# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.128.0
  creationTimestamp: null
  labels:
    cnrm.cloud.google.com/managed-by-kcc: "true"
    cnrm.cloud.google.com/stability-level: stable
    cnrm.cloud.google.com/system: "true"
    cnrm.cloud.google.com/tf2crd: "true"
  name: computeforwardingrules.compute.cnrm.cloud.google.com
spec:
  group: compute.cnrm.cloud.google.com
  names:
    categories:
    - gcp
    kind: ComputeForwardingRule
    listKind: ComputeForwardingRuleList
    plural: computeforwardingrules
    shortNames:
    - gcpcomputeforwardingrule
    - gcpcomputeforwardingrules
    singular: computeforwardingrule
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    - description: When 'True', the most recent reconcile of the resource succeeded
      jsonPath: .status.conditions[?(@.type=='Ready')].status
      name: Ready
      type: string
    - description: The reason for the value in 'Ready'
      jsonPath: .status.conditions[?(@.type=='Ready')].reason
      name: Status
      type: string
    - description: The last transition time for the value in 'Status'
      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
      name: Status Age
      type: date
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: ComputeForwardingRule is the Schema for the compute API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            properties:
              allPorts:
                description: |-
                  Immutable. This field can only be used:
                  * If 'IPProtocol' is one of TCP, UDP, or SCTP.
                  * By internal TCP/UDP load balancers, backend service-based network load
                  balancers, and internal and external protocol forwarding.

                  This option should be set to TRUE when the Forwarding Rule
                  IPProtocol is set to L3_DEFAULT.

                  Set this field to true to allow packets addressed to any port or packets
                  lacking destination port information (for example, UDP fragments after the
                  first fragment) to be forwarded to the backends configured with this
                  forwarding rule.

                  The 'ports', 'port_range', and
                  'allPorts' fields are mutually exclusive.
                type: boolean
              allowGlobalAccess:
                description: |-
                  This field is used along with the 'backend_service' field for
                  internal load balancing or with the 'target' field for internal
                  TargetInstance.

                  If the field is set to 'TRUE', clients can access ILB from all
                  regions.

                  Otherwise only allows access from clients in the same region as the
                  internal load balancer.
                type: boolean
              allowPscGlobalAccess:
                description: This is used in PSC consumer ForwardingRule to control
                  whether the PSC endpoint can be accessed from another region.
                type: boolean
              backendServiceRef:
                description: A ComputeBackendService to receive the matched traffic.
                  This is used only for internal load balancing.
                oneOf:
                - not:
                    required:
                    - external
                  required:
                  - name
                - not:
                    anyOf:
                    - required:
                      - name
                    - required:
                      - namespace
                  required:
                  - external
                properties:
                  external:
                    description: The ComputeBackendService selflink in the form "projects/{{project}}/global/backendServices/{{name}}"
                      or "projects/{{project}}/regions/{{region}}/backendServices/{{name}}"
                      when not managed by Config Connector.
                    type: string
                  name:
                    description: The `name` field of a `ComputeBackendService` resource.
                    type: string
                  namespace:
                    description: The `namespace` field of a `ComputeBackendService`
                      resource.
                    type: string
                type: object
              description:
                description: Immutable. An optional description of this resource.
                  Provide this property when you create the resource.
                type: string
              ipAddress:
                description: |-
                  The IP address that this forwarding rule is serving on behalf of.

                  Addresses are restricted based on the forwarding rule's load
                  balancing scheme (EXTERNAL or INTERNAL) and scope (global or
                  regional).

                  When the load balancing scheme is EXTERNAL, for global forwarding
                  rules, the address must be a global IP, and for regional forwarding
                  rules, the address must live in the same region as the forwarding
                  rule. If this field is empty, an ephemeral IPv4 address from the
                  same scope (global or regional) will be assigned. A regional
                  forwarding rule supports IPv4 only. A global forwarding rule
                  supports either IPv4 or IPv6.

                  When the load balancing scheme is INTERNAL, this can only be an RFC
                  1918 IP address belonging to the network/subnet configured for the
                  forwarding rule. By default, if this field is empty, an ephemeral
                  internal IP address will be automatically allocated from the IP
                  range of the subnet or network configured for this forwarding rule.
                properties:
                  addressRef:
                    oneOf:
                    - not:
                        required:
                        - external
                      required:
                      - name
                    - not:
                        anyOf:
                        - required:
                          - name
                        - required:
                          - namespace
                      required:
                      - external
                    properties:
                      external:
                        description: The ComputeAddress selflink in the form "projects/{{project}}/regions/{{region}}/addresses/{{name}}"
                          when not managed by Config Connector.
                        type: string
                      name:
                        description: The `name` field of a `ComputeAddress` resource.
                        type: string
                      namespace:
                        description: The `namespace` field of a `ComputeAddress` resource.
                        type: string
                    type: object
                  ip:
                    type: string
                type: object
              ipProtocol:
                description: |-
                  Immutable. The IP protocol to which this rule applies.

