Backport of Fix configuration merging for implicit tproxy upstreams. into release/1.14.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #16000 to be assessed for backporting due to the inclusion of the label backport/1.14.

WARNING automatic cherry-pick of commits failed. Commits will require human attention.

merge conflict error: POST https://api.github.com/repos/hashicorp/consul/merges: 409 Merge conflict []

The below text is copied from the body of the original PR.

---

This PR fixes an issue where tproxy would not correctly use service-defaults and proxy-defaults for implicit upstreams. Normally, we handle this by taking configuration from an auto-generated wildcard * upstream, but that was not done in all cases -- notably peer upstreams.

The changes here are essentially:

1. Change the merging logic so that the wildcard upstream has correct proxy-defaults and service-defaults values combined into it. It did not previously merge all fields, and the wildcard upstream did not exist unless service-defaults existed (it ignored proxy-defaults, essentially).
2. Change the way we fetch upstream configuration in the xDS layer so that it falls back to the wildcard when no matching upstream is found. This is what allows implicit peer upstreams to have the correct "merged" config.
3. Change proxycfg to always watch local mesh gateway endpoints whenever a peer upstream is found. This simplifies the logic so that we do not have to inspect the "merged" configuration on peer upstreams to extract the mesh gateway mode.

It's worth noting that another large issue still needs to be resolved in a different PR (#15956), where the ServiceDefaults.UpstreamConfig.Overrides[].Peer field does NOT exist. This manifests in two ways after these changes:

1. Explicit (non-tproxy) peer upstreams incorrectly have overrides applied to them, since the functions in agent/configentry/merge_service_config.go and agent/configentry/resolve.go are oblivious to the concept of a peer.
2. Implicit (tproxy) peer upstreams do not have overrides applied to them, because the UID that proxycfg expects is default/default/mysvc?peer=cluster-02, but the overrides UID is default/default/mysvc. This is technically correct behavior, but it's noted here, because overrides will NOT work for peer upstreams in tproxy mode until the agent/configentry package is updated.

---

Overview of commits

• fc4ce26 - 4e24bc3 - ee59d4a - 47eb461

[hashicorp-cla]

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes

---

1 out of 2 committers have signed the CLA.

• hashi-derek
• temp

---

temp seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA. If you already have a GitHub account, please add the email address used for this commit to your account.

_{Have you signed the CLA already but the status is still pending? Recheck it.}

[github-team-consul-core-pr-approver]

Auto approved Consul Bot automated PR