fix(security): prevent ESO copying source annotations (CUST-WP-0073)

Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da
2026-09-28 15:56:50 +02:00 · 2026-09-28 15:56:50 +02:00 · f0dff91eb5
commit f0dff91eb5
parent 3e42ca8ffb
1 changed files with 3 additions and 0 deletions
--- a/deploy/externalsecret-senders.yaml
+++ b/deploy/externalsecret-senders.yaml
@ -13,6 +13,9 @@ spec:
    kind: ClusterSecretStore
    name: openbao-audit-core
  target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
    name: audit-core-senders
    creationPolicy: Owner
    deletionPolicy: Retain