perf: filter workflows on K8s API during infractl list API calls

go.mod

@@ -86,6 +86,7 @@ require (
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgio v1.0.0 // indirect

go.sum

@@ -194,6 +194,8 @@ github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDe
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
 github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=

pkg/service/cluster/artifact_cache.go

@@ -0,0 +1,58 @@
+package cluster
+
+import (
+	"fmt"
+
+	lru "github.com/hashicorp/golang-lru/v2"
+	"github.com/stackrox/infra/pkg/service/metrics"
+)
+
+const (
+	// Default cache size: estimate 10KB per artifact × 100 clusters × 2 artifacts = ~2MB
+	// Setting to 1000 entries to allow for growth
+	defaultCacheSize = 1000
+)
+
+// artifactCache provides thread-safe LRU caching of immutable GCS artifact contents.
+// Since workflow artifacts don't change once written, no TTL is needed.
+type artifactCache struct {
+	cache *lru.Cache[string, []byte]
+}
+
+// newArtifactCache creates a new artifact cache with the specified size.
+func newArtifactCache(size int) (*artifactCache, error) {
+	cache, err := lru.New[string, []byte](size)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create LRU cache: %w", err)
+	}
+
+	return &artifactCache{
+		cache: cache,
+	}, nil
+}
+
+// Get retrieves cached artifact content if present.
+// Returns the content and true if found, nil and false otherwise.
+func (c *artifactCache) Get(bucket, key string) ([]byte, bool) {
+	cacheKey := makeCacheKey(bucket, key)
+	content, found := c.cache.Get(cacheKey)
+	if !found {
+		metrics.ArtifactCacheMissesCounter.Inc()
+		return nil, false
+	}
+
+	metrics.ArtifactCacheHitsCounter.Inc()
+	return content, true
+}
+
+// Set stores artifact content in the cache.
+func (c *artifactCache) Set(bucket, key string, content []byte) {
+	cacheKey := makeCacheKey(bucket, key)
+	c.cache.Add(cacheKey, content)
+	metrics.ArtifactCacheSizeGauge.Set(float64(c.cache.Len()))
+}
+
+// makeCacheKey creates a unique cache key from bucket and object key.
+func makeCacheKey(bucket, key string) string {
+	return fmt.Sprintf("%s/%s", bucket, key)
+}

pkg/service/cluster/artifact_cache_test.go

@@ -0,0 +1,94 @@
+package cluster
+
+import (
+	"testing"
+)
+
+func TestArtifactCache_GetSet(t *testing.T) {
+	cache, err := newArtifactCache(10)
+	if err != nil {
+		t.Fatalf("failed to create cache: %v", err)
+	}
+
+	bucket := "test-bucket"
+	key := "test-key"
+	content := []byte("test content")
+
+	// Cache miss on first get
+	_, found := cache.Get(bucket, key)
+	if found {
+		t.Error("expected cache miss, got hit")
+	}
+
+	// Set content
+	cache.Set(bucket, key, content)
+
+	// Cache hit on second get
+	retrieved, found := cache.Get(bucket, key)
+	if !found {
+		t.Error("expected cache hit, got miss")
+	}
+	if string(retrieved) != string(content) {
+		t.Errorf("expected content %q, got %q", content, retrieved)
+	}
+}
+
+func TestArtifactCache_MultipleEntries(t *testing.T) {
+	cache, err := newArtifactCache(10)
+	if err != nil {
+		t.Fatalf("failed to create cache: %v", err)
+	}
+
+	// Add multiple entries
+	entries := map[string][]byte{
+		"bucket1/key1": []byte("content1"),
+		"bucket1/key2": []byte("content2"),
+		"bucket2/key1": []byte("content3"),
+	}
+
+	for key, content := range entries {
+		cache.Set("bucket", key, content)
+	}
+
+	// Verify all entries are cached
+	for key, expectedContent := range entries {
+		retrieved, found := cache.Get("bucket", key)
+		if !found {
+			t.Errorf("expected cache hit for key %q", key)
+		}
+		if string(retrieved) != string(expectedContent) {
+			t.Errorf("for key %q, expected %q, got %q", key, expectedContent, retrieved)
+		}
+	}
+}
+
+func TestArtifactCache_LRUEviction(t *testing.T) {
+	cache, err := newArtifactCache(2) // Small cache for testing eviction
+	if err != nil {
+		t.Fatalf("failed to create cache: %v", err)
+	}
+
+	// Fill cache to capacity
+	cache.Set("bucket", "key1", []byte("content1"))
+	cache.Set("bucket", "key2", []byte("content2"))
+
+	// Add one more entry, should evict oldest
+	cache.Set("bucket", "key3", []byte("content3"))
+
+	// key1 should have been evicted
+	_, found := cache.Get("bucket", "key1")
+	if found {
+		t.Error("expected key1 to be evicted")
+	}
+
+	// key2 and key3 should still be present
+	_, found = cache.Get("bucket", "key2")
+	if !found {
+		t.Error("expected key2 to be present")
+	}
+
+	_, found = cache.Get("bucket", "key3")
+	if !found {
+		t.Error("expected key3 to be present")
+	}
+}