Grpc Route
GrpcRoute
Defines the high-level intent for routing gRPC traffic.
Translates this into service mesh or load balancer configurations, supporting features like method-level routing, retry policies, and timeout management.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as a GrpcRoute so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant GrpcRoute. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, project) are read by the engine to resolve this manifest's identity and its parent ingress (PublicIngress or PrivateIngress) in the dependency graph. |
| spec | Spec | Desired gRPC route configuration. The authoritative, user-authored specification for this GrpcRoute. See Spec. |
Target
Resolved backend target of the route.
NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it) and never populated by the GrpcRoute computer. Intended to identify the resolved backend (kind and name) that the route forwards to.
| Property | Type | Description |
|---|---|---|
| kind | string | Target resource kind. Discriminator for the resolved target. Part of the not-yet-implemented target block. |
| name | string | Target resource name. Name of the resolved backend target manifest. Part of the not-yet-implemented target block. |
Spec
User-defined gRPC routing rules.
The authored intent for matching gRPC requests by service or method and forwarding them to backend targets. The engine turns this into service-mesh gRPC route rules on the parent ingress.
| Property | Type | Description |
|---|---|---|
| description | string | Human-readable description of this route. Optional free text describing the purpose of the route. Not consumed by the engine's provisioning logic; surfaced in generated documentation and used as context by AI assistants when reasoning about the manifest. |
| rules | list of GrpcRouteRule | gRPC routing rules. Ordered list of match/forward rules for gRPC traffic; see GrpcRouteRule. Each rule becomes a mesh gRPC route rule bound to a hostname derived from the manifest name, and may configure service/method matching, retries, timeouts, and fault injection. |
GrpcRouteRule
A single gRPC traffic routing rule.
Pairs one or more gRPC match conditions with an action and optional auth configuration; the building block of a google_network_services_grpc_route routing table.
| Property | Type | Description |
|---|---|---|
| matches | list of GrpcRouteRuleMatch | Match conditions. Conditions selecting the gRPC requests this rule applies to; a request matches if any listed match holds. See GrpcRouteRuleMatch. |
| authentication | list of RouteRuleAuthenticationConfig | Rule Authentication Configuration. Defines the authentication configuration for this rule. If not specified, the rule will be unauthenticated. |
| authorization | list of ComputedAuthorizationAccessRuleCheck | Rule Authorization Configuration. Defines the authorization configuration for this rule. If not specified, the rule will be open to all users. |
GrpcRouteRuleMatch
Matching criteria for a gRPC request.
Conditions on gRPC metadata and the invoked service/method that steer traffic within a google_network_services_grpc_route.
| Property | Type | Description |
|---|---|---|
| headers | list of GrpcRouteRuleMatchHeader | Metadata conditions. Conditions on gRPC metadata entries; all must match for the rule to apply. See GrpcRouteRuleMatchHeader. |
| method | MethodMatch | Service/method condition. Restricts the rule to a specific gRPC service and method. See MethodMatch. |
ComputedAuthorizationAccessRuleCheck
Represents a computed access check for a route rule.
Maps an expected identity tuple (namespace, relation, object) that the AuthZ extension must validate during the request flow.
| Property | Type | Description |
|---|---|---|
| namespace | string | This value is a direct reflection of 'spec.authorization.namespace' from a child 'HttpRoute' or 'GrpcRoute' manifest. |
| relation | string | This value is a direct reflection of 'spec.authorization.relation' from a child 'HttpRoute' or 'GrpcRoute' manifest. |
| object | string | This value is a direct reflection of 'spec.authorization.object' from a child 'HttpRoute' or 'GrpcRoute' manifest. |
RouteRuleAuthenticationConfig
Configures authentication exceptions or specifics for a route rule.
Translates into localized Gateway or Load Balancer configurations dictating how auth assertions are evaluated for specific matched paths.
| Property | Type | Description |
|---|---|---|
| type | string | Authentication mode. How the route rule is authenticated: IDENTITY_PROVIDER restricts access to named identity providers (see tenants), while INTERNAL restricts to internal callers. Validated against the manifest's declared identity providers during route/ingress validation. |
| tenants | list of string | Allowed identity providers. A list of IdentityProvider names permitted to access this route. Only applicable when type is IDENTITY_PROVIDER; each entry is validated to reference an existing provider. |
GrpcRouteRuleMatchHeader
Matches gRPC metadata equivalent to HTTP headers.
Appended to a grpc_route to define rules based on custom gRPC metadata sent by the client.
| Property | Type | Description |
|---|---|---|
| key | string | Metadata key to test. Name of the gRPC metadata entry whose value is evaluated by this condition. Emitted as key on the gRPC header matcher. |
| value | string | Expected metadata value. Value compared against the metadata entry, interpreted per type (exact or regular expression). Emitted as value. |
| type | string | Match type. How value is compared: EXACT for a literal match or REGULAR_EXPRESSION for a regex match (TYPE_UNSPECIFIED defaults to exact). Emitted as type. |
MethodMatch
Matches gRPC traffic by canonical service or method name.
Primary routing discriminator in google_network_services_grpc_route, replacing URL path matches found in HTTP.
| Property | Type | Description |
|---|---|---|
| grpcService | string | Fully qualified gRPC service. Canonical service name (e.g. package.Service) that matching requests must target. Emitted as grpcService on the method matcher. |
| grpcMethod | string | gRPC method name. Method within the service that matching requests must invoke. Emitted as grpcMethod. |
| caseSensitive | bool | Case-sensitive matching. When true, service and method names are compared case-sensitively. Emitted as caseSensitive. |