[scotwells]

Requested by Scot Schuchert-Wells · project thread

Summary

Since #1372, the edge proxy can no longer reach any backend inside a VPC, so every HTTP proxy in front of a VPC workload times out and serves 503. #1372 counts a destination that only a default route reaches as down, which is right for egress shard failover on a node. The ingress sidecar resolves backends from inside Envoy's pod, where the only route is the default toward the host, so the same check refuses every backend. This change turns the check off for the sidecar only, and shard failover keeps it.

Test plan

• New unit tests pass: the sidecar's backend accepts a default route, and the check is skipped once that is turned on
• New kernel test (a default-only route resolves when accepted) passes in the privileged unit job
• The existing kernel test still shows a default-only route rejected for everyone else
• After rollout to a lab, the sidecar installs backend routes again and a VPC-backed proxy answers 200

[cla-assistant]

All committers have signed the CLA.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}