@@ -3,21 +3,30 @@ package lineagecontrollerwebhook
 import (
 	"sync"
 	"sync/atomic"
+	"time"
 
+	"github.com/cozystack/cozystack/pkg/lineage"
 	"k8s.io/apimachinery/pkg/api/meta"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/client-go/dynamic"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )
 
+// ownerCacheTTL controls how long a successful or negative dynamic-client GET
+// result is reused across admission requests. The labels we derive are based on
+// stable identity (kind/name/owner refs), so even a generous TTL is safe; the
+// dominant cost we are saving is the apiserver round-trip on every admission.
+const ownerCacheTTL = 60 * time.Second
+
 // +kubebuilder:webhook:path=/mutate-lineage,mutating=true,failurePolicy=Fail,sideEffects=None,groups="",resources=pods,secrets,services,persistentvolumeclaims,verbs=create;update,versions=v1,name=mlineage.cozystack.io,admissionReviewVersions={v1}
 type LineageControllerWebhook struct {
 	client.Client
-	Scheme    *runtime.Scheme
-	decoder   admission.Decoder
-	dynClient dynamic.Interface
-	mapper    meta.RESTMapper
-	config    atomic.Value
-	initOnce  sync.Once
+	Scheme      *runtime.Scheme
+	decoder     admission.Decoder
+	dynClient   dynamic.Interface
+	mapper      meta.RESTMapper
+	config      atomic.Value
+	initOnce    sync.Once
+	ownerCache  *lineage.ObjectCache
 }
@@ -73,6 +73,13 @@ func (h *LineageControllerWebhook) SetupWithManagerAsWebhook(mgr ctrl.Manager) e
 		return err
 	}
 
+	// Owner lookups dominate admission latency: each Pod admission walks the
+	// owner chain (Pod → STS → HelmRelease → app CR) with sequential dynamic
+	// GETs to the apiserver. The cache collapses repeat lookups across
+	// concurrent admissions for siblings of the same parent chain. TTL is short
+	// enough that DELETE/recreate of an owner is reflected within a minute.
+	h.ownerCache = lineage.NewObjectCache(ownerCacheTTL)
+
 	h.initConfig()
 	// Register HTTP path -> handler.
 	mgr.GetWebhookServer().Register("/mutate-lineage", &admission.Webhook{Handler: h})
@@ -101,6 +108,17 @@ func (h *LineageControllerWebhook) Handle(ctx context.Context, req admission.Req
 		return admission.Errored(400, fmt.Errorf("decode object: %w", err))
 	}
 
+	// Fast-path: the objectSelector on the MutatingWebhookConfiguration already
+	// skips admission for objects that carry the managed-by-cozystack label, so
+	// in steady state this branch only triggers for races (a controller
+	// re-applying labels mid-flight) and for safety if the selector is ever
+	// loosened. Pods still need applySchedulingClass each admission though, so
+	// we only short-circuit non-Pod kinds.
+	if obj.GetKind() != "Pod" && hasAllLineageLabels(obj) {
+		logger.V(1).Info("object already carries lineage labels, skipping owner walk")
+		return admission.Allowed("lineage labels already present")
+	}
+
 	owner, err := h.getOwner(ctx, obj)
 	switch {
 	case err != nil && errors.Is(err, AncestryAmbiguous):
@@ -133,11 +151,11 @@ func (h *LineageControllerWebhook) Handle(ctx context.Context, req admission.Req
 }
 
 func (h *LineageControllerWebhook) getOwner(ctx context.Context, o *unstructured.Unstructured) (*unstructured.Unstructured, error) {
-	owners := lineage.WalkOwnershipGraph(ctx, h.dynClient, h.mapper, h, o)
+	owners := lineage.WalkOwnershipGraphWithCache(ctx, h.dynClient, h.mapper, h, h.ownerCache, o)
 	if len(owners) == 0 {
 		return nil, NoAncestors
 	}
-	obj, err := owners[0].GetUnstructured(ctx, h.dynClient, h.mapper)
+	obj, err := owners[0].GetUnstructuredCached(ctx, h.dynClient, h.mapper, h.ownerCache)
 	if err != nil {
 		return nil, err
 	}
@@ -201,6 +219,26 @@ func (h *LineageControllerWebhook) applyLabels(o *unstructured.Unstructured, lab
 	o.SetLabels(existing)
 }
 
+// hasAllLineageLabels reports whether `o` already carries every label the
+// webhook would set. We treat ManagedObjectKey alone as insufficient because
+// the "unmanaged" path writes it with value "false" without setting the rest;
+// only the full set proves a previous successful walk.
+func hasAllLineageLabels(o *unstructured.Unstructured) bool {
+	labels := o.GetLabels()
+	if labels == nil {
+		return false
+	}
+	if labels[ManagedObjectKey] != "true" {
+		return false
+	}
+	for _, k := range []string{ManagerGroupKey, ManagerKindKey, ManagerNameKey} {
+		if _, ok := labels[k]; !ok {
+			return false
+		}
+	}
+	return true
+}
+
 // applySchedulingClass injects schedulerName and scheduling-class annotation
 // into Pods whose namespace carries the scheduler.cozystack.io/scheduling-class label.
 // If the referenced SchedulingClass CR does not exist (e.g. the scheduler
 
