MeshTimeout inconsistent default values for spec.to depending on the presence of the inbound policy

[lobkovilya]

What happened?

Problem

When there are no MeshTimeout then plugin is not executed

kuma/pkg/plugins/policies/meshtimeout/plugin/v1alpha1/plugin.go

Lines 40 to 46 in 820494c

	policies, ok := proxy.Policies.Dynamic[api.MeshTimeoutType]
	if !ok {
	return nil
	}
	if len(policies.ToRules.Rules) == 0 && len(policies.FromRules.Rules) == 0 && len(policies.GatewayRules.ToRules.ByListener) == 0 && len(policies.ToRules.ResourceRules) == 0 {
	return nil
	}

But when there are MeshTimeouts that configure spec.from then spec.to is configured with default values.

Steps to reproduce

1. Apply shadow MeshTimeout that configures spec.from

type: MeshTimeout
name: mt-1
mesh: meshtimeout-envoyconfig
labels:
  kuma.io/effect: shadow
spec:
  from:
    - targetRef:
        kind: Mesh
      default:
        idleTimeout: 50s
        connectionTimeout: 51s
        http:
          requestTimeout: 52s
          streamIdleTimeout: 53s
          maxStreamDuration: 54s
          maxConnectionDuration: 55s

2. Run

kumactl inspect dataplane $name --type=config --shadow --include=diff | jq '.diff'

[
  {
    "op": "test",
    "path": "/type.googleapis.com~1envoy.config.cluster.v3.Cluster/localhost:3000/connectTimeout",
    "value": "10s"
  },
  {
    "op": "remove",
    "path": "/type.googleapis.com~1envoy.config.cluster.v3.Cluster/localhost:3000/connectTimeout",
    "value": "10s"
  },
  {
    "op": "add",
    "path": "/type.googleapis.com~1envoy.config.cluster.v3.Cluster/localhost:3000/connectTimeout",
    "value": "51s"
  },
  {
    "op": "add",
    "path": "/type.googleapis.com~1envoy.config.cluster.v3.Cluster/meshtimeout-envoyconfig_demo-client__kuma-3_msvc_3000/connectTimeout",
    "value": "5s"
  },
  {
    "op": "add",
    "path": "/type.googleapis.com~1envoy.config.cluster.v3.Cluster/meshtimeout-envoyconfig_test-server__kuma-3_msvc_80/typedExtensionProtocolOptions/envoy.extensions.upstreams.http.v3.HttpProtocolOptions/commonHttpProtocolOptions",
    "value": {
      "idleTimeout": "3600s",
      "maxConnectionDuration": "5s",
      "maxStreamDuration": "0s"
    }
  },
  {
    "op": "add",
    "path": "/type.googleapis.com~1envoy.config.cluster.v3.Cluster/meshtimeout-envoyconfig_test-server__kuma-3_msvc_80/connectTimeout",
    "value": "5s"
  },
  {
    "op": "test",
    "path": "/type.googleapis.com~1envoy.config.listener.v3.Listener/inbound:IP_REDACTED:3000/filterChains/0/filters/0/typedConfig/idleTimeout",
    "value": "7200s"
  },
  {
    "op": "remove",
    "path": "/type.googleapis.com~1envoy.config.listener.v3.Listener/inbound:IP_REDACTED:3000/filterChains/0/filters/0/typedConfig/idleTimeout",
    "value": "7200s"
  },
  {
    "op": "add",
    "path": "/type.googleapis.com~1envoy.config.listener.v3.Listener/inbound:IP_REDACTED:3000/filterChains/0/filters/0/typedConfig/idleTimeout",
    "value": "50s"
  },
  {
    "op": "add",
    "path": "/type.googleapis.com~1envoy.config.listener.v3.Listener/outbound:IP_REDACTED:3000/filterChains/0/filters/0/typedConfig/idleTimeout",
    "value": "3600s"
  },
  {
    "op": "test",
    "path": "/type.googleapis.com~1envoy.config.listener.v3.Listener/outbound:IP_REDACTED:80/filterChains/0/filters/0/typedConfig/routeConfig/virtualHosts/0/routes/0/route/timeout",
    "value": "0s"
  },
  {
    "op": "remove",
    "path": "/type.googleapis.com~1envoy.config.listener.v3.Listener/outbound:IP_REDACTED:80/filterChains/0/filters/0/typedConfig/routeConfig/virtualHosts/0/routes/0/route/timeout",
    "value": "0s"
  },
  {
    "op": "add",
    "path": "/type.googleapis.com~1envoy.config.listener.v3.Listener/outbound:IP_REDACTED:80/filterChains/0/filters/0/typedConfig/routeConfig/virtualHosts/0/routes/0/route/timeout",
    "value": "15s"
  },
  {
    "op": "add",
    "path": "/type.googleapis.com~1envoy.config.listener.v3.Listener/outbound:IP_REDACTED:80/filterChains/0/filters/0/typedConfig/routeConfig/virtualHosts/0/routes/0/route/idleTimeout",
    "value": "5s"
  },
  {
    "op": "add",
    "path": "/type.googleapis.com~1envoy.config.listener.v3.Listener/outbound:IP_REDACTED:80/filterChains/0/filters/0/typedConfig/commonHttpProtocolOptions",
    "value": {
      "idleTimeout": "0s"
    }
  },
  {
    "op": "add",
    "path": "/type.googleapis.com~1envoy.config.listener.v3.Listener/outbound:IP_REDACTED:80/filterChains/0/filters/0/typedConfig/requestHeadersTimeout",
    "value": "0s"
  }
]

Expected behaviour: no outbound listeners and clusters are affected
Actual behaviour: outbound listeners and clusters have different timeouts

Effect

Some of these values are just explicitly set to defaults that Envoy has, it's harmless:

{
 "op": "add",
 "path": "/type.googleapis.com~1envoy.config.listener.v3.Listener/outbound:IP_REDACTED:3000/filterChains/0/filters/0/typedConfig/idleTimeout",
 "value": "3600s"
}

but changes like

[
  {
   "op": "remove",
   "path": "/type.googleapis.com~1envoy.config.listener.v3.Listener/outbound:IP_REDACTED:80/filterChains/0/filters/0/typedConfig/routeConfig/virtualHosts/0/routes/0/route/timeout",
   "value": "0s"
  },
  {
   "op": "add",
   "path": "/type.googleapis.com~1envoy.config.listener.v3.Listener/outbound:IP_REDACTED:80/filterChains/0/filters/0/typedConfig/routeConfig/virtualHosts/0/routes/0/route/timeout",
   "value": "15s"
  }
]

are very dangerous and enabling 15s timeout without the user expecting it.