使用自訂限制條件管理 Cloud Load Balancing 資源

本頁面說明如何使用「組織政策服務」自訂限制條件，限制對下列 Google Cloud 資源執行的特定作業：

  • compute.googleapis.com/BackendBucket
  • compute.googleapis.com/BackendService
  • compute.googleapis.com/ForwardingRule
  • compute.googleapis.com/HealthCheck
  • compute.googleapis.com/NetworkEndpointGroup
  • networkservices.googleapis.com/ServiceLbPolicy
  • compute.googleapis.com/SslPolicy
  • compute.googleapis.com/TargetInstance
  • compute.googleapis.com/TargetPool
  • compute.googleapis.com/TargetTcpProxy
  • compute.googleapis.com/TargetSslProxy
  • compute.googleapis.com/TargetHttpProxy
  • compute.googleapis.com/TargetHttpsProxy
  • compute.googleapis.com/TargetGrpcProxy
  • compute.googleapis.com/UrlMap

如要進一步瞭解組織政策，請參閱「自訂組織政策」。

關於組織政策和限制

Google Cloud 組織政策服務可讓您透過程式輔助，集中控管組織的資源。組織政策管理員可以定義組織政策，也就是一組稱為「限制」的限制條件，適用於Google Cloud 資源和這些資源在Google Cloud 資源階層中的子系。您可以在組織、資料夾或專案層級，強制執行組織政策。

組織政策提供各種 Google Cloud 服務的內建代管限制。不過，如要更精細地自訂組織政策中受限的特定欄位，您也可以建立「自訂限制」，並用於組織政策。

政策繼承

根據預設，您強制執行政策的資源子系會繼承組織政策。舉例來說，如果您對資料夾強制執行政策， Google Cloud 會對該資料夾中的所有專案強制執行政策。如要進一步瞭解這項行為及變更方式，請參閱「階層評估規則」。

優點

  • 成本管理：使用自訂組織政策限制健康狀態檢查探測頻率。

  • 安全性、法規遵循和管理：您可以透過自訂機構政策強制執行政策。例如：

    • 強制使用特定健康狀態檢查通訊協定或通訊埠範圍
    • 禁止使用特定後端流量通訊協定
    • 要求後端 bucket 啟用 Cloud CDN
    • 規定轉送規則必須使用特定網路服務級別

限制

事前準備

  1. 登入 Google Cloud 帳戶。如果您是 Google Cloud新手，歡迎 建立帳戶，親自評估產品在實際工作環境中的成效。新客戶還能獲得價值 $300 美元的免費抵免額，可用於執行、測試及部署工作負載。

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  3. Verify that billing is enabled for your Google Cloud project.

  4. 安裝 Google Cloud CLI。

  5. 若您採用的是外部識別資訊提供者 (IdP)，請先使用聯合身分登入 gcloud CLI。

  6. 執行下列指令，初始化 gcloud CLI：

    gcloud init

  7. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Roles required to select or create a project

    • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
    • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

    Go to project selector

  8. Verify that billing is enabled for your Google Cloud project.

  9. 安裝 Google Cloud CLI。

  10. 若您採用的是外部識別資訊提供者 (IdP)，請先使用聯合身分登入 gcloud CLI。

  11. 執行下列指令，初始化 gcloud CLI：

    gcloud init
  12. 請確認您知道組織 ID。

必要的角色

如要取得管理自訂組織政策所需的權限，請要求管理員授予組織資源的組織政策管理員 (roles/orgpolicy.policyAdmin) IAM 角色。如要進一步瞭解如何授予角色，請參閱「管理專案、資料夾和組織的存取權」。

您或許也能透過自訂角色或其他預先定義的角色，取得必要權限。

設定自訂限制

自訂限制是在 YAML 檔案中定義，其中包含您要強制執行組織政策的服務所支援的資源、方法、條件和動作。自訂限制的條件是使用一般運算語言 (CEL) 來定義。如要進一步瞭解如何使用 CEL 在自訂限制中建構條件，請參閱「建立及管理自訂限制」的 CEL 相關章節。

控制台

如要建立自訂限制，請按照下列步驟操作：

  1. 前往 Google Cloud 控制台的「Organization policies」(組織政策) 頁面。

    前往「Organization policies」(組織政策)

  2. 在專案選擇工具中，選取要設定組織政策的專案。
  3. 按一下「自訂限制」。
  4. 在「顯示名稱」方塊中，輸入容易理解的限制名稱。這個名稱會顯示在錯誤訊息中，可用於識別和偵錯。請勿在顯示名稱中使用個人識別資訊 (PII) 或私密資料，因為錯誤訊息可能會顯示這類名稱。這個欄位最多可輸入 200 個半形字元。
  5. 在「Constraint ID」(限制 ID) 方塊中，輸入新自訂限制的 ID。自訂限制只能包含字母 (包括大寫和小寫) 或數字，例如 custom.enforceTCPHealthCheckPort1024。這個欄位最多可包含 70 個字元，不含前置字元 (custom.)，例如 organizations/123456789/customConstraints/custom。請勿在限制 ID 中輸入 PII 或機密資料，因為錯誤訊息可能會顯示上述資訊。
  6. 在「說明」方塊中，輸入使用者可理解的限制說明。違反政策時，系統會顯示這項說明做為錯誤訊息。請提供違反政策的詳細原因，以及如何解決問題。請勿在說明中輸入 PII 或機密資料，因為錯誤訊息可能會顯示上述資訊。這個欄位最多可輸入 2000 個字元。
  7. 在「Resource type」方塊中，選取包含要限制物件和欄位的 Google Cloud REST 資源名稱，例如 container.googleapis.com/NodePool。大多數資源類型最多支援 20 項自訂限制。如果您嘗試建立更多自訂限制，作業會失敗。
  8. 在「強制執行方式」下方，選取要對 REST CREATE 方法強制執行限制，還是同時對 CREATE 和 UPDATE 方法強制執行限制。如果您在違反限制的資源上，使用 UPDATE 方法強制執行限制，除非變更可解決違規問題，否則組織政策會封鎖對該資源的變更。

