Improve SDS file watching docs #10979
Description
The comments in sds_api.cc imply that we're watching the directory to allow for atomic updates of the cert/key (https://github.com/envoyproxy/envoy/blob/master/source/common/secret/sds_api.cc#L66-L67), but from testing this by referencing certs in /secrets/current/cert.crt and repointing the current symlink to another directory, no file watches are triggered.
I'm not sure if this is a bug, inconsistent docs or perhaps I'm just misunderstanding the feature. Applying the following diff made this behave the way I expected it to:
diff --git a/source/common/secret/sds_api.cc b/source/common/secret/sds_api.cc
index deab859ad..476d1c25b 100644
--- a/source/common/secret/sds_api.cc
+++ b/source/common/secret/sds_api.cc
@@ -66,7 +66,7 @@ void SdsApi::onConfigUpdate(const Protobuf::RepeatedPtrField<ProtobufWkt::Any>&
// Watch for directory instead of file. This allows users to do atomic renames
// on directory level (e.g. Kubernetes secret update).
const auto result = api_.fileSystem().splitPathFromFilename(filename);
- watcher_->addWatch(absl::StrCat(result.directory_, "/"),
+ watcher_->addWatch(result.directory_,
Filesystem::Watcher::Events::MovedTo, [this](uint32_t) {
uint64_t new_hash = getHashForFiles();
if (new_hash != files_hash_) {