From 437f76991626eecf4e6f51d2c057a3844b4ebbc1 Mon Sep 17 00:00:00 2001
From: Daniel Nephin <dnephin@hashicorp.com>
Date: Fri, 4 Feb 2022 14:04:12 -0500
Subject: [PATCH 1/2] A test to reproduce the issue

---
 agent/consul/state/catalog_test.go | 34 ++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/agent/consul/state/catalog_test.go b/agent/consul/state/catalog_test.go
index abbf831cfd..9d28bc1015 100644
--- a/agent/consul/state/catalog_test.go
+++ b/agent/consul/state/catalog_test.go
@@ -5977,6 +5977,40 @@ func setupIngressState(t *testing.T, s *Store) memdb.WatchSet {
 	return ws
 }
 
+func TestStore_EnsureService_DoesNotPanicOnIngressGateway(t *testing.T) {
+	store := NewStateStore(nil)
+
+	err := store.EnsureConfigEntry(1, &structs.IngressGatewayConfigEntry{
+		Kind: structs.IngressGateway,
+		Name: "the-ingress",
+		Listeners: []structs.IngressListener{
+			{
+				Port:     12345,
+				Protocol: "tcp",
+				Services: []structs.IngressService{{Name: "the-service"}},
+			},
+		},
+	})
+	require.NoError(t, err)
+
+	err = store.EnsureRegistration(2, &structs.RegisterRequest{
+		Node: "the-node",
+		Service: &structs.NodeService{
+			Kind:    structs.ServiceKindConnectProxy,
+			Service: "the-proxy",
+			Proxy: structs.ConnectProxyConfig{
+				DestinationServiceName: "the-ingress",
+				Upstreams: []structs.Upstream{
+					{
+						DestinationName: "the-service",
+					},
+				},
+			},
+		},
+	})
+	require.NoError(t, err)
+}
+
 func TestStateStore_DumpGatewayServices(t *testing.T) {
 	s := testStateStore(t)
 

From 82c264b2b35737ea9a3885da19b443145b619d57 Mon Sep 17 00:00:00 2001
From: Daniel Nephin <dnephin@hashicorp.com>
Date: Fri, 4 Feb 2022 18:51:32 -0500
Subject: [PATCH 2/2] config-entry: fix a panic when registering a service or
 ingress gateway

---
 .changelog/12277.txt          | 3 +++
 agent/consul/state/catalog.go | 1 +
 2 files changed, 4 insertions(+)
 create mode 100644 .changelog/12277.txt

diff --git a/.changelog/12277.txt b/.changelog/12277.txt
new file mode 100644
index 0000000000..7435bbb37f
--- /dev/null
+++ b/.changelog/12277.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+config-entry: fix a panic when creating an ingress gateway config-entry and a proxy service instance, where both provided the same upstream and downstream mapping.
+```
diff --git a/agent/consul/state/catalog.go b/agent/consul/state/catalog.go
index 90657d841e..7ceb98caff 100644
--- a/agent/consul/state/catalog.go
+++ b/agent/consul/state/catalog.go
@@ -4016,6 +4016,7 @@ func insertGatewayServiceTopologyMapping(tx WriteTxn, idx uint64, gs *structs.Ga
 	mapping := upstreamDownstream{
 		Upstream:   gs.Service,
 		Downstream: gs.Gateway,
+		Refs:       make(map[string]struct{}),
 		RaftIndex:  gs.RaftIndex,
 	}
 	if err := tx.Insert(tableMeshTopology, &mapping); err != nil {