Build different console versions for different environments (#2715)

TESTED=deployed to alpha

README.md

@@ -12,16 +12,16 @@ Nomulus is an open source, scalable, cloud-based service for operating
 [top-level domains](https://en.wikipedia.org/wiki/Top-level_domain) (TLDs). It
 is the authoritative source for the TLDs that it runs, meaning that it is
 responsible for tracking domain name ownership and handling registrations,
-renewals, availability checks, and WHOIS requests. End-user registrants (i.e.
+renewals, availability checks, and WHOIS requests. End-user registrants (i.e.,
 people or companies that want to register a domain name) use an intermediate
 domain name registrar acting on their behalf to interact with the registry.
 
-Nomulus runs on [Google App Engine][gae] and is written primarily in Java. It is
-the software that [Google Registry](https://www.registry.google/) uses to
-operate TLDs such as .google, .app, .how, .soy, and .みんな. It can run any
-number of TLDs in a single shared registry system using horizontal scaling. Its
-source code is publicly available in this repository under the [Apache 2.0 free
-and open source license](https://www.apache.org/licenses/LICENSE-2.0).
+Nomulus runs on [Google Kubernetes Engine](https://cloud.google.com/kubernetes-engine)
+and is written primarily in Java. It is the software that
+[Google Registry](https://www.registry.google/) uses to operate TLDs such as .google,
+.app, .how, .soy, and .みんな. It can run any number of TLDs in a single shared registry
+system using horizontal scaling. Its source code is publicly available in this
+repository under the [Apache 2.0 free and open source license](https://www.apache.org/licenses/LICENSE-2.0).
 
 ## Getting started
 
@@ -54,9 +54,11 @@ Nomulus has the following capabilities:
     checking, updating, and transferring domain names.
 *   **[DNS](https://en.wikipedia.org/wiki/Domain_Name_System) interface**: The
     registry provides a pluggable interface that can be implemented to handle
-    different DNS providers. It includes a sample implementation using Google
-    Cloud DNS as well as an RFC 2136 compliant implementation that works with
-    BIND.
+    different DNS providers. It includes a sample implementation using [Google
+    Cloud DNS](https://cloud.google.com/dns/), as well as an RFC 2136 compliant
+    implementation that works with BIND. If you are using Google Cloud DNS, you
+    may need to understand its capabilities and provide your own
+    multi-[AS](https://en.wikipedia.org/wiki/Autonomous_system_\(Internet\)) solution.
 *   **[WHOIS](https://en.wikipedia.org/wiki/WHOIS)**: A text-based protocol that
     returns ownership and contact information on registered domain names.
 *   **[Registration Data Access Protocol
@@ -68,7 +70,7 @@ Nomulus has the following capabilities:
     provider to allow take-over by another registry operator in the event of
     serious failure. This is required by ICANN for all [new
     gTLDs](https://newgtlds.icann.org/).
-*   **Premium pricing**: Communicates prices for premium domain names (i.e.
+*   **Premium pricing**: Communicates prices for premium domain names (i.e.,
     those that are highly desirable) and supports configurable premium
     registration and renewal prices. An extensible interface allows fully
     programmatic pricing.
@@ -91,56 +93,50 @@ Nomulus has the following capabilities:
 *   **Administrative tool**: Performs the full range of administrative tasks
     needed to manage a running registry system, including creating and
     configuring new TLDs.
-*   **DNS interface**: An interface for DNS operations is provided so you can
-    write an implementation for your chosen provider, along with a sample
-    implementation that uses [Google Cloud DNS](https://cloud.google.com/dns/).
-    If you are using Google Cloud DNS you may need to understand its
-    capabilities and provide your own
-    multi-[AS](https://en.wikipedia.org/wiki/Autonomous_system_\(Internet\))
-    solution.
-*   **GAE Proxy**: App Engine Standard only serves HTTP/S traffic. A proxy to
-    forward traffic on EPP and WHOIS ports to App Engine via HTTPS is provided.
-    Instructions on setting up the proxy on
-    [Google Kubernetes Engine](https://cloud.google.com/kubernetes-engine/)
-    is [available](https://github.com/google/nomulus/blob/master/docs/proxy-setup.md).
-    Running the proxy on GKE supports IPv4 and IPv6 access, per ICANN's
-    requirements for gTLDs. The proxy can also run as a single jar file, or on
-    other Kubernetes providers, with modifications.
+*   **Secure storage of cryptographic keys**: A keyring interface is
+      provided for plugging in your own implementation (see [configuration
+      doc](https://github.com/google/nomulus/blob/master/docs/configuration.md)
+      for details), and an implementation based on
+      [Google Cloud Secret Manager](https://cloud.google.com/security/products/secret-manager) is
+      available.
+*   **TPC Proxy**: Nomulus is built on top of the [Jetty](https://jetty.org/)
+    container that implements the [Jakarta Servlet](https://jakarta.ee/specifications/servlet/)
+    specification and only serves HTTP/S traffic. A proxy to translate raw TCP traffic (e.g., EPP)
+    to and from HTTP is provided.
+    Instructions on setting up the proxy
+    are [available](https://github.com/google/nomulus/blob/master/docs/proxy-setup.md).
+    The proxy can either run in a separate cluster and communicate to Nomulus public HTTP
+    endpoints via the Internet, or as a sidecar with the Nomulus image in the same pod and
+    communicate to it via loopback.
 
 ## Additional components
 
 Registry operators interested in deploying Nomulus will likely require some
-additional components that are need to be configured separately.
+additional components that need to be configured separately.
 
 *   A way to invoice registrars for domain name registrations and accept
     payments. Nomulus records the information required to generate invoices in
     [billing
     events](https://github.com/google/nomulus/blob/master/docs/code-structure.md#billing-events).
 *   Fully automated reporting to meet ICANN's requirements for gTLDs. Nomulus
-    includes substantial reporting functionality but some additional work will
+    includes substantial reporting functionality, but some additional work will
     be required by the operator in this area.
-*   A secure method for storing cryptographic keys. A keyring interface is
-    provided for plugging in your own implementation (see [configuration
-    doc](https://github.com/google/nomulus/blob/master/docs/configuration.md)
-    for details).
+
 *   System status and uptime monitoring.
 
 ## Outside references
 
-*   [Donuts](http://donuts.domains) Registry has helped review the code and
-    provided valuable feedback
+*   [Identity Digital](http://identity.digital) has helped review the code and
+    provided valuable feedback.
 *   [CoCCa](http://cocca.org.nz) and [FRED](https://fred.nic.cz) are other
-    open-source registry platforms in use by many TLDs
+    open-source registry platforms in use by many TLDs.
 *   We are not aware of any fully open source domain registrar projects, but
     open source EPP Toolkits (not yet tested with Nomulus; may require
     integration work) include:
-    *   [EPP RTK Project](http://epp-rtk.sourceforge.net/)
-    *   [CentralNic](https://www.centralnic.com/registry/labs)
+    *   [Universal Registry/Registrar Toolkit](https://sourceforge.net/projects/epp-rtk/)
     *   [ari-toolkit](https://github.com/AusRegistry/ari-toolkit)
     *   [Net::DRI](https://metacpan.org/pod/Net::DRI)
 *   Some Open Source DNS Projects that may be useful, but which we have not
     tested:
-    *   [AtomiaDNS](http://atomiadns.com/)
-    *   [PowerDNS](https://doc.powerdns.com/md/)
-
-[gae]:https://cloud.google.com/appengine/docs/about-the-standard-environment
+    *   [AtomiaDNS](https://github.com/atomia/atomiadns)
+    *   [PowerDNS](https://github.com/PowerDNS/pdns)

build.gradle

@@ -95,26 +95,22 @@ task stage {
   description = 'Generates application directories for all services.'
 }
 
-// App-engine environment configuration.  We set up all of the variables in
-// the root project.
-
-def environments = ['production', 'sandbox', 'alpha', 'crash', 'qa']
-
 def gcpProject = null
 
 apply from: "${rootDir.path}/projects.gradle"
 
 if (environment == '') {
-    // Keep the project null, this will prevent deployment.  Set the
+    // Keep the project null, this will prevent deployment. Set the
     // environment to "alpha" because other code needs this property to
     // explode the war file.
     environment = 'alpha'
-} else if (environment != 'production' && environment != 'sandbox') {
+} else {
     gcpProject = projects[environment]
     if (gcpProject == null) {
         throw new GradleException("-Penvironment must be one of " +
                                   "${projects.keySet()}.")
     }
+    project(':console-webapp').setProperty('configuration', environment)
 }
 
 rootProject.ext.environment = environment

common/src/testing/java/google/registry/testing/truth/TextDiffSubject.java

@@ -63,6 +63,7 @@ public class TextDiffSubject extends Subject {
 
   private final ImmutableList<String> actual;
   private DiffFormat diffFormat = DiffFormat.SIDE_BY_SIDE_MARKDOWN;
+  private ImmutableList<String> comments = ImmutableList.of();
 
   protected TextDiffSubject(FailureMetadata metadata, List<String> actual) {
     super(metadata, actual);
@@ -83,10 +84,22 @@ public class TextDiffSubject extends Subject {
     return this;
   }
 
+  /** If set, ignore lines that start with the given string. */
+  public TextDiffSubject ignoringLinesStartingWith(String... comments) {
+    this.comments = ImmutableList.copyOf(comments);
+    return this;
+  }
+
+  private ImmutableList<String> filterComments(List<String> lines) {
+    return lines.stream()
+        .filter(line -> comments.stream().noneMatch(line::startsWith))
+        .collect(ImmutableList.toImmutableList());
+  }
+
   public void hasSameContentAs(List<String> expectedContent) {
     checkNotNull(expectedContent, "expectedContent");
-    ImmutableList<String> expected = ImmutableList.copyOf(expectedContent);
-    if (expected.equals(actual)) {
+    ImmutableList<String> expected = filterComments(expectedContent);
+    if (filterComments(expected).equals(filterComments(actual))) {
       return;
     }
     String diffString = diffFormat.generateDiff(expected, actual);

config/presubmits.py

@@ -25,7 +25,7 @@ import textwrap
 import re
 
 # We should never analyze any generated files
-UNIVERSALLY_SKIPPED_PATTERNS = {"/build/", "cloudbuild-caches", "/out/", ".git/", ".gradle/", "/dist/", "karma.conf.js", "polyfills.ts", "test.ts", "/docs/console-endpoints/"}
+UNIVERSALLY_SKIPPED_PATTERNS = {"/build/", "cloudbuild-caches", "/out/", ".git/", ".gradle/", "/dist/", "/console-alpha/", "/console-crash/", "/console-qa", "/console-sandbox", "/console-production", "karma.conf.js", "polyfills.ts", "test.ts", "/docs/console-endpoints/"}
 # We can't rely on CI to have the Enum package installed so we do this instead.
 FORBIDDEN = 1
 REQUIRED = 2

console-webapp/.gitignore

@@ -44,3 +44,4 @@ Thumbs.db
 
 # Build artifact
 /staged/dist
+/staged/console-*

console-webapp/angular.json

@@ -96,11 +96,17 @@
               "sourceMap": true,
               "namedChunks": true
             },
-            "development": {
+            "qa": {
               "optimization": false,
               "extractLicenses": false,
               "sourceMap": true,
               "namedChunks": true
+            },
+            "development": {
+              "optimization": false,
+              "extractLicenses": false,
+              "sourceMap": true,
+              "namedChunks": true,
             }
           },
           "defaultConfiguration": "production"
@@ -120,6 +126,9 @@
             "sandbox": {
               "buildTarget": "console-webapp:build:sandbox"
             },
+            "qa": {
+              "buildTarget": "console-webapp:build:qa"
+            },
             "development": {
               "buildTarget": "console-webapp:build:development"
             }

console-webapp/build.gradle

@@ -40,15 +40,55 @@ task runConsoleWebappUnitTests(type: Exec) {
 task buildConsoleWebapp(type: Exec) {
   workingDir "${consoleDir}/"
   executable 'npm'
-  def configuration = project.hasProperty('configuration') ?
-    project.getProperty('configuration') :
-    'production'
+  def configuration = project.getProperty('configuration')
   args 'run', "build", "--configuration=${configuration}"
   doFirst {
     println "Building console for environment: ${configuration}"
   }
 }
 
+task buildConsoleForAll() {}
+
+def createConsoleTask = { env ->
+  project.tasks.register("buildConsoleFor${env.capitalize()}", Exec) {
+    workingDir "${consoleDir}/"
+    executable 'npm'
+    args 'run', 'build', "--configuration=${env}"
+    doFirst {
+      println "Building console for environment: ${env}"
+    }
+    doLast {
+      copy {
+        from "${consoleDir}/staged/dist/"
+        into "${consoleDir}/staged/console-${env}"
+      }
+      delete "${consoleDir}/staged/dist"
+    }
+    dependsOn(tasks.npmInstallDeps)
+  }
+  project.tasks.register("deleteConsoleFor${env.capitalize()}", Delete) {
+    delete "${consoleDir}/staged/console-${env}"
+  }
+  tasks.named('clean') {
+    dependsOn(tasks.named("deleteConsoleFor${env.capitalize()}"))
+  }
+  tasks.named('buildConsoleForAll') {
+    dependsOn(tasks.named("buildConsoleFor${env.capitalize()}"))
+  }
+}
+
+['alpha', 'crash', 'qa', 'sandbox', 'production'].forEach {env ->
+  createConsoleTask(env)
+}
+
+// Force an order so we don't run these tasks in parallel.
+tasks.buildConsoleForCrash.mustRunAfter(tasks.buildConsoleForAlpha)
+tasks.buildConsoleForQa.mustRunAfter(tasks.buildConsoleForCrash)
+tasks.buildConsoleForSandbox.mustRunAfter(tasks.buildConsoleForQa)
+tasks.buildConsoleForProduction.mustRunAfter(tasks.buildConsoleForSandbox)
+// This task must run last, otherwise the previous tasks will have deleted the "dist" folder.
+tasks.buildConsoleWebapp.mustRunAfter(tasks.buildConsoleForProduction)
+
 task applyFormatting(type: Exec) {
   workingDir "${consoleDir}/"
   executable 'npm'

console-webapp/gradle.properties

@@ -0,0 +1 @@
+configuration=production

console-webapp/src/app/domains/domainList.component.html

@@ -24,7 +24,11 @@
     </div>
     } @else {
     <mat-menu #actions="matMenu">
-      <ng-template matMenuContent let-domainName="domainName">
+      <ng-template
+        matMenuContent
+        let-domainName="domainName"
+        let-domain="domain"
+      >
         <button
           mat-menu-item
           (click)="openRegistryLock(domainName)"
@@ -33,6 +37,24 @@
           <mat-icon>key</mat-icon>
           <span>Registry Lock</span>
         </button>
+        <button
+          mat-menu-item
+          (click)="onSuspendClick(domainName)"
+          [elementId]="getElementIdForSuspendUnsuspend()"
+          [disabled]="isDomainUnsuspendable(domain)"
+        >
+          <mat-icon>lock_clock</mat-icon>
+          <span>Suspend</span>
+        </button>
+        <button
+          mat-menu-item
+          (click)="onUnsuspendClick(domainName)"
+          [elementId]="getElementIdForSuspendUnsuspend()"
+          [disabled]="!isDomainUnsuspendable(domain)"
+        >
+          <mat-icon>lock_open</mat-icon>
+          <span>Unsuspend</span>
+        </button>
       </ng-template>
     </mat-menu>
     <div
@@ -170,7 +192,10 @@
                 <button
                   mat-icon-button
                   [matMenuTriggerFor]="actions"
-                  [matMenuTriggerData]="{ domainName: element.domainName }"
+                  [matMenuTriggerData]="{
+                    domainName: element.domainName,
+                    domain: element
+                  }"
                   aria-label="Domain actions"
                 >
                   <mat-icon>more_horiz</mat-icon>

console-webapp/src/app/domains/domainList.component.ts

@@ -14,13 +14,17 @@
 
 import { SelectionModel } from '@angular/cdk/collections';
 import { HttpErrorResponse, HttpStatusCode } from '@angular/common/http';
-import { Component, ViewChild, effect, Inject } from '@angular/core';
+import { Component, effect, Inject, ViewChild } from '@angular/core';
 import { MatPaginator, PageEvent } from '@angular/material/paginator';
 import { MatSnackBar } from '@angular/material/snack-bar';
 import { MatTableDataSource } from '@angular/material/table';
-import { Subject, debounceTime, take, filter } from 'rxjs';
+import { debounceTime, filter, Subject, take } from 'rxjs';
 import { RegistrarService } from '../registrar/registrar.service';
-import { Domain, DomainListService } from './domainList.service';
+import {
+  BULK_ACTION_NAME,
+  Domain,
+  DomainListService,
+} from './domainList.service';
 import { RegistryLockComponent } from './registryLock.component';
 import { RegistryLockService } from './registryLock.service';
 import {
@@ -62,11 +66,17 @@ export class ResponseDialogComponent {
   }
 }
 
+enum Operation {
+  deleting = 'deleting',
+  suspending = 'suspending',
+  unsuspending = 'unsuspending',
+}
+
 @Component({
   selector: 'app-reason-dialog',
   template: `
     <h2 mat-dialog-title>
-      Please provide a reason for {{ data.operation }} the domain(s):
+      Please provide the (EPP) reason for {{ data.operation }} the domain(s):
     </h2>
     <mat-dialog-content>
       <mat-form-field appearance="outline" style="width:100%">
@@ -75,8 +85,8 @@ export class ResponseDialogComponent {
     </mat-dialog-content>
     <mat-dialog-actions>
       <button mat-button (click)="onCancel()">Cancel</button>
-      <button mat-button color="warn" (click)="onDelete()" [disabled]="!reason">
-        Delete
+      <button mat-button color="warn" (click)="onSave()" [disabled]="!reason">
+        Save
       </button>
     </mat-dialog-actions>
   `,
@@ -84,14 +94,13 @@ export class ResponseDialogComponent {
 })
 export class ReasonDialogComponent {
   reason: string = '';
-
   constructor(
     public dialogRef: MatDialogRef<ReasonDialogComponent>,
     @Inject(MAT_DIALOG_DATA)
-    public data: { operation: 'deleting' | 'suspending' }
+    public data: { operation: Operation }
   ) {}
 