                  For protocol forwarding, valid
                  options are 'TCP', 'UDP', 'ESP',
                  'AH', 'SCTP', 'ICMP' and
                  'L3_DEFAULT'.

                  The valid IP protocols are different for different load balancing products
                  as described in [Load balancing
                  features](https://cloud.google.com/load-balancing/docs/features#protocols_from_the_load_balancer_to_the_backends).

                  A Forwarding Rule with protocol L3_DEFAULT can attach with target instance or
                  backend service with UNSPECIFIED protocol.
                  A forwarding rule with "L3_DEFAULT" IPProtocal cannot be attached to a backend service with TCP or UDP. Possible values: ["TCP", "UDP", "ESP", "AH", "SCTP", "ICMP", "L3_DEFAULT"].
                type: string
              ipVersion:
                description: |-
                  Immutable. The IP address version that will be used by this forwarding rule.
                  Valid options are IPV4 and IPV6.

                  If not set, the IPv4 address will be used by default. Possible values: ["IPV4", "IPV6"].
                type: string
              isMirroringCollector:
                description: |-
                  Immutable. Indicates whether or not this load balancer can be used as a collector for
                  packet mirroring. To prevent mirroring loops, instances behind this
                  load balancer will not have their traffic mirrored even if a
                  'PacketMirroring' rule applies to them.

                  This can only be set to true for load balancers that have their
                  'loadBalancingScheme' set to 'INTERNAL'.
                type: boolean
              loadBalancingScheme:
                description: |-
                  Immutable. Specifies the forwarding rule type.

                  Must set to empty for private service connect forwarding rule. For more information about forwarding rules, refer to
                  [Forwarding rule concepts](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts). Default value: "EXTERNAL" Possible values: ["EXTERNAL", "EXTERNAL_MANAGED", "INTERNAL", "INTERNAL_MANAGED", ""].
                type: string
              location:
                description: 'Location represents the geographical location of the
                  ComputeForwardingRule. Specify a region name or "global" for global
                  resources. Reference: GCP definition of regions/zones (https://cloud.google.com/compute/docs/regions-zones/)'
                type: string
              metadataFilters:
                description: |-
                  Immutable. Opaque filter criteria used by Loadbalancer to restrict routing
                  configuration to a limited set xDS compliant clients. In their xDS
                  requests to Loadbalancer, xDS clients present node metadata. If a
                  match takes place, the relevant routing configuration is made available
                  to those proxies.

                  For each metadataFilter in this list, if its filterMatchCriteria is set
                  to MATCH_ANY, at least one of the filterLabels must match the
                  corresponding label provided in the metadata. If its filterMatchCriteria
                  is set to MATCH_ALL, then all of its filterLabels must match with
                  corresponding labels in the provided metadata.

                  metadataFilters specified here can be overridden by those specified in
                  the UrlMap that this ForwardingRule references.

                  metadataFilters only applies to Loadbalancers that have their
                  loadBalancingScheme set to INTERNAL_SELF_MANAGED.
                items:
                  properties:
                    filterLabels:
                      description: |-
                        Immutable. The list of label value pairs that must match labels in the
                        provided metadata based on filterMatchCriteria

                        This list must not be empty and can have at the most 64 entries.
                      items:
                        properties:
                          name:
                            description: Immutable. Name of the metadata label. The
                              length must be between 1 and 1024 characters, inclusive.
                            type: string
                          value:
                            description: Immutable. The value that the label must
                              match. The value has a maximum length of 1024 characters.
                            type: string
                        required:
                        - name
                        - value
                        type: object
                      type: array
                    filterMatchCriteria:
                      description: |-
                        Immutable. Specifies how individual filterLabel matches within the list of
                        filterLabels contribute towards the overall metadataFilter match.

