runr_gateway_route (Resource)

A route of a gateway: a path that leads to a project's own workload, or to one of its environments, with its authentication — public, an API key of a consumer, or a JWT (API product). The gateway must be in the region the workload runs in (a global project: one of its regions), a path is used once per gateway, and a workload has one route. A route to the project's own workload makes the gateway its endpoint; removing the route gives it its own URL back. A key or JWT route is created with its authentication in one call: it is never public, not even for a moment.

Import with <gateway id or region>/<route id or path>: terraform import runr_gateway_route.orders eu-1/orders.

Example Usage#

# /orders leads to the orders project and asks for an API key (runr_api_key); the project's own
# URL stops serving, so callers cannot get around the keys.
resource "runr_gateway_route" "orders" {
  gateway_id   = runr_gateway.eu.id
  project_id   = runr_project.orders.id
  path         = "/orders"
  methods      = ["GET", "POST"]
  auth_mode    = "key"
  gateway_only = true
}

# /partners checks a JWT of the partners' identity provider; its sub claim names the consumer.
resource "runr_gateway_route" "partners" {
  gateway_id = runr_gateway.eu.id
  project_id = runr_project.partners.id
  path       = "/partners"
  auth_mode  = "jwt"
  jwt = {
    jwks_url         = "https://id.example.com/.well-known/jwks.json"
    issuer           = "https://id.example.com/"
    audience         = "partners-api"
    require_consumer = true
  }
}

# The staging environment of the orders project, on its own path.
resource "runr_gateway_route" "orders_staging" {
  gateway_id  = runr_gateway.eu.id
  project_id  = runr_project.orders.id
  environment = "staging"
  path        = "/orders-staging"
}

Schema#

Required#

gateway_id (String) Gateway id (runr_gateway). Changing it creates a new route.
path (String) Path of the route, e.g. /orders. Changes in place (the route keeps its id, which API key scopes name).
project_id (String) Project id. Changing it creates a new route.

Optional#

auth_mode (String) public (anyone, default), key (an API key of a consumer of the gateway or the organization: runr_api_key) or jwt (a JWT the route's JWKS verifies; set jwt). Key and JWT routes are checked by the region's gateway-auth and answer 503 auth_unavailable until it is ready (the gateway's status).
environment (String) Name or id of the project environment the route leads to. Left out (or production): the project's own workload. Changing it creates a new route.
gateway_only (Boolean) Only through the gateway: the workload's own URL stops serving, so callers cannot get around the route's keys. Refused for a workload with custom domains and for a global project. Left out: kept as it is (a new route: false).
jwt (Attributes) How a jwt route verifies tokens (required with auth_mode = "jwt", refused otherwise). (see below for nested schema)
methods (Set of String) Methods the route accepts (GET, POST, PUT, PATCH, DELETE). Left out: every method.

Read-Only#

id (String) Route id.
url (String) URL of the route (on the gateway's custom domain once it is verified).

Nested Schema for `jwt`#

Required:

jwks_url (String) JWKS of the token issuer (fetched from inside the region).

Optional:

audience (String) Expected aud claim.
issuer (String) Expected iss claim.
require_consumer (Boolean) true: a valid token whose subject is no consumer gets 403. false (default): it passes without a plan and its usage is counted under the subject.
subject_claim (String) Claim that names the consumer (its jwt_subject; default sub).

Import#

Import is supported using the following syntax:

The terraform import command can be used, for example:

# <gateway id or region>/<route id or path>
terraform import runr_gateway_route.orders eu-1/orders