[NET-5772] Make tcp external service registered on terminating gw reachable from peered cluster

[nathancoleman]

Note

This is a followup to #18959 which fixed the same problem specifically when using http protocol.

Description

The terminating gateways needs to be able to handle TCP connections from peers which are not TLS-terminated at the local mesh gateway. This amounts to including the target SNI that downstreams from peers would use when building the TLS context for the terminating gateway.

Filter chain match before this change

filter_chain_match: {
  server_names: [
    "destination.default.dc2.internal.b81d6ee2-8454-768e-0a06-38a62620f76a.consul"
  ]
}

Filter chain match after this change

filter_chain_match: {
  server_names: [
    "destination.default.dc2.internal.b81d6ee2-8454-768e-0a06-38a62620f76a.consul",
    "destination.default.default.dc1.external.b81d6ee2-8454-768e-0a06-38a62620f76a.consul"
  ]
}

Testing & Reproduction steps

You can test this fix using the setup here, changing the <ServiceDefaults>.spec.protocol as necessary in resources/dc2/external-service.yaml if you want to see the behavior for http services as well.

You will need to pin a build of this branch as global.image in values-dc2.yaml. I would recommend doing an install without this build to witness things in their current broken state, and then doing a helm upgrade with global.image set.

Links

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

[nathancoleman]

@erichaberkorn @jm96441n this still needs tests, a changelog entry, etc.; however, I'd appreciate it if you guys could sanity check my change here. I've verified that it works for tcp services and will verify that everything is what we expect with http services shortly.

[nathancoleman]

This logic gets moved out to a re-usable function below

[jm96441n]

approach overall LGTM, do you have an existing setup to run/test it out locally that I could steal to do some testing as well?

[jm96441n]

LGTM! nice work