Public Ingress
PublicIngress
Defines the high-level intent for a publicly accessible entry point to platform services.
Translates into external load balancing infrastructure, automated SSL/TLS certificate provisioning, and DNS zone configurations. Serves as the aggregation layer for Identity-Aware Proxy (IAP) integration and centralized authorization policy enforcement.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as a PublicIngress so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant PublicIngress. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, project) are read by the engine to resolve this manifest's identity and its parent Project in the dependency graph. |
| spec | Spec | Desired public ingress configuration. The authoritative, user-authored specification for this public ingress. See Spec. |
Authorization
Authorization enforcement details.
Computed backend service and access rules for the authorization extension. Populated only when spec.authorization_database is set.
| Property | Type | Description |
|---|---|---|
| backendService | string | Authorization-extension backend service self-link. Self-link of the backend service fronting the authorization extension Cloud Run service, conventionally named <metadata.name>-authz-ext. |
| accessRules | ComputedAuthorizationAccess | Aggregated authorization access rules. Aggregation of the authorization rules across all child HttpRoute and GrpcRoute manifests attached to this ingress. See ComputedAuthorizationAccess. |
IdentityProviderUiConfigsEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | TenantUiConfig |
LoadBalancerEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | ComputedLoadBalancerHost |
TenantUiConfig
Per-tenant login UI configuration.
UI settings for the authUI login page, keyed by IdentityProvider manifest name and populated from each IdentityProvider's spec.
| Property | Type | Description |
|---|---|---|
| signInFlow | string | The sign-in flow type (e.g. "redirect" or "popup"). |
| displayName | string | The display name shown to end-users on the login page. |
| iconUrl | string | URL to the tenant icon displayed on the login page. |
| logoUrl | string | URL to the tenant logo displayed on the login page. |
| buttonColor | string | Hex color code for the sign-in button. |
| tosUrl | string | URL to the terms of service document. |
| privacyPolicyUrl | string | URL to the privacy policy document. |
| signInOptions | list of SignInOption | The list of enabled sign-in providers for this tenant. |
| styleUrl | string | URL to a custom CSS stylesheet for this tenant. |
| heroImageUrl | string | URL to a hero/background image for the login page hero panel. |
| heroBackground | string | CSS background value for the hero panel. |
| immediateFederatedRedirect | bool | When true and exactly one federated provider, skip sign-in UI and redirect immediately. |
| redirectOnLogin | string | Redirect URL after successful sign-in for this tenant. |
| redirectOnLogout | string | Redirect URL after sign-out for this tenant. |
| gdprCompliance | bool | When true, the login app renders GDPR-compliant UI: - Explicit TOS acceptance checkbox before sign-in - "Delete my account" button on the profile page |
SignInOption
A single sign-in provider option.
One enabled authentication provider offered to end users on the login page for this tenant.
| Property | Type | Description |
|---|---|---|
| provider | string | Provider ID. Identifier of the sign-in provider (e.g. password, google.com, anonymous). |
| useRecaptcha | bool | Use invisible reCAPTCHA. When true, the provider uses invisible reCAPTCHA protection. |
Spec
User-defined configuration for the public ingress.
Describes the public entry point: custom domain binding, identity-provider and IAP access control, an optional authorization-policy database, and login-app UI settings. Child route manifests (Http/Grpc/Tls/StaticAsset) attach to this ingress to define traffic routing.
| Property | Type | Description |
|---|---|---|
| description | string | Human-readable description of this public ingress. Optional free text describing the ingress. Used as context by AI assistants when reasoning about the manifest. Not otherwise consumed by the engine. |
| region | string | Preferred GCP region for this ingress. Region for the assets created by this manifest. When empty it is inherited from the parent Project (and in turn Environment/Organization); the resolved value is surfaced in computed.region. |
| domain | DomainConfig | Custom domain configuration for this ingress. See DomainConfig. When unset, the ingress uses the system-generated default domain derived from the parent Project. |
| identityProviderApplication | IdentityProviderConfig | Identity provider for the login application. Points at the source application used to build/serve the identity-provider login UI. Validated against the project's build definitions during the validation phase and resolved into computed.idp_login_application during computation. See IdentityProviderConfig. When omitted, default configuration is used. |
| iapPermissions | DetailedAccessPermissions | IAP access allowlist. Users and groups permitted to reach applications behind this ingress when Identity-Aware Proxy (IAP) is enabled. Resolved into computed.iap_permissions and applied as IAP IAM bindings on the IAP-enabled backend service by the executor. See DetailedAccessPermissions. |
| authorizationDatabase | string | Authorization policy database reference. Name of a Database manifest in the same project used to store fine-grained authorization policies. When set, the defaulter provisions two additional Cloud Run services: an authorization extension (-authz-ext, a read-only gRPC external authorizer that checks requests against the policies) and an authorization service (-authz-svc, an Ory Keto read-write service that lets project applications manage policies and runs a one-time schema migration). Validated to reference an existing database. |
| config | Config | Advanced ingress gateway tuning. See Config. NOT YET IMPLEMENTED — no consumer reads this block. |
| loginApp | LoginAppConfig | Login app UI configuration. See LoginAppConfig. When GCIP is enabled, these settings control the behavior and appearance of the authentication portal. |
Config
Advanced backend-service tuning for the ingress gateway.
NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads any field of this block); the executor uses fixed backend-service settings. Intended future behavior: override timeouts, connection draining, custom headers, and the backend load-balancing policy.
| Property | Type | Description |
|---|---|---|
| timeoutSec | int64 | Overall request timeout, in seconds. Maximum time the backend service waits for a response. NOT YET IMPLEMENTED — no consumer reads it. |
| connectionDrainingTimeoutSec | int64 | Connection-draining timeout, in seconds. Time to wait for in-flight connections to drain before removing a backend instance. NOT YET IMPLEMENTED — no consumer reads it. |
| customRequestHeaders | list of string | Custom headers added to requests forwarded to backends. NOT YET IMPLEMENTED — no consumer reads it. |
| customResponseHeaders | list of string | Custom headers added to responses sent to clients. NOT YET IMPLEMENTED — no consumer reads it. |
| loadBalancing | LoadBalancing | Backend-service load-balancing policy. See LoadBalancing. NOT YET IMPLEMENTED — no consumer reads it. |
LoadBalancing
Load-balancing policy for the gateway's backend services.
NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads any field of this block). Intended future behavior: tune the balancing algorithm and capacity limits of the backend services.
| Property | Type | Description |
|---|---|---|
| balancingMode | string | Load-balancing algorithm. One of UTILIZATION, RATE, or CONNECTION (enforced by schema validation). NOT YET IMPLEMENTED — no consumer reads it. |
| capacityScaler | double | Capacity scaler for the backend service. A value between 0.0 and 1.0 that scales the backend service's advertised capacity. NOT YET IMPLEMENTED — no consumer reads it. |
| description | string | Description of the load-balancing policy. Optional free text describing this policy. Documentation-only: not read by the engine (the enclosing load-balancing-policy block is not yet wired). |
| maxConnections | int64 | Maximum connections per instance. Upper bound on concurrent connections per backend instance. NOT YET IMPLEMENTED — no consumer reads it. |
| maxRate | int64 | Maximum requests per second per instance. Upper bound on the request rate per backend instance. NOT YET IMPLEMENTED — no consumer reads it. |
| maxUtilization | double | Maximum CPU utilization of an instance. Target CPU utilization (0.0-1.0) used by the UTILIZATION balancing mode. NOT YET IMPLEMENTED — no consumer reads it. |
DomainConfig
Custom, user-owned domain binding and DNS records.
When provided, name is used as the base for computed.domain instead of the system-generated default, and the platform provisions a managed DNS zone plus the required records (wildcard A, certificate-validation CNAME, Firebase TXT/DKIM). The operator MUST delegate the domain by pointing its NS records at the created zone's name servers for it to resolve.
| Property | Type | Description |
|---|---|---|
| name | string | Base domain name for this ingress. Consumed during the compute phase as the base for hostnames in child HTTP/gRPC routes and for computed.domain. Validated as a hostname; empty values are ignored. |
| txtRecords | list of string | Extra TXT records for the zone apex. Custom TXT entries added at the zone apex alongside platform-managed records (e.g. Firebase SPF, domain verification), applied by the executor so they are not erased by engine runs. Each entry must be a valid TXT record value (e.g. google-site-verification=xxxxx). |
LoginAppConfig
Login app UI configuration.
