated list to quickly look up all applicable authorization predicates for incoming traffic bounds.

Property	Type	Description
rules	list of ComputedAuthorizationAccessRule	This is a list of authorization rules, aggregated from all child 'HttpRoute' and 'GrpcRoute' manifests for a given host.

ComputedContainerDefinition

Represents the fully resolved container image deployment source.

Fuses the registry's geographical footprint with a specific container build to provide the absolute URL for the deployment API (e.g., Cloud Run or GKE).

Property	Type	Description
sourceRegistry	ComputedAccessibleRegistry	Source registry. The Artifact Registry where the container image is stored. See ComputedAccessibleRegistry.
image	string	Full image URL. The absolute container image reference, including registry host and repository path, passed to the deployment API (e.g. Cloud Run or GKE).

ComputedCoreCodeOwnerEntry

Structured representation of a code owner entry for the core-manifest repository.

Used by the organization executor to resolve actual GitHub team IDs (via TeamRunner) and build RequiredReviewers entries in repository rulesets.

Property	Type	Description
path	string	The file path pattern in the manifest repo (e.g. "organization/pvotal-tech/project/my-project.yaml").
teams	list of string	Full GitHub team names owning this path, as they appear in the GithubConnection (e.g. "infrastream-platform-team"), NOT the OrganizationUserGroup names.

ComputedDatabaseAccessGrant

Pre-computed per-deployment access grant for a specific database schema.

Each entry maps one application's service account to the SQL privileges it requires on a target schema. The Database executor uses these to centrally provision AlloyDB IAM users, PG roles, and grants.

Property	Type	Description
deploymentConfigName	string	Deployment config identity. The deployment config name, which matches the owning Application manifest name whose service account receives the grant.
schema	string	Target schema for the grant. The database/schema name the privileges apply to (e.g. infrastream-cloud).
privileges	list of string	Privileges to grant. The SQL privileges granted to the application's IAM role on the schema (e.g. ALL, USAGE, CREATE).

ComputedDatabaseSchema

Pre-computed database schema to be created on an AlloyDB cluster.

Collected during the compute phase from Application manifests that reference a Database manifest via accessControl.database.name. Deduplicated by schema name with extensions merged across all applications sharing the schema.

Property	Type	Description
name	string	Schema name to create. The database/schema name the Database executor should create (e.g. infrastream-cloud).
extensions	list of string	Extensions to enable on the schema. The union of PostgreSQL extensions requested across all applications that reference this schema.

ComputedDeploymentPlan

Represents the comprehensive deployment sequence for a release track.

Calculates the complete path (pre-release to production stages) a container image takes through environments based on release track policies.

Property	Type	Description
preReleaseStages	list of ComputedDeploymentStage	Pre-release stages. The ordered stages executed before the main release progression (e.g. integration or canary environments). See ComputedDeploymentStage.
releaseStages	list of ComputedDeploymentStage	Release stages. The ordered stages of the normal release progression, from early environments through production. See ComputedDeploymentStage.
hotfixStages	list of ComputedDeploymentStage	Hotfix stages. The ordered stages used for expedited hotfix rollouts, which may bypass some pre-release stages. See ComputedDeploymentStage.

ComputedDeploymentStage

Represents a grouping of parallel deployment steps.

Aggregates environments into a cohesive deployment phase in cases like 'staging' vs 'production', which can enforce sequential rollouts.

Property	Type	Description
id	string	Stage identifier. A stable identifier for this stage within the computed deployment plan.
steps	list of ComputedDeploymentStep	Parallel steps in this stage. The deployment steps that run together as part of this stage before promotion to the next stage. See ComputedDeploymentStep.

ComputedDeploymentStep

Represents a single step in a release progression.

Captures the deployment target environment, project, and application configuration necessary to reconcile a deployment within CI/CD.

Property	Type	Description
id	string	Step identifier. A stable identifier for this deployment step within the computed plan.
environment	string	Target environment. The name of the Environment this step deploys to.
project	string	Target GCP project. The GCP project the step's resources are reconciled into.
container	ComputedContainerDefinition	Container to deploy. The fully resolved container image definition for this step. See ComputedContainerDefinition.
stakeholders	DetailedAccessPermissions	Step stakeholders. The users and groups responsible for approving or overseeing this deployment step. See DetailedAccessPermissions.

ComputedDetailedAccessPermissions

Represents the computed aggregation of specific members and groups for a permission level.

Contains the resolved IDs of identities that will be bound to a target resource.

Property	Type	Description
members	list of int64	Resolved user IDs. The final, resolved list of OrganizationUser member IDs for this permission set.
groups	list of int64	Resolved group IDs. The final, resolved list of OrganizationUserGroup IDs for this permission set.

ComputedDomainConfig

Represents computed fully-qualified domain names.

Used dynamically to construct the internal and external networking routes based on the current Environment's configured root domains.

Property	Type	Description
internal	string	The fully-qualified internal domain name, composed from parent configurations.
external	string	The fully-qualified external domain name, composed from parent configurations.

ComputedExternalRegistry

Represents a computed external container registry dependency.

Resolves the linkage between external registry configurations and the GCP / GitHub secrets containing their authentication credentials.

Property	Type	Description
name	string	This value is a direct reflection of 'metadata.name' from the 'ExternalRegistry' manifest.
type	string	This value is a direct reflection of 'spec.type' from the 'ExternalRegistry' manifest.
publishUrl	string	This value is a direct reflection of 'spec.url' from the 'ExternalRegistry' manifest.
authentication	string	This value is a direct reflection of 'spec.authentication' from the 'ExternalRegistry' manifest.
usernameGcpSecretId	string	This value is populated by looking up a 'Secret' manifest with a conventional name, typically '<registryName>-username', and retrieving its fully qualified GCP resource StateID.
usernameSourceControlSecretId	string	This value is populated by looking up a 'GithubSecret' manifest with a conventional name, typically '<registryName>-username', and retrieving its name.
passwordGcpSecretId	string	This value is populated by looking up a 'Secret' manifest with a conventional name, typically '<registryName>-password', and retrieving its fully qualified GCP resource StateID.
passwordSourceControlSecretId	string	This value is populated by looking up a 'GithubSecret' manifest with a conventional name, typically '<registryName>-password', and retrieving its name.
region	string	The GCP region associated with the external registry, used for image path resolution.

ComputedGithubBranchConfig

Represents computed branch protection rules for a GitHub repository.

Dictates the configuration applied to the github_branch_protection resource, enforcing review counts, status checks, and bypass roles.

Property	Type	Description
id	string	The unique identifier for this set of rules (e.g., 'primary-branches', 'feature-branches').
targetPatterns	list of string	A list of glob patterns for branches that these rules apply to (e.g., ['main', 'develop'] or ['feat/', 'bugfix/']).
requiredReviewers	int64	The number of required approving reviews for a pull request before it can be merged.
canCreate	bool	Indicates whether branches matching these patterns can be created by users.
bypassRoles	list of string	A list of GitHub roles (e.g., 'Maintainer', 'Admin') who are allowed to bypass these rules.
statusChecks	list of string	A list of required status check contexts that must pass before merging.
releaseType	string	The type of release associated with this branch (e.g., 'major', 'minor', 'patch'), which can influence versioning automation.
allowedSourceBranchPatterns	list of string	A list of glob patterns for branches that are allowed to be merged into this branch (used by CI to enforce flow).
requiredBranchPattern	string	Optional regex pattern that branches matching the target_patterns must adhere to.
allowedMergeMethods	list of string	The merge methods (e.g. 'merge', 'squash', 'rebase') permitted when merging into these branches.

ComputedGithubSecretRepositories

Represents the computed relationships between a GitHub secret and its target repositories.

This is an internal state object used by the engine to track which repositories a specific GithubSecret manifest has been distributed to during gitops reconciliation.

Property	Type	Description
secretKey	string	The name of the secret.
repositories	list of string	A list of repositories where this secret is configured.

ComputedGithubTeamConfig

Represents a computed GitHub Team and its membership state.

Direct reflection of configuration required to synchronize github_team and github_team_membership resources.

Property	Type	Description
name	string	GitHub team name. The resolved name of the github_team resource to synchronize.
parent	string	Parent team name. The name of the parent team when this is a nested team; empty for top-level teams.
members	list of MembersEntry	Members and their roles. A map from member login to their role on the team (e.g. member or maintainer), used to reconcile github_team_membership.

MembersEntry

Property	Type	Description
key	string
value	string

ComputedHibernationConfig

Represents the computed hibernation schedule.

Used to translate abstract windows/exclusions into concrete cron triggers that the engine uses to start/stop underlying workloads.

Property	Type	Description
enabled	bool	Whether any hibernation schedule is active for the resource.
scheduledTriggers	list of ScheduledTriggersEntry	Resolved cron triggers keyed by a unique name, used by the orchestrator to start/stop workloads.

ScheduledTriggersEntry

Property	Type	Description
key	string
value	string

ComputedIamServiceAccount

Represents a computed Google Cloud Service Account and its binding state.

Holds the resolved state for google_service_account resources, driving the creation of IAM bindings and establishing Kubernetes Workload Identity bindings (k8s_name).

