External Application
ExternalApplication
Workload backed by an image built outside the workspace.
Access-control and routing target that mirrors Application but sources its container from an artifact produced off-site (a trusted_repository naming a TrustedRepository hosting the image) rather than from an in-workspace BuildDefinition. The engine provisions the same foundational identity, networking, and service-mesh structures as a native Application so the environment can route traffic to, and grant IAM access for, the external image. The substantive configuration lives in the ExternalApplicationDefinition message; this file only carries the manifest wrapper.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as an ExternalApplication so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant ExternalApplication. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys are read by the engine to resolve this manifest's identity and its parents (e.g. its Project and enclosing ApplicationSet) in the dependency graph. |
| spec | ExternalApplicationDefinition | User-defined external-application configuration. Required. Authoritative desired state for the external workload, mirroring a native Application: trusted-repository-backed container source, target compute platform, mesh strategy, resource requirements, access control, and runtime settings. Its shape is the ExternalApplicationDefinition message; the engine defaults, validates, and computes over this block to drive compute-module execution. |
ExternalApplicationDefinition
User-authored external-application specification.
The spec body for the ExternalApplication manifest, whose container image is produced outside the workspace. Mirrors ApplicationDefinition's shared fields (description, target, mesh strategy, project, access control, bundle-only, jobs) but sources the image from a trusted external repository instead of an in-workspace build. Consumed by the external-application, deployment-config, and job-config computers.
| Property | Type | Description |
|---|---|---|
| description | string | Human-readable role of the application. Free text describing what this application does; used as documentation and as context for AI assistants reasoning about the manifest. |
| target | string | Target compute platform. Selects the runtime the application is deployed to (KUBERNETES, CLOUD_RUN, or COMPUTE). Copied to computed state and used by the deployment-config computer to pick the underlying module (e.g. google_cloud_run_v2_service for CLOUD_RUN). |
| meshStrategy | string | Service mesh integration strategy. Controls how the application joins the service mesh: SIDECAR deploys a proxy sidecar and creates mesh HTTP/gRPC routes against a SIDECAR_PROXY backend, PROXYLESS uses in-process gRPC service discovery with no sidecar, and DISABLED keeps the application out of the mesh. Copied to computed state and read by the routing executors. |
| trustedRepository | string | Source trusted repository. Required. Name of the TrustedRepository manifest (a child of an ExternalRegistry) that hosts the externally built image. Validated to exist; the external-application computer resolves the parent registry's publish URL and composes the full image reference from it. |
| image | string | External image name. Required. Name of the image within the trusted repository to deploy. Combined with the repository and the registry publish URL to form the fully qualified image reference placed on the workload. |
| project | string | Destination Project manifest. Required. Name of the Project manifest the application is deployed into; must be present in every environment of the parent ReleaseTrack. Determines the GCP project where all of the application's resources (service, IAM bindings, etc.) are provisioned. |
| accessControl | ApplicationAccessControlConfig | Resource permissions granted to the application. Declares the access the application's service account is granted to platform resources such as Buckets, Databases, Pub/Sub topics, and Secrets. Copied to computed state and expanded by executors into the corresponding IAM bindings. See ApplicationAccessControlConfig. |
| bundleOnly | bool | Skip staged rollout and store builds directly. When true, the application is not promoted through pre-release tracks; its successful build versions are recorded directly as deployments and become available for inclusion in release-track bundles. Read by the application computer. |
| jobs | list of ApplicationJobReference | Associated lifecycle jobs. References to jobs run around this application's lifecycle (BEFORE deploy, AFTER deploy, SCHEDULED via cron, or ON_DEMAND). Each reference must have a matching JobConfig manifest in every environment. Read by the job-config computer and validators. See ApplicationJobReference. |
| cluster | string | Destination Kubernetes cluster. Required when target is KUBERNETES. metadata.name of a Kubernetes manifest inside the destination project. A Project may own several clusters, so there is nothing to infer — the cluster must be named. Validated to exist in the named project, in every environment of the parent ReleaseTrack, exactly as project is. Ignored for CLOUD_RUN and COMPUTE targets. Copied to computed state and used by the deployment-config executor to resolve the cluster the workload is deployed onto. |
ApplicationJobReference
Declares a job that is part of an Application's lifecycle.