-  onDelete(): void {
+  onSave(): void {
     this.dialogRef.close(this.reason);
   }
 
@@ -108,6 +117,13 @@ export class ReasonDialogComponent {
 })
 export class DomainListComponent {
   public static PATH = 'domain-list';
+  private static SUSPENDED_STATUSES = [
+    'SERVER_RENEW_PROHIBITED',
+    'SERVER_TRANSFER_PROHIBITED',
+    'SERVER_UPDATE_PROHIBITED',
+    'SERVER_DELETE_PROHIBITED',
+    'SERVER_HOLD',
+  ];
   private readonly DEBOUNCE_MS = 500;
   isAllSelected = false;
 
@@ -258,19 +274,30 @@ export class DomainListComponent {
     return RESTRICTED_ELEMENTS.BULK_DELETE;
   }
 
+  getElementIdForSuspendUnsuspend() {
+    return RESTRICTED_ELEMENTS.SUSPEND;
+  }
+
   getOperationMessage(domain: string) {
     if (this.operationResult && this.operationResult[domain])
       return this.operationResult[domain].message;
     return '';
   }
 
+  isDomainUnsuspendable(domain: Domain) {
+    return DomainListComponent.SUSPENDED_STATUSES.every((s) =>
+      domain.statuses.includes(s)
+    );
+  }
+
   sendDeleteRequest(reason: string) {
     this.isLoading = true;
     this.domainListService
-      .deleteDomains(
-        this.selection.selected,
+      .bulkDomainAction(
+        this.selection.selected.map((d) => d.domainName),
         reason,
-        this.registrarService.registrarId()
+        this.registrarService.registrarId(),
+        BULK_ACTION_NAME.DELETE
       )
       .pipe(take(1))
       .subscribe({
@@ -294,15 +321,17 @@ export class DomainListComponent {
           this.operationResult = result;
           this.reloadData();
         },
-        error: (err: HttpErrorResponse) =>
-          this._snackBar.open(err.error || err.message),
+        error: (err: HttpErrorResponse) => {
+          this.isLoading = false;
+          this._snackBar.open(err.error || err.message);
+        },
       });
   }
 
   deleteSelectedDomains() {
     const dialogRef = this.dialog.open(ReasonDialogComponent, {
       data: {
-        operation: 'deleting',
+        operation: Operation.deleting,
       },
     });
 
@@ -314,4 +343,77 @@ export class DomainListComponent {
       )
       .subscribe(this.sendDeleteRequest.bind(this));
   }
+
+  sendSuspendUnsuspendRequest(
+    domainName: string,
+    reason: string,
+    actionName: BULK_ACTION_NAME
+  ) {
+    this.isLoading = true;
+    this.domainListService
+      .bulkDomainAction(
+        [domainName],
+        reason,
+        this.registrarService.registrarId(),
+        actionName
+      )
+      .pipe(take(1))
+      .subscribe({
+        next: (result: DomainData) => {
+          this.isLoading = false;
+          if (result[domainName].responseCode.toString().startsWith('2')) {
+            this._snackBar.open(result[domainName].message);
+          } else {
+            this.reloadData();
+          }
+        },
+        error: (err: HttpErrorResponse) => {
+          this.isLoading = false;
+          this._snackBar.open(err.error || err.message);
+        },
+      });
+  }
+  onSuspendClick(domainName: string) {
+    const dialogRef = this.dialog.open(ReasonDialogComponent, {
+      data: {
+        operation: Operation.suspending,
+      },
+    });
+
+    dialogRef
+      .afterClosed()
+      .pipe(
+        take(1),
+        filter((reason) => !!reason)
+      )
+      .subscribe((reason) => {
+        this.sendSuspendUnsuspendRequest(
+          domainName,
+          reason,
+          BULK_ACTION_NAME.SUSPEND
+        );
+      });
+  }
+
+  onUnsuspendClick(domainName: string) {
+    const dialogRef = this.dialog.open(ReasonDialogComponent, {
+      data: {
+        operation: Operation.unsuspending,
+      },
+    });
+
+    dialogRef
+      .afterClosed()
+      .pipe(
+        take(1),
+        filter((reason) => !!reason)
+      )
+      .subscribe((reason) => {
+        this.sendSuspendUnsuspendRequest(
+          domainName,
+          reason,
+          BULK_ACTION_NAME.UNSUSPEND
+        );
+      });
+  }
 }

console-webapp/src/app/domains/domainList.service.ts

@@ -35,6 +35,12 @@ export interface DomainListResult {
   totalResults: number;
 }
 
+export enum BULK_ACTION_NAME {
+  DELETE = 'DELETE',
+  SUSPEND = 'SUSPEND',
+  UNSUSPEND = 'UNSUSPEND',
+}
+
 @Injectable({
   providedIn: 'root',
 })
@@ -71,11 +77,16 @@ export class DomainListService {
       );
   }
 
-  deleteDomains(domains: Domain[], reason: string, registrarId: string) {
+  bulkDomainAction(
+    domains: string[],
+    reason: string,
+    registrarId: string,
+    actionName: BULK_ACTION_NAME
+  ) {
     return this.backendService.bulkDomainAction(
-      domains.map((d) => d.domainName),
+      domains,
       reason,
-      'DELETE',
+      actionName,
       registrarId
     );
   }

console-webapp/src/app/shared/directives/userLevelVisiblity.directive.ts

@@ -20,17 +20,17 @@ export enum RESTRICTED_ELEMENTS {
   OTE,
   USERS,
   BULK_DELETE,
+  SUSPEND,
 }
 
 export const DISABLED_ELEMENTS_PER_ROLE = {
   NONE: [
     RESTRICTED_ELEMENTS.REGISTRAR_ELEMENT,
     RESTRICTED_ELEMENTS.OTE,
-    RESTRICTED_ELEMENTS.USERS,
-    RESTRICTED_ELEMENTS.BULK_DELETE,
+    RESTRICTED_ELEMENTS.SUSPEND,
   ],
-  SUPPORT_LEAD: [RESTRICTED_ELEMENTS.USERS],
-  SUPPORT_AGENT: [RESTRICTED_ELEMENTS.USERS],
+  SUPPORT_LEAD: [],
+  SUPPORT_AGENT: [],
 };
 
 @Directive({

console-webapp/src/app/users/userDetails.component.ts

@@ -67,17 +67,24 @@ export class UserDetailsComponent {
   }
 
   deleteUser() {
-    this.isLoading = true;
-    this.usersService.deleteUser(this.userDetails()).subscribe({
-      error: (err) => {
-        this._snackBar.open(err.error || err.message);
-        this.isLoading = false;
-      },
-      complete: () => {
-        this.isLoading = false;
-        this.goBack();
-      },
-    });
+    if (
+      confirm(
+        'This will permanently delete the user ' +
+          this.userDetails().emailAddress
+      )
+    ) {
+      this.isLoading = true;
+      this.usersService.deleteUser(this.userDetails()).subscribe({
+        error: (err) => {
+          this._snackBar.open(err.error || err.message);
+          this.isLoading = false;
+        },
+        complete: () => {
+          this.isLoading = false;
+          this.goBack();
+        },
+      });
+    }
   }
 
   goBack() {

core/build.gradle

@@ -687,6 +687,7 @@ artifacts {
 task runTestServer(type: JavaExec) {
   main = 'google.registry.server.RegistryTestServerMain'
   classpath = sourceSets.test.runtimeClasspath
+  dependsOn(rootProject.project('console-webapp').tasks.named('buildConsoleWebapp'))
 }
 
 /**

core/src/main/java/google/registry/config/files/tasks/cloud-scheduler-tasks-production.xml

@@ -301,6 +301,7 @@
     <url><![CDATA[/_dr/task/bsaValidate]]></url>
     <name>bsaValidate</name>
     <service>bsa</service>
+    <timeout>10m</timeout>
     <description>
       Validates the processed BSA data in the database against the original
       block lists.

core/src/main/java/google/registry/keyring/api/pgp-private-keyring.asc

@@ -1,32 +0,0 @@
------BEGIN PGP PRIVATE KEY BLOCK-----
-
-lQHYBFo8aRIBBAC8MA2xQXYvEbeLV1iMo4GC3lRFYvrUCarenhwoWufCYH6dGien
-/HhiB0eiDF672J4MtueHQ2M7UaGJgxAoQTG9c6O90vlmFFhPZ967U1MTdY/NLvDK
-bQEGzjdaUC1T/O6kr0O4GHRAyNyHa39Q75Oaj8MNdPsTmT4tDy+aFO6kKwARAQAB
-AAP9Gd59M12tUmEcGxKBwKuFVSkc6oDlvBosG/geJMoCS+0Z2pzK0MPbBJa9mSAc
-MbRgXZ0TDLwNuwzIqO+UXARCQu1ln/NlCcSzQZd5S80Of6CSoFMdFEb0kcpFW3z9
-rpZdIBpNNk2iyBro9+7JOLJgCUkZQX7jy2K4LM5eTJsnuMECANFBnrMUde43XBiT
-gixOJ5zbekGIIGq4QeRc8fJUDUhkFMq1znNriu30bB0Ld4Btlxzyn56tx8DVgx1+
-4anONuECAOY5nm2G9i46AUxQN3dB8IE0SMMHcRcz60eX68fke+1aYjdSQA/nf9hR
-l2f+gX9+y3cPqo7bFZzrDNECRm3J2IsB/2444JDTnzyME99jRYeEZGM0BXMWZEoO
-hLU7f2V8pdN1po6mZ5bZZv6LeTXWPCIqCuBxNHZAV/xH9oWmkpjnw8Sc77QpVGVz
-dCBSZWdpc3RyeSA8dGVzdC1yZWdpc3RyeUBleGFtcGxlLmNvbT6IuAQTAQIAIgUC
-WjxpEgIbAwYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQvIOfrLbgEN2NegP+
-JV+i4DxPTv3jfRDcpGy8yDANiIoBFSyARpqMqg0+TfV/UypuyjFTGfnLuQv+osce
-OKtPevH8gCc779+OqtqyNDcPooTG5K+eUYR77PYtfzsKk/Z/33tQtEJDb8WWn4G4
-R9Nh51MOz1X17oe3ih9HNvMGIrOG9VeWPsTxjXAzBoidAdgEWjxpEgEEANiasS9p
-bG53M3jeCwLX0PFgWgspMZl3QnU6bvaTsfMAHaklJ55Tj1wuaaQymHqNm6xElCN8
-MK8exDQQvPZwYVQOuoP3cHriCslLGznB943URcuxXz6R7F7WixYUeVVpQ4J0+gFu
-bR8PfThDCtHQyP+uYx9U+EVWIvuIZIchdjl9ABEBAAEAA/4xmt2sorthIf3g9pL1
-e/jfKoZ8i1rPT1NiNvdeE217neFtEPP9i5vni76ISskGOgN2hH8bkE+y7zwWQ2YP
-FyYGlvVcw2KjT7+SrAWCkgR6Y7hWib+RDcVGje+YH5MxGtBIX2W/zcOW5S9+nC3Q
-Y3Tzc3YQxF8sOeaHvrEb1tJ9eQIA5ivEjt43GgZq0nxacKLhleXyA9Z/JmwDg15z
-FCZCnPABmR72wpXzXe2gO18W3iiqwS/WFDbdSFwxDQ0lXSy8VQIA8Okv6Q2BNXEw
-H0hufK8P7aHvuOI1ll4qTw6QkY+z5hRZAcmmID3boQJeJAmVbUissYKUNJudmiUJ
-DPLQod+wiQIAtJWxlRgHvEHRjQS5tH13ERWLObBHdZcQvKcqdtTCZj1EVH7zVHpb
-qBLggo7QwPJTC+UMf/f4nPd1U2O6zXv66p5liJ8EGAECAAkFAlo8aRICGwwACgkQ
-vIOfrLbgEN141gP9GATYCoihm5igbZ0FL8YPPb5WvHpTEA4WgdIIUUCQ0TYJ2ZOC
-dK0i3qbb1xRRBJq006qSiE4vqQ7fHO8HxmEWaPLlsPvebGm39PUuzVyWx8I2w+0/
-qcxt5L2VVzbZFp6+Yoa+meRYsO77gAzUvqUG1yLWo6MD4pSUNYJA867BB/k=
-=mkAP
------END PGP PRIVATE KEY BLOCK-----

core/src/main/java/google/registry/model/tld/Tld.java

@@ -199,16 +199,16 @@ public class Tld extends ImmutableObject implements Buildable, UnsafeSerializabl
 
   /** Returns the TLD entities for the given TLD strings, throwing if any don't exist. */
   public static ImmutableSet<Tld> get(Set<String> tlds) {
-    Map<String, Optional<Tld>> registries = CACHE.getAll(tlds);
-    ImmutableSet<String> missingRegistries =
-        registries.entrySet().stream()
+    Map<String, Optional<Tld>> tldObjects = CACHE.getAll(tlds);
+    ImmutableSet<String> missingTlds =
+        tldObjects.entrySet().stream()
             .filter(e -> e.getValue().isEmpty())
             .map(Map.Entry::getKey)
             .collect(toImmutableSet());
-    if (missingRegistries.isEmpty()) {
-      return registries.values().stream().map(Optional::get).collect(toImmutableSet());
+    if (missingTlds.isEmpty()) {
+      return tldObjects.values().stream().map(Optional::get).collect(toImmutableSet());
     } else {
-      throw new TldNotFoundException(missingRegistries);
+      throw new TldNotFoundException(missingTlds);
     }
   }
 

core/src/main/java/google/registry/model/tld/label/PremiumList.java

@@ -14,10 +14,10 @@
 
 package google.registry.model.tld.label;
 
-import static com.google.common.base.Charsets.US_ASCII;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.collect.ImmutableMap.toImmutableMap;
 import static com.google.common.hash.Funnels.stringFunnel;
+import static java.nio.charset.StandardCharsets.US_ASCII;
 
 import com.google.common.base.Splitter;
 import com.google.common.collect.ImmutableMap;

core/src/main/java/google/registry/module/RegistryServlet.java

@@ -16,7 +16,9 @@ package google.registry.module;
 
 import static google.registry.util.GcpJsonFormatter.setCurrentRequest;
 import static google.registry.util.GcpJsonFormatter.setCurrentTraceId;
+import static google.registry.util.GcpJsonFormatter.setLabel;
 import static google.registry.util.GcpJsonFormatter.unsetCurrentRequest;
+import static google.registry.util.GcpJsonFormatter.unsetLabels;
 import static google.registry.util.RandomStringGenerator.insecureRandomStringGenerator;
 import static google.registry.util.StringGenerator.Alphabets.HEX_DIGITS_ONLY;
 
@@ -30,9 +32,12 @@ import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.util.Arrays;
+import java.util.Optional;
 import java.util.logging.ConsoleHandler;
 import java.util.logging.Handler;
 import java.util.logging.Level;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 /** Servlet that handles all requests. */
 public class RegistryServlet extends ServletBase {
@@ -48,6 +53,10 @@ public class RegistryServlet extends ServletBase {
   private static final RequestHandler<RequestComponent> requestHandler = component.requestHandler();
   private static final Lazy<MetricReporter> metricReporter = component.metricReporter();
 
+  // The regex pattern to capture the cookies that we want to log.
+  private static final Pattern COOKIE_REGEX_PATTERN =
+      Pattern.compile("(JSESSIONID|GCLB)=[\"]?([^;\"\\s]+)[\"]?");
+
   private final String projectId;
 
   static {
@@ -74,11 +83,20 @@ public class RegistryServlet extends ServletBase {
     String userAgent = String.valueOf(req.getHeader("User-Agent"));
     String protocol = req.getProtocol();
     setCurrentRequest(requestMethod, requestUrl, userAgent, protocol);
+    Optional.ofNullable(req.getHeader("Cookie"))
+        .ifPresent(
+            cookie -> {
+              Matcher matcher = COOKIE_REGEX_PATTERN.matcher(cookie);
+              while (matcher.find()) {
+                setLabel(matcher.group(1), matcher.group(2));
+              }
+            });
     try {
       super.service(req, rsp);
     } finally {
       setCurrentTraceId(null);
       unsetCurrentRequest();
+      unsetLabels();
     }
   }
 

core/src/main/java/google/registry/persistence/converter/BloomFilterConverter.java

@@ -13,8 +13,8 @@
 // limitations under the License.
 package google.registry.persistence.converter;
 
-import static com.google.common.base.Charsets.US_ASCII;
 import static com.google.common.hash.Funnels.stringFunnel;
+import static java.nio.charset.StandardCharsets.US_ASCII;
 
 import com.google.common.hash.BloomFilter;
 import jakarta.persistence.AttributeConverter;

core/src/main/java/google/registry/persistence/transaction/JpaTransactionManagerImpl.java

@@ -276,6 +276,10 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
       }
       T result = work.call();
       txn.commit();
+      long duration = clock.nowUtc().getMillis() - txnInfo.transactionTime.getMillis();
+      if (duration >= 100) {
+        logger.atInfo().log("Transaction duration: %d milliseconds", duration);
+      }
       return result;
     } catch (Throwable e) {
       // Catch a Throwable here so even Errors would lead to a rollback.

core/src/main/java/google/registry/rdap/RdapActionBase.java

@@ -14,14 +14,15 @@
 
 package google.registry.rdap;
 
-import static com.google.common.base.Charsets.UTF_8;
 import static com.google.common.base.Preconditions.checkArgument;
 import static com.google.common.net.HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN;
 import static google.registry.request.Actions.getPathForAction;
 import static google.registry.util.DomainNameUtils.canonicalizeHostname;
 import static jakarta.servlet.http.HttpServletResponse.SC_BAD_REQUEST;
 import static jakarta.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
+import static jakarta.servlet.http.HttpServletResponse.SC_NOT_FOUND;
 import static jakarta.servlet.http.HttpServletResponse.SC_OK;
+import static java.nio.charset.StandardCharsets.UTF_8;
 
 import com.google.common.flogger.FluentLogger;
 import com.google.common.net.MediaType;
@@ -41,6 +42,7 @@ import google.registry.request.Parameter;
 import google.registry.request.RequestMethod;
 import google.registry.request.RequestPath;
 import google.registry.request.Response;
+import google.registry.util.Clock;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Optional;
@@ -60,6 +62,10 @@ public abstract class RdapActionBase implements Runnable {
   private static final MediaType RESPONSE_MEDIA_TYPE =
       MediaType.create("application", "rdap+json").withCharset(UTF_8);
 
+  private static final Gson GSON = new GsonBuilder().disableHtmlEscaping().create();
+  private static final Gson FORMATTED_OUTPUT_GSON =
+      new GsonBuilder().disableHtmlEscaping().setPrettyPrinting().create();
+
   /** Whether to include or exclude deleted items from a query. */
   protected enum DeletedItemHandling {
     EXCLUDE,
@@ -75,6 +81,7 @@ public abstract class RdapActionBase implements Runnable {
   @Inject @Parameter("formatOutput") Optional<Boolean> formatOutputParam;
   @Inject @Config("rdapResultSetMaxSize") int rdapResultSetMaxSize;
   @Inject RdapMetrics rdapMetrics;
+  @Inject Clock clock;
 
   /** Builder for metric recording. */
   final RdapMetrics.RdapMetricInformation.Builder metricInformationBuilder =
@@ -152,6 +159,10 @@ public abstract class RdapActionBase implements Runnable {
       response.setStatus(SC_OK);
       setPayload(replyObject);
       metricInformationBuilder.setStatusCode(SC_OK);
+    } catch (RdapDomainAction.DomainBlockedByBsaException e) {
+      logger.atInfo().withCause(e).log("Domain blocked by BSA");
+      setErrorCodes(SC_NOT_FOUND);
+      setPayload(new RdapObjectClasses.DomainBlockedByBsaErrorResponse(e.getMessage()));
     } catch (HttpException e) {
       logger.atInfo().withCause(e).log("Error in RDAP.");
       setError(e.getResponseCode(), e.getResponseCodeString(), e.getMessage());
@@ -166,8 +177,7 @@ public abstract class RdapActionBase implements Runnable {
   }
 
   void setError(int status, String title, String description) {
-    metricInformationBuilder.setStatusCode(status);
-    response.setStatus(status);
+    setErrorCodes(status);
     try {
       setPayload(ErrorResponse.create(status, title, description));
     } catch (Exception ex) {
@@ -176,21 +186,18 @@ public abstract class RdapActionBase implements Runnable {
     }
   }
 
+  void setErrorCodes(int status) {
+    metricInformationBuilder.setStatusCode(status);
+    response.setStatus(status);
+  }
+
   void setPayload(ReplyPayloadBase replyObject) {
     if (requestMethod == Action.Method.HEAD) {
       return;
     }
-
-    GsonBuilder gsonBuilder = new GsonBuilder();
-    gsonBuilder.disableHtmlEscaping();
-    if (formatOutputParam.orElse(false)) {
-      gsonBuilder.setPrettyPrinting();
-    }
-    Gson gson = gsonBuilder.create();
-
     TopLevelReplyObject topLevelObject =
         TopLevelReplyObject.create(replyObject, rdapJsonFormatter.createTosNotice());
-
+    Gson gson = formatOutputParam.orElse(false) ? FORMATTED_OUTPUT_GSON : GSON;
     response.setPayload(gson.toJson(topLevelObject.toJson()));
   }
 

core/src/main/java/google/registry/rdap/RdapDataStructures.java

@@ -119,7 +119,7 @@ final class RdapDataStructures {
    */
   @AutoValue
   @RestrictJsonNames("notices[]")
-  abstract static class Notice extends NoticeOrRemark {
+  public abstract static class Notice extends NoticeOrRemark {
 
     /**
      * Notice and Remark Type are defined in 10.2.1 of RFC 9083.

core/src/main/java/google/registry/rdap/RdapDomainAction.java

@@ -20,8 +20,11 @@ import static google.registry.request.Action.Method.GET;
 import static google.registry.request.Action.Method.HEAD;
 import static google.registry.util.DateTimeUtils.START_OF_TIME;
 
+import com.google.common.net.InternetDomainName;
 import google.registry.flows.EppException;
+import google.registry.flows.domain.DomainFlowUtils;
 import google.registry.model.domain.Domain;
+import google.registry.model.tld.Tld;
 import google.registry.rdap.RdapJsonFormatter.OutputDataType;
 import google.registry.rdap.RdapMetrics.EndpointType;
 import google.registry.rdap.RdapObjectClasses.RdapDomain;
@@ -51,8 +54,9 @@ public class RdapDomainAction extends RdapActionBase {
     // RDAP Technical Implementation Guide 2.1.1 - we must support A-label (Punycode) and U-label
     // (Unicode) formats. canonicalizeName will transform Unicode to Punycode so we support both.
     pathSearchString = canonicalizeName(pathSearchString);
+    InternetDomainName domainName;
     try {
-      validateDomainName(pathSearchString);
+      domainName = validateDomainName(pathSearchString);
     } catch (EppException e) {
       throw new BadRequestException(
           String.format(
@@ -66,6 +70,7 @@ public class RdapDomainAction extends RdapActionBase {
             pathSearchString,
             shouldIncludeDeleted() ? START_OF_TIME : rdapJsonFormatter.getRequestTime());
     if (domain.isEmpty() || !isAuthorized(domain.get())) {
+      handlePossibleBsaBlock(domainName);
       // RFC7480 5.3 - if the server wishes to respond that it doesn't have data satisfying the
       // query, it MUST reply with 404 response code.
       //
@@ -75,4 +80,17 @@ public class RdapDomainAction extends RdapActionBase {
     }
     return rdapJsonFormatter.createRdapDomain(domain.get(), OutputDataType.FULL);
   }
+
+  private void handlePossibleBsaBlock(InternetDomainName domainName) {
+    Tld tld = Tld.get(domainName.parent().toString());
+    if (DomainFlowUtils.isBlockedByBsa(domainName.parts().getFirst(), tld, clock.nowUtc())) {
+      throw new DomainBlockedByBsaException(domainName + " blocked by BSA");
+    }
+  }
+
+  static class DomainBlockedByBsaException extends RuntimeException {
+    DomainBlockedByBsaException(String message) {
+      super(message);
+    }
+  }
 }

core/src/main/java/google/registry/rdap/RdapIcannStandardInformation.java

@@ -63,8 +63,21 @@ public class RdapIcannStandardInformation {
                   .build())
           .build();
 
+  /** Not required, but provided when a domain is blocked by BSA. */
+  private static final Notice DOMAIN_BLOCKED_BY_BSA_NOTICE =
+      Notice.builder()
+          .setTitle("Blocked Domain")
+          .setDescription("This name has been blocked by a GlobalBlock service")
+          .addLink(
+              Link.builder()
+                  .setRel("alternate")
+                  .setHref("https://brandsafetyalliance.co")
+                  .setType("text/html")
+                  .build())
+          .build();
+
   /** Boilerplate notices required by domain responses. */
-  static final ImmutableList<Notice> domainBoilerplateNotices =
+  static final ImmutableList<Notice> DOMAIN_BOILERPLATE_NOTICES =
       ImmutableList.of(
           CONFORMANCE_NOTICE,
           // RDAP Response Profile 2.6.3
@@ -72,8 +85,12 @@ public class RdapIcannStandardInformation {
           // RDAP Response Profile 2.11
           INACCURACY_COMPLAINT_FORM_NOTICE);
 
+  /** Boilerplate notice for when a domain is blocked by BSA. */
+  static final ImmutableList<Notice> DOMAIN_BLOCKED_BY_BSA_BOILERPLATE_NOTICES =
+      ImmutableList.of(DOMAIN_BLOCKED_BY_BSA_NOTICE);
+
   /** Boilerplate remarks required by nameserver and entity responses. */
-  static final ImmutableList<Notice> nameserverAndEntityBoilerplateNotices =
+  static final ImmutableList<Notice> NAMESERVER_AND_ENTITY_BOILERPLATE_NOTICES =
       ImmutableList.of(CONFORMANCE_NOTICE);
 
   /**

core/src/main/java/google/registry/rdap/RdapJsonFormatter.java

@@ -70,7 +70,7 @@ import google.registry.rdap.RdapObjectClasses.RdapRegistrarEntity;
 import google.registry.rdap.RdapObjectClasses.SecureDns;
 import google.registry.rdap.RdapObjectClasses.Vcard;
 import google.registry.rdap.RdapObjectClasses.VcardArray;
-import google.registry.request.FullServletPath;
+import google.registry.request.RequestServerName;
 import google.registry.util.Clock;
 import jakarta.persistence.Entity;
 import java.net.Inet4Address;
@@ -114,7 +114,7 @@ public class RdapJsonFormatter {
   @Nullable
   String rdapTosStaticUrl;
 
-  @Inject @FullServletPath String fullServletPath;
+  @Inject @RequestServerName String serverName;
   @Inject RdapAuthorization rdapAuthorization;
   @Inject Clock clock;
 
@@ -267,7 +267,7 @@ public class RdapJsonFormatter {
             .setDescription(rdapTos)
             .addLink(selfLink);
     if (rdapTosStaticUrl != null) {
-      URI htmlBaseURI = URI.create(fullServletPath);
+      URI htmlBaseURI = URI.create("https//:" + serverName + "/rdap/");
       URI htmlUri = htmlBaseURI.resolve(rdapTosStaticUrl);
       noticeBuilder.addLink(
           Link.builder()
@@ -1071,7 +1071,7 @@ public class RdapJsonFormatter {
 
   /** Create a link relative to the RDAP server endpoint. */
   String makeRdapServletRelativeUrl(String part, String... moreParts) {
-    return makeServerRelativeUrl(fullServletPath, part, moreParts);
+    return makeServerRelativeUrl("https://" + serverName + "/rdap/", part, moreParts);
   }
 
   /** Create a link relative to some base server */

core/src/main/java/google/registry/rdap/RdapObjectClasses.java

@@ -39,6 +39,7 @@ import google.registry.rdap.RdapDataStructures.RdapConformance;
 import google.registry.rdap.RdapDataStructures.RdapStatus;
 import google.registry.rdap.RdapDataStructures.Remark;
 import google.registry.util.Idn;
+import jakarta.servlet.http.HttpServletResponse;
 import java.util.Optional;
 
 /** Object Classes defined in RFC 9083 section 5. */
@@ -137,10 +138,22 @@ final class RdapObjectClasses {
    * suppress them for other types of responses (e.g. help).
    */
   public enum BoilerplateType {
-    DOMAIN,
-    NAMESERVER,
-    ENTITY,
-    OTHER
+    DOMAIN(RdapIcannStandardInformation.DOMAIN_BOILERPLATE_NOTICES),
+    DOMAIN_BLOCKED_BY_BSA(RdapIcannStandardInformation.DOMAIN_BLOCKED_BY_BSA_BOILERPLATE_NOTICES),
+    NAMESERVER(RdapIcannStandardInformation.NAMESERVER_AND_ENTITY_BOILERPLATE_NOTICES),
+    ENTITY(RdapIcannStandardInformation.NAMESERVER_AND_ENTITY_BOILERPLATE_NOTICES),
+    OTHER(ImmutableList.of());
+
+    @SuppressWarnings("ImmutableEnumChecker") // immutable lists are, in fact, immutable
+    private final ImmutableList<Notice> notices;
+
+    BoilerplateType(ImmutableList<Notice> notices) {
+      this.notices = notices;
+    }
+
+    public ImmutableList<Notice> getNotices() {
+      return notices;
+    }
   }
 
   /**
@@ -173,14 +186,7 @@ final class RdapObjectClasses {
     @JsonableElement("notices[]") abstract Notice aTosNotice();
 
     @JsonableElement("notices") ImmutableList<Notice> boilerplateNotices() {
-      return switch (aAreplyObject().boilerplateType) {
-        case DOMAIN -> RdapIcannStandardInformation.domainBoilerplateNotices;
-        case NAMESERVER, ENTITY ->
-            RdapIcannStandardInformation.nameserverAndEntityBoilerplateNotices;
-        default -> // things other than domains, nameservers and entities do not yet have
-            // boilerplate
-            ImmutableList.of();
-      };
+      return aAreplyObject().boilerplateType.getNotices();
     }
 
     static TopLevelReplyObject create(ReplyPayloadBase replyObject, Notice tosNotice) {
@@ -532,6 +538,25 @@ final class RdapObjectClasses {
     }
   }
 
+  /** Specialized error response body for when a domain is blocked by BSA. */
+  @RestrictJsonNames({})
+  @SuppressWarnings("UnusedVariable")
+  public static class DomainBlockedByBsaErrorResponse extends ReplyPayloadBase {
+
+    @JsonableElement private static final LanguageIdentifier lang = LanguageIdentifier.EN;
+
+    @JsonableElement private static final int errorCode = HttpServletResponse.SC_NOT_FOUND;
+
+    @JsonableElement private static final String title = "Not Found";
+
+    @JsonableElement private final ImmutableList<String> description;
+
+    DomainBlockedByBsaErrorResponse(String message) {
+      super(BoilerplateType.DOMAIN_BLOCKED_BY_BSA);
+      this.description = ImmutableList.of(message);
+    }
+  }
+
   /** Error Response Body defined in 6 of RFC 9083. */
   @RestrictJsonNames({})
   @AutoValue

core/src/main/java/google/registry/rdap/RdapResultSet.java

@@ -27,7 +27,7 @@ import java.util.List;
  * @param numResourcesRetrieved Number of resources retrieved from the database in the process of
  *     assembling the data set.
  */
-record RdapResultSet<T extends EppResource>(
+public record RdapResultSet<T extends EppResource>(
     ImmutableList<T> resources,
     IncompletenessWarningType incompletenessWarningType,
     int numResourcesRetrieved) {

core/src/main/java/google/registry/rdap/RdapSearchActionBase.java

@@ -14,9 +14,9 @@
 
 package google.registry.rdap;
 
-import static com.google.common.base.Charsets.UTF_8;
 import static google.registry.persistence.transaction.TransactionManagerFactory.replicaTm;
 import static google.registry.util.DateTimeUtils.END_OF_TIME;
+import static java.nio.charset.StandardCharsets.UTF_8;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableListMultimap;
@@ -69,7 +69,7 @@ public abstract class RdapSearchActionBase extends RdapActionBase {
   public final BaseSearchResponse getJsonObjectForResource(
       String pathSearchString, boolean isHeadRequest) {
     // The pathSearchString is not used by search commands.
-    if (pathSearchString.length() > 0) {
+    if (!pathSearchString.isEmpty()) {
       throw new BadRequestException("Unexpected path");
     }
     decodeCursorToken();
@@ -323,7 +323,8 @@ public abstract class RdapSearchActionBase extends RdapActionBase {
     if (partialStringQuery.getHasWildcard()) {
       builder =
           builder.where(
-              filterField, criteriaBuilder::like,
+              filterField,
+              criteriaBuilder::like,
               String.format("%s%%", partialStringQuery.getInitialString()));
     } else {
       // no wildcard means we use a standard equals query

core/src/main/java/google/registry/rdap/RdapSearchResults.java

@@ -40,7 +40,7 @@ import java.util.Optional;
 abstract class RdapSearchResults {
 
   /** Responding To Searches defined in 8 of RFC 9083. */
-  abstract static class BaseSearchResponse extends ReplyPayloadBase {
+  public abstract static class BaseSearchResponse extends ReplyPayloadBase {
     abstract IncompletenessWarningType incompletenessWarningType();
     abstract ImmutableMap<String, URI> navigationLinks();
 

core/src/main/java/google/registry/reporting/icann/ActivityReportingQueryBuilder.java

@@ -70,10 +70,10 @@ public final class ActivityReportingQueryBuilder implements QueryBuilder {
 
     ImmutableMap.Builder<String, String> queriesBuilder = ImmutableMap.builder();
     String operationalRegistrarsQuery;
-      operationalRegistrarsQuery =
-          SqlTemplate.create(getQueryFromFile("cloud_sql_registrar_operating_status.sql"))
-              .put("PROJECT_ID", projectId)
-              .build();
+    operationalRegistrarsQuery =
+        SqlTemplate.create(getQueryFromFile(REGISTRAR_OPERATING_STATUS + ".sql"))
+            .put("PROJECT_ID", projectId)
+            .build();
     queriesBuilder.put(
         getTableName(REGISTRAR_OPERATING_STATUS, yearMonth), operationalRegistrarsQuery);
 
@@ -83,9 +83,10 @@ public final class ActivityReportingQueryBuilder implements QueryBuilder {
     // Convert reportingMonth into YYYYMMDD format for Bigquery table partition pattern-matching.
     DateTimeFormatter logTableFormatter = DateTimeFormat.forPattern("yyyyMMdd");
     String monthlyLogsQuery =
-        SqlTemplate.create(getQueryFromFile("monthly_logs.sql"))
+        SqlTemplate.create(getQueryFromFile(MONTHLY_LOGS + ".sql"))
             .put("PROJECT_ID", projectId)
             .put("APPENGINE_LOGS_DATA_SET", "appengine_logs")
+            .put("GKE_LOGS_DATA_SET", "gke_logs")
             .put("REQUEST_TABLE", "appengine_googleapis_com_request_log_")
             .put("FIRST_DAY_OF_MONTH", logTableFormatter.print(firstDayOfMonth))
             .put("LAST_DAY_OF_MONTH", logTableFormatter.print(lastDayOfMonth))
@@ -93,9 +94,10 @@ public final class ActivityReportingQueryBuilder implements QueryBuilder {
     queriesBuilder.put(getTableName(MONTHLY_LOGS, yearMonth), monthlyLogsQuery);
 
