Problem description:

The official docker container is used by e.g. Contour ingress controller.

While Contour is able to replace certificates for user plane by using SDS, it is not currently possible to rotate control plane certificates (xDS gRPC interface) without traffic interruption.

Proposal for a new feature:

Include a new binary in official Envoy container images at https://hub.docker.com/r/envoyproxy/. This new binary can be used by deployments to

1. acting as pid 1 in the container and forking & execing envoy
2. triggering Envoy's hot restart procedure when certificate or key files are updated

inotify can be used to watch the file updates, which works with e.g. Kubernetes secret volume mounts.

Implementation alternatives:

With your guidance, I'd be interested in implementing the above feature and submitting PR.

The default entrypoint can still remain like it is currently. The new binary could be "opt-in" for deployments that require xDS with TLS and hot-reload.

One implementation alternative would be to extend hot-restarter.py with inotify, but alternatively new version could be implemented with C++ in order to avoid bringing Python as dependency into all Envoy images.