    9. 如要查看各項服務支援的方法，請在「 支援自訂限制的服務」中找出該服務。

  9. 如要定義條件，請按一下「編輯條件」。
    1. 在「Add condition」(新增條件) 面板中，建立參照支援服務資源的 CEL 條件，例如 resource.management.autoUpgrade == false。這個欄位最多可輸入 1000 個字元。如要進一步瞭解如何使用 CEL，請參閱「 一般運算語言」。如要進一步瞭解自訂限制中可使用的服務資源，請參閱「 自訂限制支援的服務」。
    2. 按一下 [儲存]。
  10. 在「動作」下方，選取符合條件時要允許或拒絕評估方法。

    11. 如果條件評估結果為 true，系統會禁止建立或更新資源。

    允許動作是指只有在條件評估為 true 時，才允許建立或更新資源的作業。除了條件中明確列出的情況外，其他所有情況都會遭到封鎖。

  11. 按一下「建立限制」。

    12. 在每個欄位中輸入值後，右側會顯示這個自訂限制的對等 YAML 設定。

gcloud

  1. 如要建立自訂限制，請使用下列格式建立 YAML 檔案： 
    2. name: organizations/ORGANIZATION_ID/customConstraints/CONSTRAINT_NAME
resourceTypes: RESOURCE_NAME
methodTypes:
  - CREATE
      - UPDATE     
condition: "CONDITION"
actionType: ACTION
displayName: DISPLAY_NAME
description: DESCRIPTION

    請替換下列項目：

    • ORGANIZATION_ID：您的機構 ID，例如 123456789。
    • CONSTRAINT_NAME：新自訂限制的名稱。自訂限制只能包含字母 (包括大寫和小寫) 或數字，例如 custom.enforceTCPHealthCheckPort1024。這個欄位最多可包含 70 個字元，不含前置字元 (custom.)，例如 organizations/123456789/customConstraints/custom。請勿在限制 ID 中輸入 PII 或機密資料，因為錯誤訊息可能會顯示上述資訊。
    • RESOURCE_NAME：內含要限制的物件和欄位的 Google Cloud資源完整名稱，例如：compute.googleapis.com/HealthCheck。大多數資源類型最多支援 20 項自訂限制。如果您嘗試建立更多自訂限制，作業會失敗。
    • methodTypes：強制執行限制的 REST 方法。可以是 CREATE，也可以是 CREATE 和 UPDATE。如果您在違反限制的資源上使用 UPDATE 方法強制執行限制，除非變更可解決違規問題，否則組織政策會封鎖對該資源的變更。

      • 如要查看各項服務支援的方法，請在「 支援自訂限制的服務」中找出該服務。

    • CONDITION：針對支援服務資源表示法所撰寫的 CEL 條件。這個欄位最多可輸入 1000 個字元。例如： "resource.tcpHealthCheck.port >= 1024"。

      • 如要進一步瞭解可編寫條件的資源，請參閱「支援的資源」。

    • ACTION：符合 condition 時採取的動作。可能的值為 ALLOW 和 DENY。

      • 允許動作是指如果條件評估結果為 true，系統就會允許建立或更新資源的作業。這也表示系統會封鎖條件中明確列出的情況以外的所有其他情況。

      拒絕動作表示如果條件評估結果為 true，系統會封鎖建立或更新資源的作業。

    • DISPLAY_NAME：人類可讀的限制條件名稱。這個名稱會顯示在錯誤訊息中，可用於識別和偵錯。請勿在顯示名稱中使用 PII 或機密資料，因為錯誤訊息可能會顯示這類名稱。這個欄位最多可輸入 200 個半形字元。
    • DESCRIPTION：違反政策時，會以錯誤訊息形式顯示且易於理解的限制說明。這個欄位最多可輸入 2000 個字元。
  2. 為新的自訂限制建立 YAML 檔案後，您必須加以設定，才能用於組織的組織政策。如要設定自訂限制條件，請使用 gcloud org-policies set-custom-constraint 指令：
    3. gcloud org-policies set-custom-constraint CONSTRAINT_PATH

    請將 CONSTRAINT_PATH 替換成自訂限制檔案的完整路徑。例如：/home/user/customconstraint.yaml。

    這項作業完成後，自訂限制會顯示在 Google Cloud 組織政策清單中，供組織政策使用。

  3. 如要驗證是否存在自訂限制條件，請使用 gcloud org-policies list-custom-constraints 指令：
    4. gcloud org-policies list-custom-constraints --organization=ORGANIZATION_ID

    請將 ORGANIZATION_ID 替換成組織資源的 ID。

    詳情請參閱「 查看組織政策」。

強制執行自訂組織政策

如要強制執行限制，請建立參照該限制的組織政策，然後將組織政策套用至 Google Cloud 資源。

控制台

  1. 前往 Google Cloud 控制台的「Organization policies」(組織政策) 頁面。

    前往「Organization policies」(組織政策)

  2. 在專案選擇工具中，選取要設定組織政策的專案。
  3. 在「Organization policies」(組織政策) 頁面的清單中選取限制，即可查看該限制的「Policy details」(政策詳細資料) 頁面。
  4. 如要為這項資源設定組織政策，請按一下「Manage policy」(管理政策)。
  5. 在「Edit policy」(編輯政策) 頁面，選取「Override parent's policy」(覆寫上層政策)。
  6. 按一下「Add a rule」(新增規則)。
  7. 在「強制執行」部分，選取是否要強制執行這項機構政策。
  8. 選用：如要根據標記設定組織政策的條件，請按一下「Add condition」(新增條件)。請注意，如果為組織政策新增條件式規則，您必須至少新增一項無條件規則，否則無法儲存政策。詳情請參閱「 使用標記設定組織政策範圍」。
  9. 按一下「Test changes」(測試變更)，模擬組織政策的影響。詳情請參閱「 使用 Policy Simulator 測試組織政策變更」。
  10. 如要在模擬測試模式下強制執行組織政策，請按一下「設定模擬測試政策」。詳情請參閱「 測試組織政策」。
  11. 確認試營運模式中的機構政策運作正常後，請按一下「設定政策」，設定正式政策。

