[CONTP-656] wmeta kubelet unknown envvar handling

comp/core/workloadmeta/collectors/internal/kubelet/kubelet.go

@@ -402,6 +402,7 @@ func extractContainerSecurityContext(spec *kubelet.ContainerSpec) *workloadmeta.
 }
 
 func extractEnvFromSpec(envSpec []kubelet.EnvVar) map[string]string {
+	filterEnvVars(&envSpec)
 	env := make(map[string]string)
 	mappingFunc := expansion.MappingFuncFor(env)
 
@@ -416,9 +417,18 @@ func extractEnvFromSpec(envSpec []kubelet.EnvVar) map[string]string {
 			continue
 		}
 
+		ok := true
 		runtimeVal := e.Value
 		if runtimeVal != "" {
-			runtimeVal = expansion.Expand(runtimeVal, mappingFunc)
+			runtimeVal, ok = expansion.Expand(runtimeVal, mappingFunc)
+		}
+
+		// Ignore environment variables that failed to expand
+		// This occurs when the env var references another env var
+		// that has its value sourced from an external source
+		// (eg. ConfigMap, Secret, DownwardAPI)
+		if !ok {
+			continue
 		}
 
 		env[e.Name] = runtimeVal
@@ -427,6 +437,19 @@ func extractEnvFromSpec(envSpec []kubelet.EnvVar) map[string]string {
 	return env
 }
 
+// filterEnvVars removes unsupported env var sources (eg. ConfigMap, Secrets, etc.)
+func filterEnvVars(envSpec *[]kubelet.EnvVar) {
+	j := 0 // Position for the next valid element
+	for _, envVar := range *envSpec {
+		if envVar.ValueFrom != nil {
+			continue
+		}
+		(*envSpec)[j] = envVar
+		j++
+	}
+	*envSpec = (*envSpec)[:j]
+}
+
 func extractResources(spec *kubelet.ContainerSpec) workloadmeta.ContainerResources {
 	resources := workloadmeta.ContainerResources{}
 	if cpuReq, found := spec.Resources.Requests[kubelet.ResourceCPU]; found {

comp/core/workloadmeta/def/merge_test.go

@@ -49,6 +49,9 @@ func container1(testTime time.Time) Container {
 			Health:     ContainerHealthUnknown,
 		},
 		CollectorTags: []string{"tag1", "tag2"},
+		EnvVars: map[string]string{
+			"DD_SERVICE-partial": "my-svc",
+		},
 	}
 }
 
@@ -91,6 +94,10 @@ func container2() Container {
 			Health:     ContainerHealthHealthy,
 		},
 		CollectorTags: []string{"tag3"},
+		EnvVars: map[string]string{
+			"DD_SERVICE-partial": "my-svc",
+			"DD_ENV-extra":       "prod",
+		},
 	}
 }
 
@@ -114,6 +121,10 @@ func TestMerge(t *testing.T) {
 			ExitCode:   pointer.Ptr(int64(100)),
 			Health:     ContainerHealthHealthy,
 		},
+		EnvVars: map[string]string{
+			"DD_SERVICE-partial": "my-svc",
+			"DD_ENV-extra":       "prod",
+		},
 	}
 
 	expectedPorts := []ContainerPort{

internal/third_party/golang/expansion/expand.go

@@ -19,25 +19,32 @@ func syntaxWrap(input string) string {
 // implements the expansion semantics defined in the expansion spec; it
 // returns the input string wrapped in the expansion syntax if no mapping
 // for the input is found.
-func MappingFuncFor(context ...map[string]string) func(string) string {
-	return func(input string) string {
+//
+// Additionally, it returns a boolean indicating whether the variable was
+// found in the context.
+func MappingFuncFor(context ...map[string]string) func(string) (string, bool) {
+	return func(input string) (string, bool) {
 		for _, vars := range context {
 			val, ok := vars[input]
 			if ok {
-				return val
+				return val, true
 			}
 		}
 
-		return syntaxWrap(input)
+		return syntaxWrap(input), false
 	}
 }
 
 // Expand replaces variable references in the input string according to
 // the expansion spec using the given mapping function to resolve the
 // values of variables.
-func Expand(input string, mapping func(string) string) string {
+//
+// Additionally, it returns the status of whether all nested variables
+// have a defined mapping value in the environment.
+func Expand(input string, mapping func(string) (string, bool)) (string, bool) {
 	var buf bytes.Buffer
 	checkpoint := 0
+	allMappingsFound := true
 	for cursor := 0; cursor < len(input); cursor++ {
 		if input[cursor] == operator && cursor+1 < len(input) {
 			// Copy the portion of the input string since the last
@@ -52,7 +59,14 @@ func Expand(input string, mapping func(string) string) string {
 				// We were able to read a variable name correctly;
 				// apply the mapping to the variable name and copy the
 				// bytes into the buffer
-				buf.WriteString(mapping(read))
+				mappedValue, found := mapping(read)
+
+				// Record that the read variable is not mapped in the environment
+				if !found {
+					allMappingsFound = false
+				}
+
+				buf.WriteString(mappedValue)
 			} else {
 				// Not a variable name; copy the read bytes into the buffer
 				buf.WriteString(read)
@@ -68,8 +82,9 @@ func Expand(input string, mapping func(string) string) string {
 	}
 
 	// Return the buffer and any remaining unwritten bytes in the
-	// input string.
-	return buf.String() + input[checkpoint:]
+	// input string. Also return whether any nested variables in
+	// the input string were not found in the environment.
+	return buf.String() + input[checkpoint:], allMappingsFound
 }
 
 // tryReadVariableName attempts to read a variable name from the input