Use protocol from resolved config entry, not gateway service

agent/proxycfg/testing_terminating_gateway.go

@@ -642,9 +642,8 @@ func TestConfigSnapshotTerminatingGatewayHTTP2(t testing.T) *ConfigSnapshot {
 			Result: &structs.IndexedGatewayServices{
 				Services: []*structs.GatewayService{
 					{
-						Service:  web,
-						CAFile:   "ca.cert.pem",
-						Protocol: "http2",
+						Service: web,
+						CAFile:  "ca.cert.pem",
 					},
 				},
 			},
@@ -703,9 +702,8 @@ func TestConfigSnapshotTerminatingGatewaySubsetsHTTP2(t testing.T) *ConfigSnapsh
 			Result: &structs.IndexedGatewayServices{
 				Services: []*structs.GatewayService{
 					{
-						Service:  web,
-						CAFile:   "ca.cert.pem",
-						Protocol: "http2",
+						Service: web,
+						CAFile:  "ca.cert.pem",
 					},
 				},
 			},

agent/xds/clusters.go

@@ -425,8 +425,18 @@ func (s *ResourceGenerator) makeGatewayServiceClusters(
 		}
 		clusters = append(clusters, cluster)
 
-		gatewaySvc, ok := cfgSnap.TerminatingGateway.GatewayServices[svc]
-		isHTTP2 := ok && (gatewaySvc.Protocol == "http2" || gatewaySvc.Protocol == "grpc")
+		svcConfig, ok := cfgSnap.TerminatingGateway.ServiceConfigs[svc]
+		isHTTP2 := false
+		if ok {
+			upstreamCfg, err := structs.ParseUpstreamConfig(svcConfig.ProxyConfig)
+			if err != nil {
+				// Don't hard fail on a config typo, just warn. The parse func returns
+				// default config if there is an error so it's safe to continue.
+				s.Logger.Warn("failed to parse", "upstream", svc, "error", err)
+			}
+			isHTTP2 = upstreamCfg.Protocol == "http2" || upstreamCfg.Protocol == "grpc"
+		}
+
 		if isHTTP2 {
 			if err := s.setHttp2ProtocolOptions(cluster); err != nil {
 				return nil, err