fix(security): prevent ESO copying source annotations (CUST-WP-0073)

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da

argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml

@@ -13,6 +13,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-core-hub-runtime
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: core-hub-api-token
     creationPolicy: Owner
     deletionPolicy: Retain
@@ -33,6 +36,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-core-hub-database
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: core-hub-runtime-database
     creationPolicy: Owner
     deletionPolicy: Retain
@@ -52,6 +58,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-core-hub-database
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: core-hub-migration-database
     creationPolicy: Owner
     deletionPolicy: Retain
@@ -70,6 +79,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-core-hub-database
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: hub-core-runtime-database
     creationPolicy: Owner
     deletionPolicy: Retain
@@ -88,6 +100,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-core-hub-database
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: hub-core-migration-database
     creationPolicy: Owner
     deletionPolicy: Retain

argocd/platform-addons/openbao-secretstore/keycape-approval-clients.externalsecrets.yaml

@@ -18,6 +18,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-keycape-secrets-engine-approval
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: keycape-secrets-engine-approval-client
     creationPolicy: Owner
     deletionPolicy: Retain
@@ -38,6 +41,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-keycape-approval-engine-operator
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: keycape-approval-engine-operator-client
     creationPolicy: Owner
     deletionPolicy: Retain

argocd/platform-addons/openbao-secretstore/sitting-requester.yaml

@@ -37,6 +37,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-keycape-informed-decision-sitting-requester
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: keycape-informed-decision-sitting-requester-client
     creationPolicy: Owner
     deletionPolicy: Retain

argocd/platform-addons/openbao-secretstore/t03-requester.yaml

@@ -34,6 +34,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-keycape-secrets-engine-requester
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: keycape-secrets-engine-requester-client
     creationPolicy: Owner
     deletionPolicy: Retain

manifests/factory-audit-senders.yaml

@@ -37,6 +37,12 @@ spec:
     kind: ClusterSecretStore
     name: openbao-approval-engine-audit
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        annotations:
+          railiance.io/credential-change: CCR-2026-0021
+          railiance.io/admission: approved
     name: approval-engine-audit
     creationPolicy: Owner
     deletionPolicy: Retain
@@ -84,6 +90,12 @@ spec:
     kind: ClusterSecretStore
     name: openbao-informed-decision-audit
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        annotations:
+          railiance.io/credential-change: CCR-2026-0022
+          railiance.io/admission: approved
     name: informed-decision-audit
     creationPolicy: Owner
     deletionPolicy: Retain

manifests/keycape-factor-custody.yaml

@@ -52,6 +52,11 @@ spec:
     kind: ClusterSecretStore
     name: openbao-keycape-factor-read
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata:
+        labels:
+          app.kubernetes.io/part-of: net-kingdom-sso-mfa
     name: keycape-factor-read
     creationPolicy: Owner
   data:

openbao/state-hub-preflight/delivery.yaml

@@ -35,6 +35,9 @@ spec:
     name: openbao-state-hub-rename-preflight
     kind: SecretStore
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: state-hub-rename-preflight
     creationPolicy: Owner
     deletionPolicy: Retain