From 4e1333236c1fae43df5fa80eebac21d829b520d6 Mon Sep 17 00:00:00 2001 From: Matheus Macabu Date: Wed, 6 Aug 2025 14:02:23 +0200 Subject: [PATCH] InlineSecureValues: Only add decrypter if owner is different than svc identity (#109251) --- pkg/registry/apis/secret/inline/inline_secure_value.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkg/registry/apis/secret/inline/inline_secure_value.go b/pkg/registry/apis/secret/inline/inline_secure_value.go index 590d311c9c1..9a24f6ace52 100644 --- a/pkg/registry/apis/secret/inline/inline_secure_value.go +++ b/pkg/registry/apis/secret/inline/inline_secure_value.go @@ -198,6 +198,11 @@ func (s *LocalInlineSecureValueService) CreateInline(ctx context.Context, owner // TODO(2025-07-31): when we migrate to using the common type, we don't need this conversion. secret := secretv1beta1.ExposedSecureValue(value) + decrypters := []string{serviceIdentity} + if owner.APIGroup != serviceIdentity { + decrypters = append(decrypters, owner.APIGroup) + } + spec := &secretv1beta1.SecureValue{ ObjectMeta: metav1.ObjectMeta{ Name: "sv-" + util.GenerateShortUID(), @@ -207,10 +212,7 @@ func (s *LocalInlineSecureValueService) CreateInline(ctx context.Context, owner Spec: secretv1beta1.SecureValueSpec{ Description: fmt.Sprintf("Inline secure value for %s/%s in %s/%s", owner.Kind, owner.Name, owner.APIGroup, owner.APIVersion), Value: &secret, - Decrypters: []string{ - serviceIdentity, - owner.APIGroup, - }, + Decrypters: decrypters, }, }