volumeMounted configmap does not trigger bundle watch events

[drewwells]

Expected Behavior

A volume mounted configmap would trigger a filewatch event in opa.

Actual Behavior

The configmap symlink points to an updated file, but no event is registered in OPA.

Steps to Reproduce the Problem

Create a pod with opa in it. Create a configmap with a bundle tarball
Start opa with opa run -s -b -w /volumePath/bundle.tar.gz
Update the configmap somehow
Check the opa logs for file watch events

We use 0.18.0, but 0.22.0 showed the same issues

Additional Info

I've seen other projects that claim support for mounted configmap file watch events. linkerd/linkerd2#1061 It should be possible to watch the symlink and see file events for symlink changes.

[ashutosh-narkar]

@drewwells Are you updating the a file(s) in bundle.tar.gz under the volumePath dir, then updating the tarball and not seeing any events in the OPA log ? Is that the scenario or are you doing something else ?

[drewwells]

@drewwells Are you updating the a file(s) in bundle.tar.gz under the volumePath dir, then updating the tarball and not seeing any events in the OPA log ? Is that the scenario or are you doing something else ?

@ashutosh-narkar That's right. Kubelet uses symlinks to point to the most recent version of a volume mount. As a result, it does not necessarily trigger the file events that fsnotify expects. I have updated the file watcher to instead watch the directories. We use this internally and it has been working well.

My PR fixing this is here #2589 I'm not able to re-open the PR, but the tests are now working.