#10163 which resolved #9359 added support for inotify watching of directories to catch symlink rotation. I think this might have a bug. Specifically, if we have a cert in /foo/bar/cert.pem and perform a symlink rotation on bar, we don't see any SDS filesystem action.

The reason is that the watch is added on bar, rather than foo, see

. The watcher test in the original PR actually does that, see https://github.com/envoyproxy/envoy/pull/10163/files#diff-c2abed8cf8fe469d48e4c17a0cfc0a35ef532c8c578c90f1e675a82d8200a01cR168.

@tsaarni can you confirm that this is an issue? I'm surprised it worked in your Contour example, but maybe some other feature was triggering the inotify, e.g. the file deletes?

I think the solution is to watch the grandparent, rather than the parent directory.