Skip to content

Conversation

@Diaphteiros
Copy link
Contributor

What this PR does / why we need it:
Changes the name of the secret created by the AccessRequest. It was just the AccessRequest's name before, which is fine when coming from the AccessRequest and looking for the secret, but confusing when just listing secrets.

This change renames the secret to <access-request-name>.kubeconfig (similar to how the ClusterProvider kind does it). If that exceeds the character limit, parts of the AccessRequest's name will be cut off and replaced by a hash while the .kubeconfig suffix will be preserved.

Which issue(s) this PR fixes:
None

Special notes for your reviewer:
This change will 'leak' secrets with the old name from existing AccessRequests, as long as the AccessRequest exists. Since the old secret has an owner reference, it will be removed when the AccessRequest is deleted.

Release note:

The secrets created for `AccessRequest` resources are now named `<access-request-name>.kubeconfig`. Before, they were just named like the owning `AccessRequest` itself. Existing secrets with the old name will continue to exist until the `AccessRequest` is removed, but they will not be updated anymore.

@Diaphteiros Diaphteiros merged commit dbd78d5 into main Oct 16, 2025
7 checks passed
@Diaphteiros Diaphteiros deleted the ar-secret-rename branch October 16, 2025 12:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants