Http Route
HttpRoute
Defines the high-level intent for routing HTTP(S) traffic.
The engine translates this manifest into service mesh routes or load balancer URL maps, supporting features like path-based routing, header manipulation, and traffic splitting.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as an HttpRoute so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant HttpRoute. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, project) are read by the engine to resolve this manifest's identity and its parent ingress (PublicIngress or PrivateIngress) in the dependency graph. |
| spec | Spec | Desired HTTP route configuration. The authoritative, user-authored specification for this HttpRoute. See Spec. |
Target
Resolved backend target of the route.
Identifies a non-standard backend that the route forwards to. Set during computation when a rule destination targets an Agent (kind AGENT). Populated by the engine; currently informational and not yet read by the executor.
| Property | Type | Description |
|---|---|---|
| kind | string | Target resource kind. Discriminator for the resolved target, e.g. AGENT. Populated by the engine. |
| name | string | Target resource name. Name of the resolved backend target manifest. Populated by the engine. |
Spec
User-defined HTTP routing rules.
The authored intent for matching, transforming, and forwarding HTTP(S) requests to backend targets. The engine turns this into service-mesh route rules and load-balancer URL-map paths on the parent ingress.
| Property | Type | Description |
|---|---|---|
| description | string | Human-readable description of this route. Optional free text describing the purpose of the route. Not consumed by the engine's provisioning logic; surfaced in generated documentation and used as context by AI assistants when reasoning about the manifest. |
| rules | list of HttpRouteRule | HTTP routing rules. Ordered list of match/transform/forward rules evaluated for incoming requests; see HttpRouteRule. Each rule becomes a mesh route rule and a set of load-balancer URL-map paths on the parent ingress, bound to a hostname derived from the manifest name. Rules are reordered by match specificity during computation so more specific matches take precedence. |
HttpRouteRule
Combines a match condition with an execution action for HTTP traffic.
The fundamental building block of a traffic routing table for google_network_services_http_route.
| Property | Type | Description |
|---|---|---|
| matches | list of HttpRouteRuleMatch | Match conditions. Conditions selecting the HTTP requests this rule applies to; a request matches if any listed match holds. See HttpRouteRuleMatch. |
| authentication | list of RouteRuleAuthenticationConfig | Rule Authentication Configuration. Defines the authentication configuration for this rule. If not specified, the rule will be unauthenticated. |
| authorization | list of ComputedAuthorizationAccessRuleCheck | Rule Authorization Configuration. Defines the authorization configuration for this rule. If not specified, the rule will be open to all users. |
ComputedAuthorizationAccessRuleCheck
Represents a computed access check for a route rule.
Maps an expected identity tuple (namespace, relation, object) that the AuthZ extension must validate during the request flow.
| Property | Type | Description |
|---|---|---|
| namespace | string | This value is a direct reflection of 'spec.authorization.namespace' from a child 'HttpRoute' or 'GrpcRoute' manifest. |
| relation | string | This value is a direct reflection of 'spec.authorization.relation' from a child 'HttpRoute' or 'GrpcRoute' manifest. |
| object | string | This value is a direct reflection of 'spec.authorization.object' from a child 'HttpRoute' or 'GrpcRoute' manifest. |
HttpRouteRuleMatch
Comprehensive matching criteria for an HTTP request.
Forms the crucial conditional backbone of a network services route, steering traffic based on path, headers, or query contents.
| Property | Type | Description |
|---|---|---|
| ignoreCase | bool | Case-insensitive path matching. When true, path comparisons ignore character case. Emitted as ignoreCase on the route match. |
| fullPathMatch | string | Exact path match. Matches when the request path equals this value exactly. Emitted as fullPathMatch; mutually exclusive with prefix_match and regex_match. |
| prefixMatch | string | Path prefix match. Matches when the request path starts with this prefix. Emitted as prefixMatch. |
| regexMatch | string | Path regex match. Matches when the request path fully matches this regular expression. Emitted as regexMatch. |
| headers | list of HttpRouteRuleMatchHeader | Header conditions. Additional conditions on request headers; all must match for the rule to apply. See HttpRouteRuleMatchHeader. |
| queryParameters | list of QueryParameterMatch | Query parameter conditions. Additional conditions on URL query parameters; all must match for the rule to apply. See QueryParameterMatch. |
RouteRuleAuthenticationConfig
Configures authentication exceptions or specifics for a route rule.
Translates into localized Gateway or Load Balancer configurations dictating how auth assertions are evaluated for specific matched paths.
| Property | Type | Description |
|---|---|---|
| type | string | Authentication mode. How the route rule is authenticated: IDENTITY_PROVIDER restricts access to named identity providers (see tenants), while INTERNAL restricts to internal callers. Validated against the manifest's declared identity providers during route/ingress validation. |
| tenants | list of string | Allowed identity providers. A list of IdentityProvider names permitted to access this route. Only applicable when type is IDENTITY_PROVIDER; each entry is validated to reference an existing provider. |
QueryParameterMatch
Defines a condition to match against HTTP query parameters.
Populates the routeMatch.queryParameters block within a GCP HttpRoute resource.
| Property | Type | Description |
|---|---|---|
| queryParameter | string | Query parameter name to test. Name of the URL query parameter whose value is evaluated by this condition. Emitted as queryParameter on the query-parameter matcher. |
| exactMatch | string | Exact-value match. Matches when the parameter value equals this string exactly. Emitted as exactMatch. |
| regexMatch | string | Regex-value match. Matches when the parameter value fully matches this regular expression. Emitted as regexMatch. |
| presentMatch | string | Presence match. When set, matches on the parameter being present regardless of its value. Emitted as presentMatch. |
HttpRouteRuleMatchHeader
Defines a condition to match against HTTP headers.
Creates the evaluating rule within a routeMatch.headers block inside a GCP HttpRoute, aiding in granular traffic splitting.
| Property | Type | Description |
|---|---|---|
| header | string | Header name to test. Name of the request header whose value is evaluated by this condition. Emitted as header on the header matcher. |
| invertMatch | bool | Negate the match. When true, the rule matches requests where the header condition does NOT hold. Emitted as invertMatch. |
| exactMatch | string | Exact-value match. Matches when the header value equals this string exactly. Emitted as exactMatch. |
| regexMatch | string | Regex-value match. Matches when the header value fully matches this regular expression. Emitted as regexMatch. |
| prefixMatch | string | Prefix-value match. Matches when the header value starts with this prefix. Emitted as prefixMatch. |
| presentMatch | bool | Presence match. When true, matches solely on the header being present, regardless of its value. Emitted as presentMatch. |
| suffixMatch | string | Suffix-value match. Matches when the header value ends with this suffix. Emitted as suffixMatch. |
| rangeMatch | RangeMatch | Numeric-range match. Matches when the header value parses to an integer within the given range. See RangeMatch. |
RangeMatch
Tests a header value against an integer scale.
Adds a numeric rangeMatch parameter to a header matching rule in the underlying network service map.
| Property | Type | Description |
|---|---|---|
| start | int64 | Range lower bound (inclusive). Smallest integer header value that matches. Emitted as rangeMatch.start on the header matcher. |
| end | int64 | Range upper bound (exclusive). Value one greater than the largest matching integer header value. Emitted as rangeMatch.end on the header matcher. |