Repository: kumahq/kuma
Pull request #3391 (2021-11-29 21:41:42)

feat(.github): add commit message linting
### Summary

This check enforces a commit message and PR title format. Almost all formats include the `:` between the type/scope and message (what Dependabot creates for example) but we can of course tweak the details if we prefer.

codecov-commenter: # [Codecov](https://codecov.io/gh/kumahq/kuma/pull/3391?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) Report
> Merging [#3391](https://codecov.io/gh/kumahq/kuma/pull/3391?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) (9bf1a7b) into [master](https://codecov.io/gh/kumahq/kuma/commit/781f81244ee39a4665ef95718c0eb0bf96f55fd5?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) (781f812) will **decrease** coverage by `0.01%`.
> The diff coverage is `n/a`.

[![Impacted file tree graph](https://codecov.io/gh/kumahq/kuma/pull/3391/graphs/tree.svg?width=650&height=150&src=pr&token=D7Yvqs6rwV&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq)](https://codecov.io/gh/kumahq/kuma/pull/3391?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq)

```diff
@@            Coverage Diff             @@
##           master    #3391      +/-   ##
==========================================
- Coverage   52.12%   52.10%   -0.02%     
==========================================
  Files         932      932              
  Lines       54550    54550              
==========================================
- Hits        28433    28425       -8     
- Misses      23889    23900      +11     
+ Partials     2228     2225       -3     
```


| [Impacted Files](https://codecov.io/gh/kumahq/kuma/pull/3391?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq) | Coverage Δ | |
|---|---|---|
| [pkg/insights/components.go](https://codecov.io/gh/kumahq/kuma/pull/3391/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2luc2lnaHRzL2NvbXBvbmVudHMuZ28=) | `70.00% <0.00%> (-30.00%)` | :arrow_down: |
| [pkg/events/eventbus.go](https://codecov.io/gh/kumahq/kuma/pull/3391/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2V2ZW50cy9ldmVudGJ1cy5nbw==) | `85.18% <0.00%> (-7.41%)` | :arrow_down: |
| [pkg/plugins/runtime/gateway/route/sorter.go](https://codecov.io/gh/kumahq/kuma/pull/3391/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL3BsdWdpbnMvcnVudGltZS9nYXRld2F5L3JvdXRlL3NvcnRlci5nbw==) | `66.66% <0.00%> (-5.13%)` | :arrow_down: |
| [pkg/insights/resyncer.go](https://codecov.io/gh/kumahq/kuma/pull/3391/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2luc2lnaHRzL3Jlc3luY2VyLmdv) | `67.22% <0.00%> (-2.68%)` | :arrow_down: |
| [pkg/core/resources/model/rest/resource.go](https://codecov.io/gh/kumahq/kuma/pull/3391/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2NvcmUvcmVzb3VyY2VzL21vZGVsL3Jlc3QvcmVzb3VyY2UuZ28=) | `69.23% <0.00%> (+1.28%)` | :arrow_up: |
| [pkg/core/resources/manager/cache.go](https://codecov.io/gh/kumahq/kuma/pull/3391/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2NvcmUvcmVzb3VyY2VzL21hbmFnZXIvY2FjaGUuZ28=) | `88.31% <0.00%> (+2.59%)` | :arrow_up: |
| [pkg/core/runtime/component/component.go](https://codecov.io/gh/kumahq/kuma/pull/3391/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq#diff-cGtnL2NvcmUvcnVudGltZS9jb21wb25lbnQvY29tcG9uZW50Lmdv) | `88.67% <0.00%> (+7.54%)` | :arrow_up: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/kumahq/kuma/pull/3391?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/kumahq/kuma/pull/3391?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq). Last update [781f812...9bf1a7b](https://codecov.io/gh/kumahq/kuma/pull/3391?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kumahq).

jakubdyszkiewicz: Can we also have lint for `scope`? We have a defined set of scope here https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md but we don't stick to it. Actually, this PR is an example of it ;)
jakubdyszkiewicz: also, should this be the same across the all Kuma repos?
michaelbeaumont: @jakubdyszkiewicz 

> The scope is the part of the codebase that is affected by your change. Choosing it is at your discretion, but here are some of the most frequent ones:

The `type` differs though, this checks for:

```
[
  'build',
  'chore',
  'ci',
  'docs',
  'feat',
  'fix',
  'perf',
  'refactor',
  'revert',
  'style',
  'test'
];
```
jakubdyszkiewicz: Ok I see that we say `Choosing it is at your discretion` about scope. Then we don't need to do validation on it then.
michaelbeaumont: @hutchic Yes, [see here](https://commitlint.js.org/#/guides-local-setup?id=install-husky) but I don't necessarily want to introduce `npm` dependencies into this repo.
michaelbeaumont: > Btw there seems to be a GH action for this already: https://github.com/wagoid/commitlint-github-action . It looks to be pretty well maintained.

Indeed, I decided with the simplicity of this workflow it wasn't worth introducing an external dependency.

> Also as we're migrating to `Conventional Commits` we might just want to link the [spec](https://www.conventionalcommits.org/en/v1.0.0/) in the CONTRIBUTING.md docs. Also please socialize this with the team so that folks don't get suprised!

Done!




