From 53dcd0121925d9bc13edc3f07efc7a1775c14917 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Mon, 28 Sep 2026 15:56:50 +0200
Subject: [PATCH] fix(security): prevent ESO copying source annotations
 (CUST-WP-0073)

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da
---
 manifests/forgejo-mailer-externalsecret.yaml        | 6 ++++++
 manifests/reuse-surface-runtime-externalsecret.yaml | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/manifests/forgejo-mailer-externalsecret.yaml b/manifests/forgejo-mailer-externalsecret.yaml
index 4585bc1..9d00922 100644
--- a/manifests/forgejo-mailer-externalsecret.yaml
+++ b/manifests/forgejo-mailer-externalsecret.yaml
@@ -21,6 +21,12 @@ spec:
     kind: ClusterSecretStore
     name: openbao-forgejo
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/name: forgejo
+          app.kubernetes.io/part-of: railiance-apps
     name: forgejo-mailer
     creationPolicy: Owner
   data:
diff --git a/manifests/reuse-surface-runtime-externalsecret.yaml b/manifests/reuse-surface-runtime-externalsecret.yaml
index ece02cb..6239f45 100644
--- a/manifests/reuse-surface-runtime-externalsecret.yaml
+++ b/manifests/reuse-surface-runtime-externalsecret.yaml
@@ -22,6 +22,12 @@ spec:
     kind: ClusterSecretStore
     name: openbao-reuse
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/name: reuse-surface
+          app.kubernetes.io/part-of: railiance-apps
     name: reuse-surface-env
     creationPolicy: Owner
   data: