# Copyright 2024 Google Inc.
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

---
name: 'EdgeCacheService'
description: |
  EdgeCacheService defines the IP addresses, protocols, security policies, cache policies and routing configuration.
docs:
  warning: |
    These resources require allow-listing to use, and are not openly available to all Cloud customers. Engage with your Cloud account team to discuss how to onboard.
base_url: 'projects/{{project}}/locations/global/edgeCacheServices'
self_link: 'projects/{{project}}/locations/global/edgeCacheServices/{{name}}'
create_url: 'projects/{{project}}/locations/global/edgeCacheServices?edgeCacheServiceId={{name}}'
update_verb: 'PATCH'
update_mask: true
import_format:
  - 'projects/{{project}}/locations/global/edgeCacheServices/{{name}}'
timeouts:
  insert_minutes: 60
  update_minutes: 60
  delete_minutes: 60
autogen_async: true
async:
  actions: ['create', 'delete', 'update']
  type: 'OpAsync'
  operation:
    base_url: '{{op_id}}'
    timeouts:
      insert_minutes: 60
      update_minutes: 60
      delete_minutes: 60
  result:
    resource_inside_response: false
custom_code:
examples:
  - name: 'network_services_edge_cache_service_basic'
    primary_resource_id: 'instance'
    vars:
      bucket_name: 'my-bucket'
      origin_name: 'my-origin'
      service_name: 'my-service'
  - name: 'network_services_edge_cache_service_advanced'
    primary_resource_id: 'instance'
    vars:
      bucket_name: 'my-bucket'
      origin_name: 'my-origin'
      origin_google: 'origin-google'
      service_name: 'my-service'
  - name: 'network_services_edge_cache_service_dual_token'
    primary_resource_id: 'instance'
    vars:
      secret_name: 'secret-name'
      keyset_name: 'keyset-name'
      origin_name: 'my-origin'
      service_name: 'my-service'
parameters:
  - name: 'name'
    type: String
    description: |
      Name of the resource; provided by the client when the resource is created.
      The name must be 1-64 characters long, and match the regular expression [a-zA-Z][a-zA-Z0-9_-]* which means the first character must be a letter,
      and all following characters must be a dash, underscore, letter or digit.
    url_param_only: true
    required: true
    immutable: true
properties:
  - name: 'description'
    type: String
    description: |
      A human-readable description of the resource.
  - name: 'labels'
    type: KeyValueLabels
    description: 'Set of label tags associated with the EdgeCache resource.'
 # default from api
  - name: 'disableQuic'
    type: Boolean
    description: |
      HTTP/3 (IETF QUIC) and Google QUIC are enabled by default.
    default_from_api: true
 # default from api
  - name: 'disableHttp2'
    type: Boolean
    description: |
      Disables HTTP/2.

      HTTP/2 (h2) is enabled by default and recommended for performance. HTTP/2 improves connection re-use and reduces connection setup overhead by sending multiple streams over the same connection.

      Some legacy HTTP clients may have issues with HTTP/2 connections due to broken HTTP/2 implementations. Setting this to true will prevent HTTP/2 from being advertised and negotiated.
 # default from api
  - name: 'requireTls'
    type: Boolean
    description: |
      Require TLS (HTTPS) for all clients connecting to this service.

      Clients who connect over HTTP (port 80) will receive a HTTP 301 to the same URL over HTTPS (port 443).
      You must have at least one (1) edgeSslCertificate specified to enable this.
    default_from_api: true
  - name: 'edgeSslCertificates'
    type: Array
    description: |
      URLs to sslCertificate resources that are used to authenticate connections between users and the EdgeCacheService.

      Note that only "global" certificates with a "scope" of "EDGE_CACHE" can be attached to an EdgeCacheService.
    item_type:
      type: String
    max_size: 5
  - name: 'sslPolicy'
    type: String
    description: |
      URL of the SslPolicy resource that will be associated with the EdgeCacheService.

      If not set, the EdgeCacheService has no SSL policy configured, and will default to the "COMPATIBLE" policy.
  - name: 'ipv4Addresses'
    type: Array
    description: |
      The IPv4 addresses associated with this service. Addresses are static for the lifetime of the service.
    output: true
    item_type:
      type: String
  - name: 'ipv6Addresses'
    type: Array
    description: |
      The IPv6 addresses associated with this service. Addresses are static for the lifetime of the service.
    output: true
    item_type:
      type: String
  - name: 'routing'
    type: NestedObject
    description: |
      Defines how requests are routed, modified, cached and/or which origin content is filled from.
    required: true
    properties:
      - name: 'host_rule'
        type: Array
        description: |
          The list of hostRules to match against. These rules define which hostnames the EdgeCacheService will match against, and which route configurations apply.
        api_name: hostRules
        required: true
        item_type:
          type: NestedObject
          properties:
            - name: 'description'
              type: String
              description: |
                A human-readable description of the hostRule.
            - name: 'hosts'
              type: Array
              description: |
                The list of host patterns to match.

                Host patterns must be valid hostnames. Ports are not allowed. Wildcard hosts are supported in the suffix or prefix form. * matches any string of ([a-z0-9-.]*). It does not match the empty string.

                When multiple hosts are specified, hosts are matched in the following priority:

                  1. Exact domain names: ``www.foo.com``.
                  2. Suffix domain wildcards: ``*.foo.com`` or ``*-bar.foo.com``.
                  3. Prefix domain wildcards: ``foo.*`` or ``foo-*``.
                  4. Special wildcard ``*`` matching any domain.

                  Notes:

                    The wildcard will not match the empty string. e.g. ``*-bar.foo.com`` will match ``baz-bar.foo.com`` but not ``-bar.foo.com``. The longest wildcards match first. Only a single host in the entire service can match on ``*``. A domain must be unique across all configured hosts within a service.

                    Hosts are matched against the HTTP Host header, or for HTTP/2 and HTTP/3, the ":authority" header, from the incoming request.

                    You may specify up to 10 hosts.
              required: true
              item_type:
                type: String
              min_size: 1
              max_size: 10
            - name: 'pathMatcher'
              type: String
              description: |
                The name of the pathMatcher associated with this hostRule.
              required: true
        min_size: 1
        max_size: 50
      - name: 'path_matcher'
        type: Array
        description: |
          The list of pathMatchers referenced via name by hostRules. PathMatcher is used to match the path portion of the URL when a HostRule matches the URL's host portion.
        api_name: pathMatchers
        required: true
        item_type:
          type: NestedObject
          properties:
            - name: 'name'
              type: String
              description: |
                The name to which this PathMatcher is referred by the HostRule.
              required: true
            - name: 'description'
              type: String
              description: |
                A human-readable description of the resource.
            - name: 'route_rule'
              type: Array
              description: |
                The routeRules to match against. routeRules support advanced routing behaviour, and can match on paths, headers and query parameters, as well as status codes and HTTP methods.
              api_name: routeRules
              required: true
              item_type:
                type: NestedObject
                properties:
                  - name: 'priority'
                    type: String
                    description: |
                      The priority of this route rule, where 1 is the highest priority.

                      You cannot configure two or more routeRules with the same priority. Priority for each rule must be set to a number between 1 and 999 inclusive.