Controls the behavior and appearance of the hosted authentication portal when Google Cloud Identity Platform (GCIP) is enabled. Validated during the compute phase and serialized into the login app's UI_CONFIG environment variable by the executor.
| Property | Type | Description |
|---|---|---|
| displayMode | string | Sign-in display mode. optionFirst shows all providers at once; identifierFirst shows an email-first flow (enforced by schema validation). Serialized into the login app UI config. |
| selectTenantUiTitle | string | Tenant-selector splash title. Title text shown on the tenant selector screen in multi-tenant setups. Validation requires this when GCIP is enabled with more than one identity provider. Serialized into the login app UI config. |
| selectTenantUiLogo | string | Tenant-selector splash logo URL. Logo shown on the tenant selector screen in multi-tenant setups. Serialized into the login app UI config. |
| redirectOnLogin | string | Default post-sign-in redirect URL. Where users are sent after a successful sign-in, unless overridden per tenant. Serialized into the login app UI config. |
| redirectOnLogout | string | Default post-sign-out redirect URL. Where users are sent after signing out, unless overridden per tenant. Serialized into the login app UI config. |
| supportedLocales | list of string | Enabled locale codes. List of locale codes offered by the login app (e.g. ["en", "fr", "hi", "ar"]). When more than one is set, locale_cookie.name is required. Serialized into the login app UI config. |
| localeCookie | LocaleCookie | Locale cookie settings. See LocaleCookie. Required when supported_locales has more than one entry. |
| styleUrl | string | Global custom CSS stylesheet URL. Applied across all tenants and overridden by a per-tenant style URL. Must be an HTTPS URL or a relative path (validated during computation). Serialized into the login app UI config. |
| tosUrl | string | Default Terms of Service URL. Shown on the login page unless overridden per tenant. Serialized into the login app UI config. |
| privacyPolicyUrl | string | Default Privacy Policy URL. Shown on the login page unless overridden per tenant. Serialized into the login app UI config. |
| redirectUris | list of string | Allowed OAuth redirect URI patterns. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: restrict OAuth redirect URIs for the login flow to this allowlist. |
LocaleCookie
Cookie for persisting the user's locale choice.
Names and scopes the cookie the login app uses to remember a user's selected locale across sessions and subdomains.
| Property | Type | Description |
|---|---|---|
| name | string | Cookie name. Name of the locale cookie (e.g. locale). Required when more than one supported_locales entry is configured. |
| domain | string | Cookie domain. Domain scope for cross-subdomain sharing (e.g. .pvotal.tech). |
ComputedLoadBalancerHost
Represents a fully compiled set of paths mapped to a Load Balancer Host.
Translates down to the hostRules within a google_compute_url_map.
| Property | Type | Description |
|---|---|---|
| iapPaths | list of ComputedLoadBalancerPath | Paths protected by IAP (Identity-Aware Proxy) authentication. |
| gcipPaths | list of ComputedLoadBalancerPath | Paths protected by GCIP (Identity Platform) authentication. |
| unauthPaths | list of ComputedLoadBalancerPath | Paths served without authentication. |
| bucketPaths | list of ComputedLoadBalancerPath | Paths served directly from a static GCS bucket backend. |
ComputedAuthorizationAccess
The full map of hostnames to authorization paths.
Acts as the primary in-memory index for the authz extensions running alongside the load balancers.
| Property | Type | Description |
|---|---|---|
| rules | list of RulesEntry | This is a map where the key is a hostname and the value is the set of authorization rules for that host, aggregated from all relevant child 'HttpRoute' and 'GrpcRoute' manifests. |
DetailedAccessPermissions
Aggregation of specific user and group access definitions.
Refers to lists of OrganizationUser and OrganizationUserGroup manifests that will be parsed to retrieve actual Google Workspace identity emails for IAM binding construction.
| Property | Type | Description |
|---|---|---|
| members | list of string | A list of 'OrganizationUser' manifest names to be included in this permission set. |
| groups | list of string | A list of 'OrganizationUserGroup' manifest names to be included in this permission set. |
IdentityProviderConfig
Configures how a tenant uses an identity provider's container.
Points to a pre-defined source image and configuration layout representing a specific Identity Provider solution (like Keycloak), driving its deployment within the boundary of an IAP configuration.
| Property | Type | Description |
|---|---|---|
| source | string | Source build definition. Required. Name of the BuildDefinition manifest that supplies the container image for the identity provider. Validated at compute time to reference an existing build; the ingress computer resolves the image from it. |
| container | string | Container within the build. Required. Name of the specific container definition to use from the source BuildDefinition. Validated to match one of that build's containers; needed when the source defines multiple containers. |
| version | string | Image version tag. Required. The tag of the container image to deploy for the identity provider. |
| spec | ContainerSpec | Container runtime overrides. Optional container specification (command, args, env, resources) layered over the resolved image. See ContainerSpec. |
ComputedLoadBalancerPath
Represents a fully compiled routing path inside a Load Balancer.
