Skip filter chain created by permissive mtls

[kisunji]

Backports:
1.17.x
1.16.x

Description

Customers transitioning to service mesh using mTLS permissive mode and transparent proxy have run into an issue when using some envoy extensions like local rate-limiter because permissive mode adds a new filter chain to the public_listener: https://github.com/hashicorp/consul/blob/v1.17.2/agent/xds/listeners.go#L1436-L1445

Most of our envoy extensions assume one filter chain containing an HTTPConnectionManager but that assumption is broken in permissive mode.

We have yet to decide on how the permissive filter chain should interact with envoy extensions but until then, it is safer to explicitly skip it (meaning envoy extensions will not apply to insecure traffic to services) so that xDS does not error upon being unable to find an HTTPConnectionManager.

Testing & Reproduction steps

Manual testing was done on enterprise:

1. Started a cluster with TProxy and Permissive mTLS enabled
2. Added ratelimit service config entry
3. Observed xDS errors:

[warning] envoy.config(14) DeltaAggregatedResources gRPC config stream to consul-dataplane closed: 3, failed to patch xDS resources in │
│  the "builtin/rate-limit" extension: 1 error occurred:%0A%09* error patching listener filter chain "public_listener:10.15.2.251:20000": error patching filters: failed to insert top l │
│ evel local_ratelimit filter: failed to get HTTP connection manager%0A%0A

After this patch, the errors were suppressed and the ratelimit filter applied correctly to the non-permissive filter chain.

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

[jkirschner-hashicorp]

We should update the permissive mode docs to list which functionality is not supported with permissive mode (e.g., rate limiting, all the Envoy extensions that can be invoked directly).

That can happen in a separate PR if needed.

[kisunji]

I tried working with a sentinel name for the filter chain but ran into issues with v2 resource tests since v2 proxystate Routers don't have names.

Instead I added this special case code block to suppress errors as long as one filter chain gets patched successfully.

[hc-github-team-consul-core]

Backport failed @kisunji. Run: https://github.com/hashicorp/consul/actions/runs/7732725160

[hc-github-team-consul-core]

@kisunji, a backport is missing for this PR [20406] for versions [1.16,1.17] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

[hc-github-team-consul-core]

@kisunji, a backport is missing for this PR [20406] for versions [1.16,1.17] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

[hc-github-team-consul-core]

@kisunji, a backport is missing for this PR [20406] for versions [1.16,1.17] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

[hc-github-team-consul-core]

@kisunji, a backport is missing for this PR [20406] for versions [1.16,1.17] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

[hc-github-team-consul-core]

@kisunji, a backport is missing for this PR [20406] for versions [1.16,1.17] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>

[hc-github-team-consul-core]

@kisunji, a backport is missing for this PR [20406] for versions [1.16,1.17] please perform the backport manually and add the following snippet to your backport PR description:

<details>
	<summary> Overview of commits </summary>
		- <<backport commit 1>>
		- <<backport commit 2>>
		...
</details>