     String eppQuery =
-        SqlTemplate.create(getQueryFromFile("epp_metrics.sql"))
+        SqlTemplate.create(getQueryFromFile(EPP_METRICS + ".sql"))
             .put("PROJECT_ID", projectId)
             .put("APPENGINE_LOGS_DATA_SET", "appengine_logs")
+            .put("GKE_LOGS_DATA_SET", "gke_logs")
             .put("APP_LOGS_TABLE", "_var_log_app_")
             .put("FIRST_DAY_OF_MONTH", logTableFormatter.print(firstDayOfMonth))
             .put("LAST_DAY_OF_MONTH", logTableFormatter.print(lastDayOfMonth))
@@ -103,7 +105,7 @@ public final class ActivityReportingQueryBuilder implements QueryBuilder {
     queriesBuilder.put(getTableName(EPP_METRICS, yearMonth), eppQuery);
 
     String whoisQuery =
-        SqlTemplate.create(getQueryFromFile("whois_counts.sql"))
+        SqlTemplate.create(getQueryFromFile(WHOIS_COUNTS + ".sql"))
             .put("PROJECT_ID", projectId)
             .put("ICANN_REPORTING_DATA_SET", icannReportingDataSet)
             .put("MONTHLY_LOGS_TABLE", getTableName(MONTHLY_LOGS, yearMonth))
@@ -111,7 +113,7 @@ public final class ActivityReportingQueryBuilder implements QueryBuilder {
     queriesBuilder.put(getTableName(WHOIS_COUNTS, yearMonth), whoisQuery);
 
     SqlTemplate aggregateQuery =
-        SqlTemplate.create(getQueryFromFile("cloud_sql_activity_report_aggregation.sql"))
+        SqlTemplate.create(getQueryFromFile(ACTIVITY_REPORT_AGGREGATION + ".sql"))
             .put("PROJECT_ID", projectId)
             .put(
                 "REGISTRAR_OPERATING_STATUS_TABLE",

core/src/main/java/google/registry/reporting/icann/TransactionsReportingQueryBuilder.java

@@ -71,27 +71,27 @@ public final class TransactionsReportingQueryBuilder implements QueryBuilder {
 
     ImmutableMap.Builder<String, String> queriesBuilder = ImmutableMap.builder();
     String registrarIanaIdQuery =
-        SqlTemplate.create(getQueryFromFile("cloud_sql_registrar_iana_id.sql"))
+        SqlTemplate.create(getQueryFromFile(REGISTRAR_IANA_ID + ".sql"))
             .put("PROJECT_ID", projectId)
             .build();
     queriesBuilder.put(getTableName(REGISTRAR_IANA_ID, yearMonth), registrarIanaIdQuery);
 
     String totalDomainsQuery =
-        SqlTemplate.create(getQueryFromFile("cloud_sql_total_domains.sql"))
+        SqlTemplate.create(getQueryFromFile(TOTAL_DOMAINS + ".sql"))
             .put("PROJECT_ID", projectId)
             .build();
     queriesBuilder.put(getTableName(TOTAL_DOMAINS, yearMonth), totalDomainsQuery);
 
     DateTimeFormatter timestampFormatter = DateTimeFormat.forPattern("yyyy-MM-dd HH:mm:ss.SSS");
     String totalNameserversQuery =
-        SqlTemplate.create(getQueryFromFile("cloud_sql_total_nameservers.sql"))
+        SqlTemplate.create(getQueryFromFile(TOTAL_NAMESERVERS + ".sql"))
             .put("PROJECT_ID", projectId)
             .put("LATEST_REPORT_TIME", timestampFormatter.print(latestReportTime))
             .build();
     queriesBuilder.put(getTableName(TOTAL_NAMESERVERS, yearMonth), totalNameserversQuery);
 
     String transactionCountsQuery =
-        SqlTemplate.create(getQueryFromFile("cloud_sql_transaction_counts.sql"))
+        SqlTemplate.create(getQueryFromFile(TRANSACTION_COUNTS + ".sql"))
             .put("PROJECT_ID", projectId)
             .put("EARLIEST_REPORT_TIME", timestampFormatter.print(earliestReportTime))
             .put("LATEST_REPORT_TIME", timestampFormatter.print(latestReportTime))
@@ -99,7 +99,7 @@ public final class TransactionsReportingQueryBuilder implements QueryBuilder {
     queriesBuilder.put(getTableName(TRANSACTION_COUNTS, yearMonth), transactionCountsQuery);
 
     String transactionTransferLosingQuery =
-        SqlTemplate.create(getQueryFromFile("cloud_sql_transaction_transfer_losing.sql"))
+        SqlTemplate.create(getQueryFromFile(TRANSACTION_TRANSFER_LOSING + ".sql"))
             .put("PROJECT_ID", projectId)
             .put("EARLIEST_REPORT_TIME", timestampFormatter.print(earliestReportTime))
             .put("LATEST_REPORT_TIME", timestampFormatter.print(latestReportTime))
@@ -110,9 +110,10 @@ public final class TransactionsReportingQueryBuilder implements QueryBuilder {
     // App Engine log table suffixes use YYYYMMDD format
     DateTimeFormatter logTableFormatter = DateTimeFormat.forPattern("yyyyMMdd");
     String attemptedAddsQuery =
-        SqlTemplate.create(getQueryFromFile("cloud_sql_attempted_adds.sql"))
+        SqlTemplate.create(getQueryFromFile(ATTEMPTED_ADDS + ".sql"))
             .put("PROJECT_ID", projectId)
             .put("APPENGINE_LOGS_DATA_SET", "appengine_logs")
+            .put("GKE_LOGS_DATA_SET", "gke_logs")
             .put("APP_LOGS_TABLE", "_var_log_app_")
             .put("FIRST_DAY_OF_MONTH", logTableFormatter.print(earliestReportTime))
             .put("LAST_DAY_OF_MONTH", logTableFormatter.print(latestReportTime))
@@ -120,7 +121,7 @@ public final class TransactionsReportingQueryBuilder implements QueryBuilder {
     queriesBuilder.put(getTableName(ATTEMPTED_ADDS, yearMonth), attemptedAddsQuery);
 
     String aggregateQuery =
-        SqlTemplate.create(getQueryFromFile("cloud_sql_transactions_report_aggregation.sql"))
+        SqlTemplate.create(getQueryFromFile(TRANSACTIONS_REPORT_AGGREGATION + ".sql"))
             .put("PROJECT_ID", projectId)
             .put("ICANN_REPORTING_DATA_SET", icannReportingDataSet)
             .put("REGISTRAR_IANA_ID_TABLE", getTableName(REGISTRAR_IANA_ID, yearMonth))

core/src/main/java/google/registry/request/HttpException.java

@@ -20,6 +20,7 @@ import com.google.common.flogger.FluentLogger;
 import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.util.logging.Level;
+import javax.annotation.Nullable;
 
 /** Base for exceptions that cause an HTTP error response. */
 public abstract class HttpException extends RuntimeException {
@@ -33,13 +34,14 @@ public abstract class HttpException extends RuntimeException {
 
   private final int responseCode;
 
-  protected HttpException(int responseCode, String message, Throwable cause, Level logLevel) {
+  protected HttpException(
+      int responseCode, String message, @Nullable Throwable cause, Level logLevel) {
     super(message, cause);
     this.responseCode = responseCode;
     this.logLevel = logLevel;
   }
 
-  protected HttpException(int responseCode, String message, Throwable cause) {
+  protected HttpException(int responseCode, String message, @Nullable Throwable cause) {
     this(responseCode, message, cause, Level.INFO);
   }
 
@@ -117,22 +119,6 @@ public abstract class HttpException extends RuntimeException {
     }
   }
 
-  /** Exception that causes a 403 response. */
-  public static final class ForbiddenException extends HttpException {
-    public ForbiddenException(String message) {
-      super(HttpServletResponse.SC_FORBIDDEN, message, null);
-    }
-
-    public ForbiddenException(String message, Exception cause) {
-      super(HttpServletResponse.SC_FORBIDDEN, message, cause);
-    }
-
-    @Override
-    public String getResponseCodeString() {
-      return "Forbidden";
-    }
-  }
-
   /** Exception that causes a 404 response. */
   public static final class NotFoundException extends HttpException {
     public NotFoundException() {
@@ -149,18 +135,6 @@ public abstract class HttpException extends RuntimeException {
     }
   }
 
-  /** Exception that causes a 405 response. */
-  public static final class MethodNotAllowedException extends HttpException {
-    public MethodNotAllowedException() {
-      super(HttpServletResponse.SC_METHOD_NOT_ALLOWED, "Method not allowed", null);
-    }
-
-    @Override
-    public String getResponseCodeString() {
-      return "Method Not Allowed";
-    }
-  }
-
   /** Exception that causes a 409 response. */
   public static final class ConflictException extends HttpException {
     public ConflictException(String message) {

core/src/main/java/google/registry/request/RequestModule.java

@@ -151,17 +151,9 @@ public final class RequestModule {
    * query string.
    */
   @Provides
-  @FullServletPath
-  static String provideFullServletPath(HttpServletRequest req) {
-    // Include the port only if it differs from the default for the scheme.
-    if (("http".equals(req.getScheme()) && (req.getServerPort() == 80))
-        || ("https".equals(req.getScheme()) && (req.getServerPort() == 443))) {
-      return String.format("%s://%s%s", req.getScheme(), req.getServerName(), req.getServletPath());
-    } else {
-      return String.format(
-          "%s://%s:%d%s",
-          req.getScheme(), req.getServerName(), req.getServerPort(), req.getServletPath());
-    }
+  @RequestServerName
+  static String provideServerName(HttpServletRequest req) {
+    return req.getServerName();
   }
 
   @Provides

core/src/main/java/google/registry/request/RequestServerName.java

@@ -20,11 +20,11 @@ import java.lang.annotation.RetentionPolicy;
 import javax.inject.Qualifier;
 
 /**
- * Dagger qualifier for the HTTP servlet path, prepended with scheme, host and port.
+ * Dagger qualifier for the server name of the HTTP request.
  *
- * <p>See {@link jakarta.servlet.http.HttpServletRequest#getServletPath}
+ * <p>See {@link jakarta.servlet.http.HttpServletRequest#getServerName()}
  */
 @Qualifier
 @Documented
 @Retention(RetentionPolicy.RUNTIME)
-public @interface FullServletPath {}
+public @interface RequestServerName {}

core/src/main/java/google/registry/request/auth/OidcTokenAuthenticationMechanism.java

@@ -106,7 +106,7 @@ public abstract class OidcTokenAuthenticationMechanism implements Authentication
 
     String email = (String) token.getPayload().get("email");
     if (email == null) {
-      logger.atWarning().log("No email address from the OIDC token:\n%s", token.getPayload());
+      logger.atInfo().log("No email address from the OIDC token:\n%s", token.getPayload());
       return AuthResult.NOT_AUTHENTICATED;
     }
     Optional<User> maybeUser =

core/src/main/java/google/registry/tools/RegistryCli.java

@@ -25,7 +25,6 @@ import com.beust.jcommander.Parameters;
 import com.beust.jcommander.ParametersDelegate;
 import com.google.common.base.Throwables;
 import com.google.common.collect.ImmutableMap;
-import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.Iterables;
 import google.registry.persistence.transaction.JpaTransactionManager;
 import google.registry.persistence.transaction.TransactionManagerFactory;
@@ -42,10 +41,6 @@ import org.postgresql.util.PSQLException;
 @Parameters(separators = " =", commandDescription = "Command-line interface to the registry")
 final class RegistryCli implements CommandRunner {
 
-  private static final ImmutableSet<RegistryToolEnvironment> DEFAULT_GKE_ENVIRONMENTS =
-      ImmutableSet.of(
-          RegistryToolEnvironment.ALPHA, RegistryToolEnvironment.CRASH, RegistryToolEnvironment.QA);
-
   // The environment parameter is parsed twice: once here, and once with {@link
   // RegistryToolEnvironment#parseFromArgs} in the {@link RegistryTool#main} function.
   //
@@ -75,9 +70,6 @@ final class RegistryCli implements CommandRunner {
               + "Beam pipelines")
   private String sqlAccessInfoFile = null;
 
-  @Parameter(names = "--gke", description = "Whether to use GKE runtime, instead of GAE")
-  private boolean useGke = false;
-
   @Parameter(names = "--gae", description = "Whether to use GAE runtime, instead of GKE")
   private boolean useGae = false;
 
@@ -158,12 +150,6 @@ final class RegistryCli implements CommandRunner {
       throw e;
     }
 
-    checkState(!useGke || !useGae, "Cannot specify both --gke and --gae");
-    // Special logic to set the default based on the environment if neither --gae nor --gke is set.
-    if (!useGke && !useGae) {
-      useGke = DEFAULT_GKE_ENVIRONMENTS.contains(environment);
-    }
-
     String parsedCommand = jcommander.getParsedCommand();
     // Show the list of all commands either if requested or if no subcommand name was specified
     // (which does not throw a ParameterException parse error above).
@@ -183,7 +169,7 @@ final class RegistryCli implements CommandRunner {
         DaggerRegistryToolComponent.builder()
             .credentialFilePath(credentialJson)
             .sqlAccessInfoFile(sqlAccessInfoFile)
-            .useGke(useGke)
+            .useGke(!useGae)
             .useCanary(useCanary)
             .build();
 

core/src/main/java/google/registry/ui/server/console/ConsoleUsersAction.java

@@ -31,12 +31,14 @@ import com.google.api.services.directory.Directory;
 import com.google.api.services.directory.model.UserName;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
 import com.google.gson.annotations.Expose;
 import google.registry.config.RegistryConfig.Config;
 import google.registry.model.console.ConsolePermission;
 import google.registry.model.console.RegistrarRole;
 import google.registry.model.console.User;
 import google.registry.model.console.UserRoles;
+import google.registry.model.registrar.Registrar;
 import google.registry.persistence.VKey;
 import google.registry.request.Action;
 import google.registry.request.Action.GkeService;
@@ -44,6 +46,7 @@ import google.registry.request.HttpException.BadRequestException;
 import google.registry.request.Parameter;
 import google.registry.request.auth.Auth;
 import google.registry.tools.IamClient;
+import google.registry.util.DiffUtils;
 import google.registry.util.StringGenerator;
 import java.io.IOException;
 import java.util.List;
@@ -96,24 +99,14 @@ public class ConsoleUsersAction extends ConsoleApiAction {
 
   @Override
   protected void postHandler(User user) {
-    // Temporary flag while testing
-    if (user.getUserRoles().isAdmin()) {
-      checkPermission(user, registrarId, ConsolePermission.MANAGE_USERS);
-      tm().transact(this::runPostInTransaction);
-    } else {
-      consoleApiParams.response().setStatus(SC_FORBIDDEN);
-    }
+    checkPermission(user, registrarId, ConsolePermission.MANAGE_USERS);
+    tm().transact(this::runPostInTransaction);
   }
 
   @Override
   protected void putHandler(User user) {
-    // Temporary flag while testing
-    if (user.getUserRoles().isAdmin()) {
-      checkPermission(user, registrarId, ConsolePermission.MANAGE_USERS);
-      tm().transact(this::runUpdateInTransaction);
-    } else {
-      consoleApiParams.response().setStatus(SC_FORBIDDEN);
-    }
+    checkPermission(user, registrarId, ConsolePermission.MANAGE_USERS);
+    tm().transact(this::runUpdateInTransaction);
   }
 
   @Override
@@ -135,13 +128,8 @@ public class ConsoleUsersAction extends ConsoleApiAction {
 
   @Override
   protected void deleteHandler(User user) {
-    // Temporary flag while testing
-    if (user.getUserRoles().isAdmin()) {
-      checkPermission(user, registrarId, ConsolePermission.MANAGE_USERS);
-      tm().transact(this::runDeleteInTransaction);
-    } else {
-      consoleApiParams.response().setStatus(SC_FORBIDDEN);
-    }
+    checkPermission(user, registrarId, ConsolePermission.MANAGE_USERS);
+    tm().transact(this::runDeleteInTransaction);
   }
 
   private void runPostInTransaction() throws IOException {
@@ -163,6 +151,8 @@ public class ConsoleUsersAction extends ConsoleApiAction {
         this.userData.get().emailAddress,
         registrarId,
         RegistrarRole.valueOf(this.userData.get().role));
+
+    sendConfirmationEmail(registrarId, this.userData.get().emailAddress, "Added existing user");
     consoleApiParams.response().setStatus(SC_OK);
   }
 
@@ -186,6 +176,7 @@ public class ConsoleUsersAction extends ConsoleApiAction {
       VKey<User> key = VKey.create(User.class, email);
       tm().delete(key);
       User.revokeIapPermission(email, maybeGroupEmailAddress, cloudTasksUtils, null, iamClient);
+      sendConfirmationEmail(registrarId, email, "Deleted user");
     }
 
     consoleApiParams.response().setStatus(SC_OK);
@@ -225,13 +216,14 @@ public class ConsoleUsersAction extends ConsoleApiAction {
 
     UserRoles userRoles =
         new UserRoles.Builder()
-            .setRegistrarRoles(ImmutableMap.of(registrarId, ACCOUNT_MANAGER))
+            .setRegistrarRoles(
+                ImmutableMap.of(registrarId, RegistrarRole.valueOf(userData.get().role)))
             .build();
 
