From f0dff91eb53cf4f29bc28ff6804a41aea07abe88 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Mon, 28 Sep 2026 15:56:50 +0200
Subject: [PATCH] fix(security): prevent ESO copying source annotations
 (CUST-WP-0073)

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da
---
 deploy/externalsecret-senders.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/deploy/externalsecret-senders.yaml b/deploy/externalsecret-senders.yaml
index de3ccab..dec7381 100644
--- a/deploy/externalsecret-senders.yaml
+++ b/deploy/externalsecret-senders.yaml
@@ -13,6 +13,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-audit-core
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: audit-core-senders
     creationPolicy: Owner
     deletionPolicy: Retain