vault-exec-agent: filter out vault-exec-agent's VAULT_* env vars befo…

…re exec-ing
jf · Sep 2, 2024 · b0fe425 · b0fe425
1 parent aa3c16e
commit b0fe425
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/vault-exec-agent/vault-exec-agent.clj b/vault-exec-agent/vault-exec-agent.clj
@@ -77,9 +77,16 @@
              {}
              merged-secret-values))
 
+(def filtered-secret-values
+  (-> merged-secret-values
+      (dissoc "VAULT_ADDR"
+              "VAULT_KV_MOUNT_PATH"
+              "VAULT_KV_PATH"
+              "VAULT_TOKEN")))
+
 ;; exec program with args with supplied; otherwise the practical result is to simply fileify out the *_FILE env vars
 (if *command-line-args*
-  (apply exec {:extra-env fileified-secret-values} *command-line-args*)
+  (apply exec {:extra-env filtered-secret-values} *command-line-args*)
   "")
 
 (comment