Istio automtls mode with security.istio.io/tlsMode=disabled results in sending mTLS

[stevenctl]

Gloo Edge Product

Open Source

Gloo Edge Version

v1.18.x

Kubernetes Version

v1.30.x

Describe the bug

We're using the condition if _, ok := labels[constants.IstioTlsModeLabel]; ok { to add the mutual tls transport socket match metadata. Instead of the presence of the label, we need to check the value as well.

Expected Behavior

If the label value is disabled we shouldn't add the filter metadata resulting in mTLS being sent.

Steps to reproduce the bug

Install Istio and gloo gateway, with the istio integration enabled.

Label a non-injected backend pod with security.istio.io/tlsMode=disabled and try to send traffic to it; it will fail.

Additional Environment Detail

No response

Additional Context

No response