connect: Forward intention RPCs if this isn't the primary

agent/consul/intention_endpoint.go

@@ -29,6 +29,12 @@ type Intention struct {
 func (s *Intention) Apply(
 	args *structs.IntentionRequest,
 	reply *string) error {
+
+	// Forward this request to the primary DC if we're a secondary that's replicating intentions.
+	if s.srv.intentionReplicationEnabled() {
+		args.Datacenter = s.srv.config.PrimaryDatacenter
+	}
+
 	if done, err := s.srv.forward("Intention.Apply", args, args, reply); done {
 		return err
 	}