watchTailscaledConfigChanges only handled fsnotify events whose name
matched <mount-dir>/..data, dropping all other events from the kubelet
atomic-writer rotation. Across kernels/fsnotify versions the ..data
symlink swap can arrive as CREATE/REMOVE on ..<timestamp> or the leaf
symlinks, or be coalesced entirely, so the filter silently discarded
the rotation and lc.ReloadConfig was never called. Running tailscaled
kept stale prefs (notably AdvertiseServices) until the pod restarted,
which is the only path AdvertiseServices reaches a ProxyGroup pod
since TS_EXPERIMENTAL_SERVICE_AUTO_ADVERTISEMENT=false disables the
runtime push.
Mirror the serve-config watcher (serve.go) and re-read the file on any
event, letting the existing byte comparison decide whether to reload.
Fixes#19782
Signed-off-by: Raj Singh <raj@tailscale.com>
adcd23dbc3