fix: tcp listener is rejected when no route attached

[zhaohuabing]

Create a default route pointing to a static cluster without endpoints when there is no TCPRoutes attached to a TCP listener. This avoids Envoy rejecting a listener without a filter chain and reporting warning.

Fixes #4680

Release Notes: Yes

Alternative consideration:
An alterantive approach could be to not create the xDS listener, but this behavior doesn't align with the Gateway semantics(which does defines a listener) and the behavior of the empty HTTP listener.

Other type of listeners:

• A HTTP listener without HTTPRoute will create the xDS HTTP listener and an empty RouteConfiguration.
• An UDP listener without UDPRoute won't create the xDS UDP listerner at all.

[codecov]

Codecov Report

Attention: Patch coverage is 68.42105% with 6 lines in your changes missing coverage. Please review.

Project coverage is 65.62%. Comparing base (8a01dd6) to head (b037abe).
Report is 17 commits behind head on main.

Files with missing lines	Patch %	Lines
internal/xds/translator/translator.go	68.42%	4 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4681      +/-   ##
==========================================
+ Coverage   65.56%   65.62%   +0.05%     
==========================================
  Files         211      211              
  Lines       31998    32017      +19     
==========================================
+ Hits        20979    21010      +31     
+ Misses       9775     9764      -11     
+ Partials     1244     1243       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[arkodg]

thanks for looking into this @zhaohuabing
can you share what the flow looks like from a client perspective (e.g. using curl) when we either dont create a tcp listener vs tcp listener with dummy filter chain

[zhaohuabing]

thanks for looking into this @zhaohuabing can you share what the flow looks like from a client perspective (e.g. using curl) when we either dont create a tcp listener vs tcp listener with dummy filter chain

can't connect vs connection reset by peer, the latter seems make more sense as there's a listening port on Envoy for the defined Gateway listener.

no tcp listener:

curl -v http://${GATEWAY_HOST}:8080
*   Trying 172.18.0.200:8080...
* connect to 172.18.0.200 port 8080 from 172.18.0.1 port 54918 failed: Connection refused
* Failed to connect to 172.18.0.200 port 8080 after 0 ms: Couldn't connect to server
* Closing connection
curl: (7) Failed to connect to 172.18.0.200 port 8080 after 0 ms: Couldn't connect to server

dummy filter chain

curl -v http://${GATEWAY_HOST}:8080                    
*   Trying 172.18.0.200:8080...
* Connected to 172.18.0.200 (172.18.0.200) port 8080
> GET / HTTP/1.1
> Host: 172.18.0.200:8080
> User-Agent: curl/8.5.0
> Accept: */*
> 
* Recv failure: Connection reset by peer
* Closing connection
curl: (56) Recv failure: Connection reset by peer

[arkodg]

hey @zhaohuabing I prefer if we dont generate an xds listener for this case
wdyt @envoyproxy/gateway-maintainers

[zirain]

hey @zhaohuabing I prefer if we dont generate an xds listener for this case wdyt @envoyproxy/gateway-maintainers

it would be better if possiable.

[arkodg]

from @haq204's comment #4680 (comment) , we may want to have a listener up for responding to TCP health checks

[arkodg]

hey curious, what happens if we set xdsListener.FilterChains = [] for this case, does xDS still complain ?

[zhaohuabing]

Envoy will complain no filter chains specified. It's a validation inside the Envoy listener impl instead of a proto type built-in validation.

https://github.com/envoyproxy/envoy/blob/79958991ffe0cf8d59a4a351646c76d672dada83/source/common/listener_manager/listener_impl.cc#L763-L770

type.googleapis.com/envoy.config.listener.v3.Listener rejected: Error adding/updating listener(s) gateway-conformance-infra/same-namespace/tls: error adding listener '0.0.0.0:10443': no filter chains specified

[zhaohuabing]

This is a bug in the listener-connection-limit test. The routes field in the TCP Listener ir is missing.
This is not directly related to the issue addressed by this PR, but an empty cluster will be added if no route defined for the test.

[zhaohuabing]

Same here.

[zhaohuabing]

Same here.

[zhaohuabing]

Same here.

[zhaohuabing]

Same here.

[zhaohuabing]

Same here.

[zhaohuabing]

Same here.

[arkodg]

LGTM thanks !

[zirain]

/retest