gcloud

  1. 如要建立含有布林規則的組織政策，請建立參照限制的政策 YAML 檔案：
    2. name: projects/PROJECT_ID/policies/CONSTRAINT_NAME
spec:
  rules:
  - enforce: true

dryRunSpec:
  rules:
  - enforce: true

    請替換下列項目：

    • PROJECT_ID：要強制執行限制的專案。
    • CONSTRAINT_NAME：要為自訂限制定義的名稱，例如 custom.enforceTCPHealthCheckPort1024。
  2. 如要以模擬測試模式強制執行組織政策，請執行下列指令並加上 dryRunSpec 旗標：
    3. gcloud org-policies set-policy POLICY_PATH --update-mask=dryRunSpec

    請將 POLICY_PATH 替換為組織政策 YAML 檔案的完整路徑。政策最多需要 15 分鐘才會生效。

  3. 確認模擬測試模式中的機構政策能發揮預期效果後，請使用 org-policies set-policy 指令和 spec 旗標設定正式政策：
    4. gcloud org-policies set-policy POLICY_PATH --update-mask=spec

    請將 POLICY_PATH 替換為組織政策 YAML 檔案的完整路徑。政策最多需要 15 分鐘才會生效。

測試自訂組織政策

以下範例會建立自訂限制，要求 TCP 健康狀態檢查通訊埠必須為 1024 以上，避免使用已知通訊埠 (0-1023)。

建立自訂限制條件

  1. 如要定義自訂限制條件，請建立名為 constraint-tcp-health-check-ports.yaml 的檔案。

    name: organizations/ORGANIZATION_ID/customConstraints/custom.enforceTCPHealthCheckPort1024
resource_types:
– compute.googleapis.com/HealthCheck
condition: "resource.tcpHealthCheck.port >= 1024"
method_types:
– CREATE
– UPDATE
action_type: ALLOW
display_name: Only TCP health check ports >= 1024 allowed.
description: Prevent TCP health checks on well-known ports.

    請將 ORGANIZATION_ID 替換成組織 ID。

  2. 套用自訂限制條件。

    gcloud org-policies set-custom-constraint constraint-tcp-health-check-ports

建立機構政策

  1. 如要定義機構政策，請建立名為 policy-tcp-health-check-ports.yaml 的檔案。在本範例中，我們是在專案層級強制執行這項限制，但您也可以在機構或資料夾層級設定這項限制。

    name: projects/PROJECT_ID/policies/custom.enforceTCPHealthCheckPort1024
spec:
  rules:
  – enforce: true

    將 PROJECT_ID 替換為專案 ID。

  2. 強制執行機構政策。

    gcloud org-policies set-policy policy-tcp-health-check-ports

  3. 確認機構組織政策是否存在。

    gcloud org-policies list --project PROJECT_ID

    輸出結果會與下列內容相似：

    CONSTRAINT: custom.enforceTCPHealthCheckPort1024
LIST_POLICY: SET
BOOLEAN_POLICY: -
ETAG: CNHuh7kGEJiatFo=-

測試政策

  1. 在通訊埠 80 上建立 TCP 健康狀態檢查，測試限制。

    gcloud compute health-checks create tcp my-tcp-health-check \
    --project=PROJECT_ID \
    --region=us-central1 \
    --port=80 \
    --check-interval=5s \
    --timeout=5s \
    --healthy-threshold=4 \
    --unhealthy-threshold=5 \

    系統不允許這項作業，輸出內容類似如下：

    ERROR: (gcloud.compute.healthChecks.create) Could not fetch resource:
– Operation denied by custom org policies: [customConstraints/custom.enforceTCPHealthCheckPort1024]: Only TCP health check ports >= 1024 allowed.

