From ce666f6b54ec9f1a287f6feb4d38f53010332961 Mon Sep 17 00:00:00 2001
From: Chris Farhood <chris@farhood.org>
Date: Sun, 12 Apr 2026 08:31:43 -0400
Subject: [PATCH] Read all env vars from pod spec instead of static allowlist
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Remove INHERITED_ENV_KEYS; read directly from mainContainer.env
- Any Deployment env var is now forwarded automatically to Job pods
- Layer ordering preserved: pod spec → paperclip vars → agent config env

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 package.json             |  2 +-
 src/server/k8s-client.ts | 23 ++++++-----------------
 2 files changed, 7 insertions(+), 18 deletions(-)

diff --git a/package.json b/package.json
index 3323ab6..bbe7d23 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@farhoodliquor/paperclip-adapter-opencode-k8s",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Paperclip adapter plugin that runs OpenCode agents as Kubernetes Jobs",
   "license": "MIT",
   "type": "module",
diff --git a/src/server/k8s-client.ts b/src/server/k8s-client.ts
index 9f62571..2cc0a1d 100644
--- a/src/server/k8s-client.ts
+++ b/src/server/k8s-client.ts
@@ -20,20 +20,10 @@ export interface SelfPodInfo {
   dnsConfig: k8s.V1PodDNSConfig | undefined;
   pvcClaimName: string | null;
   secretVolumes: SelfPodSecretVolume[];
-  /** Env vars inherited from the Deployment container. */
+  /** Env vars read directly from the pod spec's container definition. */
   inheritedEnv: Record<string, string>;
 }
 
-/** Keys forwarded from the Deployment container env into Job pods. */
-const INHERITED_ENV_KEYS = [
-  "CLAUDE_CODE_USE_BEDROCK",
-  "AWS_REGION",
-  "AWS_BEARER_TOKEN_BEDROCK",
-  "ANTHROPIC_API_KEY",
-  "OPENAI_API_KEY",
-  "PAPERCLIP_API_URL",
-];
-
 let cachedSelfPod: SelfPodInfo | null = null;
 
 /**
@@ -141,13 +131,12 @@ export async function getSelfPodInfo(kubeconfigPath?: string): Promise<SelfPodIn
     }
   }
 
-  // Collect inherited env vars from process.env (these came from the Deployment spec)
+  // Collect all env vars directly from the pod spec container definition.
+  // This gives the authoritative env the container was configured with in K8s —
+  // no static allowlist needed; any env var from the Deployment is forwarded.
   const inheritedEnv: Record<string, string> = {};
-  for (const key of INHERITED_ENV_KEYS) {
-    const value = process.env[key];
-    if (value !== undefined) {
-      inheritedEnv[key] = value;
-    }
+  for (const envVar of mainContainer.env ?? []) {
+    if (envVar.value) inheritedEnv[envVar.name] = envVar.value;
   }
 
   cachedSelfPod = {