     User.Builder builder = new User.Builder().setUserRoles(userRoles).setEmailAddress(newEmail);
     tm().put(builder.build());
     User.grantIapPermission(newEmail, maybeGroupEmailAddress, cloudTasksUtils, null, iamClient);
-
+    sendConfirmationEmail(registrarId, newEmail, "Created user");
     consoleApiParams.response().setStatus(SC_CREATED);
     consoleApiParams
         .response()
@@ -250,6 +242,8 @@ public class ConsoleUsersAction extends ConsoleApiAction {
         this.userData.get().emailAddress,
         registrarId,
         RegistrarRole.valueOf(this.userData.get().role));
+
+    sendConfirmationEmail(registrarId, this.userData.get().emailAddress, "Updated user");
     consoleApiParams.response().setStatus(SC_OK);
   }
 
@@ -314,6 +308,20 @@ public class ConsoleUsersAction extends ConsoleApiAction {
                     .collect(toImmutableList()));
   }
 
+  private boolean sendConfirmationEmail(String registrarId, String emailAddress, String operation) {
+    Optional<Registrar> registrar = Registrar.loadByRegistrarId(registrarId);
+    if (registrar.isEmpty()) { // Shouldn't happen, but worth checking
+      setFailedResponse(
+          "Failed to send an email to registrar " + registrarId, SC_INTERNAL_SERVER_ERROR);
+      return false;
+    }
+    sendExternalUpdates(
+        ImmutableMap.of("Console users updated", new DiffUtils.DiffPair(operation, emailAddress)),
+        registrar.get(),
+        ImmutableSet.of());
+    return true;
+  }
+
   public record UserData(
       @Expose String emailAddress, @Expose String role, @Expose @Nullable String password) {}
 }

core/src/main/java/google/registry/ui/server/console/domains/ConsoleBulkDomainAction.java

@@ -15,7 +15,6 @@
 package google.registry.ui.server.console.domains;
 
 import static com.google.common.collect.ImmutableMap.toImmutableMap;
-import static jakarta.servlet.http.HttpServletResponse.SC_FORBIDDEN;
 import static jakarta.servlet.http.HttpServletResponse.SC_OK;
 import static java.nio.charset.StandardCharsets.UTF_8;
 
@@ -81,11 +80,6 @@ public class ConsoleBulkDomainAction extends ConsoleApiAction {
 
   @Override
   protected void postHandler(User user) {
-    // Temporary flag while testing
-    if (!user.getUserRoles().isAdmin()) {
-      consoleApiParams.response().setStatus(SC_FORBIDDEN);
-      return;
-    }
     JsonElement jsonPayload =
         optionalJsonPayload.orElseThrow(
             () -> new IllegalArgumentException("Bulk action payload must be present"));

core/src/main/java/google/registry/ui/server/console/domains/ConsoleBulkDomainDeleteActionType.java

@@ -14,12 +14,11 @@
 
 package google.registry.ui.server.console.domains;
 
-import com.google.common.collect.ImmutableMap;
 import com.google.gson.JsonElement;
 import google.registry.model.console.ConsolePermission;
 
 /** An action that will run a delete EPP command on the given domain. */
-public class ConsoleBulkDomainDeleteActionType implements ConsoleDomainActionType {
+public class ConsoleBulkDomainDeleteActionType extends ConsoleDomainActionType {
 
   private static final String DOMAIN_DELETE_XML =
       """
@@ -42,16 +41,13 @@ public class ConsoleBulkDomainDeleteActionType implements ConsoleDomainActionTyp
   </command>
 </epp>""";
 
-  private final String reason;
-
   public ConsoleBulkDomainDeleteActionType(JsonElement jsonElement) {
-    this.reason = jsonElement.getAsJsonObject().get("reason").getAsString();
+    super(jsonElement);
   }
 
   @Override
-  public String getXmlContentsToRun(String domainName) {
-    return ConsoleDomainActionType.fillSubstitutions(
-        DOMAIN_DELETE_XML, ImmutableMap.of("DOMAIN_NAME", domainName, "REASON", reason));
+  protected String getXmlTemplate() {
+    return DOMAIN_DELETE_XML;
   }
 
   @Override

core/src/main/java/google/registry/ui/server/console/domains/ConsoleBulkDomainSuspendActionType.java

@@ -14,12 +14,11 @@
 
 package google.registry.ui.server.console.domains;
 
-import com.google.common.collect.ImmutableMap;
 import com.google.gson.JsonElement;
 import google.registry.model.console.ConsolePermission;
 
 /** An action that will suspend the given domain, assigning all 5 server*Prohibited statuses. */
-public class ConsoleBulkDomainSuspendActionType implements ConsoleDomainActionType {
+public class ConsoleBulkDomainSuspendActionType extends ConsoleDomainActionType {
 
   private static final String DOMAIN_SUSPEND_XML =
       """
@@ -52,16 +51,13 @@ public class ConsoleBulkDomainSuspendActionType implements ConsoleDomainActionTy
   </command>
 </epp>""";
 
-  private final String reason;
-
   public ConsoleBulkDomainSuspendActionType(JsonElement jsonElement) {
-    this.reason = jsonElement.getAsJsonObject().get("reason").getAsString();
+    super(jsonElement);
   }
 
   @Override
-  public String getXmlContentsToRun(String domainName) {
-    return ConsoleDomainActionType.fillSubstitutions(
-        DOMAIN_SUSPEND_XML, ImmutableMap.of("DOMAIN_NAME", domainName, "REASON", reason));
+  protected String getXmlTemplate() {
+    return DOMAIN_SUSPEND_XML;
   }
 
   @Override

core/src/main/java/google/registry/ui/server/console/domains/ConsoleBulkDomainUnsuspendActionType.java

@@ -0,0 +1,67 @@
+// Copyright 2025 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.ui.server.console.domains;
+
+import com.google.gson.JsonElement;
+import google.registry.model.console.ConsolePermission;
+
+/** An action that will unsuspend the given domain, removing all 5 server*Prohibited statuses. */
+public class ConsoleBulkDomainUnsuspendActionType extends ConsoleDomainActionType {
+
+  private static final String DOMAIN_SUSPEND_XML =
+      """
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<epp
+  xmlns="urn:ietf:params:xml:ns:epp-1.0">
+  <command>
+    <update>
+      <domain:update
+        xmlns:domain="urn:ietf:params:xml:ns:domain-1.0">
+        <domain:name>%DOMAIN_NAME%</domain:name>
+        <domain:add></domain:add>
+        <domain:rem>
+          <domain:status s="serverDeleteProhibited" lang="en"></domain:status>
+          <domain:status s="serverHold" lang="en"></domain:status>
+          <domain:status s="serverRenewProhibited" lang="en"></domain:status>
+          <domain:status s="serverTransferProhibited" lang="en"></domain:status>
+          <domain:status s="serverUpdateProhibited" lang="en"></domain:status>
+        </domain:rem>
+      </domain:update>
+    </update>
+    <extension>
+      <metadata:metadata
+        xmlns:metadata="urn:google:params:xml:ns:metadata-1.0">
+        <metadata:reason>Console unsuspension: %REASON%</metadata:reason>
+        <metadata:requestedByRegistrar>false</metadata:requestedByRegistrar>
+      </metadata:metadata>
+    </extension>
+    <clTRID>RegistryConsole</clTRID>
+  </command>
+</epp>""";
+
+  public ConsoleBulkDomainUnsuspendActionType(JsonElement jsonElement) {
+    super(jsonElement);
+  }
+
+  @Override
+  protected String getXmlTemplate() {
+    return DOMAIN_SUSPEND_XML;
+  }
+
+  @Override
+  public ConsolePermission getNecessaryPermission() {
+    return ConsolePermission.SUSPEND_DOMAIN;
+  }
+}

core/src/main/java/google/registry/ui/server/console/domains/ConsoleDomainActionType.java

@@ -14,24 +14,23 @@
 
 package google.registry.ui.server.console.domains;
 
-import com.google.common.collect.ImmutableMap;
 import com.google.common.escape.Escaper;
 import com.google.common.xml.XmlEscapers;
 import com.google.gson.JsonElement;
 import google.registry.model.console.ConsolePermission;
-import java.util.Map;
 
 /**
  * A type of EPP action to perform on domain(s), run by the {@link ConsoleBulkDomainAction}.
  *
- * <p>Each {@link BulkAction} defines the class that implements that action, including the EPP XML
- * that will be run and the permission required.
+ * <p>Each {@link BulkAction} defines the class that extends that action, including the EPP XML that
+ * will be run and the permission required.
  */
-public interface ConsoleDomainActionType {
+public abstract class ConsoleDomainActionType {
 
   enum BulkAction {
     DELETE(ConsoleBulkDomainDeleteActionType.class),
-    SUSPEND(ConsoleBulkDomainSuspendActionType.class);
+    SUSPEND(ConsoleBulkDomainSuspendActionType.class),
+    UNSUSPEND(ConsoleBulkDomainUnsuspendActionType.class);
 
     private final Class<? extends ConsoleDomainActionType> actionClass;
 
@@ -44,20 +43,6 @@ public interface ConsoleDomainActionType {
     }
   }
 
-  Escaper XML_ESCAPER = XmlEscapers.xmlContentEscaper();
-
-  static String fillSubstitutions(String xmlTemplate, ImmutableMap<String, String> replacements) {
-    String xml = xmlTemplate;
-    for (Map.Entry<String, String> entry : replacements.entrySet()) {
-      xml = xml.replaceAll("%" + entry.getKey() + "%", XML_ESCAPER.escape(entry.getValue()));
-    }
-    return xml;
-  }
-
-  String getXmlContentsToRun(String domainName);
-
-  ConsolePermission getNecessaryPermission();
-
   static ConsoleDomainActionType parseActionType(String bulkDomainAction, JsonElement jsonElement) {
     BulkAction bulkAction = BulkAction.valueOf(bulkDomainAction);
     try {
@@ -66,4 +51,38 @@ public interface ConsoleDomainActionType {
       throw new RuntimeException(e); // shouldn't happen
     }
   }
+
+  private static final Escaper XML_ESCAPER = XmlEscapers.xmlContentEscaper();
+
+  private final String reason;
+
+  public ConsoleDomainActionType(JsonElement jsonElement) {
+    this.reason = jsonElement.getAsJsonObject().get("reason").getAsString();
+  }
+
+  /** Returns the full XML representing this action, including all substitutions. */
+  public String getXmlContentsToRun(String domainName) {
+    return fillSubstitutions(getXmlTemplate(), domainName);
+  }
+
+  /** Returns the permission necessary to successfully perform this action. */
+  public abstract ConsolePermission getNecessaryPermission();
+
+  /** Returns the XML template contents for this action. */
+  protected abstract String getXmlTemplate();
+
+  /**
+   * Fills out the default set of substitutions in the provided XML template.
+   *
+   * <p>Override this method if non-default substitutions are required.
+   */
+  protected String fillSubstitutions(String xmlTemplate, String domainName) {
+    String xml = xmlTemplate;
+    xml = replaceValue(xml, "DOMAIN_NAME", domainName);
+    return replaceValue(xml, "REASON", reason);
+  }
+
+  private String replaceValue(String xml, String key, String value) {
+    return xml.replaceAll("%" + key + "%", XML_ESCAPER.escape(value));
+  }
 }

core/src/main/resources/google/registry/reporting/icann/sql/attempted_adds.sql

@@ -19,7 +19,7 @@
   -- monthly App Engine logs, searching for all create commands and associating
   -- them with their corresponding registrars.
 
-  -- Example log generated by FlowReporter in App Engine logs:
+  -- Example log generated by FlowReporter in App Engine and GKE logs:
   --google.registry.flows.FlowReporter
   -- recordToLogs: FLOW-LOG-SIGNATURE-METADATA:
   --{"serverTrid":"oNwL2J2eRya7bh7c9oHIzg==-2360a","clientId":"ipmirror"
@@ -38,30 +38,42 @@ FROM (
     JSON_EXTRACT_SCALAR(json, '$.tld') AS tld,
     JSON_EXTRACT_SCALAR(json, '$.clientId') AS clientId,
     COUNT(json) AS count
-  FROM (
+  FROM ((
       -- Extract JSON metadata package from monthly logs
     SELECT
-      REGEXP_EXTRACT(textPayload, r'FLOW-LOG-SIGNATURE-METADATA: (.*)\n?$')
-          AS json
-    FROM (
+      REGEXP_EXTRACT(textPayload, r'FLOW-LOG-SIGNATURE-METADATA: (.*)\n?$') AS json
+    FROM
+      `%PROJECT_ID%.%APPENGINE_LOGS_DATA_SET%.%APP_LOGS_TABLE%*`
+    WHERE
+      _TABLE_SUFFIX BETWEEN '%FIRST_DAY_OF_MONTH%'
+      AND '%LAST_DAY_OF_MONTH%'
+      AND STARTS_WITH(textPayload, "FLOW-LOG-SIGNATURE-METADATA")
+      -- Look for domain creates
+      AND REGEXP_CONTAINS(textPayload, r'"commandType":"create","resourceType":"domain"')
+      -- Filter prober data
+      AND NOT REGEXP_CONTAINS(textPayload, r'"prober-[a-z]{2}-((any)|(canary))"'))
+    UNION ALL (
+        -- Extract JSON metadata package from monthly logs
       SELECT
-        textPayload
+        REGEXP_EXTRACT(jsonPayload.message, r'FLOW-LOG-SIGNATURE-METADATA: (.*)\n?$') AS json
       FROM
-        `%PROJECT_ID%.%APPENGINE_LOGS_DATA_SET%.%APP_LOGS_TABLE%*`
-      WHERE _TABLE_SUFFIX
-      BETWEEN '%FIRST_DAY_OF_MONTH%'
-      AND '%LAST_DAY_OF_MONTH%')
-    WHERE STARTS_WITH(textPayload, "FLOW-LOG-SIGNATURE-METADATA")
-    -- Look for domain creates
-    AND REGEXP_CONTAINS(
-       textPayload, r'"commandType":"create","resourceType":"domain"')
-    -- Filter prober data
-    AND NOT REGEXP_CONTAINS(
-        textPayload, r'"prober-[a-z]{2}-((any)|(canary))"') )
-  GROUP BY tld, clientId ) AS logs_table
+        `%PROJECT_ID%.%GKE_LOGS_DATA_SET%.stderr_*`
+      WHERE
+        _TABLE_SUFFIX BETWEEN '%FIRST_DAY_OF_MONTH%'
+        AND '%LAST_DAY_OF_MONTH%'
+        AND STARTS_WITH(jsonPayload.message, "FLOW-LOG-SIGNATURE-METADATA")
+        -- Look for domain creates
+        AND REGEXP_CONTAINS(jsonPayload.message, r'"commandType":"create","resourceType":"domain"')
+        -- Filter prober data
+        AND NOT REGEXP_CONTAINS(jsonPayload.message, r'"prober-[a-z]{2}-((any)|(canary))"')))
+  GROUP BY
+    tld,
+    clientId ) AS logs_table
 JOIN
   EXTERNAL_QUERY("projects/%PROJECT_ID%/locations/us/connections/%PROJECT_ID%-sql",
-              '''SELECT registrar_id, registrar_name FROM "Registrar";''') AS registrar_table
-  ON
-      logs_table.clientId = registrar_table.registrar_id
-  ORDER BY tld, registrar_name
+    '''SELECT registrar_id, registrar_name FROM "Registrar";''') AS registrar_table
+ON
+  logs_table.clientId = registrar_table.registrar_id
+ORDER BY
+  tld,
+  registrar_name

core/src/main/resources/google/registry/reporting/icann/sql/epp_metrics.sql

@@ -35,14 +35,30 @@ FROM (
     JSON_EXTRACT_SCALAR(json,
       '$.icannActivityReportField') AS activityReportField
   FROM (
+    -- For reasons that I don't understand, if I directly select the three columns
+    -- from the union, BigQuery complains about column number mismatch, so I have to
+    -- make a temporary union table and select on it.
     SELECT
-      -- Extract the logged JSON payload.
-      REGEXP_EXTRACT(textPayload, r'FLOW-LOG-SIGNATURE-METADATA: (.*)\n?$')
-      AS json
-    FROM `%PROJECT_ID%.%APPENGINE_LOGS_DATA_SET%.%APP_LOGS_TABLE%*`
-    WHERE
-      STARTS_WITH(textPayload, "FLOW-LOG-SIGNATURE-METADATA")
-      AND _TABLE_SUFFIX BETWEEN '%FIRST_DAY_OF_MONTH%' AND '%LAST_DAY_OF_MONTH%')) AS regexes
+      *
+    FROM (
+      SELECT
+        -- Extract the logged JSON payload.
+        REGEXP_EXTRACT(textPayload, r'FLOW-LOG-SIGNATURE-METADATA: (.*)\n?$')
+        AS json
+      FROM `%PROJECT_ID%.%APPENGINE_LOGS_DATA_SET%.%APP_LOGS_TABLE%*`
+      WHERE
+        STARTS_WITH(textPayload, "FLOW-LOG-SIGNATURE-METADATA")
+        AND _TABLE_SUFFIX BETWEEN '%FIRST_DAY_OF_MONTH%' AND '%LAST_DAY_OF_MONTH%')
+    UNION ALL (
+      SELECT
+        -- Extract the logged JSON payload.
+        REGEXP_EXTRACT(jsonPayload.message, r'FLOW-LOG-SIGNATURE-METADATA: (.*)\n?$')
+        AS json
+      FROM `%PROJECT_ID%.%GKE_LOGS_DATA_SET%.stderr_*`
+      WHERE
+        STARTS_WITH(jsonPayload.message, "FLOW-LOG-SIGNATURE-METADATA")
+        AND _TABLE_SUFFIX BETWEEN '%FIRST_DAY_OF_MONTH%' AND '%LAST_DAY_OF_MONTH%')
+  )) AS regexes
 JOIN
   -- Unnest the JSON-parsed tlds.
   UNNEST(regexes.tlds) AS tld

core/src/main/resources/google/registry/reporting/icann/sql/monthly_logs.sql

@@ -13,13 +13,23 @@
   -- See the License for the specific language governing permissions and
   -- limitations under the License.
 
