feat: Hot reload TLS certificate when TLS cert or key files changes

[clement0010]

Changes

• Create a custom CertReloader to watch for TLS certificate and private key changes. When the watcher is removed, it will also attempt to restart the watcher periodically (every 1 minute).

Notes

When the TLS Secret is changed, we expect fsnotify to notify multiple chmod events. As such, it's not uncommon to reload the cert file multiple times during cert rotation.

Reference: K8s Dynamic Certificates

[Copilot]

Pull Request Overview

This PR adds hot reload functionality for TLS certificates by implementing a custom CertReloader that watches for changes to TLS certificate and private key files in the /etc/tls-secret-volume directory using fsnotify.

• Implements a CertReloader struct that monitors file system events for certificate and key files
• Replaces static certificate loading with dynamic certificate retrieval through GetCertificate callback
• Adds comprehensive test coverage for certificate reloading scenarios including file changes and invalid certificate pairs

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
internal/httpproxy/cert_reloader.go	Core implementation of the certificate reloader with file watching and hot reload logic
internal/httpproxy/cert_reloader_test.go	Test suite covering certificate reloading scenarios and edge cases
internal/httpproxy/http_proxy.go	Integration of cert reloader into the HTTP proxy server configuration
test/data/proxy/tls1.crt	Additional test certificate for testing certificate rotation
test/data/proxy/tls1.key	Additional test private key for testing certificate rotation
test/data/data.go	Embedded test data variables for the new certificate and key files
go.mod	Moved fsnotify dependency from indirect to direct requirement

Comments suppressed due to low confidence (1)

go.mod:3

• Go version 1.24.6 does not exist. The latest Go version as of January 2025 was 1.23.x. This appears to be an invalid version number.

go 1.24.6

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[coveralls]

Pull Request Test Coverage Report for Build 17256260704

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

• For more information on this, see Tracking coverage changes with pull request builds.
• To avoid this issue with future PRs, see these Recommended CI Configurations.
• For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

• 81 of 91 (89.01%) changed or added relevant lines in 2 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage decreased (-0.1%) to 92.239%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/httpproxy/http_proxy.go	8	12	66.67%
internal/httpproxy/cert_reloader.go	73	79	92.41%

Totals
Change from base Build 17152291955:	-0.1%
Covered Lines:	1438
Relevant Lines:	1559

---

💛 - Coveralls

[minhtule]

LGTM 👍