                      Priority numbers can have gaps, which enable you to add or remove rules in the future without affecting the rest of the rules. For example, 1, 2, 3, 4, 5, 9, 12, 16 is a valid series of priority numbers
                      to which you could add rules numbered from 6 to 8, 10 to 11, and 13 to 15 in the future without any impact on existing rules.
                    required: true
                  - name: 'description'
                    type: String
                    description: |
                      A human-readable description of the routeRule.
                  - name: 'match_rule'
                    type: Array
                    description: |
                      The list of criteria for matching attributes of a request to this routeRule. This list has OR semantics: the request matches this routeRule when any of the matchRules are satisfied. However predicates
                      within a given matchRule have AND semantics. All predicates within a matchRule must match for the request to match the rule.
                    api_name: matchRules
                    required: true
                    item_type:
                      type: NestedObject
                      properties:
 # default from api
                        - name: 'ignoreCase'
                          type: Boolean
                          description: |
                            Specifies that prefixMatch and fullPathMatch matches are case sensitive.
                          default_from_api: true
                        - name: 'header_match'
                          type: Array
                          description: |
                            Specifies a list of header match criteria, all of which must match corresponding headers in the request.
                          api_name: headerMatches
                          item_type:
                            type: NestedObject
                            properties:
                              - name: 'headerName'
                                type: String
                                description: |
                                  The header name to match on.
                                required: true
                              - name: 'presentMatch'
                                type: Boolean
                                description: |
                                  A header with the contents of headerName must exist. The match takes place whether or not the request's header has a value.
                              - name: 'exactMatch'
                                type: String
                                description: |
                                  The value of the header should exactly match contents of exactMatch.
                              - name: 'prefixMatch'
                                type: String
                                description: |
                                  The value of the header must start with the contents of prefixMatch.
                              - name: 'suffixMatch'
                                type: String
                                description: |
                                  The value of the header must end with the contents of suffixMatch.
 # default from api
                              - name: 'invertMatch'
                                type: Boolean
                                description: |
                                  If set to false (default), the headerMatch is considered a match if the match criteria above are met.
                                  If set to true, the headerMatch is considered a match if the match criteria above are NOT met.
                                default_from_api: true
                          min_size: 1
                          max_size: 3
                        - name: 'query_parameter_match'
                          type: Array
                          description: |
                            Specifies a list of query parameter match criteria, all of which must match corresponding query parameters in the request.
                          api_name: queryParameterMatches
                          item_type:
                            type: NestedObject
                            properties:
                              - name: 'name'
                                type: String
                                description: |
                                  The name of the query parameter to match. The query parameter must exist in the request, in the absence of which the request match fails.
                                required: true
                              - name: 'presentMatch'
                                type: Boolean
                                description: |
                                  Specifies that the queryParameterMatch matches if the request contains the query parameter, irrespective of whether the parameter has a value or not.
                              - name: 'exactMatch'
                                type: String
                                description: |
                                  The queryParameterMatch matches if the value of the parameter exactly matches the contents of exactMatch.
                          min_size: 1
                          max_size: 5
                        - name: 'prefixMatch'
                          type: String
                          description: |
                            For satisfying the matchRule condition, the request's path must begin with the specified prefixMatch. prefixMatch must begin with a /.
                        - name: 'pathTemplateMatch'
                          type: String
                          description: |
                            For satisfying the matchRule condition, the path of the request
                            must match the wildcard pattern specified in pathTemplateMatch
                            after removing any query parameters and anchor that may be part
                            of the original URL.

                            pathTemplateMatch must be between 1 and 255 characters
                            (inclusive).  The pattern specified by pathTemplateMatch may
                            have at most 5 wildcard operators and at most 5 variable
                            captures in total.
                        - name: 'fullPathMatch'
                          type: String
                          description: |
                            For satisfying the matchRule condition, the path of the request must exactly match the value specified in fullPathMatch after removing any query parameters and anchor that may be part of the original URL.
                    min_size: 1
                    max_size: 5
                          # TODO: (scottsuarez) conflicts also won't work for array path matchers yet, uncomment here once supported.
                          # conflicts:
                          #   - Routing.PathMatcher.RouteRule.prefixMatch
                  - name: 'routeMethods'
                    type: NestedObject
                    description: |
                      Allow overriding the set of methods that are allowed for this route.
                      When not set, Media CDN allows only "GET", "HEAD", and "OPTIONS".
                    properties:
                      - name: 'allowedMethods'
                        type: Array
                        description: |
                          The non-empty set of HTTP methods that are allowed for this route.

                          Any combination of "GET", "HEAD", "OPTIONS", "PUT", "POST", "DELETE", and "PATCH".
                        item_type:
                          type: String
                        min_size: 1
                        max_size: 7
                        item_validation:
                          regex: '^(?:GET|HEAD|OPTIONS|PUT|POST|DELETE|PATCH)$'
                  - name: 'headerAction'
                    type: NestedObject
                    description: |
                      The header actions, including adding & removing headers, for requests that match this route.
                    properties:
                      - name: 'request_header_to_add'
                        type: Array
                        description: |
                          Describes a header to add.
                        api_name: requestHeadersToAdd
                        item_type:
                          type: NestedObject
                          properties:
                            - name: 'headerName'
                              type: String
                              description: |
                                The name of the header to add.
                              required: true
                            - name: 'headerValue'
                              type: String
                              description: |
                                The value of the header to add.
                              required: true
 # default from api
                            - name: 'replace'
                              type: Boolean
                              description: |
                                Whether to replace all existing headers with the same name.
                              default_from_api: true
                        min_size: 1
                        max_size: 25
                      - name: 'response_header_to_add'
                        type: Array
                        description: |
                          Headers to add to the response prior to sending it back to the client.

                          Response headers are only sent to the client, and do not have an effect on the cache serving the response.
                        api_name: responseHeadersToAdd
                        item_type:
                          type: NestedObject
                          properties:
                            - name: 'headerName'
                              type: String
                              description: |
                                The name of the header to add.
                              required: true
                            - name: 'headerValue'
                              type: String
                              description: |
                                The value of the header to add.
                              required: true
                            - name: 'replace'
                              type: Boolean
                              description: |
                                Whether to replace all existing headers with the same name.
                              default_from_api: true
                        min_size: 1
                        max_size: 25
                      - name: 'request_header_to_remove'
                        type: Array
                        description: |
                          A list of header names for headers that need to be removed from the request prior to forwarding the request to the origin.
                        api_name: requestHeadersToRemove
                        item_type:
                          type: NestedObject
                          properties:
                            - name: 'headerName'
                              type: String
                              description: |
                                The name of the header to remove.
                              required: true
                        min_size: 1
                        max_size: 25
                      - name: 'response_header_to_remove'
                        type: Array
                        description: |
                          A list of header names for headers that need to be removed from the request prior to forwarding the request to the origin.
                        api_name: responseHeadersToRemove
                        item_type:
                          type: NestedObject
                          properties:
                            - name: 'headerName'
                              type: String
                              description: |
                                Headers to remove from the response prior to sending it back to the client.

                                Response headers are only sent to the client, and do not have an effect on the cache serving the response.
                              required: true
                        min_size: 1
                        max_size: 25
                  - name: 'routeAction'
                    type: NestedObject
                    description: |
                      In response to a matching path, the routeAction performs advanced routing actions like URL rewrites, header transformations, etc. prior to forwarding the request to the selected origin.
                    properties:
                      - name: 'cdnPolicy'
                        type: NestedObject
                        description: |
                          The policy to use for defining caching and signed request behaviour for requests that match this route.
                        properties:
 # default from api
                          - name: 'cacheMode'
                            type: Enum
                            description: |
                              Cache modes allow users to control the behaviour of the cache, what content it should cache automatically, whether to respect origin headers, or whether to unconditionally cache all responses.

                              For all cache modes, Cache-Control headers will be passed to the client. Use clientTtl to override what is sent to the client.
                            default_from_api: true
                            enum_values:
                              - 'CACHE_ALL_STATIC'
                              - 'USE_ORIGIN_HEADERS'
                              - 'FORCE_CACHE_ALL'
                              - 'BYPASS_CACHE'
                          - name: 'clientTtl'
                            type: String
                            description: |
                              Specifies a separate client (e.g. browser client) TTL, separate from the TTL used by the edge caches. Leaving this empty will use the same cache TTL for both the CDN and the client-facing response.

                              - The TTL must be > 0 and <= 86400s (1 day)
                              - The clientTtl cannot be larger than the defaultTtl (if set)
                              - Fractions of a second are not allowed.

                              Omit this field to use the defaultTtl, or the max-age set by the origin, as the client-facing TTL.

                              When the cache mode is set to "USE_ORIGIN_HEADERS" or "BYPASS_CACHE", you must omit this field.
                              A duration in seconds terminated by 's'. Example: "3s".
 # defalt from api
                          - name: 'defaultTtl'
                            type: String
                            description: |
                              Specifies the default TTL for cached content served by this origin for responses that do not have an existing valid TTL (max-age or s-max-age).

                              Defaults to 3600s (1 hour).

                              - The TTL must be >= 0 and <= 31,536,000 seconds (1 year)
                              - Setting a TTL of "0" means "always revalidate" (equivalent to must-revalidate)
                              - The value of defaultTTL cannot be set to a value greater than that of maxTTL.
                              - Fractions of a second are not allowed.
                              - When the cacheMode is set to FORCE_CACHE_ALL, the defaultTTL will overwrite the TTL set in all responses.

                              Note that infrequently accessed objects may be evicted from the cache before the defined TTL. Objects that expire will be revalidated with the origin.

                              When the cache mode is set to "USE_ORIGIN_HEADERS" or "BYPASS_CACHE", you must omit this field.

                              A duration in seconds terminated by 's'. Example: "3s".
                            default_from_api: true
 # defalt from api
                          - name: 'maxTtl'
                            type: String
                            description: |
                              Specifies the maximum allowed TTL for cached content served by this origin.

                              Defaults to 86400s (1 day).