-  -- Query to fetch AppEngine request logs for the report month.
+  -- Query to fetch AppEngine and GKE request logs for the report month.
 
   -- START_OF_MONTH and END_OF_MONTH should be in YYYYMM01 format.
 
 SELECT
-  protoPayload.resource AS requestPath,
-FROM
-  `%PROJECT_ID%.%APPENGINE_LOGS_DATA_SET%.%REQUEST_TABLE%*`
-WHERE
-  _TABLE_SUFFIX BETWEEN '%FIRST_DAY_OF_MONTH%' AND '%LAST_DAY_OF_MONTH%'
+  *
+FROM (
+  SELECT
+    jsonPayload.httrequest.requesturl AS requestPath
+  FROM
+    `%PROJECT_ID%.%GKE_LOGS_DATA_SET%.stderr_*`
+  WHERE
+    _TABLE_SUFFIX BETWEEN '%FIRST_DAY_OF_MONTH%' AND '%LAST_DAY_OF_MONTH%')
+UNION ALL (
+  SELECT
+    protoPayload.resource AS requestPath
+  FROM
+    `%PROJECT_ID%.%APPENGINE_LOGS_DATA_SET%.%REQUEST_TABLE%*`
+  WHERE
+    _TABLE_SUFFIX BETWEEN '%FIRST_DAY_OF_MONTH%' AND '%LAST_DAY_OF_MONTH%')

core/src/test/java/google/registry/flows/domain/DomainCreateFlowTest.java

@@ -161,8 +161,6 @@ import google.registry.model.common.FeatureFlag;
 import google.registry.model.domain.Domain;
 import google.registry.model.domain.DomainHistory;
 import google.registry.model.domain.GracePeriod;
-import google.registry.model.domain.fee.BaseFee.FeeType;
-import google.registry.model.domain.fee.Fee;
 import google.registry.model.domain.fee.FeeQueryCommandExtensionItem.CommandName;
 import google.registry.model.domain.launch.LaunchNotice;
 import google.registry.model.domain.rgp.GracePeriodStatus;
@@ -287,59 +285,45 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     persistContactsAndHosts("net"); // domain_create.xml uses hosts on "net".
   }
 
+  private void assertSuccessfulCreate(String domainTld, ImmutableSet<Flag> expectedBillingFlags)
+      throws Exception {
+    assertSuccessfulCreate(domainTld, expectedBillingFlags, null, 24, null);
+  }
+
   private void assertSuccessfulCreate(
-      String domainTld, ImmutableSet<BillingBase.Flag> expectedBillingFlags) throws Exception {
-    assertSuccessfulCreate(domainTld, expectedBillingFlags, null);
+      String domainTld, ImmutableSet<Flag> expectedBillingFlags, double createCost)
+      throws Exception {
+    assertSuccessfulCreate(domainTld, expectedBillingFlags, null, createCost, null);
+  }
+
+  private void assertSuccessfulCreate(
+      String domainTld, ImmutableSet<Flag> expectedBillingFlags, AllocationToken token)
+      throws Exception {
+    assertSuccessfulCreate(domainTld, expectedBillingFlags, token, 24, null);
   }
 
   private void assertSuccessfulCreate(
       String domainTld,
-      ImmutableSet<BillingBase.Flag> expectedBillingFlags,
-      @Nullable AllocationToken allocationToken)
+      ImmutableSet<Flag> expectedBillingFlags,
+      AllocationToken token,
+      double createCost)
+      throws Exception {
+    assertSuccessfulCreate(domainTld, expectedBillingFlags, token, createCost, null);
+  }
+
+  private void assertSuccessfulCreate(
+      String domainTld,
+      ImmutableSet<Flag> expectedBillingFlags,
+      @Nullable AllocationToken token,
+      double createCost,
+      @Nullable Integer specifiedRenewCost)
       throws Exception {
     Domain domain = reloadResourceByForeignKey();
 
     boolean isAnchorTenant = expectedBillingFlags.contains(ANCHOR_TENANT);
     // Set up the creation cost.
     boolean isDomainPremium = isDomainPremium(getUniqueIdFromCommand(), clock.nowUtc());
-    BigDecimal createCost = isDomainPremium ? BigDecimal.valueOf(200) : BigDecimal.valueOf(24);
-    if (isAnchorTenant) {
-      createCost = BigDecimal.ZERO;
-    }
-    if (expectedBillingFlags.contains(SUNRISE)) {
-      createCost =
-          createCost.multiply(
-              BigDecimal.valueOf(1 - RegistryConfig.getSunriseDomainCreateDiscount()));
-    }
-    if (allocationToken != null) {
-      if (allocationToken
-          .getRegistrationBehavior()
-          .equals(RegistrationBehavior.NONPREMIUM_CREATE)) {
-        createCost =
-            createCost.subtract(
-                BigDecimal.valueOf(isDomainPremium ? 87 : 0)); // premium is 100, standard 13
-      }
-      if (allocationToken.getRenewalPriceBehavior().equals(NONPREMIUM)) {
-        createCost =
-            createCost.subtract(
-                BigDecimal.valueOf(isDomainPremium ? 89 : 0)); // premium is 100, standard 11
-      }
-      if (allocationToken.getRenewalPriceBehavior().equals(SPECIFIED)) {
-        createCost =
-            createCost
-                .subtract(BigDecimal.valueOf(isDomainPremium ? 100 : 11))
-                .add(allocationToken.getRenewalPrice().get().getAmount());
-      }
-    }
-    FeesAndCredits feesAndCredits =
-        new FeesAndCredits.Builder()
-            .setCurrency(USD)
-            .addFeeOrCredit(
-                Fee.create(
-                    createCost,
-                    FeeType.CREATE,
-                    isDomainPremium(getUniqueIdFromCommand(), clock.nowUtc())))
-            .build();
+
     Money eapFee =
         Money.of(
             Tld.get(domainTld).getCurrency(),
@@ -362,7 +346,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     RenewalPriceBehavior expectedRenewalPriceBehavior =
         isAnchorTenant
             ? RenewalPriceBehavior.NONPREMIUM
-            : Optional.ofNullable(allocationToken)
+            : Optional.ofNullable(token)
                 .map(AllocationToken::getRenewalPriceBehavior)
                 .orElse(RenewalPriceBehavior.DEFAULT);
     // There should be one bill for the create and one for the recurrence autorenew event.
@@ -371,13 +355,13 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
             .setReason(Reason.CREATE)
             .setTargetId(getUniqueIdFromCommand())
             .setRegistrarId("TheRegistrar")
-            .setCost(feesAndCredits.getCreateCost())
+            .setCost(Money.of(USD, BigDecimal.valueOf(createCost)))
             .setPeriodYears(2)
             .setEventTime(clock.nowUtc())
             .setBillingTime(billingTime)
             .setFlags(expectedBillingFlags)
             .setDomainHistory(historyEntry)
-            .setAllocationToken(allocationToken == null ? null : allocationToken.createVKey())
+            .setAllocationToken(Optional.ofNullable(token).map(t -> t.createVKey()).orElse(null))
             .build();
 
     BillingRecurrence renewBillingEvent =
@@ -391,8 +375,8 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
             .setDomainHistory(historyEntry)
             .setRenewalPriceBehavior(expectedRenewalPriceBehavior)
             .setRenewalPrice(
-                Optional.ofNullable(allocationToken)
-                    .flatMap(AllocationToken::getRenewalPrice)
+                Optional.ofNullable(specifiedRenewCost)
+                    .map(r -> Money.of(USD, BigDecimal.valueOf(r)))
                     .orElse(null))
             .build();
 
@@ -480,7 +464,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     assertMutatingFlow(true);
     runFlowAssertResponse(
         CommitMode.LIVE, userPrivileges, loadFile(responseXmlFile, substitutions));
-    assertSuccessfulCreate(domainTld, ImmutableSet.of());
+    assertSuccessfulCreate(domainTld, ImmutableSet.of(), 24);
     assertNoLordn();
   }
 
@@ -886,10 +870,14 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
                     clock.nowUtc().plusDays(1),
                     Money.of(USD, 0)))
             .build());
-    doSuccessfulTest(
-        "example",
-        "domain_create_response_premium_eap.xml",
-        ImmutableMap.of("DOMAIN", "rich.example"));
+    assertMutatingFlow(true);
+    runFlowAssertResponse(
+        CommitMode.LIVE,
+        UserPrivileges.NORMAL,
+        loadFile(
+            "domain_create_response_premium_eap.xml", ImmutableMap.of("DOMAIN", "rich.example")));
+    assertSuccessfulCreate("example", ImmutableSet.of(), 200);
+    assertNoLordn();
   }
 
   /**
@@ -1336,7 +1324,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     setEppInput("domain_create_anchor_allocationtoken.xml");
     persistContactsAndHosts();
     runFlowAssertResponse(loadFile("domain_create_anchor_response.xml"));
-    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), allocationToken);
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), allocationToken, 0);
     assertNoLordn();
     assertAllocationTokenWasRedeemed("abcDEF23456");
   }
@@ -1350,7 +1338,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
                 .setTokenType(SINGLE_USE)
                 .setDomainName("resdom.tld")
                 .setRenewalPriceBehavior(SPECIFIED)
-                .setRenewalPrice(Money.of(USD, 0))
+                .setRenewalPrice(Money.of(USD, 1))
                 .build());
     // Despite the domain being FULLY_BLOCKED, the non-superuser create succeeds the domain is also
     // RESERVED_FOR_SPECIFIC_USE and the correct allocation token is passed.
@@ -1359,7 +1347,8 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     persistContactsAndHosts();
     runFlowAssertResponse(
         loadFile("domain_create_response.xml", ImmutableMap.of("DOMAIN", "resdom.tld")));
-    assertSuccessfulCreate("tld", ImmutableSet.of(RESERVED), allocationToken);
+    // $13 for the first year plus $1 renewal for the second year =
+    assertSuccessfulCreate("tld", ImmutableSet.of(RESERVED), allocationToken, 14, 1);
     assertNoLordn();
     assertAllocationTokenWasRedeemed("abc123");
   }
@@ -1379,7 +1368,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     setEppInput("domain_create_anchor_allocationtoken.xml");
     persistContactsAndHosts();
     runFlowAssertResponse(loadFile("domain_create_anchor_response.xml"));
-    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), allocationToken);
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), allocationToken, 0);
     assertNoLordn();
     assertAllocationTokenWasRedeemed("abcDEF23456");
   }
@@ -1402,7 +1391,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     clock.setTo(DateTime.parse("2009-08-16T09:00:00.0Z"));
     persistContactsAndHosts();
     runFlowAssertResponse(loadFile("domain_create_response_claims.xml"));
-    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), allocationToken);
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), allocationToken, 0);
     assertDomainDnsRequests("example-one.tld");
     assertClaimsLordn();
     assertAllocationTokenWasRedeemed("abcDEF23456");
@@ -1415,7 +1404,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     persistContactsAndHosts();
     runFlowAssertResponse(
         loadFile("domain_create_response.xml", ImmutableMap.of("DOMAIN", "example.tld")));
-    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT));
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), 0);
     assertNoLordn();
   }
 
@@ -1450,7 +1439,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
                 SMD_VALID_TIME.toString(),
                 "EXPIRATION_TIME",
                 SMD_VALID_TIME.plusYears(2).toString())));
-    assertSuccessfulCreate("tld", ImmutableSet.of(SUNRISE, ANCHOR_TENANT));
+    assertSuccessfulCreate("tld", ImmutableSet.of(SUNRISE, ANCHOR_TENANT), 0);
   }
 
   @Test
@@ -1482,7 +1471,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
                 SMD_VALID_TIME.toString(),
                 "EXPIRATION_TIME",
                 SMD_VALID_TIME.plusYears(2).toString())));
-    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT, SUNRISE), allocationToken);
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT, SUNRISE), allocationToken, 0);
     assertDomainDnsRequests("test-validate.tld");
     assertSunriseLordn();
     assertAllocationTokenWasRedeemed("abcDEF23456");
@@ -1505,7 +1494,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     setEppInput("domain_create_anchor_allocationtoken.xml");
     persistContactsAndHosts();
     runFlowAssertResponse(loadFile("domain_create_anchor_response.xml"));
-    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), allocationToken);
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), allocationToken, 0);
     assertNoLordn();
     assertAllocationTokenWasRedeemed("abcDEF23456");
   }
@@ -1929,7 +1918,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
         loadFile(
             "domain_create_response_premium.xml",
             ImmutableMap.of("EXDATE", "2001-04-03T22:00:00.0Z", "FEE", "200.00")));
-    assertSuccessfulCreate("example", ImmutableSet.of());
+    assertSuccessfulCreate("example", ImmutableSet.of(), 200);
   }
 
   private BillingEvent runTest_defaultToken(String token) throws Exception {
@@ -2148,7 +2137,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
         loadFile(
             "domain_create_response_premium.xml",
             ImmutableMap.of("EXDATE", "2001-04-03T22:00:00.0Z", "FEE", "200.00")));
-    assertSuccessfulCreate("example", ImmutableSet.of());
+    assertSuccessfulCreate("example", ImmutableSet.of(), 200);
   }
 
   @Test
@@ -2572,7 +2561,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     persistContactsAndHosts();
     persistBsaLabel("anchor");
     runFlowAssertResponse(loadFile("domain_create_anchor_response.xml"));
-    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), allocationToken);
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), allocationToken, 0);
     assertNoLordn();
     assertAllocationTokenWasRedeemed("abcDEF23456");
   }
@@ -2738,7 +2727,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
                 SMD_VALID_TIME.toString(),
                 "EXPIRATION_TIME",
                 SMD_VALID_TIME.plusYears(2).toString())));
-    assertSuccessfulCreate("tld", ImmutableSet.of(SUNRISE));
+    assertSuccessfulCreate("tld", ImmutableSet.of(SUNRISE), 20.40);
     assertSunriseLordn();
   }
 
@@ -2761,7 +2750,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
                 SMD_VALID_TIME.toString(),
                 "EXPIRATION_TIME",
                 SMD_VALID_TIME.plusYears(2).toString())));
-    assertSuccessfulCreate("tld", ImmutableSet.of(SUNRISE));
+    assertSuccessfulCreate("tld", ImmutableSet.of(SUNRISE), 20.40);
     assertSunriseLordn();
   }
 
@@ -3245,7 +3234,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
         "domain_create_allocationtoken.xml",
         ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2"));
     runFlow();
-    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), token);
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), token, 0);
   }
 
   @Test
@@ -3265,7 +3254,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
         "domain_create_premium_allocationtoken.xml",
         ImmutableMap.of("YEARS", "2", "FEE", "111.00"));
     runFlow();
-    assertSuccessfulCreate("example", ImmutableSet.of(), token);
+    assertSuccessfulCreate("example", ImmutableSet.of(), token, 111);
   }
 
   @Test
@@ -3286,7 +3275,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
         "domain_create_premium_allocationtoken.xml",
         ImmutableMap.of("YEARS", "2", "FEE", "101.00"));
     runFlow();
-    assertSuccessfulCreate("example", ImmutableSet.of(), token);
+    assertSuccessfulCreate("example", ImmutableSet.of(), token, 101, 1);
   }
 
   @Test
@@ -3438,7 +3427,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
         ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2"));
     persistContactsAndHosts();
     runFlow();
-    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), token);
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), token, 0);
   }
 
   @Test
@@ -3492,7 +3481,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
         "domain_create_allocationtoken.xml",
         ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2"));
     runFlow();
-    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), token);
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), token, 0);
   }
 
   @Test
@@ -3510,7 +3499,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
             .build());
     persistContactsAndHosts();
     runFlow();
-    assertSuccessfulCreate("tld", ImmutableSet.of(SUNRISE, ANCHOR_TENANT), allocationToken);
+    assertSuccessfulCreate("tld", ImmutableSet.of(SUNRISE, ANCHOR_TENANT), allocationToken, 0);
   }
 
   @Test
@@ -3572,7 +3561,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
         "domain_create_allocationtoken.xml",
         ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2"));
     runFlow();
-    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), token);
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), token, 0);
   }
 
   @Test
@@ -3599,7 +3588,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     setEppInput("domain_create_allocationtoken_claims.xml");
     persistContactsAndHosts();
     runFlow();
-    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), allocationToken);
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), allocationToken, 0);
   }
 
   @Test
@@ -3649,7 +3638,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
         "domain_create_allocationtoken.xml",
         ImmutableMap.of("DOMAIN", "example.tld", "YEARS", "2"));
     runFlow();
-    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), token);
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), token, 0);
   }
 
   @Test
@@ -3663,7 +3652,7 @@ class DomainCreateFlowTest extends ResourceFlowTestCase<DomainCreateFlow, Domain
     setEppInput("domain_create_allocationtoken_claims.xml");
     persistContactsAndHosts();
     runFlow();
-    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), allocationToken);
+    assertSuccessfulCreate("tld", ImmutableSet.of(ANCHOR_TENANT), allocationToken, 0);
   }
 
   @Test

core/src/test/java/google/registry/persistence/converter/BloomFilterConverterTest.java

@@ -13,11 +13,11 @@
 // limitations under the License.
 package google.registry.persistence.converter;
 
-import static com.google.common.base.Charsets.US_ASCII;
 import static com.google.common.hash.Funnels.stringFunnel;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.persistence.transaction.TransactionManagerFactory.tm;
 import static google.registry.testing.DatabaseHelper.insertInDb;
+import static java.nio.charset.StandardCharsets.US_ASCII;
 
 import com.google.common.collect.ImmutableSet;
 import com.google.common.hash.BloomFilter;

core/src/test/java/google/registry/persistence/transaction/JpaTransactionManagerExtension.java

