Summary

KubernetesStore.List() → SimpleConverter.ToCoreList() → jsonpb unmarshal runs on every DataplaneWatchdog reconcile. Converted core resources are not cached between reconciles, so every tick re-parses JSON for resources that have not changed.

Evidence

• CPU profile wave2: 0.92s flat in unmarshalMessage; part of a 34.42s resource-set-build chain in wave3
• Heap wave1→wave3: KubernetesMetaAdapter.GetLabels + maps.Clone = ~68 MB of pure label-map copies for destination name resolution

Code

• pkg/plugins/resources/k8s/store.go — List path + conversion
• pkg/plugins/resources/k8s/native/pkg/registry — converter registration

Proposed fix

Cache converted core resources keyed by resourceVersion; invalidate on informer events. Drop the defensive maps.Clone in GetLabels if callers respect immutability.

Parent: #16183