From 33ea04a6da36f0f9ccb9325072b43f51c1f56673 Mon Sep 17 00:00:00 2001
From: Roger Siegenthaler <r.siegenthaler@elderbyte.com>
Date: Tue, 22 Apr 2025 19:55:34 +0000
Subject: [PATCH] fix!: custom environment variables are appended after all
 generated variables

---
 pkg/cluster/k8sres.go      | 15 ++++++++++-----
 pkg/cluster/k8sres_test.go |  8 ++++----
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/pkg/cluster/k8sres.go b/pkg/cluster/k8sres.go
index 00cb01b90..6abd170fb 100644
--- a/pkg/cluster/k8sres.go
+++ b/pkg/cluster/k8sres.go
@@ -1035,22 +1035,19 @@ func (c *Cluster) generateSpiloPodEnvVars(
 	}
 
 	// fetch variables from custom environment Secret
-	// that will override all subsequent global variables
 	secretEnvVarsList, err := c.getPodEnvironmentSecretVariables()
 	if err != nil {
 		return nil, err
 	}
-	envVars = appendIfNotPresent(envVars, secretEnvVarsList...)
 
 	// fetch variables from custom environment ConfigMap
-	// that will override all subsequent global variables
 	configMapEnvVarsList, err := c.getPodEnvironmentConfigMapVariables()
 	if err != nil {
 		return nil, err
 	}
-	envVars = appendIfNotPresent(envVars, configMapEnvVarsList...)
 
 	// global variables derived from operator configuration
+	// that do not override custom environment variables
 	opConfigEnvVars := make([]v1.EnvVar, 0)
 	if c.OpConfig.WALES3Bucket != "" {
 		opConfigEnvVars = append(opConfigEnvVars, v1.EnvVar{Name: "WAL_S3_BUCKET", Value: c.OpConfig.WALES3Bucket})
@@ -1080,7 +1077,15 @@ func (c *Cluster) generateSpiloPodEnvVars(
 		opConfigEnvVars = append(opConfigEnvVars, v1.EnvVar{Name: "LOG_BUCKET_SCOPE_PREFIX", Value: ""})
 	}
 
-	envVars = appendIfNotPresent(envVars, opConfigEnvVars...)
+	for _, env := range opConfigEnvVars {
+		if !isEnvVarPresent(secretEnvVarsList, env.Name) && !isEnvVarPresent(configMapEnvVarsList, env.Name) {
+			envVars = appendIfNotPresent(envVars, env)
+		}
+	}
+
+	// append custom environment variables last to allow chained referencing
+	envVars = appendIfNotPresent(envVars, secretEnvVarsList...)
+	envVars = appendIfNotPresent(envVars, configMapEnvVarsList...)
 
 	return envVars, nil
 }
diff --git a/pkg/cluster/k8sres_test.go b/pkg/cluster/k8sres_test.go
index d2bbfaf87..ca5c52705 100644
--- a/pkg/cluster/k8sres_test.go
+++ b/pkg/cluster/k8sres_test.go
@@ -623,7 +623,7 @@ func TestGenerateSpiloPodEnvVars(t *testing.T) {
 	}
 	expectedS3BucketConfigMap := []ExpectedValue{
 		{
-			envIndex:       17,
+			envIndex:       19,
 			envVarConstant: "wal_s3_bucket",
 			envVarValue:    "global-s3-bucket-configmap",
 		},
@@ -709,14 +709,14 @@ func TestGenerateSpiloPodEnvVars(t *testing.T) {
 			envVarValue:    fmt.Sprintf("/%s", dummyUUID),
 		},
 		{
-			envIndex:       21,
+			envIndex:       23,
 			envVarConstant: "clone_aws_endpoint",
 			envVarValue:    "s3.eu-west-1.amazonaws.com",
 		},
 	}
 	expectedCloneEnvSecret := []ExpectedValue{
 		{
-			envIndex:       21,
+			envIndex:       24,
 			envVarConstant: "clone_aws_access_key_id",
 			envVarValueRef: &v1.EnvVarSource{
 				SecretKeyRef: &v1.SecretKeySelector{
@@ -735,7 +735,7 @@ func TestGenerateSpiloPodEnvVars(t *testing.T) {
 			envVarValue:    "gs://some/path/",
 		},
 		{
-			envIndex:       20,
+			envIndex:       23,
 			envVarConstant: "standby_google_application_credentials",
 			envVarValueRef: &v1.EnvVarSource{
 				SecretKeyRef: &v1.SecretKeySelector{