Motivation

ZoneTag() in pkg/kds/util/resource.go:126 accesses GetInbound()[0] without bounds check. When a Dataplane has no gateway and no inbound listeners, this panics with index out of range [0] with length 0, crashing the control plane.

Confirmed via PoC test — a Dataplane with empty Inbound slice and no Gateway triggers the panic.

Implementation information

Add a length check before accessing [0]:

inbounds := res.GetNetworking().GetInbound()
if len(inbounds) == 0 {
    return ""
}
return inbounds[0].GetTags()[mesh_proto.ZoneTag]

Alternatively, consider replacing the function with core_model.ZoneOfResource(r) as the existing TODO at line 132 suggests.