[Yandex Cloud documentation](../../index.md) > [Yandex Application Load Balancer](../index.md) > [Step-by-step guides](index.md) > HTTP routers > Managing routes # Managing routes [Routes](../concepts/http-router.md) are sets of conditions (predicates) that are used by the [load balancer](../concepts/application-load-balancer.md) to select the request's next forwarding direction and actions to perform with it. Possible conditions and actions depend on the [route type](../concepts/http-router.md#routes-types). ## Creating a route {#create-route} To create a route in a [virtual host](../concepts/http-router.md#virtual-host) of an HTTP router: {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) where you are going to create a virtual host route. 1. Navigate to **Application Load Balancer**. 1. In the left-hand panel, click ![route](../../_assets/console-icons/route.svg) **HTTP routers** and select the [HTTP router](../concepts/http-router.md) containing the virtual host for which you need to create a route. 1. On the page that opens, under **Virtual hosts**, click ![ellipsis](../../_assets/console-icons/ellipsis.svg) next to the virtual host and select ![pencil](../../_assets/console-icons/pencil.svg) **Edit**. [Create](manage-virtual-hosts.md#create-vh) a new virtual host if needed. In the window that opens, click **Add route** and proceed as follows in the **New route** form that appears, depending on the new route [type](../concepts/http-router.md#routes-types): {% list tabs group=alb_route_type%} - HTTP {#http} 1. In the **Name** field, specify the name of the route you are creating. Follow these naming requirements: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. 1. In the **Type** field, select `HTTP`. 1. In the **Path** field, select one of the options: * `Matches`: To route requests with the same path as the one specified in the text box on the right. For example, to route all requests, specify the `/` path. * `Starts with`: To route requests whose path begins with the prefix specified in the text box on the right. * `Regular expression`: To route requests whose path matches the [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression) specified in the text box on the right, e.g., `\/[a-z]{10}[0-9]{3}`. 1. In the **HTTP methods** field, select the HTTP [methods](https://en.wikipedia.org/wiki/HTTP#Request_methods) for which to route the requests. 1. In the **Action** field, select one of the options: `Routing`, `Forward`, or `Response`. Depending on the selected option: {% list tabs %} - Routing * In the **Backend group** field, select a [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host for which you are creating the new route. * Optionally, in the **Rewrite path or start** field, specify the path the HTTP router should redirect traffic to. If you select `Matches` in the **Path** field, the path will be completely replaced. If you select `Starts with`, only the prefix will be changed. * Optionally, in the **Host header rewrite** field, select one of these options: * `none`: The Host header in the request does not change. * `rewrite`: The Host header is replaced with the specified value. * `auto`: The Host header in the request is automatically replaced with the target [VM](../../compute/concepts/vm.md) address. * Optionally, enable **Limit on all requests** and/or **Limit on requests from one IP** and set these limits for the number of requests that will be processed for this route per unit of time. * Optionally, in the **Timeout, s** field, specify the maximum connection time. * Optionally, in the **Idle timeout, seconds** field, specify the maximum connection idle timeout (keep-alive time). * Optionally, in the **Valid values for the Upgrade header** field: * Optionally, list the protocols the backend group can switch to within a TCP connection on client's request. To add more protocols, click **Add upgrade type**. * Optionally, enable **WebSocket** if you want to use the [WebSocket](https://en.wikipedia.org/wiki/WebSocket) protocol. - Forward * In the **HTTP status code** field, select the HTTP forwarding status code: * `301 Moved Permanently` * `302 Found` * `303 See Other` * `307 Temporary Redirect` * `308 Permanent Redirect` * Optionally, enable **Rewrite path or start** and specify the modification type of the path the HTTP router should redirect traffic to: * `Entire path`: To completely replace the request path with the value set in the field on the right. * `Start`: To replace the request path prefix with the value set in the field on the right. {% note info %} If you select `Matches` in the **Path** field above, the path will be completely replaced, even with `Start` selected in the **Rewrite path or start** field. {% endnote %} * Optionally, enable **Delete query parameters** to remove all query parameters from requests. * Optionally, enable **Replace scheme** to replace the scheme found in requests with the one specified in the field on the right. If the original URI uses the `http` (`https`) scheme and port `80` (`443`), changing the scheme will delete the port. * Optionally, enable **Replace host** and specify the new host in the field on the right. * Optionally, enable **Replace port** and specify the new port in the field on the right. - Response * In the **HTTP status code** field, select the static response code to return. * In the **Response body** field, set the static response body to return. To do this, click **Select** and in the window that opens: * In the **Method** field, select: * `File`: To select a text file containing the response body. * `Text`: To enter the response text in the relevant text box. * Click **Add**. {% endlist %} - gRPC {#grpc} 1. In the **Name** field, specify the name of the route you are creating. Follow these naming requirements: * Length: between 3 and 63 characters. * It can only contain lowercase Latin letters, numbers, and hyphens. * It must start with a letter and cannot end with a hyphen. 1. In the **Type** field, select `gRPC`. 1. In the **FQMN** field, select one of the options: * `Matches`: To route requests whose FQMN matches the FQMN specified in the text box on the right. * `Starts with`: To route requests whose FQMN begins with the prefix specified in the text box on the right. For example, you can specify the first word of the service name: `/helloworld`. * `Regular expression`: To route requests whose FQMN matches the [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression) specified in the text box on the right. {% note warning %} The FQMN must start with a slash `/` and contain a part of the service name where your procedure call is redirected. {% endnote %} 1. In the **Action** field, select one of the options: `Routing` or `Response`. Depending on the selected option: {% list tabs %} - Routing * In the **Backend group** field, select a [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host for which you are creating the new route. * Optionally, in the **Host header rewrite** field, select one of these options: * `none`: The Host header in the request does not change. * `rewrite`: The Host header is replaced with the specified value. * `auto`: The Host header in the request is automatically replaced with the target [VM](../../compute/concepts/vm.md) address. * Optionally, enable **Limit on all requests** and/or **Limit on requests from one IP** and set these limits for the number of requests that will be processed for this route per unit of time. * Optionally, in the **Maximum timeout, sec.** field, specify the maximum connection time. You can specify a shorter timeout in the `grpc-timeout` request HTTP header. * Optionally, in the **Idle timeout, seconds** field, specify the connection idle timeout. - Response In the **gRPC status code** field, select the static response code for the load balancer to return: * `OK` * `INVALID_ARGUMENT` * `NOT_FOUND` * `PERMISSION_DENIED` * `UNAUTHENTICATED` * `UNIMPLEMENTED` * `INTERNAL` * `UNAVAILABLE` {% endlist %} {% endlist %} 1. If you want to change the route order, click **Sort** and in the window that opens: 1. Drag and drop routes to arrange them in desired order. 1. Click **Save**. {% note info %} You will be able to [reorder](manage-routes.md#sort-routes) your virtual host routes at any later time. {% endnote %} 1. Click **Save**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. With the Yandex Cloud CLI, you can add different [types](../concepts/http-router.md#routes-types) of routes to the virtual host: {% list tabs group=alb_route_type%} - HTTP {#http} Yandex Cloud CLI allows using three different commands to add HTTP routes to a virtual host: * `yc alb virtual-host append-http-route`: Adds a route to the end of the list of virtual host routes. * `yc alb virtual-host append-http-route`: Adds a route to the beginning of the list of virtual host routes. * `yc alb virtual-host append-http-route`: Adds a route to a specified place in the list of virtual host routes. {% list tabs %} - append-http-route 1. See the description of the CLI command for adding a route to the end of the virtual host's route list: ```bash yc alb virtual-host append-http-route --help ``` 1. View the list of HTTP routers in the default folder: ```bash yc alb http-router list ``` Result: ```text +----------------------+--------------------+-------------+-------------+ | ID | NAME | VHOST COUNT | ROUTE COUNT | +----------------------+--------------------+-------------+-------------+ | ds76j5n6a39g******** | sample-http-router | 1 | 2 | | ds76jk27sdf3******** | new-http-router | 2 | 7 | +----------------------+--------------------+-------------+-------------+ ``` 1. View the list of virtual hosts in an HTTP router by specifying the router name or ID, respectively, in the `--http-router-name` or `--http-router-id` parameter: ```bash yc alb virtual-host list \ --http-router-name \ --http-router-id ``` Result: ```text +-------------------+-------------+-------------+----------------------+ | NAME | AUTHORITIES | ROUTE COUNT | SECURITY PROFILE ID | +-------------------+-------------+-------------+----------------------+ | my-virtual-host | * | 1 | fevu5fnuk6vf******** | | test-virtual-host | example.com | 2 | fevug3d25bv6******** | +-------------------+-------------+-------------+----------------------+ ``` 1. Add the route by specifying its name and additional parameters: ```bash yc alb virtual-host append-http-route \ --http-router-name \ --virtual-host-name \ --match-http-method ,,... \ --exact-path-match \ --prefix-path-match \ --regex-path-match \ --backend-group-name \ --request-timeout s \ --request-idle-timeout s \ --rate-limit rps=,requests-per-ip \ --disable-security-profile ``` Where: * `--http-router-name`: Name of the HTTPS router you are creating the route in. Instead of the HTTP router name, you can provide its ID in the `--http-router-id` parameter. * `--virtual-host-name`: Name of the virtual host where the route is created. * `--match-http-method`: List of HTTP [methods](https://en.wikipedia.org/wiki/HTTP#Request_methods) for which requests need to be routed, e.g., `--match-http-method GET,POST,OPTIONS`. This is an optional parameter. If not specified, requests with any methods will be routed. * Parameters with path-based routing conditions: * `--exact-path-match`: Route requests with the same path as the specified one. For example, to route all requests, specify the `/` path. * `--prefix-path-match`: Route requests whose path starts with the specified prefix, e.g., `/myapp/`. * `--regex-path-match`: Route requests whose path matches the specified [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression), e.g., `\/[a-z]{10}[0-9]{3}\/`. {% note info %} The `--exact-path-match`, `--prefix-path-match`, and `--regex-path-match` parameters are mutually exclusive: you can use only one of them. {% endnote %} * `--backend-group-name`: Name of the [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host for which you are creating the new route. Instead of the backend group name, you can provide its ID in the `--backend-group-id` parameter. * `--request-timeout`: Maximum connection time in seconds for a connection on request. * `--request-idle-timeout`: Maximum connection idle time in seconds. * `--rate-limit`: Request rate limit. Available properties: * `rps` or `rpm`: Number of incoming requests per second or per minute. * `all-requests`: Limits all incoming requests. * `requests-per-ip`: Limits requests per client IP address. You can configure only one type of rate limit per route, either `all-requests` or `requests-per-ip`. This is an optional parameter; if