Revert "multi-network: fix eastwest gateway endpoint filtering (istio…

…#38762) (istio#39275)"

This reverts commit 097fed9.

pilot/pkg/xds/endpoint_builder.go

@@ -103,11 +103,10 @@ func NewEndpointBuilder(clusterName string, proxy *model.Proxy, push *model.Push
 		port:       port,
 	}
 
-	passthroughMode := model.IsDNSSrvSubsetKey(clusterName)
 	// We need this for multi-network, or for clusters meant for use with AUTO_PASSTHROUGH.
 	if features.EnableAutomTLSCheckPolicies ||
-		b.push.NetworkManager().IsMultiNetworkEnabled() || passthroughMode {
-		b.mtlsChecker = newMtlsChecker(push, port, dr, passthroughMode)
+		b.push.NetworkManager().IsMultiNetworkEnabled() || model.IsDNSSrvSubsetKey(clusterName) {
+		b.mtlsChecker = newMtlsChecker(push, port, dr)
 	}
 	return b
 }
@@ -436,26 +435,19 @@ type mtlsChecker struct {
 	rootPolicyMode *networkingapi.ClientTLSSettings_TLSmode
 }
 
-func newMtlsChecker(push *model.PushContext, svcPort int, dr *config.Config, passthroughMode bool) *mtlsChecker {
-	var rootPolicyMode *networkingapi.ClientTLSSettings_TLSmode
+func newMtlsChecker(push *model.PushContext, svcPort int, dr *config.Config) *mtlsChecker {
 	var drSpec *networkingapi.DestinationRule
-
-	// tcp passthrough gateways don't care about client settings
-	if !passthroughMode {
-		rootPolicyMode = mtlsModeForDefaultTrafficPolicy(dr, svcPort)
-		if dr != nil {
-			drSpec = dr.Spec.(*networkingapi.DestinationRule)
-		}
+	if dr != nil {
+		drSpec = dr.Spec.(*networkingapi.DestinationRule)
 	}
-
 	return &mtlsChecker{
 		push:                 push,
 		svcPort:              svcPort,
 		destinationRule:      drSpec,
 		mtlsDisabledHosts:    map[string]struct{}{},
 		peerAuthDisabledMTLS: map[string]bool{},
 		subsetPolicyMode:     map[string]*networkingapi.ClientTLSSettings_TLSmode{},
-		rootPolicyMode:       rootPolicyMode,
+		rootPolicyMode:       mtlsModeForDefaultTrafficPolicy(dr, svcPort),
 	}
 }