In #10163, support is added to load both private key and certificate on an inotify event. However, this is not fully atomic w.r.t. symlink changes. Imagine you have foo/ pointing at bar/ containing key.pem and cert.pem. Then you relink foo/ to point at baz/ with key.pem and cert.pem during a rotation. In our current solution, there is a race, where key.pem might be read from bar/ and cert.pem from baz/ during the relink.

We need to fully resolve a symlink with readlink before reading the key/cert pair.

I think this might actually also affect runtime snapshots; is this true @mattklein123?

CC @tsaarni @lizan