Patch:
diff --git a/.github/commitlint.config.js b/.github/commitlint.config.js
new file mode 100644
index 000000000..a19eb6f33
--- /dev/null
+++ b/.github/commitlint.config.js
@@ -0,0 +1,5 @@
+module.exports = {
+  extends: ["@commitlint/config-conventional"],
+  helpUrl:
+    "https://github.com/kumahq/kuma/blob/master/CONTRIBUTING.md#commit-message-format",
+};
diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
new file mode 100644
index 000000000..bc381416e
--- /dev/null
+++ b/.github/workflows/check.yaml
@@ -0,0 +1,28 @@
+name: "Lint PRs"
+
+on: pull_request
+
+jobs:
+  # This job checks all PR commits and the PR title using
+  # https://github.com/conventional-changelog/commitlint
+  # for whether they follow the conventional commit format at
+  # https://www.conventionalcommits.org/en/v1.0.0/
+  # See also /.github/commitlint.config.js for more details
+  commit-lint:
+    name: "Check commits and PR title"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v2
+      - run: npm install -g @commitlint/cli @commitlint/config-conventional
+      - name: "Check commits"
+        run: |
+          commitlint --config .github/commitlint.config.js --from="origin/${{ github.event.pull_request.base.ref }}"
+      - name: "Check PR title"
+        # Inject as env variable to escape properly
+        env:
+          TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          commitlint --config .github/commitlint.config.js --edit=<(echo "${TITLE}")
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 71e70ae86..4101d1068 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -114,13 +114,13 @@ format to use or the appropriate code style.
 Once you have read them, and you are ready to submit your Pull Request, be sure
 to verify a few things:
 
-- Your work was based on the appropriate branch (`master` vs. `feature/latest`), 
+- Your work was based on the appropriate branch (`master` vs. `feature/latest`),
   and you are opening your Pull Request against the appropriate one
 - Your commit history is clean: changes are atomic and the git message format
   was respected
 - Rebase your work on top of the base branch (seek help online on how to use
   `git rebase`; this is important to ensure your commit history is clean and
-   linear)
+  linear)
 - The tests are passing: run `make test`, `make test/kuma-cp`,
   `make test/kuma-dp`, or whichever make target under `test/` is appropriate
   for your change
@@ -202,8 +202,10 @@ also help you respect this mantra (see the below section).
 
 #### Commit message format
 
-To maintain a healthy Git history, we ask of you that you write your commit
-messages as follows:
+We follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/)
+for commit messages and PR titles.
+
+A quick overview on commit messages:
 
 - The tense of your message must be **present**
 - Your message must be prefixed by a type, and a scope
@@ -214,31 +216,20 @@ messages as follows:
 Here is a template of what your commit message should look like:
 
 ```
-<type>(<scope>) <subject>
+<type>(<scope>): <subject>
 <BLANK LINE>
 <body>
 <BLANK LINE>
 <footer>
 ```
 
+The exact details of the format can be found in the [conventional commits
+specification](https://www.conventionalcommits.org/en/v1.0.0/#specification).
+
 ##### Type
 
-The type of your commit indicates what type of change this commit is about. The
-accepted types are:
-
-- **feat**: A new feature
-- **fix**: A bug fix
-- **hotfix**: An urgent bug fix during a release process
-- **tests**: A change that is purely related to the test suite only (fixing
-  a test, adding a test, improving its reliability, etc...)
-- **docs**: Changes to the README.md, this file, or other such documents
-- **style**: Changes that do not affect the meaning of the code (white-space
-  trimming, formatting, etc...)
-- **perf**: A code change that significantly improves performance
-- **refactor**: A code change that neither fixes a bug nor adds a feature, and
-  is too big to be considered just `perf`
-- **chore**: Maintenance changes related to code cleaning that isn't
-  considered part of a refactor, build process updates, or dependency bumps
+Allowed types are enforced via `commitlint`. The list can be found at the
+[`config-conventional` repository](https://github.com/conventional-changelog/commitlint/tree/master/%40commitlint/config-conventional#type-enum).
 
