Merge pull request #148 from bank-vaults/backport-147

fix: only add encryption context to args when it is specified
bank-vaults · Aug 3, 2023 · ccb081e · ccb081e
2 parents 75531ba + 5018b5b
commit ccb081e
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/pkg/apis/vault/v1alpha1/vault_types.go b/pkg/apis/vault/v1alpha1/vault_types.go
@@ -704,8 +704,6 @@ func (usc *UnsealConfig) ToArgs(vault *Vault) []string {
 			usc.AWS.KMSKeyID,
 			"--aws-kms-region",
 			usc.AWS.KMSRegion,
-			"--aws-kms-encryption-context",
-			usc.AWS.KMSEncryptionContext,
 			"--aws-s3-bucket",
 			usc.AWS.S3Bucket,
 			"--aws-s3-prefix",
@@ -715,6 +713,13 @@ func (usc *UnsealConfig) ToArgs(vault *Vault) []string {
 			"--aws-s3-sse-algo",
 			usc.AWS.S3SSE,
 		)
+
+		if usc.AWS.KMSEncryptionContext != "" {
+			args = append(args,
+				"--aws-kms-encryption-context",
+				usc.AWS.KMSEncryptionContext,
+			)
+		}
 	} else if usc.Alibaba != nil {
 		args = append(args,
 			"--mode",