Private Ingress
PrivateIngress
Defines the high-level intent for an internal-only entry point to services.
Manages private traffic within the organization's network, translating intent into internal load balancers and network endpoints. This facilitates secure cross-project connectivity and service discovery within the private VPC infrastructure without public exposure.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as a PrivateIngress so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant PrivateIngress. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, project) are read by the engine to resolve this manifest's identity and its parent Project in the dependency graph. |
| spec | Spec | Desired private ingress configuration. The authoritative, user-authored specification for this private ingress. See Spec. |
Spec
User-defined configuration for the private ingress.
Describes the internal entry point: regional placement, an optional custom internal domain, and the set of source projects granted cross-project access via the hub-and-spoke (Private Service Connect) network model.
| Property | Type | Description |
|---|---|---|
| description | string | Human-readable description of this private ingress. Optional free text describing the ingress. Used as context by AI assistants when reasoning about the manifest. Not otherwise consumed by the engine. |
| authorizationDatabase | string | Authorization policy database reference. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the PrivateIngress engine (its defaulter, validator, and executor do not read it); unlike PublicIngress, no authorization services are provisioned. Intended future behavior: name of a sibling Database manifest used to store fine-grained authorization policies. |
| region | string | Preferred GCP region for the ingress gateway. Region where the gateway's compute resources are deployed. When empty it is inherited from the parent Project; the resolved value is surfaced in computed.region. |
| config | Config | Advanced ingress gateway tuning. See Config. NOT YET IMPLEMENTED — no consumer reads this block. |
| authorizedProjects | list of SourceProjectReference | Source projects granted inbound access. List of projects allowed to reach this ingress. During the compute phase each referenced project is registered as a Private Service Connect (hub-and-spoke) spoke so it can consume the gateway. See SourceProjectReference. |
| domain | string | Custom internal domain for this ingress. Optional hostname that overrides the system-generated internal domain. When set, the executor provisions a dedicated managed DNS zone plus a managed TLS certificate for it, and the operator is responsible for pointing DNS at the internal load balancer's IP. When empty it defaults to {metadata.name}.{project.computed.domain.internal}. Validated as a hostname; empty values are ignored. |
Config
Advanced backend-service tuning for the ingress gateway.
NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads any field of this block); the executor uses fixed backend-service settings. Intended future behavior: override timeouts, connection draining, custom headers, and the backend load-balancing policy.
| Property | Type | Description |
|---|---|---|
| timeoutSec | int64 | Overall request timeout, in seconds. Maximum time the backend service waits for a response. NOT YET IMPLEMENTED — no consumer reads it. |
| connectionDrainingTimeoutSec | int64 | Connection-draining timeout, in seconds. Time to wait for in-flight connections to drain before removing a backend instance. NOT YET IMPLEMENTED — no consumer reads it. |
| customRequestHeaders | list of string | Custom headers added to requests forwarded to backends. NOT YET IMPLEMENTED — no consumer reads it. |
| customResponseHeaders | list of string | Custom headers added to responses sent to clients. NOT YET IMPLEMENTED — no consumer reads it. |
| loadBalancing | LoadBalancing | Backend-service load-balancing policy. See LoadBalancing. NOT YET IMPLEMENTED — no consumer reads it. |
LoadBalancing
Load-balancing policy for the gateway's backend services.
NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads any field of this block). Intended future behavior: tune the balancing algorithm and capacity limits of the backend services.
| Property | Type | Description |
|---|---|---|
| balancingMode | string | Load-balancing algorithm. One of UTILIZATION, RATE, or CONNECTION (enforced by schema validation). NOT YET IMPLEMENTED — no consumer reads it. |
| capacityScaler | double | Capacity scaler for the backend service. A value between 0.0 and 1.0 that scales the backend service's advertised capacity. NOT YET IMPLEMENTED — no consumer reads it. |
| description | string | Description of the load-balancing policy. Optional free text describing this policy. Documentation-only: not read by the engine (the enclosing load-balancing-policy block is not yet wired). |
| maxConnections | int64 | Maximum connections per instance. Upper bound on concurrent connections per backend instance. NOT YET IMPLEMENTED — no consumer reads it. |
| maxRate | int64 | Maximum requests per second per instance. Upper bound on the request rate per backend instance. NOT YET IMPLEMENTED — no consumer reads it. |
| maxUtilization | double | Maximum CPU utilization of an instance. Target CPU utilization (0.0-1.0) used by the UTILIZATION balancing mode. NOT YET IMPLEMENTED — no consumer reads it. |
SourceProjectReference
Fully qualified reference to a specific Project manifest.
NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: identify a Project by its name plus the environment and organizational_unit coordinates, since project names are not globally unique on their own.
| Property | Type | Description |
|---|---|---|
| name | string | The 'metadata.name' of the target 'Project' manifest being referenced. |
| environment | string | The 'metadata.name' of the 'Environment' manifest that is the parent of the target project. If omitted, it defaults to the current 'Environment'. |
| organizationalUnit | string | The 'metadata.name' of the 'OrganizationalUnit' manifest that is the parent of the target environment. If omitted, it defaults to the current 'OrganizationalUnit'. |