feat(k8score): idle reaper for namespace-scoped dynamic informers

Per-namespace dynamic informers (the B2.1 model) can accumulate over the
life of a long-running, namespace-restricted deployment as different
namespaces get watched. Add an idle reaper that stops a namespace-scoped
informer after InformerIdleTTL (default 30m) without a read, re-creating it
transparently on the next access.

Liveness is the read path itself: List/Get/Count/EnsureWatching stamp the
entry's lastAccess. The frontend re-lists open views every 60-120s (React
Query refetchInterval), and SSE topology rebuilds also list — both flow
through that stamp — so an open view's informer is never reaped out from
under it, and an explicit SSE lease/refcount is unnecessary. Cluster-wide
informers (one per GVR, serve every namespace) are exempt; a negative TTL
disables reaping.

To make eviction safe, informers are now constructed directly via
NewFilteredDynamicInformer instead of through a shared factory: a factory
caches one informer per GVR and would hand back the stopped instance after a
reap (a SharedInformer cannot be re-Run). Standalone informers, each under
its own cancelable context, can be stopped and re-created freely. This also
removes the per-namespace factory map and simplifies Stop().

Builds on #770.

Author: nadaverell

pkg/k8score/cache_test.go

@@ -1347,6 +1347,108 @@ func TestDynamicResourceCache_StatusAPIsSpanNamespaceInformers(t *testing.T) {
 	}
 }
 
+func (d *DynamicResourceCache) hasInformer(gvr schema.GroupVersionResource, ns string) bool {
+	d.mu.RLock()
+	defer d.mu.RUnlock()
+	_, ok := d.informers[informerKey{gvr: gvr, ns: ns}]
+	return ok
+}
+
+// The idle reaper stops namespace-scoped informers untouched beyond the TTL,
+// leaves freshly-read ones alone, and never touches cluster-wide informers.
+// Reaped informers are re-created transparently on the next access.
+func TestDynamicResourceCache_ReapsIdleNamespacedInformers(t *testing.T) {
+	const nsIdle, nsFresh = "idle-ns", "fresh-ns"
+	gvr := schema.GroupVersionResource{Group: "example.com", Version: "v1", Resource: "widgets"}
+	dyn := fakeDynamicForListAccess(t, map[schema.GroupVersionResource]string{
+		gvr: "WidgetList",
+	}, func(_ schema.GroupVersionResource, ns string) bool { return ns != "" }) // namespaced only
+
+	d, err := NewDynamicResourceCache(DynamicCacheConfig{DynamicClient: dyn, InformerIdleTTL: time.Hour})
+	if err != nil {
+		t.Fatalf("NewDynamicResourceCache failed: %v", err)
+	}
+	defer d.Stop()
+
+	for _, ns := range []string{nsIdle, nsFresh} {
+		if _, err := d.ListBlocking(gvr, ns, 2*time.Second); err != nil {
+			t.Fatalf("ListBlocking(%q) failed: %v", ns, err)
+		}
+	}
+
+	// Backdate the idle informer's last access; leave the fresh one current.
+	d.mu.RLock()
+	d.informers[informerKey{gvr: gvr, ns: nsIdle}].lastAccess.Store(time.Now().Add(-2 * time.Hour).UnixNano())
+	d.mu.RUnlock()
+
+	if reaped := d.reapIdleInformers(time.Now()); reaped != 1 {
+		t.Fatalf("reaped %d informers, want 1", reaped)
+	}
+	if d.hasInformer(gvr, nsIdle) {
+		t.Errorf("idle informer for %q was not reaped", nsIdle)
+	}
+	if !d.hasInformer(gvr, nsFresh) {
+		t.Errorf("fresh informer for %q was wrongly reaped", nsFresh)
+	}
+
+	// Next access re-creates the reaped informer.
+	if _, err := d.ListBlocking(gvr, nsIdle, 2*time.Second); err != nil {
+		t.Fatalf("re-list after reap failed: %v", err)
+	}
+	if !d.hasInformer(gvr, nsIdle) {
+		t.Errorf("informer for %q was not re-created on access", nsIdle)
+	}
+}
+
+// Cluster-wide informers are exempt from reaping even when idle, and a
+// negative TTL disables reaping entirely.
+func TestDynamicResourceCache_ReapExemptionsAndDisable(t *testing.T) {
+	gvr := schema.GroupVersionResource{Group: "example.com", Version: "v1", Resource: "gadgets"}
+
+	t.Run("cluster-wide exempt", func(t *testing.T) {
+		dyn := fakeDynamicForListAccess(t, map[schema.GroupVersionResource]string{
+			gvr: "GadgetList",
+		}, func(_ schema.GroupVersionResource, ns string) bool { return ns == "" }) // cluster-wide allowed
+		d, err := NewDynamicResourceCache(DynamicCacheConfig{DynamicClient: dyn, InformerIdleTTL: time.Hour})
+		if err != nil {
+			t.Fatalf("NewDynamicResourceCache failed: %v", err)
+		}
+		defer d.Stop()
+		if _, err := d.ListBlocking(gvr, "", 2*time.Second); err != nil {
+			t.Fatalf("ListBlocking failed: %v", err)
+		}
+		d.mu.RLock()
+		d.informers[informerKey{gvr: gvr}].lastAccess.Store(int64(0)) // ancient
+		d.mu.RUnlock()
+		if reaped := d.reapIdleInformers(time.Now()); reaped != 0 {
+			t.Errorf("reaped %d cluster-wide informers, want 0 (exempt)", reaped)
+		}
+		if !d.hasInformer(gvr, "") {
+			t.Error("cluster-wide informer was reaped")
+		}
+	})
+
+	t.Run("negative TTL disables reaping", func(t *testing.T) {
+		dyn := fakeDynamicForListAccess(t, map[schema.GroupVersionResource]string{
+			gvr: "GadgetList",
+		}, func(_ schema.GroupVersionResource, ns string) bool { return ns != "" }) // namespaced only
+		d, err := NewDynamicResourceCache(DynamicCacheConfig{DynamicClient: dyn, InformerIdleTTL: -1})
+		if err != nil {
+			t.Fatalf("NewDynamicResourceCache failed: %v", err)
+		}
+		defer d.Stop()
+		if _, err := d.ListBlocking(gvr, "team-x", 2*time.Second); err != nil {
+			t.Fatalf("ListBlocking failed: %v", err)
+		}
+		d.mu.RLock()
+		d.informers[informerKey{gvr: gvr, ns: "team-x"}].lastAccess.Store(int64(0))
+		d.mu.RUnlock()
+		if reaped := d.reapIdleInformers(time.Now()); reaped != 0 {
+			t.Errorf("reaped %d with reaping disabled, want 0", reaped)
+		}
+	})
+}
+
 // EnsureWatching must surface a probe that's forbidden everywhere it looks
 // (cluster-wide AND the fallback namespace) as an apierrors.IsForbidden-
 // classifiable error through the %w wrap — that's what lets the resources