Module routing 

RoutingSpec — declared DNS + Ingress edges this Process exposes.

The substrate move: every Process can declare hostnames at which it answers. The reconciler emits one networking.k8s.io/v1 Ingress + one externaldns.k8s.io/v1alpha1 DNSEndpoint per entry, owned by the Process via ownerRefs (cascade-delete on Reaped). DNS records are declarative — the Process IS the source of truth for ${app}.${eph_id}.${cluster}.${location}.${domain}.

Two hostname forms:

1. Per-instance — ${app}.${eph_id}.${cluster}.${loc}.${domain}. The eph_id segment is the hostnames[i].instance value when set, or the BLAKE3:8 short-hash of the Process’s canonical spec when unset. Stable for the lifetime of the spec; new spec content ⇒ new hash ⇒ new slot.

2. Stable claim — ${app}.${cluster}.${loc}.${domain} (no eph_id segment). Emitted iff stable_name_claim: true AND this Process currently holds the ProcessTable.claims entry for (cluster, app). The claim arbiter handles atomic transfer when the holder fails.

Lisp authoring:

:routing (:hostnames ((:app "gator" :instance "akeyless-prod")
                      (:app "gateway"))
          :backend   (:service "akeyless-saas-akeyless-gateway"
                      :port    8000)
          :stable-name-claim #t
          :priority           100)

Structs

RoutingBackend

Backend Service the FQDN’s Ingress routes traffic to.

RoutingHostname

One entry in RoutingSpec.hostnames.

RoutingSpec

Declared external edges (DNS + Ingress) this Process exposes.