Make Envoy's Forward-Proxy Filter and Cluster Use the Same DNS Cache

Repeat matching dns_cache_config parameters in both components, then check resolved-host and cluster lookup consistency.

Envoy's HTTP dynamic forward proxy has a resolution filter and a dynamic cluster. Put matching cache parameters under each component's typed_config:

dns_cache_config:
  name: shared_egress_cache
  dns_lookup_family: AUTO

This is only the repeated cache fragment. Match the other cache options too; a shared name cannot reconcile incompatible configurations.

The route selects a cluster name, while the cache name identifies resolution state. After the forward-proxy filter handles resolution, the router filter makes the onward request.

If host-rewriting filters or dynamic-host state are involved, compare the host resolved by the filter with the key the cluster requests. Resolving one name cannot populate the expected entry for a different key.

Retain client/destination restrictions. CONNECT handling and upstream TLS/trust need their own configuration; matching the cache does not enable those paths.

Artiglyn mynjee