@@ -0,0 +1,128 @@
+package lineage
+
+import (
+	"sync"
+	"time"
+
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+)
+
+// ObjectCache is a small TTL cache shared across WalkOwnershipGraph calls so the
+// admission webhook can avoid repeatedly issuing the same uncached dynamic GET to
+// the apiserver. A child Pod's owner (StatefulSet, HelmRelease, application CR)
+// is looked up on every admission of every sibling — the cache collapses those
+// per-process lookups to a single round-trip per TTL window.
+//
+// The cache stores both successful lookups and negative results (NotFound or
+// other transient errors) so a tight stream of admissions for the same parent
+// chain does not amplify pressure on the apiserver. Entries expire after `ttl`
+// from the time of insertion; staleness is acceptable because the labels we
+// compute are derived from immutable identity fields (kind, name, namespace,
+// owner refs) — not from object state that mutates frequently.
+//
+// A nil ObjectCache is a valid no-op cache: Get always misses, Set is a no-op.
+type ObjectCache struct {
+	ttl   time.Duration
+	mu    sync.RWMutex
+	items map[cacheKey]cacheEntry
+}
+
+type cacheKey struct {
+	apiVersion string
+	kind       string
+	namespace  string
+	name       string
+}
+
+type cacheEntry struct {
+	obj       *unstructured.Unstructured
+	err       error
+	expiresAt time.Time
+}
+
+// NewObjectCache returns a cache with the given TTL. A ttl of zero or less
+// disables caching by returning nil; callers can pass the result straight to
+// WalkOwnershipGraph without nil-checking.
+func NewObjectCache(ttl time.Duration) *ObjectCache {
+	if ttl <= 0 {
+		return nil
+	}
+	return &ObjectCache{
+		ttl:   ttl,
+		items: make(map[cacheKey]cacheEntry),
+	}
+}
+
+// Get returns a cached lookup, if any. The second return value reports whether
+// the entry was present and unexpired. A nil receiver is safe.
+func (c *ObjectCache) Get(apiVersion, kind, namespace, name string) (*unstructured.Unstructured, error, bool) {
+	if c == nil {
+		return nil, nil, false
+	}
+	k := cacheKey{apiVersion, kind, namespace, name}
+	c.mu.RLock()
+	entry, ok := c.items[k]
+	c.mu.RUnlock()
+	if !ok || time.Now().After(entry.expiresAt) {
+		return nil, nil, false
+	}
+	return entry.obj, entry.err, true
+}
+
+// Set stores a lookup result. Both successful objects and errors are cached so
+// that repeated misses (NotFound, NoKindMatch) do not retry every admission.
+// A nil receiver is safe.
+func (c *ObjectCache) Set(apiVersion, kind, namespace, name string, obj *unstructured.Unstructured, err error) {
+	if c == nil {
+		return
+	}
+	k := cacheKey{apiVersion, kind, namespace, name}
+	entry := cacheEntry{
+		obj:       obj,
+		err:       err,
+		expiresAt: time.Now().Add(c.ttl),
+	}
+	c.mu.Lock()
+	c.items[k] = entry
+	// Bounded sampling eviction: when the map outgrows the threshold, scan a
+	// fixed slice of entries (cheap O(1) amortised, ~evictionSampleSize per
+	// Set) and drop the expired ones. This avoids the O(N) full-map scan
+	// pattern that would otherwise hold the write lock long enough to
+	// serialise admission webhook calls under bursty load.
+	if len(c.items) > evictionThreshold {
+		c.evictExpiredSampleLocked(time.Now(), evictionSampleSize)
+	}
+	c.mu.Unlock()
+}
+
+// evictExpiredSampleLocked scans at most n entries and removes the expired
+// ones. The caller must hold c.mu. Map iteration in Go is randomised, so
+// repeated invocations probabilistically cover the whole map without ever
+// holding the lock for an unbounded amount of time.
+func (c *ObjectCache) evictExpiredSampleLocked(now time.Time, n int) {
+	if n <= 0 {
+		return
+	}
+	i := 0
+	for key, e := range c.items {
+		if now.After(e.expiresAt) {
+			delete(c.items, key)
+		}
+		i++
+		if i >= n {
+			return
+		}
+	}
+}
+
+const (
+	// evictionThreshold is the size at which Set begins sampling for expired
+	// entries. Set high enough that the sweep stays infrequent under steady
+	// load, low enough that the map cannot grow unbounded under pathological
+	// admission patterns.
+	evictionThreshold = 4096
+	// evictionSampleSize caps how many entries each Set inspects when
+	// evicting. With sampleSize ≪ threshold the work is amortised across many
+	// Sets, bounding the write-lock hold time regardless of map size.
+	evictionSampleSize = 64
+)