From c98259f74a835429ed2db6cca2c64a3802ebc43f Mon Sep 17 00:00:00 2001
From: Charandas <542168+charandas@users.noreply.github.com>
Date: Sat, 1 Nov 2025 11:51:25 -0700
Subject: [PATCH] Identity: adds ServiceIdentityForSingleNamespace helper
 (#113161)

---
 pkg/apimachinery/identity/context.go | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/pkg/apimachinery/identity/context.go b/pkg/apimachinery/identity/context.go
index 1ce76389f59..00488ed9d85 100644
--- a/pkg/apimachinery/identity/context.go
+++ b/pkg/apimachinery/identity/context.go
@@ -74,6 +74,21 @@ func newInternalIdentity(name string, namespace string, orgID int64, opts ...Ide
 	return staticRequester
 }
 
+// WithServiceIdentityForSingleNamespace sets an identity representing the service itself in provided namespace and store it in context.
+// This is useful for background tasks that has to communicate with other services in the same namespace. It also returns a Requester with
+// static permissions so it can be used in legacy code paths.
+func WithServiceIdentityForSingleNamespace(ctx context.Context, namespace string, opts ...IdentityOpts) (context.Context, Requester) {
+	r := newInternalIdentity(serviceName, namespace, 1, opts...)
+	return WithRequester(ctx, r), r
+}
+
+// WithServiceIdentityForSingleNamespaceContext sets an identity representing the service itself in context, restricted to a namespace.
+// Use when using a middleware that signs tokens with the same restriction.
+func WithServiceIdentityForSingleNamespaceContext(ctx context.Context, namespace string, opts ...IdentityOpts) context.Context {
+	ctx, _ = WithServiceIdentityForSingleNamespace(ctx, namespace, opts...)
+	return ctx
+}
+
 // WithServiceIdentity sets an identity representing the service itself in provided org and store it in context.
 // This is useful for background tasks that has to communicate with unfied storage. It also returns a Requester with
 // static permissions so it can be used in legacy code paths.