Property	Type	Description
name	string	The name of the Google Cloud Service Account. This is typically composed from the name of the corresponding 'Application' manifest.
create	bool	A boolean indicating whether the platform should create this service account. This is usually true unless the application is configured to use a pre-existing service account.
roles	ComputedIamServiceAccountPermissions	This block contains the final, resolved list of IAM roles granted to the service account, derived from the 'accessControl' block of the corresponding 'Application' manifest.
k8sName	string	The name of the corresponding Kubernetes Service Account that is bound to the Google Cloud Service Account. This is relevant for applications deployed to GKE.
k8sNamespace	string	The Kubernetes namespace where the Kubernetes Service Account is created.

ComputedIamServiceAccountPermissions

Represents computed IAM role aggregations for a service account.

Derived from the accessControl blocks to determine the precise list of IAM roles the application's service account requires across scopes (org, project, AR).

Property	Type	Description
organization	list of string	A list of computed IAM roles granted to the service account at the GCP Organization level.
project	list of string	A list of computed IAM roles granted to the service account at the GCP Project level.
artifactRegistry	list of string	A list of computed IAM roles granted to the service account for accessing specific Artifact Registry repositories.

ComputedLoadBalancerHost

Represents a fully compiled set of paths mapped to a Load Balancer Host.

Translates down to the hostRules within a google_compute_url_map.

Property	Type	Description
iapPaths	list of ComputedLoadBalancerPath	Paths protected by IAP (Identity-Aware Proxy) authentication.
gcipPaths	list of ComputedLoadBalancerPath	Paths protected by GCIP (Identity Platform) authentication.
unauthPaths	list of ComputedLoadBalancerPath	Paths served without authentication.
bucketPaths	list of ComputedLoadBalancerPath	Paths served directly from a static GCS bucket backend.

ComputedLoadBalancerPath

Represents a fully compiled routing path inside a Load Balancer.

Translates down to individual URL Map path matchers within a google_compute_url_map.

Property	Type	Description
matchers	list of HttpRouteRuleMatch	Compiled match conditions for this URL Map path matcher.
tenant	string	Tenant this path is scoped to; only populated for IDENTITY_PROVIDER auth. Only used for IDENTITY_PROVIDER
hostRewrite	string	Host header rewrite applied before forwarding to the backend.
pathRewrite	string	Request path rewrite applied before forwarding to the backend.
bucket	string	Backing GCS bucket name, set when this path serves static bucket content. Used for static buckets
complexity	int64	Ordering weight used to sort path matchers (higher = more specific, evaluated first).
timeout	string	Go-style duration string for the route-level request timeout (e.g. "1800s"). When set, overrides the backend service default on the URL Map route rule.
idleTimeout	string	Go-style duration string for the route-level idle timeout (e.g. "60s").
agentName	string	Agent name this path routes to. When set, indicates this path should be rewritten to /agents/{agent_name}/ for the agentic proxy.

ComputedLoadBalancerRouteAuthorization

Links a backend service to its authorization context.

Extends the IAP or Cloud Service Mesh configuration to include the external authz plugin with the specified policy payload.

Property	Type	Description
backendService	string	The self-link of the backend service for the authorization extension Cloud Run service. This service is conventionally named based on this 'PublicIngress' manifest's 'metadata.name' (e.g., '<name>-authz-ext').
accessRules	ComputedAuthorizationAccess	This block is an aggregation of all 'spec.authorization.rules' from all child 'HttpRoute' and 'GrpcRoute' manifests associated with this ingress.

ComputedPrivateCaPool

Represents a computed Private Certificate Authority Pool resource.

Resolves the state IDs and locations for google_privateca_ca_pool resources established within the core control plane project.

Property	Type	Description
authorityId	string	The computed unique StateID for the Certificate Authority resource within the pool.
poolId	string	The computed unique StateID for the Certificate Authority pool.
location	string	The GCP region where the CA pool is located, inherited from the Organization's 'default_region'.
projectId	string	The GCP project StateID where the CA pool is created, specifically the 'infrastream_core_project_id'.
organization	string	The name of the parent Organization manifest.

ComputedRelatedArtifactRegistry

Groups an Artifact Registry with a list of dependent repository names.

Used to correlate an environment's registry with the specific application repositories built into it, simplifying the generation of IAM and image paths.

Property	Type	Description
repositories	list of string	Names of the application repositories built into this registry.
registry	ComputedArtifactRegistry	The resolved Artifact Registry these repositories depend on.

ComputedRelatedExternalRegistry

Groups an External Registry with a list of dependent repository names.

Associates specific application repositories to a configured external registry.

Property	Type	Description
repositories	list of string	Names of the application repositories that pull from this external registry.
registry	ComputedExternalRegistry	The resolved external registry these repositories depend on.

ComputedVirtualMachineBucketConfig

Represents a computed bucket mount for a VM.

Resolves the linkage between the VM configuration and the exact bucket resource to be mounted via Cloud Storage FUSE.

Property	Type	Description
source	string	Bucket resource name. The resolved bucket to mount, derived from the name field of the volume in the VirtualMachineConfiguration manifest.
mountOptions	string	Computed mount options. The mount option string for the FUSE mount, computed from the VM's operating system to ensure compatibility.

ComputedVirtualMachineDiskConfig

Represents the computed specification of a VM's attached disk.

Consolidates disk sizing, snapshots, and filesystem details into a unified block for persistent disk provisioning.

Property	Type	Description
name	string	Disk resource name. The resolved disk name, derived from the name field of the volume in the VirtualMachineConfiguration manifest.
fileSystem	string	Disk filesystem. The filesystem to format the disk with, derived from the volume's fileSystem field in the VirtualMachineConfiguration manifest.
mountOptions	string	Computed mount options. The mount option string for the disk, computed from the filesystem and the VM's operating system.
sourceSnapshot	string	Source snapshot. The source snapshot to hydrate the disk from, derived from the volume mount's sourceSnapshot in the VirtualMachine manifest.
encrypted	bool	Encryption flag. Whether the disk is encrypted, derived from the volume's encrypted field in the VirtualMachineConfiguration manifest.
diskSizeGb	int64	Disk size, in GB. The disk size, derived from the volume mount's diskSizeGb field in the VirtualMachine manifest.
diskType	string	Disk type. The Compute Engine disk type, derived from the volume mount's diskType field in the VirtualMachine manifest.

ContainerResource

Single resource boundary definition.

Translates to either requests or limits for CPU or memory within a container specification.

Property	Type	Description
cpu	string	CPU quantity for this boundary, in Kubernetes/Cloud Run notation (e.g. "500m", "1", "2").
memory	string	Memory quantity for this boundary, in Kubernetes/Cloud Run notation (e.g. "256Mi", "1Gi").

ContainerResources

Defines compute requirements and constraints for a container.

Maps to the resource requests and limits in Kubernetes Pods or Cloud Run service configurations to ensure adequate scaling and scheduling semantics.

Property	Type	Description
requests	ContainerResource	The minimum CPU/memory guaranteed to the container (maps to resource requests).
limits	ContainerResource	The maximum CPU/memory the container may consume (maps to resource limits).

ContainerSpec

Core configuration block for defining a runtime container.

Overrides default container behavior from the base image, defining entrypoints, variables, and compute constraints. Translates directly to elements like resources and env within google_cloud_run_v2_service or Kubernetes specifications.

Property	Type	Description
enabled	bool	Whether this container is enabled. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: allow toggling this container off without removing its definition.
command	list of string	Container entrypoint. Overrides the image entrypoint (maps to the container command). Applied to the provisioned Cloud Run service or Kubernetes container.
args	list of string	Container arguments. Arguments passed to the entrypoint (maps to the container args).
env	list of EnvVariableDefinition	Static environment variables. Literal name/value environment variables merged into the container's computed environment alongside variables injected via secrets and access control.
uid	string	Process user ID. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: run the container process as this UID.
gid	string	Process group ID. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: run the container process as this GID.
resources	ContainerResources	Compute resource requests and limits. CPU/memory requests and limits applied to the container on the provisioned Cloud Run service or Kubernetes pod. See ContainerResources.

ContainerVolumeMount

Maps generated files to a container volume.

Specifies the layout of files to be mounted, typically corresponding to config maps or secrets in K8s, or files written in Cloud Run.

Property	Type	Description
files	list of FilesEntry	Files to materialize in the volume. Map of relative file path to its synthesized contents; each entry becomes a file written into the mounted volume. See VolumeMountFile.

FilesEntry

Property	Type	Description
key	string
value	VolumeMountFile

ControlPlaneDefinition

High-level definition for the platform's control plane.

Defines the foundational GCP resources (VPCs, identity, routing) and deployment regions for the platform's central management plane. This drives the generation of core foundational modules.

Property	Type	Description
description	string	Human-readable description of the control plane. Free text describing this control plane, propagated onto the description of the provisioned GCP asset.
permissions	AccessPermissions	Control plane project access permissions. Users and groups granted administrative, contributor, or viewer access to the control plane's underlying cloud project. Translated into google_project_iam_binding resources on the control plane's dedicated GCP project.
network	ControlPlaneNetwork	Control plane network settings. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (its NetworkLogs payload has no consumer). Intended future behavior: override VPC flow-log settings for the control plane's network.
hibernation	HibernationConfig	Control plane hibernation schedule. Schedule for automatically hibernating (scaling to zero) the resources in this control plane to save cost. The computed schedule governs the active hours of underlying resources within the control plane project.
region	string	Primary GCP region. Foundational setting determining the location of most resources created within the control plane, including VPCs, Cloud Run services, and databases.
passiveRegions	list of string	Passive/failover regions. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: additional GCP regions for passive or failover deployment (e.g. DNS peering and VPC subnets) to support multi-region high availability.
maintenance	Maintenance	Maintenance windows and exclusions. Recurring maintenance windows and exclusions for the control plane's resources. Used to configure the maintenance_policy on applicable resources such as google_container_cluster and google_sql_database_instance.
defaultUrlRedirect	string	Default ingress redirect URL. URL to redirect to when an incoming ingress request matches no other routing rule. Configures the default_url_redirect on google_compute_url_map resources created for control plane ingresses.
allowedEgress	list of string	Egress allowlist. External hostnames or IP addresses that applications within the control plane may connect to; egress to any other destination is denied. Configures a google_compute_router_nat resource and associated firewall rules enforcing the egress policy for all traffic originating in the control plane.
identityProviderConfig	ProjectIdpConfig	Project-wide identity provider configuration. Identity provider settings applied across all tenants in the control plane project. See ProjectIdpConfig.

