From 58aed4dc0473e643b1a412ff49f588d9eaa28f77 Mon Sep 17 00:00:00 2001
From: Nitya Dhanushkodi <nitya@hashicorp.com>
Date: Wed, 8 Feb 2023 14:49:38 -0800
Subject: [PATCH] troubleshoot: handle tproxy dialed directly case (#16210)

---
 troubleshoot/validate/validate.go      | 11 +++++++++++
 troubleshoot/validate/validate_test.go | 22 ++++++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/troubleshoot/validate/validate.go b/troubleshoot/validate/validate.go
index b02480fe6..59dad4031 100644
--- a/troubleshoot/validate/validate.go
+++ b/troubleshoot/validate/validate.go
@@ -2,6 +2,7 @@ package validate
 
 import (
 	"fmt"
+	"strings"
 
 	envoy_admin_v3 "github.com/envoyproxy/go-control-plane/envoy/admin/v3"
 	envoy_cluster_v3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
@@ -181,6 +182,16 @@ func (v *Validate) GetMessages(validateEndpoints bool, endpointValidator Endpoin
 			})
 		}
 
+		// If the resource is a passthrough cluster, it will not have endpoints, so we need to skip the endpoint
+		// validation.
+		if strings.Contains(sni, "passthrough~") {
+			messages = append(messages, Message{
+				Message: fmt.Sprintf("cluster %q is a passthrough cluster, skipping endpoint healthiness check", sni),
+				Success: true,
+			})
+			continue
+		}
+
 		if validateEndpoints {
 			// If resource is a top-level cluster (any cluster that is an aggregate cluster or not a child of an aggregate
 			// cluster), it will have an empty parent. If resource is a child cluster, it will have a nonempty parent.
diff --git a/troubleshoot/validate/validate_test.go b/troubleshoot/validate/validate_test.go
index bbae5d240..c8f353f30 100644
--- a/troubleshoot/validate/validate_test.go
+++ b/troubleshoot/validate/validate_test.go
@@ -171,6 +171,28 @@ func TestErrors(t *testing.T) {
 			},
 			err: "no healthy endpoints for aggregate cluster \"db-sni\" for upstream \"db\"",
 		},
+		"success: passthrough cluster doesn't error even though there are zero endpoints": {
+			validate: func() *Validate {
+				return &Validate{
+					envoyID: "db",
+					snis: map[string]struct{}{
+						"passthrough~db-sni": {},
+					},
+					listener: true,
+					usesRDS:  true,
+					route:    true,
+					resources: map[string]*resource{
+						"passthrough~db-sni": {
+							required: true,
+							cluster:  true,
+						},
+					},
+				}
+			},
+			endpointValidator: func(r *resource, s string, clusters *envoy_admin_v3.Clusters) {
+				r.loadAssignment = true
+			},
+		},
 	}
 
 	for n, tc := range cases {