The installer delivers any MESH_…_FILE own secret, not only the store's (ADR 0086)

2026-09-21 10:10:33 +02:00
parent e30a6b08ea
commit c5c42376c1
2 changed files with 29 additions and 2 deletions
@@ -334,8 +334,10 @@ func secretsByVariableIn(manifest []byte) (map[string]string, error) {
 		case "container":
 			inside := mountedFrom(r.Volumes)
 			for key, path := range r.Env {
-				if !strings.HasPrefix(key, storeVariablePrefix) ||
-					!strings.HasSuffix(key, storeFileSuffix) {
+				// Any `MESH_…_FILE` naming an own-secret's file, not only the store's: the broker
+				// settings took the same shape once a secret stopped travelling in an env-file
+				// (novox/hq ADR 0086, issue 041).
+				if !strings.HasPrefix(key, "MESH_") || !strings.HasSuffix(key, storeFileSuffix) {
 					continue
 				}
 				on := path