not specified, no rate limiting is applied. * `--disable-security-profile`: Parameter that disables the use of the virtual host’s [Yandex Smart Web Security](../../smartwebsecurity/index.md) [profile](../../smartwebsecurity/concepts/profiles.md) for the route. A security profile allows you to filter incoming requests, enable [WAF](../../smartwebsecurity/concepts/waf.md), and set limits on the number of requests for protection against malicious activity. For more information, see [Security profiles](../../smartwebsecurity/concepts/profiles.md). This is an optional parameter. By default, the security profile associated with a virtual host applies to all routes you create. {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-route http: match: path: prefix_match: / route: backend_group_id: ds7dnf2s5dco******** timeout: 60s auto_host_rewrite: false - name: my-second-route http: match: http_method: - GET - POST - OPTIONS path: exact_match: / route: backend_group_id: ds7dnf2s5dco******** timeout: 2s idle_timeout: 5s rate_limit: requests_per_ip: per_second: "10" disable_security_profile: true modify_request_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "100" ``` {% endcut %} For detailed information about the `yc alb virtual-host append-http-route` command with the full list of properties, see the [CLI reference](../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/append-http-route.md). - prepend-http-route 1. See the description of the CLI command for adding a route to the beginning of the route list: ```bash yc alb virtual-host prepend-http-route --help ``` 1. View the list of HTTP routers in the default folder: ```bash yc alb http-router list ``` Result: ```text +----------------------+--------------------+-------------+-------------+ | ID | NAME | VHOST COUNT | ROUTE COUNT | +----------------------+--------------------+-------------+-------------+ | ds76j5n6a39g******** | sample-http-router | 1 | 2 | | ds76jk27sdf3******** | new-http-router | 2 | 7 | +----------------------+--------------------+-------------+-------------+ ``` 1. View the list of virtual hosts in an HTTP router by specifying the router name or ID, respectively, in the `--http-router-name` or `--http-router-id` parameter: ```bash yc alb virtual-host list \ --http-router-name \ --http-router-id ``` Result: ```text +-------------------+-------------+-------------+----------------------+ | NAME | AUTHORITIES | ROUTE COUNT | SECURITY PROFILE ID | +-------------------+-------------+-------------+----------------------+ | my-virtual-host | * | 1 | fevu5fnuk6vf******** | | test-virtual-host | example.com | 2 | fevug3d25bv6******** | +-------------------+-------------+-------------+----------------------+ ``` 1. Add the route by specifying its name and additional parameters: ```bash yc alb virtual-host prepend-http-route \ --http-router-name \ --virtual-host-name \ --match-http-method ,,... \ --exact-path-match \ --prefix-path-match \ --regex-path-match \ --backend-group-name \ --request-timeout s \ --request-idle-timeout s \ --rate-limit rps=,requests-per-ip \ --disable-security-profile ``` Where: * `--http-router-name`: Name of the HTTPS router you are creating the route in. Instead of the HTTP router name, you can provide its ID in the `--http-router-id` parameter. * `--virtual-host-name`: Name of the virtual host where the route is created. * `--match-http-method`: List of HTTP [methods](https://en.wikipedia.org/wiki/HTTP#Request_methods) for which requests need to be routed, e.g., `--match-http-method GET,POST,OPTIONS`. This is an optional parameter. If not specified, requests with any methods will be routed. * Parameters with path-based routing conditions: * `--exact-path-match`: Route requests with the same path as the specified one. For example, to route all requests, specify the `/` path. * `--prefix-path-match`: Route requests whose path starts with the specified prefix, e.g., `/myapp/`. * `--regex-path-match`: Route requests whose path matches the specified [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression), e.g., `\/[a-z]{10}[0-9]{3}\/`. {% note info %} The `--exact-path-match`, `--prefix-path-match`, and `--regex-path-match` parameters are mutually exclusive: you can use only one of them. {% endnote %} * `--backend-group-name`: Name of the [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host for which you are creating the new route. Instead of the backend group name, you can provide its ID in the `--backend-group-id` parameter. * `--request-timeout`: Maximum connection time in seconds for a connection on request. * `--request-idle-timeout`: Maximum connection idle time in seconds. * `--rate-limit`: Request rate limit. Available properties: * `rps` or `rpm`: Number of incoming requests per second or per minute. * `all-requests`: Limits all incoming requests. * `requests-per-ip`: Limits requests per client IP address. You can configure only one type of rate limit per route, either `all-requests` or `requests-per-ip`. This is an optional parameter; if not specified, no rate limiting is applied. * `--disable-security-profile`: Parameter that disables the use of the virtual host’s [Yandex Smart Web Security](../../smartwebsecurity/index.md) [profile](../../smartwebsecurity/concepts/profiles.md) for the route. A security profile allows you to filter incoming requests, enable [WAF](../../smartwebsecurity/concepts/waf.md), and set limits on the number of requests for protection against malicious activity. For more information, see [Security profiles](../../smartwebsecurity/concepts/profiles.md). This is an optional parameter. By default, the security profile associated with a virtual host applies to all routes you create. {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-second-route http: match: http_method: - GET - POST - OPTIONS path: exact_match: / route: backend_group_id: ds7dnf2s5dco******** timeout: 2s idle_timeout: 5s rate_limit: requests_per_ip: per_second: "10" disable_security_profile: true - name: my-first-route http: match: path: prefix_match: / route: backend_group_id: ds7dnf2s5dco******** timeout: 60s auto_host_rewrite: false modify_request_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "100" ``` {% endcut %} For more details about the `yc alb virtual-host prepend-http-route` command with the full list of properties, see the [CLI reference](../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/prepend-http-route.md). - insert-http-route 1. See the description of the CLI command for adding a route to a specified place in the route list: ```bash yc alb virtual-host insert-http-route --help ``` 1. View the list of HTTP routers in the default folder: ```bash yc alb http-router list ``` Result: ```text +----------------------+--------------------+-------------+-------------+ | ID | NAME | VHOST COUNT | ROUTE COUNT | +----------------------+--------------------+-------------+-------------+ | ds76j5n6a39g******** | sample-http-router | 1 | 2 | | ds76jk27sdf3******** | new-http-router | 2 | 7 | +----------------------+--------------------+-------------+-------------+ ``` 1. View the list of virtual hosts in an HTTP router by specifying the router name or ID, respectively, in the `--http-router-name` or `--http-router-id` parameter: ```bash yc alb virtual-host list \ --http-router-name \ --http-router-id ``` Result: ```text +-------------------+-------------+-------------+----------------------+ | NAME | AUTHORITIES | ROUTE COUNT | SECURITY PROFILE ID | +-------------------+-------------+-------------+----------------------+ | my-virtual-host | * | 1 | fevu5fnuk6vf******** | | test-virtual-host | example.com | 2 | fevug3d25bv6******** | +-------------------+-------------+-------------+----------------------+ ``` 1. To find out the current route order in the virtual host, run the command below specifying the virtual host name and the HTTP router name or ID in the `--http-router-name` or `--http-router-id` parameter, respectively: ```bash yc alb virtual-host get \ --http-router-name \ --http-router-id ``` {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-route http: match: path: prefix_match: / route: backend_group_id: ds7dnf2s5dco******** timeout: 60s auto_host_rewrite: false - name: my-second-route http: match: http_method: - GET - POST - OPTIONS path: exact_match: / route: backend_group_id: ds7dnf2s5dco******** timeout: 2s idle_timeout: 5s rate_limit: requests_per_ip: per_second: "10" disable_security_profile: true modify_request_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "100" ``` {% endcut %} 1. Add the route by specifying its name and additional parameters: ```bash yc alb virtual-host insert-http-route \ --http-router-name \ --virtual-host-name \ --match-http-method ,,... \ --exact-path-match \ --prefix-path-match \ --regex-path-match \ --backend-group-name \ --request-timeout s \ --request-idle-timeout s \ --rate-limit rps=,requests-per-ip \ --disable-security-profile \ --before \ --after ``` Where: * `--http-router-name`: Name of the HTTPS router you are creating the route in. Instead of the HTTP router name, you can provide its ID in the `--http-router-id` parameter. * `--virtual-host-name`: Name of the virtual host where the route is created. * `--match-http-method`: List of HTTP [methods](https://en.wikipedia.org/wiki/HTTP#Request_methods) for which requests need to be routed, e.g., `--match-http-method GET,POST,OPTIONS`. This is an optional parameter. If not specified, requests with any methods will be routed. * Parameters with path-based routing conditions: * `--exact-path-match`: Route requests with the same path as the specified one. For example, to route all requests, specify the `/` path. * `--prefix-path-match`: Route requests whose path starts with the specified prefix, e.g., `/myapp/`. * `--regex-path-match`: Route requests whose path matches the specified [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression), e.g., `\/[a-z]{10}[0-9]{3}\/`. {% note info %} The `--exact-path-match`, `--prefix-path-match`, and `--regex-path-match` parameters are mutually exclusive: you can use only one of them. {% endnote %} * `--backend-group-name`: Name of the [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host for which you are creating the new route. Instead of the backend group name, you can provide its ID in the `--backend-group-id` parameter. * `--request-timeout`: Maximum connection time in seconds for a connection on request. * `--request-idle-timeout`: Maximum connection idle time in seconds. * `--rate-limit`: Request rate limit. Available properties: * `rps` or `rpm`: Number of incoming requests per second or per minute. * `all-requests`: Limits all incoming requests. * `requests-per-ip`: Limits requests per client IP address. You can configure only one type of rate limit per route, either `all-requests` or `requests-per-ip`. This is an optional parameter; if not specified, no rate limiting is applied. * `--disable-security-profile`: Parameter that disables the use of the virtual host’s [Yandex Smart Web Security](../../smartwebsecurity/index.md) [profile](../../smartwebsecurity/concepts/profiles.md) for the route. A security profile allows you to filter incoming requests, enable [WAF](../../smartwebsecurity/concepts/waf.md), and set limits on the number of requests for protection against malicious activity. For more information, see [Security profiles](../../smartwebsecurity/concepts/profiles.md). This is an optional parameter. By default, the security profile associated with a virtual host applies to all routes you create. * `--before`: Name of the route which the new route will precede in the list of all virtual host routes. * `--after`: Name of the route which the new route will follow in the list of all virtual host routes. {% note info %} The `--before` and `--after` parameters are mutually exclusive: you can use only one of them. {% endnote %} {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-route http: match: path: prefix_match: / route: backend_group_id: ds7dnf2s5dco******** timeout: 60s auto_host_rewrite: false - name: my-third-route http: match: http_method: - PATCH - PUT path: exact_match: / route: backend_group_id: ds7dnf2s5dco******** timeout: 2s idle_timeout: 5s rate_limit: requests_per_ip: per_second: "10" disable_security_profile: true - name: my-second-route http: match: http_method: - GET - POST - OPTIONS path: exact_match: / route: backend_group_id: ds7dnf2s5dco******** timeout: 2s idle_timeout: 5s rate_limit: requests_per_ip: per_second: "10" disable_security_profile: true