Csub silently ignores extra env

csub.py

@@ -29,7 +29,6 @@
     shlex_join,
     parse_duration,
     add_env_flags,
-    add_secret_env_flags,
 )
 
 def build_parser() -> argparse.ArgumentParser:
@@ -100,7 +99,7 @@ def build_runai_command(
     run_uid = str(args.uid) if args.uid is not None else env["LDAP_UID"]
     run_gid = str(args.gid) if args.gid is not None else env["LDAP_GID"]
 
-    literal_env = {
+    literal_env = env | {
         "HOME": f"/home/{env['LDAP_USERNAME']}",
         "NB_USER": env["LDAP_USERNAME"],
         "NB_UID": run_uid,
@@ -184,10 +183,9 @@ def build_runai_command(
             "--extended-resource", "rdma/rdma=1"
         ])
 
-    add_env_flags(cmd, literal_env)
-    add_secret_env_flags(
+    add_env_flags(
         cmd,
-        env,
+        literal_env,
         secret_name,
         env.get("EXTRA_SECRET_KEYS", "").split(","),
     )

utils.py

@@ -1,4 +1,4 @@
-#!/usr/bin/python3
+v#!/usr/bin/python3
 
 """Utility helpers shared by the csub CLI entrypoint."""
 
@@ -143,24 +143,20 @@ def ensure_secret(env_path: Path, namespace: str, secret_name: str) -> None:
         sys.exit(f"kubectl failed to apply the secret:\n{exc.stderr}")
 
 
-def add_env_flags(cmd: List[str], values: Dict[str, str]) -> None:
+def add_env_flags(cmd: List[str], values: Dict[str, str], secret_name: str, extra_secret_keys: Iterable[str]) -> None:
+    secret_keys = set(SECRET_KEYS).union(k.strip() for k in extra_secret_keys if k.strip())
+    ignore_keys = {
+        "LDAP_UID",  # set automatically
+        "LDAP_GID",  # set automatically
+    }
     for key, value in values.items():
-        if value == "":
+        if value == "" or key in ignore_keys:
             continue
-        cmd.extend(["--environment", f"{key}={value}"])
-
-
-def add_secret_env_flags(
-    cmd: List[str],
-    env: Dict[str, str],
-    secret_name: str,
-    extra_secret_keys: Iterable[str],
-) -> None:
-    keys = set(SECRET_KEYS).union(k.strip() for k in extra_secret_keys if k.strip())
-    for key in sorted(keys):
-        if key not in env or env[key] == "":
-            continue
-        cmd.extend(["--environment", f"{key}=SECRET:{secret_name},{key}"])
+
+        if key in secret_keys:
+            cmd.extend(["--environment", f"{key}=SECRET:{secret_name},{key}"])
+        else:
+            cmd.extend(["--environment", f"{key}={value}"])
 
 
 __all__ = [