常見用途的自訂組織政策範例

下表提供一些常見自訂限制的語法。

說明 限制語法
要求所有後端 bucket 啟用 Cloud CDN 
    name: organizations/ORGANIZATION_ID/customConstraints/custom.backendBucketEnableCdn
    resourceTypes:
    - compute.googleapis.com/BackendBucket
    methodTypes:
    - CREATE
    - UPDATE
    condition: "resource.enableCdn == true"
    actionType: ALLOW
    displayName: Require all backend buckets to have Cloud CDN enabled
    description: All backend buckets must have Cloud CDN enabled.
禁止使用 HTTP 和 TCP 做為後端服務通訊協定 
    name: organizations/ORGANIZATION_ID/customConstraints/custom.backendBucketEnableCdn
    resourceTypes:
    - compute.googleapis.com/BackendService
    methodTypes:
    - CREATE
    - UPDATE
    condition: "resource.protocol == 'HTTP' || resource.protocol == 'TCP'"
    actionType: DENY
    displayName: Disallow the use of HTTP and TCP as backend service protocols
    description: Backend services cannot configure HTTP or TCP as the backend service protocol.
要求轉送規則使用標準級 
    name: organizations/ORGANIZATION_ID/customConstraints/custom.forwardingRulesStandardTier
    resourceTypes:
    - compute.googleapis.com/ForwardingRule
    methodTypes:
    - CREATE
    - UPDATE
    condition: "resource.networkTier == 'STANDARD'"
    actionType: ALLOW
    displayName: Require forwarding rules to use Standard Tier
    description: Forwarding rules must use the Standard Network Service Tier.
要求所有健康狀態檢查通訊協定都透過通訊埠 1024 以上進行 
    name: organizations/ORGANIZATION_ID/customConstraints/custom.healthCheckPortMin1024
    resourceTypes:
    - compute.googleapis.com/HealthCheck
    methodTypes:
    - CREATE
    - UPDATE
    condition: "resource.tcpHealthCheck.port >= 1024 && resource.httpHealthCheck.port >= 1024 && resource.httpsHealthCheck.port >= 1024 && resource.sslHealthCheck.port >= 1024 && resource.sslHealthCheck.port >= 1024 &&resource.http2HealthCheck.port >= 1024 && resource.grpcHealthCheck.port >= 1024"
    actionType: ALLOW
    displayName: Require port 1024 or greater for all health checks
    description: All health check protocols must use a port of 1024 or higher, to avoid well-known ports.
禁止使用 gRPC 健康狀態檢查 
    name: organizations/ORGANIZATION_ID/customConstraints/custom.disallowGRPCHealthChecks
    resourceTypes:
    - compute.googleapis.com/HealthCheck
    methodTypes:
    - CREATE
    - UPDATE
    condition: "resource.type == 'GRPC'"
    actionType: DENY
    displayName: Disallow GRPC health checks
    description: Health checks aren't allowed to use GRPC.
避免高頻率健康狀態檢查探測要求 
    name: organizations/ORGANIZATION_ID/customConstraints/custom.minHealthCheckFrequency
    resourceTypes:
    - compute.googleapis.com/HealthCheck
    methodTypes:
    - CREATE
    - UPDATE
    condition: "resource.checkIntervalSec >= 30"
    actionType: ALLOW
    displayName: Disallow fast health check probes
    description: Prevent health checks from having a probe frequency under 30 seconds.
禁止用戶端 HTTPS 保持運作逾時值超過 1000 秒 
    name: organizations/ORGANIZATION_ID/customConstraints/custom.clientHTTPSKeepalive1000Sec
    resourceTypes:
    - compute.googleapis.com/TargetHttpsProxy
    methodTypes:
    - CREATE
    - UPDATE
    condition: "resource.httpKeepAliveTimeoutSec > 1000"
    actionType: DENY
    displayName: Disallow client HTTPS keepalive timeout greater than 1000 seconds
    description: Disallow client HTTPS keepalive timeout values greater than 1000 seconds.
要求網址對應針對 HTTP 500 狀態碼採用自訂錯誤回應政策 
    name: organizations/ORGANIZATION_ID/customConstraints/custom.urlMapCustomResponseHTTP500
    resourceTypes:
    - compute.googleapis.com/UrlMaps
    methodTypes:
    - CREATE
    - UPDATE
    condition: "resource.defaultCustomErrorResponsePolicy.errorResponseRule.exists(value, value.matchResponseCode == 500)"
    actionType: ALLOW
    displayName: Require URL maps to have a custom error response policy for HTTP 500 errors
    description: URL maps must have a custom error response policy configured for HTTP 500 errors.
要求目標執行個體的名稱開頭為「targetInstance」字串 
    name: organizations/ORGANIZATION_ID/customConstraints/custom.targetInstanceConstraint
    resourceTypes:
    - compute.googleapis.com/TargetInstance
    methodTypes:
    - CREATE
    - UPDATE
    condition: "resource.name.startsWith('targetInstance')"
    actionType: ALLOW
    displayName: Require target instances to have a name that starts with the string "targetInstance"
    description: Target instances must have resource names that start with the string "targetInstance"
要求目標集區具有 CLIENT_IP 工作階段相依性 
    name: organizations/ORGANIZATION_ID/customConstraints/custom.targetPoolConstraint
    resourceTypes:
    - compute.googleapis.com/TargetPool
    methodTypes:
    - CREATE
    - UPDATE
    condition: "resource.sessionAffinity == 'CLIENT_IP'"
    actionType: ALLOW
    displayName: Require target pools to use CLIENT_IP session affinity
    description: Target pools must use CLIENT_IP session affinity
將最低 TLS 版本限制為 1.2 
    name: organizations/ORGANIZATION_ID/customConstraints/custom.restrictLbTlsVersion
    resource_types: compute.googleapis.com/SslPolicy
    methodTypes:
    - CREATE
    - UPDATE
    condition: resource.minTlsVersion == "TLS_1_2"
    action_type: ALLOW
    display_name: Restrict Load Balancing TLS version to 1.2
    description: Only allow SSL policies to be created or updated if the minimum TLS version is 1.2 where this custom constraint is enforced.

如果符合下列條件，即可建立 SSL 資源：

  • 最低 TLS 版本設為 1.2
  • SSL 政策提供 CUSTOM 設定檔，可讓您個別選取 SSL 功能
  • SSL 政策未包含 ChaCha20-Poly1305 加密套件
 
    name: organizations/ORGANIZATION_ID/customConstraints/custom.restrictLbTlsCapabilities
    resourceTypes:
    - compute.googleapis.com/SslPolicy
    methodTypes:
    - CREATE
    - UPDATE
    condition: resource.minTlsVersion == "TLS_1_2" && resource.profile == "CUSTOM" && !resource.customFeatures.exists(feature, feature.contains("CHACHA20_POLY1305"))
    actionType: ALLOW
    displayName: Restrict Load Balancing TLS Capabilities
    description: Only allow SSL Policy resources to be created or updated if the minimum TLS version is 1.2, profile is CUSTOM, and no ChaCha20-Poly1305 cipher suite is used where this custom constraint is enforced.

