Missing secret env when merging two deploy.yml files

[jrodriigues]

I am using kamal to deploy a rails 8 application. I have a custom environment, staging, and created the respective config/deploy.staging.yml configuration file.

This is my config/deploy.yml env settings:

env:
  clear:
    RAILS_ENV: production
  secret:
    - RAILS_MASTER_KEY

And this is my config/deploy.staging.yml:

env:
  clear:
    RAILS_ENV: staging
  secret:
    - DATABASE_URL

When deploying with kamal deploy -d staging, I would expect that the secret envs would be merged, ending up with RAILS_MASTER_KEY and DATABASE_URL in my container. However, that's not the case.

When I run the above command, the deployment fails with the following error:

2026-01-08T16:46:03.487349794Z ArgumentError: Missing `secret_key_base` for 'staging' environment, set this string with `bin/rails credentials:edit` (ArgumentError)
2026-01-08T16:46:03.487360669Z
2026-01-08T16:46:03.487364601Z           raise ArgumentError, "Missing `secret_key_base` for '#{Rails.env}' environment, set this string with `bin/rails credentials:edit`"
2026-01-08T16:46:03.487368438Z                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2026-01-08T16:46:03.487371979Z /rails/config/environment.rb:5:in `<main>'

If I add the RAILS_MASTER_KEY explicitly to config/deploy.staging/yml and alongside DATABASE_URL, then the deployment works as expected.

Is this expected behaviour? I couldn't find any documentation that supports it.

Versions:

• kamal 2.10.1
• rails 8.0.4
• ruby 3.3.10

[jrodriigues]

Worth mentioning that I have tried replacing .kamal/secrets with .kamal/secrets-common but had the same output.

[jrodriigues]

I believe the issue is on this function:

# lib/kamal/configuration.rb

def load_config_files(*files)
  files.inject({}) { |config, file| config.deep_merge! load_config_file(file) }
end

According to the docs, deep_merge! will only apply merge! recursively.
There is a limitation though, that if the value is an array, only the later value will be used instead of both arrays being concatenated, and this is exactly what's happening when the secret key is deep merged.

For example:

require 'active_support/core_ext/hash'

a = {
  "env": {"clear":{"RAILS_ENV": "staging"}, "secret": ["foo"]}
}

b = {
  "env": {"clear":{"ANOTHER_ENV": "value"}, "secret": ["bar"]}
}

p a.deep_merge! b # {:env=>{:clear=>{:RAILS_ENV=>"staging", :ANOTHER_ENV=>"value"}, :secret=>["bar"]}


c = {
  "secret": ["foo"]
}

d = {
  "secret": ["bar"]
}

p c.merge! d # {:secret=>["bar"]}

In my scenario, these are the env keys being merged:

# .kamal/secrets
:env=>{"clear"=>{"RAILS_ENV"=>"staging"}, "secret"=>["RAILS_MASTER_KEY"]}

# .kamal/secrets.staging
:env=>{"clear"=>{"RAILS_ENV"=>"staging"}, "secret"=>["DATABASE_URL"]}

Only the latter will remain.
Not sure if you would still consider this a bug, or just need to add some documentation on what this limitation is. If so, I wouldn't mind working on a possible workaround for it.