From f782de3320ef64db2187b29826d5079a515feb09 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 18 Oct 2026 13:08:03 +0200 Subject: [PATCH] MAS-WP-0003: explicit ExternalSecret target metadata (reject-secret-last-applied) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 252470@bnt-lap001 Assistant-Session: ad628c8f-4be2-4979-94c9-76c7ed6f8241 --- deploy/railiance/manifests.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/deploy/railiance/manifests.yaml b/deploy/railiance/manifests.yaml index a15797d..3c31c69 100644 --- a/deploy/railiance/manifests.yaml +++ b/deploy/railiance/manifests.yaml @@ -48,7 +48,14 @@ metadata: {name: mas-relay, namespace: mas} spec: refreshInterval: 1h secretStoreRef: {name: openbao-mas-tem-relay, kind: SecretStore} - target: {name: mas-relay, creationPolicy: Owner} + target: + name: mas-relay + creationPolicy: Owner + # Explicit target metadata stops ESO copying the last-applied annotation, + # which policy reject-secret-last-applied forbids on Secrets. + template: + metadata: + labels: {app.kubernetes.io/name: mas-mx} data: - {secretKey: username, remoteRef: {key: suppliers/scaleway/mas-tem-relay, property: username}} - {secretKey: password, remoteRef: {key: suppliers/scaleway/mas-tem-relay, property: password}}