Static Asset Route

StaticAssetRoute

Defines the high-level intent for serving static content via the public ingress layer.

Establishes routing topologies that map predictable URL paths directly to storage buckets. Operates in conjunction with load balancing topography to facilitate low-latency, edge-optimized delivery of frontend assets and immutable media payloads.

Property	Type	Description
apiVersion	string	API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant `lowops.manifests.v1`.
kind	string	Resource kind discriminator. Identifies this document as a StaticAssetRoute so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant `StaticAssetRoute`.
metadata	`map`	Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. `name`, `project`) are read by the engine to resolve this manifest's identity and its parent ingress (`PublicIngress` or `PrivateIngress`) in the dependency graph.
spec	Spec	Desired static asset route configuration. The authoritative, user-authored specification for this StaticAssetRoute. See `Spec`.

Spec

User-defined URL-path-to-bucket mappings.

The authored intent for serving static content: which URL path prefixes are backed by which storage buckets. The engine folds these into the parent ingress's load-balancer configuration as bucket-backed URL-map paths.

Property	Type	Description
description	string	Human-readable description of this route. Optional free text describing the purpose of the route. Not consumed by the engine's provisioning logic; surfaced in generated documentation and used as context by AI assistants when reasoning about the manifest.
paths	list of PathsEntry	URL-path-to-bucket routing map. Maps a URL path prefix (the map key, e.g. `/images`) to the `Bucket` that serves content for that prefix; see `BucketRouteConfig`. Consumed during computation of the parent ingress to build load-balancer bucket-backed paths, and validated to ensure each referenced bucket exists.

PathsEntry

Property	Type	Description
key	string
value	BucketRouteConfig

BucketRouteConfig

Configures authorization rules specifically for bucket backends.

Affects the associated URL map routing and attached authz extensions when a Load Balancer path serves static assets directly from GCS.

Property	Type	Description
name	string	Backing bucket name. Name of the GCS bucket whose static assets are served directly by this Load Balancer path.
authentication	list of RouteRuleAuthenticationConfig	Rule Authentication Configuration. Defines the authentication configuration for this rule. If not specified, the rule will be unauthenticated.
authorization	list of ComputedAuthorizationAccessRuleCheck	Rule Authorization Configuration. Defines the authorization configuration for this rule. If not specified, the rule will be open to all users.

ComputedAuthorizationAccessRuleCheck

Represents a computed access check for a route rule.

Maps an expected identity tuple (namespace, relation, object) that the AuthZ extension must validate during the request flow.

Property	Type	Description
namespace	string	This value is a direct reflection of 'spec.authorization.namespace' from a child 'HttpRoute' or 'GrpcRoute' manifest.
relation	string	This value is a direct reflection of 'spec.authorization.relation' from a child 'HttpRoute' or 'GrpcRoute' manifest.
object	string	This value is a direct reflection of 'spec.authorization.object' from a child 'HttpRoute' or 'GrpcRoute' manifest.

RouteRuleAuthenticationConfig

Configures authentication exceptions or specifics for a route rule.

Translates into localized Gateway or Load Balancer configurations dictating how auth assertions are evaluated for specific matched paths.

Property	Type	Description
type	string	Authentication mode. How the route rule is authenticated: `IDENTITY_PROVIDER` restricts access to named identity providers (see `tenants`), while `INTERNAL` restricts to internal callers. Validated against the manifest's declared identity providers during route/ingress validation.
tenants	list of string	Allowed identity providers. A list of `IdentityProvider` names permitted to access this route. Only applicable when `type` is `IDENTITY_PROVIDER`; each entry is validated to reference an existing provider.