Translates down to individual URL Map path matchers within a google_compute_url_map.
| Property | Type | Description |
|---|---|---|
| matchers | list of HttpRouteRuleMatch | Compiled match conditions for this URL Map path matcher. |
| tenant | string | Tenant this path is scoped to; only populated for IDENTITY_PROVIDER auth. Only used for IDENTITY_PROVIDER |
| hostRewrite | string | Host header rewrite applied before forwarding to the backend. |
| pathRewrite | string | Request path rewrite applied before forwarding to the backend. |
| bucket | string | Backing GCS bucket name, set when this path serves static bucket content. Used for static buckets |
| complexity | int64 | Ordering weight used to sort path matchers (higher = more specific, evaluated first). |
| timeout | string | Go-style duration string for the route-level request timeout (e.g. "1800s"). When set, overrides the backend service default on the URL Map route rule. |
| idleTimeout | string | Go-style duration string for the route-level idle timeout (e.g. "60s"). |
| agentName | string | Agent name this path routes to. When set, indicates this path should be rewritten to /agents/{agent_name}/ for the agentic proxy. |
RulesEntry
| Property | Type | Description |
|---|---|---|
| key | string | |
| value | ComputedAuthorizationAccessRules |
ContainerSpec
Core configuration block for defining a runtime container.
Overrides default container behavior from the base image, defining entrypoints, variables, and compute constraints. Translates directly to elements like resources and env within google_cloud_run_v2_service or Kubernetes specifications.
| Property | Type | Description |
|---|---|---|
| enabled | bool | Whether this container is enabled. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: allow toggling this container off without removing its definition. |
| command | list of string | Container entrypoint. Overrides the image entrypoint (maps to the container command). Applied to the provisioned Cloud Run service or Kubernetes container. |
| args | list of string | Container arguments. Arguments passed to the entrypoint (maps to the container args). |
| env | list of EnvVariableDefinition | Static environment variables. Literal name/value environment variables merged into the container's computed environment alongside variables injected via secrets and access control. |
| uid | string | Process user ID. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: run the container process as this UID. |
| gid | string | Process group ID. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it). Intended future behavior: run the container process as this GID. |
| resources | ContainerResources | Compute resource requests and limits. CPU/memory requests and limits applied to the container on the provisioned Cloud Run service or Kubernetes pod. See ContainerResources. |
EnvVariableDefinition
Defines a static environment variable to be injected.
Appended to the environment variable array of the corresponding compute resource container definition.
| Property | Type | Description |
|---|---|---|
| name | string | The environment variable name. |
| value | string | The literal value assigned to the environment variable. |
ContainerResources
Defines compute requirements and constraints for a container.
Maps to the resource requests and limits in Kubernetes Pods or Cloud Run service configurations to ensure adequate scaling and scheduling semantics.
| Property | Type | Description |
|---|---|---|
| requests | ContainerResource | The minimum CPU/memory guaranteed to the container (maps to resource requests). |
| limits | ContainerResource | The maximum CPU/memory the container may consume (maps to resource limits). |
HttpRouteRuleMatch
Comprehensive matching criteria for an HTTP request.
Forms the crucial conditional backbone of a network services route, steering traffic based on path, headers, or query contents.
| Property | Type | Description |
|---|---|---|
| ignoreCase | bool | Case-insensitive path matching. When true, path comparisons ignore character case. Emitted as ignoreCase on the route match. |
| fullPathMatch | string | Exact path match. Matches when the request path equals this value exactly. Emitted as fullPathMatch; mutually exclusive with prefix_match and regex_match. |
| prefixMatch | string | Path prefix match. Matches when the request path starts with this prefix. Emitted as prefixMatch. |
| regexMatch | string | Path regex match. Matches when the request path fully matches this regular expression. Emitted as regexMatch. |
| headers | list of HttpRouteRuleMatchHeader | Header conditions. Additional conditions on request headers; all must match for the rule to apply. See HttpRouteRuleMatchHeader. |
| queryParameters | list of QueryParameterMatch | Query parameter conditions. Additional conditions on URL query parameters; all must match for the rule to apply. See QueryParameterMatch. |
ComputedAuthorizationAccessRules
Aggregation of authz rules for a specific host.