 ##### Scope
 
@@ -281,7 +272,7 @@ related GitHub issues, Pull Requests, fixed bug reports, etc...
 Here are a few examples of good commit messages to take inspiration from:
 
 ```
-fix(admin) send HTTP 405 on unsupported method
+fix(admin): send HTTP 405 on unsupported method
 
 The appropriate status code when the request method is not supported
 on an endpoint it 405. We previously used to send HTTP 404, which
@@ -312,4 +303,4 @@ easier to use or understand Kuma, congratulations! You are eligible to
 receive the very special Contributor T-shirt! Go ahead and fill out the
 [Contributors Submissions form](https://goo.gl/forms/5w6mxLaE4tz2YM0L2).
 
-[Back to TOC](#table-of-contents)
\ No newline at end of file
+[Back to TOC](#table-of-contents)
diff --git a/mk/dev.mk b/mk/dev.mk
index ceacc7a14..a5da10e1c 100644
--- a/mk/dev.mk
+++ b/mk/dev.mk
@@ -1,8 +1,8 @@
-GINKGO_VERSION := v1.16.4
-GOLANGCI_LINT_VERSION := v1.41.1
+GINKGO_VERSION := v1.16.5
+GOLANGCI_LINT_VERSION := v1.43.0
 GOLANG_PROTOBUF_VERSION := v1.5.2
-HELM_DOCS_VERSION := 1.4.0
-KUSTOMIZE_VERSION := v4.1.3
+HELM_DOCS_VERSION := 1.5.0
+KUSTOMIZE_VERSION := v4.4.1
 PROTOC_PGV_VERSION := v0.4.1
 PROTOC_VERSION := 3.14.0
 UDPA_LATEST_VERSION := main
diff --git a/mk/docker.mk b/mk/docker.mk
index b0cb949ba..faa3cac45 100644
--- a/mk/docker.mk
+++ b/mk/docker.mk
@@ -41,8 +41,8 @@ docker/build/kuma-cp: build/artifacts-linux-amd64/kuma-cp/kuma-cp ## Dev: Build
 	docker build -t $(KUMA_CP_DOCKER_IMAGE) -f tools/releases/dockerfiles/Dockerfile.kuma-cp .
 
 .PHONY: docker/build/kuma-dp
-docker/build/kuma-dp: build/artifacts-linux-amd64/kuma-dp/kuma-dp build/artifacts-linux-amd64/coredns/coredns ## Dev: Build `kuma-dp` Docker image using existing artifact
-	docker build -t $(KUMA_DP_DOCKER_IMAGE) -f tools/releases/dockerfiles/Dockerfile.kuma-dp .
+docker/build/kuma-dp: build/artifacts-linux-amd64/kuma-dp/kuma-dp build/artifacts-linux-amd64/coredns/coredns build/artifacts-linux-amd64/envoy/envoy ## Dev: Build `kuma-dp` Docker image using existing artifact
+	docker build -t $(KUMA_DP_DOCKER_IMAGE) --build-arg ENVOY_VERSION=${ENVOY_VERSION} -f tools/releases/dockerfiles/Dockerfile.kuma-dp .
 
 .PHONY: docker/build/kumactl
 docker/build/kumactl: build/artifacts-linux-amd64/kumactl/kumactl ## Dev: Build `kumactl` Docker image using existing artifact
@@ -58,8 +58,8 @@ docker/build/kuma-prometheus-sd: build/artifacts-linux-amd64/kuma-prometheus-sd/
 
 .PHONY: docker/build/kuma-universal
 docker/build/kuma-universal: ## Dev: Build `kuma-universal` Docker image using existing artifact
-docker/build/kuma-universal: build/artifacts-linux-amd64/kuma-cp/kuma-cp build/artifacts-linux-amd64/kuma-dp/kuma-dp build/artifacts-linux-amd64/kumactl/kumactl build/artifacts-linux-amd64/test-server/test-server
-	docker build -t kuma-universal -f test/dockerfiles/Dockerfile.universal .
+docker/build/kuma-universal: build/artifacts-linux-amd64/kuma-cp/kuma-cp build/artifacts-linux-amd64/kuma-dp/kuma-dp build/artifacts-linux-amd64/kumactl/kumactl build/artifacts-linux-amd64/test-server/test-server build/artifacts-linux-amd64/envoy/envoy
+	docker build -t kuma-universal --build-arg ENVOY_VERSION=${ENVOY_VERSION}  -f test/dockerfiles/Dockerfile.universal .
 	docker tag kuma-universal $(KUMA_UNIVERSAL_DOCKER_IMAGE)
 
 .PHONY: image/kuma-cp
diff --git a/mk/envoy.mk b/mk/envoy.mk
index dcfda518e..0c18e824c 100644
--- a/mk/envoy.mk
+++ b/mk/envoy.mk
@@ -1,32 +1,51 @@
-ENVOY_TAG ?= v1.20.0
-ENVOY_COMMIT_HASH ?= b16d390f11376e47f479778f2362ea4f48bdc895
+KUMA_DIR ?= .
+
+BUILD_ENVOY_FROM_SOURCES ?= false
+
+ENVOY_TAG ?= b16d390f11376e47f479778f2362ea4f48bdc895 # commit hash or git tag
+ENVOY_VERSION = $(shell ${KUMA_DIR}/tools/envoy/version.sh ${ENVOY_TAG})
+
+ifeq ($(GOOS),linux)
+	ENVOY_DISTRO ?= alpine
+endif
+ENVOY_DISTRO ?= ${GOOS}
 
 SOURCE_DIR ?= ${TMPDIR}envoy-sources
 ifndef TMPDIR