                              Cache directives that attempt to set a max-age or s-maxage higher than this, or an Expires header more than maxTtl seconds in the future will be capped at the value of maxTTL, as if it were the value of an s-maxage Cache-Control directive.

                              - The TTL must be >= 0 and <= 31,536,000 seconds (1 year)
                              - Setting a TTL of "0" means "always revalidate"
                              - The value of maxTtl must be equal to or greater than defaultTtl.
                              - Fractions of a second are not allowed.

                              When the cache mode is set to "USE_ORIGIN_HEADERS", "FORCE_CACHE_ALL", or "BYPASS_CACHE", you must omit this field.

                              A duration in seconds terminated by 's'. Example: "3s".
                            default_from_api: true
                          - name: 'cacheKeyPolicy'
                            type: NestedObject
                            description: |
                              Defines the request parameters that contribute to the cache key.
                            properties:
 # default from api
                              - name: 'includeProtocol'
                                type: Boolean
                                description: |
                                  If true, http and https requests will be cached separately.
                                default_from_api: true
                              - name: 'excludeQueryString'
                                type: Boolean
                                description: |
                                  If true, exclude query string parameters from the cache key

                                  If false (the default), include the query string parameters in
                                  the cache key according to includeQueryParameters and
                                  excludeQueryParameters. If neither includeQueryParameters nor
                                  excludeQueryParameters is set, the entire query string will be
                                  included.
 # default from api
                              - name: 'excludeHost'
                                type: Boolean
                                description: |
                                  If true, requests to different hosts will be cached separately.

                                  Note: this should only be enabled if hosts share the same origin and content. Removing the host from the cache key may inadvertently result in different objects being cached than intended, depending on which route the first user matched.
                                default_from_api: true
                              - name: 'includedQueryParameters'
                                type: Array
                                description: |
                                  Names of query string parameters to include in cache keys. All other parameters will be excluded.

                                  Either specify includedQueryParameters or excludedQueryParameters, not both. '&' and '=' will be percent encoded and not treated as delimiters.
                                item_type:
                                  type: String
                                max_size: 20
                              - name: 'excludedQueryParameters'
                                type: Array
                                description: |
                                  Names of query string parameters to exclude from cache keys. All other parameters will be included.

                                  Either specify includedQueryParameters or excludedQueryParameters, not both. '&' and '=' will be percent encoded and not treated as delimiters.
                                item_type:
                                  type: String
                                max_size: 20
                              - name: 'includedHeaderNames'
                                type: Array
                                description: |
                                  Names of HTTP request headers to include in cache keys. The value of the header field will be used as part of the cache key.

                                  - Header names must be valid HTTP RFC 7230 header field values.
                                  - Header field names are case insensitive
                                  - To include the HTTP method, use ":method"

                                  Note that specifying several headers, and/or headers that have a large range of values (e.g. per-user) will dramatically impact the cache hit rate, and may result in a higher eviction rate and reduced performance.
                                item_type:
                                  type: String
                                max_size: 5
                              - name: 'includedCookieNames'
                                type: Array
                                description: |
                                  Names of Cookies to include in cache keys.  The cookie name and cookie value of each cookie named will be used as part of the cache key.

                                  Cookie names:
                                    - must be valid RFC 6265 "cookie-name" tokens
                                    - are case sensitive
                                    - cannot start with "Edge-Cache-" (case insensitive)

                                    Note that specifying several cookies, and/or cookies that have a large range of values (e.g., per-user) will dramatically impact the cache hit rate, and may result in a higher eviction rate and reduced performance.

                                    You may specify up to three cookie names.
                                item_type:
                                  type: String
                                max_size: 3
                          - name: 'negativeCaching'
                            type: Boolean
                            description: |
                              Negative caching allows per-status code TTLs to be set, in order to apply fine-grained caching for common errors or redirects. This can reduce the load on your origin and improve end-user experience by reducing response latency.

                              By default, the CDNPolicy will apply the following default TTLs to these status codes:

                              - HTTP 300 (Multiple Choice), 301, 308 (Permanent Redirects): 10m
                              - HTTP 404 (Not Found), 410 (Gone), 451 (Unavailable For Legal Reasons): 120s
                              - HTTP 405 (Method Not Found), 414 (URI Too Long), 501 (Not Implemented): 60s

                              These defaults can be overridden in negativeCachingPolicy
                          - name: 'negativeCachingPolicy'
                            type: KeyValuePairs
                            description: |
                              Sets a cache TTL for the specified HTTP status code. negativeCaching must be enabled to configure negativeCachingPolicy.

