Description

Optimizes Central's short-circuit reprocessor path to reduce unnecessary UpdatedImage message overhead and prevent full Admission Controller cache purges.

Previously, Central sent UpdatedImage for every image during short circuit reprocessing regardless of whether the scan data actually changed. This caused unnecessary proto serialization/deserialization overhead and, combined with the subsequent FlushCache, purged the entire admission controller cache even when most images were unchanged.

What changed (short-circuit path only):

Central's reprocessor now distinguishes between changed and unchanged images during the short-circuit reprocessing cycle:

• Changed images (imageUpdated=true): Central sends UpdatedImage as before. Sensor's detector accumulates the image key.
• Unchanged images (imageUpdated=false): Central skips UpdatedImage entirely and batches the image key for a single RefreshImageCacheTTL message per cluster, keeping Sensor's cache warm without the deserialization cost of full image data.

At the end of the cycle, Central sends ReprocessDeployments with skip_cache_flush=true. Sensor's detector then sends a single batched InvalidateImageCache to the Admission Controller for only the changed images, instead of flushing the entire admission controller cache. This keeps the Admission controller cache warm for unchanged images, avoiding unnecessary re-fetches on subsequent review requests.

Central -> Sensor gRPC message and cache operation comparison (short-circuit path, per cluster)

N = total images reprocessed, K = images with changed scan data, D = deployments with cached images in admission controller

Example: 500 images, 3 changed, 200 of those images in a review request burst to admission controller → Before: 501 messages, 500 deployment re-detections, full admission controller cache purge, 200 re-fetches. After: 5 messages, 3 deployment re-detections, 3 admission controller entries invalidated, 3 re-fetches.

Sensor detection during reassess (no image changes)

• Master: each deployment is re-evaluated N+1 times — once per ResolveDeploymentsByImages for each of its images (triggered by N UpdatedImage messages), plus once from ResolveAllDeployments (triggered by ReprocessDeployments). All but the final pass are redundant.
• This PR: each deployment is re-evaluated exactly once — from ResolveAllDeployments only. No UpdatedImage messages are sent for unchanged images, eliminating N redundant per-image re-detection passes. Policy evaluation outcomes are identical.

Key wins:

• Message reduction: N + 1 → K + 2 (typically K ≪ N, saving nearly N messages per cycle)
• Serialization savings: only K full image protos serialized/deserialized instead of N
• Sensor cache churn eliminated: N − K unnecessary cache replacements become lightweight TTL touches
• Deployment re-detection reduced: N → K; avoids N − K redundant ResolveDeploymentsByImages calls.
• Admission controller cache kept warm: N − K entries preserved instead of full purge
• Admission controller re-fetch load reduced: D → K; avoids a burst of image re-fetches from Sensor/Central for unchanged images after every reprocessing cycle

Periodic reprocessor path is unchanged in behavior: The periodic path (default 4h interval) continues to send UpdatedImage for every image and ReprocessDeployments with skip_cache_flush=false (the proto default). Sensor receives skip_cache_flush=false and performs a full FlushCache() on the admission controller cache. The admissionCacheNeedsFlush guard was removed since Central never sends ReprocessDeployments without preceding images (early return on zero results), making the flag always true when reached.

Version compatibility:

No breaking changes in any version combination.

User-facing documentation

• CHANGELOG.md is updated OR update is not needed
• documentation PR is created and is linked above OR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

• added unit tests
• added e2e tests
• added regression tests
• added compatibility tests
• modified existing tests

How I validated my change

Testing

Validated end-to-end using bench-reassess.sh (available in #19427) against a live cluster, comparing a master build to this PR's build. The script automates:

1. Burst 1 — sends N deployment creates (--dry-run=server) to warm AC/Sensor caches
2. Snapshot pre-reassess — scrapes Prometheus metrics from AC, Sensor, and Central
3. Trigger reassess — calls POST /v1/policies/reassess, waits for Central's reprocessor to complete by tailing logs for the completion marker
4. Snapshot post-reassess — scrapes metrics again to measure reassess-cycle impact
5. Burst 2 — repeats the burst to measure cache survival after reassess
6. Snapshot post-burst2 — final metric scrape
7. Report — prints deltas for key metrics across all three components

Run: BURST_SIZE=100 UNIQUE_PCT=25 PARALLEL=50 ./tools/admission-control/bench-reassess.sh

Results (100 deployments, 20 unique images):

A detailed description and analysis of the test results can be found here.