fix(envoy): cache last validated config to skip redundant validation

Every config change revalidates the entire merged config via the embedded
envoy subprocess, even when reconciling an unrelated ingress produces a config
identical to one already validated. Cache the SHA-256 of the last successfully
validated bootstrap and skip the subprocess on a match.

The cache is a single-slot, mutex-guarded value shared across concurrent
reconciles; the check-then-store gap can only cause a redundant (correct)
revalidation, never an incorrect skip.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: danielwatrous-zendesk

pomerium/envoy/validate_cache.go

@@ -0,0 +1,34 @@
+// Package envoy contains functions for working with an embedded envoy binary.
+package envoy
+
+import (
+	"crypto/sha256"
+	"sync"
+)
+
+// defaultValidationCache is the process-wide cache of the last successfully
+// validated config hash. It is shared across concurrent reconciles.
+var defaultValidationCache = &validationCache{}
+
+// validationCache caches the hash of the most recently successfully-validated
+// config so that repeated validation of an unchanged config can skip the
+// expensive embedded-envoy subprocess. It is safe for concurrent use.
+type validationCache struct {
+	mu       sync.RWMutex
+	lastHash [sha256.Size]byte
+	valid    bool
+}
+
+// hit reports whether hash matches the last successfully-validated config.
+func (c *validationCache) hit(hash [sha256.Size]byte) bool {
+	c.mu.RLock()
+	defer c.mu.RUnlock()
+	return c.valid && c.lastHash == hash
+}
+
+// store records hash as the last successfully-validated config.
+func (c *validationCache) store(hash [sha256.Size]byte) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.lastHash, c.valid = hash, true
+}

pomerium/envoy/validate_cache_test.go

@@ -0,0 +1,44 @@
+package envoy
+
+import (
+	"crypto/sha256"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestValidationCache(t *testing.T) {
+	c := &validationCache{}
+	h1 := sha256.Sum256([]byte("config-1"))
+	h2 := sha256.Sum256([]byte("config-2"))
+
+	// empty cache: never a hit
+	assert.False(t, c.hit(h1), "empty cache should not hit")
+
+	// after storing h1, only h1 hits
+	c.store(h1)
+	assert.True(t, c.hit(h1), "stored hash should hit")
+	assert.False(t, c.hit(h2), "different hash should miss")
+
+	// storing h2 replaces h1 (single-slot cache)
+	c.store(h2)
+	assert.True(t, c.hit(h2), "newly stored hash should hit")
+	assert.False(t, c.hit(h1), "previous hash should no longer hit")
+}
+
+func TestValidationCacheConcurrent(t *testing.T) {
+	c := &validationCache{}
+	h := sha256.Sum256([]byte("config"))
+	c.store(h)
+
+	// concurrent readers and writers must not race (run with -race).
+	var wg sync.WaitGroup
+	for i := 0; i < 50; i++ {
+		wg.Add(2)
+		go func() { defer wg.Done(); _ = c.hit(h) }()
+		go func() { defer wg.Done(); c.store(h) }()
+	}
+	wg.Wait()
+	assert.True(t, c.hit(h))
+}

pomerium/envoy/validate_envoy.go

@@ -6,7 +6,7 @@ package envoy
 
 import (
 	"context"
-
+	"crypto/sha256"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -33,6 +33,14 @@ func Validate(ctx context.Context, bootstrap *envoy_config_bootstrap_v3.Bootstra
 		return nil, err
 	}
 
+	// Skip the (expensive) envoy subprocess if this exact config was already
+	// validated successfully. saveConfig revalidates the whole config on every
+	// change, so identical configs are validated repeatedly without this cache.
+	hash := sha256.Sum256(bs)
+	if defaultValidationCache.hit(hash) {
+		return &ValidateResult{Valid: true, Message: "OK (cached)"}, nil
+	}
+
 	cfgName := filepath.Join(os.TempDir(), id+".pb")
 	err = os.WriteFile(cfgName, bs, ownerRW)
 	if err != nil {
@@ -62,6 +70,7 @@ func Validate(ctx context.Context, bootstrap *envoy_config_bootstrap_v3.Bootstra
 		// all other errors are returned as errors
 		return nil, err
 	}
+	defaultValidationCache.store(hash)
 	return &ValidateResult{
 		Valid:   true,
 		Message: "OK",