watched_directory not working for basic_auth users file

[milan-holub]

Title: watched_directory not working for basic_auth users file

Description: Hello and thank you of this awesome piece of software! Recently I was trying to get basic auth working with simple users file in k8s environment. Basic setup with dynamic configuration is working for me fine. What I was hoping for was that envoy will auto-detect the file change using the DataSource’s watched_directory configuration directive - but I’m out of luck. I just wanted to double-check here whether this is expected behaviour (as per docs not every Datasource supports the watching directories) or there is something wrong on my site. If the watched_directory is not supported in this scenario what would you suggest as workarounds? Thank you!

Repro steps: Configure based on the snippets from the Config section and then

Current behaviour:

• users file is read by the dynamic configuration during envoy startup
• changes to secret with users file are reflected in the pod
• as mounted as k8s secret changes should be done with the move operation
• envoy does not detect the change and keeps authenticating with the old version of users file

Expected behaviour:

• envoy will auto detect the changes in users file and perform auto-reload of the configuration

Admin and Stats Output: N/A

Config:

• envoy v1.31

• basic_auth.yaml:

  resources:
  - "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig"
    name: envoy.filters.http.basic_auth
      typed_config:
        "@type": "type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth"
        users:
          filename: /opt/basic_auth/users
          watched_directory:
            path: /opt/basic_auth

• above is referenced from dynamic lds.yaml in listener’s http_connection_manager as:

  http_filters:
  - name: envoy.filters.http.basic_auth
    config_discovery:
      config_source:
        path_config_source:
          path: /etc/envoy/basic_auth.yaml
      type_urls:
        - type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth

• users file is properly mounted as k8s secret in the pod

  volumeMounts:
    - name: secret-envoy-web-users
      mountPath: /opt/basic_auth
      readOnly: true

Logs: no specific logs available when the users file gets replaced

Call Stack: N/A

[alyssawilk]

cc @zhaohuabing @wbpcode for triage

[wbpcode]

Thanks for the reporting.

As the comments of DataSource, only part of positions provide the watching support. This is not a bug. So if dynamic watching is necessary, you may need to create a feature request issue and ping the code owner of basic auth filter. :)