feat: add envVars field for Workbench, Connect, and Package Manager

api/core/v1beta1/connect_types.go

@@ -84,8 +84,15 @@ type ConnectSpec struct {
 	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
 
 	// AddEnv adds arbitrary environment variables to the container env
+	//
+	// Deprecated: use envVars instead. If the same variable name is set in both
+	// addEnv and envVars, envVars takes precedence: it is rendered after addEnv,
+	// and Kubernetes resolves a duplicate env var name to the last occurrence.
 	AddEnv map[string]string `json:"addEnv,omitempty"`
 
+	// EnvVars adds environment variables to the container, supporting valueFrom (e.g. secretKeyRef).
+	EnvVars []corev1.EnvVar `json:"envVars,omitempty"`
+
 	OffHostExecution bool `json:"offHostExecution,omitempty"`
 
 	// AdditionalRuntimeImages specifies additional runtime images to append to the defaults

api/core/v1beta1/packagemanager_types.go

@@ -43,8 +43,15 @@ type PackageManagerSpec struct {
 	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
 
 	// AddEnv adds arbitrary environment variables to the container env
+	//
+	// Deprecated: use envVars instead. If the same variable name is set in both
+	// addEnv and envVars, envVars takes precedence: it is rendered after addEnv,
+	// and Kubernetes resolves a duplicate env var name to the last occurrence.
 	AddEnv map[string]string `json:"addEnv,omitempty"`
 
+	// EnvVars adds environment variables to the container, supporting valueFrom (e.g. secretKeyRef).
+	EnvVars []v1.EnvVar `json:"envVars,omitempty"`
+
 	Image string `json:"image,omitempty"`
 
 	ImagePullPolicy v1.PullPolicy `json:"imagePullPolicy,omitempty"`

api/core/v1beta1/site_types.go

@@ -213,8 +213,13 @@ type InternalPackageManagerSpec struct {
 
 	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
 
+	// Deprecated: use envVars instead. If the same variable name is set in both
+	// addEnv and envVars, envVars takes precedence: it is rendered after addEnv,
+	// and Kubernetes resolves a duplicate env var name to the last occurrence.
 	AddEnv map[string]string `json:"addEnv,omitempty"`
 
+	EnvVars []corev1.EnvVar `json:"envVars,omitempty"`
+
 	Image string `json:"image,omitempty"`
 
 	ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"`
@@ -281,8 +286,13 @@ type InternalConnectSpec struct {
 	// when they first log in via OAuth2/OIDC. Only applies when auth type is "oidc".
 	RegisterOnFirstLogin *bool `json:"registerOnFirstLogin,omitempty"`
 
+	// Deprecated: use envVars instead. If the same variable name is set in both
+	// addEnv and envVars, envVars takes precedence: it is rendered after addEnv,
+	// and Kubernetes resolves a duplicate env var name to the last occurrence.
 	AddEnv map[string]string `json:"addEnv,omitempty"`
 
+	EnvVars []corev1.EnvVar `json:"envVars,omitempty"`
+
 	Image string `json:"image,omitempty"`
 
 	SessionImage string `json:"sessionImage,omitempty"`
@@ -414,8 +424,13 @@ type InternalWorkbenchSpec struct {
 	// If not specified, no superuser groups will be configured
 	AdminSuperuserGroups []string `json:"adminSuperuserGroups,omitempty"`
 
+	// Deprecated: use envVars instead. If the same variable name is set in both
+	// addEnv and envVars, envVars takes precedence: it is rendered after addEnv,
+	// and Kubernetes resolves a duplicate env var name to the last occurrence.
 	AddEnv map[string]string `json:"addEnv,omitempty"`
 
+	EnvVars []corev1.EnvVar `json:"envVars,omitempty"`
+
 	Auth AuthSpec `json:"auth,omitempty"`
 
 	Image string `json:"image,omitempty"`

api/core/v1beta1/workbench_types.go

@@ -61,8 +61,15 @@ type WorkbenchSpec struct {
 	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
 
 	// AddEnv adds arbitrary environment variables to the container env
+	//
+	// Deprecated: use envVars instead. If the same variable name is set in both
+	// addEnv and envVars, envVars takes precedence: it is rendered after addEnv,
+	// and Kubernetes resolves a duplicate env var name to the last occurrence.
 	AddEnv map[string]string `json:"addEnv,omitempty"`
 
+	// EnvVars adds environment variables to the container, supporting valueFrom (e.g. secretKeyRef).
+	EnvVars []corev1.EnvVar `json:"envVars,omitempty"`
+
 	OffHostExecution bool `json:"offHostExecution,omitempty"`
 
 	Image string `json:"image,omitempty"`