fix: disable -shadow host suffix append (#7229)

* fix: disable `-shadow` host suffix append

Signed-off-by: Shreemaan Abhishek <shreemaanabhishek@apache.org>

Author: shreealt

internal/xds/translator/route.go

@@ -543,6 +543,8 @@ func buildXdsRequestMirrorPolicies(mirrorPolicies []*ir.MirrorPolicy) []*routev3
 			xdsMirrorPolicies = append(xdsMirrorPolicies, &routev3.RouteAction_RequestMirrorPolicy{
 				Cluster:         policy.Destination.Name,
 				RuntimeFraction: mp,
+				// We don't need to append the shadow host suffix as the mirror policy already uses a different cluster which is enough to distinguish the mirrored traffic
+				DisableShadowHostSuffixAppend: true,
 			})
 		}
 	}

internal/xds/translator/testdata/out/xds-ir/http-route-mirrors-percentage.routes.yaml

@@ -12,6 +12,7 @@
         cluster: route-dest
         requestMirrorPolicies:
         - cluster: mirror-route-dest
+          disableShadowHostSuffixAppend: true
           runtimeFraction:
             defaultValue:
               denominator: MILLION

internal/xds/translator/testdata/out/xds-ir/http-route-multiple-mirrors-percentage.routes.yaml

@@ -12,11 +12,13 @@
         cluster: route-dest
         requestMirrorPolicies:
         - cluster: mirror-route-dest
+          disableShadowHostSuffixAppend: true
           runtimeFraction:
             defaultValue:
               denominator: MILLION
               numerator: 250000
         - cluster: mirror-route-dest1
+          disableShadowHostSuffixAppend: true
           runtimeFraction:
             defaultValue:
               denominator: MILLION

internal/xds/translator/testdata/out/xds-ir/http-route-multiple-mirrors.routes.yaml

@@ -12,10 +12,12 @@
         cluster: route-dest
         requestMirrorPolicies:
         - cluster: mirror-route-dest
+          disableShadowHostSuffixAppend: true
           runtimeFraction:
             defaultValue:
               numerator: 100
         - cluster: mirror-route-dest1
+          disableShadowHostSuffixAppend: true
           runtimeFraction:
             defaultValue:
               numerator: 100

release-notes/current.yaml

@@ -5,6 +5,7 @@ breaking changes: |
   ALPNProtocols in EnvoyProxy Backend TLS setting use [h2, http/1.1] if not set.
   When a Backend resource specifies TLS settings and SNI is not specified or a BackendTLSPolicy is not attached to it, the value of upstream TLS SNI is determined by the HTTP Host header.
   When a Backend resource specifies TLS settings and SNI is not specified or a BackendTLSPolicy is not attached to it, the upstream certificate is validated for DNS SAN matching the SNI value sent.
+  When a MirrorPolicy is used, the shadow host suffix is not appended to the mirrored cluster name.
 
 # Updates addressing vulnerabilities, security flaws, or compliance requirements.
 security updates: |