diff --git a/internal/rbd/controllerserver.go b/internal/rbd/controllerserver.go
index e8d7460aa..29563d6d8 100644
--- a/internal/rbd/controllerserver.go
+++ b/internal/rbd/controllerserver.go
@@ -559,8 +559,7 @@ func checkContentSource(ctx context.Context, req *csi.CreateVolumeRequest, cr *u
 		if volID == "" {
 			return nil, nil, status.Errorf(codes.NotFound, "volume ID cannot be empty")
 		}
-		// TODO need to support cloning for encrypted volume
-		rbdvol, err := genVolFromVolID(ctx, volID, cr, nil)
+		rbdvol, err := genVolFromVolID(ctx, volID, cr, req.GetSecrets())
 		if err != nil {
 			util.ErrorLog(ctx, "failed to get backend image for %s: %v", volID, err)
 			if !errors.Is(err, ErrImageNotFound) {