fix(gateway): skip ExternalService if none match

pkg/plugins/runtime/gateway/cluster_generator.go

@@ -37,21 +37,24 @@ func (c *ClusterGenerator) GenerateClusters(ctx context.Context, xdsCtx xds_cont
 	// an external service. Because the dataplane endpoints happen to be
 	// generated first, the mesh service will have priority.
 	for _, dest := range routeDestinationsMutable(hostInfo.Entries) {
-		matched := match.ExternalService(info.ExternalServices.Items, mesh_proto.TagSelector(dest.Destination))
 		service := dest.Destination[mesh_proto.ServiceTag]
 
 		firstEndpointExternalService := route.HasExternalServiceEndpoint(xdsCtx.Mesh.Resource, info.OutboundEndpoints, *dest)
 
+		matched := match.ExternalService(info.ExternalServices.Items, mesh_proto.TagSelector(dest.Destination))
+
 		// If there is Mesh property ZoneEgress enabled we want always to
 		// direct the traffic through them. The condition is, the mesh must
 		// have mTLS enabled and traffic through zoneEgress is enabled.
 		isDirectExternalService := firstEndpointExternalService && !xdsCtx.Mesh.Resource.ZoneEgressEnabled()
-		isExternalServiceThroughZoneEgress := firstEndpointExternalService && !isDirectExternalService
+		isExternalCluster := isDirectExternalService && len(matched) > 0
+
+		isExternalServiceThroughZoneEgress := firstEndpointExternalService && xdsCtx.Mesh.Resource.ZoneEgressEnabled()
 
 		var r *core_xds.Resource
 		var err error
 
-		if isDirectExternalService {
+		if isExternalCluster {
 			log.V(1).Info("generating external service cluster",
 				"service", service,
 			)
@@ -80,7 +83,7 @@ func (c *ClusterGenerator) GenerateClusters(ctx context.Context, xdsCtx xds_cont
 		// reference it.
 		dest.Name = r.Name
 
-		if isDirectExternalService {
+		if isExternalCluster {
 			// External clusters don't get a load assignment.
 			continue
 		}

test/e2e_env/kubernetes/gateway/gateway.go

@@ -222,12 +222,15 @@ spec:
 					testserver.WithEchoArgs("echo", "--instance", "es-echo-server"),
 				)).
 				Install(YamlK8s(externalService)).
-				Install(YamlK8s(route("es-echo-server", "/external-service", "external-service"))).
 				Setup(env.Cluster)
 			Expect(err).ToNot(HaveOccurred())
 		})
 
 		It("should proxy to service via HTTP", func() {
+			route := route("es-echo-server", "/external-service", "external-service")
+			setup := NewClusterSetup().Install(YamlK8s(route))
+			Expect(setup.Setup(env.Cluster)).To(Succeed())
+
 			Eventually(func(g Gomega) {
 				response, err := client.CollectResponse(
 					env.Cluster, "demo-client",
@@ -239,6 +242,50 @@ spec:
 				g.Expect(err).ToNot(HaveOccurred())
 				g.Expect(response.Instance).To(Equal("es-echo-server"))
 			}, "30s", "1s").Should(Succeed())
+
+			Expect(NewClusterSetup().Install(DeleteYamlK8s(route)).Setup(env.Cluster)).To(Succeed())
+		})
+
+		It("should handle external-service excluded by tags", func() {
+			route := fmt.Sprintf(`
+apiVersion: kuma.io/v1alpha1
+kind: MeshGatewayRoute
+metadata:
+  name: %s
+mesh: simple-gateway
+spec:
+  selectors:
+  - match:
+      kuma.io/service: simple-gateway
+  conf:
+    http:
+      rules:
+      - matches:
+        - path:
+            match: PREFIX
+            value: %s
+        backends:
+        - destination:
+            kuma.io/service: %s
+            nonexistent: tag
+`, "es-echo-server-broken", "/external-service", "external-service")
+
+			setup := NewClusterSetup().Install(YamlK8s(route))
+			Expect(setup.Setup(env.Cluster)).To(Succeed())
+
+			Eventually(func(g Gomega) {
+				response, err := client.CollectFailure(
+					env.Cluster, "demo-client",
+					"http://simple-gateway.simple-gateway:8080/external-service",
+					client.WithHeader("host", "example.kuma.io"),
+					client.FromKubernetesPod(clientNamespace, "demo-client"),
+				)
+
+				g.Expect(err).ToNot(HaveOccurred())
+				g.Expect(response.ResponseCode).To(Equal(503))
+			}, "30s", "1s").Should(Succeed())
+
+			Expect(NewClusterSetup().Install(DeleteYamlK8s(route)).Setup(env.Cluster)).To(Succeed())
 		})
 	})
 }