                        MATCH_ANY - At least one of the filterLabels must have a matching
                        label in the provided metadata.
                        MATCH_ALL - All filterLabels must have matching labels in the
                        provided metadata. Possible values: ["MATCH_ANY", "MATCH_ALL"].
                      type: string
                  required:
                  - filterLabels
                  - filterMatchCriteria
                  type: object
                type: array
              networkRef:
                description: This field is not used for external load balancing. For
                  internal load balancing, this field identifies the network that
                  the load balanced IP should belong to for this forwarding rule.
                  If this field is not specified, the default network will be used.
                oneOf:
                - not:
                    required:
                    - external
                  required:
                  - name
                - not:
                    anyOf:
                    - required:
                      - name
                    - required:
                      - namespace
                  required:
                  - external
                properties:
                  external:
                    description: A reference to an externally managed Compute Network
                      resource. Should be in the format `projects/{{projectID}}/global/networks/{{network}}`.
                    type: string
                  name:
                    description: The `name` field of a `ComputeNetwork` resource.
                    type: string
                  namespace:
                    description: The `namespace` field of a `ComputeNetwork` resource.
                    type: string
                type: object
              networkTier:
                description: |-
                  Immutable. This signifies the networking tier used for configuring
                  this load balancer and can only take the following values:
                  'PREMIUM', 'STANDARD'.

                  For regional ForwardingRule, the valid values are 'PREMIUM' and
                  'STANDARD'. For GlobalForwardingRule, the valid value is
                  'PREMIUM'.

                  If this field is not specified, it is assumed to be 'PREMIUM'.
                  If 'IPAddress' is specified, this value must be equal to the
                  networkTier of the Address. Possible values: ["PREMIUM", "STANDARD"].
                type: string
              noAutomateDnsZone:
                description: Immutable. This is used in PSC consumer ForwardingRule
                  to control whether it should try to auto-generate a DNS zone or
                  not. Non-PSC forwarding rules do not use this field.
                type: boolean
              portRange:
                description: |-
                  Immutable. This field can only be used:

                  * If 'IPProtocol' is one of TCP, UDP, or SCTP.
                  * By backend service-based network load balancers, target pool-based
                  network load balancers, internal proxy load balancers, external proxy load
                  balancers, Traffic Director, external protocol forwarding, and Classic VPN.
                  Some products have restrictions on what ports can be used. See
                  [port specifications](https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications)
                  for details.

                  Only packets addressed to ports in the specified range will be forwarded to
                  the backends configured with this forwarding rule.

                  The 'ports' and 'port_range' fields are mutually exclusive.

                  For external forwarding rules, two or more forwarding rules cannot use the
                  same '[IPAddress, IPProtocol]' pair, and cannot have
                  overlapping 'portRange's.

                  For internal forwarding rules within the same VPC network, two or more
                  forwarding rules cannot use the same '[IPAddress, IPProtocol]'
                  pair, and cannot have overlapping 'portRange's.
                type: string
              ports:
                description: |-
                  Immutable. This field can only be used:

                  * If 'IPProtocol' is one of TCP, UDP, or SCTP.
                  * By internal TCP/UDP load balancers, backend service-based network load
                  balancers, internal protocol forwarding and when protocol is not L3_DEFAULT.

                  You can specify a list of up to five ports by number, separated by commas.
                  The ports can be contiguous or discontiguous. Only packets addressed to
                  these ports will be forwarded to the backends configured with this
                  forwarding rule.

                  For external forwarding rules, two or more forwarding rules cannot use the
                  same '[IPAddress, IPProtocol]' pair, and cannot share any values
                  defined in 'ports'.

                  For internal forwarding rules within the same VPC network, two or more
                  forwarding rules cannot use the same '[IPAddress, IPProtocol]'
                  pair, and cannot share any values defined in 'ports'.

                  The 'ports' and 'port_range' fields are mutually exclusive.
                items:
                  type: string
                type: array
              resourceID:
                description: Immutable. Optional. The name of the resource. Used for
                  creation and acquisition. When unset, the value of `metadata.name`
                  is used as the default.
                type: string
              serviceDirectoryRegistrations:
                description: |-
                  Immutable. Service Directory resources to register this forwarding rule with.

                  Currently, only supports a single Service Directory resource.
                items:
                  properties:
                    namespace:
                      description: Immutable. Service Directory namespace to register
                        the forwarding rule under.
                      type: string
                    service:
                      description: Immutable. Service Directory service to register
                        the forwarding rule under.
                      type: string
                  type: object
                type: array
              serviceLabel:
                description: |-
                  Immutable. An optional prefix to the service name for this Forwarding Rule.
                  If specified, will be the first label of the fully qualified service
                  name.

                  The label must be 1-63 characters long, and comply with RFC1035.
                  Specifically, the label must be 1-63 characters long and match the
                  regular expression '[a-z]([-a-z0-9]*[a-z0-9])?' which means the first
                  character must be a lowercase letter, and all following characters
                  must be a dash, lowercase letter, or digit, except the last
                  character, which cannot be a dash.

