Merge pull request #31820 from ehazlett/secrets-restrict

Restrict secret view to node level in controller
Upstream-commit: 0fe41cc4db65372f66d79721344522159c173ae5
Component: engine

components/engine/daemon/cluster/executor/container/executor.go

@@ -152,7 +152,7 @@ func (e *executor) Controller(t *api.Task) (exec.Controller, error) {
 		return newNetworkAttacherController(e.backend, t, e.secrets)
 	}
 
-	ctlr, err := newController(e.backend, t, e.secrets)
+	ctlr, err := newController(e.backend, t, secrets.Restrict(e.secrets, t))
 	if err != nil {
 		return nil, err
 	}