Ensures listing secrets excludes deleted secrets without content.

cache_test.go

@@ -333,6 +333,7 @@ func TestCacheSecretListUsesClientOverCache(t *testing.T) {
 	list := cache.SecretList()
 	assert.Len(list, 2)
 	assert.Contains(list, *fixture1)
+	assert.Contains(list, *fixture2)
 	assert.Equal(2, cache.Len())
 
 	// Advance clock, cache should now have only 1 element

secretmap.go

@@ -113,10 +113,13 @@ func (m *SecretMap) Replace(m2 *SecretMap) {
 	// Delete existing entries
 	expire := m.getNow().Add(m.timeouts.DeletionDelay)
 	for k, v := range m.m {
-		if v.ttl.IsZero() {
+		// Only hold on to secrets which actually have data.
+		if len(v.Secret.Content) == 0 {
+			delete(m.m, k)
+		} else if v.ttl.IsZero() {
 			v.ttl = expire
+			m.m[k] = v
 		}
-		m.m[k] = v
 	}
 
 	// Replace values with data from m2