diff --git a/staging/src/k8s.io/kube-aggregator/pkg/controllers/status/available_controller.go b/staging/src/k8s.io/kube-aggregator/pkg/controllers/status/available_controller.go
index 51ae2d8a3ca..525d8c98c63 100644
--- a/staging/src/k8s.io/kube-aggregator/pkg/controllers/status/available_controller.go
+++ b/staging/src/k8s.io/kube-aggregator/pkg/controllers/status/available_controller.go
@@ -125,7 +125,7 @@ func (c *tlsTransportCache) get(config *rest.Config) (http.RoundTripper, error)
 
 type tlsCacheKey struct {
 	certData string
-	keyData  string
+	keyData  string `datapolicy:"secret-key"`
 }
 
 func tlsConfigKey(c *rest.Config) tlsCacheKey {