References a job by name and type. The environment-specific configuration (container, schedule, resources) is provided by a corresponding JobConfig manifest.
| Property | Type | Description |
|---|---|---|
| name | string | Job name. Required. A unique name for this job within the application (e.g. migrate, cleanup). Links to the corresponding JobConfig manifest that supplies the environment-specific container, schedule, and resources. |
| type | string | Job execution type. Determines when and how the job runs: BEFORE runs before the main service deploy and blocks until complete (e.g. DB migrations); AFTER runs after the deploy and blocks until complete (e.g. seed data); SCHEDULED is triggered by a Cloud Scheduler cron expression; ON_DEMAND is provisioned but not scheduled, triggered manually or via API. |
ApplicationAccessControlConfig
Aggregates all external access rules an application requires.
Computes the comprehensive list of IAM bindings, SQL grants, and secret consumptions that must be provisioned alongside the application's actual deployment.
| Property | Type | Description |
|---|---|---|
| additionalRoles | list of string | Extra IAM roles for the service account. A list of additional IAM roles granted directly to the application's service account, beyond the roles derived from the other access-control blocks. |
| pubsub | ApplicationAccessControlPubsubConfig | Pub/Sub publish and subscribe grants. The application's permission to publish to or subscribe from specific Pub/Sub topics. See ApplicationAccessControlPubsubConfig. |
| buckets | list of ApplicationAccessControlBucketConfig | Cloud Storage bucket access rules. A list of bucket access rules describing which Cloud Storage buckets the application may read from or write to, and how they are mounted or exposed. See ApplicationAccessControlBucketConfig. |
| database | ApplicationAccessControlDatabaseConfig | PostgreSQL database access. The application's access to a specific PostgreSQL database instance and schema, including privileges and credential source. See ApplicationAccessControlDatabaseConfig. |
| secrets | list of SecretsEntry | Secrets consumed by the application. A map from Secret manifest name to the configuration describing how that secret is exposed to the application (as an environment variable or mounted file). See SecretSourceConfig. |
| redis | list of ApplicationAccessControlRedisConfig | Redis cache access. A list of Redis instances the application may use. Each entry injects the connection URL as an environment variable and creates a deployment dependency on the Redis DNS record. See ApplicationAccessControlRedisConfig. |
| jobs | list of ApplicationAccessControlJobConfig | Cloud Run Jobs the application may trigger. A list of Cloud Run Jobs (owned by other applications) that this application's service account may trigger via the RunJob API. Each entry grants roles/run.developer on the referenced job and injects its full resource name as an environment variable. See ApplicationAccessControlJobConfig. |
SecretsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | SecretSourceConfig |
ApplicationAccessControlPubsubConfig
Configures Pub/Sub interaction permissions for a workload.
Translates to roles/pubsub.publisher and roles/pubsub.subscriber IAM bindings assigned to the application's underlying service account.
| Property | Type | Description |
|---|---|---|
| publishTo | list of string | Topics the workload may publish to. A list of PubSub manifest names this workload is allowed to publish messages to. Each entry grants roles/pubsub.publisher to the workload's service account on the corresponding topic. |
| subscribeTo | list of string | Topics the workload may subscribe to. A list of PubSub manifest names this workload is allowed to create subscriptions for and pull messages from. Each entry grants roles/pubsub.subscriber to the workload's service account on the corresponding topic. |
ApplicationAccessControlJobConfig
Grants an application permission to trigger a Cloud Run Job owned by another application.
Resolves the target job via the owning Application's name and job name, then grants roles/run.developer to the calling application's service account on that job. The job's full Cloud Run resource name is injected as an env var (derived from the job name).
| Property | Type | Description |
|---|---|---|
| application | string | Owning application. Required. The Application manifest name that owns the target Cloud Run Job. Used together with job to resolve the concrete job resource to grant access on. |
| job | string | Target job name. Required. The job's name within the owning application, matching an ApplicationJobReference.name on that application. |
| envVar | string | Environment variable for the job resource name. The name of an environment variable injected into the caller with the job's full Cloud Run resource name. When empty, no variable is injected and the caller must derive the job name by convention. |
ApplicationAccessControlDatabaseConfig
Configures PostgreSQL interaction permissions for a workload.
