feat: expose maxHosts for DynamicResolver DNS cache - #9740
Conversation
Envoy's dynamic_forward_proxy DnsCacheConfig supports a max_hosts field that bounds the number of hosts held in the DNS cache, but Envoy Gateway did not surface it through any API, so it was stuck at Envoy's default of 1024. This adds a first-class `maxHosts` field to the DNS config. The field is added to the shared DNS type so it is configurable everywhere existing DNS settings live (BackendTrafficPolicy, EnvoyExtensionPolicy, EnvoyProxy, SecurityPolicy), consistent with how dnsRefreshRate and lookupFamily are already exposed. It flows API -> IR (translateDNS) -> xDS (buildDFPDNSCacheConfig), which feeds both the cluster and SNI dynamic-forward-proxy paths. When unset, Envoy's default is preserved. Fixes envoyproxy#9382 Test Plan: Regenerated deepcopy, CRDs, and API reference docs via controller-gen and crd-ref-docs (the repo's own tooling). ``` go test ./internal/xds/translator/ ./internal/gatewayapi/ ./internal/ir/ ./api/... go vet ./internal/xds/translator/ ./internal/gatewayapi/ ./internal/ir/ ./api/... ``` Added a translator golden case (http-route-dynamic-resolver-dns-max-hosts) asserting `maxHosts` in the rendered Envoy dnsCacheConfig, extended the gatewayapi backendtrafficpolicy-with-dns-settings fixture to exercise the API->IR conversion, and added TestBuildDFPDNSCacheConfig covering the nil/unset/set cases. This change was authored with the assistance of Claude, an AI assistant. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
✅ Deploy Preview for cerulean-figolla-1f9435 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aee307f811
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| - IPv6Preferred | ||
| - IPv4AndIPv6 | ||
| type: string | ||
| maxHosts: |
There was a problem hiding this comment.
This generated CRD schema now renders maxHosts, but none of the test/helm/*.out.yaml golden manifests were updated (I checked rg -n maxHosts test/helm). make gen-check runs helm-template and then fails on any worktree diff (tools/make/lint.mk:81-85, with gateway-crds-helm rendering from tools/make/helm.mk:83-90), so this change will leave CI/presubmit dirty until the Helm golden outputs are regenerated.
Useful? React with 👍 / 👎.
1 participant
Fixes #9382
What this does
Envoy's
dynamic_forward_proxyDnsCacheConfigsupports amax_hostsfield that bounds how many hosts the DNS cache holds. Envoy Gateway did not expose it, so it was pinned to Envoy's default of 1024. This adds a first-classmaxHostsfield to the DNS configuration.Design
The field is added to the shared
DNStype, so it is configurable everywhere existing DNS settings live (BackendTrafficPolicy, EnvoyExtensionPolicy, EnvoyProxy, SecurityPolicy) — consistent with howdnsRefreshRateandlookupFamilyare already surfaced. It flows through the standard pipeline:api/v1alpha1/dns_types.go:MaxHosts *uint32(+kubebuilder:validation:Minimum=1)internal/ir/xds.go:MaxHosts *uint32on the internalDNSstructinternal/gatewayapi/clustersettings.go(translateDNS)internal/xds/translator/cluster.go(buildDFPDNSCacheConfig), which feeds both the cluster and SNI dynamic-forward-proxy pathsWhen unset, Envoy's default is preserved.
The issue floated Backend / DynamicResolver / EnvoyProxy as candidate homes for the field; putting it on the shared DNS type covers those via the existing
ClusterSettings.dnssurface. Happy to move it if maintainers prefer a narrower placement.Testing
Generated code (deepcopy, CRDs, API reference docs) was regenerated with the repo's own tooling (
controller-gen,crd-ref-docs).http-route-dynamic-resolver-dns-max-hostsassertingmaxHostsin the rendered EnvoydnsCacheConfigbackendtrafficpolicy-with-dns-settingsfixture to exercise the API→IR conversionTestBuildDFPDNSCacheConfigunit test covering nil / unset / setThis PR was authored with the assistance of Claude, an AI assistant.
🤖 Generated with Claude Code