 	SOURCE_DIR ?= /tmp/envoy-sources
 endif
 
-BUILD_ENVOY_FROM_SOURCES ?= false
-KUMA_DIR ?= .
-# Target 'build/envoy' allows to put Envoy binary under the build/artifacts-$GOOS-$GOARCH directory.
+# Target 'build/envoy' allows to put Envoy binary under the build/artifacts-$GOOS-$GOARCH/envoy directory.
 # Depending on the flag BUILD_ENVOY_FROM_SOURCES this target either fetches Envoy from binary registry or
-# builds from sources. It's possible to build binaries for darwin, linux and centos7 by specifying GOOS variable.
-# Envoy version could be specified either by ENVOY_TAG or ENVOY_COMMIT_HASH, the latter takes precedence.
+# builds from sources. It's possible to build binaries for darwin, linux and centos by specifying GOOS
+# and ENVOY_DISTRO variables. Envoy version could be specified by ENVOY_TAG that accepts git tag or commit
+# hash values.
 .PHONY: build/envoy
-build/envoy: ## Envoy: build or fetch envoy binaries
-	$(MAKE) build/artifacts-${GOOS}-${GOARCH}/envoy/envoy
+build/envoy:
+	GOOS=${GOOS} \
+	GOARCH=${GOARCH} \
+	ENVOY_DISTRO=${ENVOY_DISTRO} \
+	ENVOY_VERSION=${ENVOY_VERSION} \
+	$(MAKE) build/artifacts-${GOOS}-${GOARCH}/envoy/envoy-${ENVOY_VERSION}-${ENVOY_DISTRO}
+
+.PHONY: build/artifacts-linux-amd64/envoy/envoy
+build/artifacts-linux-amd64/envoy/envoy:
+	GOOS=linux GOARCH=amd64 $(MAKE) build/envoy
 
-build/artifacts-%-amd64/envoy/envoy:
+build/artifacts-${GOOS}-${GOARCH}/envoy/envoy-${ENVOY_VERSION}-${ENVOY_DISTRO}:
 ifeq ($(BUILD_ENVOY_FROM_SOURCES),true)
 	ENVOY_TAG=${ENVOY_TAG} \
-	ENVOY_COMMIT_HASH=${ENVOY_COMMIT_HASH} \
 	SOURCE_DIR=${SOURCE_DIR} \
 	KUMA_DIR=${KUMA_DIR} \
 	BAZEL_BUILD_EXTRA_OPTIONS=${BAZEL_BUILD_EXTRA_OPTIONS} \
-	BINARY_PATH=$@ ${KUMA_DIR}/tools/envoy/build_$*.sh
+	BINARY_PATH=$@ ${KUMA_DIR}/tools/envoy/build_${ENVOY_DISTRO}.sh
 else
-	ENVOY_TAG=${ENVOY_TAG} \
-	ENVOY_COMMIT_HASH=${ENVOY_COMMIT_HASH} \
-	BINARY_PATH=$@ \
-	ENVOY_DISTRO=$* ${KUMA_DIR}/tools/envoy/fetch.sh
+	ENVOY_VERSION=${ENVOY_VERSION} \
+	ENVOY_DISTRO=${ENVOY_DISTRO} \
+	BINARY_PATH=$@ ${KUMA_DIR}/tools/envoy/fetch.sh
 endif
+
+.PHONY: clean/envoy
+clean/envoy:
+	rm -rf ${SOURCE_DIR}
+	rm -rf build/artifacts-${GOOS}-${GOARCH}/envoy/
diff --git a/pkg/xds/generator/prometheus_endpoint_generator.go b/pkg/xds/generator/prometheus_endpoint_generator.go
index 6d959be23..f6451b0e9 100644
--- a/pkg/xds/generator/prometheus_endpoint_generator.go
+++ b/pkg/xds/generator/prometheus_endpoint_generator.go
@@ -2,7 +2,6 @@ package generator
 
 import (
 	"net"
-	"strings"
 
 	"github.com/pkg/errors"
 
@@ -31,10 +30,6 @@ const OriginPrometheus = "prometheus"
 type PrometheusEndpointGenerator struct {
 }
 
-var HasMetricsHijacker = func(version *mesh_proto.Version) bool {
-	return strings.HasPrefix(version.GetKumaDp().GetVersion(), "1.2.")
-}
-
 func (g PrometheusEndpointGenerator) Generate(ctx xds_context.Context, proxy *core_xds.Proxy) (*core_xds.ResourceSet, error) {
 	prometheusEndpoint, err := proxy.Dataplane.GetPrometheusEndpoint(ctx.Mesh.Resource)
 	if err != nil {
@@ -64,34 +59,22 @@ func (g PrometheusEndpointGenerator) Generate(ctx xds_context.Context, proxy *co
 
 	resources := core_xds.NewResourceSet()
 
-	// backwards compatibility
-	// Kuma DP <1.2.x does not have metrics hijacker builtin therefore we configure those Envoys with just Envoy prometheus endpoint.
-	var clusterName string
-	var statsPath string
-
-	if HasMetricsHijacker(proxy.Metadata.Version) {
-		metricsHijackerClusterName := envoy_names.GetMetricsHijackerClusterName()
-		cluster, err := envoy_clusters.NewClusterBuilder(proxy.APIVersion).
-			Configure(envoy_clusters.StaticClusterUnixSocket(metricsHijackerClusterName,
-				envoy_common.MetricsHijackerSocketName(proxy.Dataplane.Meta.GetName(), proxy.Dataplane.Meta.GetMesh()))).
-			Build()
-		if err != nil {
-			return nil, err
-		}
-
-		resources.Add(&core_xds.Resource{
-			Name:     cluster.GetName(),
