Cleanup proxycfg for TLS

- Use correct enterprise metadata for finding config entry
- nil out cancel functions on config snapshot copy
- Look at HostsSet when checking validity

agent/proxycfg/snapshot.go

@@ -287,7 +287,8 @@ func (s *ConfigSnapshot) Valid() bool {
 	case structs.ServiceKindIngressGateway:
 		return s.Roots != nil &&
 			s.IngressGateway.Leaf != nil &&
-			s.IngressGateway.TLSSet
+			s.IngressGateway.TLSSet &&
+			s.IngressGateway.HostsSet
 	default:
 		return false
 	}
@@ -317,7 +318,9 @@ func (s *ConfigSnapshot) Clone() (*ConfigSnapshot, error) {
 		snap.MeshGateway.WatchedServices = nil
 	case structs.ServiceKindIngressGateway:
 		snap.IngressGateway.WatchedUpstreams = nil
+		snap.IngressGateway.WatchedGateways = nil
 		snap.IngressGateway.WatchedDiscoveryChains = nil
+		snap.IngressGateway.LeafCertWatchCancel = nil
 	}
 
 	return snap, nil

agent/proxycfg/state.go

@@ -496,10 +496,11 @@ func (s *state) initWatchesIngressGateway() error {
 
 	// Watch this ingress gateway's config entry
 	err = s.cache.Notify(s.ctx, cachetype.ConfigEntryName, &structs.ConfigEntryQuery{
-		Kind:         structs.IngressGateway,
-		Name:         s.service,
-		Datacenter:   s.source.Datacenter,
-		QueryOptions: structs.QueryOptions{Token: s.token},
+		Kind:           structs.IngressGateway,
+		Name:           s.service,
+		Datacenter:     s.source.Datacenter,
+		QueryOptions:   structs.QueryOptions{Token: s.token},
+		EnterpriseMeta: s.proxyID.EnterpriseMeta,
 	}, gatewayConfigWatchID, s.ch)
 	if err != nil {
 		return err
@@ -1346,6 +1347,7 @@ func (s *state) handleUpdateIngressGateway(u cache.UpdateEvent, snap *ConfigSnap
 		}
 
 		// Update our upstreams and watches.
+		var hosts []string
 		watchedSvcs := make(map[string]struct{})
 		upstreamsMap := make(map[IngressListenerKey]structs.Upstreams)
 		for _, service := range services.Services {
@@ -1357,15 +1359,13 @@ func (s *state) handleUpdateIngressGateway(u cache.UpdateEvent, snap *ConfigSnap
 			}
 			watchedSvcs[u.Identifier()] = struct{}{}
 
+			hosts = append(hosts, service.Hosts...)
+
 			id := IngressListenerKey{Protocol: service.Protocol, Port: service.Port}
 			upstreamsMap[id] = append(upstreamsMap[id], u)
 		}
-		snap.IngressGateway.Upstreams = upstreamsMap
 
-		var hosts []string
-		for _, s := range services.Services {
-			hosts = append(hosts, s.Hosts...)
-		}
+		snap.IngressGateway.Upstreams = upstreamsMap
 		snap.IngressGateway.Hosts = hosts
 		snap.IngressGateway.HostsSet = true