Executes dynamic DDL (CREATE USER, GRANT) against the target SQL instance using an administrative proxy, setting up specific schema rights.
| Property | Type | Description |
|---|---|---|
| name | string | Target Database manifest name. The name of the Database manifest this application requires access to. Resolves to a concrete AlloyDB/PostgreSQL instance during computation. |
| schema | string | Database schema to connect to. The specific database (schema) within the instance the application connects to. Feeds the computed schema and per-deployment access grants used by the Database executor to provision users, roles, and grants. |
| privileges | list of string | SQL privileges to grant on the schema. A list of SQL privileges granted to the application's database role on the target schema. Each entry (one of USAGE, CREATE, ALL) translates into GRANT statements executed against the PostgreSQL instance. |
| readOnly | bool | Connect against a read replica. When true, the application is wired for read-only access, typically to connect to a read replica rather than the primary instance. |
| extensions | list of string | PostgreSQL extensions to enable. A list of PostgreSQL extensions to enable in the target database for this application. Each entry runs CREATE EXTENSION IF NOT EXISTS; extensions are merged across all applications sharing a schema in the computed database schema. |
| secretSource | SecretSourceConfig | Credential source for the database. Required. Defines how the application obtains its database credentials, e.g. from which Secret manifest and how it is exposed (environment variable or file mount). See SecretSourceConfig. |
ApplicationAccessControlRedisConfig
Configures Redis cache access for a workload.
Injects the Redis connection URL as an environment variable and establishes a graph dependency on the Redis manifest's DNS record to ensure the stable FQDN is resolvable before the application deploys.
All Memorystore Redis instances are provisioned with SERVER_AUTHENTICATION transit encryption (TLS). The CA certificate is extracted from the instance state and mounted as a volume in the container so the application can configure its TLS trust pool.
| Property | Type | Description |
|---|---|---|
| name | string | Target Redis manifest name. Required. The name of the Redis manifest this application requires access to. Establishes a graph dependency on that instance's DNS record so its FQDN is resolvable before the application deploys. |
| envVar | string | Environment variable for the connection URL. Required. The name of the environment variable populated with the Redis connection URL of the form redis[s]://memory-<redis-name>.<internal-domain>:<port>. Meshed strategies (SIDECAR/PROXYLESS) use redis:// on port 6380; direct access (DISABLED) uses rediss:// on port 6379. |
| caCertPath | string | In-container path for the server CA certificate. Required. The absolute file path at which the Memorystore server's CA certificate (extracted from instance state) is mounted. The application must load this PEM file into its TLS trust pool to validate the server's identity. |
ApplicationAccessControlBucketConfig
Configures Google Cloud Storage interaction permissions for a workload.
Translates to roles/storage.objectViewer or roles/storage.objectUser IAM bindings assigned to the application's service account, and can map specific paths.
| Property | Type | Description |
|---|---|---|
| name | string | Target Bucket manifest name. Required. The name of the Bucket manifest this application requires access to. The bucket must exist in every environment defined by the parent ReleaseTrack. |
| source | string | Source repository to sync into the bucket. Optional reference to a GithubRepository manifest whose contents seed the bucket. The CI/CD system uses this to set up a gcloud storage rsync job that mirrors the repository data into the bucket. |
| permission | string | Access level granted on the bucket. The permission level for this bucket: READ_ONLY grants roles/storage.objectViewer, and WRITE grants roles/storage.objectUser to the application's service account on the bucket. |
| mountPath | string | In-container mount path for the bucket. The absolute path at which the bucket is mounted (via Cloud Storage FUSE) inside the container. When omitted, permissions are still granted but the bucket is not mounted as a filesystem. |
| subPath | string | Restrict access to a bucket sub-path. A sub-path (prefix) within the bucket that access is scoped to; when omitted, access covers the whole bucket. Commonly used to mount a specific folder of the bucket into the container. |
| promote | bool | Promote bucket contents with the release. When true, the bucket's content is promoted through the ReleaseTrack alongside the application, typically for shipping generic application configuration data with each release. |
| envVar | string | Environment variable to receive the bucket name. The name of an environment variable populated with the resolved bucket name, giving the application the bucket name as plain configuration instead of a filesystem mount. Mutually exclusive with mount_path. |
SecretSourceConfig
Defines how a secret should be retrieved and mounted into a workload.
Triggers IAM bindings for Secret Manager payload access. Values are resolved JIT and passed into the container via environment variables or file mounts.
| Property | Type | Description |
|---|---|---|
| envVar | string | Environment variable name for the secret. The name of the environment variable populated with the secret's value. Mutually exclusive with file_path: set exactly one to choose environment-variable versus file-mount delivery. |
| version | string | Secret Manager version to resolve. The specific version of the secret to retrieve from the backend, either latest or a numeric version like 1. When omitted, latest is assumed. |