ServiceProbe is broken with transparent proxying Universal

[jakubdyszkiewicz]

What happened?

Steps to reproduce run should not load balance requests to unhealthy instance on UniCluster1 or manually

1. Spawn Envoy with Application on Unviersal with Transparent Proxying
2. Kill app
3. See that Envoy reports that the app is healthy.

After digging deeper it is caused by #4630
When the regular traffic goes to the Envoy, it goes through the inbound listener, then to cluster that has set upstream bind config. This modifies the source address+port so iptables can pass this traffic further.

When the traffic is initiated by Envoy with HC it does not use the cluster therefore it does not have changed bind config.

Potential solutions that we quickly discussed:

1. Modify Envoy HDS to let it override upstream bind config
2. Move HDS to kuma-dp Go process (requires rebuilding HDS client etc.)

[jakubdyszkiewicz]

Will be solved by envoyproxy/envoy#24053

[github-actions]

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

[michaelbeaumont]

Will be solved in Envoy v1.25