fix(security): prevent ESO copying source annotations (CUST-WP-0073)

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da

argocd/platform-addons/openbao-secretstore/core-hub.externalsecrets.yaml

@@ -13,6 +13,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-core-hub-runtime
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: core-hub-api-token
     creationPolicy: Owner
     deletionPolicy: Retain
@@ -33,6 +36,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-core-hub-database
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: core-hub-runtime-database
     creationPolicy: Owner
     deletionPolicy: Retain
@@ -52,6 +58,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-core-hub-database
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: core-hub-migration-database
     creationPolicy: Owner
     deletionPolicy: Retain
@@ -70,6 +79,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-core-hub-database
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: hub-core-runtime-database
     creationPolicy: Owner
     deletionPolicy: Retain
@@ -88,6 +100,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-core-hub-database
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: hub-core-migration-database
     creationPolicy: Owner
     deletionPolicy: Retain

argocd/platform-addons/openbao-secretstore/keycape-approval-clients.externalsecrets.yaml

@@ -18,6 +18,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-keycape-secrets-engine-approval
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: keycape-secrets-engine-approval-client
     creationPolicy: Owner
     deletionPolicy: Retain
@@ -38,6 +41,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-keycape-approval-engine-operator
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: keycape-approval-engine-operator-client
     creationPolicy: Owner
     deletionPolicy: Retain

argocd/platform-addons/openbao-secretstore/sitting-requester.yaml

@@ -37,6 +37,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-keycape-informed-decision-sitting-requester
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: keycape-informed-decision-sitting-requester-client
     creationPolicy: Owner
     deletionPolicy: Retain

argocd/platform-addons/openbao-secretstore/t03-requester.yaml

@@ -34,6 +34,9 @@ spec:
     kind: ClusterSecretStore
     name: openbao-keycape-secrets-engine-requester
   target:
+    # Explicit target metadata prevents ESO copying source last-applied annotations.
+    template:
+      metadata: {}
     name: keycape-secrets-engine-requester-client
     creationPolicy: Owner
     deletionPolicy: Retain