                  This field is only used for INTERNAL load balancing.
                type: string
              sourceIpRanges:
                description: Immutable. If not empty, this Forwarding Rule will only
                  forward the traffic when the source IP address matches one of the
                  IP addresses or CIDR ranges set here. Note that a Forwarding Rule
                  can only have up to 64 source IP ranges, and this field can only
                  be used with a regional Forwarding Rule whose scheme is EXTERNAL.
                  Each sourceIpRange entry should be either an IP address (for example,
                  1.2.3.4) or a CIDR range (for example, 1.2.3.0/24).
                items:
                  type: string
                type: array
              subnetworkRef:
                description: |-
                  Immutable. The subnetwork that the load balanced IP should belong to for this
                  forwarding rule. This field is only used for internal load
                  balancing.

                  If the network specified is in auto subnet mode, this field is
                  optional. However, if the network is in custom subnet mode, a
                  subnetwork must be specified.
                oneOf:
                - not:
                    required:
                    - external
                  required:
                  - name
                - not:
                    anyOf:
                    - required:
                      - name
                    - required:
                      - namespace
                  required:
                  - external
                properties:
                  external:
                    description: The ComputeSubnetwork selflink of form "projects/{{project}}/regions/{{region}}/subnetworks/{{name}}",
                      when not managed by Config Connector.
                    type: string
                  name:
                    description: The `name` field of a `ComputeSubnetwork` resource.
                    type: string
                  namespace:
                    description: The `namespace` field of a `ComputeSubnetwork` resource.
                    type: string
                type: object
              target:
                description: The target resource to receive the matched traffic. The
                  forwarded traffic must be of a type appropriate to the target object.
                  For INTERNAL_SELF_MANAGED load balancing, only HTTP and HTTPS targets
                  are valid.
                properties:
                  googleAPIsBundle:
                    type: string
                  serviceAttachmentRef:
                    oneOf:
                    - not:
                        required:
                        - external
                      required:
                      - name
                    - not:
                        anyOf:
                        - required:
                          - name
                        - required:
                          - namespace
                      required:
                      - external
                    properties:
                      external:
                        description: The ComputeServiceAttachment selflink in the
                          form "projects/{{project}}/regions/{{region}}/serviceAttachments/{{name}}"
                          when not managed by Config Connector.
                        type: string
                      name:
                        description: The `name` field of a `ComputeServiceAttachment`
                          resource.
                        type: string
                      namespace:
                        description: The `namespace` field of a `ComputeServiceAttachment`
                          resource.
                        type: string
                    type: object
                  targetGRPCProxyRef:
                    oneOf:
                    - not:
                        required:
                        - external
                      required:
                      - name
                    - not:
                        anyOf:
                        - required:
                          - name
                        - required:
                          - namespace
                      required:
                      - external
                    properties:
                      external:
                        description: The ComputeTargetGrpcProxy selflink in the form
                          "projects/{{project}}/global/targetGrpcProxies/{{name}}"
                          when not managed by Config Connector.
                        type: string
                      name:
                        description: The `name` field of a `ComputeTargetGrpcProxy`
                          resource.
                        type: string
                      namespace:
                        description: The `namespace` field of a `ComputeTargetGrpcProxy`
                          resource.
                        type: string
                    type: object
                  targetHTTPProxyRef:
                    oneOf:
                    - not:
                        required:
                        - external
                      required:
                      - name
                    - not:
                        anyOf:
                        - required:
                          - name
                        - required:
                          - namespace
                      required:
                      - external
                    properties:
                      external:
                        description: The ComputeTargetHTTPProxy selflink in the form
                          "projects/{{project}}/global/targetHttpProxies/{{name}}"
                          or "projects/{{project}}/regions/{{region}}/targetHttpProxies/{{name}}"
                          when not managed by Config Connector.
                        type: string
                      name:
                        description: The `name` field of a `ComputeTargetHTTPProxy`
                          resource.
                        type: string
                      namespace:
                        description: The `namespace` field of a `ComputeTargetHTTPProxy`
                          resource.
                        type: string
                    type: object
                  targetHTTPSProxyRef:
                    oneOf:
                    - not:
                        required:
                        - external
                      required:
                      - name
                    - not:
                        anyOf:
                        - required:
                          - name
                        - required:
                          - namespace
                      required:
                      - external
                    properties:
                      external:
                        description: The ComputeTargetHTTPSProxy selflink in the form
                          "projects/{{project}}/global/targetHttpProxies/{{name}}"
                          or "projects/{{project}}/regions/{{region}}/targetHttpProxies/{{name}}"
                          when not managed by Config Connector.
                        type: string
                      name:
                        description: The `name` field of a `ComputeTargetHTTPSProxy`
                          resource.