ControlPlaneNetwork

Network telemetry settings for the Control Plane.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (its only field feeds NetworkLogs, which no consumer reads). Intended future behavior: override the default VPC flow log settings for the control plane's foundational network.

Property	Type	Description
logs	NetworkLogs	Control plane VPC flow log settings. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: apply these flow-log settings to the log_config of the control plane VPC's google_compute_subnetwork.

CorsPolicy

Defines Cross-Origin Resource Sharing logic for an endpoint.

Emitted as corsPolicy on backend services or ingress routes to inform the LB terminating proxy how to respond to OPTIONS preflight requests.

Property	Type	Description
allowOrigins	list of string	Allowed origins (exact). List of origins permitted to make cross-origin requests, matched exactly. Emitted as corsPolicy.allowOrigins on the route action.
allowOriginRegexes	list of string	Allowed origins (regex). List of regular expressions matched against the request origin to allow cross-origin requests. Emitted as corsPolicy.allowOriginRegexes.
allowMethods	list of string	Allowed HTTP methods. Methods permitted on cross-origin requests, returned in the Access-Control-Allow-Methods preflight response. Emitted as corsPolicy.allowMethods.
allowHeaders	list of string	Allowed request headers. Headers a client may send on cross-origin requests, returned in Access-Control-Allow-Headers. Emitted as corsPolicy.allowHeaders.
exposeHeaders	list of string	Exposed response headers. Response headers the browser is allowed to expose to the client script. Emitted as corsPolicy.exposeHeaders.
maxAge	string	Preflight cache lifetime. How long (in seconds, as a string) the results of a preflight request may be cached by the client. Emitted as corsPolicy.maxAge.
allowCredentials	bool	Allow credentialed requests. When true, the response permits credentials (cookies, authorization headers) on cross-origin requests. Emitted as corsPolicy.allowCredentials.
disabled	bool	Disable this CORS policy. When true, the CORS policy is present but inactive. Emitted as corsPolicy.disabled.

DetailedAccessPermissions

Aggregation of specific user and group access definitions.

Refers to lists of OrganizationUser and OrganizationUserGroup manifests that will be parsed to retrieve actual Google Workspace identity emails for IAM binding construction.

Property	Type	Description
members	list of string	A list of 'OrganizationUser' manifest names to be included in this permission set.
groups	list of string	A list of 'OrganizationUserGroup' manifest names to be included in this permission set.

DirectResponse

Details for sending an immediate, synthetic response to matching traffic.

Emitted as faultInjectionPolicy.abort or direct routeAction configured with an HTTP status and payload to bounce traffic at the proxy layer.

Property	Type	Description
status	int64	HTTP status code to return. Required. Positive HTTP status code returned directly to the client without forwarding to a backend. Emitted as the route action's directResponse.status.
stringBody	string	Response body as text. Optional response body sent as a UTF-8 string (maximum 1024 characters). Emitted as the route action's directResponse.stringBody.
bytesBody	string	Response body as bytes. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no executor reads it; only string_body is emitted). Intended future behavior: base64-encoded binary response body (maximum 4096 bytes).

DiskSnapshotConfiguration

Defines the source snapshot for a given environment.

Determines the specific google_compute_snapshot link used to provision a new compute disk for a VM within a target environment.

Property	Type	Description
source	string	Volume source. For a BUCKET volume, the name of the bucket to mount; for a DISK volume, an optional Google Compute snapshot self-link used as the source snapshot.
mountOptions	list of string	Mount options. Additional mount options applied when attaching the volume (e.g. FUSE or fstab-style flags).
diskConfig	DiskSnapshotDiskConfig	Disk sizing and snapshots. Size, type, and per-environment snapshot sources for a DISK volume created from this configuration. See DiskSnapshotDiskConfig.

DiskSnapshotDiskConfig

Configures properties for a disk created from a snapshot.

Sets disk size and type attributes on the resulting google_compute_disk when hydrating a snapshot.

Property	Type	Description
sizeGb	int64	Disk size, in GB. Only applicable to DISK volumes. The size of the disk provisioned from the snapshot.
type	string	Disk type. Only applicable to DISK volumes. The Compute Engine disk type (e.g. pd-ssd, pd-balanced) of the provisioned disk.
snapshots	list of SnapshotsEntry	Per-environment snapshot sources. A map from environment name to the source snapshot self-link used to hydrate the disk in that environment.

SnapshotsEntry

Property	Type	Description
key	string
value	string

EnvVariableDefinition

Defines a static environment variable to be injected.

Appended to the environment variable array of the corresponding compute resource container definition.

Property	Type	Description
name	string	The environment variable name.
value	string	The literal value assigned to the environment variable.

EnvironmentDefinition

High-level definition of an Environment (e.g., staging, prod) within an organizational boundary.

Maps to a GCP Folder under its parent OU folder. Establishes the boundary where environment-specific IAM, hibernation, and networking defaults are defined.

Property	Type	Description
displayName	string	Display name of the GCP folder. Human-friendly name for the Environment's GCP Folder. When unspecified, the manifest's metadata.name is used. Proto validation constrains it to 3-30 characters of letters, digits, spaces, underscores, and dashes.
description	string	Human-readable description. Free text describing the GCP asset represented by this Environment.
hibernation	HibernationConfig	Default hibernation schedule for the environment. Default schedule for this Environment, overriding the parent OrganizationalUnit schedule and inherited by all child Project manifests. The computed schedule governs the active hours of underlying resources within this environment's projects to manage cost.
permissions	AccessPermissions	Default access permissions for the environment. Default permissions for all resources within this Environment, inherited by child Project manifests and combined with permissions from the parent OrganizationalUnit. Translated into google_folder_iam_binding resources granting the specified roles to principals on this environment's GCP Folder.
network	EnvironmentNetwork	Default network settings for the environment. See EnvironmentNetwork. NOT YET IMPLEMENTED (the underlying flow-log settings have no consumer).

EnvironmentNetwork

Default network settings at the Environment level.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (its NetworkLogs payload has no consumer). Intended future behavior: provide default VPC flow-log configuration, inherited by down-level Projects, overriding parent OU settings.

Property	Type	Description
logs	NetworkLogs	Default VPC flow log settings for the environment. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: apply these settings to the log_config of every google_compute_subnetwork created under this environment's projects.

EventArcNotificationTarget

Details the webhook destination for Eventarc triggers.

Directs where Pub/Sub or Audit Log events pushed by Eventarc should hit a deployed Cloud Run service.

Property	Type	Description
deploymentConfig	string	The name of the 'DeploymentConfig' manifest that defines the target service for the notification.
path	string	The relative URL path on the target service where Eventarc should send the event payload.

ExternalApplicationDefinition

User-authored external-application specification.

The spec body for the ExternalApplication manifest, whose container image is produced outside the workspace. Mirrors ApplicationDefinition's shared fields (description, target, mesh strategy, project, access control, bundle-only, jobs) but sources the image from a trusted external repository instead of an in-workspace build. Consumed by the external-application, deployment-config, and job-config computers.

Property	Type	Description
description	string	Human-readable role of the application. Free text describing what this application does; used as documentation and as context for AI assistants reasoning about the manifest.
target	string	Target compute platform. Selects the runtime the application is deployed to (KUBERNETES, CLOUD_RUN, or COMPUTE). Copied to computed state and used by the deployment-config computer to pick the underlying module (e.g. google_cloud_run_v2_service for CLOUD_RUN).
meshStrategy	string	Service mesh integration strategy. Controls how the application joins the service mesh: SIDECAR deploys a proxy sidecar and creates mesh HTTP/gRPC routes against a SIDECAR_PROXY backend, PROXYLESS uses in-process gRPC service discovery with no sidecar, and DISABLED keeps the application out of the mesh. Copied to computed state and read by the routing executors.
trustedRepository	string	Source trusted repository. Required. Name of the TrustedRepository manifest (a child of an ExternalRegistry) that hosts the externally built image. Validated to exist; the external-application computer resolves the parent registry's publish URL and composes the full image reference from it.
image	string	External image name. Required. Name of the image within the trusted repository to deploy. Combined with the repository and the registry publish URL to form the fully qualified image reference placed on the workload.
project	string	Destination Project manifest. Required. Name of the Project manifest the application is deployed into; must be present in every environment of the parent ReleaseTrack. Determines the GCP project where all of the application's resources (service, IAM bindings, etc.) are provisioned.
accessControl	ApplicationAccessControlConfig	Resource permissions granted to the application. Declares the access the application's service account is granted to platform resources such as Buckets, Databases, Pub/Sub topics, and Secrets. Copied to computed state and expanded by executors into the corresponding IAM bindings. See ApplicationAccessControlConfig.
bundleOnly	bool	Skip staged rollout and store builds directly. When true, the application is not promoted through pre-release tracks; its successful build versions are recorded directly as deployments and become available for inclusion in release-track bundles. Read by the application computer.
jobs	list of ApplicationJobReference	Associated lifecycle jobs. References to jobs run around this application's lifecycle (BEFORE deploy, AFTER deploy, SCHEDULED via cron, or ON_DEMAND). Each reference must have a matching JobConfig manifest in every environment. Read by the job-config computer and validators. See ApplicationJobReference.
cluster	string	Destination Kubernetes cluster. Required when target is KUBERNETES. metadata.name of a Kubernetes manifest inside the destination project. A Project may own several clusters, so there is nothing to infer — the cluster must be named. Validated to exist in the named project, in every environment of the parent ReleaseTrack, exactly as project is. Ignored for CLOUD_RUN and COMPUTE targets. Copied to computed state and used by the deployment-config executor to resolve the cluster the workload is deployed onto.

