Repository: kmesh-net/kmesh

Issue:
waypoint address missing in ebpf/endpoints
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!
-->

**What happened**:
The client service got "Connection reset by peer" error log.

waypoint log:
```
envoy connection external/envoy/source/common/tls/ssl_socket.cc:248        [Tags: "ConnectionId":"731052"] remote address:10.119.127.26:47892,TLS_error:|268435703:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER:TLS_error_end        thread=21
```

We found that the  epbf connect to 15008  of waypoint.

After check kmesh's ebpf dump API
```
kubectl exec -ti {kmesh-pod} -- curl http://localhost:15200/debug/config_dump/bpf/dual-engine
```

waypoint backendUid missed in the endpoints.

Finally, the bug could be here:

https://github.com/kmesh-net/kmesh/blob/main/pkg/controller/workload/workload_processor.go#L565-L567

<img width="754" height="118" alt="Image" src="https://github.com/user-attachments/assets/0e151e86-80bb-4bc0-8d50-1e9945b02a9f" />

https://github.com/kmesh-net/kmesh/blob/main/pkg/controller/workload/workload_processor.go#L452-L466

<img width="773" height="522" alt="Image" src="https://github.com/user-attachments/assets/8e3df3a4-93b3-45ef-b735-80ccf8a7bf2c" />

waypoint' LB policy default be  FAILOVER. kmesh-daemonset may not initialize the locality


Hints from issue comments:

Solution patch:
diff --git a/pkg/controller/workload/workload_processor.go b/pkg/controller/workload/workload_processor.go
index c9bdfcb8..7557d099 100644
--- a/pkg/controller/workload/workload_processor.go
+++ b/pkg/controller/workload/workload_processor.go
@@ -458,8 +458,16 @@ func (p *Processor) handleWorkloadNewBoundServices(workload *workloadapi.Workloa
 				}
 			} else { // locality mode
 				service := p.ServiceCache.GetService(p.hashName.NumToStr(svcUid))
-				if p.locality.LocalityInfo != nil && service != nil {
-					prio := p.locality.CalcLocalityLBPrio(workload, service.LoadBalancing.GetRoutingPreference())
+				if service != nil {
+					var prio uint32
+					if p.locality.LocalityInfo != nil {
+						prio = p.locality.CalcLocalityLBPrio(workload, service.LoadBalancing.GetRoutingPreference())
+					} else {
+						// If locality is not yet initialized, use highest priority (0)
+						// This ensures the workload is added to the endpoint map and will be recalculated
+						// when locality is eventually set
+						prio = 0
+					}
 					if _, err = p.addWorkloadToService(&sk, &sv, workloadId, prio); err != nil {
 						log.Errorf("addWorkloadToService workload %d service %d priority %d failed: %v", workloadId, sk.ServiceId, prio, err)
 						return err



Test patch:
diff --git a/pkg/controller/workload/workload_processor_test.go b/pkg/controller/workload/workload_processor_test.go
index cdabb712..46af4f47 100644
--- a/pkg/controller/workload/workload_processor_test.go
+++ b/pkg/controller/workload/workload_processor_test.go
@@ -784,3 +784,70 @@ func TestUpdateWorkloadInFrontendMap(t *testing.T) {
 		assert.NoError(t, err)
 	})
 }
+
+// TestLocalityLBWithNilLocalityInfo verifies that workloads are correctly added
+// to service endpoints even when LocalityInfo is nil in locality LB mode.
+// This tests the fix for the issue where waypoint addresses were missing in
+// ebpf/endpoints because LocalityInfo was not initialized when workloads from
+// other nodes arrived before any local workload.
+func TestLocalityLBWithNilLocalityInfo(t *testing.T) {
+	workloadMap := bpfcache.NewFakeWorkloadMap(t)
+	defer bpfcache.CleanupFakeWorkloadMap(workloadMap)
+
+	p := NewProcessor(workloadMap)
+
+	// Ensure LocalityInfo is nil (simulating no local workload has been processed yet)
+	assert.Nil(t, p.locality.LocalityInfo)
+
+	res := &service_discovery_v3.DeltaDiscoveryResponse{}
+
+	// Create a service with locality LB (FAILOVER mode, which is the default for waypoints)
+	localityLBScope := []workloadapi.LoadBalancing_Scope{
+		workloadapi.LoadBalancing_REGION,
+		workloadapi.LoadBalancing_ZONE,
+		workloadapi.LoadBalancing_SUBZONE,
+	}
+	localityLoadBalancing := createLoadBalancing(workloadapi.LoadBalancing_FAILOVER, localityLBScope)
+	svc := common.CreateFakeService("svc1", "10.240.10.1", "10.240.10.200", localityLoadBalancing)
+
+	addr := serviceToAddress(svc)
+	res.Resources = append(res.Resources, &service_discovery_v3.Resource{
+		Resource: protoconv.MessageToAny(addr),
+	})
+
+	// Add a workload from a different node (simulating waypoint workload)
+	// This workload arrives before any local workload, so LocalityInfo is still nil
+	wl := createWorkload("waypoint1", "10.244.0.1", "other-node", workloadapi.NetworkMode_STANDARD, createLocality("r1", "z1", "s1"), "svc1")
+	wlAddr := workloadToAddress(wl)
+	res.Resources = append(res.Resources, &service_discovery_v3.Resource{
+		Resource: protoconv.MessageToAny(wlAddr),
+	})
+
+	err := p.handleAddressTypeResponse(res)
+	assert.NoError(t, err)
+
+	// LocalityInfo should still be nil since no local workload was processed
+	assert.Nil(t, p.locality.LocalityInfo)
+
+	// Verify the workload is in the frontend map
+	workloadID := checkFrontEndMap(t, wl.Addresses[0], p)
+
+	// Verify the service is in the frontend map
+	svcID := checkFrontEndMap(t, svc.Addresses[0].Address, p)
+
+	// Verify the endpoint was added to the service
+	// When LocalityInfo is nil, the workload should be added with the highest priority (0)
+	var ek bpfcache.EndpointKey
+	var ev bpfcache.EndpointValue
+	ek.ServiceId = svcID
+	ek.Prio = 0 // highest priority when LocalityInfo is nil
+	ek.BackendIndex = 1
+	err = p.bpf.EndpointLookup(&ek, &ev)
+	assert.NoError(t, err, "Endpoint should exist in endpoint map with highest priority")
+	assert.Equal(t, workloadID, ev.BackendUid)
+
+	// Verify the endpoint count in the service map
+	checkServiceMap(t, p, svcID, svc, 0, 1)
+
+	hashNameClean(p)
+}