Include both privileged and non-privileged binaries in Docker image

This way ingress-gateway can use the privileged entrypoint without everyone else having to add the NET_BIND_SERVICE capability when they don't need/want it

Dockerfile

@@ -81,10 +81,17 @@ COPY LICENSE /usr/share/doc/$PRODUCT_NAME/LICENSE.txt
 
 COPY --from=dumb-init /usr/bin/dumb-init /usr/local/bin/
 COPY --from=go-discover /go/bin/discover /usr/local/bin/
-COPY --from=setcap-envoy-binary /usr/local/bin/envoy /usr/local/bin/
-COPY --from=setcap-envoy-binary /usr/local/bin/$BIN_NAME /usr/local/bin/
 COPY LICENSE /licenses/copyright.txt
 
+# Since we can't know at build time if a runtime will attempt to bind to privileged ports,
+# include a version that supports privileged ports and a version that doesn't.
+# Determine at runtime which to use. This prevents a blanket requirement for NET_BIND_SERVICE
+# in use cases which actually don't require it.
+COPY --from=envoy-binary /usr/local/bin/envoy /usr/local/bin/
+COPY dist/$TARGETOS/$TARGETARCH/$BIN_NAME /usr/local/bin/
+COPY --from=setcap-envoy-binary /usr/local/bin/envoy /usr/local/bin/privileged-envoy
+COPY --from=setcap-envoy-binary /usr/local/bin/$BIN_NAME /usr/local/bin/privileged-$BIN_NAME
+
 USER 100
 
 ENTRYPOINT ["/usr/local/bin/dumb-init", "/usr/local/bin/consul-dataplane"]
@@ -115,10 +122,17 @@ COPY LICENSE /usr/share/doc/$PRODUCT_NAME/LICENSE.txt
 
 COPY --from=dumb-init /usr/bin/dumb-init /usr/local/bin/
 COPY --from=go-discover /go/bin/discover /usr/local/bin/
-COPY --from=setcap-envoy-fips-binary /usr/local/bin/envoy /usr/local/bin/
-COPY --from=setcap-envoy-fips-binary /usr/local/bin/$BIN_NAME /usr/local/bin/
 COPY LICENSE /licenses/copyright.txt
 
+# Since we can't know at build time if a runtime will attempt to bind to privileged ports,
+# include a version that supports privileged ports and a version that doesn't.
+# Determine at runtime which to use. This prevents a blanket requirement for NET_BIND_SERVICE
+# in use cases which actually don't require it.
+COPY --from=envoy-fips-binary /usr/local/bin/envoy /usr/local/bin/
+COPY dist/$TARGETOS/$TARGETARCH/$BIN_NAME /usr/local/bin/
+COPY --from=setcap-envoy-fips-binary /usr/local/bin/envoy /usr/local/bin/privileged-envoy
+COPY --from=setcap-envoy-fips-binary /usr/local/bin/$BIN_NAME /usr/local/bin/privileged-$BIN_NAME
+
 USER 100
 
 ENTRYPOINT ["/usr/local/bin/dumb-init", "/usr/local/bin/consul-dataplane"]
@@ -158,10 +172,17 @@ RUN groupadd --gid 1000 $PRODUCT_NAME && \
 
 COPY --from=dumb-init /usr/bin/dumb-init /usr/local/bin/
 COPY --from=go-discover /go/bin/discover /usr/local/bin/
-COPY --from=setcap-envoy-binary /usr/local/bin/envoy /usr/local/bin/
-COPY --from=setcap-envoy-binary /usr/local/bin/$BIN_NAME /usr/local/bin/
 COPY LICENSE /licenses/copyright.txt
 
+# Since we can't know at build time if a runtime will attempt to bind to privileged ports,
+# include a version that supports privileged ports and a version that doesn't.
+# Determine at runtime which to use. This prevents a blanket requirement for NET_BIND_SERVICE
+# in use cases which actually don't require it.
+COPY --from=envoy-binary /usr/local/bin/envoy /usr/local/bin/
+COPY dist/$TARGETOS/$TARGETARCH/$BIN_NAME /usr/local/bin/
+COPY --from=setcap-envoy-binary /usr/local/bin/envoy /usr/local/bin/privileged-envoy
+COPY --from=setcap-envoy-binary /usr/local/bin/$BIN_NAME /usr/local/bin/privileged-$BIN_NAME
+
 USER 100
 ENTRYPOINT ["/usr/local/bin/dumb-init", "/usr/local/bin/consul-dataplane"]
 
@@ -200,10 +221,17 @@ RUN groupadd --gid 1000 $PRODUCT_NAME && \
 
 COPY --from=dumb-init /usr/bin/dumb-init /usr/local/bin/
 COPY --from=go-discover /go/bin/discover /usr/local/bin/
-COPY --from=setcap-envoy-fips-binary /usr/local/bin/envoy /usr/local/bin/
-COPY --from=setcap-envoy-fips-binary /usr/local/bin/$BIN_NAME /usr/local/bin/
 COPY LICENSE /licenses/copyright.txt
 