Cloud Load Balancing 支援的資源

對於 Cloud Load Balancing，您可以對下列資源和欄位設定自訂限制。

資源 欄位
compute.googleapis.com/BackendBucket resource.bucketName
resource.cdnPolicy.bypassCacheOnRequestHeaders.headerName
resource.cdnPolicy.cacheKeyPolicy.includeHttpHeaders
resource.cdnPolicy.cacheKeyPolicy.queryStringWhitelist
resource.cdnPolicy.cacheMode
resource.cdnPolicy.clientTtl
resource.cdnPolicy.defaultTtl
resource.cdnPolicy.maxTtl
resource.cdnPolicy.negativeCaching
resource.cdnPolicy.negativeCachingPolicy.code
resource.cdnPolicy.negativeCachingPolicy.ttl
resource.cdnPolicy.requestCoalescing
resource.cdnPolicy.serveWhileStale
resource.cdnPolicy.signedUrlCacheMaxAgeSec
resource.compressionMode
resource.customResponseHeaders
resource.description
resource.enableCdn
resource.loadBalancingScheme
resource.name
compute.googleapis.com/BackendService resource.affinityCookieTtlSec
resource.backends.balancingMode
resource.backends.capacityScaler
resource.backends.description
resource.backends.failover
resource.backends.maxConnections
resource.backends.maxConnectionsPerEndpoint
resource.backends.maxConnectionsPerInstance
resource.backends.maxRate
resource.backends.maxRatePerEndpoint
resource.backends.maxRatePerInstance
resource.backends.maxSessions
resource.backends.maxSessionsPerEndpoint
resource.backends.maxSessionsPerInstance
resource.backends.maxUtilization
resource.backends.preference
resource.backends.trafficDuration
resource.cdnPolicy.bypassCacheOnRequestHeaders.headerName
resource.cdnPolicy.cacheKeyPolicy.includeHost
resource.cdnPolicy.cacheKeyPolicy.includeHttpHeaders
resource.cdnPolicy.cacheKeyPolicy.includeNamedCookies
resource.cdnPolicy.cacheKeyPolicy.includeProtocol
resource.cdnPolicy.cacheKeyPolicy.includeQueryString
resource.cdnPolicy.cacheKeyPolicy.queryStringBlacklist
resource.cdnPolicy.cacheKeyPolicy.queryStringWhitelist
resource.cdnPolicy.cacheMode
resource.cdnPolicy.clientTtl
resource.cdnPolicy.defaultTtl
resource.cdnPolicy.maxTtl
resource.cdnPolicy.negativeCaching
resource.cdnPolicy.negativeCachingPolicy.code
resource.cdnPolicy.negativeCachingPolicy.ttl
resource.cdnPolicy.requestCoalescing
resource.cdnPolicy.serveWhileStale
resource.cdnPolicy.signedUrlCacheMaxAgeSec
resource.circuitBreakers.maxConnections
resource.circuitBreakers.maxPendingRequests
resource.circuitBreakers.maxRequests
resource.circuitBreakers.maxRequestsPerConnection
resource.circuitBreakers.maxRetries
resource.compressionMode
resource.connectionDraining.drainingTimeoutSec
resource.connectionTrackingPolicy.connectionPersistenceOnUnhealthyBackends
resource.connectionTrackingPolicy.enableStrongAffinity
resource.connectionTrackingPolicy.idleTimeoutSec
resource.connectionTrackingPolicy.trackingMode
resource.consistentHash.httpCookie.name
resource.consistentHash.httpCookie.path
resource.consistentHash.httpCookie.ttl.nanos
resource.consistentHash.httpCookie.ttl.seconds
resource.consistentHash.minimumRingSize
resource.customRequestHeaders
resource.customResponseHeaders
resource.description
resource.enableCDN
resource.failoverPolicy.disableConnectionDrainOnFailover
resource.failoverPolicy.dropTrafficIfUnhealthy
resource.failoverPolicy.failoverRatio
resource.haPolicy.fastIPMove
resource.haPolicy.leader.backendGroup
resource.haPolicy.leader.networkEndpoint.instance
resource.iap.enabled
resource.iap.oauth2ClientId
resource.ipAddressSelectionPolicy
resource.loadBalancingScheme
resource.localityLbPolicies.customPolicy.data
resource.localityLbPolicies.customPolicy.name
resource.localityLbPolicies.policy.name
resource.logConfig.enable
resource.logConfig.optionalFields
resource.logConfig.optionalMode
resource.logConfig.sampleRate
resource.maxStreamDuration.nanos
resource.maxStreamDuration.seconds
resource.name
resource.outlierDetection.baseEjectionTime.nanos
resource.outlierDetection.baseEjectionTime.seconds
resource.outlierDetection.consecutiveGatewayFailure
resource.outlierDetection.enforcingConsecutiveErrors
resource.outlierDetection.enforcingConsecutiveGatewayFailure
resource.outlierDetection.enforcingSuccessRate
resource.outlierDetection.maxEjectionPercent
resource.outlierDetection.successRateMinimumHosts
resource.outlierDetection.successRateRequestVolume
resource.outlierDetection.successRateStdevFactor
resource.portName
resource.protocol
resource.securitySettings.awsV4Authentication.accessKeyId
resource.securitySettings.awsV4Authentication.accessKeyVersion
resource.securitySettings.subjectAltNames
resource.sessionAffinity
resource.strongSessionAffinityCookie.name
resource.strongSessionAffinityCookie.path
resource.strongSessionAffinityCookie.ttl.nanos
resource.strongSessionAffinityCookie.ttl.seconds
resource.subsetting.policy
resource.timeoutSec
compute.googleapis.com/ForwardingRule resource.allowGlobalAccess
resource.allowPscGlobalAccess
resource.allPorts
resource.description
resource.IPProtocol
resource.ipVersion
resource.isMirroringCollector
resource.loadBalancingScheme
resource.metadataFilters.filterLabels.name
resource.metadataFilters.filterLabels.value
resource.metadataFilters.filterMatchCriteria
resource.name
resource.networkTier
resource.noAutomateDnsZone
resource.portRange
resource.ports
resource.serviceDirectoryRegistrations.namespace
resource.serviceDirectoryRegistrations.service
resource.serviceDirectoryRegistrations.serviceDirectoryRegion
resource.serviceLabel
resource.sourceIpRanges
resource.target
compute.googleapis.com/HealthCheck resource.checkIntervalSec
resource.description
resource.grpcHealthCheck.grpcServiceName
resource.grpcHealthCheck.port
resource.grpcHealthCheck.portSpecification
resource.healthyThreshold
resource.http2HealthCheck.host
resource.http2HealthCheck.port
resource.http2HealthCheck.portSpecification
resource.http2HealthCheck.proxyHeader
resource.http2HealthCheck.requestPath
resource.http2HealthCheck.response
