Don't write service-defaults during connect-inject unless protocol set explicitly

[lkysow]

Background

The init container we inject for Consul connect writes a service-defaults config for the service if central config is enabled (the default in the helm chart):

consul-k8s/connect-inject/container_init.go

Lines 263 to 270 in 8a2c7cb

	{{- if .CentralConfig }}
	# Create the central config's service registration
	cat <<EOF >/consul/connect-inject/central-config.hcl
	kind = "service-defaults"
	name = "{{ .ServiceName }}"
	protocol = "{{ .ServiceProtocol }}"
	EOF
	{{- end }}

The protocol can be set passing the -default-protocol flag which is controlled by the Helm chart's connectInject.centralConfig.defaultProtocol value. This protocol can be overridden by an annotation on the pod (consul.hashicorp.com/connect-service-protocol). If there is no annotation or Helm value, it will be set to an empty string which Consul will treat as TCP.

Problem

By default we write TCP - When the Pod starts, the service-defaults config will be written. By default, this will set the protocol to TCP. If the protocol is TCP, none of the L7 routing rules will work. A user isn't expecting this config to be written because they haven't configured it anywhere. If they had written a global proxy-defaults config and set the protocol to http so their L7 rules work, the service-defaults config will override the protocol to tcp. This is unexpected. If a user hasn't explicitly configured a protocol, we should not write a service-defaults config.

Proposal

Only write service-defaults if the protocol is explicitly configured, i.e. in connectInject.centralConfig.defaultProtocol or the annotation.