troubleshoot: handle tproxy dialed directly case (#16210)

troubleshoot/validate/validate.go

@@ -2,6 +2,7 @@ package validate
 
 import (
 	"fmt"
+	"strings"
 
 	envoy_admin_v3 "github.com/envoyproxy/go-control-plane/envoy/admin/v3"
 	envoy_cluster_v3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
@@ -181,6 +182,16 @@ func (v *Validate) GetMessages(validateEndpoints bool, endpointValidator Endpoin
 			})
 		}
 
+		// If the resource is a passthrough cluster, it will not have endpoints, so we need to skip the endpoint
+		// validation.
+		if strings.Contains(sni, "passthrough~") {
+			messages = append(messages, Message{
+				Message: fmt.Sprintf("cluster %q is a passthrough cluster, skipping endpoint healthiness check", sni),
+				Success: true,
+			})
+			continue
+		}
+
 		if validateEndpoints {
 			// If resource is a top-level cluster (any cluster that is an aggregate cluster or not a child of an aggregate
 			// cluster), it will have an empty parent. If resource is a child cluster, it will have a nonempty parent.

troubleshoot/validate/validate_test.go

@@ -171,6 +171,28 @@ func TestErrors(t *testing.T) {
 			},
 			err: "no healthy endpoints for aggregate cluster \"db-sni\" for upstream \"db\"",
 		},
+		"success: passthrough cluster doesn't error even though there are zero endpoints": {
+			validate: func() *Validate {
+				return &Validate{
+					envoyID: "db",
+					snis: map[string]struct{}{
+						"passthrough~db-sni": {},
+					},
+					listener: true,
+					usesRDS:  true,
+					route:    true,
+					resources: map[string]*resource{
+						"passthrough~db-sni": {
+							required: true,
+							cluster:  true,
+						},
+					},
+				}
+			},
+			endpointValidator: func(r *resource, s string, clusters *envoy_admin_v3.Clusters) {
+				r.loadAssignment = true
+			},
+		},
 	}
 
 	for n, tc := range cases {