Project: Gloo (Orchestration & Management / API Gateway)
File: dynamic_forward_proxy.proto.sk.md

title: "dynamicforwardproxy.proto" weight: 5 <!-- Code generated by solo-kit. DO NOT EDIT. --> - Configuration for the dynamic forward proxy HTTP filter. See the :ref:`architecture overview <archoverviewhttpdynamicforward_proxy>` for more information. [#extension: envoy.filters.http.dynamicforwardproxy] ```yaml "dnsCacheConfig": .dfp.options.gloo.solo.io.DnsCacheConfig "saveUpstreamAddress": bool "sslConfig": .gloo.solo.io.UpstreamSslConfig ``` | Field | Type | Description | | -- | - | -- | | `dnsCacheConfig` | | The DNS cache configuration that the filter will attach to. Note this configuration must match that of associated :ref:`dynamic forward proxy cluster configuration <envoyapifieldconfig.cluster.dynamicforwardproxy.v2alpha.ClusterConfig.dnscache_config>`. | | `saveUpstreamAddress` | `bool` | When this flag is set, the filter will add the resolved upstream address in the filter state. The state should be saved with key `envoy.stream.upstreamaddress` (See :repo:`upstreamaddress.h<source/common/streaminfo/upstreamaddress.h>`). | | `sslConfig` | | If provided, the autogenerated dynamic forward proxy cluster will use TLS when connecting to upstream hosts and verify the certificate chain. | Configuration of circuit breakers for resolver. ```yaml "maxPendingRequests": .google.protobuf.UInt32Value ``` | Field | Type | Description | | -- | - | -- | | `maxPendingRequests` | | The maximum number of pending requests that Envoy will allow to the resolver. If not specified, the default is 1024. | Configuration for the dynamic forward proxy DNS cache. See the :ref:`architecture overview <archoverviewhttpdynamicforward_proxy>` for more information. [#next-free-field: 14] ```yaml "dnsLookupFamily": .dfp.options.gloo.solo.io.DnsLookupFamily "dnsRefreshRate": .google.protobuf.Duration "hostTtl": .google.protobuf.Duration "maxHosts": .google.protobuf.UInt32Value "dnsFailureRefreshRate": .dfp.options.gloo.solo.io.RefreshRate "dnsCacheCircuitBreaker": .dfp.options.gloo.solo.io.DnsCacheCircuitBreakers "caresDns": .dfp.options.gloo.solo.io.CaresDnsResolverConfig "appleDns": .dfp.options.gloo.solo.io.AppleDnsResolverConfig "preresolveHostnames": []solo.io.envoy.config.core.v3.SocketAddress "dnsQueryTimeout": .google.protobuf.Duration ``` | Field | Type | Description | | -- | - | -- | | `dnsLookupFamily` | | The DNS lookup family to use during resolution. [#comment:TODO(mattklein123): Figure out how to support IPv4/IPv6 "happy eyeballs" mode. The way this might work is a new lookup family which returns both IPv4 and IPv6 addresses, and then configures a host to have a primary and fall back address. With this, we could very likely build a "happy eyeballs" connection pool which would race the primary / fall back address and return the one that wins. This same method could potentially also be used for QUIC to TCP fall back.]. | | `dnsRefreshRate` | | The DNS refresh rate for unresolved DNS hosts. If not specified defaults to 60s. The refresh rate is rounded to the closest millisecond, and must be at least 1ms. Once a host has been resolved, the refresh rate will be the DNS TTL, capped at a minimum of 5s. | | `hostTtl` | | The TTL for hosts that are unused. Hosts that have not been used in the configured time interval will be purged. If not specified defaults to 5m. .. note: The TTL is only checked at the time of DNS refresh, as specified by dns_refresh_rate. This means that if the configured TTL is shorter than the refresh rate the host may not be removed immediately. .. note: The TTL has no relation to DNS TTL and is only used to control Envoy's resource usage. | | `maxHosts` | | The maximum number of hosts that the cache will hold. If not specified defaults to 1024.

note: The implementation is approximate and enforced independently on each worker thread, thus it is possible for the maximum hosts in the cache to go slightly above the configured value depending on timing. This is similar to how other circuit breakers work. | | `dnsFailureRefreshRate` | | If the DNS failure refresh rate is specified, this is used as the cache's DNS refresh rate when DNS requests are failing. If this setting is not specified, the failure refresh rate defaults to the dnsrefreshrate. | | `dnsCacheCircuitBreaker` | | The config of circuit breakers for resolver. It provides a configurable threshold. Envoy will use dns cache circuit breakers with default settings even if this value is not set. | | `caresDns` | | Only one of `caresDns` or `appleDns` can be set. | | `appleDns` | | Only one of `appleDns` or `caresDns` can be set. | | `preresolveHostnames` | | Hostnames that should be preresolved into the cache upon creation. This might provide a performance improvement, in the form of cache hits, for hostnames that are going to be resolved during steady state and are known at config load time. | | `dnsQueryTimeout` | | The timeout used for DNS queries. This timeout is independent of any timeout and retry policy used by the underlying DNS implementation (e.g., c-areas and Apple DNS) which are opaque. Setting this timeout will ensure that queries succeed or fail within the specified time frame and are then retried using the standard refresh rates. Defaults to 5s if not set. | ```yaml "baseInterval": .google.protobuf.Duration "maxInterval": .google.protobuf.Duration ``` | Field | Type | Description | | -- | - | -- | | `baseInterval` | | Specifies the base interval between refreshes. This parameter is required and must be greater than 1ms and less than :ref:`maxinterval <envoyv3apifieldconfig.cluster.v3.Cluster.RefreshRate.maxinterval>`. | | `maxInterval` | | Specifies the maximum interval between refreshes. This parameter is optional, but must be greater than or equal to the :ref:`baseinterval <envoyv3apifieldconfig.cluster.v3.Cluster.RefreshRate.baseinterval>` if set. The default is 10 times the :ref:`baseinterval <envoyv3apifieldconfig.cluster.v3.Cluster.RefreshRate.baseinterval>`. | Per route Configuration for the dynamic forward proxy HTTP filter. ```yaml "hostRewrite": string "autoHostRewriteHeader": string ``` | Field | Type | Description | | -- | - | -- | | `hostRewrite` | `string` | Indicates that before DNS lookup, the host header will be swapped with this value. If not set or empty, the original host header value will be used and no rewrite will happen. Note: this rewrite affects both DNS lookup and host header forwarding. However, this option shouldn't be used with :ref:`HCM host rewrite <envoyapifieldroute.RouteAction.hostrewrite>` given that the value set here would be used for DNS lookups whereas the value set in the HCM would be used for host header forwarding which is not the desired outcome. Only one of `hostRewrite` or `autoHostRewriteHeader` can be set. | | `autoHostRewriteHeader` | `string` | Indicates that before DNS lookup, the host header will be swapped with the value of this

If not set or empty, the original host header value will be used and no rewrite will happen. Note: this rewrite affects both DNS lookup and host header forwarding. However, this option shouldn't be used with :ref:`HCM host rewrite header <envoyapifieldroute.RouteAction.autohostrewriteheader>` given that the value set here would be used for DNS lookups whereas the value set in the HCM would be used for host header forwarding which is not the desired outcome. .. note:: If the header appears multiple times only the first value is used. Only one of `autoHostRewriteHeader` or `hostRewrite` can be set. | Configuration of DNS resolver option flags which control the behavior of the DNS resolver. ```yaml "useTcpForDnsLookups": bool "noDefaultSearchDomain": bool ``` | Field | Type | Description | | -- | - | -- | | `useTcpForDnsLookups` | `bool` | Use TCP for all DNS queries instead of the default protocol UDP. | | `noDefaultSearchDomain` | `bool` | Do not use the default search domains; only query hostnames as-is or as aliases. | Configuration for c-ares DNS resolver. ```yaml "resolvers": []solo.io.envoy.config.core.v3.Address "dnsResolverOptions": .dfp.options.gloo.solo.io.DnsResolverOptions ``` | Field | Type | Description | | -- | - | -- | | `resolvers` | | A list of dns resolver addresses. :ref:`useresolversasfallback<envoyv3apifieldextensions.network.dnsresolver.cares.v3.CaresDnsResolverConfig.useresolversas_fallback>` below dictates if the DNS client should override system defaults or only use the provided resolvers if the system defaults are not available, i.e., as a fallback. | | `dnsResolverOptions` | | Configuration of DNS resolver option flags which control the behavior of the DNS resolver. | Configuration for apple DNS resolver. ```yaml ``` | Field | Type | Description | | -- | - | -- | Description: When V4_ONLY is selected, the DNS resolver will only perform a lookup for addresses in the IPv4 family. If V6_ONLY is selected, the DNS resolver will only perform a lookup for addresses in the IPv6 family. If AUTO is specified, the DNS resolver will first perform a lookup for addresses in the IPv6 family and fallback to a lookup for addresses in the IPv4 family. This is semantically equivalent to a non-existent V6_PREFERRED option. AUTO is a legacy name that is more opaque than necessary and will be deprecated in favor of V6_PREFERRED in a future major version of the API. If V4_PREFERRED is specified, the DNS resolver will first perform a lookup for addresses in the IPv4 family and fallback to a lookup for addresses in the IPv6 family. i.e., the callback target will only get v6 addresses if there were NO v4 addresses to return. If ALL is specified, the DNS resolver will perform a lookup for both IPv4 and IPv6 families, and return all resolved addresses. For cluster types other than :ref:`STRICTDNS<envoyv3apienumvalueconfig.cluster.v3.Cluster.DiscoveryType.STRICT_DNS>` and :ref:`LOGICALDNS<envoyv3apienumvalueconfig.cluster.v3.Cluster.DiscoveryType.LOGICAL_DNS>`, this setting is ignored. [#next-major-version: deprecate AUTO in favor of a V6_PREFERRED option.] | Name | Description | | -- | -- | | V4_PREFERRED | | | V4_ONLY | | | V6_ONLY | | | AUTO | | | ALL | | <!-- Start of HubSpot Embed Code --> <script type="text/javascript" id="hs-script-loader" async defer src="//js.hs-scripts.com/5130874.js"></script> <!-- End of HubSpot Embed Code -->