fix: address remaining review feedback from gemini bot

Signed-off-by: Abhinav Singh <abhinavsingh717073@gmail.com>

Author: Abhinav-kodes

pkg/router/jwt.go

@@ -24,6 +24,7 @@ import (
 	"encoding/pem"
 	"fmt"
 	"os"
+	"sync"
 	"time"
 
 	"github.com/golang-jwt/jwt/v5"
@@ -62,6 +63,7 @@ type JWTManager struct {
 	privateKey *rsa.PrivateKey
 	publicKey  *rsa.PublicKey
 	clientset  kubernetes.Interface
+	keyCache   sync.Map
 }
 
 // NewJWTManager creates a new JWT manager with a fresh RSA key pair
@@ -105,9 +107,17 @@ func (jm *JWTManager) GenerateToken(claims map[string]interface{}) (string, erro
 
 // GenerateTokenWithKey generates a JWT token signed with a specific PEM-encoded private key
 func (jm *JWTManager) GenerateTokenWithKey(claims map[string]interface{}, privateKeyPEM string) (string, error) {
-	privKey, err := jwt.ParseRSAPrivateKeyFromPEM([]byte(privateKeyPEM))
-	if err != nil {
-		return "", fmt.Errorf("failed to parse private key: %w", err)
+	var privKey *rsa.PrivateKey
+
+	if cachedKey, ok := jm.keyCache.Load(privateKeyPEM); ok {
+		privKey = cachedKey.(*rsa.PrivateKey)
+	} else {
+		parsedKey, err := jwt.ParseRSAPrivateKeyFromPEM([]byte(privateKeyPEM))
+		if err != nil {
+			return "", fmt.Errorf("failed to parse private key: %w", err)
+		}
+		privKey = parsedKey
+		jm.keyCache.Store(privateKeyPEM, privKey)
 	}
 
 	// Create JWT claims

pkg/workloadmanager/sandbox_helper.go

@@ -203,8 +203,7 @@ func (s *Server) initializePicoD(ctx context.Context, podIP string, entry *sandb
 	}
 	req.Header.Set("Content-Type", "application/json")
 
-	client := &http.Client{Timeout: s.config.PicoInitTimeout}
-	resp, err := client.Do(req)
+	resp, err := s.httpClient.Do(req)
 	if err != nil {
 		return fmt.Errorf("POST /init failed: %w", err)
 	}

pkg/workloadmanager/server.go

@@ -41,6 +41,7 @@ type Server struct {
 	tokenCache        *TokenCache
 	informers         *Informers
 	storeClient       store.Store
+	httpClient        *http.Client
 	wg                sync.WaitGroup
 }
 
@@ -107,6 +108,7 @@ func NewServer(config *Config, sandboxController *SandboxReconciler) (*Server, e
 		tokenCache:        tokenCache,
 		informers:         NewInformers(k8sClient),
 		storeClient:       store.Storage(),
+		httpClient:        &http.Client{Timeout: config.PicoInitTimeout},
 	}
 
 	// Setup routes