+# Since we can't know at build time if a runtime will attempt to bind to privileged ports,
+# include a version that supports privileged ports and a version that doesn't.
+# Determine at runtime which to use. This prevents a blanket requirement for NET_BIND_SERVICE
+# in use cases which actually don't require it.
+COPY --from=envoy-fips-binary /usr/local/bin/envoy /usr/local/bin/
+COPY dist/$TARGETOS/$TARGETARCH/$BIN_NAME /usr/local/bin/
+COPY --from=setcap-envoy-fips-binary /usr/local/bin/envoy /usr/local/bin/privileged-envoy
+COPY --from=setcap-envoy-fips-binary /usr/local/bin/$BIN_NAME /usr/local/bin/privileged-$BIN_NAME
+
 USER 100
 ENTRYPOINT ["/usr/local/bin/dumb-init", "/usr/local/bin/consul-dataplane"]
 

cmd/consul-dataplane/config.go

@@ -136,6 +136,7 @@ type EnvoyFlags struct {
 	Concurrency      *int    `json:"concurrency,omitempty"`
 	DrainTimeSeconds *int    `json:"drainTimeSeconds,omitempty"`
 	DrainStrategy    *string `json:"drainStrategy,omitempty"`
+	ExecutablePath   *string `json:"executablePath,omitempty"`
 
 	ShutdownDrainListenersEnabled *bool   `json:"shutdownDrainListenersEnabled,omitempty"`
 	ShutdownGracePeriodSeconds    *int    `json:"shutdownGracePeriodSeconds,omitempty"`
@@ -182,12 +183,7 @@ func (f *FlagOpts) buildDataplaneConfig(extraArgs []string) (*consuldp.Config, e
 		return nil, err
 	}
 
-	consuldpRuntimeConfig, err := constructRuntimeConfig(consulDPDefaultFlags, extraArgs)
-	if err != nil {
-		return nil, err
-	}
-
-	return consuldpRuntimeConfig, nil
+	return constructRuntimeConfig(consulDPDefaultFlags, extraArgs)
 }
 
 // Constructs a config based on the values present in the config json file
@@ -328,6 +324,7 @@ func constructRuntimeConfig(cfg DataplaneConfigFlags, extraArgs []string) (*cons
 		Envoy: &consuldp.EnvoyConfig{
 			AdminBindAddress:              stringVal(cfg.Envoy.AdminBindAddr),
 			AdminBindPort:                 intVal(cfg.Envoy.AdminBindPort),
+			ExecutablePath:                stringVal(cfg.Envoy.ExecutablePath),
 			ReadyBindAddress:              stringVal(cfg.Envoy.ReadyBindAddr),
 			ReadyBindPort:                 intVal(cfg.Envoy.ReadyBindPort),
 			EnvoyConcurrency:              intVal(cfg.Envoy.Concurrency),

cmd/consul-dataplane/main.go

@@ -100,6 +100,7 @@ func init() {
 	IntVar(flags, &flagOpts.dataplaneConfig.Envoy.Concurrency, "envoy-concurrency", "DP_ENVOY_CONCURRENCY", "The number of worker threads that Envoy uses.")
 	IntVar(flags, &flagOpts.dataplaneConfig.Envoy.DrainTimeSeconds, "envoy-drain-time-seconds", "DP_ENVOY_DRAIN_TIME", "The time in seconds for which Envoy will drain connections.")
 	StringVar(flags, &flagOpts.dataplaneConfig.Envoy.DrainStrategy, "envoy-drain-strategy", "DP_ENVOY_DRAIN_STRATEGY", "The behaviour of Envoy during the drain sequence. Determines whether all open connections should be encouraged to drain immediately or to increase the percentage gradually as the drain time elapses.")
+	StringVar(flags, &flagOpts.dataplaneConfig.Envoy.ExecutablePath, "envoy-executable-path", "DP_ENVOY_EXECUTABLE_PATH", "Path to the Envoy executable to run. Defaults to the ")
 
 	StringVar(flags, &flagOpts.dataplaneConfig.XDSServer.BindAddr, "xds-bind-addr", "DP_XDS_BIND_ADDR", "The address on which the Envoy xDS server is available.")
 	IntVar(flags, &flagOpts.dataplaneConfig.XDSServer.BindPort, "xds-bind-port", "DP_XDS_BIND_PORT", "The port on which the Envoy xDS server is available.")

pkg/consuldp/config.go

@@ -276,6 +276,7 @@ type PrometheusTelemetryConfig struct {
 
 // EnvoyConfig contains configuration for the Envoy process.
 type EnvoyConfig struct {
+	ExecutablePath string
 	// AdminBindAddress is the address on which the Envoy admin server will be available.
 	AdminBindAddress string
 	// AdminBindPort is the port on which the Envoy admin server will be available.

pkg/consuldp/consul_dataplane.go

@@ -227,6 +227,7 @@ func (cdp *ConsulDataplane) Run(ctx context.Context) error {
 	cdp.logger.Debug("generated envoy bootstrap config", "config", string(cfg))
 
 	cdp.logger.Info("configuring envoy and xDS")
+
 	proxy, err := envoy.NewProxy(cdp.envoyProxyConfig(cfg))
 	if err != nil {
 		cdp.logger.Error("failed to create new proxy", "error", err)
@@ -339,6 +340,7 @@ func (cdp *ConsulDataplane) envoyProxyConfig(cfg []byte) envoy.ProxyConfig {
 		Logger:          cdp.logger,
 		LogJSON:         cdp.cfg.Logging.LogJSON,
 		BootstrapConfig: cfg,
+		ExecutablePath:  cdp.cfg.Envoy.ExecutablePath,
 		ExtraArgs:       extraArgs,
 	}
 }