Pre-calculated list to quickly look up all applicable authorization predicates for incoming traffic bounds.
| Property | Type | Description |
|---|---|---|
| rules | list of ComputedAuthorizationAccessRule | This is a list of authorization rules, aggregated from all child 'HttpRoute' and 'GrpcRoute' manifests for a given host. |
HttpRouteRuleMatchHeader
Defines a condition to match against HTTP headers.
Creates the evaluating rule within a routeMatch.headers block inside a GCP HttpRoute, aiding in granular traffic splitting.
| Property | Type | Description |
|---|---|---|
| header | string | Header name to test. Name of the request header whose value is evaluated by this condition. Emitted as header on the header matcher. |
| invertMatch | bool | Negate the match. When true, the rule matches requests where the header condition does NOT hold. Emitted as invertMatch. |
| exactMatch | string | Exact-value match. Matches when the header value equals this string exactly. Emitted as exactMatch. |
| regexMatch | string | Regex-value match. Matches when the header value fully matches this regular expression. Emitted as regexMatch. |
| prefixMatch | string | Prefix-value match. Matches when the header value starts with this prefix. Emitted as prefixMatch. |
| presentMatch | bool | Presence match. When true, matches solely on the header being present, regardless of its value. Emitted as presentMatch. |
| suffixMatch | string | Suffix-value match. Matches when the header value ends with this suffix. Emitted as suffixMatch. |
| rangeMatch | RangeMatch | Numeric-range match. Matches when the header value parses to an integer within the given range. See RangeMatch. |
QueryParameterMatch
Defines a condition to match against HTTP query parameters.
Populates the routeMatch.queryParameters block within a GCP HttpRoute resource.
| Property | Type | Description |
|---|---|---|
| queryParameter | string | Query parameter name to test. Name of the URL query parameter whose value is evaluated by this condition. Emitted as queryParameter on the query-parameter matcher. |
| exactMatch | string | Exact-value match. Matches when the parameter value equals this string exactly. Emitted as exactMatch. |
| regexMatch | string | Regex-value match. Matches when the parameter value fully matches this regular expression. Emitted as regexMatch. |
| presentMatch | string | Presence match. When set, matches on the parameter being present regardless of its value. Emitted as presentMatch. |
ContainerResource
Single resource boundary definition.
Translates to either requests or limits for CPU or memory within a container specification.
| Property | Type | Description |
|---|---|---|
| cpu | string | CPU quantity for this boundary, in Kubernetes/Cloud Run notation (e.g. "500m", "1", "2"). |
| memory | string | Memory quantity for this boundary, in Kubernetes/Cloud Run notation (e.g. "256Mi", "1Gi"). |
ComputedAuthorizationAccessRule
Single computed authorization rule.
Part of the compiled configuration supplied to authz extension services to resolve user scopes dynamically.
| Property | Type | Description |
|---|---|---|
| identitySource | string | This value is a direct reflection of 'spec.authorization.identitySource' from a child 'HttpRoute' or 'GrpcRoute' manifest. |
| matches | list of HttpRouteRuleMatch | This list is a direct reflection of the 'spec.matches' block from a child 'HttpRoute' or 'GrpcRoute' manifest. |
| checks | list of ComputedAuthorizationAccessRuleCheck | This list is a direct reflection of the 'spec.authorization.checks' block from a child 'HttpRoute' or 'GrpcRoute' manifest. |
RangeMatch
Tests a header value against an integer scale.
Adds a numeric rangeMatch parameter to a header matching rule in the underlying network service map.
| Property | Type | Description |
|---|---|---|
| start | int64 | Range lower bound (inclusive). Smallest integer header value that matches. Emitted as rangeMatch.start on the header matcher. |
| end | int64 | Range upper bound (exclusive). Value one greater than the largest matching integer header value. Emitted as rangeMatch.end on the header matcher. |
ComputedAuthorizationAccessRuleCheck
Represents a computed access check for a route rule.
Maps an expected identity tuple (namespace, relation, object) that the AuthZ extension must validate during the request flow.
| Property | Type | Description |
|---|---|---|
| namespace | string | This value is a direct reflection of 'spec.authorization.namespace' from a child 'HttpRoute' or 'GrpcRoute' manifest. |
| relation | string | This value is a direct reflection of 'spec.authorization.relation' from a child 'HttpRoute' or 'GrpcRoute' manifest. |
| object | string | This value is a direct reflection of 'spec.authorization.object' from a child 'HttpRoute' or 'GrpcRoute' manifest. |