modify_request_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "100" ``` {% endcut %} For more details about the `yc alb virtual-host insert-http-route` command with the full list of properties, see the [CLI reference](../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/insert-http-route.md). {% endlist %} - gRPC {#grpc} Yandex Cloud CLI allows using three different commands to add gRPC routes to a virtual host: * `yc alb virtual-host append-grpc-route`: Adds a route to the end of the list of virtual host routes. * `yc alb virtual-host append-http-route`: Adds a route to the beginning of the list of virtual host routes. * `yc alb virtual-host append-http-route`: Adds a route to a specified place in the list of virtual host routes. {% list tabs %} - append-grpc-route 1. See the description of the CLI command for adding a route to the end of the virtual host's route list: ```bash yc alb virtual-host append-grpc-route --help ``` 1. View the list of HTTP routers in the default folder: ```bash yc alb http-router list ``` Result: ```text +----------------------+--------------------+-------------+-------------+ | ID | NAME | VHOST COUNT | ROUTE COUNT | +----------------------+--------------------+-------------+-------------+ | ds76j5n6a39g******** | sample-http-router | 1 | 2 | | ds76jk27sdf3******** | new-http-router | 2 | 7 | +----------------------+--------------------+-------------+-------------+ ``` 1. View the list of virtual hosts in an HTTP router by specifying the router name or ID, respectively, in the `--http-router-name` or `--http-router-id` parameter: ```bash yc alb virtual-host list \ --http-router-name \ --http-router-id ``` Result: ```text +-------------------+-------------+-------------+----------------------+ | NAME | AUTHORITIES | ROUTE COUNT | SECURITY PROFILE ID | +-------------------+-------------+-------------+----------------------+ | my-virtual-host | * | 1 | fevu5fnuk6vf******** | | test-virtual-host | example.com | 2 | fevug3d25bv6******** | +-------------------+-------------+-------------+----------------------+ ``` 1. Add the route by specifying its name and additional parameters: ```bash yc alb virtual-host append-grpc-route \ --http-router-name \ --virtual-host-name \ --exact-fqmn-match \ --prefix-fqmn-match \ --regex-fqmn-match \ --backend-group-name \ --request-max-timeout s \ --request-idle-timeout s \ --rate-limit rps=,requests-per-ip \ --disable-security-profile ``` Where: * `--http-router-name`: Name of the HTTPS router you are creating the route in. Instead of the HTTP router name, you can provide its ID in the `--http-router-id` parameter. * `--virtual-host-name`: Name of the virtual host you are creating the route in. * FQMN-based routing condition parameters: * `--exact-fqmn-match`: Route requests with the same FQMN as the specified one. * `--prefix-fqmn-match`: Route requests whose FQMN starts with the specified prefix. For example, you can specify the first word of the service name: `/helloworld`. * `--regex-fqmn-match`: Route requests whose FQMN matches the specified [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression). For example: `\/[a-z]{10}[0-9]{3}`. {% note warning %} The FQMN must start with a slash `/` and contain a part of the service name where your procedure call is redirected. {% endnote %} {% note info %} The `--exact-fqmn-match`, `--prefix-fqmn-match`, and `--regex-fqmn-match` parameters are mutually exclusive: you can use only one of them. {% endnote %} * `--backend-group-name`: Name of the [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host for which you are creating the new route. Instead of the backend group name, you can provide its ID in the `--backend-group-id` parameter. * `--request-max-timeout`: Maximum connection time. You can specify a shorter timeout in the `grpc-timeout` request HTTP header. * `--request-idle-timeout`: Maximum connection idle time in seconds. * `--rate-limit`: Request rate limit. Available properties: * `rps` or `rpm`: Number of incoming requests per second or per minute. * `all-requests`: Limits all incoming requests. * `requests-per-ip`: Limits requests per client IP address. You can configure only one type of rate limit per route, either `all-requests` or `requests-per-ip`. This is an optional parameter; if not specified, no rate limiting is applied. * `--disable-security-profile`: Parameter that disables the use of the virtual host’s [Yandex Smart Web Security](../../smartwebsecurity/index.md) [profile](../../smartwebsecurity/concepts/profiles.md) for the route. A security profile allows you to filter incoming requests, enable [WAF](../../smartwebsecurity/concepts/waf.md), and set limits on the number of requests for protection against malicious activity. For more information, see [Security profiles](../../smartwebsecurity/concepts/profiles.md). This is an optional parameter. By default, the security profile associated with a virtual host applies to all routes you create. {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-route grpc: match: fqmn: prefix_match: / route: backend_group_id: ds7dq9nsrgpc******** max_timeout: 60s idle_timeout: 5s auto_host_rewrite: false - name: my-second-route grpc: match: fqmn: prefix_match: helloworld/ route: backend_group_id: ds7dq9nsrgpc******** max_timeout: 10s idle_timeout: 5s rate_limit: requests_per_ip: per_second: "4" disable_security_profile: true modify_request_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "100" ``` {% endcut %} For detailed information about the `yc alb virtual-host append-grpc-route` command with the full list of properties, see the [CLI reference](../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/append-grpc-route.md). - prepend-grpc-route 1. See the description of the CLI command for adding a route to the beginning of the route list: ```bash yc alb virtual-host prepend-grpc-route --help ``` 1. View the list of HTTP routers in the default folder: ```bash yc alb http-router list ``` Result: ```text +----------------------+--------------------+-------------+-------------+ | ID | NAME | VHOST COUNT | ROUTE COUNT | +----------------------+--------------------+-------------+-------------+ | ds76j5n6a39g******** | sample-http-router | 1 | 2 | | ds76jk27sdf3******** | new-http-router | 2 | 7 | +----------------------+--------------------+-------------+-------------+ ``` 1. View the list of virtual hosts in an HTTP router by specifying the router name or ID, respectively, in the `--http-router-name` or `--http-router-id` parameter: ```bash yc alb virtual-host list \ --http-router-name \ --http-router-id ``` Result: ```text +-------------------+-------------+-------------+----------------------+ | NAME | AUTHORITIES | ROUTE COUNT | SECURITY PROFILE ID | +-------------------+-------------+-------------+----------------------+ | my-virtual-host | * | 1 | fevu5fnuk6vf******** | | test-virtual-host | example.com | 2 | fevug3d25bv6******** | +-------------------+-------------+-------------+----------------------+ ``` 1. Add the route by specifying its name and additional parameters: ```bash yc alb virtual-host prepend-grpc-route \ --http-router-name \ --virtual-host-name \ --exact-fqmn-match \ --prefix-fqmn-match \ --regex-fqmn-match \ --backend-group-name \ --request-max-timeout s \ --request-idle-timeout s \ --rate-limit rps=,requests-per-ip \ --disable-security-profile ``` Where: * `--http-router-name`: Name of the HTTPS router you are creating the route in. Instead of the HTTP router name, you can provide its ID in the `--http-router-id` parameter. * `--virtual-host-name`: Name of the virtual host you are creating the route in. * FQMN-based routing condition parameters: * `--exact-fqmn-match`: Route requests with the same FQMN as the specified one. * `--prefix-fqmn-match`: Route requests whose FQMN starts with the specified prefix. For example, you can specify the first word of the service name: `/helloworld`. * `--regex-fqmn-match`: Route requests whose FQMN matches the specified [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression). For example: `\/[a-z]{10}[0-9]{3}`. {% note warning %} The FQMN must start with a slash `/` and contain a part of the service name where your procedure call is redirected. {% endnote %} {% note info %} The `--exact-fqmn-match`, `--prefix-fqmn-match`, and `--regex-fqmn-match` parameters are mutually exclusive: you can use only one of them. {% endnote %} * `--backend-group-name`: Name of the [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host for which you are creating the new route. Instead of the backend group name, you can provide its ID in the `--backend-group-id` parameter. * `--request-max-timeout`: Maximum connection time. You can specify a shorter timeout in the `grpc-timeout` request HTTP header. * `--request-idle-timeout`: Maximum connection idle time in seconds. * `--rate-limit`: Request rate limit. Available properties: * `rps` or `rpm`: Number of incoming requests per second or per minute. * `all-requests`: Limits all incoming requests. * `requests-per-ip`: Limits requests per client IP address. You can configure only one type of rate limit per route, either `all-requests` or `requests-per-ip`. This is an optional parameter; if not specified, no rate limiting is applied. * `--disable-security-profile`: Parameter that disables the use of the virtual host’s [Yandex Smart Web Security](../../smartwebsecurity/index.md) [profile](../../smartwebsecurity/concepts/profiles.md) for the route. A security profile allows you to filter incoming requests, enable [WAF](../../smartwebsecurity/concepts/waf.md), and set limits on the number of requests for protection against malicious activity. For more information, see [Security profiles](../../smartwebsecurity/concepts/profiles.md). This is an optional parameter. By default, the security profile associated with a virtual host applies to all routes you create. {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-second-route grpc: match: fqmn: prefix_match: helloworld/ route: backend_group_id: ds7dq9nsrgpc******** max_timeout: 10s idle_timeout: 5s rate_limit: requests_per_ip: per_second: "4" disable_security_profile: true - name: my-first-route grpc: match: fqmn: prefix_match: / route: backend_group_id: ds7dq9nsrgpc******** max_timeout: 60s idle_timeout: 5s auto_host_rewrite: false modify_request_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "100" ``` {% endcut %} For detailed information about the `yc alb virtual-host prepend-grpc-route` command with the full list of properties, see the [CLI reference](../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/prepend-grpc-route.md). - insert-grpc-route 1. See the description of the CLI command for adding a route to a specified place in the route list: ```bash yc alb virtual-host insert-grpc-route --help ``` 1. View the list of HTTP routers in the default folder: ```bash yc alb http-router list ``` Result: ```text +----------------------+--------------------+-------------+-------------+ | ID | NAME | VHOST COUNT | ROUTE COUNT | +----------------------+--------------------+-------------+-------------+ | ds76j5n6a39g******** | sample-http-router | 1 | 2 | | ds76jk27sdf3******** | new-http-router | 2 | 7 | +----------------------+--------------------+-------------+-------------+ ``` 1. View the list of virtual hosts in an HTTP router by specifying the router name or ID, respectively, in the `--http-router-name` or `--http-router-id` parameter: ```bash yc alb virtual-host list \ --http-router-name \ --http-router-id ``` Result: ```text +-------------------+-------------+-------------+----------------------+ | NAME | AUTHORITIES | ROUTE COUNT | SECURITY PROFILE ID | +-------------------+-------------+-------------+----------------------+ | my-virtual-host | * | 1 | fevu5fnuk6vf******** | | test-virtual-host | example.com | 2 | fevug3d25bv6******** | +-------------------+-------------+-------------+----------------------+ ``` 1. To find out the current route order in the virtual host, run the command below specifying the virtual host name and the HTTP router name or ID in the `--http-router-name` or `--http-router-id` parameter, respectively: ```bash yc alb virtual-host get \ --http-router-name \ --http-router-id ``` {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-route grpc: match: fqmn: prefix_match: / route: backend_group_id: ds7dq9nsrgpc******** max_timeout: 60s idle_timeout: 5s auto_host_rewrite: false - name: my-second-route grpc: match: fqmn: prefix_match: helloworld/ route: backend_group_id: ds7dq9nsrgpc******** max_timeout: 10s idle_timeout: 5s rate_limit: requests_per_ip: per_second: "4" disable_security_profile: true modify_request_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "100" ``` {% endcut %} 1. Add the route by specifying its name and additional parameters: ```bash yc alb virtual-host insert-grpc-route \ --http-router-name \ --virtual-host-name \ --exact-fqmn-match \ --prefix-fqmn-match \ --regex-fqmn-match \ --backend-group-name \ --request-max-timeout s \ --request-idle-timeout s \ --rate-limit rps=,requests-per-ip \ --disable-security-profile \ --before \ --after ``` Where: * `--http-router-name`: Name of the HTTPS router you are creating the route in. Instead of the HTTP router name, you can provide its ID in the `--http-router-id` parameter. * `--virtual-host-name`: Name of the virtual host you are creating the route in. * FQMN-based routing condition parameters: * `--exact-fqmn-match`: Route requests with the same FQMN as the specified one. * `--prefix-fqmn-match`: Route requests whose FQMN starts with the specified prefix. For example, you can specify the first word of the service name: `/helloworld`. * `--regex-fqmn-match`: Route requests whose FQMN matches the specified [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression). For example: `\/[a-z]{10}[0-9]{3}`. {% note warning %} The FQMN must start with a slash `/` and contain a part of the service name where your procedure call is redirected. {% endnote %} {% note info %} The `--exact-fqmn-match`, `--prefix-fqmn-match`, and `--regex-fqmn-match` parameters are mutually exclusive: you can use only one of them. {% endnote %} * `--backend-group-name`: Name of the [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host for which you are creating the new route. Instead of the backend group name, you can provide its ID in the `--backend-group-id` parameter. * `--request-max-timeout`: Maximum connection time. You can specify a shorter timeout in the `grpc-timeout` request HTTP header. * `--request-idle-timeout`: Maximum connection idle time in seconds. * `--rate-limit`: Request rate limit. Available properties: * `rps` or `rpm`: Number of incoming requests per second or per minute. * `all-requests`: Limits all incoming requests. * `requests-per-ip`: Limits requests per client IP address. You can configure only one type of rate limit per route, either `all-requests` or `requests-per-ip`. This is an optional parameter; if not specified, no rate limiting is applied. * `--disable-security-profile`: Parameter that disables the use of the virtual host’s [Yandex Smart Web Security](../../smartwebsecurity/index.md) [profile](../../smartwebsecurity/concepts/profiles.md) for the route. A security profile allows you to filter incoming requests, enable [WAF](../../smartwebsecurity/concepts/waf.md), and set limits on the number of requests for protection against malicious activity. For more information, see [Security profiles](../../smartwebsecurity/concepts/profiles.md). This is an optional parameter. By default, the security profile associated with a virtual host applies to all routes you create. * `--before`: Name of the route which the new route will precede in the list of all virtual host routes. * `--after`: Name of the route which the new route will follow in the list of all virtual host routes. {% note info %} The `--before` and `--after` parameters are mutually exclusive: you can use only one of them. {% endnote %} {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-route grpc: match: fqmn: prefix_match: / route: backend_group_id: ds7dq9nsrgpc******** max_timeout: 60s idle_timeout: 5s auto_host_rewrite: false - name: my-third-route grpc: match: fqmn: prefix_match: myapp/ route: backend_group_id: ds7dq9nsrgpc******** max_timeout: 10s idle_timeout: 5s rate_limit: requests_per_ip: per_second: "4" disable_security_profile: true - name: my-second-route grpc: match: fqmn: prefix_match: helloworld/ route: backend_group_id: ds7dq9nsrgpc******** max_timeout: 10s idle_timeout: 5s rate_limit: requests_per_ip: per_second: "4" disable_security_profile: true modify_request_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "100" ``` {% endcut %} For detailed information about the `yc alb virtual-host insert-grpc-route` command with the full list of properties, see the [CLI reference](../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/insert-grpc-route.md). {% endlist %} {% endlist %} - Terraform {#tf} With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed. Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license. For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md). If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method. {% note info %} Virtual host routes will be applied to incoming requests in the same order as described in the Terraform configuration file. {% endnote %} 1. In the configuration file, describe the parameters of the route as a resource nested in a [yandex_alb_virtual_host](../../terraform/resources/alb_virtual_host.md) resource. With Terraform, you can add different [types](../concepts/http-router.md#routes-types) of routes to the virtual host: {% list tabs group=alb_route_type%} - HTTP {#http} ```hcl ... route { name = "" disable_security_profile = true|false http_route { http_match { http_method = ["","",...,""] path { prefix = "//" # or exact = "" # or regex = "" } } http_route_action { backend_group_id = "" host_rewrite = "" timeout = "s" idle_timeout = "s" prefix_rewrite = "/" rate_limit { all_requests { per_second = # or per_minute = } requests_per_ip { per_second = # or per_minute = } } } } } ... ``` Where: * `route`: Virtual host route description: * `name`: Route name. * `disable_security_profile`: Disabling the [Yandex Smart Web Security](../../smartwebsecurity/index.md) [security profile](../../smartwebsecurity/concepts/profiles.md) (optional). The possible values are `true` (the profile is disabled) or `false` (the profile is enabled). The default value is `false`: the security profile is enabled. * `http_route`: Route description for HTTP traffic: * `http_match`: Parameter for filtering incoming HTTP requests (optional): * `http_method`: List of HTTP [methods](https://en.wikipedia.org/wiki/HTTP#Request_methods) for which requests will be routed (optional). By default, requests with any methods are routed. * `path`: Optionally, parameters for filtering the path of an incoming request: * `exact`: Route requests with the same path as the specified one. For example, to route all requests, specify the `/` path. * `prefix`: Route requests whose path starts with the specified prefix. * `regex`: Route requests whose path matches the specified [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression), e.g., `\/[a-z]{10}[0-9]{3}\/`. The `exact`, `prefix`, and `regex` parameters are mutually exclusive: you can use only one of them. * `http_route_action`: Action applied to HTTP traffic. * `backend_group_id`: ID of the [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host of the new route. * `host_rewrite`: Replacing the Host header in the request with the specified value (optional). You specify the `auto_host_rewrite` parameter instead of the `host_rewrite` parameter; in this case the Host header in the request will be automatically replaced with the address of the target [VM](../../compute/concepts/vm.md). * `timeout`: Maximum connection time in seconds (optional). The default value is 60 seconds. * `idle_timeout`: Maximum connection idle timeout (keep-alive time) (optional). If not specified, the idle connection will be terminated immediately. * `prefix_rewrite`: Value to replace the path or part of the path specified in the `path` parameter (optional). * `rate_limit`: Limits the number of requests per unit of time (optional): * `all_requests`: Limits all incoming requests (optional): * `per_second`: Maximum number of incoming requests to a route per second. * `per_minute`: Maximum number of incoming requests to a route per minute. The `per_second`, and `per_minute` parameters are mutually exclusive: you can use only one of them. * `requests_per_ip`: Limits incoming requests from a single IP address (optional): * `per_second`: Maximum number of incoming requests to a route from a single IP address per second. * `per_minute`: Maximum number of incoming requests to a route from a single IP address per minute. The `per_second`, and `per_minute` parameters are mutually exclusive: you can use only one of them. - gRPC {#grpc} ```hcl ... route { name = "" disable_security_profile = true|false grpc_route { grpc_match { fqmn { prefix = "/" # or exact = "" # or regex = "" } } grpc_route_action { backend_group_id = "" host_rewrite = "" max_timeout = "s" idle_timeout = "s" rate_limit { all_requests { per_second = # or per_minute = } requests_per_ip { per_second = # or per_minute = } } } } } ... ``` Where: * `route`: Virtual host route description: * `name`: Route name. * `disable_security_profile`: Disabling the [Yandex Smart Web Security](../../smartwebsecurity/index.md) [security profile](../../smartwebsecurity/concepts/profiles.md) (optional). The possible values are `true` (the profile is disabled) or `false` (the profile is enabled). The default value is `false`: the security profile is enabled. * `grpc_route`: Route description for gRPC traffic: * `grpc_match.fqmn`: Parameter for filtering incoming gRPC requests by FQMN (optional): * `exact`: Route requests with the same FQMN as the specified one. * `prefix`: Route requests whose FQMN starts with the specified prefix. For example, you can specify the first word of the service name: `/helloworld`. * `regex`: Route requests whose FQMN matches the specified [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression). For example: `\/[a-z]{10}[0-9]{3}`. The `exact`, `prefix`, and `regex` parameters are mutually exclusive: you can use only one of them. * `grpc_route_action`: Action applied to gRPC traffic. * `backend_group_id`: ID of the [backend group](../concepts/backend-group.md) located in the same folder as the new route's [HTTP router](../concepts/http-router.md) and virtual host. * `host_rewrite`: Replacing the Host header in the request with the specified value (optional). You can specify `auto_host_rewrite` instead of `host_rewrite`, in which case the Host header in the request will be automatically replaced with the target [VM](../../compute/concepts/vm.md) address. * `--request-max-timeout`: Maximum request timeout in seconds (optional). You can specify a shorter timeout in the `grpc-timeout` request HTTP header. The default value is 60 seconds. * `idle_timeout`: Maximum connection idle timeout (keep-alive time) (optional). If not specified, the idle connection will be terminated immediately. * `rate_limit`: Limits the number of requests per unit of time (optional): * `all_requests`: Limits all incoming requests (optional): * `per_second`: Maximum number of incoming requests to a route per second. * `per_minute`: Maximum number of incoming requests to a route per minute. The `per_second`, and `per_minute` parameters are mutually exclusive: you can use only one of them. * `requests_per_ip`: Limits incoming requests from a single IP address (optional): * `per_second`: Maximum number of incoming requests to a route from a single IP address per second. * `per_minute`: Maximum number of incoming requests to a route from a single IP address per minute. The `per_second`, and `per_minute` parameters are mutually exclusive: you can use only one of them. {% endlist %} Learn more about the properties of resources used in Terraform in this provider guide: [yandex_alb_virtual_host](../../terraform/resources/alb_virtual_host.md). 1. Create the resources: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. Terraform will create all the required resources. You can check the new resources and their settings using the [management console](https://console.yandex.cloud) or this [CLI](../../cli/index.md) command: ```bash yc alb virtual-host get \ --http-router-name ``` {% note warning "Timeouts" %} The Terraform provider limits the execution time for operations with Application Load Balancer HTTP routers and virtual hosts to 10 minutes. Operations in excess of this time will be interrupted. {% cut "How do I modify these limits?" %} Add the `timeouts` section to the descriptions of the HTTP router and virtual host (the `yandex_alb_http_router` and `yandex_alb_virtual_host` resources, respectively). Here is an example: ```hcl resource "yandex_alb_http_router" "" { ... timeouts { create = "60m" update = "60m" delete = "60m" } } ``` {% endcut %} {% endnote %} - API {#api} Use the [update](../api-ref/VirtualHost/update.md) REST API method for the [VirtualHost](../api-ref/VirtualHost/index.md) resource or the [VirtualHostService/Update](../api-ref/grpc/VirtualHost/update.md) gRPC API call. {% note info %} Virtual host routes will be applied to incoming requests in the same order as described in the request body. {% endnote %} {% endlist %} ## Updating a route {#update-route} To update a route in a [virtual host](../concepts/http-router.md#virtual-host) of an HTTP router: {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you are going to update a virtual host route in. 1. Navigate to **Application Load Balancer**. 