-			Origin:   OriginPrometheus,
-			Resource: cluster,
-		})
-
-		clusterName = metricsHijackerClusterName
-		statsPath = "/"
-	} else {
-		clusterName = envoy_names.GetEnvoyAdminClusterName()
-		statsPath = "/stats/prometheus"
+	const statsPath = "/"
+	metricsHijackerClusterName := envoy_names.GetMetricsHijackerClusterName()
+	cluster, err := envoy_clusters.NewClusterBuilder(proxy.APIVersion).
+		Configure(envoy_clusters.StaticClusterUnixSocket(metricsHijackerClusterName,
+			envoy_common.MetricsHijackerSocketName(proxy.Dataplane.Meta.GetName(), proxy.Dataplane.Meta.GetMesh()))).
+		Build()
+	if err != nil {
+		return nil, err
 	}
 
+	resources.Add(&core_xds.Resource{
+		Name:     cluster.GetName(),
+		Origin:   OriginPrometheus,
+		Resource: cluster,
+	})
+
 	// Cluster is generated by AdminProxyGenerator
 	prometheusListenerName := envoy_names.GetPrometheusListenerName()
 
@@ -112,7 +95,7 @@ func (g PrometheusEndpointGenerator) Generate(ctx xds_context.Context, proxy *co
 					envoy_listeners.StaticEndpoints(prometheusListenerName,
 						[]*envoy_common.StaticEndpointPath{
 							{
-								ClusterName: clusterName,
+								ClusterName: metricsHijackerClusterName,
 								Path:        prometheusEndpoint.Path,
 								RewritePath: statsPath,
 							},
@@ -125,7 +108,7 @@ func (g PrometheusEndpointGenerator) Generate(ctx xds_context.Context, proxy *co
 					envoy_listeners.StaticEndpoints(prometheusListenerName,
 						[]*envoy_common.StaticEndpointPath{
 							{
-								ClusterName: clusterName,
+								ClusterName: metricsHijackerClusterName,
 								Path:        prometheusEndpoint.Path,
 								RewritePath: statsPath,
 							},
@@ -139,7 +122,7 @@ func (g PrometheusEndpointGenerator) Generate(ctx xds_context.Context, proxy *co
 			Configure(envoy_listeners.FilterChain(envoy_listeners.NewFilterChainBuilder(proxy.APIVersion).
 				Configure(envoy_listeners.StaticEndpoints(prometheusListenerName, []*envoy_common.StaticEndpointPath{
 					{
-						ClusterName: clusterName,
+						ClusterName: metricsHijackerClusterName,
 						Path:        prometheusEndpoint.Path,
 						RewritePath: statsPath,
 					},
diff --git a/tools/envoy/Dockerfile.build-centos7 b/tools/envoy/Dockerfile.build-centos
similarity index 100%
rename from tools/envoy/Dockerfile.build-centos7
rename to tools/envoy/Dockerfile.build-centos
diff --git a/tools/envoy/Dockerfile.build-centos7.dockerignore b/tools/envoy/Dockerfile.build-centos.dockerignore
similarity index 100%
rename from tools/envoy/Dockerfile.build-centos7.dockerignore
rename to tools/envoy/Dockerfile.build-centos.dockerignore
diff --git a/tools/envoy/README.md b/tools/envoy/README.md
index 702dafed1..1f6c6f61f 100644
--- a/tools/envoy/README.md
+++ b/tools/envoy/README.md
@@ -2,7 +2,7 @@
 
 The current directory contains tools for building, publishing and fetching Envoy binaries.
 
-There is a new Makefile target `build/envoy` that places an `envoy` binary in `build/artifacts-$GOOS-$GOARCH/` directory.
+There is a new Makefile target `build/envoy` that places an `envoy` binary in `build/artifacts-$GOOS-$GOARCH/envoy` directory.
 The default behaviour of that target – fetching binaries from [download.konghq.com](download.konghq.com) since it makes more sense for
 overwhelming majority of users. However, there is a variable `BUILD_ENVOY_FROM_SOURCES` that allows to build Envoy from 
 source code. 
@@ -16,7 +16,7 @@ $ make build/envoy
 
 Download the latest supported Envoy binary for specified system:
 ```shell
-$ GOOS=linux make build/envoy # supported OS: linux, centos7 and darwin
+$ GOOS=linux make build/envoy # supported OS: linux, centos and darwin
 ```
 
 Download the specific Envoy tag:
@@ -26,15 +26,15 @@ $ ENVOY_TAG=v1.18.4 make build/envoy
 
 Download the specific Envoy commit hash (if it exists in [download.konghq.com](download.konghq.com)):
 ```shell
