From f20a8eed3d6e41a234774b031c0ceeaca8a909a1 Mon Sep 17 00:00:00 2001
From: Dan Prince <dprince@redhat.com>
Date: Mon, 16 Jun 2025 20:09:00 -0400
Subject: [PATCH] Optimize getBundlePEM

This was the top allocation on the heap. See if we can optimize it a bit

Jira: OSPRH-17235
---
 pkg/openstack/ca.go | 35 +++++++++++++++++++++++++++--------
 1 file changed, 27 insertions(+), 8 deletions(-)

diff --git a/pkg/openstack/ca.go b/pkg/openstack/ca.go
index 417a290c42..d92b452aed 100644
--- a/pkg/openstack/ca.go
+++ b/pkg/openstack/ca.go
@@ -9,6 +9,7 @@ import (
 	"fmt"
 	"math"
 	"os"
+	"strings"
 	"time"
 
 	certmgrv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
@@ -458,6 +459,15 @@ func ReconcileCAs(ctx context.Context, instance *corev1.OpenStackControlPlane, h
 		return ctrl.Result{}, err
 	}
 
+	caBundlePEM, err := bundle.getBundlePEM()
+	if err != nil {
+		return ctrl.Result{}, fmt.Errorf("failed to create CA bundle PEM: %w", err)
+	}
+	caOnlyBundlePEM, err := caOnlyBundle.getBundlePEM()
+	if err != nil {
+		return ctrl.Result{}, fmt.Errorf("failed to create CA only bundle PEM: %w", err)
+	}
+
 	saSecretTemplate := []util.Template{
 		{
 			Name:               tls.CABundleSecret,
@@ -471,8 +481,8 @@ func ReconcileCAs(ctx context.Context, instance *corev1.OpenStackControlPlane, h
 			},
 			ConfigOptions: nil,
 			CustomData: map[string]string{
-				tls.CABundleKey:         bundle.getBundlePEM(),
-				tls.InternalCABundleKey: caOnlyBundle.getBundlePEM(),
+				tls.CABundleKey:         caBundlePEM,
+				tls.InternalCABundleKey: caOnlyBundlePEM,
 			},
 			SkipSetOwner: true, // TODO: (mschuppert) instead add e.g. keystoneapi to secret to prevent keystoneapi on cleanup to switch to not ready
 		},
@@ -796,16 +806,25 @@ func (cab *caBundle) getCertsFromPEM(PEMdata []byte) error {
 	return nil
 }
 
-// Create PEM bundle from certificates
-func (cab *caBundle) getBundlePEM() string {
-	var bundleData string
+func (cab *caBundle) getBundlePEM() (string, error) {
+	var b strings.Builder
 
 	for _, cert := range cab.certs {
-		bundleData += "# " + cert.cert.Issuer.CommonName + "\n" +
-			string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert.cert.Raw}))
+		b.WriteString("# ")
+		b.WriteString(cert.cert.Issuer.CommonName)
+		b.WriteByte('\n')
+
+		block := &pem.Block{
+			Type:  "CERTIFICATE",
+			Bytes: cert.cert.Raw,
+		}
+
+		if err := pem.Encode(&b, block); err != nil {
+			return "", fmt.Errorf("failed to encode bundle PEM for %w", err)
+		}
 	}
 
-	return bundleData
+	return b.String(), nil
 }
 
 func addIssuerLabelAnnotation(