resource.httpHealthCheck.host
resource.httpHealthCheck.port
resource.httpHealthCheck.portSpecification
resource.httpHealthCheck.proxyHeader
resource.httpHealthCheck.requestPath
resource.httpHealthCheck.response
resource.httpsHealthCheck.host
resource.httpsHealthCheck.port
resource.httpsHealthCheck.portSpecification
resource.httpsHealthCheck.proxyHeader
resource.httpsHealthCheck.requestPath
resource.httpsHealthCheck.response
resource.logConfig.enable
resource.name
resource.sourceRegions
resource.sslHealthCheck.port
resource.sslHealthCheck.portSpecification
resource.sslHealthCheck.proxyHeader
resource.sslHealthCheck.request
resource.sslHealthCheck.response
resource.tcpHealthCheck.port
resource.tcpHealthCheck.portSpecification
resource.tcpHealthCheck.proxyHeader
resource.tcpHealthCheck.request
resource.tcpHealthCheck.response
resource.timeoutSec
resource.type
resource.unhealthyThreshold
compute.googleapis.com/NetworkEndpointGroup resource.annotations
resource.appEngine.service
resource.appEngine.urlMask
resource.appEngine.version
resource.cloudFunction.function
resource.cloudFunction.urlMask
resource.cloudRun.service
resource.cloudRun.tag
resource.cloudRun.urlMask
resource.defaultPort
resource.description
resource.name
resource.network
resource.networkEndpointType
resource.pscData.producerPort
resource.pscTargetService
resource.subnetwork
compute.googleapis.com/SslPolicy resource.customFeatures
resource.description
resource.minTlsVersion
resource.name
resource.profile
compute.googleapis.com/TargetGrpcProxy resource.description
resource.name
resource.validateForProxyless
compute.googleapis.com/TargetHttpProxy resource.description
resource.httpKeepAliveTimeoutSec
resource.name
resource.proxyBind
compute.googleapis.com/TargetHttpsProxy resource.description
resource.httpKeepAliveTimeoutSec
resource.name
resource.proxyBind
resource.quicOverride
resource.tlsEarlyData
compute.googleapis.com/TargetInstance resource.description
resource.name
resource.natPolicy
compute.googleapis.com/TargetPool resource.description
resource.failoverRatio
resource.name
resource.sessionAffinity
compute.googleapis.com/TargetSslProxy resource.description
resource.name
resource.proxyHeader
compute.googleapis.com/TargetTcpProxy resource.description
resource.name
resource.proxyBind
resource.proxyHeader
compute.googleapis.com/UrlMap resource.defaultCustomErrorResponsePolicy.errorResponseRules.matchResponseCodes
resource.defaultCustomErrorResponsePolicy.errorResponseRules.overrideResponseCode
resource.defaultCustomErrorResponsePolicy.errorResponseRules.path
resource.defaultRouteAction.corsPolicy.allowCredentials
resource.defaultRouteAction.corsPolicy.allowHeaders
resource.defaultRouteAction.corsPolicy.allowMethods
resource.defaultRouteAction.corsPolicy.allowOriginRegexes
resource.defaultRouteAction.corsPolicy.allowOrigins
resource.defaultRouteAction.corsPolicy.disabled
resource.defaultRouteAction.corsPolicy.exposeHeaders
resource.defaultRouteAction.corsPolicy.maxAge
resource.defaultRouteAction.faultInjectionPolicy.abort.httpStatus
resource.defaultRouteAction.faultInjectionPolicy.abort.percentage
resource.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay.nanos
resource.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay.seconds
resource.defaultRouteAction.faultInjectionPolicy.delay.percentage
resource.defaultRouteAction.maxStreamDuration.nanos
resource.defaultRouteAction.maxStreamDuration.seconds
resource.defaultRouteAction.retryPolicy.numRetries
resource.defaultRouteAction.retryPolicy.perTryTimeout.nanos
resource.defaultRouteAction.retryPolicy.perTryTimeout.seconds
resource.defaultRouteAction.retryPolicy.retryConditions
resource.defaultRouteAction.timeout.nanos
resource.defaultRouteAction.timeout.seconds
resource.defaultRouteAction.urlRewrite.hostRewrite
resource.defaultRouteAction.urlRewrite.pathPrefixRewrite
resource.defaultRouteAction.urlRewrite.pathTemplateRewrite
resource.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerName
resource.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerValue
resource.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.replace
resource.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToRemove
resource.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerName
resource.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerValue
resource.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.replace
resource.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToRemove
resource.defaultRouteAction.weightedBackendServices.weight
resource.defaultUrlRedirect.hostRedirect
resource.defaultUrlRedirect.httpsRedirect
resource.defaultUrlRedirect.pathRedirect
resource.defaultUrlRedirect.prefixRedirect
resource.defaultUrlRedirect.redirectResponseCode
resource.defaultUrlRedirect.stripQuery
resource.description
resource.headerAction.requestHeadersToAdd.headerName
resource.headerAction.requestHeadersToAdd.headerValue
resource.headerAction.requestHeadersToAdd.replace
resource.headerAction.requestHeadersToRemove
resource.headerAction.responseHeadersToAdd.headerName
resource.headerAction.responseHeadersToAdd.headerValue
resource.headerAction.responseHeadersToAdd.replace
resource.headerAction.responseHeadersToRemove
resource.hostRules.description
resource.hostRules.hosts
resource.hostRules.pathMatcher
resource.name
resource.pathMatchers.defaultCustomErrorResponsePolicy.errorResponseRules.matchResponseCodes
resource.pathMatchers.defaultCustomErrorResponsePolicy.errorResponseRules.overrideResponseCode
resource.pathMatchers.defaultCustomErrorResponsePolicy.errorResponseRules.path
resource.pathMatchers.defaultRouteAction.corsPolicy.allowCredentials
resource.pathMatchers.defaultRouteAction.corsPolicy.allowHeaders
resource.pathMatchers.defaultRouteAction.corsPolicy.allowMethods
