k8s/mqtt-vaultstaticsecret.yaml

@@ -23,6 +23,11 @@ spec:
     create: true
     transformation:
       excludeRaw: true
+      # Drop ALL passthrough source keys (api_key, vantage_*, etc.) — keep only
+      # the templated MQTT_USERNAME/MQTT_PASSWORD below. Without this, envFrom
+      # would inject the entire home_assistant secret into the web container.
+      excludes:
+        - ".*"
       templates:
         MQTT_USERNAME:
           text: '{{ .Secrets.mqtt_user }}'