diff --git a/.changelog/16673.txt b/.changelog/16673.txt new file mode 100644 index 000000000..f72eedc61 --- /dev/null +++ b/.changelog/16673.txt @@ -0,0 +1,3 @@ +```release-note:bug +peering: Fixes a bug where the importing partition was not added to peered failover targets, which causes issues when the importing partition is a non-default partition. +``` diff --git a/agent/proxycfg/upstreams.go b/agent/proxycfg/upstreams.go index 30fe43280..21db25923 100644 --- a/agent/proxycfg/upstreams.go +++ b/agent/proxycfg/upstreams.go @@ -470,6 +470,9 @@ func (s *handlerUpstreams) watchUpstreamTarget(ctx context.Context, snap *Config if opts.peer != "" { uid = NewUpstreamIDFromTargetID(opts.chainID) + // chainID has the partition stripped. However, when a target is in a cluster peer, the partition should be set + // to the local partition (i.e chain.Partition), since the peered target is imported into the local partition. + uid.OverridePartition(opts.entMeta.PartitionOrDefault()) correlationID = upstreamPeerWatchIDPrefix + uid.String() } diff --git a/agent/xds/clusters.go b/agent/xds/clusters.go index 9a296d2a8..f3c85ee18 100644 --- a/agent/xds/clusters.go +++ b/agent/xds/clusters.go @@ -1957,11 +1957,17 @@ func (s *ResourceGenerator) mapDiscoChainTargets(cfgSnap *proxycfg.ConfigSnapsho } if targetUID.Peer != "" { + // targetID has the partition stripped, so targetUID will not have a partition either. However, + // when a failover target is in a cluster peer, the partition should be set to the local partition (i.e + // chain.Partition), since the peered failover target is imported into the local partition. + targetUID.OverridePartition(chain.Partition) + tbs, _ := upstreamsSnapshot.UpstreamPeerTrustBundles.Get(targetUID.Peer) rootPEMs = tbs.ConcatenatedRootPEMs() peerMeta, found := upstreamsSnapshot.UpstreamPeerMeta(targetUID) if !found { + s.Logger.Warn("failed to fetch upstream peering metadata", "target", targetUID) continue } sni = peerMeta.PrimarySNI()