Kubernetes
Kubernetes
Defines the high-level intent for a managed Kubernetes cluster.
Provides a simplified interface for defining a cluster's region, maintenance window, and node pools. The platform handles the underlying complexity of VPC peering, control plane master authorized networks, and IAM role bindings for workload identity.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as a Kubernetes cluster so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant Kubernetes. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, project) are read by the engine to resolve this manifest's identity and its parent Project, and to attach child KubernetesNodePool manifests in the dependency graph. |
| spec | Spec | Desired cluster configuration. The authoritative, user-authored specification for this Kubernetes cluster. See Spec. |
ApplicationsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | ComputedApplication |
ServiceAccountsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | ComputedIamServiceAccount |
Spec
User-provided cluster configuration.
Regional placement and lifecycle maintenance settings for the GKE cluster. Node capacity is defined separately via child KubernetesNodePool manifests.
| Property | Type | Description |
|---|---|---|
| description | string | Human-readable description of this cluster. Optional free text describing the role of this cluster. Propagated onto the provisioned GKE cluster's description field, and used as context by AI assistants when reasoning about the manifest. |
| region | string | GKE cluster region. The GCP region where the cluster is created. When unset, the engine falls back to the computed region of the parent Project manifest. |
| maintenance | Maintenance | Cluster maintenance window. Time windows during which the platform may perform automated cluster maintenance and upgrades. When unset, the engine falls back to the maintenance schedule of the parent Project manifest. See Maintenance. |
ComputedApplication
Represents a fully computed application deployment configuration.
Collates mesh strategy, pre-flight migration requirements, and the container image layout required by the execution engine to provision the underlying Cloud Run service or K8s Deployment.
| Property | Type | Description |
|---|---|---|
| name | string | Application name. The resolved name of the application this computed record describes. |
| meshStrategy | string | Service mesh strategy. The mesh strategy applied to the application (e.g. SIDECAR, PROXYLESS, DISABLED, EXCLUDED), which governs how traffic is routed and how service URLs are formed. |
| container | ComputedContainerDefinition | Container definition. The fully resolved container image definition for the application, used by the executor to provision the underlying Cloud Run service or Kubernetes Deployment. See ComputedContainerDefinition. |
ComputedIamServiceAccount
Represents a computed Google Cloud Service Account and its binding state.
Holds the resolved state for google_service_account resources, driving the creation of IAM bindings and establishing Kubernetes Workload Identity bindings (k8s_name).
| Property | Type | Description |
|---|---|---|
| name | string | The name of the Google Cloud Service Account. This is typically composed from the name of the corresponding 'Application' manifest. |
| create | bool | A boolean indicating whether the platform should create this service account. This is usually true unless the application is configured to use a pre-existing service account. |
| roles | ComputedIamServiceAccountPermissions | This block contains the final, resolved list of IAM roles granted to the service account, derived from the 'accessControl' block of the corresponding 'Application' manifest. |
| k8sName | string | The name of the corresponding Kubernetes Service Account that is bound to the Google Cloud Service Account. This is relevant for applications deployed to GKE. |
| k8sNamespace | string | The Kubernetes namespace where the Kubernetes Service Account is created. |
Maintenance
Defines the recurring weekly maintenance window and any explicit exclusions for resource upgrades.
Translates into maintenance_policy blocks on GCP resources like google_container_cluster (GKE) and google_sql_database_instance (Cloud SQL), dictating when Google Cloud can perform infrastructure upgrades.
| Property | Type | Description |
|---|---|---|
| start | string | Recurring maintenance window start. RFC3339 timestamp whose time-of-day and day-of-week establish the recurring weekly window. Used to configure the maintenance_policy on resources like google_container_cluster and google_sql_database_instance. |
| end | string | Recurring maintenance window end. RFC3339 timestamp defining the end of the weekly window, and thus its duration, for applicable GCP resources. |
| exclusions | list of MaintenanceExclusion | Non-recurring maintenance blackout windows. Specific time windows during which maintenance must not occur even if it falls within the recurring weekly window; use to prevent updates during business-critical periods. Each entry creates a maintenance_exclusion block on applicable GCP resources. |
MaintenanceExclusion
Defines a specific, non-recurring time window where platform maintenance should not occur.
Translates into maintenance_exclusion blocks on underlying GCP resources, overriding regular weekly maintenance windows during critical business periods.
| Property | Type | Description |
|---|---|---|
| name | string | Human-readable name for the exclusion. A unique label identifying the reason for this exclusion (e.g. black-friday-freeze). Surfaced onto the corresponding maintenance_exclusion block on the underlying GCP resource. |
| start | string | Exclusion window start. The start date and time, in RFC3339 format, of this specific non-recurring window during which platform maintenance must not run. |
| end | string | Exclusion window end. The end date and time, in RFC3339 format, marking when the non-recurring exclusion window closes and normal maintenance may resume. |
ComputedContainerDefinition
Represents the fully resolved container image deployment source.
Fuses the registry's geographical footprint with a specific container build to provide the absolute URL for the deployment API (e.g., Cloud Run or GKE).
| Property | Type | Description |
|---|---|---|
| sourceRegistry | ComputedAccessibleRegistry | Source registry. The Artifact Registry where the container image is stored. See ComputedAccessibleRegistry. |
| image | string | Full image URL. The absolute container image reference, including registry host and repository path, passed to the deployment API (e.g. Cloud Run or GKE). |
ComputedIamServiceAccountPermissions
Represents computed IAM role aggregations for a service account.
Derived from the accessControl blocks to determine the precise list of IAM roles the application's service account requires across scopes (org, project, AR).
| Property | Type | Description |
|---|---|---|
| organization | list of string | A list of computed IAM roles granted to the service account at the GCP Organization level. |
| project | list of string | A list of computed IAM roles granted to the service account at the GCP Project level. |
| artifactRegistry | list of string | A list of computed IAM roles granted to the service account for accessing specific Artifact Registry repositories. |
ComputedAccessibleRegistry
Represents a computed Artifact Registry resource accessible by deployments.
Tracks the registry location and name needed to perform container image path resolution.
| Property | Type | Description |
|---|---|---|
| name | string | Registry name. The name of the Artifact Registry repository accessible to the deployment. |
| location | string | Registry location. The GCP region or multi-region where the registry is hosted, used to build the image path. |
| trustedRepositories | list of string | Trusted external repositories. The names of trusted repository children for external registries, used by the Binary Authorization policy to generate granular per-repository allowlist patterns instead of blanket registry-wide wildcards. Empty for internal Artifact Registry repositories, which rely on attestation instead. |