1. In the left-hand panel, click ![route](../../_assets/console-icons/route.svg) **HTTP routers** and select the [HTTP router](../concepts/http-router.md) that contains the route you need. 1. On the page that opens, under **Virtual hosts**, locate the route in the virtual host section, click ![ellipsis](../../_assets/console-icons/ellipsis.svg) next to its name, and select ![pencil](../../_assets/console-icons/pencil.svg) **Edit**. In the window that opens, depending on the [type](../concepts/http-router.md#routes-types) of your route: {% list tabs group=alb_route_type%} - HTTP {#http} 1. In the **Type** field, select `HTTP`. 1. In the **Path** field, select one of the options: * `Matches`: To route requests with the same path as the one specified in the text box on the right. For example, to route all requests, specify the `/` path. * `Starts with`: To route requests whose path begins with the prefix specified in the text box on the right. * `Regular expression`: To route requests whose path matches the [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression) specified in the text box on the right, e.g., `\/[a-z]{10}[0-9]{3}`. 1. In the **HTTP methods** field, select the HTTP [methods](https://en.wikipedia.org/wiki/HTTP#Request_methods) for which to route the requests. 1. In the **Action** field, select one of the options: `Routing`, `Forward`, or `Response`. Depending on the selected option: {% list tabs %} - Routing * In the **Backend group** field, select a [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host for which you are creating the new route. * Optionally, in the **Rewrite path or start** field, specify the path the HTTP router should redirect traffic to. If you select `Matches` in the **Path** field, the path will be completely replaced. If you select `Starts with`, only the prefix will be changed. * Optionally, in the **Host header rewrite** field, select one of these options: * `none`: The Host header in the request does not change. * `rewrite`: The Host header is replaced with the specified value. * `auto`: The Host header in the request is automatically replaced with the target [VM](../../compute/concepts/vm.md) address. * Optionally, enable **Limit on all requests** and/or **Limit on requests from one IP** and set these limits for the number of requests that will be processed for this route per unit of time. * Optionally, in the **Timeout, s** field, specify the maximum connection time. * Optionally, in the **Idle timeout, seconds** field, specify the maximum connection idle timeout (keep-alive time). * Optionally, in the **Valid values for the Upgrade header** field: * Optionally, list the protocols the backend group can switch to within a TCP connection on client's request. To add more protocols, click **Add upgrade type**. * Optionally, enable **WebSocket** if you want to use the [WebSocket](https://en.wikipedia.org/wiki/WebSocket) protocol. - Forward * In the **HTTP status code** field, select the HTTP forwarding status code: * `301 Moved Permanently` * `302 Found` * `303 See Other` * `307 Temporary Redirect` * `308 Permanent Redirect` * Optionally, enable **Rewrite path or start** and specify the modification type of the path the HTTP router should redirect traffic to: * `Entire path`: To completely replace the request path with the value set in the field on the right. * `Start`: To replace the request path prefix with the value set in the field on the right. {% note info %} If you select `Matches` in the **Path** field above, the path will be completely replaced, even with `Start` selected in the **Rewrite path or start** field. {% endnote %} * Optionally, enable **Delete query parameters** to remove all query parameters from requests. * Optionally, enable **Replace scheme** to replace the scheme found in requests with the one specified in the field on the right. If the original URI uses the `http` (`https`) scheme and port `80` (`443`), changing the scheme will delete the port. * Optionally, enable **Replace host** and specify the new host in the field on the right. * Optionally, enable **Replace port** and specify the new port in the field on the right. - Response * In the **HTTP status code** field, select the static response code to return. * In the **Response body** field, set the static response body to return. To do this, click **Select** and in the window that opens: * In the **Method** field, select: * `File`: To select a text file containing the response body. * `Text`: To enter the response text in the relevant text box. * Click **Add**. {% endlist %} - gRPC {#grpc} 1. In the **Type** field, select `gRPC`. 1. In the **FQMN** field, select one of the options: * `Matches`: To route requests whose FQMN matches the FQMN specified in the text box on the right. * `Starts with`: To route requests whose FQMN begins with the prefix specified in the text box on the right. For example, you can specify the first word of the service name: `/helloworld`. * `Regular expression`: To route requests whose FQMN matches the [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression) specified in the text box on the right. {% note warning %} The FQMN must start with a slash `/` and contain a part of the service name where your procedure call is redirected. {% endnote %} 1. In the **Action** field, select one of the options: `Routing` or `Response`. Depending on the selected option: {% list tabs %} - Routing * In the **Backend group** field, select a [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host for which you are creating the new route. * Optionally, in the **Host header rewrite** field, select one of these options: * `none`: The Host header in the request does not change. * `rewrite`: The Host header is replaced with the specified value. * `auto`: The Host header in the request is automatically replaced with the target [VM](../../compute/concepts/vm.md) address. * Optionally, enable **Limit on all requests** and/or **Limit on requests from one IP** and set these limits for the number of requests that will be processed for this route per unit of time. * Optionally, in the **Maximum timeout, sec.** field, specify the maximum connection time. You can specify a shorter timeout in the `grpc-timeout` request HTTP header. * Optionally, in the **Idle timeout, seconds** field, specify the connection idle timeout. - Response In the **gRPC status code** field, select the static response code for the load balancer to return: * `OK` * `INVALID_ARGUMENT` * `NOT_FOUND` * `PERMISSION_DENIED` * `UNAUTHENTICATED` * `UNIMPLEMENTED` * `INTERNAL` * `UNAVAILABLE` {% endlist %} {% endlist %} 1. Click **Save**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. With the Yandex Cloud CLI, you can update different [types](../concepts/http-router.md#routes-types) of routes in the virtual host: {% list tabs group=alb_route_type%} - HTTP {#http} 1. See the description of the CLI command for updating a virtual host route: ```bash yc alb virtual-host update-http-route --help ``` 1. View the list of HTTP routers in the default folder: ```bash yc alb http-router list ``` Result: ```text +----------------------+--------------------+-------------+-------------+ | ID | NAME | VHOST COUNT | ROUTE COUNT | +----------------------+--------------------+-------------+-------------+ | ds76j5n6a39g******** | sample-http-router | 1 | 2 | | ds76jk27sdf3******** | new-http-router | 2 | 7 | +----------------------+--------------------+-------------+-------------+ ``` 1. View the list of virtual hosts in an HTTP router by specifying the router name or ID, respectively, in the `--http-router-name` or `--http-router-id` parameter: ```bash yc alb virtual-host list \ --http-router-name \ --http-router-id ``` Result: ```text +-------------------+-------------+-------------+----------------------+ | NAME | AUTHORITIES | ROUTE COUNT | SECURITY PROFILE ID | +-------------------+-------------+-------------+----------------------+ | my-virtual-host | * | 1 | fevu5fnuk6vf******** | | test-virtual-host | example.com | 2 | fevug3d25bv6******** | +-------------------+-------------+-------------+----------------------+ ``` 1. To get a list of a virtual host's routes, run this command by substituting the virtual host name and the HTTP router name or ID in the `--http-router-name` or `--http-router-id` parameter, respectively: ```bash yc alb virtual-host get \ --http-router-name \ --http-router-id ``` {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-route http: match: path: prefix_match: / route: backend_group_id: ds7dnf2s5dco******** timeout: 60s auto_host_rewrite: false modify_request_headers: - name: Accept-Language append: ru-RU modify_response_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "5" requests_per_ip: per_second: "3" ``` {% endcut %} 1. Update the route by specifying its name and additional parameters: ```bash yc alb virtual-host update-http-route \ --http-router-name \ --virtual-host-name \ --match-http-method ,,... \ --exact-path-match \ --prefix-path-match \ --regex-path-match \ --backend-group-name \ --request-timeout s \ --request-idle-timeout s \ --rate-limit rps=,requests-per-ip \ --disable-security-profile ``` Where: * `--http-router-name`: Name of the HTTP router the route is in. Instead of the HTTP router name, you can provide its ID in the `--http-router-id` parameter. * `--virtual-host-name`: Name of the virtual host the route is in. * `--match-http-method`: List of HTTP [methods](https://en.wikipedia.org/wiki/HTTP#Request_methods) for which to route the requests. For example, `--match-http-method GET,POST,OPTIONS`. To clear the list of HTTP methods set for the route, provide the `--clear-method-match` parameter in the command. * Path-based routing condition parameters: * `--exact-path-match`: Route requests with the same path as the specified one. For example, to route all requests, specify the `/` path. * `--prefix-path-match`: Route requests whose path starts with the specified prefix, e.g., `/myapp/`. * `--regex-path-match`: Route requests whose path matches the specified [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression), e.g., `\/[a-z]{10}[0-9]{3}\/`. {% note info %} The `--exact-path-match`, `--prefix-path-match`, and `--regex-path-match` parameters are mutually exclusive: you can use only one of them. {% endnote %} To clear the path-based routing conditions set for the route, provide the `--clear-path-match` parameter in the command. * `--backend-group-name`: Name of the [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md), virtual host, and route. Instead of the backend group name, you can provide its ID in the `--backend-group-id` parameter. * `--request-timeout`: Maximum connection time in seconds for a connection on request. To clear the request timeout set for the route, provide the `--clear-request-timeout` parameter in the command. * `--request-idle-timeout`: Maximum connection idle time in seconds. To clear the idle timeout set for the route, provide the `--clear-idle-timeout` parameter in the command. * `--rate-limit`: Request rate limit. Available properties: * `rps` or `rpm`: Number of incoming requests per second or per minute. * `all-requests`: Limits all incoming requests. * `requests-per-ip`: Limits requests per client IP address. You can configure only one type of rate limit per route, either `all-requests` or `requests-per-ip`. This is an optional parameter; if not specified, no rate limiting is applied. To clear the route's request rate limits settings, provide the `--clear-rate-limit` parameter in the command. * `--disable-security-profile`: Parameter that disables the use of the virtual host’s [Yandex Smart Web Security](../../smartwebsecurity/index.md) [profile](../../smartwebsecurity/concepts/profiles.md) for the route. A security profile allows you to filter incoming requests, enable [WAF](../../smartwebsecurity/concepts/waf.md), and set limits on the number of requests for protection against malicious activity. For more information, see [Security profiles](../../smartwebsecurity/concepts/profiles.md). This is an optional parameter. By default, the security profile associated with a virtual host applies to all routes you create. To re-enable the security profile previously disabled for the route, provide the `--disable-security-profile=false` parameter in the command. {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-route http: match: http_method: - POST - PATCH path: exact_match: / route: backend_group_id: ds7dnf2s5dco******** timeout: 12s idle_timeout: 6s host_rewrite: myapp prefix_rewrite: yourapp/ rate_limit: requests_per_ip: per_second: "5" modify_request_headers: - name: Accept-Language append: ru-RU modify_response_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "5" requests_per_ip: per_second: "3" ``` {% endcut %} For more details about the `yc alb virtual-host update-http-route` command, see the [CLI reference](../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/update-http-route.md). - gRPC {#grpc} 1. See the description of the CLI command for updating a virtual host route: ```bash yc alb virtual-host update-grpc-route --help ``` 1. View the list of HTTP routers in the default folder: ```bash yc alb http-router list ``` Result: ```text +----------------------+--------------------+-------------+-------------+ | ID | NAME | VHOST COUNT | ROUTE COUNT | +----------------------+--------------------+-------------+-------------+ | ds76j5n6a39g******** | sample-http-router | 1 | 2 | | ds76jk27sdf3******** | new-http-router | 2 | 7 | +----------------------+--------------------+-------------+-------------+ ``` 1. View the list of virtual hosts in an HTTP router by specifying the router name or ID, respectively, in the `--http-router-name` or `--http-router-id` parameter: ```bash yc alb virtual-host list \ --http-router-name \ --http-router-id ``` Result: ```text +-------------------+-------------+-------------+----------------------+ | NAME | AUTHORITIES | ROUTE COUNT | SECURITY PROFILE ID | +-------------------+-------------+-------------+----------------------+ | my-virtual-host | * | 1 | fevu5fnuk6vf******** | | test-virtual-host | example.com | 2 | fevug3d25bv6******** | +-------------------+-------------+-------------+----------------------+ ``` 1. To get a list of a virtual host's routes, run this command by substituting the virtual host name and the HTTP router name or ID in the `--http-router-name` or `--http-router-id` parameter, respectively: ```bash yc alb virtual-host get \ --http-router-name \ --http-router-id ``` {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-route grpc: match: fqmn: prefix_match: / route: backend_group_id: ds7dq9nsrgpc******** max_timeout: 10s idle_timeout: 5s host_rewrite: myapp rate_limit: all_requests: per_second: "12" requests_per_ip: per_second: "6" modify_request_headers: - name: Accept-Language append: ru-RU modify_response_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "5" requests_per_ip: per_second: "3" ``` {% endcut %} 1. Update the route by specifying its name and additional parameters: ```bash yc alb virtual-host update-grpc-route \ --http-router-name \ --virtual-host-name \ --exact-fqmn-match \ --prefix-fqmn-match \ --regex-fqmn-match \ --backend-group-name \ --request-max-timeout s \ --request-idle-timeout s \ --rate-limit rps=,requests-per-ip \ --disable-security-profile ``` Where: * `--http-router-name`: Name of the HTTP router the route is in. Instead of the HTTP router name, you can provide its ID in the `--http-router-id` parameter. * `--virtual-host-name`: Name of the virtual host the route is in. * Parameters of routing conditions based on FQMN: * `--exact-fqmn-match`: Route requests with the same FQMN as the specified one. * `--prefix-fqmn-match`: Route requests whose FQMN starts with the specified prefix. For example, you can specify the first word of the service name: `/helloworld`. * `--regex-fqmn-match`: Route requests whose FQMN matches the specified [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression), e.g., `\/[a-z]{10}[0-9]{3}`. {% note warning %} The FQMN must start with a slash `/` and contain a part of the service name where your procedure call is redirected. {% endnote %} {% note info %} The `--exact-fqmn-match`, `--prefix-fqmn-match`, and `--regex-fqmn-match` parameters are mutually exclusive: you can use only one of them. {% endnote %} To clear the FQMN-based routing conditions set for the route, provide the `--clear-fqmn-match` parameter in the command. * `--backend-group-name`: Name of the [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md), virtual host, and route. Instead of the backend group name, you can provide its ID in the `--backend-group-id` parameter. * `--request-max-timeout`: Maximum connection time. You can specify a shorter timeout in the `grpc-timeout` request HTTP header. To clear the connection timeout set for the route, provide the `--clear-max-timeout` parameter in the command. * `--request-idle-timeout`: Maximum connection idle time, in seconds. To clear the idle timeout set for the route, provide the `--clear-idle-timeout` parameter in the command. * `--rate-limit`: Request rate limit. Available properties: * `rps` or `rpm`: Number of incoming requests per second or per minute. * `all-requests`: Limits all incoming requests. * `requests-per-ip`: Limits requests per client IP address. You can configure only one type of rate limit per route, either `all-requests` or `requests-per-ip`. This is an optional parameter; if not specified, no rate limiting is applied. To clear the route's request rate limits settings, provide the `--clear-rate-limit` parameter in the command. * `--disable-security-profile`: Parameter that disables the use of the virtual host’s [Yandex Smart Web Security](../../smartwebsecurity/index.md) [profile](../../smartwebsecurity/concepts/profiles.md) for the route. A security profile allows you to filter incoming requests, enable [WAF](../../smartwebsecurity/concepts/waf.md), and set limits on the number of requests for protection against malicious activity. For more information, see [Security profiles](../../smartwebsecurity/concepts/profiles.md). This is an optional parameter. By default, the security profile associated with a virtual host applies to all routes you create. To re-enable the security profile previously disabled for the route, provide the `--disable-security-profile=false` parameter in the command. {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-route grpc: match: fqmn: exact_match: /myapp route: backend_group_id: ds7dq9nsrgpc******** max_timeout: 12s idle_timeout: 6s host_rewrite: myapp rate_limit: all_requests: per_second: "12" requests_per_ip: per_second: "6" disable_security_profile: true modify_request_headers: - name: Accept-Language append: ru-RU modify_response_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "5" requests_per_ip: per_second: "3" ``` {% endcut %} For more details about the `yc alb virtual-host update-grpc-route` command, see the [CLI reference](../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/update-grpc-route.md). {% endlist %} - Terraform {#tf} With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed. Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license. For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md). If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method. 1. In the configuration file, update the parameters of the route as a resource nested in a [yandex_alb_virtual_host](../../terraform/resources/alb_virtual_host.md) resource. With Terraform, you can update different [types](../concepts/http-router.md#routes-types) of routes in the virtual host: {% list tabs group=alb_route_type%} - HTTP {#http} ```hcl ... route { name = "" disable_security_profile = true|false http_route { http_match { http_method = ["","",...,""] path { prefix = "//" # or exact = "" # or regex = "" } } http_route_action { backend_group_id = "" host_rewrite = "" timeout = "s" idle_timeout = "s" prefix_rewrite = "/" rate_limit { all_requests { per_second = # or per_minute = } requests_per_ip { per_second = # or per_minute = } } } } } ... ``` Where: * `route`: Virtual host route description: * `name`: Route name. * `disable_security_profile`: Disabling the [Yandex Smart Web Security](../../smartwebsecurity/index.md) [security profile](../../smartwebsecurity/concepts/profiles.md) (optional). The possible values are `true` (the profile is disabled) or `false` (the profile is enabled). The default value is `false`: the security profile is enabled. * `http_route`: Route description for HTTP traffic: * `http_match`: Parameter for filtering incoming HTTP requests (optional): * `http_method`: List of HTTP [methods](https://en.wikipedia.org/wiki/HTTP#Request_methods) for which requests will be routed (optional). By default, requests with any methods are routed. * `path`: Optionally, parameters for filtering the path of an incoming request: * `exact`: Route requests with the same path as the specified one. For example, to route all requests, specify the `/` path. * `prefix`: Route requests whose path starts with the specified prefix. * `regex`: Route requests whose path matches the specified [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression), e.g., `\/[a-z]{10}[0-9]{3}\/`. The `exact`, `prefix`, and `regex` parameters are mutually exclusive: you can use only one of them. * `http_route_action`: Action applied to HTTP traffic. * `backend_group_id`: ID of the [backend group](../concepts/backend-group.md) located in the same folder as the [HTTP router](../concepts/http-router.md) and virtual host of the new route. * `host_rewrite`: Replacing the Host header in the request with the specified value (optional). You specify the `auto_host_rewrite` parameter instead of the `host_rewrite` parameter; in this case the Host header in the request will be automatically replaced with the address of the target [VM](../../compute/concepts/vm.md). * `timeout`: Maximum connection time in seconds (optional). The default value is 60 seconds. * `idle_timeout`: Maximum connection idle timeout (keep-alive time) (optional). If not specified, the idle connection will be terminated immediately. * `prefix_rewrite`: Value to replace the path or part of the path specified in the `path` parameter (optional). * `rate_limit`: Limits the number of requests per unit of time (optional): * `all_requests`: Limits all incoming requests (optional): * `per_second`: Maximum number of incoming requests to a route per second. * `per_minute`: Maximum number of incoming requests to a route per minute. The `per_second`, and `per_minute` parameters are mutually exclusive: you can use only one of them. * `requests_per_ip`: Limits incoming requests from a single IP address (optional): * `per_second`: Maximum number of incoming requests to a route from a single IP address per second. * `per_minute`: Maximum number of incoming requests to a route from a single IP address per minute. The `per_second`, and `per_minute` parameters are mutually exclusive: you can use only one of them. - gRPC {#grpc} ```hcl ... route { name = "" disable_security_profile = true|false grpc_route { grpc_match { fqmn { prefix = "/" # or exact = "" # or regex = "" } } grpc_route_action { backend_group_id = "" host_rewrite = "" max_timeout = "s" idle_timeout = "s" rate_limit { all_requests { per_second = # or per_minute = } requests_per_ip { per_second = # or per_minute = } } } } } ... ``` Where: * `route`: Virtual host route description: * `name`: Route name. * `disable_security_profile`: Disabling the [Yandex Smart Web Security](../../smartwebsecurity/index.md) [security profile](../../smartwebsecurity/concepts/profiles.md) (optional). The possible values are `true` (the profile is disabled) or `false` (the profile is enabled). The default value is `false`: the security profile is enabled. * `grpc_route`: Route description for gRPC traffic: * `grpc_match.fqmn`: Parameter for filtering incoming gRPC requests by FQMN (optional): * `exact`: Route requests with the same FQMN as the specified one. * `prefix`: Route requests whose FQMN starts with the specified prefix. For example, you can specify the first word of the service name: `/helloworld`. * `regex`: Route requests whose FQMN matches the specified [RE2](https://github.com/google/re2/wiki/Syntax) [regular expression](https://en.wikipedia.org/wiki/Regular_expression). For example: `\/[a-z]{10}[0-9]{3}`. The `exact`, `prefix`, and `regex` parameters are mutually exclusive: you can use only one of them. * `grpc_route_action`: Action applied to gRPC traffic. * `backend_group_id`: ID of the [backend group](../concepts/backend-group.md) located in the same folder as the new route's [HTTP router](../concepts/http-router.md) and virtual host. * `host_rewrite`: Replacing the Host header in the request with the specified value (optional). You can specify `auto_host_rewrite` instead of `host_rewrite`, in which case the Host header in the request will be automatically replaced with the target [VM](../../compute/concepts/vm.md) address. * `--request-max-timeout`: Maximum request timeout in seconds (optional). You can specify a shorter timeout in the `grpc-timeout` request HTTP header. The default value is 60 seconds. * `idle_timeout`: Maximum connection idle timeout (keep-alive time) (optional). If not specified, the idle connection will be terminated immediately. * `rate_limit`: Limits the number of requests per unit of time (optional): * `all_requests`: Limits all incoming requests (optional): * `per_second`: Maximum number of incoming requests to a route per second. * `per_minute`: Maximum number of incoming requests to a route per minute. The `per_second`, and `per_minute` parameters are mutually exclusive: you can use only one of them. * `requests_per_ip`: Limits incoming requests from a single IP address (optional): * `per_second`: Maximum number of incoming requests to a route from a single IP address per second. * `per_minute`: Maximum number of incoming requests to a route from a single IP address per minute. The `per_second`, and `per_minute` parameters are mutually exclusive: you can use only one of them. {% endlist %} Learn more about the properties of Terraform resources in the relevant provider guide: [yandex_alb_virtual_host](../../terraform/resources/alb_virtual_host.md). 