-$ ENVOY_COMMIT_HASH=bef18019d8fc33a4ed6aca3679aff2100241ac5e make build/envoy
+$ ENVOY_TAG=bef18019d8fc33a4ed6aca3679aff2100241ac5e make build/envoy
 ```
 
 If desired commit hash doesn't exist, it could be built from sources:
 ```shell
-$ ENVOY_COMMIT_HASH=bef18019d8fc33a4ed6aca3679aff2100241ac5e BUILD_ENVOY_FROM_SOURCES=true make build/envoy
+$ ENVOY_TAG=bef18019d8fc33a4ed6aca3679aff2100241ac5e BUILD_ENVOY_FROM_SOURCES=true make build/envoy
 ```
 
 When building from sources its still possible to specify OS:
 ```shell
-$ GOOS=linux ENVOY_COMMIT_HASH=bef18019d8fc33a4ed6aca3679aff2100241ac5e BUILD_ENVOY_FROM_SOURCES=true make build/envoy
+$ GOOS=linux ENVOY_TAG=bef18019d8fc33a4ed6aca3679aff2100241ac5e BUILD_ENVOY_FROM_SOURCES=true make build/envoy
 ```
diff --git a/tools/envoy/build_centos7.sh b/tools/envoy/build_centos.sh
similarity index 95%
rename from tools/envoy/build_centos7.sh
rename to tools/envoy/build_centos.sh
index 8e9efdeff..c1d8a1c7c 100755
--- a/tools/envoy/build_centos7.sh
+++ b/tools/envoy/build_centos.sh
@@ -26,7 +26,7 @@ LOCAL_BUILD_IMAGE="envoy-builder:${ENVOY_TAG}"
 docker build -t "${LOCAL_BUILD_IMAGE}" --progress=plain \
   --build-arg ENVOY_BUILD_IMAGE="${ENVOY_BUILD_IMAGE}" \
   --build-arg BUILD_CMD="${BUILD_CMD}" \
-  -f tools/envoy/Dockerfile.build-centos7 "${SOURCE_DIR}"
+  -f tools/envoy/Dockerfile.build-centos "${SOURCE_DIR}"
 
 # copy out the binary
 id=$(docker create "${LOCAL_BUILD_IMAGE}")
diff --git a/tools/envoy/build_linux.sh b/tools/envoy/build_linux.sh
index 6967abfb1..7a5f2f4a9 100755
--- a/tools/envoy/build_linux.sh
+++ b/tools/envoy/build_linux.sh
@@ -28,7 +28,7 @@ echo "BUILD_CMD=${BUILD_CMD}"
 docker build -t "${LOCAL_BUILD_IMAGE}" --progress=plain \
   --build-arg ENVOY_BUILD_IMAGE="${ENVOY_BUILD_IMAGE}" \
   --build-arg BUILD_CMD="${BUILD_CMD}" \
-  -f tools/envoy/Dockerfile.build-ubuntu "${SOURCE_DIR}"
+  -f "${KUMA_DIR:-.}/tools/envoy/Dockerfile.build-ubuntu" "${SOURCE_DIR}"
 
 # copy out the binary
 id=$(docker create "${LOCAL_BUILD_IMAGE}")
diff --git a/tools/envoy/fetch.sh b/tools/envoy/fetch.sh
index 50d2b7237..fb84cb4d7 100755
--- a/tools/envoy/fetch.sh
+++ b/tools/envoy/fetch.sh
@@ -4,13 +4,8 @@
 #
 # Requires:
 # - $BINARY_PATH, path where binary will be fetched, for example 'out/envoy'
-# - $ENVOY_DISTRO, name of the distributive (i.e darwin, linux)
-#
-# Optional:
-# - $ENVOY_TAG, git tag to reference specific revision
-# - $ENVOY_COMMIT_HASH, hash of the git commit. If specified, then $ENVOY_TAG will be ignored
-#
-# at least one of $ENVOY_TAG or $ENVOY_COMMIT_HASH should be specified
+# - $ENVOY_VERSION, version of the envoy binary to fetch
+# - $ENVOY_DISTRO, name of the distributive (i.e darwin, alpine)
 
 set -o errexit
 set -o pipefail
@@ -33,36 +28,8 @@ function download_envoy() {
   [ "$status" -ne "200" ] && msg_err "Error: failed downloading Envoy" || true
 }
 
-ENVOY_TAG=${ENVOY_TAG:-}
-ENVOY_COMMIT_HASH=${ENVOY_COMMIT_HASH:-}
-[[ -z "${ENVOY_TAG}" ]] && [[ -z "${ENVOY_COMMIT_HASH}" ]] && msg_err "Error: either ENVOY_TAG or ENVOY_COMMIT_HASH should be specified"
-
-if [ "${ENVOY_DISTRO}" == "linux" ]; then
-  ENVOY_DISTRO="alpine"
-fi
-
-if [ "${ENVOY_DISTRO}" == "centos7" ]; then
-  ENVOY_DISTRO="centos"
-fi
-
-if [[ -n "${ENVOY_COMMIT_HASH}" ]]; then
-  ENVOY_SHORT_HASH=${ENVOY_COMMIT_HASH:0:8}
-
-  BINARY_NAME=$(curl --silent https://download.konghq.com/mesh-alpine/ \
-    | { grep "${ENVOY_SHORT_HASH}" || true; } \
-    | { grep "${ENVOY_DISTRO}" || true; } \
-    | sed -e 's#.*<li><a href=".*">\(.*\)</a></li>#\1#')
-
-  [[ -z "${BINARY_NAME}" ]] && msg_err "failed to resolve binary name by ENVOY_COMMIT_HASH=${ENVOY_COMMIT_HASH}"
-
-  download_envoy "${BINARY_NAME}"
-  exit 0
-fi
-
-if [[ -n "${ENVOY_TAG}" ]]; then
-  ENVOY_VERSION=${ENVOY_TAG:1}
+if [[ -n "${ENVOY_VERSION}" ]]; then
   BINARY_NAME="envoy-${ENVOY_VERSION}-${ENVOY_DISTRO}"
-
   download_envoy "${BINARY_NAME}"
