fix: move applyEnvironmentVariables() before secret-ref loop in write()#31154
fix: move applyEnvironmentVariables() before secret-ref loop in write()#31154ilancas wants to merge 3 commits intoKoenkk:devfrom
Conversation
In write(), applyEnvironmentVariables(toWrite) was called after the secret-reference preservation loop. This meant env var values (e.g. ZIGBEE2MQTT_CONFIG_MQTT_PASSWORD injected by the HA addon docker-entrypoint.sh) would overwrite the !secret.yaml reference with plain text on every write cycle. Fix: move applyEnvironmentVariables(toWrite) to before the loop so that the resolved env var value gets routed to the secret file and the !secret reference is preserved in configuration.yaml. Fixes Koenkk#31140
Reverts the previous approach (moving applyEnvironmentVariables before the loop) which broke existing tests. The correct fix: keep applyEnvironmentVariables after the loop, but in the secret-reference preservation loop, check whether a plain env var is set for that key. If so, skip the !secret routing so the env var value goes directly into configuration.yaml instead of being silently diverted to the secret file. If the env var value is itself a !secret reference, the preservation logic still runs normally.
|
The title/description of the PR doesn't appear to match what the code change is doing? Regarding the issue, since env vars are meant to override the
The final value is always HA should allow preventing the setting of env vars if set via HA add-on config: |
|
This pull request is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days |
2 participants
In write(), applyEnvironmentVariables(toWrite) was called after the secret-reference preservation loop. This meant env var values (e.g. ZIGBEE2MQTT_CONFIG_MQTT_PASSWORD injected by the HA addon docker-entrypoint.sh) would overwrite the !secret.yaml reference with plain text on every write cycle.
Fix: move applyEnvironmentVariables(toWrite) to before the loop so that the resolved env var value gets routed to the secret file and the !secret reference is preserved in configuration.yaml.
Fixes #31140