FaultInjectionAbort

Configures simulated failures/aborts for a route.

Translates into the abort block of the faultInjectionPolicy on a google_network_services_http_route, terminating requests early with the specified HTTP status code.

Property	Type	Description
httpStatus	int64	Abort status code. The HTTP status code returned to matched requests that are aborted early. Maps to the abort.httpStatus of the mesh route's fault injection policy.
percentage	int64	Affected traffic percentage. The percentage of matched requests that are aborted, from 0 to 100. Maps to abort.percentage.

FaultInjectionDelay

Configures simulated latency for a route.

Translates into the delay block of the faultInjectionPolicy on a google_network_services_http_route.

Property	Type	Description
fixedDelay	string	Injected delay duration. The fixed delay to add before forwarding matched requests, parsed as a duration string (e.g. 5s). Maps to the delay.fixedDelay of the mesh route's fault injection policy.
percentage	int64	Affected traffic percentage. The percentage of matched requests to which the delay is applied, from 0 to 100. Maps to delay.percentage.

FaultInjectionPolicy

Aggregates fault injection policies for testing resilience.

Drives the stochastic or deterministic network disruption features of GCP Traffic Director or K8s Gateway APIs.

Property	Type	Description
delay	FaultInjectionDelay	Latency injection. Optional configuration for injecting artificial delay into a percentage of matched requests. See FaultInjectionDelay.
abort	FaultInjectionAbort	Abort injection. Optional configuration for aborting a percentage of matched requests with a fixed HTTP status. See FaultInjectionAbort.

GithubConfig

Configuration for the central GitOps repository hosted on GitHub.

This determines where the engine pushes hydrated infrastructure state and application configs, establishing the source of truth for the GitOps workflow.

Property	Type	Description
organization	string	Owning GitHub organization. Name of the GitHub Organization that owns the central GitOps repository (e.g. pvotal-tech). This organization hosts the hydrated manifest repositories the engine pushes to, and its name is used to build repository owners and CODEOWNERS team references. Required.
administrators	list of string	Organization-level GitHub administrators. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: a list of GitHub usernames to be granted admin access on the managed GitOps repositories.

GrpcRouteRule

A single gRPC traffic routing rule.

Pairs one or more gRPC match conditions with an action and optional auth configuration; the building block of a google_network_services_grpc_route routing table.

Property	Type	Description
matches	list of GrpcRouteRuleMatch	Match conditions. Conditions selecting the gRPC requests this rule applies to; a request matches if any listed match holds. See GrpcRouteRuleMatch.
authentication	list of RouteRuleAuthenticationConfig	Rule Authentication Configuration. Defines the authentication configuration for this rule. If not specified, the rule will be unauthenticated.
authorization	list of ComputedAuthorizationAccessRuleCheck	Rule Authorization Configuration. Defines the authorization configuration for this rule. If not specified, the rule will be open to all users.

GrpcRouteRuleAction

Execution logic for a matched gRPC request.

Binds a gRPC route match to its target backends and per-request policies within google_network_services_grpc_route.

Property	Type	Description
destinations	list of HttpRouteRuleActionDestination	Weighted backend destinations. One or more backends that matching gRPC traffic is forwarded to, with optional weight-based splitting. See HttpRouteRuleActionDestination.
faultInjectionPolicy	FaultInjectionPolicy	Fault injection policy. Optional delay/abort fault injection applied to matching traffic for resilience testing. See FaultInjectionPolicy.
timeout	string	Per-request timeout. Go-style duration string bounding the total time for a matching request. Applied to the gRPC route action's timeout.
retryPolicy	RetryPolicy	Retry policy. Conditions and attempt count governing automatic retries of failed requests. See RetryPolicy (note: per_try_timeout is not consumed on the gRPC path).
idleTimeout	string	Per-request idle timeout. Go-style duration string bounding the idle time on a matching request's stream. Applied to the gRPC route action's idleTimeout.

GrpcRouteRuleMatch

Matching criteria for a gRPC request.

Conditions on gRPC metadata and the invoked service/method that steer traffic within a google_network_services_grpc_route.

Property	Type	Description
headers	list of GrpcRouteRuleMatchHeader	Metadata conditions. Conditions on gRPC metadata entries; all must match for the rule to apply. See GrpcRouteRuleMatchHeader.
method	MethodMatch	Service/method condition. Restricts the rule to a specific gRPC service and method. See MethodMatch.

GrpcRouteRuleMatchHeader

Matches gRPC metadata equivalent to HTTP headers.

Appended to a grpc_route to define rules based on custom gRPC metadata sent by the client.

Property	Type	Description
key	string	Metadata key to test. Name of the gRPC metadata entry whose value is evaluated by this condition. Emitted as key on the gRPC header matcher.
value	string	Expected metadata value. Value compared against the metadata entry, interpreted per type (exact or regular expression). Emitted as value.
type	string	Match type. How value is compared: EXACT for a literal match or REGULAR_EXPRESSION for a regex match (TYPE_UNSPECIFIED defaults to exact). Emitted as type.

HeaderModifier

Directs transformations on HTTP headers.

Configured as custom request or response headers added/removed by the HTTP(S) Load Balancer.

Property	Type	Description
set	list of SetEntry	Headers to overwrite. Map of header name to value that replaces any existing value for that header. Emitted as the set block of the route rule's header modifier by the HTTP route executor.
add	list of AddEntry	Headers to append. Map of header name to value added without removing existing headers of the same name. Emitted as the add block of the route rule's header modifier.
remove	list of string	Header names to strip. List of header names removed before the request reaches the backend or the response reaches the client. Emitted as the remove block of the route rule's header modifier.

AddEntry

Property	Type	Description
key	string
value	string

SetEntry

Property	Type	Description
key	string
value	string

HibernationConfig

Consolidates hibernation scheduling logic.

Used by the orchestrator to aggregate windows and exclusions across OU, Environment, and Project inheritance chains into a final deployment state.

Property	Type	Description
hibernate	bool	When set to 'true', forces the resource into hibernation immediately, overriding any active 'windows' or 'exclusions'. Defaults to 'false'.
windows	list of WindowsEntry	A map of recurring time windows during which the resource will be hibernated. The key of the map provides a unique name for each window.
exclusions	list of ExclusionsEntry	A map of specific, non-recurring time windows during which hibernation will be suspended, even if a 'window' is active. Use this for planned maintenance or high-traffic periods. The key of the map provides a unique name for each exclusion.

ExclusionsEntry

Property	Type	Description
key	string
value	HibernationExclusion

WindowsEntry

Property	Type	Description
key	string
value	HibernationWindow

HibernationExclusion

Defines a specific suspension of the hibernation schedule.

Prevents down-scaling operations during the specified timeframe, ensuring workloads remain active for special events or maintenance.

Property	Type	Description
start	string	The start date and time for the exclusion window in RFC3339 format. RFC3339
end	string	The end date and time for the exclusion window in RFC3339 format. RFC3339

HibernationWindow

Defines a recurring period when an asset should be scaled down.

Scheduled cron strings used by the control plane's orchestration tools to dynamically stop virtual machines or scale Cloud Run instances to zero.

Property	Type	Description
start	string	A cron expression defining when the hibernation window begins.
end	string	A cron expression defining when the hibernation window ends.

HostHealthConfig

Configuration for uptime and health checks on host endpoints.

Translates into google_compute_health_check and backend service parameters, driving routing decisions within GCP load balancers.

Property	Type	Description
protocol	string	Probe protocol. The protocol the health check uses to reach the endpoint: one of http, http2, https, grpc, or tcp. Drives both the container startup/liveness probes (Cloud Run, GKE) and the compute backend health check for VMs.
port	int64	Probe port. The TCP port the health check targets on the workload.
checkIntervalSec	int64	Check interval, in seconds. How often the health check runs. Defaulted to 30 by the ingress defaulter when the probe is generated automatically.
timeoutSec	int64	Probe timeout, in seconds. How long to wait for a single probe response before treating it as a failure. The ingress defaulter sets this to 10 when generating probes automatically.
healthyThreshold	int64	Healthy threshold. The number of consecutive successful probes required to mark the endpoint healthy. Defaulted to 1 by the ingress defaulter.
unhealthyThreshold	int64	Unhealthy threshold. The number of consecutive failed probes required to mark the endpoint unhealthy. Defaulted to 2 by the ingress defaulter.
enableLogs	bool	Enable health-check logging. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: enable request/response logging on the generated google_compute_health_check.
path	string	Probe request path. The HTTP request path for HTTP-family probes. Defaults to /. Used as the request path on the container probe and the compute backend health check.

