fix: add proxy protocol always as first listenerFilter

[zetaab]

What type of PR is this?

fix: add proxy protocol always as first listenerFilter

What this PR does / why we need it:

As you can see I did issue about 3 months ago and since that I have had random issues that envoy will not reply anything back. Now I decided that I will go through the egctl dumps and I found out that the order in tls and proxy protocol listenerFilters are incorrect somehow.

not working

                  "listenerFilters": [
                    {
                      "name": "envoy.filters.listener.tls_inspector",
                      "typedConfig": {
                        "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
                      }
                    },
                    {
                      "name": "envoy.filters.listener.proxy_protocol",
                      "typedConfig": {
                        "@type": "type.googleapis.com/envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol"
                      }
                    }
                  ],

working

                  "listenerFilters": [
                    {
                      "name": "envoy.filters.listener.proxy_protocol",
                      "typedConfig": {
                        "@type": "type.googleapis.com/envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol"
                      }
                    },
                    {
                      "name": "envoy.filters.listener.tls_inspector",
                      "typedConfig": {
                        "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
                      }
                    }
                  ],

Which issue(s) this PR fixes:

Fixes #2968

[zetaab]

cc @arkodg perhaps worth of cherry-picking this to 1.0.x series as well. It is currently broken if people do use proxy protocol and tls.

[guydc]

Hi @zetaab. Overall makes sense to me. Can you maybe create a unit test to protect this from breaking in the future?

[arkodg]

hey @zetaab thanks for fixing this !
added a label so we'll be sure this include this in v1.0.2 as well
as @guydc suggested, can we add a xds translator test for this ?

[zetaab]

@arkodg @guydc I could not find way to reproduce that with normal yaml tests. Always proxy protocol ended as first without the change. So I decided to do just normal unit test for that

[arkodg]

looks like the existing test was already checking this and was computing this correctly
https://github.com/envoyproxy/gateway/blob/main/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol.listeners.yaml
https://github.com/envoyproxy/gateway/blob/main/internal/xds/translator/testdata/in/xds-ir/listener-proxy-protocol.yaml

how is it that this test case is passing ?

[zetaab]

I have no idea how to reproduce that really. I had such configuration in envoy gateway, sometimes it was working sometimes not so it was flaky. I just restarted EG + envoy pods n times and it happened sometimes.