DnsSeedProviderOptionsType

Este conteúdo não está disponível em sua língua ainda.

DnsSeedProviderOptionsType = object

Defined in: src/discovery/DnsSeedProviderOptions.ts:6

Plain options-object shape accepted by a DnsSeedProvider.

Properties

cacheTtlMs?

readonly optional cacheTtlMs?: number

Defined in: src/discovery/DnsSeedProviderOptions.ts:26

In-process TTL cache for DNS lookups. Deliberately not a distributed cache — DNS resolution is a per-process concern, and a Redis hop here would cost more than the lookup itself. Default: 60_000 ms. Set 0 to disable. Failures are NOT cached: a query that throws will retry on the next call.

hostname

readonly hostname: string

Defined in: src/discovery/DnsSeedProviderOptions.ts:8

Hostname to resolve (e.g. my-cluster.default.svc.cluster.local).

log?

readonly optional log?: (message, error?) => void

Defined in: src/discovery/DnsSeedProviderOptions.ts:60

Reports addresses dropped by pinnedAddresses. Default: no-op — which makes a pin-list typo look exactly like an empty DNS answer, so wire this up in production.

Parameters

message

string

error?

unknown

Returns

void

pinnedAddresses?

readonly optional pinnedAddresses?: readonly string[]

Defined in: src/discovery/DnsSeedProviderOptions.ts:54

Addresses the resolver is allowed to hand back. Anything outside the list is discarded (and reported through log) instead of being offered to the cluster as a seed — a spoofed or hijacked DNS answer cannot point this node at a foreign peer. Unset means no pinning: every resolved address is accepted.

Entries come in two shapes, and which one applies depends on useSrv, because the two modes resolve to different things:

'10.0.0.0/8' — a CIDR. Matches the IPs that A-record mode returns.
'svc.cluster.local' — a host suffix, matched on a label boundary. Matches the target hostnames SRV records carry (SRV mode never sees an IP, so a CIDR-only list would discard every legitimate answer).

Mixing both shapes is fine — a config shared between modes — but a list with nothing usable in the configured mode is rejected at construction time rather than silently discarding every seed.

A suffix pin is weaker than a CIDR pin: it constrains the namespace an SRV record may point into, but the A lookup of that target is still unpinned, so an attacker who owns the resolver outright is not stopped by it. It does stop the cheap attack — an injected record aimed at an unrelated domain.