Allow any host when fallback policy fails (#6117)

We use the default subset as our fallback policy. However, if there's
a problem with our metadata it's possible for the default subset
to become empty. In this case, we'd like any host to be selected.

This change adds a panic_mode_any boolean option to LbSubsetConfig
to enable this behavior.

Signed-off-by: Raul Gutierrez Segales <rgs@pinterest.com>

Mirrored from https://github.com/envoyproxy/envoy @ 718682f22bdb548624df076813208660fb928188

envoy/api/v2/cds.proto

@@ -385,6 +385,14 @@ message Cluster {
     // going to an individual locality if said locality is disproportionally affected by the
     // subset predicate.
     bool scale_locality_weight = 5;
+
+    // If true, when a fallback policy is configured and its corresponding subset fails to find
+    // a host this will cause any host to be selected instead.
+    //
+    // This is useful when using the default subset as the fallback policy, given the default
+    // subset might become empty. With this option enabled, if that happens the LB will attempt
+    // to select a host from the entire cluster.
+    bool panic_mode_any = 6;
   }
 
   // Configuration for load balancing subsetting.