[release-1.13] multi-network: fix eastwest gateway endpoint filtering (#38762)

pilot/pkg/xds/endpoint_builder.go

@@ -103,10 +103,11 @@ func NewEndpointBuilder(clusterName string, proxy *model.Proxy, push *model.Push
 		port:       port,
 	}
 
+	passthroughMode := model.IsDNSSrvSubsetKey(clusterName)
 	// We need this for multi-network, or for clusters meant for use with AUTO_PASSTHROUGH.
 	if features.EnableAutomTLSCheckPolicies ||
-		b.push.NetworkManager().IsMultiNetworkEnabled() || model.IsDNSSrvSubsetKey(clusterName) {
-		b.mtlsChecker = newMtlsChecker(push, port, dr)
+		b.push.NetworkManager().IsMultiNetworkEnabled() || passthroughMode {
+		b.mtlsChecker = newMtlsChecker(push, port, dr, passthroughMode)
 	}
 	return b
 }
@@ -435,19 +436,26 @@ type mtlsChecker struct {
 	rootPolicyMode *networkingapi.ClientTLSSettings_TLSmode
 }
 
-func newMtlsChecker(push *model.PushContext, svcPort int, dr *config.Config) *mtlsChecker {
+func newMtlsChecker(push *model.PushContext, svcPort int, dr *config.Config, passthroughMode bool) *mtlsChecker {
+	var rootPolicyMode *networkingapi.ClientTLSSettings_TLSmode
 	var drSpec *networkingapi.DestinationRule
-	if dr != nil {
-		drSpec = dr.Spec.(*networkingapi.DestinationRule)
+
+	// tcp passthrough gateways don't care about client settings
+	if !passthroughMode {
+		rootPolicyMode = mtlsModeForDefaultTrafficPolicy(dr, svcPort)
+		if dr != nil {
+			drSpec = dr.Spec.(*networkingapi.DestinationRule)
+		}
 	}
+
 	return &mtlsChecker{
 		push:                 push,
 		svcPort:              svcPort,
 		destinationRule:      drSpec,
 		mtlsDisabledHosts:    map[string]struct{}{},
 		peerAuthDisabledMTLS: map[string]bool{},
 		subsetPolicyMode:     map[string]*networkingapi.ClientTLSSettings_TLSmode{},
-		rootPolicyMode:       mtlsModeForDefaultTrafficPolicy(dr, svcPort),
+		rootPolicyMode:       rootPolicyMode,
 	}
 }
 

releasenotes/notes/38704.yaml

@@ -0,0 +1,7 @@
+apiVersion: release-notes/v2
+kind: bug-fix
+area: traffic-management
+issue: [38704]
+releaseNotes:
+- |
+  **Fixed** improper filtering of endpoints from East-West Gateway caused by `DestinationRule` TLS settings.