audit-core/deploy/externalsecret-senders.yaml
tegwick f0dff91eb5
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
CI Smoke / container-smoke (push) Successful in 5s
fix(security): prevent ESO copying source annotations (CUST-WP-0073)
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da
2026-09-28 15:56:50 +02:00

26 lines
762 B
YAML

# Apply only after ops-mason wrap-migrate has filled
# platform/workloads/audit-core/senders. Until then the sender registry is
# Secret audit-core-senders, minted in-cluster (see operator-runbook).
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: audit-core-senders
namespace: audit-core
spec:
refreshInterval: 1h
secretStoreRef:
kind: ClusterSecretStore
name: openbao-audit-core
target:
# Explicit target metadata prevents ESO copying source last-applied annotations.
template:
metadata: {}
name: audit-core-senders
creationPolicy: Owner
deletionPolicy: Retain
data:
- secretKey: senders.json
remoteRef:
key: workloads/audit-core/senders
property: senders.json