Loki writes its config file containing values from environment variables

[gthieleb]

Describe the bug

Loki writes config with values from environment variables.

To Reproduce

1. Started Loki 3.1.0 with "config.expand-env" Param.
2. Config.yaml contains variables that are defined in the system

The configuration is expanded by loki and written back to the filesystem. This exposes all variable contents including sensitive values. This also means that the configmap has the content of the config.yaml containing sensitive data.

Expected behavior

Loki should substitute parameters with values from the environment and initialize the service without writing a config file. This is the default in other services like quarkus, spring where a config value can easily replaced by a environment variable.

Environment:

• Infrastructure: Baremetal, Kubernetes

[gthieleb]

After investigating the code i can't find a direct evidence that the config file is written by loki back to the filesystem.

I will check if the issue that env vars in the config file are replaced by values is due to my local helm setup (helm plugins, ...)