                        type: string
                      namespace:
                        description: The `namespace` field of a `ComputeTargetHTTPSProxy`
                          resource.
                        type: string
                    type: object
                  targetSSLProxyRef:
                    oneOf:
                    - not:
                        required:
                        - external
                      required:
                      - name
                    - not:
                        anyOf:
                        - required:
                          - name
                        - required:
                          - namespace
                      required:
                      - external
                    properties:
                      external:
                        description: The ComputeTargetSSLProxy selflink in the form
                          "projects/{{project}}/global/targetSslProxies/{{name}}"
                          when not managed by Config Connector.
                        type: string
                      name:
                        description: The `name` field of a `ComputeTargetSSLProxy`
                          resource.
                        type: string
                      namespace:
                        description: The `namespace` field of a `ComputeTargetSSLProxy`
                          resource.
                        type: string
                    type: object
                  targetTCPProxyRef:
                    oneOf:
                    - not:
                        required:
                        - external
                      required:
                      - name
                    - not:
                        anyOf:
                        - required:
                          - name
                        - required:
                          - namespace
                      required:
                      - external
                    properties:
                      external:
                        description: The ComputeTargetTCPProxy selflink in the form
                          "projects/{{project}}/global/targetTcpProxies/{{name}}"
                          or "projects/{{project}}/regions/{{region}}/targetTcpProxies/{{name}}"
                          when not managed by Config Connector.
                        type: string
                      name:
                        description: The `name` field of a `ComputeTargetTCPProxy`
                          resource.
                        type: string
                      namespace:
                        description: The `namespace` field of a `ComputeTargetTCPProxy`
                          resource.
                        type: string
                    type: object
                  targetVPNGatewayRef:
                    oneOf:
                    - not:
                        required:
                        - external
                      required:
                      - name
                    - not:
                        anyOf:
                        - required:
                          - name
                        - required:
                          - namespace
                      required:
                      - external
                    properties:
                      external:
                        description: The ComputeTargetVPNGateway selflink in the form
                          "projects/{{project}}/regions/{{region}}/targetVpnGateways/{{name}}"
                          when not managed by Config Connector.
                        type: string
                      name:
                        description: The `name` field of a `ComputeTargetVPNGateway`
                          resource.
                        type: string
                      namespace:
                        description: The `namespace` field of a `ComputeTargetVPNGateway`
                          resource.
                        type: string
                    type: object
                type: object
            required:
            - location
            type: object
          status:
            properties:
              baseForwardingRule:
                description: '[Output Only] The URL for the corresponding base Forwarding
                  Rule. By base Forwarding Rule, we mean the Forwarding Rule that
                  has the same IP address, protocol, and port settings with the current
                  Forwarding Rule, but without sourceIPRanges specified. Always empty
                  if the current Forwarding Rule does not have sourceIPRanges specified.'
                type: string
              conditions:
                description: Conditions represent the latest available observations
                  of the object's current state.
                items:
                  properties:
                    lastTransitionTime:
                      description: Last time the condition transitioned from one status
                        to another.
                      type: string
                    message:
                      description: Human-readable message indicating details about
                        last transition.
                      type: string
                    reason:
                      description: Unique, one-word, CamelCase reason for the condition's
                        last transition.
                      type: string
                    status:
                      description: Status is the status of the condition. Can be True,
                        False, Unknown.
                      type: string
                    type:
                      description: Type is the type of the condition.
                      type: string
                  type: object
                type: array
              creationTimestamp:
                description: Creation timestamp in RFC3339 text format.
                type: string
              externalRef:
                description: A unique Config Connector specifier for the resource
                  in GCP.
                type: string
              labelFingerprint:
                description: The fingerprint used for optimistic locking of this resource.  Used
                  internally during updates.
                type: string
              observedGeneration:
                description: ObservedGeneration is the generation of the resource
                  that was most recently observed by the Config Connector controller.
                  If this is equal to metadata.generation, then that means that the
                  current reported status reflects the most recent desired state of
                  the resource.
                format: int64
                type: integer
              pscConnectionId:
                description: The PSC connection id of the PSC Forwarding Rule.
                type: string
              pscConnectionStatus:
                description: 'The PSC connection status of the PSC Forwarding Rule.
                  Possible values: ''STATUS_UNSPECIFIED'', ''PENDING'', ''ACCEPTED'',
                  ''REJECTED'', ''CLOSED''.'
                type: string
              selfLink:
                type: string
              serviceName:
                description: |-
                  The internal fully qualified service name for this Forwarding Rule.

                  This field is only used for INTERNAL load balancing.
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
