From d7f2ae69caf54bb40ca75145f8e983fbacfa3dbf Mon Sep 17 00:00:00 2001
From: adam <me@adamksmith.xyz>
Date: Tue, 16 Jun 2026 20:09:19 +0000
Subject: [PATCH] k8s: exclude passthrough source keys from jbod-mqtt secret

excludeRaw alone left all home_assistant source keys (api_key, vantage_*, etc.)
in the synced secret, so envFrom injected them into the web container. Add
transformation.excludes ['.*'] so only the templated MQTT_USERNAME/MQTT_PASSWORD
remain.
---
 k8s/mqtt-vaultstaticsecret.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/k8s/mqtt-vaultstaticsecret.yaml b/k8s/mqtt-vaultstaticsecret.yaml
index b1ac7de..1741804 100644
--- a/k8s/mqtt-vaultstaticsecret.yaml
+++ b/k8s/mqtt-vaultstaticsecret.yaml
@@ -23,6 +23,11 @@ spec:
     create: true
     transformation:
       excludeRaw: true
+      # Drop ALL passthrough source keys (api_key, vantage_*, etc.) — keep only
+      # the templated MQTT_USERNAME/MQTT_PASSWORD below. Without this, envFrom
+      # would inject the entire home_assistant secret into the web container.
+      excludes:
+        - ".*"
       templates:
         MQTT_USERNAME:
           text: '{{ .Secrets.mqtt_user }}'