Backport of [NET-5772] Make tcp external service registered on terminating gw reachable from peered cluster into release/1.18.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #19881 to be assessed for backporting due to the inclusion of the label backport/1.18.

The below text is copied from the body of the original PR.

---

Note

This is a followup to #18959 which fixed the same problem specifically when using http protocol.

Description

The terminating gateways needs to be able to handle TCP connections from peers which are not TLS-terminated at the local mesh gateway. This amounts to including the target SNI that downstreams from peers would use when building the TLS context for the terminating gateway.

Filter chain match before this change

filter_chain_match: {
  server_names: [
    "destination.default.dc2.internal.b81d6ee2-8454-768e-0a06-38a62620f76a.consul"
  ]
}

Filter chain match after this change

filter_chain_match: {
  server_names: [
    "destination.default.dc2.internal.b81d6ee2-8454-768e-0a06-38a62620f76a.consul",
    "destination.default.default.dc1.external.b81d6ee2-8454-768e-0a06-38a62620f76a.consul"
  ]
}

Testing & Reproduction steps

You can test this fix using the setup here, changing the <ServiceDefaults>.spec.protocol as necessary in resources/dc2/external-service.yaml if you want to see the behavior for http services as well.

You will need to pin a build of this branch as global.image in values-dc2.yaml. I would recommend doing an install without this build to witness things in their current broken state, and then doing a helm upgrade with global.image set.

Links

PR Checklist

• updated test coverage
• external facing docs updated
• appropriate backport labels added
• not a security concern

---

Overview of commits

• 7ed7f23 - 9c8529b - 5753ee8 - 17bc757 - d0fa205

[github-team-consul-core-pr-approver]

Auto approved Consul Bot automated PR