feat: cache project-id got from project-slug

[mathnogueira]

We call an endpoint to resolve the project id from the projectSlug, this is not cached, so it contributes to the 429 response errors if user prefer slugs over ids.

This PR caches those calls using:

• InfisicalAuth name (namespace + resource name)
• project slug

As InfisicalAuth is bound to an org, we ensure the cached entry cannot be referencing another project with same slug from another organization.

[infisical-review-police]

💬 Discussion in Slack: #pr-review-kubernetes-operator-102-feat-cache-project-id

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[greptile-apps]

Greptile Summary

This PR introduces an in-memory cache (backed by ristretto) for project-ID lookups by slug, reducing redundant API calls to Infisical on every reconciliation cycle. The cache is keyed on the auth-ref namespace, auth-ref name, and project slug, and is wired through the controller → handler → reconciler chain with a 5-minute TTL.

• A new ResourceCache type wraps ristretto with Get/Set/Cleanup helpers and a ProjectBySlugCacheKey constructor; the cache is initialised once at operator startup and shared across all InfisicalStaticSecret reconciliations.
• getProjectIDBySlug implements a read-through pattern: cache hit returns immediately, miss falls through to api.FindProjectBySlug and populates the cache before returning.

Confidence Score: 5/5

Safe to merge; the change is additive and falls back gracefully (nil cache, uncached paths) with no correctness impact.

The read-through cache is nil-safe on both read and write paths, the reconciler falls back to a live API call whenever the cache is absent or misses, and the new ristretto wrapper is covered by a solid test suite including concurrent-access and TTL-expiry cases.

internal/cache/resource_cache.go — minor configuration and return-value handling points worth a second look.

Important Files Changed

Filename	Overview
internal/cache/resource_cache.go	New ristretto-backed cache for project-ID lookups; SetWithTTL return value is silently ignored, and NumCounters:1000 is low relative to MaxCost:1<<20.
internal/cache/resource_cache_test.go	Comprehensive test suite covering basic ops, TTL expiry, concurrent access, cleanup, and cache key determinism.
internal/services/infisicalstaticsecret/reconciler.go	Introduces getProjectIDBySlug with cache read-through pattern using InfisicalAuthRef (namespace+name) as the discriminator; nil-safe on both read and write paths.
internal/services/infisicalstaticsecret/handler.go	Adds resourceCache parameter to constructor and threads it into the inner reconciler; no field stored on the handler itself, which is clean.
internal/controller/v1beta1/infisicalstaticsecret_controller.go	Adds ResourceCache field to the reconciler struct and passes it to the handler constructor; straightforward wiring.
cmd/main.go	Initialises a 5-minute TTL ResourceCache at startup with proper defer Cleanup() and error handling.
internal/services/infisicalstaticsecret/reconciler_test.go	Import ordering tidied (no logic changes).

_{Reviews (2): Last reviewed commit: "30 min cache ttl" | Re-trigger Greptile}

[mathnogueira]

@greptile review again

[adilsitos]

just two question. But looks good!

[adilsitos]

question: is there a reason for us to define those as static? Couldn't we let the user define those and have a default in case they don't provide anything?

[mathnogueira]

not really, just for simplicity. Just like we do in https://github.com/Infisical/kubernetes-operator/blob/main/internal/cache/auth_cache.go#L33

[adilsitos]

LGTM! (generics were an error on the go design, it lost its essence)