Traffic Policy DSL Specification

1. Goal

Traffic Policy DSL describes how developer service traffic should select Traffic Exit candidates.

It is an OrbitMesh platform model, not a sing-box route file.

2. Policy Shape

apiVersion: orbitmesh.io/v1alpha1
kind: TrafficPolicy
metadata:
  name: developer-default
spec:
  scope:
    type: tenant
  rules:
    - name: github
      match:
        service: github
        domains:
          - github.com
          - githubusercontent.com
      select:
        role: traffic.exit
        preferredRegions:
          - tokyo
          - singapore
        preferredProviders:
          - oci
          - vultr
          - aws
        healthRequired: true
        maxLatencyMs: 300
      failover:
        - region: singapore
        - region: us-west

3. Match

Supported match fields:

• service
• domains
• domainSuffixes
• ports
• protocols

MVP supports:

• service
• domainSuffixes

4. Select

Supported selector fields:

• role
• preferredRegions
• preferredProviders
• requiredNodeLabels
• requiredCapabilityLabels
• healthRequired
• maxLatencyMs
• costClass
• dedicated

MVP supports:

• role = traffic.exit
• preferredRegions
• preferredProviders
• healthRequired

5. Failover

Failover entries are evaluated in order.

failover:
  - capabilityBindingRef: cb_exit_tokyo_02
  - region: singapore
  - provider: aws

6. Priority

Rules use numeric priority.

priority: 100

Lower number wins.

If priorities are equal:

1. More specific domain wins.
2. Service-specific rule wins over default.
3. Earlier rule wins.

7. Explain Output

Traffic Policy simulation should return:

{
  "matched_rule": "github",
  "selected_role": "traffic.exit",
  "selected_capability_binding_id": "cb_exit_tokyo_01",
  "candidates": [
    {
      "capability_binding_id": "cb_exit_tokyo_01",
      "runtime_binding_id": "rb_sing_box_tokyo_01",
      "score": 91,
      "reason": "healthy preferred region"
    }
  ],
  "decision": "selected"
}

8. Compile Output

Traffic Policy Engine output:

{
  "domain_suffix": ["github.com", "githubusercontent.com"],
  "target_role": "traffic.exit",
  "target_capability_binding_id": "cb_exit_tokyo_01",
  "target_runtime_binding_id": "rb_sing_box_tokyo_01"
}

Configuration Compiler turns this into RuntimeConfiguration.