Tls Route

TlsRoute

Defines the high-level intent for routing encrypted TLS traffic based on protocol negotiation.

Establishes secure transit pathways by evaluating Server Name Indication (SNI) and Application-Layer Protocol Negotiation (ALPN) parameters. Enables end-to-end encryption topologies by directing traffic flows without gateway-level decryption, suitable for specialized protocols or strict zero-trust interconnects.

Property	Type	Description
apiVersion	string	API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1.
kind	string	Resource kind discriminator. Identifies this document as a TlsRoute so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant TlsRoute.
metadata	map	Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, project) are read by the engine to resolve this manifest's identity and its parent ingress (PublicIngress or PrivateIngress) in the dependency graph.
spec	Spec	Desired TLS route configuration. The authoritative, user-authored specification for this TlsRoute. See Spec.

Target

Resolved backend target of the route.

NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it) and never populated by the TlsRoute computer. Intended to identify the resolved backend (kind and name) that the route forwards to.

Property	Type	Description
kind	string	Target resource kind. Discriminator for the resolved target. Part of the not-yet-implemented target block.
name	string	Target resource name. Name of the resolved backend target manifest. Part of the not-yet-implemented target block.

Spec

User-defined TLS routing rules.

The authored intent for routing encrypted streams by TLS handshake information (SNI and ALPN) to weighted backends without decrypting at the gateway. The engine turns this into service-mesh TLS route rules on the parent ingress.

Property	Type	Description
description	string	Human-readable description of this route. Optional free text describing the purpose of the route. Not consumed by the engine's provisioning logic; surfaced in generated documentation and used as context by AI assistants when reasoning about the manifest.
rules	list of Rule	TLS routing rules. Ordered list of SNI/ALPN match-and-forward rules for encrypted traffic; see Rule. Each rule becomes a mesh TLS route rule on the parent ingress.

Rule

A single TLS routing rule.

Pairs one or more TLS handshake match conditions with a forwarding action; a connection is routed by the first rule whose match conditions it satisfies.

Property	Type	Description
matches	list of Match	Match conditions for this rule. List of handshake match blocks; the rule applies when a connection satisfies any of them. See Match.

Action

Forwarding action for matched connections.

Defines the weighted backend destinations and the connection idle timeout applied to connections matching this rule.

Property	Type	Description
destinations	list of Destination	Weighted backend destinations. Set of destinations receiving traffic for matched connections; see Destination. Applied by the executor to the generated mesh TLS route action.
idleTimeout	string	Connection idle timeout. Go-style duration string (e.g. 30s) after which an idle encrypted connection with no bytes transferred is closed; parsed and applied by the executor. Empty leaves the platform default.

Destination

A weighted backend destination.

Identifies a backend service (via a DeploymentConfig) and its share of matched traffic.

Property	Type	Description
deploymentConfig	string	Target DeploymentConfig name. Name of the DeploymentConfig manifest whose backend service receives matched connections; resolved to that service's backend by the executor.
port	int64	Backend service port. Port on the target DeploymentConfig to route to; selects the corresponding backend-service-<port> resource. When 0, the default backend service is used.
weight	int64	Relative traffic weight. Share of matched traffic sent to this destination, between 0 and 100. When unset (0), the executor defaults the weight to 100.

Match

TLS handshake match conditions.

Criteria evaluated against the TLS ClientHello — SNI hostnames and negotiated ALPN protocols — that a connection must satisfy to select this rule.

Property	Type	Description
sniHost	list of string	SNI hostnames to match. List of Server Name Indication hostnames; a connection matches when its SNI equals one of these entries. Applied by the executor to the generated mesh TLS route match.
alpn	list of string	ALPN protocols to match. List of Application-Layer Protocol Negotiation identifiers to match; restricted to http/1.1 and h2 by validation. Applied by the executor to the generated mesh TLS route match.