From 1249e699990ebee2cee0b45a09ca4792c77b5843 Mon Sep 17 00:00:00 2001
From: Lyndon-Li <lyonghui@vmware.com>
Date: Mon, 3 Aug 2026 17:09:30 +0800
Subject: [PATCH] empty sa namespace when secret is empty for getChangedBlocks

Signed-off-by: Lyndon-Li <lyonghui@vmware.com>
---
 pkg/cbtservice/csi_service_impl.go | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkg/cbtservice/csi_service_impl.go b/pkg/cbtservice/csi_service_impl.go
index f4ea23de7..235477bd4 100644
--- a/pkg/cbtservice/csi_service_impl.go
+++ b/pkg/cbtservice/csi_service_impl.go
@@ -116,6 +116,12 @@ func (s *ServiceImpl) GetChangedBlocks(ctx context.Context, snapshot string, cha
 		return err
 	}
 
+	saNamespace := ""
+	if s.SAName != "" {
+		// The SA is created in the same namespace as Velero server. vsNamespace is the namespace of Velero	server.
+		saNamespace = s.vsNamespace
+	}
+
 	args := iterator.Args{
 		SnapshotName:   snapshot,
 		PrevSnapshotID: changeID,
@@ -126,7 +132,7 @@ func (s *ServiceImpl) GetChangedBlocks(ctx context.Context, snapshot string, cha
 
 		Clients:         clients,
 		Namespace:       s.vsNamespace,
-		SANamespace:     s.vsNamespace,
+		SANamespace:     saNamespace,
 		SAName:          s.SAName,
 		TokenExpirySecs: iterator.DefaultTokenExpirySeconds,
 		MaxResults:      0, // If 0 then the CSI driver decides the value.