   exit 0
 fi
diff --git a/tools/envoy/fetch_sources.sh b/tools/envoy/fetch_sources.sh
index 1d6fe2a0e..771a10fcb 100755
--- a/tools/envoy/fetch_sources.sh
+++ b/tools/envoy/fetch_sources.sh
@@ -4,12 +4,7 @@
 #
 # Requires:
 # - $SOURCE_DIR, a directory where sources will be placed
-#
-# Optional:
 # - $ENVOY_TAG, git tag to reference specific revision
-# - $ENVOY_COMMIT_HASH, hash of the git commit. If specified, then $ENVOY_TAG will be ignored
-#
-# at least one of $ENVOY_TAG or $ENVOY_COMMIT_HASH should be specified
 
 set -o errexit
 set -o pipefail
@@ -17,10 +12,6 @@ set -o nounset
 
 source "$(dirname -- "${BASH_SOURCE[0]}")/../common.sh"
 
-ENVOY_TAG=${ENVOY_TAG:-}
-ENVOY_COMMIT_HASH=${ENVOY_COMMIT_HASH:-}
-[[ -z "${ENVOY_TAG}" ]] && [[ -z "${ENVOY_COMMIT_HASH}" ]] && msg_err "Error: either ENVOY_TAG or ENVOY_COMMIT_HASH should be specified"
-
 # clone Envoy repo if not exists
 if [[ ! -d "${SOURCE_DIR}" ]]; then
   mkdir -p "${SOURCE_DIR}"
@@ -36,10 +27,9 @@ fi
 
 pushd ${SOURCE_DIR}
 
-git fetch origin --depth=1 "${ENVOY_COMMIT_HASH:-${ENVOY_TAG}}"
+git fetch origin --depth=1 "${ENVOY_TAG}"
 git reset --hard FETCH_HEAD
 
 echo "ENVOY_TAG=${ENVOY_TAG}"
-echo "ENVOY_COMMIT_HASH=${ENVOY_COMMIT_HASH}"
 
 popd
diff --git a/tools/envoy/version.sh b/tools/envoy/version.sh
new file mode 100755
index 000000000..f7ad197d8
--- /dev/null
+++ b/tools/envoy/version.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -o errexit
+set -o pipefail
+set -o nounset
+
+# Returns Envoy version by ENVOY_TAG:
+# - if ENVOY_TAG is a real git tag like 'v1.20.0' then the version is equal to '1.20.0' (without the first letter 'v').
+# - if ENVOY_TAG is a commit hash then the version will look like '1.20.1-dev-b16d390f'
+
+ENVOY_TAG=$1
+ENVOY_VERSION=$(curl --silent --location --fail "https://raw.githubusercontent.com/envoyproxy/envoy/${ENVOY_TAG}/VERSION")
+if [[ "${ENVOY_TAG}" =~ ^v[0-9]*\.[0-9]*\.[0-9]*$ ]]; then
+  echo "${ENVOY_VERSION}"
+else
+  echo "${ENVOY_VERSION}-${ENVOY_TAG:0:8}"
+fi
diff --git a/tools/releases/dockerfiles/Dockerfile.kuma-dp b/tools/releases/dockerfiles/Dockerfile.kuma-dp
index c1b9ca049..6acb530cc 100644
--- a/tools/releases/dockerfiles/Dockerfile.kuma-dp
+++ b/tools/releases/dockerfiles/Dockerfile.kuma-dp
@@ -1,7 +1,9 @@
 FROM frolvlad/alpine-glibc:alpine-3.15_glibc-2.33
 
+ARG ENVOY_VERSION
+
 ADD $KUMA_ROOT/build/artifacts-linux-amd64/kuma-dp/kuma-dp /usr/bin
-ADD $KUMA_ROOT/build/artifacts-linux-amd64/envoy/envoy /usr/bin
+ADD $KUMA_ROOT/build/artifacts-linux-amd64/envoy/envoy-$ENVOY_VERSION-alpine /usr/bin/envoy
 ADD $KUMA_ROOT/build/artifacts-linux-amd64/coredns/coredns /usr/bin
 
 COPY $KUMA_ROOT/tools/releases/templates/LICENSE \
diff --git a/tools/releases/dockerfiles/Dockerfile.kuma-dp.dockerignore b/tools/releases/dockerfiles/Dockerfile.kuma-dp.dockerignore
index ed32c8372..4761af513 100644
--- a/tools/releases/dockerfiles/Dockerfile.kuma-dp.dockerignore
+++ b/tools/releases/dockerfiles/Dockerfile.kuma-dp.dockerignore
@@ -1,7 +1,7 @@
 *
 !build/artifacts-linux-amd64/kuma-dp/kuma-dp
 !build/artifacts-linux-amd64/coredns/coredns
-!build/artifacts-linux-amd64/envoy/envoy
+!build/artifacts-linux-amd64/envoy/*
 !tools/releases/templates/LICENSE
 !tools/releases/templates/NOTICE
 !tools/releases/templates/README


Test patch:
diff --git a/app/kuma-cp/cmd/cmd_k8s_test.go b/app/kuma-cp/cmd/cmd_k8s_test.go
index c4522048a..fc4f269b7 100644
--- a/app/kuma-cp/cmd/cmd_k8s_test.go
+++ b/app/kuma-cp/cmd/cmd_k8s_test.go
@@ -80,6 +80,6 @@ diagnostics:
   serverPort: %%d
 `,
 			admissionServerPort,
-			filepath.Join("testdata"))
+			"testdata")
 	}), "")
 })
diff --git a/app/kuma-dp/pkg/dataplane/dnsserver/dnsserver_test.go b/app/kuma-dp/pkg/dataplane/dnsserver/dnsserver_test.go
index feeb4904e..89aa1db93 100644
--- a/app/kuma-dp/pkg/dataplane/dnsserver/dnsserver_test.go
+++ b/app/kuma-dp/pkg/dataplane/dnsserver/dnsserver_test.go