HostRoutePortConfig

Port-specific routing configuration.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: bind a protocol and namespace to a set of named per-route configurations so load balancer traffic is routed correctly per port.

Property	Type	Description
protocol	string	Port protocol. NOT YET IMPLEMENTED. The intended protocol served on the port: one of http, http2, https, grpc, or tcp. Currently ignored by the engine.
namespace	string	Routing namespace. NOT YET IMPLEMENTED. The intended namespace the routes are bound into. Currently ignored by the engine.
routes	list of RoutesEntry	Named route configurations. NOT YET IMPLEMENTED. A map from route name to its per-route configuration. Currently ignored by the engine. See RouteConfig.

RoutesEntry

Property	Type	Description
key	string
value	RouteConfig

HttpRouteRedirect

Immediate HTTP redirect response.

Instructs the edge load balancer to intercept the request and issue an HTTP 3xx redirect instead of forwarding it. Redirect-only rules are handled at the external LB layer; the in-mesh HTTP route executor skips them. The engine currently populates host_redirect and response_code on the synthetic login redirect it injects; the remaining fields are passed through to the LB and not otherwise read by the engine.

Property	Type	Description
hostRedirect	string	Replacement host. Host the client is redirected to. Set by the engine on the injected login redirect and passed through to the LB's hostRedirect.
pathRedirect	string	Replacement path. Absolute path the client is redirected to, replacing the original path. Passed through to the LB's pathRedirect.
prefixRewrite	string	Path prefix rewrite on redirect. Prefix of the original path replaced before redirecting. Passed through to the LB's prefixRewrite.
responseCode	string	Redirect status code. Named HTTP redirect response code (e.g. MOVED_PERMANENTLY_DEFAULT, SEE_OTHER, TEMPORARY_REDIRECT). Set by the engine on the injected login redirect and passed through to the LB's redirectResponseCode.
httpsRedirect	bool	Force HTTPS scheme. When true, the redirect URL uses the https scheme. Passed through to the LB's httpsRedirect.
stripQuery	bool	Drop the query string. When true, the original request's query portion is removed from the redirect URL. Passed through to the LB's stripQuery.
portRedirect	string	Replacement port. Port used in the redirect URL. Passed through to the LB's portRedirect.

HttpRouteRule

Combines a match condition with an execution action for HTTP traffic.

The fundamental building block of a traffic routing table for google_network_services_http_route.

Property	Type	Description
matches	list of HttpRouteRuleMatch	Match conditions. Conditions selecting the HTTP requests this rule applies to; a request matches if any listed match holds. See HttpRouteRuleMatch.
authentication	list of RouteRuleAuthenticationConfig	Rule Authentication Configuration. Defines the authentication configuration for this rule. If not specified, the rule will be unauthenticated.
authorization	list of ComputedAuthorizationAccessRuleCheck	Rule Authorization Configuration. Defines the authorization configuration for this rule. If not specified, the rule will be open to all users.

HttpRouteRuleAction

Encapsulates the execution logic when a route match occurs.

Binds the RouteMatch to its target backend services or redirects within the cloud load balancing framework.

Property	Type	Description
destinations	list of HttpRouteRuleActionDestination	Weighted backend destinations. One or more backends that matching traffic is forwarded to, with optional weight-based splitting. See HttpRouteRuleActionDestination.
redirect	HttpRouteRedirect	Redirect instead of forwarding. When set (and no destinations are given), matching requests are answered with an HTTP redirect. Redirect-only rules are applied at the external LB, not the in-mesh route. See HttpRouteRedirect.
faultInjectionPolicy	FaultInjectionPolicy	Fault injection policy. Optional delay/abort fault injection applied to matching traffic for resilience testing. See FaultInjectionPolicy.
requestHeaderModifier	HeaderModifier	Request header rewrites. Header set/add/remove operations applied to the request before it reaches the backend. See HeaderModifier.
responseHeaderModifier	HeaderModifier	Response header rewrites. Header set/add/remove operations applied to the response before it reaches the client. See HeaderModifier.
urlRewrite	UrlRewrite	URL rewrite before forwarding. Path-prefix and host rewrites applied to the request before it is sent to the backend. See UrlRewrite.
timeout	string	Per-request timeout. Go-style duration string bounding the total time for a matching request. Applied to the route action's timeout.
retryPolicy	RetryPolicy	Retry policy. Conditions, attempt count, and per-try timeout governing automatic retries of failed requests. See RetryPolicy.
requestMirrorPolicy	RequestMirrorPolicy	Traffic mirroring policy. NOT YET IMPLEMENTED. Shadow-traffic mirroring configuration; declared but not read by any executor. See RequestMirrorPolicy.
corsPolicy	CorsPolicy	CORS policy. Cross-Origin Resource Sharing rules applied to matching traffic. See CorsPolicy.
directResponse	DirectResponse	Direct synthetic response. When set, matching requests are answered directly with a static status and body instead of being forwarded. See DirectResponse.
idleTimeout	string	Per-request idle timeout. Go-style duration string bounding the idle time on a matching request's stream. Applied to the route action's idleTimeout.

HttpRouteRuleActionDestination

Defines an upstream target for a routed request.

References the canonical backend service ID where traffic matching the rule should be sent, governing the weight distribution.

Property	Type	Description
deploymentConfig	string	Target DeploymentConfig manifest name. References a DeploymentConfig by name; the executor resolves it to that service's backend and routes matching traffic there. Mutually exclusive with virtual_machine and agent.
virtualMachine	string	Target VirtualMachine manifest name. References a VirtualMachine by name; the executor resolves it to that VM's backend. Mutually exclusive with deployment_config and agent.
port	int64	Backend port to route to. Port number on the resolved backend that matching traffic is forwarded to.
weight	int64	Traffic weight share. Relative weight (0-100) of this destination when a rule splits traffic across multiple destinations. Applied to the route rule's weighted-destination configuration.
agent	string	Target Agent manifest name. References an Agent by name; when set, the HTTP route targets the agentic proxy backing that agent's Reasoning Engine (the path is rewritten to /agents/{agent}/). Consumed only on the HTTP route path, not the gRPC path.

HttpRouteRuleMatch

Comprehensive matching criteria for an HTTP request.

Forms the crucial conditional backbone of a network services route, steering traffic based on path, headers, or query contents.

Property	Type	Description
ignoreCase	bool	Case-insensitive path matching. When true, path comparisons ignore character case. Emitted as ignoreCase on the route match.
fullPathMatch	string	Exact path match. Matches when the request path equals this value exactly. Emitted as fullPathMatch; mutually exclusive with prefix_match and regex_match.
prefixMatch	string	Path prefix match. Matches when the request path starts with this prefix. Emitted as prefixMatch.
regexMatch	string	Path regex match. Matches when the request path fully matches this regular expression. Emitted as regexMatch.
headers	list of HttpRouteRuleMatchHeader	Header conditions. Additional conditions on request headers; all must match for the rule to apply. See HttpRouteRuleMatchHeader.
queryParameters	list of QueryParameterMatch	Query parameter conditions. Additional conditions on URL query parameters; all must match for the rule to apply. See QueryParameterMatch.

HttpRouteRuleMatchHeader

Defines a condition to match against HTTP headers.

Creates the evaluating rule within a routeMatch.headers block inside a GCP HttpRoute, aiding in granular traffic splitting.

Property	Type	Description
header	string	Header name to test. Name of the request header whose value is evaluated by this condition. Emitted as header on the header matcher.
invertMatch	bool	Negate the match. When true, the rule matches requests where the header condition does NOT hold. Emitted as invertMatch.
exactMatch	string	Exact-value match. Matches when the header value equals this string exactly. Emitted as exactMatch.
regexMatch	string	Regex-value match. Matches when the header value fully matches this regular expression. Emitted as regexMatch.
prefixMatch	string	Prefix-value match. Matches when the header value starts with this prefix. Emitted as prefixMatch.
presentMatch	bool	Presence match. When true, matches solely on the header being present, regardless of its value. Emitted as presentMatch.
suffixMatch	string	Suffix-value match. Matches when the header value ends with this suffix. Emitted as suffixMatch.
rangeMatch	RangeMatch	Numeric-range match. Matches when the header value parses to an integer within the given range. See RangeMatch.

IdentityProviderConfig

Configures how a tenant uses an identity provider's container.

Points to a pre-defined source image and configuration layout representing a specific Identity Provider solution (like Keycloak), driving its deployment within the boundary of an IAP configuration.

Property	Type	Description
source	string	Source build definition. Required. Name of the BuildDefinition manifest that supplies the container image for the identity provider. Validated at compute time to reference an existing build; the ingress computer resolves the image from it.
container	string	Container within the build. Required. Name of the specific container definition to use from the source BuildDefinition. Validated to match one of that build's containers; needed when the source defines multiple containers.
version	string	Image version tag. Required. The tag of the container image to deploy for the identity provider.
spec	ContainerSpec	Container runtime overrides. Optional container specification (command, args, env, resources) layered over the resolved image. See ContainerSpec.

Jwks

JSON Web Key configuration for verifying tokens.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (only referenced by OauthClientConfig.jwks, which has no consumer). Intended future behavior: provide an offline public key for JWT verification in OAuth clients.

