fix: revert to per-resource watcher + increase FD limit in main.go

The shared watcher approach has fundamental issues:
- Each fileREST instance starts a goroutine reading from the same Events channel
- This causes event distribution conflicts between resources
- Multiple resources adding the same directory causes issues

Solution:
1. Revert to each resource having its own watcher
2. Increase file descriptor limit to 65535 in main.go init()
3. Add better error messages when watcher creation fails

This ensures proper event isolation while providing enough FD headroom.

Author: johnlanni

src/apiserver/main.go

@@ -17,13 +17,43 @@ limitations under the License.
 package main
 
 import (
+	"fmt"
 	"os"
+	"syscall"
 
 	"github.com/alibaba/higress/api-server/pkg/cmd/server"
 	genericapiserver "k8s.io/apiserver/pkg/server"
 	"k8s.io/component-base/cli"
 )
 
+func init() {
+	// Increase file descriptor limit early to avoid "too many open files" errors
+	var rLimit syscall.Rlimit
+	if err := syscall.Getrlimit(syscall.RLIMIT_NOFILE, &rLimit); err != nil {
+		fmt.Fprintf(os.Stderr, "Warning: failed to get rlimit: %v\n", err)
+		return
+	}
+
+	fmt.Printf("Current file descriptor limit: soft=%d hard=%d\n", rLimit.Cur, rLimit.Max)
+
+	// Try to set soft limit to 65535
+	targetLimit := uint64(65535)
+	if rLimit.Cur < targetLimit {
+		rLimit.Cur = targetLimit
+		// If hard limit is less than target, try to increase it (may require root)
+		if rLimit.Max < targetLimit {
+			rLimit.Max = targetLimit
+		}
+
+		if err := syscall.Setrlimit(syscall.RLIMIT_NOFILE, &rLimit); err != nil {
+			fmt.Fprintf(os.Stderr, "Warning: failed to set rlimit to %d: %v\n", targetLimit, err)
+			return
+		}
+
+		fmt.Printf("Updated file descriptor limit: soft=%d hard=%d\n", rLimit.Cur, rLimit.Max)
+	}
+}
+
 func main() {
 	stopCh := genericapiserver.SetupSignalHandler()
 	options := server.NewHigressServerOptions(os.Stdout, os.Stderr)

src/apiserver/pkg/apiserver/apiserver.go

@@ -19,7 +19,6 @@ package apiserver
 import (
 	"fmt"
 
-	"github.com/fsnotify/fsnotify"
 	istiov1alpha3 "istio.io/client-go/pkg/apis/networking/v1alpha3"
 	admregv1 "k8s.io/api/admissionregistration/v1"
 	authzv1 "k8s.io/api/authorization/v1"
@@ -170,15 +169,6 @@ func (c completedConfig) New() (*HigressServer, error) {
 		}
 	}
 
-	// Create shared watcher for file storage mode to avoid "too many open files"
-	var sharedWatcher *fsnotify.Watcher
-	if storageMode == options.Storage_File {
-		sharedWatcher, err = fsnotify.NewWatcher()
-		if err != nil {
-			return nil, fmt.Errorf("failed to create shared file watcher: %v", err)
-		}
-	}
-
 	storageCreateFunc := func(
 		groupResource schema.GroupResource,
 		runtimeCodec runtime.Codec,
@@ -195,7 +185,7 @@ func (c completedConfig) New() (*HigressServer, error) {
 		switch storageMode {
 		case options.Storage_File:
 			runtimeCodec = codec.NewFlatAwareCodec(groupResource, runtimeCodec)
-			return registry.NewFileREST(groupResource, runtimeCodec, storageOptions.FileOptions.RootDir, extension, isNamespaced, singularName, newFunc, newListFunc, attrFunc, sharedWatcher)
+			return registry.NewFileREST(groupResource, runtimeCodec, storageOptions.FileOptions.RootDir, extension, isNamespaced, singularName, newFunc, newListFunc, attrFunc)
 		case options.Storage_Nacos:
 			var encryptionKey []byte = nil
 			if sensitive {

src/apiserver/pkg/registry/file_rest.go

@@ -54,7 +54,6 @@ func NewFileREST(
 	newFunc func() runtime.Object,
 	newListFunc func() runtime.Object,
 	attrFunc storage.AttrFunc,
-	sharedWatcher *fsnotify.Watcher,
 ) (REST, error) {
 	if attrFunc == nil {
 		if isNamespaced {
@@ -63,6 +62,10 @@ func NewFileREST(
 			attrFunc = storage.DefaultClusterScopedAttr
 		}
 	}
+	watcher, err := fsnotify.NewWatcher()
+	if err != nil {
+		return nil, fmt.Errorf("failed to create file watcher for %s: %v", groupResource.Resource, err)
+	}
 	// file REST
 	f := &fileREST{
 		TableConvertor: rest.NewDefaultTableConvertor(groupResource),
@@ -75,7 +78,7 @@ func NewFileREST(
 		newFunc:        newFunc,
 		newListFunc:    newListFunc,
 		attrFunc:       attrFunc,
-		dirWatcher:     sharedWatcher,
+		dirWatcher:     watcher,
 		fileWatchers:   make(map[string]*fileWatch, 10),
 	}
 	if err := f.startDirWatcher(); err != nil {
@@ -111,8 +114,9 @@ func (f *fileREST) GetSingularName() string {
 }
 
 func (f *fileREST) Destroy() {
-	// Don't close the watcher as it's shared across all fileREST instances
-	// The watcher will be closed when the server shuts down
+	if f.dirWatcher != nil {
+		_ = f.dirWatcher.Close()
+	}
 }
 
 func (f *fileREST) startDirWatcher() error {