@@ -177,7 +177,7 @@ var _ = Describe("DNS Server", func() {
 			cfg := kuma_dp.Config{
 				DNS: kuma_dp.DNS{
 					Enabled:           true,
-					CoreDNSBinaryPath: filepath.Join("testdata"),
+					CoreDNSBinaryPath: "testdata",
 					ConfigDir:         configDir,
 				},
 			}
diff --git a/app/kuma-dp/pkg/dataplane/envoy/envoy_test.go b/app/kuma-dp/pkg/dataplane/envoy/envoy_test.go
index 15addec1d..c3a40623b 100644
--- a/app/kuma-dp/pkg/dataplane/envoy/envoy_test.go
+++ b/app/kuma-dp/pkg/dataplane/envoy/envoy_test.go
@@ -230,7 +230,7 @@ var _ = Describe("Envoy", func() {
 			// given
 			cfg := kuma_dp.Config{
 				DataplaneRuntime: kuma_dp.DataplaneRuntime{
-					BinaryPath: filepath.Join("testdata"),
+					BinaryPath: "testdata",
 					ConfigDir:  configDir,
 				},
 			}
diff --git a/pkg/xds/generator/testdata/prometheus-endpoint/default-without-hijacker.envoy-config.golden.yaml b/pkg/xds/generator/testdata/prometheus-endpoint/default-without-hijacker.envoy-config.golden.yaml
index e9832c44b..2d215fab6 100644
--- a/pkg/xds/generator/testdata/prometheus-endpoint/default-without-hijacker.envoy-config.golden.yaml
+++ b/pkg/xds/generator/testdata/prometheus-endpoint/default-without-hijacker.envoy-config.golden.yaml
@@ -1,4 +1,19 @@
 resources:
+- name: kuma:metrics:hijacker
+  resource:
+    '@type': type.googleapis.com/envoy.config.cluster.v3.Cluster
+    altStatName: kuma_metrics_hijacker
+    connectTimeout: 10s
+    loadAssignment:
+      clusterName: kuma:metrics:hijacker
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              pipe:
+                path: /tmp/kuma-mh-backend-01-demo.sock
+    name: kuma:metrics:hijacker
+    type: STATIC
 - name: kuma:metrics:prometheus
   resource:
     '@type': type.googleapis.com/envoy.config.listener.v3.Listener
@@ -23,8 +38,8 @@ resources:
               - match:
                   prefix: /non-standard-path
                 route:
-                  cluster: kuma:envoy:admin
-                  prefixRewrite: /stats/prometheus
+                  cluster: kuma:metrics:hijacker
+                  prefixRewrite: /
           statPrefix: kuma_metrics_prometheus
     name: kuma:metrics:prometheus
     trafficDirection: INBOUND
diff --git a/test/dockerfiles/Dockerfile.universal b/test/dockerfiles/Dockerfile.universal
index 766e8b1d1..3b821e686 100644
--- a/test/dockerfiles/Dockerfile.universal
+++ b/test/dockerfiles/Dockerfile.universal
@@ -1,6 +1,3 @@
-# using Envoy's base to copy the Envoy binary
-FROM envoyproxy/envoy-contrib:v1.20.0 as envoy
-
 FROM ubuntu:21.04
 
 RUN mkdir /kuma
@@ -33,11 +30,11 @@ RUN ssh-keygen -A \
   && chmod a+rwx /root \
   && useradd -U kuma-dp
 
-COPY --from=envoy /usr/local/bin/envoy /usr/local/bin/envoy
+ARG ENVOY_VERSION
 
 ADD $KUMA_ROOT/build/artifacts-linux-amd64/kuma-cp/kuma-cp /usr/bin
 ADD $KUMA_ROOT/build/artifacts-linux-amd64/kuma-dp/kuma-dp /usr/bin
-ADD $KUMA_ROOT/build/artifacts-linux-amd64/envoy/envoy /usr/bin
+ADD $KUMA_ROOT/build/artifacts-linux-amd64/envoy/envoy-$ENVOY_VERSION-alpine /usr/bin/envoy
 ADD $KUMA_ROOT/build/artifacts-linux-amd64/coredns/coredns /usr/bin
 ADD $KUMA_ROOT/build/artifacts-linux-amd64/kumactl/kumactl /usr/bin
 ADD $KUMA_ROOT/build/artifacts-linux-amd64/test-server/test-server /usr/bin
diff --git a/test/dockerfiles/Dockerfile.universal.dockerignore b/test/dockerfiles/Dockerfile.universal.dockerignore
index 24d9bb062..0c6ad0415 100644
--- a/test/dockerfiles/Dockerfile.universal.dockerignore
+++ b/test/dockerfiles/Dockerfile.universal.dockerignore
@@ -1,7 +1,7 @@
 *
 !build/artifacts-linux-amd64/kuma-cp/kuma-cp
 !build/artifacts-linux-amd64/kuma-dp/kuma-dp
-!build/artifacts-linux-amd64/envoy/envoy
+!build/artifacts-linux-amd64/envoy/*
 !build/artifacts-linux-amd64/kumactl/kumactl
 !build/artifacts-linux-amd64/coredns/coredns
 !build/artifacts-linux-amd64/test-server/test-server