Strip managedFields from cached objects

[alexh-tigera]

Description

Performance enhancement (memory) — no functional change.

Sets DefaultTransform: cache.TransformStripManagedFields() on the manager's informer cache in cmd/main.go, dropping metadata.managedFields from every object at informer ingest time.

The operator's controllers never consult managedFields: there are no readers of ManagedFields anywhere in the codebase, and the operator does no server-side apply (no FieldManager/ApplyPatchType usage), which is the only write pattern that consumes field-ownership data at runtime. The change is read-side only — an Update that carries empty managedFields leaves the server-side tracking untouched, so nothing changes in etcd or kubectl output; only the operator's in-memory copies shrink.

This is the documented intended use of the API: the controller-runtime godoc for TransformStripManagedFields notes that "setting this as DefaultTransform on the cache can lead to a significant reduction in memory usage", and Options.DefaultTransform calls it out as the typical use case.

Measured impact — envtest micro-benchmark (kube-apiserver 1.34.1, controller-runtime v0.24.1; same method as #5082): a cluster-wide informer cache over N namespaces × (2 Secrets + 1 ConfigMap + 1 Service, 2 KiB payloads, two field managers per object), heap read after 2× GC, runs identical except for DefaultTransform:

namespaces	cached objects	with managedFields	stripped	saved
1,000	4,000	22.9 MiB	20.0 MiB	2.9 MiB (13%)
5,000	20,000	87.5 MiB	73.8 MiB	13.7 MiB (16%)
10,000	40,000	169.5 MiB	139.7 MiB	29.8 MiB (18%)

Savings are a stable ~750 B HeapInuse (~505 B live heap) per cached object and scale linearly with cache size. Serialized, managedFields accounted for 19.5% of Secret bytes, 14.3% of ConfigMap, and 52.2% of Service in this workload. The numbers are conservative: benchmark objects carry two field managers, while objects touched by kubectl apply plus controllers typically carry more.

Testing:

• make ut — all 82 suites pass with the transform active.
• Envtest benchmark above (throwaway harness, kept out of the tree per the Disable client caching for Pods #5082 convention).

Affected components: the shared manager cache — i.e. every controller's cached reads (Calico and Enterprise).

Related: #5082 (informer cache memory work whose measurement method this replicates).

Release Note

Reduced operator memory usage by stripping managedFields from cached objects.

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.

[Copilot]

Pull request overview

Reduces the Tigera operator’s in-memory footprint by stripping metadata.managedFields from objects as they enter the shared controller-runtime informer cache, without changing any on-cluster resources or behavior.

Changes:

• Configure the manager’s cache with DefaultTransform: cache.TransformStripManagedFields() to drop managedFields at cache ingest time.
• Add the controller-runtime pkg/cache import to support the new cache option.