fix(webhook): eliminate per-admission json.MarshalIndent and index verifyHpas

Three changes to reduce webhook memory pressure during SO creation bursts:

1. Replace unconditional json.MarshalIndent calls in ValidateCreate,
   ValidateUpdate, isRemovingFinalizer, and the verifyHpas loop with
   structured logr key-value logging. The marshals ran on every admission
   even when V(1) logging was disabled, generating 60-100 KB of transient
   garbage per request — at burst=60 this outpaced MADV_FREE and caused
   repeated OOMKills despite the 20 GiB limit.

2. Replace isRemovingFinalizer's JSON string comparison with
   reflect.DeepEqual, eliminating two spec marshals per update admission.

3. Add hpaScaleTargetNameIdx field index for HPA objects and switch
   verifyHpas to an indexed List, reducing it from O(N_hpas) to O(1)
   — same fix pattern as the A1d verifyScaledObjects change (#7681).

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: ggarb

apis/keda/v1alpha1/scaledobject_webhook.go

@@ -18,9 +18,9 @@ package v1alpha1
 
 import (
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
+	"reflect"
 	"strconv"
 	"strings"
 
@@ -60,6 +60,11 @@ var cpuString = "cpu"
 const (
 	scaleTargetRefNameIdx = "spec.scaleTargetRef.name"
 	hpaNameIdx            = "spec.hpaName"
+	// hpaScaleTargetNameIdx indexes HPA objects by spec.scaleTargetRef.name so
+	// verifyHpas can issue an O(1) lookup instead of listing every HPA in the
+	// namespace. Index names are scoped per-GVK so reusing the same path string
+	// as scaleTargetRefNameIdx is safe.
+	hpaScaleTargetNameIdx = "spec.scaleTargetRef.name"
 )
 
 func (so *ScaledObject) SetupWebhookWithManager(mgr ctrl.Manager, cacheMissFallback bool) error {
@@ -79,6 +84,12 @@ func (so *ScaledObject) SetupWebhookWithManager(mgr ctrl.Manager, cacheMissFallb
 		}); err != nil {
 		return fmt.Errorf("failed to register index %q: %w", hpaNameIdx, err)
 	}
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &autoscalingv2.HorizontalPodAutoscaler{}, hpaScaleTargetNameIdx,
+		func(obj client.Object) []string {
+			return []string{obj.(*autoscalingv2.HorizontalPodAutoscaler).Spec.ScaleTargetRef.Name}
+		}); err != nil {
+		return fmt.Errorf("failed to register HPA index %q: %w", hpaScaleTargetNameIdx, err)
+	}
 
 	err := setupKubernetesClients(mgr, cacheMissFallback)
 	if err != nil {
@@ -150,14 +161,12 @@ var _ webhook.CustomValidator = &ScaledObjectCustomValidator{}
 
 // ValidateCreate implements webhook.Validator so a webhook will be registered for the type
 func (so *ScaledObject) ValidateCreate(dryRun *bool) (admission.Warnings, error) {
-	val, _ := json.MarshalIndent(so, "", "  ")
-	scaledobjectlog.V(1).Info(fmt.Sprintf("validating scaledobject creation for %s", string(val)))
+	scaledobjectlog.V(1).Info("validating scaledobject creation", "name", so.Name)
 	return validateWorkload(so, "create", *dryRun)
 }
 
 func (so *ScaledObject) ValidateUpdate(old runtime.Object, dryRun *bool) (admission.Warnings, error) {
-	val, _ := json.MarshalIndent(so, "", "  ")
-	scaledobjectlog.V(1).Info(fmt.Sprintf("validating scaledobject update for %s", string(val)))
+	scaledobjectlog.V(1).Info("validating scaledobject update", "name", so.Name)
 
 	if isRemovingFinalizer(so, old) {
 		scaledobjectlog.V(1).Info("finalizer removal, skipping validation")
@@ -173,13 +182,7 @@ func (so *ScaledObject) ValidateDelete(_ *bool) (admission.Warnings, error) {
 
 func isRemovingFinalizer(so *ScaledObject, old runtime.Object) bool {
 	oldSo := old.(*ScaledObject)
-
-	soSpec, _ := json.MarshalIndent(so.Spec, "", "  ")
-	oldSoSpec, _ := json.MarshalIndent(oldSo.Spec, "", "  ")
-	soSpecString := string(soSpec)
-	oldSoSpecString := string(oldSoSpec)
-
-	return len(so.Finalizers) < len(oldSo.Finalizers) && soSpecString == oldSoSpecString
+	return len(so.Finalizers) < len(oldSo.Finalizers) && reflect.DeepEqual(so.Spec, oldSo.Spec)
 }
 
 func validateWorkload(so *ScaledObject, action string, dryRun bool) (admission.Warnings, error) {
@@ -194,7 +197,7 @@ func validateWorkload(so *ScaledObject, action string, dryRun bool) (admission.W
 	}
 
 	for functionName, function := range verifyFunctions {
-		scaledobjectlog.V(1).Info(fmt.Sprintf("calling %s to validate %s", functionName, so.Name))
+		scaledobjectlog.V(1).Info("calling validator", "function", functionName, "name", so.Name)
 		err := function(so, action, dryRun)
 		if err != nil {
 			return nil, err
@@ -262,10 +265,12 @@ func verifyTriggers(incomingObject interface{}, action string, _ bool) error {
 
 func verifyHpas(incomingSo *ScaledObject, action string, _ bool) error {
 	hpaList := &autoscalingv2.HorizontalPodAutoscalerList{}
-	opt := &client.ListOptions{
-		Namespace: incomingSo.Namespace,
-	}
-	err := kc.List(context.Background(), hpaList, opt)
+	// Use the hpaScaleTargetNameIdx field index to narrow candidates to HPAs
+	// that target the same workload name, avoiding an O(N) full-namespace scan.
+	err := kc.List(context.Background(), hpaList,
+		client.InNamespace(incomingSo.Namespace),
+		client.MatchingFields{hpaScaleTargetNameIdx: incomingSo.Spec.ScaleTargetRef.Name},
+	)
 	if err != nil {
 		return err
 	}
@@ -281,8 +286,7 @@ func verifyHpas(incomingSo *ScaledObject, action string, _ bool) error {
 		if hpa.Annotations[ValidationsHpaOwnershipAnnotation] == "false" {
 			continue
 		}
-		val, _ := json.MarshalIndent(hpa, "", "  ")
-		scaledobjectlog.V(1).Info(fmt.Sprintf("checking hpa %s: %v", hpa.Name, string(val)))
+		scaledobjectlog.V(1).Info("checking hpa", "name", hpa.Name)
 
 		hpaGvkr, err := ParseGVKR(restMapper, hpa.Spec.ScaleTargetRef.APIVersion, hpa.Spec.ScaleTargetRef.Kind)
 		if err != nil {