w.bundle.CABundle = caBundle
	}
	for _, ch := range w.watchers {
		select {
		case ch <- struct{}{}:
		default:
		}
	}
}

// SetFromFilesAndNotify sets the key cert and root cert from files and notify the watchers.
func (w *Watcher) SetFromFilesAndNotify(keyFile, certFile, rootCert string) error {
	cert, err := os.ReadFile(certFile)
	if err != nil {
		return err
	}
	key, err := os.ReadFile(keyFile)

	caFile := path.Join(tmpDir, "ca.pem")

	os.WriteFile(keyFile, key, os.ModePerm)
	os.WriteFile(certFile, cert, os.ModePerm)
	os.WriteFile(caFile, ca, os.ModePerm)

	// 2. set key cert bundle
	watcher.SetFromFilesAndNotify(keyFile, certFile, caFile)
	select {
	case <-watch1:
		keyCertBundle := watcher.GetKeyCertBundle()
		if !bytes.Equal(keyCertBundle.KeyPem, key) || !bytes.Equal(keyCertBundle.CertPem, cert) ||

// when /var/run/secrets/istiod/tls is used. Not to be confused with the /etc/cacerts path.
func (s *Server) initFileCertificateWatches(tlsOptions TLSOptions) error {
	if err := s.istiodCertBundleWatcher.SetFromFilesAndNotify(tlsOptions.KeyFile, tlsOptions.CertFile, tlsOptions.CaCertFile); err != nil {
		return fmt.Errorf("set keyCertBundle failed: %v", err)
	}
	// TODO: Setup watcher for root and restart server if it changes.