resource.pathMatchers.defaultRouteAction.corsPolicy.allowOriginRegexes
resource.pathMatchers.defaultRouteAction.corsPolicy.allowOrigins
resource.pathMatchers.defaultRouteAction.corsPolicy.disabled
resource.pathMatchers.defaultRouteAction.corsPolicy.exposeHeaders
resource.pathMatchers.defaultRouteAction.corsPolicy.maxAge
resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.abort.httpStatus
resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.abort.percentage
resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay.nanos
resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.delay.fixedDelay.seconds
resource.pathMatchers.defaultRouteAction.faultInjectionPolicy.delay.percentage
resource.pathMatchers.defaultRouteAction.maxStreamDuration.nanos
resource.pathMatchers.defaultRouteAction.maxStreamDuration.seconds
resource.pathMatchers.defaultRouteAction.retryPolicy.numRetries
resource.pathMatchers.defaultRouteAction.retryPolicy.perTryTimeout.nanos
resource.pathMatchers.defaultRouteAction.retryPolicy.perTryTimeout.seconds
resource.pathMatchers.defaultRouteAction.retryPolicy.retryConditions
resource.pathMatchers.defaultRouteAction.timeout.nanos
resource.pathMatchers.defaultRouteAction.timeout.seconds
resource.pathMatchers.defaultRouteAction.urlRewrite.hostRewrite
resource.pathMatchers.defaultRouteAction.urlRewrite.pathPrefixRewrite
resource.pathMatchers.defaultRouteAction.urlRewrite.pathTemplateRewrite
resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerName
resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerValue
resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToAdd.replace
resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.requestHeadersToRemove
resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerName
resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerValue
resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToAdd.replace
resource.pathMatchers.defaultRouteAction.weightedBackendServices.headerAction.responseHeadersToRemove
resource.pathMatchers.defaultRouteAction.weightedBackendServices.weight
resource.pathMatchers.defaultUrlRedirect.hostRedirect
resource.pathMatchers.defaultUrlRedirect.httpsRedirect
resource.pathMatchers.defaultUrlRedirect.pathRedirect
resource.pathMatchers.defaultUrlRedirect.prefixRedirect
resource.pathMatchers.defaultUrlRedirect.redirectResponseCode
resource.pathMatchers.defaultUrlRedirect.stripQuery
resource.pathMatchers.description
resource.pathMatchers.headerAction.requestHeadersToAdd.headerName
resource.pathMatchers.headerAction.requestHeadersToAdd.headerValue
resource.pathMatchers.headerAction.requestHeadersToAdd.replace
resource.pathMatchers.headerAction.requestHeadersToRemove
resource.pathMatchers.headerAction.responseHeadersToAdd.headerName
resource.pathMatchers.headerAction.responseHeadersToAdd.headerValue
resource.pathMatchers.headerAction.responseHeadersToAdd.replace
resource.pathMatchers.headerAction.responseHeadersToRemove
resource.pathMatchers.name
resource.pathMatchers.pathRules.customErrorResponsePolicy.errorResponseRules.matchResponseCodes
resource.pathMatchers.pathRules.customErrorResponsePolicy.errorResponseRules.overrideResponseCode
resource.pathMatchers.pathRules.customErrorResponsePolicy.errorResponseRules.path
resource.pathMatchers.pathRules.paths
resource.pathMatchers.pathRules.routeAction.corsPolicy.allowCredentials
resource.pathMatchers.pathRules.routeAction.corsPolicy.allowHeaders
resource.pathMatchers.pathRules.routeAction.corsPolicy.allowMethods
resource.pathMatchers.pathRules.routeAction.corsPolicy.allowOriginRegexes
resource.pathMatchers.pathRules.routeAction.corsPolicy.allowOrigins
resource.pathMatchers.pathRules.routeAction.corsPolicy.disabled
resource.pathMatchers.pathRules.routeAction.corsPolicy.exposeHeaders
resource.pathMatchers.pathRules.routeAction.corsPolicy.maxAge
resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.abort.httpStatus
resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.abort.percentage
resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.delay.fixedDelay.nanos
resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.delay.fixedDelay.seconds
resource.pathMatchers.pathRules.routeAction.faultInjectionPolicy.delay.percentage
resource.pathMatchers.pathRules.routeAction.maxStreamDuration.nanos
resource.pathMatchers.pathRules.routeAction.maxStreamDuration.seconds
resource.pathMatchers.pathRules.routeAction.retryPolicy.numRetries
resource.pathMatchers.pathRules.routeAction.retryPolicy.perTryTimeout.nanos
resource.pathMatchers.pathRules.routeAction.retryPolicy.perTryTimeout.seconds
resource.pathMatchers.pathRules.routeAction.retryPolicy.retryConditions
resource.pathMatchers.pathRules.routeAction.timeout.nanos
resource.pathMatchers.pathRules.routeAction.timeout.seconds
resource.pathMatchers.pathRules.routeAction.urlRewrite.hostRewrite
resource.pathMatchers.pathRules.routeAction.urlRewrite.pathPrefixRewrite
resource.pathMatchers.pathRules.routeAction.urlRewrite.pathTemplateRewrite
resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerName
resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerValue
resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.replace
resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.requestHeadersToRemove
resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerName
resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerValue
resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.replace
resource.pathMatchers.pathRules.routeAction.weightedBackendServices.headerAction.responseHeadersToRemove
resource.pathMatchers.pathRules.routeAction.weightedBackendServices.weight
resource.pathMatchers.pathRules.urlRedirect.hostRedirect
resource.pathMatchers.pathRules.urlRedirect.httpsRedirect
resource.pathMatchers.pathRules.urlRedirect.pathRedirect
