Ensure we remove Connect proxy before deregistering the service itself

This will fix hashicorp#5351

Author: pierresouchay

agent/agent.go

@@ -2071,6 +2071,17 @@ func (a *Agent) removeServiceLocked(serviceID string, persist bool) error {
 		checkIDs = append(checkIDs, id)
 	}
 
+	// Remove the associated managed proxy if it exists
+	// This has to be DONE before purging configuration as might might have issues
+	// With ACLs otherwise
+	for proxyID, p := range a.State.Proxies() {
+		if p.Proxy.TargetServiceID == serviceID {
+			if err := a.removeProxyLocked(proxyID, true); err != nil {
+				return err
+			}
+		}
+	}
+
 	// Remove service immediately
 	if err := a.State.RemoveServiceWithChecks(serviceID, checkIDs); err != nil {
 		a.logger.Printf("[WARN] agent: Failed to deregister service %q: %s", serviceID, err)
@@ -2094,15 +2105,6 @@ func (a *Agent) removeServiceLocked(serviceID string, persist bool) error {
 		}
 	}
 
-	// Remove the associated managed proxy if it exists
-	for proxyID, p := range a.State.Proxies() {
-		if p.Proxy.TargetServiceID == serviceID {
-			if err := a.removeProxyLocked(proxyID, true); err != nil {
-				return err
-			}
-		}
-	}
-
 	a.logger.Printf("[DEBUG] agent: removed service %q", serviceID)
 
 	// If any Sidecar services exist for the removed service ID, remove them too.