From 0a114995880e62e9ca3ccf285c9b65141fa932ce Mon Sep 17 00:00:00 2001
From: Nitya Dhanushkodi <nitya@hashicorp.com>
Date: Thu, 21 Sep 2023 15:52:30 -0700
Subject: [PATCH] net-5689 fix disabling panic threshold logic (#18958)

---
 agent/xds/clusters_test.go                         |  3 ++-
 agent/xds/proxystateconverter/clusters.go          | 14 ++++++++------
 agent/xdsv2/cluster_resources.go                   |  2 +-
 .../l4-single-implicit-destination-tproxy.golden   |  3 +++
 4 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/agent/xds/clusters_test.go b/agent/xds/clusters_test.go
index adeb2b57374f..fb92ea5804b6 100644
--- a/agent/xds/clusters_test.go
+++ b/agent/xds/clusters_test.go
@@ -5,13 +5,14 @@ package xds
 
 import (
 	"bytes"
-	"github.com/hashicorp/consul/types"
 	"path/filepath"
 	"sort"
 	"testing"
 	"text/template"
 	"time"
 
+	"github.com/hashicorp/consul/types"
+
 	envoy_cluster_v3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
 	envoy_core_v3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
 	envoy_tls_v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
diff --git a/agent/xds/proxystateconverter/clusters.go b/agent/xds/proxystateconverter/clusters.go
index e12211f67078..54aeedf9ace9 100644
--- a/agent/xds/proxystateconverter/clusters.go
+++ b/agent/xds/proxystateconverter/clusters.go
@@ -6,11 +6,12 @@ package proxystateconverter
 import (
 	"errors"
 	"fmt"
-	"github.com/hashicorp/go-hclog"
-	"github.com/hashicorp/go-uuid"
 	"strings"
 	"time"
 
+	"github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/go-uuid"
+
 	envoy_endpoint_v3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
 	"google.golang.org/protobuf/types/known/durationpb"
 	"google.golang.org/protobuf/types/known/wrapperspb"
@@ -312,7 +313,8 @@ func (s *Converter) makePassthroughClusters(cfgSnap *proxycfg.ConfigSnapshot) (m
 									ConnectTimeout: durationpb.New(5 * time.Second),
 									// Endpoints are managed separately by EDS
 									// Having an empty config enables outlier detection with default config.
-									OutlierDetection: &pbproxystate.OutlierDetection{},
+									OutlierDetection:      &pbproxystate.OutlierDetection{},
+									DisablePanicThreshold: true,
 								},
 							},
 						},
@@ -653,8 +655,7 @@ func (s *Converter) makeUpstreamClusterForPreparedQuery(upstream structs.Upstrea
 								ConnectTimeout: durationpb.New(time.Duration(cfg.ConnectTimeoutMs) * time.Millisecond),
 								// Endpoints are managed separately by EDS
 								// Having an empty config enables outlier detection with default config.
-								OutlierDetection:      makeOutlierDetection(cfg.PassiveHealthCheck, nil, true),
-								DisablePanicThreshold: true,
+								OutlierDetection: makeOutlierDetection(cfg.PassiveHealthCheck, nil, true),
 								CircuitBreakers: &pbproxystate.CircuitBreakers{
 									UpstreamLimits: makeUpstreamLimitsIfNeeded(cfg.Limits),
 								},
@@ -880,7 +881,8 @@ func (s *Converter) makeUpstreamClustersForDiscoveryChain(
 					CircuitBreakers: &pbproxystate.CircuitBreakers{
 						UpstreamLimits: makeUpstreamLimitsIfNeeded(upstreamConfig.Limits),
 					},
-					OutlierDetection: makeOutlierDetection(upstreamConfig.PassiveHealthCheck, nil, true),
+					DisablePanicThreshold: true,
+					OutlierDetection:      makeOutlierDetection(upstreamConfig.PassiveHealthCheck, nil, true),
 				},
 			}
 			ti := groupedTarget.Targets[0]
diff --git a/agent/xdsv2/cluster_resources.go b/agent/xdsv2/cluster_resources.go
index 05c4a41cee72..ba5de38eaccf 100644
--- a/agent/xdsv2/cluster_resources.go
+++ b/agent/xdsv2/cluster_resources.go
@@ -125,7 +125,7 @@ func (pr *ProxyResources) makeEnvoyDynamicCluster(name string, protocol string,
 			cluster.AltStatName = name
 		}
 		cluster.ConnectTimeout = dynamic.Config.ConnectTimeout
-		if !dynamic.Config.DisablePanicThreshold {
+		if dynamic.Config.DisablePanicThreshold {
 			cluster.CommonLbConfig = &envoy_cluster_v3.Cluster_CommonLbConfig{
 				HealthyPanicThreshold: &envoy_type_v3.Percent{
 					Value: 0, // disable panic threshold
diff --git a/agent/xdsv2/testdata/output/clusters/l4-single-implicit-destination-tproxy.golden b/agent/xdsv2/testdata/output/clusters/l4-single-implicit-destination-tproxy.golden
index 76f814eb3924..611c863c3af9 100644
--- a/agent/xdsv2/testdata/output/clusters/l4-single-implicit-destination-tproxy.golden
+++ b/agent/xdsv2/testdata/output/clusters/l4-single-implicit-destination-tproxy.golden
@@ -11,6 +11,9 @@
           "resourceApiVersion":  "V3"
         }
       },
+      "commonLbConfig": {
+        "healthyPanicThreshold": {}
+      },
       "name": "tcp.api-1.default.dc1.internal.foo.consul",
       "transportSocket": {
         "name": "tls",