@@ -21,7 +21,6 @@ import static google.registry.testing.DatabaseHelper.insertSimpleResources;
 import static java.nio.charset.StandardCharsets.UTF_8;
 import static org.testcontainers.containers.PostgreSQLContainer.POSTGRESQL_PORT;
 
-import com.google.common.base.Charsets;
 import com.google.common.base.Joiner;
 import com.google.common.base.Suppliers;
 import com.google.common.collect.ImmutableList;
@@ -305,7 +304,7 @@ public abstract class JpaTransactionManagerExtension
 
   private static String readSqlInClassPath(String sqlScriptPath) {
     try {
-      return Resources.toString(Resources.getResource(sqlScriptPath), Charsets.UTF_8);
+      return Resources.toString(Resources.getResource(sqlScriptPath), UTF_8);
     } catch (IOException e) {
       throw new UncheckedIOException(e);
     }

core/src/test/java/google/registry/rdap/RdapActionBaseTestCase.java

@@ -85,6 +85,7 @@ abstract class RdapActionBaseTestCase<A extends RdapActionBase> {
     action.rdapJsonFormatter = RdapTestHelper.getTestRdapJsonFormatter(clock);
     action.rdapMetrics = rdapMetrics;
     action.requestMethod = GET;
+    action.clock = new FakeClock(DateTime.parse("2025-01-01T00:00:00.000Z"));
     logout();
   }
 

core/src/test/java/google/registry/rdap/RdapDomainActionTest.java

@@ -15,6 +15,7 @@
 package google.registry.rdap;
 
 import static com.google.common.truth.Truth.assertThat;
+import static google.registry.bsa.persistence.BsaTestingUtils.persistBsaLabel;
 import static google.registry.model.EppResourceUtils.loadByForeignKey;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistActiveDomain;
@@ -27,8 +28,11 @@ import static google.registry.testing.FullFieldsTestEntityHelper.makeHistoryEntr
 import static google.registry.testing.FullFieldsTestEntityHelper.makeRegistrar;
 import static google.registry.testing.FullFieldsTestEntityHelper.makeRegistrarPocs;
 import static google.registry.testing.GsonSubject.assertAboutJson;
+import static google.registry.util.DateTimeUtils.START_OF_TIME;
 import static org.mockito.Mockito.verify;
 
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import com.google.gson.JsonObject;
 import google.registry.model.contact.Contact;
@@ -608,6 +612,34 @@ class RdapDomainActionTest extends RdapActionBaseTestCase<RdapDomainAction> {
                 .build());
   }
 
+  @Test
+  void testBlockedByBsa() {
+    persistResource(
+        Tld.get("lol").asBuilder().setBsaEnrollStartTime(Optional.of(START_OF_TIME)).build());
+    persistBsaLabel("example");
+    ImmutableMap<?, ?> expectedBsaNotice =
+        ImmutableMap.of(
+            "description",
+            ImmutableList.of("This name has been blocked by a GlobalBlock service"),
+            "title",
+            "Blocked Domain",
+            "links",
+            ImmutableList.of(
+                ImmutableMap.of(
+                    "href",
+                    "https://brandsafetyalliance.co",
+                    "rel",
+                    "alternate",
+                    "type",
+                    "text/html")));
+    JsonObject expectedErrorResponse = generateExpectedJsonError("example.lol blocked by BSA", 404);
+    expectedErrorResponse
+        .getAsJsonArray("notices")
+        .add(RdapTestHelper.GSON.toJsonTree(expectedBsaNotice));
+    assertAboutJson().that(generateActualJson("example.lol")).isEqualTo(expectedErrorResponse);
+    assertThat(response.getStatus()).isEqualTo(404);
+  }
+
   private Domain persistActiveDomainWithHost(
       String label, String tld, DateTime creationTime, DateTime expirationTime) {
     return persistResource(

core/src/test/java/google/registry/rdap/RdapJsonFormatterTest.java

@@ -406,26 +406,6 @@ class RdapJsonFormatterTest {
         .isEqualTo(loadJson("rdapjson_registrant_logged_out.json"));
   }
 
-  @Test
-  void testRegistrant_baseHasNoTrailingSlash() {
-    // First, make sure we have a trailing slash at the end by default!
-    // This test tries to change the default state, if the default doesn't have a /, then this test
-    // doesn't help.
-    assertThat(rdapJsonFormatter.fullServletPath).endsWith("/");
-    rdapJsonFormatter.fullServletPath =
-        rdapJsonFormatter.fullServletPath.substring(
-            0, rdapJsonFormatter.fullServletPath.length() - 1);
-    assertAboutJson()
-        .that(
-            rdapJsonFormatter
-                .createRdapContactEntity(
-                    contactRegistrant,
-                    ImmutableSet.of(RdapEntity.Role.REGISTRANT),
-                    OutputDataType.FULL)
-                .toJson())
-        .isEqualTo(loadJson("rdapjson_registrant.json"));
-  }
-
   @Test
   void testAdmin() {
     assertAboutJson()

core/src/test/java/google/registry/rdap/RdapTestHelper.java

@@ -33,8 +33,7 @@ import java.util.Map;
 /** Test helper methods for RDAP tests. */
 class RdapTestHelper {
 
-  private static final Gson GSON =
-      new GsonBuilder().setPrettyPrinting().disableHtmlEscaping().create();
+  static final Gson GSON = new GsonBuilder().setPrettyPrinting().disableHtmlEscaping().create();
 
   static JsonElement createJson(String... lines) {
     return GSON.fromJson(Joiner.on("\n").join(lines), JsonElement.class);
@@ -150,7 +149,7 @@ class RdapTestHelper {
   static RdapJsonFormatter getTestRdapJsonFormatter(Clock clock) {
     RdapJsonFormatter rdapJsonFormatter = new RdapJsonFormatter();
     rdapJsonFormatter.rdapAuthorization = RdapAuthorization.PUBLIC_AUTHORIZATION;
-    rdapJsonFormatter.fullServletPath = "https://example.tld/rdap/";
+    rdapJsonFormatter.serverName = "example.tld";
     rdapJsonFormatter.clock = clock;
     rdapJsonFormatter.rdapTos =
         ImmutableList.of(
@@ -240,5 +239,4 @@ class RdapTestHelper {
     obj.remove("rdapConformance");
     return reply;
   }
-
 }

core/src/test/java/google/registry/ui/server/console/domains/ConsoleBulkDomainActionTest.java

@@ -30,6 +30,7 @@ import static org.mockito.Mockito.when;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.ImmutableSet;
 import com.google.common.collect.ImmutableSortedMap;
 import com.google.gson.Gson;
 import com.google.gson.JsonElement;
@@ -61,6 +62,14 @@ public class ConsoleBulkDomainActionTest {
 
   private static final Gson GSON = GsonUtils.provideGson();
 
+  private static ImmutableSet<StatusValue> serverSuspensionStatuses =
+      ImmutableSet.of(
+          StatusValue.SERVER_RENEW_PROHIBITED,
+          StatusValue.SERVER_TRANSFER_PROHIBITED,
+          StatusValue.SERVER_UPDATE_PROHIBITED,
+          StatusValue.SERVER_DELETE_PROHIBITED,
+          StatusValue.SERVER_HOLD);
+
   private final FakeClock clock = new FakeClock(DateTime.parse("2024-05-13T00:00:00.000Z"));
 
   @RegisterExtension
@@ -135,12 +144,34 @@ public class ConsoleBulkDomainActionTest {
             """
             {"example.tld":{"message":"Command completed successfully","responseCode":1000}}""");
     assertThat(loadByEntity(domain).getStatusValues())
-        .containsAtLeast(
-            StatusValue.SERVER_RENEW_PROHIBITED,
-            StatusValue.SERVER_TRANSFER_PROHIBITED,
-            StatusValue.SERVER_UPDATE_PROHIBITED,
-            StatusValue.SERVER_DELETE_PROHIBITED,
-            StatusValue.SERVER_HOLD);
+        .containsAtLeastElementsIn(serverSuspensionStatuses);
+  }
+
+  @Test
+  void testSuccess_unsuspend() throws Exception {
+    User adminUser =
+        persistResource(
+            new User.Builder()
+                .setEmailAddress("email@email.com")
+                .setUserRoles(
+                    new UserRoles.Builder().setGlobalRole(GlobalRole.FTE).setIsAdmin(true).build())
+                .build());
+    persistResource(domain.asBuilder().addStatusValues(serverSuspensionStatuses).build());
+    ConsoleBulkDomainAction action =
+        createAction(
+            "UNSUSPEND",
+            GSON.toJsonTree(
+                ImmutableMap.of("domainList", ImmutableList.of("example.tld"), "reason", "test")),
+            adminUser);
+    assertThat(loadByEntity(domain).getStatusValues())
+        .containsAtLeastElementsIn(serverSuspensionStatuses);
+    action.run();
+    assertThat(fakeResponse.getStatus()).isEqualTo(SC_OK);
+    assertThat(fakeResponse.getPayload())
+        .isEqualTo(
+            """
+            {"example.tld":{"message":"Command completed successfully","responseCode":1000}}""");
+    assertThat(loadByEntity(domain).getStatusValues()).containsNoneIn(serverSuspensionStatuses);
   }
 
   @Test

core/src/test/resources/google/registry/reporting/icann/attempted_adds_test.sql

@@ -19,7 +19,7 @@
   -- monthly App Engine logs, searching for all create commands and associating
   -- them with their corresponding registrars.
 
-  -- Example log generated by FlowReporter in App Engine logs:
+  -- Example log generated by FlowReporter in App Engine and GKE logs:
   --google.registry.flows.FlowReporter
   -- recordToLogs: FLOW-LOG-SIGNATURE-METADATA:
   --{"serverTrid":"oNwL2J2eRya7bh7c9oHIzg==-2360a","clientId":"ipmirror"
@@ -38,30 +38,42 @@ FROM (
     JSON_EXTRACT_SCALAR(json, '$.tld') AS tld,
     JSON_EXTRACT_SCALAR(json, '$.clientId') AS clientId,
     COUNT(json) AS count
-  FROM (
+  FROM ((
       -- Extract JSON metadata package from monthly logs
     SELECT
-      REGEXP_EXTRACT(textPayload, r'FLOW-LOG-SIGNATURE-METADATA: (.*)\n?$')
-          AS json
-    FROM (
+      REGEXP_EXTRACT(textPayload, r'FLOW-LOG-SIGNATURE-METADATA: (.*)\n?$') AS json
+    FROM
+      `domain-registry-alpha.appengine_logs._var_log_app_*`
+    WHERE
+      _TABLE_SUFFIX BETWEEN '20170901'
+      AND '20170930'
+      AND STARTS_WITH(textPayload, "FLOW-LOG-SIGNATURE-METADATA")
+      -- Look for domain creates
+      AND REGEXP_CONTAINS(textPayload, r'"commandType":"create","resourceType":"domain"')
+      -- Filter prober data
+      AND NOT REGEXP_CONTAINS(textPayload, r'"prober-[a-z]{2}-((any)|(canary))"'))
+    UNION ALL (
+        -- Extract JSON metadata package from monthly logs
       SELECT
-        textPayload
+        REGEXP_EXTRACT(jsonPayload.message, r'FLOW-LOG-SIGNATURE-METADATA: (.*)\n?$') AS json
       FROM
-        `domain-registry-alpha.appengine_logs._var_log_app_*`
-      WHERE _TABLE_SUFFIX
-      BETWEEN '20170901'
-      AND '20170930')
-    WHERE STARTS_WITH(textPayload, "FLOW-LOG-SIGNATURE-METADATA")
-    -- Look for domain creates
-    AND REGEXP_CONTAINS(
-       textPayload, r'"commandType":"create","resourceType":"domain"')
-    -- Filter prober data
-    AND NOT REGEXP_CONTAINS(
-        textPayload, r'"prober-[a-z]{2}-((any)|(canary))"') )
-  GROUP BY tld, clientId ) AS logs_table
+        `domain-registry-alpha.gke_logs.stderr_*`
+      WHERE
+        _TABLE_SUFFIX BETWEEN '20170901'
+        AND '20170930'
+        AND STARTS_WITH(jsonPayload.message, "FLOW-LOG-SIGNATURE-METADATA")
+        -- Look for domain creates
+        AND REGEXP_CONTAINS(jsonPayload.message, r'"commandType":"create","resourceType":"domain"')
+        -- Filter prober data
+        AND NOT REGEXP_CONTAINS(jsonPayload.message, r'"prober-[a-z]{2}-((any)|(canary))"')))
+  GROUP BY
+    tld,
+    clientId ) AS logs_table
 JOIN
   EXTERNAL_QUERY("projects/domain-registry-alpha/locations/us/connections/domain-registry-alpha-sql",
-              '''SELECT registrar_id, registrar_name FROM "Registrar";''') AS registrar_table
-  ON
-      logs_table.clientId = registrar_table.registrar_id
-  ORDER BY tld, registrar_name
+    '''SELECT registrar_id, registrar_name FROM "Registrar";''') AS registrar_table
+ON
+  logs_table.clientId = registrar_table.registrar_id
+ORDER BY
+  tld,
+  registrar_name

core/src/test/resources/google/registry/reporting/icann/epp_metrics_test.sql

@@ -35,14 +35,30 @@ FROM (
     JSON_EXTRACT_SCALAR(json,
       '$.icannActivityReportField') AS activityReportField
   FROM (
+    -- For reasons that I don't understand, if I directly select the three columns
+    -- from the union, BigQuery complains about column number mismatch, so I have to
+    -- make a temporary union table and select on it.
     SELECT
-      -- Extract the logged JSON payload.
-      REGEXP_EXTRACT(textPayload, r'FLOW-LOG-SIGNATURE-METADATA: (.*)\n?$')
-      AS json
-    FROM `domain-registry-alpha.appengine_logs._var_log_app_*`
-    WHERE
-      STARTS_WITH(textPayload, "FLOW-LOG-SIGNATURE-METADATA")
-      AND _TABLE_SUFFIX BETWEEN '20170901' AND '20170930')) AS regexes
+      *
+    FROM (
+      SELECT
+        -- Extract the logged JSON payload.
+        REGEXP_EXTRACT(textPayload, r'FLOW-LOG-SIGNATURE-METADATA: (.*)\n?$')
+        AS json
+      FROM `domain-registry-alpha.appengine_logs._var_log_app_*`
+      WHERE
+        STARTS_WITH(textPayload, "FLOW-LOG-SIGNATURE-METADATA")
+        AND _TABLE_SUFFIX BETWEEN '20170901' AND '20170930')
+    UNION ALL (
+      SELECT
+        -- Extract the logged JSON payload.
+        REGEXP_EXTRACT(jsonPayload.message, r'FLOW-LOG-SIGNATURE-METADATA: (.*)\n?$')
+        AS json
+      FROM `domain-registry-alpha.gke_logs.stderr_*`
+      WHERE
+        STARTS_WITH(jsonPayload.message, "FLOW-LOG-SIGNATURE-METADATA")
+        AND _TABLE_SUFFIX BETWEEN '20170901' AND '20170930')
+  )) AS regexes
 JOIN
   -- Unnest the JSON-parsed tlds.
   UNNEST(regexes.tlds) AS tld

core/src/test/resources/google/registry/reporting/icann/monthly_logs_test.sql

@@ -13,13 +13,23 @@
   -- See the License for the specific language governing permissions and
   -- limitations under the License.
 
-  -- Query to fetch AppEngine request logs for the report month.
+  -- Query to fetch AppEngine and GKE request logs for the report month.
 
   -- START_OF_MONTH and END_OF_MONTH should be in YYYYMM01 format.
 
