Reduce ClusterPermission controller reconcile rate

controllers/clusterpermission_controller.go

@@ -287,12 +287,17 @@ func (r *ClusterPermissionReconciler) Reconcile(ctx context.Context, req ctrl.Re
 			return ctrl.Result{}, err
 		}
 	} else if err == nil {
-		log.Info("updating ManifestWork")
-		mw.Spec = manifestWork.Spec
-		err = r.Client.Update(ctx, &mw)
-		if err != nil {
-			log.Error(err, "unable to update ManifestWork")
-			return ctrl.Result{}, err
+		// Only update if the spec has actually changed
+		if !equality.Semantic.DeepEqual(mw.Spec, manifestWork.Spec) {
+			log.Info("updating ManifestWork - spec has changed")
+			mw.Spec = manifestWork.Spec
+			err = r.Client.Update(ctx, &mw)
+			if err != nil {
+				log.Error(err, "unable to update ManifestWork")
+				return ctrl.Result{}, err
+			}
+		} else {
+			log.Info("ManifestWork spec unchanged, skipping update")
 		}
 	} else {
 		log.Error(err, "unable to fetch ManifestWork")

controllers/managed_cluster_addon_informer.go

@@ -87,7 +87,7 @@ func NewManagedClusterAddOnInformer(config *rest.Config, eventHandler func(obj *
 	informer := cache.NewSharedIndexInformer(
 		listWatcher,
 		&addonv1alpha1.ManagedClusterAddOn{},
-		time.Minute*10, // resync period
+		time.Hour*10, // resync period - ManagedClusterAddOn namespaces change infrequently
 		cache.Indexers{},
 	)
 
@@ -117,10 +117,31 @@ func (i *ManagedClusterAddOnInformer) Start() error {
 			// no-op
 		},
 		UpdateFunc: func(oldObj, newObj any) {
-			if addon, ok := newObj.(*addonv1alpha1.ManagedClusterAddOn); ok {
-				i.enqueueAddon(addon)
-			} else {
+			oldAddon, oldOk := oldObj.(*addonv1alpha1.ManagedClusterAddOn)
+			newAddon, newOk := newObj.(*addonv1alpha1.ManagedClusterAddOn)
+
+			if !newOk {
 				i.logger.Error(nil, "newObj is not a ManagedClusterAddOn", "object", newObj)
+				return
+			}
+
+			if !oldOk {
+				i.logger.Error(nil, "oldObj is not a ManagedClusterAddOn", "object", oldObj)
+				return
+			}
+
+			// Only enqueue if the addon's Status.Namespace or Spec.InstallNamespace has changed
+			// These are the fields the controller cares about for generating subjects
+			if oldAddon.Status.Namespace != newAddon.Status.Namespace ||
+				oldAddon.Spec.InstallNamespace != newAddon.Spec.InstallNamespace {
+				i.logger.Info("ManagedClusterAddOn namespace changed, enqueuing for reconciliation",
+					"namespace", newAddon.Namespace,
+					"name", newAddon.Name,
+					"oldStatusNamespace", oldAddon.Status.Namespace,
+					"newStatusNamespace", newAddon.Status.Namespace,
+					"oldInstallNamespace", oldAddon.Spec.InstallNamespace,
+					"newInstallNamespace", newAddon.Spec.InstallNamespace)
+				i.enqueueAddon(newAddon)
 			}
 		},
 		DeleteFunc: func(obj any) {

main.go

@@ -137,8 +137,9 @@ func main() {
 		RetryPeriod:             &options.LeaderElectionRetryPeriod,
 		// Memory optimization: Configure cache options
 		Cache: cache.Options{
-			// Reduce default resync period to save memory
-			SyncPeriod: &[]time.Duration{10 * time.Minute}[0],
+			// Use a longer resync period for resources that change infrequently
+			// Controller-runtime default is 10 hours, which is appropriate for this use case
+			SyncPeriod: &[]time.Duration{10 * time.Hour}[0],
 			// Configure cache size limits
 			DefaultNamespaces: map[string]cache.Config{
 				// Only cache specific namespaces if needed