Project
Project
Defines the high-level intent for a logical project within the Infrastream platform.
Serves as a fundamental boundary for resource isolation, IAM permissions, and network segmentation. It anchors infrastructure deployments including compute workloads, data stores, and ingress routing topologies.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as a Project so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant Project. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Reserved keys (e.g. name, environment, organizational-unit, organization) are read by the engine to resolve this project's identity and its parent Environment in the dependency graph. |
| spec | ProjectDefinition | Desired project configuration. The authoritative, user-authored specification for this project: billing assignment, region, egress policy, network topology, and cross-resource access controls. Uses the shared ProjectDefinition type. |
AccessibleRegistries
Registry access grouped by compute target.
Lists the artifact/external registries that Cloud Run and Compute workloads in this project need to pull from, broken down by target so each service account is granted the right access.
| Property | Type | Description |
|---|---|---|
| cloudrun | list of ComputedAccessibleRegistry | Registries accessible to Cloud Run workloads. Registries referenced by the project's Cloud Run applications. |
| compute | list of ComputedAccessibleRegistry | Registries accessible to Compute workloads. Registries referenced by the project's Compute Engine applications. |
AgentApplicationsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |
CloudrunApplicationsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | ComputedApplication |
CloudrunJobApplicationsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | ComputedApplication |
ComputeApplicationsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | ComputedApplication |
IdentityProviderAuthorizedDomainsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |
McpApplicationsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |
VpcSpokesEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |
ProjectDefinition
High-level definition of a workload-bearing Project.
Maps to a google_project in GCP. Sets the fundamental boundaries for deployed applications, defining the target region, IAM identity bindings, maintenance windows, and default routing rules.
| Property | Type | Description |
|---|---|---|
| displayName | string | Display name of the GCP project. Human-friendly name for the google_project. When unspecified, the manifest's metadata.name is used. Proto validation constrains it to 3-30 characters of letters, digits, spaces, underscores, and dashes. |
| description | string | Human-readable description. Free text describing the GCP asset represented by this Project. |
| permissions | AccessPermissions | Project access permissions. Permissions specific to this Project, merged with those inherited from the parent Environment and OrganizationalUnit. Translated into google_project_iam_binding resources granting the specified roles to principals on this GCP Project. |
| network | ProjectNetwork | Project network settings. See ProjectNetwork. NOT YET IMPLEMENTED (the underlying flow-log settings have no consumer). |
| hibernation | HibernationConfig | Project hibernation schedule. Hibernation schedule for this Project, overriding any schedule inherited from parent manifests. The computed schedule governs the active hours of underlying resources within this Project to manage cost. |
| region | string | Primary GCP region. Region for the Project and its resources; when unspecified, inherited from the parent Environment. Sets the region for many provisioned resources such as google_sql_database_instance and google_redis_instance. |
| maintenance | Maintenance | Maintenance windows and exclusions. Required. Recurring weekly maintenance windows and specific exclusions for the Project's resources. Used to configure the maintenance_policy on resources like google_container_cluster and google_sql_database_instance. |
| defaultUrlRedirect | string | Default routing redirect URL. Required. URL to redirect to when a request matches no other routing rule within the Project. |
| allowedEgress | list of string | Egress allowlist. External hostnames or IP ranges that applications within the Project are allowed to connect to. Feeds the computed egress policy (NAT and firewall rules) enforced on the Project's outbound traffic. |
| identityProviderConfig | ProjectIdpConfig | Project-wide identity provider configuration. Identity provider settings applied across all tenants in the Project. See ProjectIdpConfig. |
ComputedApplication
Represents a fully computed application deployment configuration.
Collates mesh strategy, pre-flight migration requirements, and the container image layout required by the execution engine to provision the underlying Cloud Run service or K8s Deployment.
| Property | Type | Description |
|---|---|---|
| name | string | Application name. The resolved name of the application this computed record describes. |
| meshStrategy | string | Service mesh strategy. The mesh strategy applied to the application (e.g. SIDECAR, PROXYLESS, DISABLED, EXCLUDED), which governs how traffic is routed and how service URLs are formed. |
| container | ComputedContainerDefinition | Container definition. The fully resolved container image definition for the application, used by the executor to provision the underlying Cloud Run service or Kubernetes Deployment. See ComputedContainerDefinition. |
ComputedAccessibleRegistry
Represents a computed Artifact Registry resource accessible by deployments.