Property	Type	Description
kid	string	Key ID. NOT YET IMPLEMENTED (see message note). Intended future behavior: the kid identifying this key.
type	string	Key type. NOT YET IMPLEMENTED (see message note). Intended future behavior: the key type (e.g. RSA, EC).
alg	string	Signing algorithm. NOT YET IMPLEMENTED (see message note). Intended future behavior: the algorithm the key is used with (e.g. RS256).
pem	string	PEM-encoded public key. NOT YET IMPLEMENTED (see message note). Intended future behavior: the PEM-encoded public key material.

Maintenance

Defines the recurring weekly maintenance window and any explicit exclusions for resource upgrades.

Translates into maintenance_policy blocks on GCP resources like google_container_cluster (GKE) and google_sql_database_instance (Cloud SQL), dictating when Google Cloud can perform infrastructure upgrades.

Property	Type	Description
start	string	Recurring maintenance window start. RFC3339 timestamp whose time-of-day and day-of-week establish the recurring weekly window. Used to configure the maintenance_policy on resources like google_container_cluster and google_sql_database_instance.
end	string	Recurring maintenance window end. RFC3339 timestamp defining the end of the weekly window, and thus its duration, for applicable GCP resources.
exclusions	list of MaintenanceExclusion	Non-recurring maintenance blackout windows. Specific time windows during which maintenance must not occur even if it falls within the recurring weekly window; use to prevent updates during business-critical periods. Each entry creates a maintenance_exclusion block on applicable GCP resources.

MaintenanceExclusion

Defines a specific, non-recurring time window where platform maintenance should not occur.

Translates into maintenance_exclusion blocks on underlying GCP resources, overriding regular weekly maintenance windows during critical business periods.

Property	Type	Description
name	string	Human-readable name for the exclusion. A unique label identifying the reason for this exclusion (e.g. black-friday-freeze). Surfaced onto the corresponding maintenance_exclusion block on the underlying GCP resource.
start	string	Exclusion window start. The start date and time, in RFC3339 format, of this specific non-recurring window during which platform maintenance must not run.
end	string	Exclusion window end. The end date and time, in RFC3339 format, marking when the non-recurring exclusion window closes and normal maintenance may resume.

MethodMatch

Matches gRPC traffic by canonical service or method name.

Primary routing discriminator in google_network_services_grpc_route, replacing URL path matches found in HTTP.

Property	Type	Description
grpcService	string	Fully qualified gRPC service. Canonical service name (e.g. package.Service) that matching requests must target. Emitted as grpcService on the method matcher.
grpcMethod	string	gRPC method name. Method within the service that matching requests must invoke. Emitted as grpcMethod.
caseSensitive	bool	Case-sensitive matching. When true, service and method names are compared case-sensitively. Emitted as caseSensitive.

MetricConfig

Configures custom metric collection for the Ops Agent.

Adds custom receivers to the Ops Agent configuration file running within the virtual machine.

Property	Type	Description
type	string	Receiver type. The kind of metric receiver to add to the Ops Agent. Currently only prometheus is supported.
prometheus	PrometheusConfig	Prometheus receiver settings. The Prometheus scrape configuration used when type is prometheus. See PrometheusConfig.

MfaConfig

Multi-Factor Authentication (MFA) requirements for users.

NOT YET IMPLEMENTED as a project-wide setting: this type is only referenced by ProjectIdpConfig.mfa, which no engine consumer reads. Per-tenant MFA is instead configured on the IdentityProvider manifest. Intended future behavior: apply MFA mode, test phone numbers, and region restrictions to Identity Platform tenant configurations for all tenants in the project.

Property	Type	Description
mode	string	MFA enforcement mode. NOT YET IMPLEMENTED (see message note). Intended future behavior: DISABLED turns MFA off, ENABLED makes it optional, and MANDATORY requires it for all users. Proto validation restricts the value to these three constants.
testPhoneNumbers	list of TestPhoneNumbersEntry	MFA test phone numbers. NOT YET IMPLEMENTED (see message note). Intended future behavior: a map of phone number to its expected 6-digit OTP code, used to exercise MFA flows without sending real SMS.
allowedRegions	list of string	Allowed MFA regions. NOT YET IMPLEMENTED (see message note). Intended future behavior: the list of two-letter Unicode CLDR region codes in which MFA is permitted (region codes per https://cldr.unicode.org/).

TestPhoneNumbersEntry

Property	Type	Description
key	string
value	string

NetworkLogs

VPC Flow Logs export settings.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: populate the log_config block of google_compute_subnetwork, controlling flow-log aggregation interval and sampling rate for network telemetry.

Property	Type	Description
interval	string	Flow-log aggregation interval. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: set the aggregation_interval of the subnetwork log config, controlling the window over which VPC flow logs are aggregated before export. Proto validation restricts it to the allowed INTERVAL_* enum values.
sampling	double	Flow-log sampling rate. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: set the flow_sampling of the subnetwork log config, the fraction of connections captured. Proto validation constrains it to between 0.0 (no logs) and 1.0 (all logs).

OauthClientConfig

Defines the configuration of an OAuth 2.0 client.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: register a standard OAuth/OIDC client in Identity Providers or Gateway surfaces.

Property	Type	Description
grantTypes	list of string	Allowed OAuth grant types. NOT YET IMPLEMENTED (see message note). Intended future behavior: the grant types the client may use (e.g. authorization_code, client_credentials).
responseTypes	list of string	Allowed OAuth response types. NOT YET IMPLEMENTED (see message note). Intended future behavior: the response types the client may request (e.g. code, token).
scopes	list of string	Allowed scopes. NOT YET IMPLEMENTED (see message note). Intended future behavior: the OAuth scopes the client is permitted to request.
redirectUris	list of string	Permitted redirect URIs. NOT YET IMPLEMENTED (see message note). Intended future behavior: the allowed post-authorization redirect targets.
postLogoutRedirectUris	list of string	Permitted post-logout redirect URIs. NOT YET IMPLEMENTED (see message note). Intended future behavior: the allowed redirect targets after logout.
audience	list of string	Token audience. NOT YET IMPLEMENTED (see message note). Intended future behavior: the audience values placed on issued tokens.
jwks	Jwks	Client signing keys. NOT YET IMPLEMENTED (see message note). Intended future behavior: JSON Web Key material for verifying the client's tokens. See Jwks.

OidcProviderConfig

Configures an external OIDC provider for identity federation.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: plumb OIDC connection details into Identity Platform or other federated authentication components.

Property	Type	Description
source	string	Upstream OIDC provider. NOT YET IMPLEMENTED (see message note). Intended future behavior: the external provider to federate with. Proto validation restricts the value to github or google.
clientId	string	OAuth client identifier. NOT YET IMPLEMENTED (see message note). Intended future behavior: the client ID registered with the upstream provider.
mapper	string	Claim mapper. NOT YET IMPLEMENTED (see message note). Intended future behavior: mapping expression translating upstream OIDC claims into local identity attributes.
scopes	list of string	Requested OAuth scopes. NOT YET IMPLEMENTED (see message note). Intended future behavior: the scopes requested from the upstream provider during federation.

OrganizationalUnitDefinition

High-level definition of an Organizational Unit used to group environments and govern policies.

Maps to a GCP Folder hierarchy (google_folder), acting as an administrative boundary where IAM permissions and default network/hibernation policies are applied and propagated.

Property	Type	Description
displayName	string	Display name of the GCP folder. Human-friendly name for the OU's GCP Folder. When unspecified, the manifest's metadata.name is used. Proto validation constrains it to 3-30 characters of letters, digits, spaces, underscores, and dashes.
description	string	Human-readable description. Free text describing the GCP asset represented by this OU.
hibernation	HibernationConfig	Default hibernation schedule for the OU. Default schedule for automatically hibernating all resources within this Organizational Unit; can be overridden by child Environment or Project manifests. The computed schedule governs the active hours of underlying resources like google_compute_instance and google_cloud_run_service to manage cost.
permissions	AccessPermissions	Default access permissions for the OU. Default permissions for all resources within this Organizational Unit, inherited by child Environment and Project manifests. Translated into google_folder_iam_binding resources granting the specified roles to principals on the corresponding GCP Folder.
network	OrganizationalUnitNetwork	Default network settings for the OU. See OrganizationalUnitNetwork. NOT YET IMPLEMENTED (the underlying flow-log settings have no consumer).

OrganizationalUnitNetwork

Default network settings at the Organizational Unit (OU) level.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (its NetworkLogs payload has no consumer). Intended future behavior: provide default VPC flow-log configuration inherited by any Environment or Project within this OU.

Property	Type	Description
logs	NetworkLogs	Default VPC flow log settings for the OU. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: apply these settings to the log_config of every google_compute_subnetwork created under this unit.

ProjectDefinition

High-level definition of a workload-bearing Project.

Maps to a google_project in GCP. Sets the fundamental boundaries for deployed applications, defining the target region, IAM identity bindings, maintenance windows, and default routing rules.

