From 3974e88cbe6f8a468da4f86dbd219a9d9aa943a5 Mon Sep 17 00:00:00 2001 From: Michael Mandrus Date: Fri, 14 Nov 2025 00:03:48 -0500 Subject: [PATCH] flush the encryption cache during consolidation --- pkg/registry/apis/secret/service/consolidation.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkg/registry/apis/secret/service/consolidation.go b/pkg/registry/apis/secret/service/consolidation.go index bbe7d9084e6..1789612881d 100644 --- a/pkg/registry/apis/secret/service/consolidation.go +++ b/pkg/registry/apis/secret/service/consolidation.go @@ -53,6 +53,9 @@ func (s *ConsolidationService) Consolidate(ctx context.Context) (err error) { return fmt.Errorf("disabling all data keys: %w", err) } + // Keep track of which namespaces we have already flushed so we get to take advantage of caching the new values + flushedNamespaces := make(map[string]bool) + // List all encrypted values. encryptedValues, err := s.globalEncryptedValueStore.ListAll(ctx, contracts.ListOpts{}, nil) if err != nil { @@ -60,6 +63,12 @@ func (s *ConsolidationService) Consolidate(ctx context.Context) (err error) { } for _, ev := range encryptedValues { + // Flush the cache for this namespace if we haven't already + if !flushedNamespaces[ev.Namespace] { + s.encryptionManager.FlushCache(xkube.Namespace(ev.Namespace)) + flushedNamespaces[ev.Namespace] = true + } + // Decrypt the value using its old data key. decryptedValue, err := s.encryptionManager.Decrypt(ctx, xkube.Namespace(ev.Namespace), ev.EncryptedPayload) if err != nil {