resource.pathMatchers.pathRules.urlRedirect.prefixRedirect
resource.pathMatchers.pathRules.urlRedirect.redirectResponseCode
resource.pathMatchers.pathRules.urlRedirect.stripQuery
resource.pathMatchers.routeRules.customErrorResponsePolicy.errorResponseRules.matchResponseCodes
resource.pathMatchers.routeRules.customErrorResponsePolicy.errorResponseRules.overrideResponseCode
resource.pathMatchers.routeRules.customErrorResponsePolicy.errorResponseRules.path
resource.pathMatchers.routeRules.description
resource.pathMatchers.routeRules.headerAction.requestHeadersToAdd.headerName
resource.pathMatchers.routeRules.headerAction.requestHeadersToAdd.headerValue
resource.pathMatchers.routeRules.headerAction.requestHeadersToAdd.replace
resource.pathMatchers.routeRules.headerAction.requestHeadersToRemove
resource.pathMatchers.routeRules.headerAction.responseHeadersToAdd.headerName
resource.pathMatchers.routeRules.headerAction.responseHeadersToAdd.headerValue
resource.pathMatchers.routeRules.headerAction.responseHeadersToAdd.replace
resource.pathMatchers.routeRules.headerAction.responseHeadersToRemove
resource.pathMatchers.routeRules.matchRules.fullPathMatch
resource.pathMatchers.routeRules.matchRules.headerMatches.exactMatch
resource.pathMatchers.routeRules.matchRules.headerMatches.headerName
resource.pathMatchers.routeRules.matchRules.headerMatches.invertMatch
resource.pathMatchers.routeRules.matchRules.headerMatches.prefixMatch
resource.pathMatchers.routeRules.matchRules.headerMatches.presentMatch
resource.pathMatchers.routeRules.matchRules.headerMatches.rangeMatch.rangeEnd
resource.pathMatchers.routeRules.matchRules.headerMatches.rangeMatch.rangeStart
resource.pathMatchers.routeRules.matchRules.headerMatches.regexMatch
resource.pathMatchers.routeRules.matchRules.headerMatches.suffixMatch
resource.pathMatchers.routeRules.matchRules.ignoreCase
resource.pathMatchers.routeRules.matchRules.metadataFilters.filterLabels.name
resource.pathMatchers.routeRules.matchRules.metadataFilters.filterLabels.value
resource.pathMatchers.routeRules.matchRules.metadataFilters.filterMatchCriteria
resource.pathMatchers.routeRules.matchRules.pathTemplateMatch
resource.pathMatchers.routeRules.matchRules.prefixMatch
resource.pathMatchers.routeRules.matchRules.queryParameterMatches.exactMatch
resource.pathMatchers.routeRules.matchRules.queryParameterMatches.name
resource.pathMatchers.routeRules.matchRules.queryParameterMatches.presentMatch
resource.pathMatchers.routeRules.matchRules.queryParameterMatches.regexMatch
resource.pathMatchers.routeRules.matchRules.regexMatch
resource.pathMatchers.routeRules.priority
resource.pathMatchers.routeRules.routeAction.corsPolicy.allowCredentials
resource.pathMatchers.routeRules.routeAction.corsPolicy.allowHeaders
resource.pathMatchers.routeRules.routeAction.corsPolicy.allowMethods
resource.pathMatchers.routeRules.routeAction.corsPolicy.allowOriginRegexes
resource.pathMatchers.routeRules.routeAction.corsPolicy.allowOrigins
resource.pathMatchers.routeRules.routeAction.corsPolicy.disabled
resource.pathMatchers.routeRules.routeAction.corsPolicy.exposeHeaders
resource.pathMatchers.routeRules.routeAction.corsPolicy.maxAge
resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.abort.httpStatus
resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.abort.percentage
resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.delay.fixedDelay.nanos
resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.delay.fixedDelay.seconds
resource.pathMatchers.routeRules.routeAction.faultInjectionPolicy.delay.percentage
resource.pathMatchers.routeRules.routeAction.maxStreamDuration.nanos
resource.pathMatchers.routeRules.routeAction.maxStreamDuration.seconds
resource.pathMatchers.routeRules.routeAction.retryPolicy.numRetries
resource.pathMatchers.routeRules.routeAction.retryPolicy.perTryTimeout.nanos
resource.pathMatchers.routeRules.routeAction.retryPolicy.perTryTimeout.seconds
resource.pathMatchers.routeRules.routeAction.retryPolicy.retryConditions
resource.pathMatchers.routeRules.routeAction.timeout.nanos
resource.pathMatchers.routeRules.routeAction.timeout.seconds
resource.pathMatchers.routeRules.routeAction.urlRewrite.hostRewrite
resource.pathMatchers.routeRules.routeAction.urlRewrite.pathPrefixRewrite
resource.pathMatchers.routeRules.routeAction.urlRewrite.pathTemplateRewrite
resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerName
resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.headerValue
resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.requestHeadersToAdd.replace
resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.requestHeadersToRemove
resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerName
resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.headerValue
resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.responseHeadersToAdd.replace
resource.pathMatchers.routeRules.routeAction.weightedBackendServices.headerAction.responseHeadersToRemove
resource.pathMatchers.routeRules.routeAction.weightedBackendServices.weight
resource.pathMatchers.routeRules.urlRedirect.hostRedirect
resource.pathMatchers.routeRules.urlRedirect.httpsRedirect
resource.pathMatchers.routeRules.urlRedirect.pathRedirect
resource.pathMatchers.routeRules.urlRedirect.prefixRedirect
resource.pathMatchers.routeRules.urlRedirect.redirectResponseCode
resource.pathMatchers.routeRules.urlRedirect.stripQuery
resource.tests.description
resource.tests.expectedOutputUrl
resource.tests.expectedRedirectResponseCode
resource.tests.headers.name
resource.tests.headers.value
resource.tests.host
resource.tests.path
networkservices.googleapis.com/ServiceLbPolicy resource.autoCapacityDrain.enable
resource.description
resource.failoverConfig.failoverHealthThreshold
resource.loadBalancingAlgorithm
resource.name

後續步驟