                              - Omitting the policy and leaving negativeCaching enabled will use the default TTLs for each status code, defined in negativeCaching.
                              - TTLs must be >= 0 (where 0 is "always revalidate") and <= 86400s (1 day)

                              Note that when specifying an explicit negativeCachingPolicy, you should take care to specify a cache TTL for all response codes that you wish to cache. The CDNPolicy will not apply any default negative caching when a policy exists.
 # default from api
                          - name: 'signedRequestMode'
                            type: Enum
                            description: |
                              Whether to enforce signed requests. The default value is DISABLED, which means all content is public, and does not authorize access.

                              You must also set a signedRequestKeyset to enable signed requests.

                              When set to REQUIRE_SIGNATURES, all matching requests will have their signature validated. Requests that were not signed with the corresponding private key, or that are otherwise invalid (expired, do not match the signature, IP address, or header) will be rejected with a HTTP 403 and (if enabled) logged.
                            default_from_api: true
                            enum_values:
                              - 'DISABLED'
                              - 'REQUIRE_SIGNATURES'
                              - 'REQUIRE_TOKENS'
 # resource ref, EdgeCacheKeyset?
                          - name: 'signedRequestKeyset'
                            type: String
                            description: |
                              The EdgeCacheKeyset containing the set of public keys used to validate signed requests at the edge.
                            default_from_api: true
                          - name: 'signedTokenOptions'
                            type: NestedObject
                            description: |
                              Additional options for signed tokens.

                              signedTokenOptions may only be specified when signedRequestMode is REQUIRE_TOKENS.
                            properties:
                              - name: 'tokenQueryParameter'
                                type: String
                                description: |
                                  The query parameter in which to find the token.

                                  The name must be 1-64 characters long and match the regular expression `[a-zA-Z]([a-zA-Z0-9_-])*` which means the first character must be a letter, and all following characters must be a dash, underscore, letter or digit.

                                  Defaults to `edge-cache-token`.
                              - name: 'allowedSignatureAlgorithms'
                                type: Array
                                description: |
                                  The allowed signature algorithms to use.

                                  Defaults to using only ED25519.

                                  You may specify up to 3 signature algorithms to use.
                                item_type:
                                  type: Enum
                                  description: |
                                    The signed request signature algorithm to use.
                                  enum_values:
                                    - 'ED25519'
                                    - 'HMAC_SHA_256'
                                    - 'HMAC_SHA1'
                                max_size: 3
                          - name: 'addSignatures'
                            type: NestedObject
                            description: |
                              Enable signature generation or propagation on this route.

                              This field may only be specified when signedRequestMode is set to REQUIRE_TOKENS.
                            properties:
                              - name: 'actions'
                                type: Array
                                description: |
                                  The actions to take to add signatures to responses.
                                required: true
                                item_type:
                                  type: Enum
                                  description: |
                                    The ways a signature can be manipulated in a response.
                                  enum_values:
                                    - 'GENERATE_COOKIE'
                                    - 'GENERATE_TOKEN_HLS_COOKIELESS'
                                    - 'PROPAGATE_TOKEN_HLS_COOKIELESS'
                                max_size: 1
                              - name: 'keyset'
                                type: String
                                description: |
                                  The keyset to use for signature generation.

                                  The following are both valid paths to an EdgeCacheKeyset resource:

                                    * `projects/project/locations/global/edgeCacheKeysets/yourKeyset`
                                    * `yourKeyset`

                                  This must be specified when the GENERATE_COOKIE or GENERATE_TOKEN_HLS_COOKIELESS actions are specified.  This field may not be specified otherwise.
                              - name: 'tokenTtl'
                                type: String
                                description: |
                                  The duration the token is valid starting from the moment the token is first generated.

                                  Defaults to `86400s` (1 day).

                                  The TTL must be >= 0 and <= 604,800 seconds (1 week).

                                  This field may only be specified when the GENERATE_COOKIE or GENERATE_TOKEN_HLS_COOKIELESS actions are specified.

                                  A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
                              - name: 'tokenQueryParameter'
                                type: String
                                description: |
                                  The query parameter in which to put the generated token.

                                  If not specified, defaults to `edge-cache-token`.

                                  If specified, the name must be 1-64 characters long and match the regular expression `[a-zA-Z]([a-zA-Z0-9_-])*` which means the first character must be a letter, and all following characters must be a dash, underscore, letter or digit.

                                  This field may only be set when the GENERATE_TOKEN_HLS_COOKIELESS or PROPAGATE_TOKEN_HLS_COOKIELESS actions are specified.
                              - name: 'copiedParameters'
                                type: Array
                                description: |
                                  The parameters to copy from the verified token to the generated token.

                                  Only the following parameters may be copied:

                                    * `PathGlobs`
                                    * `paths`
                                    * `acl`
                                    * `URLPrefix`
                                    * `IPRanges`
                                    * `SessionID`
                                    * `id`
                                    * `Data`
                                    * `data`
                                    * `payload`
                                    * `Headers`

                                  You may specify up to 6 parameters to copy.  A given parameter is be copied only if the parameter exists in the verified token.  Parameter names are matched exactly as specified.  The order of the parameters does not matter.  Duplicates are not allowed.

                                  This field may only be specified when the GENERATE_COOKIE or GENERATE_TOKEN_HLS_COOKIELESS actions are specified.
                                item_type:
                                  type: String
                          - name: 'signedRequestMaximumExpirationTtl'
                            type: String
                            description: |
                              Limit how far into the future the expiration time of a signed request may be.

                              When set, a signed request is rejected if its expiration time is later than now + signedRequestMaximumExpirationTtl, where now is the time at which the signed request is first handled by the CDN.

                              - The TTL must be > 0.
                              - Fractions of a second are not allowed.

                              By default, signedRequestMaximumExpirationTtl is not set and the expiration time of a signed request may be arbitrarily far into future.
                      - name: 'urlRewrite'
                        type: NestedObject
                        description: |
                          The URL rewrite configuration for requests that match this route.
                        properties:
                          - name: 'pathPrefixRewrite'
                            type: String
                            description: |
                              Prior to forwarding the request to the selected origin, the matching portion of the request's path is replaced by pathPrefixRewrite.
                          - name: 'hostRewrite'
                            type: String
                            description: |
                              Prior to forwarding the request to the selected origin, the request's host header is replaced with contents of hostRewrite.
                          - name: 'pathTemplateRewrite'
                            type: String
                            description: |
                              Prior to forwarding the request to the selected origin, if the
                              request matched a pathTemplateMatch, the matching portion of the
                              request's path is replaced re-written using the pattern specified
                              by pathTemplateRewrite.

                              pathTemplateRewrite must be between 1 and 255 characters
                              (inclusive), must start with a '/', and must only use variables
                              captured by the route's pathTemplate matchers.

                              pathTemplateRewrite may only be used when all of a route's
                              MatchRules specify pathTemplate.

                              Only one of pathPrefixRewrite and pathTemplateRewrite may be
                              specified.
                      - name: 'corsPolicy'
                        type: NestedObject
                        description: |
                          CORSPolicy defines Cross-Origin-Resource-Sharing configuration, including which CORS response headers will be set.
                        properties:
                          - name: 'maxAge'
                            type: String
                            description: |
                              Specifies how long results of a preflight request can be cached by a client in seconds. Note that many browser clients enforce a maximum TTL of 600s (10 minutes).

                              - Setting the value to -1 forces a pre-flight check for all requests (not recommended)
                              - A maximum TTL of 86400s can be set, but note that (as above) some clients may force pre-flight checks at a more regular interval.
                              - This translates to the Access-Control-Max-Age header.

                              A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
                            required: true
                          - name: 'allowCredentials'
                            type: Boolean
                            description: |
                              In response to a preflight request, setting this to true indicates that the actual request can include user credentials.

                              This translates to the Access-Control-Allow-Credentials response header.
                          - name: 'allowOrigins'
                            type: Array
                            description: |
                              Specifies the list of origins that will be allowed to do CORS requests.

                              This translates to the Access-Control-Allow-Origin response header.
                            item_type:
                              type: String
                            max_size: 25
                          - name: 'allowMethods'
                            type: Array
                            description: |
                              Specifies the content for the Access-Control-Allow-Methods response header.
                            item_type:
                              type: String
                            max_size: 5
                          - name: 'allowHeaders'
                            type: Array
                            description: |
                              Specifies the content for the Access-Control-Allow-Headers response header.
                            item_type:
                              type: String
                            max_size: 25
                          - name: 'exposeHeaders'
                            type: Array
                            description: |
                              Specifies the content for the Access-Control-Allow-Headers response header.
                            item_type:
                              type: String
                            max_size: 25
                          - name: 'disabled'
                            type: Boolean
                            description: |
                              If true, specifies the CORS policy is disabled. The default value is false, which indicates that the CORS policy is in effect.
                      - name: 'compressionMode'
                        type: Enum
                        description: |
                          Setting the compression mode to automatic enables dynamic compression for every eligible response.

