Update filter chain creation for sidecar/ingress listeners

.changelog/11245.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: fix issue with attempting to generate an invalid upstream cluster from UpstreamConfig.Defaults.
+```

agent/proxycfg/state.go

@@ -114,11 +114,12 @@ func copyProxyConfig(ns *structs.NodeService) (structs.ConnectProxyConfig, error
 	for idx := range proxyCfg.Upstreams {
 		us := &proxyCfg.Upstreams[idx]
 		if us.DestinationType != structs.UpstreamDestTypePreparedQuery && us.DestinationNamespace == "" {
-			// default the upstreams target namespace to the namespace of the proxy
+			// default the upstreams target namespace and partition to those of the proxy
 			// doing this here prevents needing much more complex logic a bunch of other
 			// places and makes tracking these upstreams simpler as we can dedup them
 			// with the maps tracking upstream ids being watched.
 			proxyCfg.Upstreams[idx].DestinationNamespace = ns.EnterpriseMeta.NamespaceOrDefault()
+			proxyCfg.Upstreams[idx].DestinationPartition = ns.EnterpriseMeta.PartitionOrDefault()
 		}
 	}
 

agent/proxycfg/state_test.go

@@ -1686,6 +1686,7 @@ func TestState_WatchesAndUpdates(t *testing.T) {
 							db.String(): {
 								DestinationName:      "db",
 								DestinationNamespace: structs.IntentionDefaultNamespace,
+								DestinationPartition: structs.IntentionDefaultNamespace,
 							},
 						}
 						require.Equal(t, expectUpstreams, snap.ConnectProxy.UpstreamConfig)