1. Update the resources: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. Terraform will create all the required resources. You can check the new resources, their updates, and settings using the [management console](https://console.yandex.cloud) or this [CLI](../../cli/index.md) command: ```bash yc alb virtual-host get \ --http-router-name ``` {% note warning "Timeouts" %} The Terraform provider limits the execution time for operations with Application Load Balancer HTTP routers and virtual hosts to 10 minutes. Operations in excess of this time will be interrupted. {% cut "How do I modify these limits?" %} Add the `timeouts` section to the descriptions of the HTTP router and virtual host (the `yandex_alb_http_router` and `yandex_alb_virtual_host` resources, respectively). Here is an example: ```hcl resource "yandex_alb_http_router" "" { ... timeouts { create = "60m" update = "60m" delete = "60m" } } ``` {% endcut %} {% endnote %} - API {#api} Use the [updateRoute](../api-ref/VirtualHost/updateRoute.md) REST API method for the [VirtualHost](../api-ref/VirtualHost/index.md) resource or the [VirtualHostService/UpdateRoute](../api-ref/grpc/VirtualHost/updateRoute.md) gRPC API call. {% endlist %} ## Changing route order {#sort-routes} To reorder routes in a [virtual host](../concepts/http-router.md#virtual-host) of an HTTP router: {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) in which you are going to reorder virtual host. 1. Navigate to **Application Load Balancer**. 1. In the left-hand panel, click ![route](../../_assets/console-icons/route.svg) **HTTP routers** and select the [HTTP router](../concepts/http-router.md) that contains the virtual host. 1. On the page that opens, under **Virtual hosts**, click ![ellipsis](../../_assets/console-icons/ellipsis.svg) next to the virtual host and select ![pencil](../../_assets/console-icons/pencil.svg) **Edit**. 1. If you want to change the route order, click **Sort** and in the window that opens: 1. Drag and drop routes to arrange them in desired order. 1. Click **Save**. 1. Click **Save**. - CLI {#cli} The Yandex Cloud CLI currently does not have a dedicated command for reordering routes in a virtual host. To reorder routes via the CLI, follow these steps: 1. [Delete](manage-routes.md#delete-route) the route in question from the virtual host. 1. [Add](manage-routes.md#create-route) the route again to the appropriate place in the route list. - Terraform {#tf} With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed. Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license. For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md). If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method. {% note info %} Virtual host routes will be applied to incoming requests in the same order as described in the Terraform configuration file. {% endnote %} 1. In the configuration file, reorder the routes as resources nested in a [yandex_alb_virtual_host](../../terraform/resources/alb_virtual_host.md) resource. {% cut "Example of a virtual host configuration:" %} ```hcl resource "yandex_alb_virtual_host" "my-virtual-host" { name = "test-virtual-host" http_router_id = "ds76j5n6a39g********" rate_limit { all_requests { per_second = 5 } requests_per_ip { per_second = 3 } } route { name = "my-first-http-route" disable_security_profile = false http_route { http_match { http_method = ["GET","POST"] path { prefix = "/myapp/" } } http_route_action { backend_group_id = "ds7dnf2s5dco********" host_rewrite = "myapp" idle_timeout = "3s" prefix_rewrite = "/yourapp/" rate_limit { all_requests { per_second = 12 } requests_per_ip { per_minute = 120 } } timeout = "10s" } } } route { name = "my-first-grpc-route" disable_security_profile = false grpc_route { grpc_match { fqmn { prefix = "/" } } grpc_route_action { backend_group_id = "ds7dq9nsrgpc********" host_rewrite = "myapp" idle_timeout = "5s" max_timeout = "10s" rate_limit { all_requests { per_minute = 0 per_second = 12 } requests_per_ip { per_minute = 0 per_second = 6 } } } } } authority = ["example.com"] modify_request_headers { name = "Accept-Language" append = "ru-RU" } modify_response_headers { name = "Accept-Language" append = "ru-RU" } route_options { security_profile_id = "fevu5fnuk6vf********" } } ``` {% endcut %} Learn more about the properties of resources used in Terraform in this provider guide: [yandex_alb_virtual_host](../../terraform/resources/alb_virtual_host.md). 1. Update the resources: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. Terraform will create all the required resources. You can check the new resources as well as their order and settings using the [management console](https://console.yandex.cloud) or this [CLI](../../cli/index.md) command: ```bash yc alb virtual-host get \ --http-router-name ``` {% note warning "Timeouts" %} The Terraform provider limits the execution time for operations with Application Load Balancer HTTP routers and virtual hosts to 10 minutes. Operations in excess of this time will be interrupted. {% cut "How do I modify these limits?" %} Add the `timeouts` section to the descriptions of the HTTP router and virtual host (the `yandex_alb_http_router` and `yandex_alb_virtual_host` resources, respectively). Here is an example: ```hcl resource "yandex_alb_http_router" "" { ... timeouts { create = "60m" update = "60m" delete = "60m" } } ``` {% endcut %} {% endnote %} - API {#api} Use the [update](../api-ref/VirtualHost/update.md) REST API method for the [VirtualHost](../api-ref/VirtualHost/index.md) resource or the [VirtualHostService/Update](../api-ref/grpc/VirtualHost/update.md) gRPC API call. {% note info %} Virtual host routes will be applied to incoming requests in the same order as described in the request body. {% endnote %} {% endlist %} ## Modifying HTTP request parameters {#modify-http-parameters} [Virtual host](../concepts/http-router.md#virtual-host) routes in Yandex Application Load Balancer [HTTP routers](../concepts/http-router.md) allow you to modify HTTP request parameters as needed by replacing the request parts matching [RE2](https://github.com/google/re2/wiki/Syntax) [regular expressions](https://en.wikipedia.org/wiki/Regular_expression) with other values. For example, such modifications may be of use for API versioning, microservice routing, backward compatibility, URL normalization, as well as [A/B testing](https://en.wikipedia.org/wiki/A/B_testing) and [canary releases](../../api-gateway/concepts/extensions/canary.md). To modify HTTP request parameters, you can use [Yandex Cloud CLI](../../cli/index.md), [Terraform](../../terraform/index.md), or [API](../api-ref/authentication.md). ### Example of modifying HTTP request parameters {#modification-example} As an example, consider a scenario that may arise from implementing a new API version in the service. Let's assume that initially, the only API version offered by the service was available at `/api/users`. After introducing the new API version (`v2`), the new interface should be available at `/api/v2/users`, and the old one, at `/api/v1/users`. Requests targeting the new API go straight to `/api/v2/users`, and it is enough to configure a standard routing rule to send them to the `api-v2-backend` group with the new API. Requests to the old API continue to arrive at `/api/users`. In which case, you can replace this address in the requests with `/api/v1/users` by modifying the HTTP request parameters in route settings. {% list tabs group=instructions %} - CLI {#cli} To modify the HTTP request parameters in a virtual host route, specify the required replacement settings in the `--path-regex-rewrite` parameter when [creating](#create-route) or [updating](#update-route) an HTTP route. The following example shows how to configure request modification when creating a route: ```bash yc alb virtual-host append-http-route \ --virtual-host-name \ --http-router-name \ --backend-group-name api-v1-backend \ --prefix-path-match '/api/users/' \ --path-regex-rewrite 'regex=^/api/users/(.*),substitute=/api/v1/users/\\1' ``` Where: * `--backend-group-name`: Name of the backend group serving the old API. * `--prefix-path-match`: Filter specifying the path prefix to select requests for the route you are creating. * `--path-regex-rewrite`: Specifies how to replace parts of the HTTP request path: * `regex`: RE2 standard regular expression that, when matched, will modify the request path string. In this example, the regular expression describes a path that begins with the `/api/users/` prefix, followed by any number of any characters (or nothing). In this case, everything that follows the prefix is ​​saved in a group (pocket). * `substitute`: String that will replace the path matching the regular expression specified in `regex`. In the example above, the path will be replaced with a string consisting of the `/api/v1/users/` prefix and the contents of the group (pocket) saved in the regular expression. {% note info %} The `--path-regex-rewrite`, and `--path-prefix-rewrite` parameters are mutually exclusive: you can use only one of them. {% endnote %} Result: ```text name: my-virtual-host routes: - name: my-http-route http: match: path: prefix_match: /api/users/ route: backend_group_id: ds7m9iupbcaq******** regex_rewrite: regex: ^/api/users/(.*) substitute: /api/v1/users/\\1 ``` For more details about the `yc alb virtual-host append-http-route` command, see the [CLI reference](../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/append-http-route.md). - Terraform {#tf} 1. To modify the HTTP request parameters, in the Terraform configuration file, provide `regex_rewrite` in the HTTP route resource settings nested within a [yandex_alb_virtual_host](../../terraform/resources/alb_virtual_host.md) resource: ```hcl ... route { name = "" disable_security_profile = true|false http_route { http_match { http_method = ["","",...,""] path { prefix = "/api/users/" # or exact = "" # or regex = "" } } http_route_action { backend_group_id = "ds7m9iupbcaq********" host_rewrite = "" timeout = "s" idle_timeout = "s" regex_rewrite { regex = "^/api/users/(.