backport of commit d03729c

.changelog/106.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+Fix a bug that threw an error when trying to use `$HOST_IP` with metrics URLs.
+```

.changelog/98.txt

@@ -0,0 +1,3 @@
+```release-note:security
+Update to Go 1.20.4 and Envoy 1.25.6 within the Dockerfile. 
+```

.github/workflows/build.yml

@@ -271,8 +271,6 @@ jobs:
             image: docker.mirror.hashicorp.services/hashicorp/consul:1.14.4
           - version: v1.15.0-dev
             image: hashicorppreview/consul:1.15-dev
-          - version: v1.16.0-dev
-            image: hashicorppreview/consul:1.16-dev
         dataplane:
           - image_suffix: "dev"
             docker_target: "release-default"

.github/workflows/consul-dataplane-checks.yaml

@@ -3,8 +3,7 @@ name: consul-dataplane-checks
 on:
   push:
     branches:
-    - main
-    - 'release/*.*.x'
+      main
   pull_request:
 
 jobs:
@@ -58,4 +57,4 @@ jobs:
           go-version: ${{ needs.get-go-version.outputs.go-version }}
       - uses: actions/checkout@v3
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@v3

.release/ci.hcl

@@ -1,6 +1,3 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
-
 schema = "1"
 
 project "consul-dataplane" {

.release/release-metadata.hcl

@@ -1,6 +1,3 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
-
 url_docker_registry_dockerhub = "https://hub.docker.com/r/hashicorp/consul-dataplane"
 url_docker_registry_ecr       = "https://gallery.ecr.aws/hashicorp/consul-dataplane"
 url_source_repository         = "https://github.com/hashicorp/consul-dataplane"

.release/security-scan.hcl

@@ -1,6 +1,3 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
-
 container {
   dependencies = true
   alpine_secdb = true

Dockerfile

@@ -1,6 +1,3 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
-
 # This Dockerfile contains multiple targets.
 # Use 'docker build --target=<name> .' to build one.
 #
@@ -9,7 +6,7 @@
 
 # envoy-binary pulls in the latest Envoy binary, as Envoy don't publish
 # prebuilt binaries in any other form.
-FROM envoyproxy/envoy-distroless:v1.26.1 as envoy-binary
+FROM envoyproxy/envoy-distroless:v1.25.6 as envoy-binary
 
 # go-discover builds the discover binary (which we don't currently publish
 # either).

build-scripts/version.sh

@@ -1,7 +1,4 @@
 #!/usr/bin/env bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
-
 
 version_file=$1
 version=$(awk '$1 == "Version" && $2 == "=" { gsub(/"/, "", $3); print $3 }' < "${version_file}")

cmd/consul-dataplane/env.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package main
 
 import (

cmd/consul-dataplane/flags.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package main
 
 // This file contains flag wrappers that support reading from an environment

cmd/consul-dataplane/main.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package main
 
 import (

cmd/consul-dataplane/map_flag.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package main
 
 import (

cmd/consul-dataplane/map_flag_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package main
 
 import (

integration-tests/helpers/auth_method.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package helpers
 
 import (

integration-tests/helpers/dataplane.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package helpers
 
 import (

integration-tests/helpers/helpers.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package helpers
 
 import (

integration-tests/helpers/pod.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package helpers
 
 import (

integration-tests/helpers/server.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package helpers
 
 import (

integration-tests/helpers/service.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package helpers
 
 import (

integration-tests/helpers/suite.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package helpers
 
 import (

integration-tests/helpers/tls.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package helpers
 
 import (

integration-tests/main_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package integrationtests
 
 import (

internal/bootstrap/helpers_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package bootstrap
 
 import (

pkg/consuldp/bootstrap.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package consuldp
 
 import (

pkg/consuldp/bootstrap_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package consuldp
 
 import (

pkg/consuldp/config.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package consuldp
 
 import (

pkg/consuldp/config_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package consuldp
 
 import (

pkg/consuldp/consul_dataplane.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package consuldp
 
 import (

pkg/consuldp/consul_dataplane_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package consuldp
 
 import (

pkg/consuldp/metrics.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package consuldp
 
 import (
@@ -9,6 +6,7 @@ import (
 	"io"
 	"net/http"
 	"net/url"
+	"os"
 	"strconv"
 	"sync"
 	"time"
@@ -108,6 +106,18 @@ func NewMetricsConfig(cfg *Config, cacheSink *metricscache.Sink) *metricsConfig
 	}
 }
 
+func statsSinkEnvMapping(s string) string {
+	allowedStatsSinkEnvVars := map[string]bool{
+		"HOST_IP": true,
+	}
+
+	if !allowedStatsSinkEnvVars[s] {
+		// if the specified env var isn't explicitly allowed, unexpand it
+		return fmt.Sprintf("${%s}", s)
+	}
+	return os.Getenv(s)
+}
+
 func (m *metricsConfig) startMetrics(ctx context.Context, bcfg *bootstrap.BootstrapConfig) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
@@ -360,6 +370,12 @@ func (m *metricsConfig) runPrometheusCDPServer(gather prom.Gatherer) {
 }
 
 func parseSinkAddr(addr string, s Stats) (string, error) {
+	if len(addr) > 2 && addr[0] == '$' {
+		addr = os.Getenv(addr[1:])
+	} else {
+		addr = os.Expand(addr, statsSinkEnvMapping)
+	}
+
 	u, err := url.Parse(addr)
 	if err != nil {
 		return "", fmt.Errorf("failed to parse address %s", addr)

pkg/consuldp/metrics_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package consuldp
 
 import (
@@ -465,7 +462,19 @@ func TestParseAddr(t *testing.T) {
 			s:           Dogstatsd,
 			expectedErr: errors.New("unsupported addr: tcp://0.0.0.0:1234 for sink type: dogstatsD"),
 		},
+		"dogstatsd HOST_IP": {
+			addr:         "udp://${HOST_IP}:1234",
+			s:            Dogstatsd,
+			expectedAddr: "1.2.3.4:1234",
+		},
+		"dogstatsd bad env var": {
+			addr:        "udp://${NOT_SUPPORTED}:1234",
+			s:           Dogstatsd,
+			expectedErr: errors.New("failed to parse address udp://${NOT_SUPPORTED}:1234"),
+		},
 	}
+
+	t.Setenv("HOST_IP", "1.2.3.4")
 	for name, tc := range testCases {
 		t.Run(name, func(t *testing.T) {
 			addr, err := parseSinkAddr(tc.addr, tc.s)

pkg/consuldp/stats.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package consuldp
 
 import "github.com/armon/go-metrics/prometheus"

pkg/consuldp/xds.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package consuldp
 
 import (

pkg/consuldp/xds_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package consuldp
 
 import (

pkg/dns/dns.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package dns
 
 import (

pkg/dns/dns_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package dns
 
 import (

pkg/envoy/proxy.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package envoy
 
 import (

pkg/envoy/proxy_test.go

@@ -1,6 +1,3 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
 package envoy
 
 import (