Performance fixes

[fxiang1]

📝 Summary

Ticket Summary (Title):
Performance fixes

Ticket Link:
n/a

Type of Change:

• 🐞 Bug Fix
• ✨ Feature
• 🔧 Refactor
• 💸 Tech Debt
• 🧪 Test-related
• 📄 Docs

---

✅ Checklist

General

• PR title follows the convention (e.g. ACM-12340 Fix bug with...)
• Code builds and runs locally without errors
• No console logs, commented-out code, or unnecessary files
• All commits are meaningful and well-labeled
• All new display strings are externalized for localization (English only)
• (Nice to have) JSDoc comments added for new functions and interfaces

If Feature

• UI/UX reviewed (if applicable)
• All acceptance criteria met
• Unit test coverage added or updated
• Relevant documentation or comments included

If Bugfix

• Root cause and fix summary are documented in the ticket (for future reference / errata)
• Fix tested thoroughly and resolves the issue
• Test(s) added to prevent regression

---

🗒️ Notes for Reviewers

Fix 0: Ignore missing watched CRDs (ie. AnsibleJob, AnsibleWorkflow)

Fix 1: Merge /events/rbac back into /events (saves 1 connection per tab)

Backend (backend/internal/informers/specs.go):

• Added ClusterRole with label rbac.open-cluster-management.io/filter=vm-clusterroles to DefaultWatchSpecs(), so ClusterRole events are included in the hub's /events stream — matching
  the original Node.js behavior.

Frontend (frontend/src/components/LoadEventsData.tsx):

• Added ClusterRoleKind/RbacApiVersion setter mapping to vmClusterRolesState, so ClusterRole events arriving on /events are processed.

Frontend (frontend/src/components/LoadData.tsx):

• Removed — eliminates the separate /events/rbac SSE connection.

The /events/rbac endpoint and LoadRbacData component are kept for backward compatibility but are no longer used in the main data flow.

Fix 2: SSAR client caching (backend/internal/aggregate/rbac.go)

Cached K8s clients per token instead of creating a new one for every SSAR call. Prevents hundreds of TCP+TLS connection spikes per request.

Fix 3: Read-only lock for aggregate requests (backend/internal/aggregate/engine.go)

Changed applications() from exclusive Lock() to shared RLock(), so concurrent aggregate requests no longer serialize behind each other and the background search loop.

Fix 4: backend/internal/events/rbac/access.go — Added cache cleanup

• Added accessCleanupEvery (90s) and accessCacheMaxSize (5000) constants
• Added StartCleanup(ctx) — background goroutine that ticks every 90s
• Added cleanup() — expires entries past TTL, then LRU-evicts if cache exceeds 5000 entries
• Matches the pattern already used in events/hub/access.go and aggregate/rbac.go

Fix 5: backend/cmd/console/main.go — Wire up the cleanup

• Extracted rbacSSAR variable and called rbacSSAR.StartCleanup(ctx) before passing to NewHandler, identical to how the other two SSAR instances (ssar and aggAccess) are already wired

Fix 6: backend/internal/aggregate/argo.go — Prune stale AppSet status

• Reset e.appStatusByName to a fresh map at the start of createArgoStatusMap(), so deleted ApplicationSets and hibernated cluster entries don't accumulate indefinitely

[fxiang1]

/assign @Ginxo

[fxiang1]

Superseded by #78