traefik_mesh: add container-based config discovery support

[vitkyrka]

What does this PR do?

Adds container-based config discovery support to traefik_mesh.

Discovery strategy: Traefik Mesh's proxy shares the stock upstream traefik image with any plain (non-mesh) Traefik reverse-proxy deployment, so image/ad_identifiers-only matching can't tell them apart. This PR uses a local discovery strategy that reads the container's kube_daemon_set Kubernetes tag instead — the chart hardcodes the proxy's DaemonSet name to traefik-mesh-proxy, so that tag reliably identifies the role even though the image itself is generic. This mirrors the approach in argocd's discovery PR (#24624), which solved the same shared-image problem with a different Kubernetes-derived tag (kube_app_name, since ArgoCD's chart sets app.kubernetes.io/name per role; Traefik Mesh's chart predates that labeling convention and doesn't).

Base branch note: this branch is based on the not-yet-merged vwhitchurch/velero-discovery branch, which adds the shared Kubernetes-discovery E2E helpers (datadog_checks_dev/datadog_checks/dev/kube_discovery.py) this PR depends on, the same dependency argocd's discovery PR has. The diff against master therefore also includes velero's own discovery changes; rebase onto master once that branch merges.

Two independent bug fixes, both needed for the new E2E discovery tests to pass, both unrelated to discovery itself:

1. tests/kind/traefik_mesh.yaml's vendored manifest hardcoded the proxy's --providers.http.endpoint controller lookup to the default namespace (traefik-mesh-controller.default.svc.cluster.local) instead of traefik-mesh. Confirmed against the live upstream chart template (traefik/mesh-helm-chart, which correctly uses {{ .Release.Namespace }}) that this is a rendering bug in the checked-in fixture. It silently left the proxy pod permanently un-Ready — undetected until now because the existing test_e2e_openmetrics_v2 test port-forwards directly and never checks pod readiness (the proxy's /metrics//api/version endpoints, served on a different Traefik entrypoint, worked fine regardless).
2. traefik_controller_api_endpoint/traefik_proxy_api_endpoint are optional fields whose spec.yaml example used a lowercase URL scheme (http://<...>). ddev's config-model codegen only treats an example as "documentation, not a real default" when the whole string is uppercase; the lowercase scheme broke that heuristic, so the generated Pydantic default for these unconfigured optional fields was the literal placeholder string, not None. Any real customer leaving traefik_controller_api_endpoint unset would hit requests.exceptions.InvalidURL on every check run. Existing unit tests never caught this because they mock self.http.get entirely, bypassing the URL-parsing crash. Fixed by uppercasing both examples.

Motivation

https://datadoghq.atlassian.net/browse/DSCVR-484

Part of DSCVR-518.

Container-based discovery lets the Agent auto-configure this integration from Autodiscovery without hand-written instance config.

Validated with new unit tests for the discovery strategy, and a clean ddev env test --dev --new-env traefik_mesh py3.13 run: all 3 E2E tests pass, including the pre-existing test_e2e_openmetrics_v2 (no regression) and the two new discovery tests — test_e2e_discovery_all_candidates (generated config probes the real proxy pod cleanly) and test_e2e_discovery (the real in-cluster Agent resolves kube_daemon_set:traefik-mesh-proxy via its own Kubernetes tagger and runs the check through Autodiscovery, config.provider: ad-container-discovery, 76 metrics collected).

Known gap: the controller's readiness/mesh-node-status metrics (traefik_mesh.controller.ready, traefik_mesh.node.ready) require a second container's (traefik-mesh-controller) host/port that a single-container discovery candidate can't see — only the proxy's OpenMetrics endpoint is discovered; the controller fields are left unset (same category as aerospike's legacy-mode gap).

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[dd-octo-sts]

Validation Report

Validation	Description	Status
license-headers	Validate Python files have proper license headers	❌
models	Validate configuration data models match spec.yaml	❌

Run ddev validate all changed --fix to attempt to auto-fix supported validations.

Passed validations (19)

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run

[datadog-prod-us1-5]

 

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 97.56%
• Overall Coverage: 88.35% (-0.12%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 8adfcfc | Docs | Datadog PR Page | Give us feedback!}