Merge branch 'optimize/round2-20260619'

Round 2 performance optimizations:

- perf: replace fmt.Sprintf with direct string concat in hot paths
- perf: pre-allocate map capacity in translator hot paths

Author: mahmut-Abi

internal/mesh/frontends.go

@@ -198,7 +198,7 @@ func serviceKey(namespace string, name string) string {
 }
 
 func servicePortKey(namespace string, name string, port int32) string {
-	return fmt.Sprintf("%s/%s/%d", namespace, name, port)
+	return namespace + "/" + name + "/" + strconv.Itoa(int(port))
 }
 
 func namespaceOrDefault(namespace *gatewayv1.Namespace, defaultNamespace string) string {

internal/status/reconciler_listener_sets.go

@@ -2,7 +2,6 @@ package status
 
 import (
 	"context"
-	"fmt"
 
 	apiequality "k8s.io/apimachinery/pkg/api/equality"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -15,7 +14,7 @@ import (
 func (r *Reconciler) reconcileListenerSetStatuses(ctx context.Context, lses []gatewayv1.ListenerSet, evals map[string]listenerSetEvaluation) error {
 	for i := range lses {
 		key := client.ObjectKeyFromObject(&lses[i])
-		eval, ok := evals[fmt.Sprintf("%s/%s", lses[i].Namespace, lses[i].Name)]
+		eval, ok := evals[lses[i].Namespace+"/"+lses[i].Name]
 		if !ok {
 			continue
 		}

internal/translator/backend_tls.go

@@ -2,7 +2,6 @@ package translator
 
 import (
 	"crypto/tls"
-	"fmt"
 
 	corev1 "k8s.io/api/core/v1"
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
@@ -69,7 +68,7 @@ func backendTLSForGatewayWithIndexes(
 	}
 
 	return &ir.BackendTLSConfig{
-		ClientCertificateRef: fmt.Sprintf("%s/%s", targetNamespace, ref.Name),
+		ClientCertificateRef: targetNamespace + "/" + string(ref.Name),
 	}
 }
 

internal/translator/backend_tls_policy.go

@@ -2,8 +2,8 @@ package translator
 
 import (
 	"crypto/x509"
-	"fmt"
 	"sort"
+	"strconv"
 
 	corev1 "k8s.io/api/core/v1"
 	gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
@@ -383,7 +383,7 @@ func serviceImportBackendKeys(
 }
 
 func backendClusterKey(namespace, name string, port int32) string {
-	return fmt.Sprintf("%s/%s:%d", namespace, name, port)
+	return namespace + "/" + name + ":" + strconv.Itoa(int(port))
 }
 
 func compactStrings(items []string) []string {

internal/translator/mesh.go

@@ -72,8 +72,8 @@ func translateMeshServiceListeners(frontends []mesh.ServiceFrontendPort) []ir.Li
 }
 
 func effectiveBackendServices(services []corev1.Service) []backendService {
-	shadowByName := make(map[string]corev1.Service)
-	shadowByOriginal := make(map[string]corev1.Service)
+	shadowByName := make(map[string]corev1.Service, len(services))
+	shadowByOriginal := make(map[string]corev1.Service, len(services))
 	for _, service := range services {
 		if service.Labels[mesh.ShadowServiceRoleLabel] != mesh.ShadowServiceRoleValue {
 			continue

internal/translator/partial_backends.go

@@ -225,7 +225,7 @@ func expandMeshShadowBackendKeys(
 
 	expandedServiceKeys := cloneObjectKeyMap(serviceKeys)
 	expandedReplacementKeys := cloneObjectKeyMap(replacementKeys)
-	loadedKeys := make(map[string]struct{})
+	loadedKeys := make(map[string]struct{}, len(serviceKeys))
 	pendingKeys := cloneObjectKeyMap(serviceKeys)
 
 	for len(pendingKeys) != 0 {

internal/translator/translator_listeners.go

@@ -2,7 +2,6 @@ package translator
 
 import (
 	"crypto/tls"
-	"fmt"
 	"net"
 	"sort"
 	"strings"
@@ -141,7 +140,7 @@ func listenerCertificateSecretRefsWithIndexes(
 			continue
 		}
 
-		key := fmt.Sprintf("%s/%s", targetNamespace, ref.Name)
+		key := targetNamespace + "/" + string(ref.Name)
 		if _, exists := seen[key]; exists {
 			continue
 		}