 SELECT
-  protoPayload.resource AS requestPath,
-FROM
-  `domain-registry-alpha.appengine_logs.appengine_googleapis_com_request_log_*`
-WHERE
-  _TABLE_SUFFIX BETWEEN '20170901' AND '20170930'
+  *
+FROM (
+  SELECT
+    jsonPayload.httrequest.requesturl AS requestPath
+  FROM
+    `domain-registry-alpha.gke_logs.stderr_*`
+  WHERE
+    _TABLE_SUFFIX BETWEEN '20170901' AND '20170930')
+UNION ALL (
+  SELECT
+    protoPayload.resource AS requestPath
+  FROM
+    `domain-registry-alpha.appengine_logs.appengine_googleapis_com_request_log_*`
+  WHERE
+    _TABLE_SUFFIX BETWEEN '20170901' AND '20170930')

db/src/main/java/google/registry/persistence/NomulusPostgreSql.java

@@ -23,7 +23,7 @@ public class NomulusPostgreSql {
 
   /** The current PostgreSql version in Cloud SQL. */
   // TODO(weiminyu): setup periodic checks to detect version changes in Cloud SQL.
-  private static final String TARGET_VERSION = "11.21-alpine";
+  private static final String TARGET_VERSION = "17-alpine";
 
   /**
    * Returns the docker image of the targeted Postgresql server version.

db/src/main/resources/sql/flyway.txt

@@ -184,3 +184,4 @@ V183__remove_fk_billingrecurrence_domainhistory.sql
 V184__remove_fk_pollmessage_domainhistory.sql
 V185__remove_fk_domaintransactionrecord_domainhistory.sql
 V186__remove_fk_domaindsdatahistory_domainhistory.sql
+V187__console_update_history.sql

db/src/main/resources/sql/flyway/V187__console_update_history.sql

@@ -0,0 +1,34 @@
+-- Copyright 2025 The Nomulus Authors. All Rights Reserved.
+--
+-- Licensed under the Apache License, Version 2.0 (the "License");
+-- you may not use this file except in compliance with the License.
+-- You may obtain a copy of the License at
+--
+--     http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing, software
+-- distributed under the License is distributed on an "AS IS" BASIS,
+-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+-- See the License for the specific language governing permissions and
+-- limitations under the License.
+
+CREATE TABLE "ConsoleUpdateHistory" (
+    revision_id bigint NOT NULL,
+    modification_time timestamp with time zone NOT NULL,
+    method text NOT NULL,
+    type text NOT NULL,
+    url text NOT NULL,
+    description text,
+    acting_user text NOT NULL,
+    PRIMARY KEY (revision_id),
+    CONSTRAINT fk_console_update_history_acting_user
+        FOREIGN KEY(acting_user)
+        REFERENCES "User" (email_address)
+);
+
+CREATE INDEX IF NOT EXISTS idx_console_update_history_acting_user
+    ON "ConsoleUpdateHistory" (acting_user);
+CREATE INDEX IF NOT EXISTS idx_console_update_history_type
+    ON "ConsoleUpdateHistory" (type);
+CREATE INDEX IF NOT EXISTS idx_console_update_history_modification_time
+    ON "ConsoleUpdateHistory" (modification_time);

db/src/main/resources/sql/schema/nomulus.golden.sql

@@ -2,12 +2,13 @@
 -- PostgreSQL database dump
 --
 
--- Dumped from database version 11.21
--- Dumped by pg_dump version 11.21
+-- Dumped from database version 17.4
+-- Dumped by pg_dump version 17.4
 
 SET statement_timeout = 0;
 SET lock_timeout = 0;
 SET idle_in_transaction_session_timeout = 0;
+SET transaction_timeout = 0;
 SET client_encoding = 'UTF8';
 SET standard_conforming_strings = on;
 SELECT pg_catalog.set_config('search_path', '', false);
@@ -32,7 +33,7 @@ COMMENT ON EXTENSION hstore IS 'data type for storing sets of (key, value) pairs
 
 SET default_tablespace = '';
 
-SET default_with_oids = false;
+SET default_table_access_method = heap;
 
 --
 -- Name: AllocationToken; Type: TABLE; Schema: public; Owner: -
@@ -271,6 +272,21 @@ CREATE TABLE public."ConsoleEppActionHistory" (
 );
 
 
+--
+-- Name: ConsoleUpdateHistory; Type: TABLE; Schema: public; Owner: -
+--
+
+CREATE TABLE public."ConsoleUpdateHistory" (
+    revision_id bigint NOT NULL,
+    modification_time timestamp with time zone NOT NULL,
+    method text NOT NULL,
+    type text NOT NULL,
+    url text NOT NULL,
+    description text,
+    acting_user text NOT NULL
+);
+
+
 --
 -- Name: Contact; Type: TABLE; Schema: public; Owner: -
 --
@@ -1529,6 +1545,14 @@ ALTER TABLE ONLY public."ConsoleEppActionHistory"
     ADD CONSTRAINT "ConsoleEppActionHistory_pkey" PRIMARY KEY (history_revision_id);
 
 
+--
+-- Name: ConsoleUpdateHistory ConsoleUpdateHistory_pkey; Type: CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public."ConsoleUpdateHistory"
+    ADD CONSTRAINT "ConsoleUpdateHistory_pkey" PRIMARY KEY (revision_id);
+
+
 --
 -- Name: ContactHistory ContactHistory_pkey; Type: CONSTRAINT; Schema: public; Owner: -
 --
@@ -2051,6 +2075,27 @@ CREATE INDEX idx9g3s7mjv1yn4t06nqid39whss ON public."AllocationToken" USING btre
 CREATE INDEX idx9q53px6r302ftgisqifmc6put ON public."ContactHistory" USING btree (history_type);
 
 
+--
+-- Name: idx_console_update_history_acting_user; Type: INDEX; Schema: public; Owner: -
+--
+
+CREATE INDEX idx_console_update_history_acting_user ON public."ConsoleUpdateHistory" USING btree (acting_user);
+
+
+--
+-- Name: idx_console_update_history_modification_time; Type: INDEX; Schema: public; Owner: -
+--
+
+CREATE INDEX idx_console_update_history_modification_time ON public."ConsoleUpdateHistory" USING btree (modification_time);
+
+
+--
+-- Name: idx_console_update_history_type; Type: INDEX; Schema: public; Owner: -
+--
+
+CREATE INDEX idx_console_update_history_type ON public."ConsoleUpdateHistory" USING btree (type);
+
+
 --
 -- Name: idx_registry_lock_registrar_id; Type: INDEX; Schema: public; Owner: -
 --
@@ -2689,6 +2734,14 @@ ALTER TABLE ONLY public."BillingRecurrence"
     ADD CONSTRAINT fk_billing_recurrence_registrar_id FOREIGN KEY (registrar_id) REFERENCES public."Registrar"(registrar_id) DEFERRABLE INITIALLY DEFERRED;
 
 
+--
+-- Name: ConsoleUpdateHistory fk_console_update_history_acting_user; Type: FK CONSTRAINT; Schema: public; Owner: -
+--
+
+ALTER TABLE ONLY public."ConsoleUpdateHistory"
+    ADD CONSTRAINT fk_console_update_history_acting_user FOREIGN KEY (acting_user) REFERENCES public."User"(email_address);
+
+
 --
 -- Name: ContactHistory fk_contact_history_contact_repo_id; Type: FK CONSTRAINT; Schema: public; Owner: -
 --

db/src/test/java/google/registry/sql/flyway/SchemaTest.java

@@ -115,6 +115,7 @@ class SchemaTest {
             Joiner.on(File.separatorChar).join(MOUNTED_RESOURCE_PATH, DUMP_OUTPUT_FILE));
 
     assertThat(dumpedSchema)
+        .ignoringLinesStartingWith("--")
         .hasSameContentAs(Resources.getResource("sql/schema/nomulus.golden.sql"));
   }
 

integration/run_compatibility_tests.sh

@@ -111,7 +111,7 @@ fi
 if [[ "${SUT}" = "nomulus" ]]; then
   DEPLOYED_SYSTEM="sql"
 elif [[ "${SUT}" = "sql" ]]; then
-  DEPLOYED_SYSTEM="nomulus"
+  DEPLOYED_SYSTEM="nomulus-gke"
 else
   echo "${USAGE}"
   exit 1

jetty/build.gradle

@@ -37,11 +37,11 @@ dependencies {
 }
 
 tasks.register('copyConsole', Copy) {
-    from("${rootDir}/console-webapp/staged/dist") {
-        include "**/*"
+    from("${rootDir}/console-webapp/staged/") {
+        include "console-*/*"
     }
-    into layout.buildDirectory.dir('jetty-base/webapps/console')
-    dependsOn(':console-webapp:buildConsoleWebapp')
+    into layout.buildDirectory.dir('jetty-base/webapps/')
+    dependsOn(':console-webapp:buildConsoleForAll')
 }
 
 tasks.register('stage') {

jetty/deploy-nomulus-for-env.sh

@@ -29,48 +29,48 @@ environment=${1}
 base_domain=${2}
 project="domain-registry-"${environment}
 current_context=$(kubectl config current-context)
+line=$(gcloud container clusters list --project "${project}" | grep nomulus | grep main)
+parts=(${line})
+echo "Updating cluster ${parts[0]} in location ${parts[1]}..."
+gcloud container fleet memberships get-credentials "${parts[0]}" --project "${project}"
+for service in frontend backend pubapi console
+do
+  sed s/GCP_PROJECT/"${project}"/g "./kubernetes/nomulus-${service}.yaml" | \
+  sed s/ENVIRONMENT/"${environment}"/g | \
+  sed s/PROXY_ENV/"${environment}"/g | \
+  sed s/EPP/"epp"/g | \
+  kubectl apply -f -
+  kubectl rollout restart deployment/${service}
+  # canary
+  sed s/GCP_PROJECT/"${project}"/g "./kubernetes/nomulus-${service}.yaml" | \
+  sed s/ENVIRONMENT/"${environment}"/g | \
+  sed s/PROXY_ENV/"${environment}_canary"/g | \
+  sed s/EPP/"epp-canary"/g | \
+  sed s/"${service}"/"${service}-canary"/g | \
+  kubectl apply -f -
+  kubectl rollout restart deployment/${service}-canary
+done
+kubectl apply -f "./kubernetes/gateway/nomulus-gateway.yaml"
+kubectl apply -f "./kubernetes/gateway/nomulus-iap-${environment}.yaml"
+for service in frontend backend console pubapi
+do
+  sed s/BASE_DOMAIN/"${base_domain}"/g "./kubernetes/gateway/nomulus-route-${service}.yaml" | \
+  kubectl apply -f -
+  sed s/SERVICE/"${service}"/g "./kubernetes/gateway/nomulus-backend-policy-${environment}.yaml" | \
+  kubectl apply -f -
+  sed s/SERVICE/"${service}-canary"/g "./kubernetes/gateway/nomulus-backend-policy-${environment}.yaml" | \
+  kubectl apply -f -
+done
+
+# Restart proxies
 while read line
 do
   parts=(${line})
   echo "Updating cluster ${parts[0]} in location ${parts[1]}..."
-  gcloud container fleet memberships get-credentials "${parts[0]}" --project "${project}"
-  for service in frontend backend pubapi console
-  do
-    sed s/GCP_PROJECT/"${project}"/g "./kubernetes/nomulus-${service}.yaml" | \
-    sed s/ENVIRONMENT/"${environment}"/g | \
-    sed s/PROXY_ENV/"${environment}"/g | \
-    sed s/EPP/"epp"/g | \
-    sed s/WHOIS/"whois"/g | \
-    kubectl apply -f -
-    # canary
-    sed s/GCP_PROJECT/"${project}"/g "./kubernetes/nomulus-${service}.yaml" | \
-    sed s/ENVIRONMENT/"${environment}"/g | \
-    sed s/PROXY_ENV/"${environment}_canary"/g | \
-    sed s/EPP/"epp-canary"/g | \
-    sed s/WHOIS/"whois-canary"/g | \
-    sed s/"${service}"/"${service}-canary"/g | \
-    kubectl apply -f -
-  done
-  # Kills all running pods, new pods created will be pulling the new image.
-  kubectl delete pods --all
-  # The multi-cluster gateway is only deployed to one cluster (the one in the US).
-  if [[ "${parts[1]}" == us-* ]]
-  then
-    kubectl apply -f "./kubernetes/gateway/nomulus-gateway.yaml"
-    for service in frontend backend console pubapi
-    do
-      sed s/BASE_DOMAIN/"${base_domain}"/g "./kubernetes/gateway/nomulus-route-${service}.yaml" | \
-      kubectl apply -f -
-      # Don't enable IAP on pubapi.
-      if [[ "${service}" == pubapi ]]
-      then
-        continue
-      fi
-      sed s/SERVICE/"${service}"/g "./kubernetes/gateway/nomulus-iap-${environment}.yaml" | \
-      kubectl apply -f -
-      sed s/SERVICE/"${service}-canary"/g "./kubernetes/gateway/nomulus-iap-${environment}.yaml" | \
-      kubectl apply -f -
-    done
-  fi
-done < <(gcloud container clusters list --project "${project}" | grep nomulus)
+  gcloud container clusters get-credentials ${parts[0]} \
+    --project ${project} --location ${parts[1]}
+  kubectl rollout restart deployment/proxy-deployment
+  kubectl rollout restart deployment/proxy-deployment-canary
+done < <(gcloud container clusters list --project ${project} | grep proxy-cluster)
+
 kubectl config use-context "$current_context"

jetty/get-endpoints.py

@@ -1,158 +0,0 @@
-#! /bin/env python3
-# Copyright 2024 The Nomulus Authors. All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-'''
-A script that outputs the IP endpoints of various load balancers, to be run
-after Nomulus is deployed.
-'''
-
-import ipaddress
-import json
-import subprocess
-import sys
-from dataclasses import dataclass
-from ipaddress import IPv4Address
-from ipaddress import IPv6Address
-from operator import attrgetter
-from operator import methodcaller
-
-
-class PreserveContext:
-    def __enter__(self):
-        self._context = run_command('kubectl config current-context')
-
-    def __exit__(self, type, value, traceback):
-        run_command('kubectl config use-context ' + self._context)
-
-
-class UseCluster(PreserveContext):
-    def __init__(self, cluster: str, region: str, project: str):
-        self._cluster = cluster
-        self._region = region
-        self._project = project
-
-    def __enter__(self):
-        super().__enter__()
-        cmd = (f'gcloud container fleet memberships get-credentials'
-                   f' {self._cluster} --project {self._project}')
-        run_command(cmd)
-
-
-def run_command(cmd: str, print_output=False) -> str:
-    proc = subprocess.run(cmd, text=True, shell=True, stdout=subprocess.PIPE,
-                          stderr=subprocess.STDOUT)
-    if print_output:
-        print(proc.stdout)
-    return proc.stdout
-
-
-def get_clusters(project: str) -> dict[str, str]:
-    cmd = f'gcloud container clusters list --project {project} --format=json'
-    content = json.loads(run_command(cmd))
-    res = {}
-    for item in content:
-        name = item['name']
-        region = item['location']
-        if not name.startswith('nomulus-cluster'):
-            continue
-        res[name] = region
-    return res
-
-
-def get_endpoints(resource: str, service: str, jsonpath: str) -> list[
-    str]:
-    content = run_command(
-            f'kubectl get {resource}/{service} -o jsonpath={jsonpath}', )
-    return content.split()
-
-
-def get_region_symbol(region: str) -> str:
-    if region.startswith('us'):
-        return 'amer'
-    if region.startswith('europe'):
-        return 'emea'
-    if region.startswith('asia'):
-        return 'apac'
-    return 'other'
-
-
-@dataclass
-class IP:
-    service: str
-    region: str
-    address: IPv4Address | IPv6Address
-
-    def is_ipv6(self) -> bool:
-        return self.address.version == 6
-
-    def __str__(self) -> str:
-        return f'{self.service} {self.region}: {self.address}'
-
-
-def terraform_str(item) -> str:
-    res = ""
-    if (isinstance(item, dict)):
-        res += '{\n'
-        for key, value in item.items():
-            res += f'{key} = {terraform_str(value)}\n'
-        res += '}'
-    elif (isinstance(item, list)):
-        res += '['
-        for i, value in enumerate(item):
-            if i != 0:
-                res += ', '
-            res += terraform_str(value)
-        res += ']'
-    else:
-        res += f'"{item}"'
-    return res
-
-
-if __name__ == '__main__':
-    if len(sys.argv) != 2:
-        raise ValueError('Usage: get-endpoints.py <project>')
-    project = sys.argv[1]
-    print(f'Project: {project}')
-    clusters = get_clusters(project)
-    ips = []
-    res = {}
-    for cluster, region in clusters.items():
-        with UseCluster(cluster, region, project):
-            for service in ['whois', 'whois-canary', 'epp', 'epp-canary']:
-                map_key = service.replace('-', '_')
-                for ip in get_endpoints('services', service,
-                                        '{.status.loadBalancer.ingress[*].ip}'):
-                    ip = ipaddress.ip_address(ip)
-                    if isinstance(ip, IPv4Address):
-                        map_key_with_iptype = map_key + '_ipv4'
-                    else:
-                        map_key_with_iptype = map_key + '_ipv6'
-                    if map_key_with_iptype not in res:
-                        res[map_key_with_iptype] = {}
-                    res[map_key_with_iptype][get_region_symbol(region)] = [ip]
-                    ips.append(IP(service, get_region_symbol(region), ip))
-            if not region.startswith('us'):
-                continue
-            ip = get_endpoints('gateways.gateway.networking.k8s.io', 'nomulus',
-                               '{.status.addresses[*].value}')[0]
-            print(f'nomulus: {ip}')
-            res['https_ip'] = ipaddress.ip_address(ip)
-    ips.sort(key=attrgetter('region'))
-    ips.sort(key=methodcaller('is_ipv6'))
-    ips.sort(key=attrgetter('service'))
-    for ip in ips:
-        print(ip)
-    print("Terraform friendly output:")
-    print(terraform_str(res))

jetty/kubernetes/gateway/nomulus-gateway.yaml

@@ -4,7 +4,18 @@ metadata:
   name: nomulus
 spec:
   gatewayClassName: gke-l7-global-external-managed-mc
+  addresses:
+  - type: NamedAddress
+    value: nomulus-ipv4-address
+  - type: NamedAddress
+    value: nomulus-ipv6-address
   listeners:
+  - name: http
+    protocol: HTTP
+    port: 80
+    allowedRoutes:
+      kinds:
+      - kind: HTTPRoute
   - name: https
     protocol: HTTPS
     port: 443
@@ -15,3 +26,19 @@ spec:
     allowedRoutes:
       kinds:
       - kind: HTTPRoute
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
+metadata:
+  name: redirect
+spec:
+  parentRefs:
+  - kind: Gateway
+    name: nomulus
+    sectionName: http
+  rules:
+  - filters:
+    - type: RequestRedirect
+      requestRedirect:
+        scheme: https
+

jetty/kubernetes/gateway/nomulus-route-backend.yaml

@@ -6,6 +6,7 @@ spec:
   parentRefs:
   - kind: Gateway
     name: nomulus
+    sectionName: https
   hostnames:
     - "backend.BASE_DOMAIN"
   rules:

jetty/kubernetes/gateway/nomulus-route-console.yaml

@@ -6,6 +6,7 @@ spec:
   parentRefs:
   - kind: Gateway
     name: nomulus
+    sectionName: https
   hostnames:
     - "console.BASE_DOMAIN"
   rules:

jetty/kubernetes/gateway/nomulus-route-frontend.yaml

@@ -6,6 +6,7 @@ spec:
   parentRefs:
   - kind: Gateway
     name: nomulus
+    sectionName: https
   hostnames:
     - "frontend.BASE_DOMAIN"
   rules:

jetty/kubernetes/gateway/nomulus-route-pubapi.yaml

@@ -6,6 +6,7 @@ spec:
   parentRefs:
   - kind: Gateway
     name: nomulus
+    sectionName: https
   hostnames:
     - "pubapi.BASE_DOMAIN"
   rules: