Not able to resolve hostnames of external server for TCP proxying

[bharanitharanm]

Envoy not able to resolve hostnames deployed in Kubernetes cluster (K3S)

Verifying hostname resolution from busybox pod for testing

edge-38ff3542bb059c6806df04b9c101f7d7:~ # kubectl exec -it busybox -n compute -- nslookup tcp-server.com
Server:    100.64.0.10
Address 1: 100.64.0.10 kube-dns.kube-system.svc.cluster.local

Name:      tcp-server.com
Address 1: 10.12.135.120
edge-38ff3542bb059c6806df04b9c101f7d7:~ #

Configured Envoy for TCP proxy to external server using hostname,

kind: GatewayClass
apiVersion: gateway.networking.k8s.io/v1
metadata:
  name: example-gateway-class
  namespace: compute
  labels:
    example: tcp-routing
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: tcp-gateway-egress
  namespace: compute
spec:
  gatewayClassName: example-gateway-class
  listeners:
    - name: tcp
      protocol: TCP
      port: 9007
---
apiVersion: v1
kind: Service
metadata:
  name: external-tcp-server
  namespace: compute
spec:
  type: ExternalName
  externalName: tcp-server.com
  ports:
    - port: 8080
      targetPort: 8080
      protocol: TCP
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata:
  name: tcp-proxy
  namespace: compute
spec:
  parentRefs:
    - name: tcp-gateway-egress
  rules:
    - backendRefs:
        - name: external-tcp-server
          namespace: compute
          port: 8080

Testing

edge-38ff3542bb059c6806df04b9c101f7d7:~ # kubectl get svc -n compute
NAME                                        TYPE           CLUSTER-IP      EXTERNAL-IP      PORT(S)                                            AGE
envoy-compute-tcp-gateway-egress-ed54a08c   LoadBalancer   100.64.47.188   10.177.193.172   9007:32473/TCP                                     28m
envoy-gateway                               ClusterIP      100.64.3.247    <none>           18000/TCP,18001/TCP,18002/TCP,19001/TCP,9443/TCP   30m
external-tcp-server                         ExternalName   <none>          tcp-server.com   8080/TCP                                           28m
edge-38ff3542bb059c6806df04b9c101f7d7:~ #
edge-38ff3542bb059c6806df04b9c101f7d7:~ # kubectl get po -n compute
NAME                                                         READY   STATUS    RESTARTS   AGE
axone-base                                                   1/1     Running   0          30m
busybox                                                      1/1     Running   0          5m3s
envoy-compute-tcp-gateway-egress-ed54a08c-5cdfcf5898-t5bw5   2/2     Running   0          28m
envoy-gateway-64c89dfff6-wvz9w                               1/1     Running   0          30m
edge-38ff3542bb059c6806df04b9c101f7d7:~ # kubectl get gateway -n compute
NAME                 CLASS                   ADDRESS          PROGRAMMED   AGE
tcp-gateway-egress   example-gateway-class   10.177.193.172   True         28m
edge-38ff3542bb059c6806df04b9c101f7d7:~ #

Below error is logged in Envoy

edge-38ff3542bb059c6806df04b9c101f7d7:~ # echo "Test data" | nc 10.177.193.172 9007
edge-38ff3542bb059c6806df04b9c101f7d7:~ # kubectl logs -f envoy-compute-tcp-gateway-egress-ed54a08c-5cdfcf5898-t5bw5 -n compute --since 30s
Defaulted container "envoy" out of: envoy, shutdown-manager
{":authority":null,"bytes_received":0,"bytes_sent":0,"connection_termination_details":null,"downstream_local_address":"100.64.64.127:9007","downstream_remote_address":"100.64.64.1:58763","duration":0,"method":null,"protocol":null,"requested_server_name":null,"response_code":0,"response_code_details":null,"response_flags":"UH","route_name":null,"start_time":"2025-09-12T07:00:21.518Z","upstream_cluster":"tcproute/compute/tcp-proxy/rule/-1","upstream_host":null,"upstream_local_address":null,"upstream_transport_failure_reason":null,"user-agent":null,"x-envoy-origin-path":null,"x-envoy-upstream-service-time":null,"x-forwarded-for":null,"x-request-id":null}

[arkodg]

are endpoints present for external-tcp-server ?

[deekshith-hadil]

I tried by adding the endpoints for external-tcp-server and it works.

apiVersion: v1
kind: Endpoints
metadata:
  name: external-tcp-server
  namespace: compute
subsets:
  - addresses:
      - ip: 10.12.135.120
    ports:
      - port: 8080
        protocol: TCP

Since the host is external and is resolved via DNS, adding endpoints with IP is not possible. The user may not know the IP or it can change over time. Is there any work around for this problem?

[bharanitharanm]

Is TCPRoute + ExternalName Service currently supported by Envoy Gateway for dynamic DNS resolution?

[arkodg]

ExternalName is not supported due to https://gateway.envoyproxy.io/docs/tasks/traffic/backend/#warning