*)" substitute = "/api/v1/users/\\1" } rate_limit { all_requests { per_second = # or per_minute = } requests_per_ip { per_second = # or per_minute = } } } } } ... ``` Where: * `route`: Virtual host route description: * `http_route`: Route description for HTTP traffic: * `path`: Parameter for filtering the incoming request path: * `prefix`: Filter specifying the path prefix to match requests for the route you are creating. * `http_route_action`: Action to apply to HTTP traffic. * `backend_group_id`: ID of the backend group serving the old API. * `regex_rewrite`: Specifies how to replace parts of the HTTP request path: * `regex`: RE2 standard regular expression that, when matched, will modify the request path string. In this example, the regular expression describes a path that begins with the `/api/users/` prefix, followed by any number of any characters (or nothing). In this case, everything that follows the prefix is ​​saved in a group (pocket). * `substitute`: String that will replace the path matching the regular expression specified in `regex`. In the example above, the path will be replaced with a string consisting of the `/api/v1/users/` prefix and the contents of the group (pocket) saved in the regular expression. {% note info %} The `regex_rewrite`, and `prefix_rewrite` parameters are mutually exclusive: you can use only one of them. {% endnote %} Learn more about the properties of Terraform resources in the relevant provider guide: [yandex_alb_virtual_host](../../terraform/resources/alb_virtual_host.md). 1. Create or update the resources: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. Terraform will create all the required resources. You can check the new resources, their updates, and settings using the [management console](https://console.yandex.cloud) or this [CLI](../../cli/index.md) command: ```bash yc alb virtual-host get \ --http-router-name ``` - API {#api} To modify the HTTP request parameters in a virtual host route, specify the required replacement settings in the `regexRewrite` (for REST API) or `regex_rewrite` (for gRPC API) fields when [creating](#create-route) or [updating](#update-route) the HTTP route. {% note info %} The `regexRewrite` and `prefixRewrite` parameters are mutually exclusive, so you can specify only one of them. {% endnote %} {% endlist %} ## Deleting a route {#delete-route} To delete a route from a [virtual host](../concepts/http-router.md#virtual-host) of an HTTP router: {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) to delete a virtual host route from. 1. Navigate to **Application Load Balancer**. 1. In the left-hand panel, click ![route](../../_assets/console-icons/route.svg) **HTTP routers** and select the [HTTP router](../concepts/http-router.md) that contains the route you need. 1. On the page that opens, under **Virtual hosts**, locate the route in the virtual host section, click ![ellipsis](../../_assets/console-icons/ellipsis.svg) next to its name, and select ![trash-bin](../../_assets/console-icons/trash-bin.svg) **Delete**. 1. In the window that opens, confirm the deletion. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. With the Yandex Cloud CLI, you can delete different [types](../concepts/http-router.md#routes-types) of routes from a virtual host: {% list tabs group=alb_route_type%} - HTTP {#http} 1. See the description of the CLI command for deleting a virtual host route: ```bash yc alb virtual-host remove-http-route --help ``` 1. View the list of HTTP routers in the default folder: ```bash yc alb http-router list ``` Result: ```text +----------------------+--------------------+-------------+-------------+ | ID | NAME | VHOST COUNT | ROUTE COUNT | +----------------------+--------------------+-------------+-------------+ | ds76j5n6a39g******** | sample-http-router | 1 | 2 | | ds76jk27sdf3******** | new-http-router | 2 | 7 | +----------------------+--------------------+-------------+-------------+ ``` 1. View the list of virtual hosts in an HTTP router by specifying the router name or ID, respectively, in the `--http-router-name` or `--http-router-id` parameter: ```bash yc alb virtual-host list \ --http-router-name \ --http-router-id ``` Result: ```text +-------------------+-------------+-------------+----------------------+ | NAME | AUTHORITIES | ROUTE COUNT | SECURITY PROFILE ID | +-------------------+-------------+-------------+----------------------+ | my-virtual-host | * | 1 | fevu5fnuk6vf******** | | test-virtual-host | example.com | 2 | fevug3d25bv6******** | +-------------------+-------------+-------------+----------------------+ ``` 1. To get a list of a virtual host's routes, run this command by substituting the virtual host name and the HTTP router name or ID in the `--http-router-name` or `--http-router-id` parameter, respectively: ```bash yc alb virtual-host get \ --http-router-name \ --http-router-id ``` {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-http-route http: match: http_method: - GET - POST path: prefix_match: myapp/ route: backend_group_id: ds7dnf2s5dco******** timeout: 10s idle_timeout: 3s host_rewrite: myapp prefix_rewrite: yourapp/ rate_limit: all_requests: per_second: "12" requests_per_ip: per_minute: "120" - name: my-first-grpc-route grpc: match: fqmn: prefix_match: / route: backend_group_id: ds7dq9nsrgpc******** max_timeout: 10s idle_timeout: 5s host_rewrite: myapp rate_limit: all_requests: per_second: "12" requests_per_ip: per_second: "6" modify_request_headers: - name: Accept-Language append: ru-RU modify_response_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "5" requests_per_ip: per_second: "3" ``` {% endcut %} 1. Delete a route by specifying its name, virtual host details, and HTTP router details: ```bash yc alb virtual-host remove-http-route \ --http-router-name \ --virtual-host-name ``` Where: * `--http-router-name`: Name of the HTTP router the route is in. Instead of the HTTP router name, you can provide its ID in the `--http-router-id` parameter. * `--virtual-host-name`: Name of the virtual host the route is in. {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-grpc-route grpc: match: fqmn: prefix_match: / route: backend_group_id: ds7dq9nsrgpc******** max_timeout: 10s idle_timeout: 5s host_rewrite: myapp rate_limit: all_requests: per_second: "12" requests_per_ip: per_second: "6" modify_request_headers: - name: Accept-Language append: ru-RU modify_response_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "5" requests_per_ip: per_second: "3" ``` {% endcut %} For more details about the `yc alb virtual-host remove-http-route` command, see the [CLI reference](../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/remove-http-route.md). - gRPC {#grpc} 1. See the description of the CLI command for deleting a virtual host route: ```bash yc alb virtual-host remove-grpc-route --help ``` 1. View the list of HTTP routers in the default folder: ```bash yc alb http-router list ``` Result: ```text +----------------------+--------------------+-------------+-------------+ | ID | NAME | VHOST COUNT | ROUTE COUNT | +----------------------+--------------------+-------------+-------------+ | ds76j5n6a39g******** | sample-http-router | 1 | 2 | | ds76jk27sdf3******** | new-http-router | 2 | 7 | +----------------------+--------------------+-------------+-------------+ ``` 1. View the list of virtual hosts in an HTTP router by specifying the router name or ID, respectively, in the `--http-router-name` or `--http-router-id` parameter: ```bash yc alb virtual-host list \ --http-router-name \ --http-router-id ``` Result: ```text +-------------------+-------------+-------------+----------------------+ | NAME | AUTHORITIES | ROUTE COUNT | SECURITY PROFILE ID | +-------------------+-------------+-------------+----------------------+ | my-virtual-host | * | 1 | fevu5fnuk6vf******** | | test-virtual-host | example.com | 2 | fevug3d25bv6******** | +-------------------+-------------+-------------+----------------------+ ``` 1. To get a list of a virtual host's routes, run this command by substituting the virtual host name and the HTTP router name or ID in the `--http-router-name` or `--http-router-id` parameter, respectively: ```bash yc alb virtual-host get \ --http-router-name \ --http-router-id ``` {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-http-route http: match: http_method: - GET - POST path: prefix_match: myapp/ route: backend_group_id: ds7dnf2s5dco******** timeout: 10s idle_timeout: 3s host_rewrite: myapp prefix_rewrite: yourapp/ rate_limit: all_requests: per_second: "12" requests_per_ip: per_minute: "120" - name: my-first-grpc-route grpc: match: fqmn: prefix_match: / route: backend_group_id: ds7dq9nsrgpc******** max_timeout: 10s idle_timeout: 5s host_rewrite: myapp rate_limit: all_requests: per_second: "12" requests_per_ip: per_second: "6" modify_request_headers: - name: Accept-Language append: ru-RU modify_response_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "5" requests_per_ip: per_second: "3" ``` {% endcut %} 1. Delete a route by specifying its name, virtual host details, and HTTP router details: ```bash yc alb virtual-host remove-grpc-route \ --http-router-name \ --virtual-host-name ``` Where: * `--http-router-name`: Name of the HTTP router the route is in. Instead of the HTTP router name, you can provide its ID in the `--http-router-id` parameter. * `--virtual-host-name`: Name of the virtual host the route is in. {% cut "Result:" %} ```text name: test-virtual-host authority: - example.com routes: - name: my-first-http-route http: match: http_method: - GET - POST path: prefix_match: myapp/ route: backend_group_id: ds7dnf2s5dco******** timeout: 10s idle_timeout: 3s host_rewrite: myapp prefix_rewrite: yourapp/ rate_limit: all_requests: per_second: "12" requests_per_ip: per_minute: "120" modify_request_headers: - name: Accept-Language append: ru-RU modify_response_headers: - name: Accept-Language append: ru-RU route_options: security_profile_id: fevu5fnuk6vf******** rate_limit: all_requests: per_second: "5" requests_per_ip: per_second: "3" ``` {% endcut %} For more details about the `yc alb virtual-host remove-grpc-route` command, see the [CLI reference](../../cli/cli-ref/application-load-balancer/cli-ref/virtual-host/remove-grpc-route.md). {% endlist %} - Terraform {#tf} With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed. Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license. For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md). If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method. 1. Delete from the configuration file the description of the route as a resource nested in a [yandex_alb_virtual_host](../../terraform/resources/alb_virtual_host.md) resource. {% cut "Example of a virtual host configuration:" %} ```hcl resource "yandex_alb_virtual_host" "my-virtual-host" { name = "test-virtual-host" http_router_id = "ds76j5n6a39g********" rate_limit { all_requests { per_second = 5 } requests_per_ip { per_second = 3 } } route { name = "my-first-http-route" disable_security_profile = false http_route { http_match { http_method = ["GET","POST"] path { prefix = "/myapp/" } } http_route_action { backend_group_id = "ds7dnf2s5dco********" host_rewrite = "myapp" idle_timeout = "3s" prefix_rewrite = "/yourapp/" rate_limit { all_requests { per_second = 12 } requests_per_ip { per_minute = 120 } } timeout = "10s" } } } route { name = "my-first-grpc-route" disable_security_profile = false grpc_route { grpc_match { fqmn { prefix = "/" } } grpc_route_action { backend_group_id = "ds7dq9nsrgpc********" host_rewrite = "myapp" idle_timeout = "5s" max_timeout = "10s" rate_limit { all_requests { per_minute = 0 per_second = 12 } requests_per_ip { per_minute = 0 per_second = 6 } } } } } authority = ["example.com"] modify_request_headers { name = "Accept-Language" append = "ru-RU" } modify_response_headers { name = "Accept-Language" append = "ru-RU" } route_options { security_profile_id = "fevu5fnuk6vf********" } } ``` {% endcut %} Learn more about the properties of Terraform resources in the relevant provider guide: [yandex_alb_virtual_host](../../terraform/resources/alb_virtual_host.md). 1. Update the resources: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. Terraform will create all the required resources. You can check the new resources, their deletion status, and settings using the [management console](https://console.yandex.cloud) or this [CLI](../../cli/index.md) command: ```bash yc alb virtual-host get \ --http-router-name ``` {% note warning "Timeouts" %} The Terraform provider limits the execution time for operations with Application Load Balancer HTTP routers and virtual hosts to 10 minutes. Operations in excess of this time will be interrupted. {% cut "How do I modify these limits?" %} Add the `timeouts` section to the descriptions of the HTTP router and virtual host (the `yandex_alb_http_router` and `yandex_alb_virtual_host` resources, respectively). Here is an example: ```hcl resource "yandex_alb_http_router" "" { ... timeouts { create = "60m" update = "60m" delete = "60m" } } ``` {% endcut %} {% endnote %} - API {#api} Use the [removeRoute](../api-ref/VirtualHost/removeRoute.md) REST API method for the [VirtualHost](../api-ref/VirtualHost/index.md) resource or the [VirtualHostService/RemoveRoute](../api-ref/grpc/VirtualHost/removeRoute.md) gRPC API call. {% endlist %}