Repository navigation
fix(deploy): a key the environment declares may-be-empty is stored empty - #1155
Merged
Merged
Conversation
service-secrets.may-be-empty only tolerated an empty value already in the store; nothing ever wrote one. A property absent from the store that no file, generator or other key supplies was therefore required of the operator even when the environment had declared its correct value empty, and the only way through was a hand write to the store. The declaration now plans it as 'empty' and the apply stores it, so the ExternalSecret reading it materializes; a re-plan keeps it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
service-secrets.may-be-emptyonly tolerated an empty value that was already stored, and nothing in the CLI ever writes one. A declared-empty property that no file, generator or other remote key supplied was plannedrequire. Under--allow-missingit was left absent, so the ExternalSecret that reads it never materialized its Secret. The only way through was a hand write to the store.Found standing up obin-dev: five optional keys (datasource OAuth client secret, three Vault keys, the Sentry DSN) on a cell with no Vault and no Sentry project.
Change. In
fallbackSource, a property whose every key is declaredmay-be-empty, and which has no configured value or generator, is planned as a new actionempty. The apply writes it as"". The existing present-but-empty check then keeps it on later runs.Reused:
declaredEmpty, the existing every-key rule. An undeclared property is still required (test).Classification: a fix at the owner (the plan).
Tests:
TestBuildWritesADeclaredEmptyPropertyNothingHolds(planned empty, stored empty, kept on re-plan) andTestBuildRequiresAnAbsentPropertyNotDeclaredEmpty.go test ./pkg/deploysecrets/ ./cmd/deploy/passes.Verified live: obin-dev's
deploy secrets --env devplanned the five keysemptyand wroteplatform-obin-dev-saas-accountsv3 andplatform-obin-dev-saas-frontendv2.🤖 Generated with Claude Code