                          When dynamic compression is enabled, it is recommended to also set a cache policy to maximize efficiency.
                        enum_values:
                          - 'DISABLED'
                          - 'AUTOMATIC'
                  - name: 'origin'
                    type: String
                    description: |
                      The Origin resource that requests to this route should fetch from when a matching response is not in cache. Origins can be defined as short names ("my-origin") or fully-qualified resource URLs - e.g. "networkservices.googleapis.com/projects/my-project/global/edgecacheorigins/my-origin"

                      Only one of origin or urlRedirect can be set.
                    diff_suppress_func: 'tpgresource.CompareSelfLinkOrResourceName'
                  - name: 'urlRedirect'
                    type: NestedObject
                    description: |
                      The URL redirect configuration for requests that match this route.
                    properties:
                      - name: 'hostRedirect'
                        type: String
                        description: |
                          The host that will be used in the redirect response instead of the one that was supplied in the request.
                      - name: 'pathRedirect'
                        type: String
                        description: |
                          The path that will be used in the redirect response instead of the one that was supplied in the request.

                          pathRedirect cannot be supplied together with prefixRedirect. Supply one alone or neither. If neither is supplied, the path of the original request will be used for the redirect.

                          The path value must be between 1 and 1024 characters.
                      - name: 'prefixRedirect'
                        type: String
                        description: |
                          The prefix that replaces the prefixMatch specified in the routeRule, retaining the remaining portion of the URL before redirecting the request.

                          prefixRedirect cannot be supplied together with pathRedirect. Supply one alone or neither. If neither is supplied, the path of the original request will be used for the redirect.
 # default from api
                      - name: 'redirectResponseCode'
                        type: Enum
                        description: |
                          The HTTP Status code to use for this RedirectAction.

                          The supported values are:

                          - `MOVED_PERMANENTLY_DEFAULT`, which is the default value and corresponds to 301.
                          - `FOUND`, which corresponds to 302.
                          - `SEE_OTHER` which corresponds to 303.
                          - `TEMPORARY_REDIRECT`, which corresponds to 307. in this case, the request method will be retained.
                          - `PERMANENT_REDIRECT`, which corresponds to 308. in this case, the request method will be retained.
                        default_from_api: true
                        enum_values:
                          - 'MOVED_PERMANENTLY_DEFAULT'
                          - 'FOUND'
                          - 'SEE_OTHER'
                          - 'TEMPORARY_REDIRECT'
                          - 'PERMANENT_REDIRECT'
 # default from api
                      - name: 'httpsRedirect'
                        type: Boolean
                        description: |
                          If set to true, the URL scheme in the redirected request is set to https. If set to false, the URL scheme of the redirected request will remain the same as that of the request.

                          This can only be set if there is at least one (1) edgeSslCertificate set on the service.
                        default_from_api: true
 # default from api
                      - name: 'stripQuery'
                        type: Boolean
                        description: |
                          If set to true, any accompanying query portion of the original URL is removed prior to redirecting the request. If set to false, the query portion of the original URL is retained.
                        default_from_api: true
              min_size: 1
              max_size: 200
        min_size: 1
        max_size: 50
  - name: 'logConfig'
    type: NestedObject
    description: |
      Specifies the logging options for the traffic served by this service. If logging is enabled, logs will be exported to Cloud Logging.
    properties:
 # default from api
      - name: 'enable'
        type: Boolean
        description: |
          Specifies whether to enable logging for traffic served by this service.
        required: true
        default_from_api: true
      - name: 'sampleRate'
        type: Double
        description: |
          Configures the sampling rate of requests, where 1.0 means all logged requests are reported and 0.0 means no logged requests are reported. The default value is 1.0, and the value of the field must be in [0, 1].

          This field can only be specified if logging is enabled for this service.
  - name: 'edgeSecurityPolicy'
    type: String
    description: |
      Resource URL that points at the Cloud Armor edge security policy that is applied on each request against the EdgeCacheService.
