From 6669e9279027b56ab7fe7d1c93765b1af9713546 Mon Sep 17 00:00:00 2001
From: Morgan Creekmore <morgan.creekmore@contrastsecurity.com>
Date: Wed, 7 Jan 2026 16:30:34 -0600
Subject: [PATCH] Fix GetShortHash, old ShortHash handled length incorrectly so
 this matches the old functionality now

---
 src/Contrast.K8s.AgentOperator/Core/HashHelper.cs             | 2 +-
 .../Reactions/Secrets/AgentConnectionVolumeSecretHandler.cs   | 4 +---
 .../Scenarios/Injection/InitContainerOverrideTests.cs         | 2 +-
 3 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/src/Contrast.K8s.AgentOperator/Core/HashHelper.cs b/src/Contrast.K8s.AgentOperator/Core/HashHelper.cs
index f6823c2b..59553e5c 100644
--- a/src/Contrast.K8s.AgentOperator/Core/HashHelper.cs
+++ b/src/Contrast.K8s.AgentOperator/Core/HashHelper.cs
@@ -14,7 +14,7 @@ public static string GetShortHash(string text)
         using var sha256 = SHA256.Create();
         var bytes = Encoding.UTF8.GetBytes(text);
         var hash = sha256.ComputeHash(bytes);
-        return Convert.ToHexStringLower(hash, 0, 8);
+        return Convert.ToHexStringLower(hash, 0, 5);
     }
 
     public static string Sha256(string text)
diff --git a/src/Contrast.K8s.AgentOperator/Core/Reactions/Secrets/AgentConnectionVolumeSecretHandler.cs b/src/Contrast.K8s.AgentOperator/Core/Reactions/Secrets/AgentConnectionVolumeSecretHandler.cs
index 02687c0d..34a1918f 100644
--- a/src/Contrast.K8s.AgentOperator/Core/Reactions/Secrets/AgentConnectionVolumeSecretHandler.cs
+++ b/src/Contrast.K8s.AgentOperator/Core/Reactions/Secrets/AgentConnectionVolumeSecretHandler.cs
@@ -147,9 +147,7 @@ private async Task<string> CreateDerivedSecretHash(ResourceIdentityPair<AgentCon
             }
         }
 
-        using var sha256 = SHA256.Create();
-        var bytes = sha256.ComputeHash(Encoding.ASCII.GetBytes(secretKeyHashes.ToString()));
-        return Convert.ToHexStringLower(bytes);
+        return HashHelper.Sha256(secretKeyHashes.ToString());
     }
 
     private async Task<byte[]?> CreateLiveConfig(ResourceIdentityPair<AgentConnectionResource> connectionResource)
diff --git a/tests/Contrast.K8s.AgentOperator.FunctionalTests/Scenarios/Injection/InitContainerOverrideTests.cs b/tests/Contrast.K8s.AgentOperator.FunctionalTests/Scenarios/Injection/InitContainerOverrideTests.cs
index 37fc63fe..bcf00645 100644
--- a/tests/Contrast.K8s.AgentOperator.FunctionalTests/Scenarios/Injection/InitContainerOverrideTests.cs
+++ b/tests/Contrast.K8s.AgentOperator.FunctionalTests/Scenarios/Injection/InitContainerOverrideTests.cs
@@ -37,7 +37,7 @@ public async Task When_any_overrides_are_applied_a_debugging_env_var_should_be_a
             var container = result.Spec.InitContainers.Single(x => x.Name == "contrast-init");
             var env = container.Env;
 
-            env.Should().ContainSingle(x => x.Name == "CONTRAST_DEBUGGING_SECURITY_CONTEXT_TAINTED").Which.Value.Should().Be("True");
+            env.Should().ContainSingle(x => x.Name == "CONTRAST_DEBUGGING_SECURITY_CONTEXT_TAINTED").Which.Value.Should().Be("true");
         }
     }