Property	Type	Description
displayName	string	Display name of the GCP project. Human-friendly name for the google_project. When unspecified, the manifest's metadata.name is used. Proto validation constrains it to 3-30 characters of letters, digits, spaces, underscores, and dashes.
description	string	Human-readable description. Free text describing the GCP asset represented by this Project.
permissions	AccessPermissions	Project access permissions. Permissions specific to this Project, merged with those inherited from the parent Environment and OrganizationalUnit. Translated into google_project_iam_binding resources granting the specified roles to principals on this GCP Project.
network	ProjectNetwork	Project network settings. See ProjectNetwork. NOT YET IMPLEMENTED (the underlying flow-log settings have no consumer).
hibernation	HibernationConfig	Project hibernation schedule. Hibernation schedule for this Project, overriding any schedule inherited from parent manifests. The computed schedule governs the active hours of underlying resources within this Project to manage cost.
region	string	Primary GCP region. Region for the Project and its resources; when unspecified, inherited from the parent Environment. Sets the region for many provisioned resources such as google_sql_database_instance and google_redis_instance.
maintenance	Maintenance	Maintenance windows and exclusions. Required. Recurring weekly maintenance windows and specific exclusions for the Project's resources. Used to configure the maintenance_policy on resources like google_container_cluster and google_sql_database_instance.
defaultUrlRedirect	string	Default routing redirect URL. Required. URL to redirect to when a request matches no other routing rule within the Project.
allowedEgress	list of string	Egress allowlist. External hostnames or IP ranges that applications within the Project are allowed to connect to. Feeds the computed egress policy (NAT and firewall rules) enforced on the Project's outbound traffic.
identityProviderConfig	ProjectIdpConfig	Project-wide identity provider configuration. Identity provider settings applied across all tenants in the Project. See ProjectIdpConfig.

ProjectIdpConfig

Project-wide Identity Provider (IdP) configuration.

Applies identity and MFA settings globally to all Identity Platform tenants operating within this project's boundary.

Property	Type	Description
mfa	MfaConfig	Project-wide MFA configuration. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads this field). Intended future behavior: apply the given MfaConfig to every Identity Platform tenant in the project.
gdprCompliance	bool	Enables GDPR/EU regulatory compliance for all tenants in this project. When true the engine sets disable_user_deletion=false on the IdentityPlatformConfig (allowing user self-deletion) and propagates gdpr_compliance=true to all tenant UI configs, which makes the login app render an explicit TOS acceptance checkbox before sign-in and show a "Delete my account" button on the profile page. All child IdentityProvider manifests must set terms_of_service and privacy_policy URLs when this is enabled (enforced at compute time).

ProjectNetwork

Network telemetry settings for a Project.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (its NetworkLogs payload has no consumer). Intended future behavior: override the VPC flow-log configuration for subnetworks created within this Project.

Property	Type	Description
logs	NetworkLogs	VPC flow log settings for the project. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: apply these settings, overriding parent manifests, to the log_config of every google_compute_subnetwork created within this Project.

PrometheusConfig

Configures a Prometheus receiver for the Ops Agent.

Instructs the Ops Agent to scrape Prometheus metrics from the specified endpoint and port on the VM localhost loopback.

Property	Type	Description
scheme	string	Scrape scheme. The URL scheme the Ops Agent uses to scrape metrics: http or https.
endpoint	string	Scrape endpoint. The metrics path/endpoint scraped on the VM's localhost loopback (e.g. /metrics).
port	int64	Scrape port. The localhost port the Ops Agent scrapes for Prometheus metrics.

QueryParameterMatch

Defines a condition to match against HTTP query parameters.

Populates the routeMatch.queryParameters block within a GCP HttpRoute resource.

Property	Type	Description
queryParameter	string	Query parameter name to test. Name of the URL query parameter whose value is evaluated by this condition. Emitted as queryParameter on the query-parameter matcher.
exactMatch	string	Exact-value match. Matches when the parameter value equals this string exactly. Emitted as exactMatch.
regexMatch	string	Regex-value match. Matches when the parameter value fully matches this regular expression. Emitted as regexMatch.
presentMatch	string	Presence match. When set, matches on the parameter being present regardless of its value. Emitted as presentMatch.

RangeMatch

Tests a header value against an integer scale.

Adds a numeric rangeMatch parameter to a header matching rule in the underlying network service map.

Property	Type	Description
start	int64	Range lower bound (inclusive). Smallest integer header value that matches. Emitted as rangeMatch.start on the header matcher.
end	int64	Range upper bound (exclusive). Value one greater than the largest matching integer header value. Emitted as rangeMatch.end on the header matcher.

RequestMirrorDestination

Secondary destination for mirrored (shadow) traffic.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no executor reads RequestMirrorPolicy). Intended future behavior: duplicate matching requests to this backend without waiting for its response, for shadow testing or asynchronous analysis.

Property	Type	Description
deploymentConfig	string	Target DeploymentConfig manifest name. References the DeploymentConfig whose backend receives the mirrored copy of the request.
port	int64	Backend port for the mirror. Port number on the mirror backend that duplicated traffic is sent to.
weight	int64	Mirror weight share. Relative weight (0-100) of this mirror destination when traffic is duplicated across multiple targets.
requestHeaderModifier	HeaderModifier	Request header overrides for the mirror. Header modifications applied to the mirrored request before it is sent to the shadow backend.
responseHeaderModifier	HeaderModifier	Response header overrides for the mirror. Header modifications applied to the mirror backend's response (which is discarded, since the mirror is fire-and-forget).

RequestMirrorPolicy

Out-of-band request-mirroring policy.

NOT YET IMPLEMENTED. Declared in the schema (and referenced by HttpRouteRuleAction.request_mirror_policy) but currently ignored by the engine (no executor reads it). Intended future behavior: shadow a percentage of matching production traffic to a secondary backend, e.g. a staging service.

Property	Type	Description
destination	RequestMirrorDestination	Mirror destination. The backend that receives duplicated requests. See RequestMirrorDestination.
mirrorPercent	int64	Percentage of traffic to mirror. Share (0-100) of matching requests duplicated to the mirror destination.

RetryPolicy

Configures automatic retry mechanisms for failed requests.

Configured on the retryPolicy map for a network services route, determining backoff and condition behaviors when upstream services fail.

Property	Type	Description
retryConditions	list of string	Conditions that trigger a retry. List of failure conditions (e.g. 5xx, connect-failure, refused-stream) under which a request is retried. Applied to the route action's retryPolicy.retryConditions for both HTTP and gRPC routes.
numRetries	int64	Maximum retry attempts. Number of times a failed request is retried before giving up. Applied to the route action's retryPolicy.numRetries for both HTTP and gRPC routes.
perTryTimeout	string	Per-attempt timeout. Go-style duration string bounding each individual retry attempt. Applied to the HTTP route action's retryPolicy.perTryTimeout; not consumed on the gRPC path.

RouteAuthentication

Edge authentication requirements for a route.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: gate a route behind Identity-Aware Proxy, internal Organization IAM, or a named identity provider before traffic reaches the backend service.

Property	Type	Description
enabled	bool	Whether authentication is enforced. NOT YET IMPLEMENTED. When true, the route is intended to require authentication; currently no consumer reads this field.
type	string	Authentication mechanism. NOT YET IMPLEMENTED. The intended auth type: IdentityAwareProxy, OrgInternal, or IdentityProvider. Currently ignored by the engine.
providerName	string	Identity provider name. NOT YET IMPLEMENTED. The name of the identity provider to enforce when type is IdentityProvider. Currently ignored by the engine.

RouteConfig

Wrapper for per-route configuration settings.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: carry per-route settings (starting with authentication) for the ingress controllers or Gateway rules.

Property	Type	Description
authentication	RouteAuthentication	Route authentication settings. NOT YET IMPLEMENTED. The intended edge authentication configuration for the route. Currently ignored by the engine. See RouteAuthentication.

RouteRuleAuthenticationConfig

Configures authentication exceptions or specifics for a route rule.

Translates into localized Gateway or Load Balancer configurations dictating how auth assertions are evaluated for specific matched paths.

Property	Type	Description
type	string	Authentication mode. How the route rule is authenticated: IDENTITY_PROVIDER restricts access to named identity providers (see tenants), while INTERNAL restricts to internal callers. Validated against the manifest's declared identity providers during route/ingress validation.
tenants	list of string	Allowed identity providers. A list of IdentityProvider names permitted to access this route. Only applicable when type is IDENTITY_PROVIDER; each entry is validated to reference an existing provider.

Scaling

Defines autoscaling boundaries for compute workloads or replica sets.

Dictates min_replicas and max_replicas configuration for underlying autoscaling resources like google_compute_instance_group_manager or Kubernetes HorizontalPodAutoscaler.

Property	Type	Description
min	int64	Minimum instance count. Floor on the number of instances kept running in an instance group or replica set. Passed as the min instance/replica count to the underlying autoscaler (e.g. Cloud Run min instances or google_compute_instance_group_manager). Constrained by proto validation to be at least 1.
max	int64	Maximum instance count. Ceiling on the number of instances the autoscaler may create in an instance group or replica set. Passed as the max instance/replica count to the underlying autoscaler.

SecretSourceConfig

Defines how a secret should be retrieved and mounted into a workload.

Triggers IAM bindings for Secret Manager payload access. Values are resolved JIT and passed into the container via environment variables or file mounts.

Property	Type	Description
envVar	string	Environment variable name for the secret. The name of the environment variable populated with the secret's value. Mutually exclusive with file_path: set exactly one to choose environment-variable versus file-mount delivery.
version	string	Secret Manager version to resolve. The specific version of the secret to retrieve from the backend, either latest or a numeric version like 1. When omitted, latest is assumed.

SmtpConfig

Configuration for outbound email delivery via SMTP.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: supply sender identity for services that dispatch email (e.g. Identity Providers sending password-reset links).

Property	Type	Description
fromAddress	string	Sender email address. NOT YET IMPLEMENTED (see message note). Intended future behavior: the From address used on outbound messages.
fromName	string	Sender display name. NOT YET IMPLEMENTED (see message note). Intended future behavior: the human-readable From name shown on outbound messages.

SourceProjectReference

Fully qualified reference to a specific Project manifest.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: identify a Project by its name plus the environment and organizational_unit coordinates, since project names are not globally unique on their own.

Property	Type	Description
name	string	The 'metadata.name' of the target 'Project' manifest being referenced.
environment	string	The 'metadata.name' of the 'Environment' manifest that is the parent of the target project. If omitted, it defaults to the current 'Environment'.
organizationalUnit	string	The 'metadata.name' of the 'OrganizationalUnit' manifest that is the parent of the target environment. If omitted, it defaults to the current 'OrganizationalUnit'.

Stage

Defines a phase within a deployment strategy.

Maps out which application environments must be deployed to concurrently before proceeding, establishing the approval gates.

Property	Type	Description
environments	list of string	Environments in this stage. A list of Environment manifest names that belong to this deployment stage. An application must deploy successfully to every environment in the stage before it can be promoted to the next stage.
approvalPolicy	ApprovalPolicy	Approval gate for the stage. The approval policy that must be satisfied before the release may proceed through this stage. Validated during release-track processing to ensure referenced stakeholders exist. See ApprovalPolicy.

Stakeholder

Identifies a single approver by email.

A stakeholder is either an individual user or a group, referenced by email address. Used as the leaf of an ApprovalPolicy tree and validated to exist in the organization.

Property	Type	Description
userEmail	string	User approver email. The email address of an individual OrganizationUser who may satisfy the approval.
groupEmail	string	Group approver email. The email address of an OrganizationUserGroup whose members may satisfy the approval.

StartupConfig

Configuration for VM startup scripting.

Populates the metadata.startup-script field of the google_compute_instance, executing specified logic and injecting templated variables on boot.

Property	Type	Description
script	string	Startup script template. The script body written to the instance's metadata.startup-script. Templated variables from variables are substituted before execution on boot.
variables	list of VariablesEntry	Script template variables. A map from variable name to its definition (default value and whether it is required), substituted into the startup script's execution context. See VariableConfig.

VariablesEntry

Property	Type	Description
key	string
value	VariableConfig

UrlRewrite

Defines URL mutation logic before forwarding to a destination.

Populates the urlRewrite field of a routing action, altering the request path before it reaches the backend.

Property	Type	Description
pathPrefixRewrite	string	Replacement request path prefix. When set, the matched request path prefix is rewritten to this value before the request is forwarded. Applied to the route action's urlRewrite.pathPrefixRewrite by the HTTP route executor.
hostRewrite	string	Replacement Host header. When set, the request's Host header is rewritten to this value before forwarding to the backend. Applied to the route action's urlRewrite.hostRewrite.

UserBasedAccessPermissions

Defines access permissions strictly assigned to individual users, used when group-based authorization is unsupported or inappropriate.

Directly binds specific users to IAM roles or system privileges without an intermediary group resolution layer.

Property	Type	Description
administrators	list of string	Administrators. A list of users and groups granted administrative privileges on the asset. Exact rights are resource-dependent but typically confer full control.
contributors	list of string	Contributors. A list of users and groups granted contributor privileges on the asset. Exact rights are resource-dependent but typically confer read and write access.
viewers	list of string	Viewers. A list of users and groups granted viewer privileges on the asset. Exact rights are resource-dependent but typically confer read-only access.

UserExternalAccount

Maps a platform user to an external identity system.

Facilitates adding users to GitHub Orgs/Teams and maintaining synchronicity between internal user definition and external SSO representations.

Property	Type	Description
sourceType	string	External identity system type. The kind of external system hosting the account. Currently only GITHUB is supported.
sourceName	string	Connection manifest for the account. The name of the GithubConnection manifest that this external account belongs to, identifying the org/instance the username is resolved against.
username	string	External login name. The user's login or username in the external system, used to add them to the corresponding GitHub org/team.

VariableConfig

Defines a template variable for the startup script.

Resolved variables are injected into the VM's startup script execution context.

Property	Type	Description
defaultValue	string	Default value. The value substituted for the variable when no explicit value is provided by the VM manifest.
required	bool	Whether the variable is mandatory. When true, the VM computer errors if the variable is left unset, enforcing that a value is supplied before the startup script is rendered.

VirtualMachineConfigurationDefinition

Defines the core configuration for a virtual machine blueprint.

Acts as a templatable base for VirtualMachine manifests, establishing OS images, agent specs, and baseline secrets for google_compute_instance creation.

Property	Type	Description
operatingSystem	string	Operating system. The OS installed on the VM, which selects the boot disk's source image for the google_compute_instance. One of the supported Debian, Ubuntu, or Windows Server values.
secrets	list of SecretsEntry	Secrets available to the VM. A map from Secret manifest name to how it is exposed on the VM. The platform fetches each payload from Secret Manager and uses the startup script to inject it as a file or environment variable. See VirtualMachineSecretConfig.
agent	AgentConfig	Ops Agent configuration. The monitoring and logging agent configuration installed on the VM, controlling which logs and metrics are exported. See AgentConfig.
volumes	list of VolumesEntry	Volume definitions. A map from in-VM absolute mount path (e.g. /data) to the volume mounted there. See VirtualMachineVolumeConfig.
startup	StartupConfig	Startup configuration. The VM's startup script and its template variables, rendered into the instance metadata. See StartupConfig.

SecretsEntry

Property	Type	Description
key	string
value	VirtualMachineSecretConfig

VolumesEntry

Property	Type	Description
key	string
value	VirtualMachineVolumeConfig

VirtualMachineSecretConfig

Configures how secrets are provisioned directly to a Virtual Machine.

Intercepts Google Secret Manager payloads and drives startup scripts to write them out as files or variables prior to VM application startup.

Property	Type	Description
type	string	Exposure mechanism. How the secret is delivered to the VM: ENV_VAR sets it as an environment variable, or FILE writes it to a file via the startup script.
target	string	Destination for the secret. The target location: when type is FILE, the absolute path of the file to create; when type is ENV_VAR, the name of the environment variable to set. Consumed by the VM computer to populate the startup configuration.

VirtualMachineVolumeConfig

Defines a storage volume to be attached to a virtual machine.

Translates into google_compute_disk or bucket mount instructions, attaching physical or logical storage media to the google_compute_instance.

Property	Type	Description
name	string	Volume name. A logical name for the volume, referenced by VirtualMachine volume mounts and carried into the computed bucket/disk configuration.
type	string	Volume kind. The backing storage type: BUCKET (Cloud Storage FUSE mount), DISK (a persistent google_compute_disk), or SECRET (a Secret Manager payload).
fileSystem	string	Disk filesystem format. Only applicable to DISK volumes. The filesystem the disk is formatted with; must be compatible with the VM operating system. Lower-cased and carried into the computed disk configuration.
encrypted	bool	Disk encryption. Only applicable to DISK volumes. When true, the provisioned disk is encrypted. Carried into the computed disk configuration.

VirtualMachineVolumeMount

Connects a VM application to a specific backing volume.

Defines the runtime mounting instructions (like fstab entries or Fuse attachments) within the google_compute_instance.

Property	Type	Description
source	string	Volume source. For a BUCKET volume, the name of the bucket to mount; for a DISK volume, an optional Google Compute snapshot self-link used as the source snapshot. Carried into the computed bucket/disk configuration.
mountOptions	list of string	Mount options. Additional mount options applied when attaching the volume; joined into the mount command for the instance.
diskConfig	VirtualMachineVolumeMountDiskConfig	Disk sizing for the mount. Size, type, and snapshot settings for a DISK-backed mount. See VirtualMachineVolumeMountDiskConfig.

VirtualMachineVolumeMountDiskConfig

Configures the specification of an attached disk volume.

Parameters translate into the size and type of google_compute_disk created to back the attached volume mount.

Property	Type	Description
sizeGb	int64	Disk size, in GB. Only applicable to DISK volumes. The size of the attached disk; must be at least 200 GB.
type	string	Disk type. Only applicable to DISK volumes. The Compute Engine disk type (e.g. pd-ssd, pd-balanced) backing the mount.
snapshots	list of DiskSnapshotConfiguration	Per-environment snapshot sources. Optional snapshot configurations used to seed the disk for specific environments. See DiskSnapshotConfiguration.

VolumeMountBucketRef

References an external bucket for volume mounting.

Indicates Cloud Storage FUSE parameters and IAM permissions needed to attach the bucket.

Property	Type	Description
name	string	Source bucket name. Name of the Bucket manifest attached to the container via Cloud Storage FUSE. Resolved by the deployment config computer into the computed bucket-mount entry.
path	string	In-container mount path. Filesystem path at which the bucket is mounted inside the container.
canWrite	bool	Grant write access. When true, the mount is read-write and the container's service account is granted object-write permission on the bucket; otherwise the mount is read-only.

VolumeMountFile

Defines a synthesized file content within a volume mount.

Handled by startup scripts to create physical files on disk with the necessary text or binary payloads.

Property	Type	Description
mimeType	string	MIME type of the file. Content type recorded for the synthesized file; defaulted by the deployment config computer when left empty. Carried into the computed volume-mount file entry.
content	string	File contents. The literal payload written to the file at the mount path. Interpreted as base64 when base64_encoded is set, otherwise as plain text.
base64Encoded	bool	Content is base64-encoded. When true, content is decoded from base64 before being written, allowing binary files. Carried into the computed volume-mount file entry.