From 80e053988fcd7f45c4e297a416e4915d7a73804a Mon Sep 17 00:00:00 2001 From: codex Date: Mon, 28 Sep 2026 15:56:50 +0200 Subject: [PATCH] fix(security): prevent ESO copying source annotations (CUST-WP-0073) Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da --- .../core-hub.externalsecrets.yaml | 15 +++++++++++++++ .../keycape-approval-clients.externalsecrets.yaml | 6 ++++++ .../openbao-secretstore/sitting-requester.yaml | 3 +++ .../openbao-secretstore/t03-requester.yaml | 3 +++ manifests/factory-audit-senders.yaml | 12 ++++++++++++ manifests/keycape-factor-custody.yaml | 5 +++++ openbao/state-hub-preflight/delivery.yaml | 3 +++ 7 files changed, 47 insertions(+) diff --git a/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml b/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml index 4511bdb..8a4ecdc 100644 --- a/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml +++ b/argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml @@ -13,6 +13,9 @@ spec: kind: ClusterSecretStore name: openbao-core-hub-runtime target: + # Explicit target metadata prevents ESO copying source last-applied annotations. + template: + metadata: {} name: core-hub-api-token creationPolicy: Owner deletionPolicy: Retain @@ -33,6 +36,9 @@ spec: kind: ClusterSecretStore name: openbao-core-hub-database target: + # Explicit target metadata prevents ESO copying source last-applied annotations. + template: + metadata: {} name: core-hub-runtime-database creationPolicy: Owner deletionPolicy: Retain @@ -52,6 +58,9 @@ spec: kind: ClusterSecretStore name: openbao-core-hub-database target: + # Explicit target metadata prevents ESO copying source last-applied annotations. + template: + metadata: {} name: core-hub-migration-database creationPolicy: Owner deletionPolicy: Retain @@ -70,6 +79,9 @@ spec: kind: ClusterSecretStore name: openbao-core-hub-database target: + # Explicit target metadata prevents ESO copying source last-applied annotations. + template: + metadata: {} name: hub-core-runtime-database creationPolicy: Owner deletionPolicy: Retain @@ -88,6 +100,9 @@ spec: kind: ClusterSecretStore name: openbao-core-hub-database target: + # Explicit target metadata prevents ESO copying source last-applied annotations. + template: + metadata: {} name: hub-core-migration-database creationPolicy: Owner deletionPolicy: Retain diff --git a/argocd/platform-addons/openbao-secretstore/keycape-approval-clients.externalsecrets.yaml b/argocd/platform-addons/openbao-secretstore/keycape-approval-clients.externalsecrets.yaml index d70490d..182162c 100644 --- a/argocd/platform-addons/openbao-secretstore/keycape-approval-clients.externalsecrets.yaml +++ b/argocd/platform-addons/openbao-secretstore/keycape-approval-clients.externalsecrets.yaml @@ -18,6 +18,9 @@ spec: kind: ClusterSecretStore name: openbao-keycape-secrets-engine-approval target: + # Explicit target metadata prevents ESO copying source last-applied annotations. + template: + metadata: {} name: keycape-secrets-engine-approval-client creationPolicy: Owner deletionPolicy: Retain @@ -38,6 +41,9 @@ spec: kind: ClusterSecretStore name: openbao-keycape-approval-engine-operator target: + # Explicit target metadata prevents ESO copying source last-applied annotations. + template: + metadata: {} name: keycape-approval-engine-operator-client creationPolicy: Owner deletionPolicy: Retain diff --git a/argocd/platform-addons/openbao-secretstore/sitting-requester.yaml b/argocd/platform-addons/openbao-secretstore/sitting-requester.yaml index 059791e..1e10710 100644 --- a/argocd/platform-addons/openbao-secretstore/sitting-requester.yaml +++ b/argocd/platform-addons/openbao-secretstore/sitting-requester.yaml @@ -37,6 +37,9 @@ spec: kind: ClusterSecretStore name: openbao-keycape-informed-decision-sitting-requester target: + # Explicit target metadata prevents ESO copying source last-applied annotations. + template: + metadata: {} name: keycape-informed-decision-sitting-requester-client creationPolicy: Owner deletionPolicy: Retain diff --git a/argocd/platform-addons/openbao-secretstore/t03-requester.yaml b/argocd/platform-addons/openbao-secretstore/t03-requester.yaml index 6649864..3b65159 100644 --- a/argocd/platform-addons/openbao-secretstore/t03-requester.yaml +++ b/argocd/platform-addons/openbao-secretstore/t03-requester.yaml @@ -34,6 +34,9 @@ spec: kind: ClusterSecretStore name: openbao-keycape-secrets-engine-requester target: + # Explicit target metadata prevents ESO copying source last-applied annotations. + template: + metadata: {} name: keycape-secrets-engine-requester-client creationPolicy: Owner deletionPolicy: Retain diff --git a/manifests/factory-audit-senders.yaml b/manifests/factory-audit-senders.yaml index 92de187..e9e3e89 100644 --- a/manifests/factory-audit-senders.yaml +++ b/manifests/factory-audit-senders.yaml @@ -37,6 +37,12 @@ spec: kind: ClusterSecretStore name: openbao-approval-engine-audit target: + # Explicit target metadata prevents ESO copying source last-applied annotations. + template: + metadata: + annotations: + railiance.io/credential-change: CCR-2026-0021 + railiance.io/admission: approved name: approval-engine-audit creationPolicy: Owner deletionPolicy: Retain @@ -84,6 +90,12 @@ spec: kind: ClusterSecretStore name: openbao-informed-decision-audit target: + # Explicit target metadata prevents ESO copying source last-applied annotations. + template: + metadata: + annotations: + railiance.io/credential-change: CCR-2026-0022 + railiance.io/admission: approved name: informed-decision-audit creationPolicy: Owner deletionPolicy: Retain diff --git a/manifests/keycape-factor-custody.yaml b/manifests/keycape-factor-custody.yaml index 9ef5ad9..bd28964 100644 --- a/manifests/keycape-factor-custody.yaml +++ b/manifests/keycape-factor-custody.yaml @@ -52,6 +52,11 @@ spec: kind: ClusterSecretStore name: openbao-keycape-factor-read target: + # Explicit target metadata prevents ESO copying source last-applied annotations. + template: + metadata: + labels: + app.kubernetes.io/part-of: net-kingdom-sso-mfa name: keycape-factor-read creationPolicy: Owner data: diff --git a/openbao/state-hub-preflight/delivery.yaml b/openbao/state-hub-preflight/delivery.yaml index 81fc654..d0939d3 100644 --- a/openbao/state-hub-preflight/delivery.yaml +++ b/openbao/state-hub-preflight/delivery.yaml @@ -35,6 +35,9 @@ spec: name: openbao-state-hub-rename-preflight kind: SecretStore target: + # Explicit target metadata prevents ESO copying source last-applied annotations. + template: + metadata: {} name: state-hub-rename-preflight creationPolicy: Owner deletionPolicy: Retain