backend: k8cache: percent-encode '+' in cache key fields to avoid delimiter collision

GenerateKey joins apiGroup, kind, namespace, and contextID with '+' as a
delimiter, and DeleteKeys later splits on '+' to strip the namespace via
positional indexing. Kubeconfig context names are not restricted by
Kubernetes naming rules and may legitimately contain '+', which produces
a key with more than 4 segments and breaks the positional namespace
stripping in DeleteKeys. This can cause cache invalidation to silently
target the wrong key, leaving stale cached API responses served after
a write.

Escape literal '+' to '%2B' in each field before joining so the only
'+' characters remaining in the key are the delimiters themselves.

Fixes #6123

Signed-off-by: Siddhi Khandelwal <siddhi.200727@gmail.com>

Author: sid200727

backend/pkg/k8cache/cacheStore.go

@@ -163,8 +163,19 @@ func GenerateKey(url *url.URL, contextID string) (string, error) {
 		Context:   contextID,
 	}
 
-	// Create a stable representation
-	raw := fmt.Sprintf("%s+%s+%s+%s", apiGroup, k.Kind, k.Namespace, k.Context)
+	// Create a stable representation. Each field has any literal "+" escaped
+	// to "%2B" so it cannot be misread as the "+" delimiter when the key is
+	// later split apart (see DeleteKeys). This matters most for the context
+	// field, since kubeconfig context names are not restricted by Kubernetes
+	// naming rules and may legitimately contain "+".
+	escape := strings.NewReplacer("+", "%2B").Replace
+	raw := fmt.Sprintf(
+		"%s+%s+%s+%s",
+		escape(apiGroup),
+		escape(k.Kind),
+		escape(k.Namespace),
+		escape(k.Context),
+	)
 
 	return raw, nil
 }

backend/pkg/k8cache/cacheStore_test.go

@@ -410,6 +410,13 @@ func TestGenerateKey(t *testing.T) {
 			expectedKey: "",
 			expectedErr: errors.New("invalid url format"),
 		},
+		{
+			name:        "context key containing a literal plus is escaped, not treated as delimiter",
+			urlPath:     url.URL{Path: "/clusters/kind-kind/apis/apps/v1/namespaces/default/deployments"},
+			contextKey:  "prod+cluster",
+			expectedKey: "apps+deployments+default+prod%2Bcluster",
+			expectedErr: nil,
+		},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {