Backport of NET-5186 Fix issue where consul-dataplane attempts to write to a read-only file system location into release/1.0.x

[hc-github-team-consul-core]

Backport

This PR is auto-generated from #253 to be assessed for backporting due to the inclusion of the label backport/1.0.

The below text is copied from the body of the original PR.

---

Running setcap on the consul-dataplane binary results in a process that cannot see the TMPDIR envar intended to influence where the envoy bootstrap config is written to. This is due to a previously-uknown-to-us side effect of glibc, described here.

As a result, it attempts to write to the /tmp directory instead of /consul/connect-inject -- configured for injected sidecars here -- and gets a read-only file system error.

We previously considered dropping setcap for the consul-dataplane binary; however, the envoy binary that is forked from dataplane cannot itself have a capability that the consul-dataplane process does not have.

Instead, I've opted to keep setcap net_bind_service for both envoy and consul-dataplane. We can work around the fact that TMPDIR is invisible to consul-dataplane by not writing to the file system at all and using envoy --config-yaml <yaml or json string> where we were previously using envoy --config-path <string>.

---

Overview of commits

• 518e8be - 1de6153 - fdf1989 - 0391963 - 268a2bc - 0e00abe - 45453c1 - 54b21a4 - 8a56a78 - e96130d - 87a5291

[nathancoleman]

Matches source PR other than changes around FIPS envoy