Tracks the registry location and name needed to perform container image path resolution.
| Property | Type | Description |
|---|---|---|
| name | string | Registry name. The name of the Artifact Registry repository accessible to the deployment. |
| location | string | Registry location. The GCP region or multi-region where the registry is hosted, used to build the image path. |
| trustedRepositories | list of string | Trusted external repositories. The names of trusted repository children for external registries, used by the Binary Authorization policy to generate granular per-repository allowlist patterns instead of blanket registry-wide wildcards. Empty for internal Artifact Registry repositories, which rely on attestation instead. |
AccessPermissions
Core definition for assigning administrative and viewer privileges across the platform.
Used by the engine to compute the final IAM policies (google_folder_iam_binding, etc.), aggregating individual user and group definitions to role assignments.
| Property | Type | Description |
|---|---|---|
| administrators | DetailedAccessPermissions | Administrators. Users and groups granted administrative privileges on the asset. Exact rights are resource-dependent but typically confer full control. See DetailedAccessPermissions. |
| contributors | DetailedAccessPermissions | Contributors. Users and groups granted contributor privileges on the asset. Exact rights are resource-dependent but typically confer read and write access. See DetailedAccessPermissions. |
| viewers | DetailedAccessPermissions | Viewers. Users and groups granted viewer privileges on the asset. Exact rights are resource-dependent but typically confer read-only access. See DetailedAccessPermissions. |
HibernationConfig
Consolidates hibernation scheduling logic.
Used by the orchestrator to aggregate windows and exclusions across OU, Environment, and Project inheritance chains into a final deployment state.
| Property | Type | Description |
|---|---|---|
| hibernate | bool | When set to 'true', forces the resource into hibernation immediately, overriding any active 'windows' or 'exclusions'. Defaults to 'false'. |
| windows | list of WindowsEntry | A map of recurring time windows during which the resource will be hibernated. The key of the map provides a unique name for each window. |
| exclusions | list of ExclusionsEntry | A map of specific, non-recurring time windows during which hibernation will be suspended, even if a 'window' is active. Use this for planned maintenance or high-traffic periods. The key of the map provides a unique name for each exclusion. |
ComputedContainerDefinition
Represents the fully resolved container image deployment source.
Fuses the registry's geographical footprint with a specific container build to provide the absolute URL for the deployment API (e.g., Cloud Run or GKE).
| Property | Type | Description |
|---|---|---|
| sourceRegistry | ComputedAccessibleRegistry | Source registry. The Artifact Registry where the container image is stored. See ComputedAccessibleRegistry. |
| image | string | Full image URL. The absolute container image reference, including registry host and repository path, passed to the deployment API (e.g. Cloud Run or GKE). |
ProjectIdpConfig
Project-wide Identity Provider (IdP) configuration.
Applies identity and MFA settings globally to all Identity Platform tenants operating within this project's boundary.
| Property | Type | Description |
|---|---|---|
| mfa | MfaConfig | Project-wide MFA configuration. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads this field). Intended future behavior: apply the given MfaConfig to every Identity Platform tenant in the project. |
| gdprCompliance | bool | Enables GDPR/EU regulatory compliance for all tenants in this project. When true the engine sets disable_user_deletion=false on the IdentityPlatformConfig (allowing user self-deletion) and propagates gdpr_compliance=true to all tenant UI configs, which makes the login app render an explicit TOS acceptance checkbox before sign-in and show a "Delete my account" button on the profile page. All child IdentityProvider manifests must set terms_of_service and privacy_policy URLs when this is enabled (enforced at compute time). |
Maintenance
Defines the recurring weekly maintenance window and any explicit exclusions for resource upgrades.
Translates into maintenance_policy blocks on GCP resources like google_container_cluster (GKE) and google_sql_database_instance (Cloud SQL), dictating when Google Cloud can perform infrastructure upgrades.
| Property | Type | Description |
|---|---|---|
| start | string | Recurring maintenance window start. RFC3339 timestamp whose time-of-day and day-of-week establish the recurring weekly window. Used to configure the maintenance_policy on resources like google_container_cluster and google_sql_database_instance. |
| end | string | Recurring maintenance window end. RFC3339 timestamp defining the end of the weekly window, and thus its duration, for applicable GCP resources. |
| exclusions | list of MaintenanceExclusion | Non-recurring maintenance blackout windows. Specific time windows during which maintenance must not occur even if it falls within the recurring weekly window; use to prevent updates during business-critical periods. Each entry creates a maintenance_exclusion block on applicable GCP resources. |
ProjectNetwork
Network telemetry settings for a Project.
NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (its NetworkLogs payload has no consumer). Intended future behavior: override the VPC flow-log configuration for subnetworks created within this Project.
| Property | Type | Description |
|---|---|---|
| logs | NetworkLogs | VPC flow log settings for the project. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: apply these settings, overriding parent manifests, to the log_config of every google_compute_subnetwork created within this Project. |
MaintenanceExclusion
Defines a specific, non-recurring time window where platform maintenance should not occur.
Translates into maintenance_exclusion blocks on underlying GCP resources, overriding regular weekly maintenance windows during critical business periods.
| Property | Type | Description |
|---|---|---|
| name | string | Human-readable name for the exclusion. A unique label identifying the reason for this exclusion (e.g. black-friday-freeze). Surfaced onto the corresponding maintenance_exclusion block on the underlying GCP resource. |
| start | string | Exclusion window start. The start date and time, in RFC3339 format, of this specific non-recurring window during which platform maintenance must not run. |
| end | string | Exclusion window end. The end date and time, in RFC3339 format, marking when the non-recurring exclusion window closes and normal maintenance may resume. |
MfaConfig
Multi-Factor Authentication (MFA) requirements for users.
NOT YET IMPLEMENTED as a project-wide setting: this type is only referenced by ProjectIdpConfig.mfa, which no engine consumer reads. Per-tenant MFA is instead configured on the IdentityProvider manifest. Intended future behavior: apply MFA mode, test phone numbers, and region restrictions to Identity Platform tenant configurations for all tenants in the project.
| Property | Type | Description |
|---|---|---|
| mode | string | MFA enforcement mode. NOT YET IMPLEMENTED (see message note). Intended future behavior: DISABLED turns MFA off, ENABLED makes it optional, and MANDATORY requires it for all users. Proto validation restricts the value to these three constants. |
| testPhoneNumbers | list of TestPhoneNumbersEntry | MFA test phone numbers. NOT YET IMPLEMENTED (see message note). Intended future behavior: a map of phone number to its expected 6-digit OTP code, used to exercise MFA flows without sending real SMS. |
| allowedRegions | list of string | Allowed MFA regions. NOT YET IMPLEMENTED (see message note). Intended future behavior: the list of two-letter Unicode CLDR region codes in which MFA is permitted (region codes per https://cldr.unicode.org/). |
ExclusionsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | HibernationExclusion |
WindowsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | HibernationWindow |
NetworkLogs
VPC Flow Logs export settings.
NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: populate the log_config block of google_compute_subnetwork, controlling flow-log aggregation interval and sampling rate for network telemetry.
| Property | Type | Description |
|---|---|---|
| interval | string | Flow-log aggregation interval. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: set the aggregation_interval of the subnetwork log config, controlling the window over which VPC flow logs are aggregated before export. Proto validation restricts it to the allowed INTERVAL_* enum values. |
| sampling | double | Flow-log sampling rate. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: set the flow_sampling of the subnetwork log config, the fraction of connections captured. Proto validation constrains it to between 0.0 (no logs) and 1.0 (all logs). |
DetailedAccessPermissions
Aggregation of specific user and group access definitions.
Refers to lists of OrganizationUser and OrganizationUserGroup manifests that will be parsed to retrieve actual Google Workspace identity emails for IAM binding construction.
| Property | Type | Description |
|---|---|---|
| members | list of string | A list of 'OrganizationUser' manifest names to be included in this permission set. |
| groups | list of string | A list of 'OrganizationUserGroup' manifest names to be included in this permission set. |
HibernationWindow
Defines a recurring period when an asset should be scaled down.
Scheduled cron strings used by the control plane's orchestration tools to dynamically stop virtual machines or scale Cloud Run instances to zero.
| Property | Type | Description |
|---|---|---|
| start | string | A cron expression defining when the hibernation window begins. |
| end | string | A cron expression defining when the hibernation window ends. |
HibernationExclusion
Defines a specific suspension of the hibernation schedule.
Prevents down-scaling operations during the specified timeframe, ensuring workloads remain active for special events or maintenance.
| Property | Type | Description |
|---|---|---|
| start | string | The start date and time for the exclusion window in RFC3339 format. RFC3339 |
| end | string | The end date and time for the exclusion window in RFC3339 format. RFC3339 |
TestPhoneNumbersEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | string |